From ad36cb7205bcb1783c2cb0101f7e46048c203340 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Wed, 11 Nov 2026 09:44:25 -0500
Subject: [PATCH 1/9] feat(pr-pipeline): stop lanes at their start gate on a
 low GITHUB_TOKEN budget

check-kill-switch now gates on the GITHUB_TOKEN budget as well as the two
manual switches. With both switches off it makes one GET /rate_limit with
the job's token, reads the core pool from the x-ratelimit-* headers (else
the body's resources.core), and stops the lane while remaining is under
limits.api github-token start-gate (default 0.1) of the limit and the reset
is ahead. A failed read proceeds with a warning. Each switch also accepts
true@<UTC time>, which stops until that time. Every stop keeps
reason=kill-switch; a new cause output names switch, expiry, budget or ok.

The read runner marks a budget stop with a top-level step, so work-unblock's
sweep tells it apart from the job listing alone: it re-fires such a run on
the next sweep, and its record never counts toward
limits.limit-stops-per-issue or the flat kill-switch wait.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q1HHi6JACp77x2ZbE7
---
 ...-kill-switch-start-gate-budget-16d00f6e.md |   7 +
 .github/actions/check-kill-switch/README.md   |  37 ++-
 .github/actions/check-kill-switch/action.yml  |  30 ++-
 .../check-kill-switch/check-kill-switch.mjs   | 135 +++++++++-
 .../check-kill-switch.test.mjs                | 251 +++++++++++++++++-
 .github/actions/log-api-budget/rate-guard.mjs |   7 +-
 .../actions/log-api-budget/rate-limits.json   |   2 +-
 .../scripts/work-unblock/label-unblocked.mjs  |  53 ++--
 .../work-unblock/label-unblocked.test.mjs     |  76 ++++++
 .github/workflows/pr-run-activity-read.yml    |  12 +
 docs/conventions/pr-pipeline.yaml             |   4 +-
 docs/conventions/pr-pipeline/README.md        |   2 +-
 .../pr-pipeline/pr-pipeline.schema.json       |   6 +
 13 files changed, 563 insertions(+), 59 deletions(-)
 create mode 100644 .changes/pr-pipeline/feat-kill-switch-start-gate-budget-16d00f6e.md

diff --git a/.changes/pr-pipeline/feat-kill-switch-start-gate-budget-16d00f6e.md b/.changes/pr-pipeline/feat-kill-switch-start-gate-budget-16d00f6e.md
new file mode 100644
index 00000000000..29cb22566c8
--- /dev/null
+++ b/.changes/pr-pipeline/feat-kill-switch-start-gate-budget-16d00f6e.md
@@ -0,0 +1,7 @@
+---
+bump: minor
+---
+
+### Added
+
+- `limits.api.github-token.start-gate`, a share of the header's `x-ratelimit-limit` (default 0.1, in `.github/actions/log-api-budget/rate-limits.json`). The kill-switch gate (`.github/actions/check-kill-switch`) now also stops a lane at its start while the GITHUB_TOKEN core pool's remaining is under that share and the reset is still ahead, from one GET /rate_limit with the job's token (its `x-ratelimit-*` headers, else the body's `resources.core`). The stop keeps `reason=kill-switch`; a new `cause` output says `switch`, `expiry`, `budget` or `ok`. A failed or unreadable read proceeds with a warning. Each switch variable also accepts `true@<UTC time>`, which stops until that time. work-unblock's sweep re-fires a budget-stopped issue run on its next sweep and never counts it toward `limits.limit-stops-per-issue`.
diff --git a/.github/actions/check-kill-switch/README.md b/.github/actions/check-kill-switch/README.md
index b1d5a59d9fb..d33c3309010 100644
--- a/.github/actions/check-kill-switch/README.md
+++ b/.github/actions/check-kill-switch/README.md
@@ -1,10 +1,33 @@
 # check-kill-switch
 
-Gate a CI lane on the org and repository kill switches before its model step. The lane proceeds
-only when both read exactly `false`; a switch that is unset, empty or holds any other value stops
-it
+Gate a CI lane on the org and repository kill switches, then on the GITHUB_TOKEN budget, before
+its model step. Each switch proceeds only on exactly `false`, or on `true@<time>` once that time
+has passed; a switch that is unset, empty or holds any other value stops the lane
 ([ADR 0049](../../../docs/adr/0049-run-ci-lanes-on-github-hosted-runners-under-trigger-and-token-hardening.md)
-condition 4).
+condition 4). Nothing writes the switches automatically: they are manual brakes.
+
+| Switch value | Gate |
+|---|---|
+| `false` | proceeds |
+| `true@2026-11-11T18:00:00Z` (UTC, seconds, `Z`) | stops until that time, then proceeds |
+| unset, empty, `true`, a malformed time, anything else | stops |
+
+The `true@<time>` form is this gate's alone. `merge-holds.mjs` `switchHold` and
+`babysit_merge_policy.py` still hold on any value but `false`, and the token broker reads the
+switches by its own rule, so a lapsed `true@<time>` can still hold those until someone sets
+`false`.
+
+With both switches proceeding, the gate makes one GET /rate_limit with `token` and reads the core
+pool from the `x-ratelimit-limit`, `-remaining` and `-reset` headers, or from the body's
+`resources.core` when a header is missing. It stops the lane while remaining is under
+`limits.api.github-token.start-gate` of the limit (default 0.1, in
+[`rate-limits.json`](../log-api-budget/rate-limits.json); `pr-pipeline.yaml` overrides it where
+the job's `RESOLVED_CONFIG` names a resolved config) and the reset is still ahead. A read that
+fails, times out or carries no reading proceeds with a warning; the rate guard's `stop-floor` is
+the backstop. GitHub counts GET /rate_limit against the secondary limit, not the primary one, so
+the gate makes it once, with no retry, and not at all when a switch already stops. Each read
+logs one `start-gate` notice with the body's core block and the response's rate-limit headers,
+so the two can be compared.
 
 The repository switch has its own name because a repository variable named
 `CLAUDE_LANES_DISABLED` replaces the org value in `vars`, so it could re-enable lanes under an
@@ -17,13 +40,15 @@ and a read lane's broker check, while one exists.
 |---|---|---|
 | `value` | empty | The org switch, normally `${{ vars.CLAUDE_LANES_DISABLED }}` |
 | `repo-value` | empty | The repository switch, normally `${{ vars.CLAUDE_LANES_REPO_DISABLED }}` |
+| `token` | `${{ github.token }}` | The token whose GET /rate_limit answer is the budget reading |
 
 ## Outputs
 
 | Output | Values |
 |---|---|
-| `proceed` | `true` only when `value` and `repo-value` are both exactly `false`; otherwise `false` |
-| `reason` | `ok` or `kill-switch` |
+| `proceed` | `true` when both switches proceed and the budget does not stop the lane; otherwise `false` |
+| `reason` | `ok` or `kill-switch`, for every stop |
+| `cause` | `ok`, `switch` (a switch stops), `expiry` (a `true@<time>` still ahead) or `budget` |
 
 The step always exits 0. A stopped lane is an expected outcome, not a failure.
 
diff --git a/.github/actions/check-kill-switch/action.yml b/.github/actions/check-kill-switch/action.yml
index beb5ec1aeab..83b0d0052a2 100644
--- a/.github/actions/check-kill-switch/action.yml
+++ b/.github/actions/check-kill-switch/action.yml
@@ -1,25 +1,35 @@
 name: Check Kill Switch
 description: >
-  Gate a CI lane on the org and repository kill switches. Emits proceed=true
-  only when both values read exactly `false`; unset, empty and every other
-  value emit proceed=false reason=kill-switch. Always exits 0: the model
-  step's `if:` reads the output, so a missing output also keeps the lane
-  stopped.
+  Start gate for a CI lane: the org and repository kill switches, then the
+  GITHUB_TOKEN budget. Each switch proceeds only on exactly `false`;
+  `true@<UTC time>` stops until that time; unset, empty and every other value
+  stop. With both switches off, one GET /rate_limit stops the lane while the
+  core pool's remaining is under limits.api github-token start-gate of its
+  limit; a failed read proceeds. Every stop is proceed=false
+  reason=kill-switch, with cause switch, expiry or budget. Always exits 0:
+  the model step's `if:` reads the output, so a missing output also keeps the
+  lane stopped.
 
 inputs:
   value:
     description: >
       The org kill-switch value, normally `vars.CLAUDE_LANES_DISABLED`. Only
-      the exact string `false` lets the lane proceed.
+      `false`, or a `true@<UTC time>` already past, lets the lane proceed.
     required: false
     default: ""
   repo-value:
     description: >
       The repository kill-switch value, normally
-      `vars.CLAUDE_LANES_REPO_DISABLED`. Only the exact string `false` lets
-      the lane proceed.
+      `vars.CLAUDE_LANES_REPO_DISABLED`. Only `false`, or a
+      `true@<UTC time>` already past, lets the lane proceed.
     required: false
     default: ""
+  token:
+    description: >
+      The token whose GET /rate_limit answer is the budget reading. Defaults
+      to the job's GITHUB_TOKEN.
+    required: false
+    default: ${{ github.token }}
 
 outputs:
   proceed:
@@ -28,6 +38,9 @@ outputs:
   reason:
     description: "`ok` or `kill-switch`."
     value: ${{ steps.check.outputs.reason }}
+  cause:
+    description: "`ok`, or why the lane stopped: `switch`, `expiry` or `budget`."
+    value: ${{ steps.check.outputs.cause }}
 
 runs:
   using: composite
@@ -38,4 +51,5 @@ runs:
       env:
         KILL_SWITCH_VALUE: ${{ inputs.value }}
         REPO_KILL_SWITCH_VALUE: ${{ inputs.repo-value }}
+        BUDGET_TOKEN: ${{ inputs.token }}
       run: node "$GITHUB_ACTION_PATH/check-kill-switch.mjs"
diff --git a/.github/actions/check-kill-switch/check-kill-switch.mjs b/.github/actions/check-kill-switch/check-kill-switch.mjs
index fef147ea99f..825b457e731 100644
--- a/.github/actions/check-kill-switch/check-kill-switch.mjs
+++ b/.github/actions/check-kill-switch/check-kill-switch.mjs
@@ -1,15 +1,118 @@
-// Kill-switch gate for CI lanes: proceed only when the org switch and the
-// repository switch both read exactly `false`. Unset, empty and every other
-// value stop the lane (fail closed).
+// Start gate for CI lanes. Two manual switches, then the GITHUB_TOKEN budget:
+//
+// - The org switch and the repository switch each proceed only on exactly
+//   `false`. `true@<time>` (`true@2026-11-11T18:00:00Z`, UTC, seconds, `Z`)
+//   stops until that time and then proceeds; any other value, a malformed time
+//   included, stops (fail closed).
+// - With both switches proceeding, one GET /rate_limit with the job's token
+//   reads the core pool: x-ratelimit-limit, -remaining and -reset when the
+//   response carries all three, else the body's resources.core. The lane stops
+//   while remaining < limits.api github-token start-gate x limit and the reset
+//   is still ahead. A read that fails or cannot be read proceeds with a
+//   warning; the rate guard's stop-floor (log-api-budget/rate-guard.mjs) is
+//   the backstop. GitHub counts this call against the secondary limit, not the
+//   primary one, so it is made once, with no retry.
+//
+// Every stop is reason=kill-switch; cause says which: switch, expiry (a
+// `true@<time>` still ahead), budget, or ok when the lane proceeds.
 import { randomUUID } from "node:crypto";
 import { appendFileSync } from "node:fs";
 import process from "node:process";
 import { pathToFileURL } from "node:url";
 
-export function checkKillSwitch(value, repoValue) {
-  return value === "false" && repoValue === "false"
-    ? { proceed: "true", reason: "ok" }
-    : { proceed: "false", reason: "kill-switch" };
+// rate-limits.json's github-token start-gate, used when log-api-budget is not
+// in the job's checkout (check-kill-switch.test.mjs holds the two equal).
+export const START_GATE_SHARE = 0.1;
+const READ_TIMEOUT_MS = 10_000;
+const TIMED = /^true@(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\dZ)$/;
+
+// One switch value at `now` (ms): ok, switch, or expiry while its time is ahead.
+export function switchCause(value, now = Date.now()) {
+  if (value === "false") {
+    return "ok";
+  }
+  const time = TIMED.exec(value ?? "")?.[1];
+  const until = time ? Date.parse(time) : Number.NaN;
+  // Date.parse rolls 2026-02-30 over to March; only a real date round-trips.
+  if (!Number.isFinite(until) || new Date(until).toISOString() !== time.replace("Z", ".000Z")) {
+    return "switch";
+  }
+  return now < until ? "expiry" : "ok";
+}
+
+export function checkKillSwitch(value, repoValue, now = Date.now()) {
+  const causes = [switchCause(value, now), switchCause(repoValue, now)];
+  const cause = causes.includes("switch") ? "switch" : causes.includes("expiry") ? "expiry" : "ok";
+  return cause === "ok" ? { proceed: "true", reason: "ok", cause } : { proceed: "false", reason: "kill-switch", cause };
+}
+
+// Whether `reading` ({ limit, remaining, reset }, reset in epoch seconds) is
+// under `share` of its limit with its reset after `now` (epoch seconds).
+// Anything unreadable never stops.
+export function budgetStops({ limit, remaining, reset } = {}, share, now) {
+  return [limit, remaining, reset, share].every(Number.isFinite) && limit > 0 && reset > now && remaining < share * limit;
+}
+
+const HEADERS = ["limit", "remaining", "reset", "used", "resource"];
+
+// The reading from one GET /rate_limit response: its headers when limit,
+// remaining and reset all parse, else the body's resources.core.
+export function readingOf(headers, body) {
+  const header = Object.fromEntries(HEADERS.map((name) => [name, headers?.get?.(`x-ratelimit-${name}`) ?? null]));
+  const fromHeaders = Object.fromEntries(["limit", "remaining", "reset"].map((name) => [name, /^\d+$/.test(header[name] ?? "") ? Number(header[name]) : Number.NaN]));
+  const core = body?.resources?.core ?? null;
+  const reading = Object.values(fromHeaders).every(Number.isFinite)
+    ? { ...fromHeaders, source: "headers" }
+    : { limit: Number(core?.limit), remaining: Number(core?.remaining), reset: Number(core?.reset), source: "body" };
+  return { reading, header, core };
+}
+
+// A value from a response, kept to one line with no workflow command in it.
+const clean = (text) => String(text).replace(/[\r\n%:]/g, " ");
+const show = (fields) => Object.entries(fields ?? {}).map(([name, value]) => `${name}=${clean(value ?? "na")}`).join(" ");
+
+// The budget half of the gate: { stop, line } where line is the run's one
+// notice or warning. Never throws.
+export async function checkBudget({ token, api = "https://api.github.com", share, now = Date.now() / 1000, fetchImpl = fetch } = {}) {
+  if (!token) {
+    return { stop: false, line: "::warning title=start-gate::no token to read the GITHUB_TOKEN budget; the lane proceeds" };
+  }
+  try {
+    const response = await fetchImpl(`${api}/rate_limit`, {
+      headers: { Accept: "application/vnd.github+json", Authorization: `Bearer ${token}`, "X-GitHub-Api-Version": "2022-11-28" },
+      signal: AbortSignal.timeout(READ_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+      throw new Error(`HTTP ${response.status}`);
+    }
+    const { reading, header, core } = readingOf(response.headers, await response.json().catch(() => null));
+    if (![reading.limit, reading.remaining, reading.reset].every(Number.isFinite)) {
+      throw new Error("neither the headers nor the body's resources.core carry limit, remaining and reset");
+    }
+    const stop = budgetStops(reading, share, now);
+    const coreFields = core && { limit: core.limit, remaining: core.remaining, reset: core.reset, used: core.used };
+    return {
+      stop,
+      line:
+        `::notice title=start-gate::github-token start-gate=${share} decided from ${reading.source}: limit=${reading.limit} remaining=${reading.remaining} reset=${reading.reset} stop=${stop}; ` +
+        `body core ${core ? show(coreFields) : "absent"}; headers ${show(header)}`,
+    };
+  } catch (error) {
+    return { stop: false, line: `::warning title=start-gate::the GITHUB_TOKEN budget was not read (${clean(error?.message ?? error)}); the lane proceeds` };
+  }
+}
+
+// limits.api github-token start-gate, from RESOLVED_CONFIG over rate-limits.json
+// (rate-guard.mjs apiLimitsOrBuiltIn), or START_GATE_SHARE when that module is
+// not in the job's checkout.
+async function startGateShare(resolvedPath, log) {
+  try {
+    const { apiLimitsOrBuiltIn } = await import(new URL("../log-api-budget/rate-guard.mjs", import.meta.url));
+    return apiLimitsOrBuiltIn({ resolvedPath: resolvedPath ?? "", log })["github-token"]["start-gate"] ?? START_GATE_SHARE;
+  } catch (error) {
+    log(`::warning title=start-gate::rate-guard.mjs could not be loaded (${clean(error?.code ?? error?.message)}); start-gate share ${START_GATE_SHARE}`);
+    return START_GATE_SHARE;
+  }
 }
 
 // Every value is written in the delimited form, so no value can start a
@@ -30,12 +133,20 @@ export function writeOutputs(outputs, outputPath = process.env.GITHUB_OUTPUT) {
   appendFileSync(outputPath, text);
 }
 
-function main() {
-  const result = checkKillSwitch(process.env.KILL_SWITCH_VALUE, process.env.REPO_KILL_SWITCH_VALUE);
-  writeOutputs(result);
-  console.log(`check-kill-switch: proceed=${result.proceed} reason=${result.reason}`);
+export async function main(env = process.env, { fetchImpl = fetch, now = Date.now, log = (line) => console.log(line) } = {}) {
+  let result = checkKillSwitch(env.KILL_SWITCH_VALUE, env.REPO_KILL_SWITCH_VALUE, now());
+  if (result.proceed === "true") {
+    const share = await startGateShare(env.RESOLVED_CONFIG, log);
+    const budget = await checkBudget({ token: env.BUDGET_TOKEN, api: env.GITHUB_API_URL || undefined, share, now: now() / 1000, fetchImpl });
+    log(budget.line);
+    if (budget.stop) {
+      result = { proceed: "false", reason: "kill-switch", cause: "budget" };
+    }
+  }
+  writeOutputs(result, env.GITHUB_OUTPUT);
+  log(`check-kill-switch: proceed=${result.proceed} reason=${result.reason} cause=${result.cause}`);
 }
 
 if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
-  main();
+  await main();
 }
diff --git a/.github/actions/check-kill-switch/check-kill-switch.test.mjs b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
index 8bf0c280894..c97d5b363ab 100644
--- a/.github/actions/check-kill-switch/check-kill-switch.test.mjs
+++ b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
@@ -1,15 +1,21 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { readFileSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { test } from "node:test";
 import { fileURLToPath } from "node:url";
 
-import { checkKillSwitch, writeOutputs } from "./check-kill-switch.mjs";
+import { budgetStops, checkBudget, checkKillSwitch, main, START_GATE_SHARE, switchCause, writeOutputs } from "./check-kill-switch.mjs";
 import { readOutputs } from "./fixtures/read-outputs.mjs";
 import { tempDir } from "../../../lib/test-tmp.mjs";
 
 const SCRIPT = fileURLToPath(new URL("./check-kill-switch.mjs", import.meta.url));
+const RATE_LIMITS = fileURLToPath(new URL("../log-api-budget/rate-limits.json", import.meta.url));
+
+// 2026-11-11T12:00:00Z.
+const NOW_MS = Date.parse("2026-11-11T12:00:00Z");
+const NOW_S = NOW_MS / 1000;
+const RESET = NOW_S + 1200;
 
 function runCli(env) {
   const dir = tempDir("kill-switch-");
@@ -20,14 +26,39 @@ function runCli(env) {
       env: { PATH: process.env.PATH, GITHUB_OUTPUT: outputPath, ...env },
       encoding: "utf8",
     });
-    return { status: result.status, outputs: readOutputs(readFileSync(outputPath, "utf8")) };
+    return { status: result.status, stdout: result.stdout, outputs: readOutputs(readFileSync(outputPath, "utf8")) };
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }
 }
 
+// A GET /rate_limit answer in the shape GitHub's REST docs give: a body with
+// resources.core, and x-ratelimit-* headers on the response.
+function rateLimitResponse({ headers = {}, core = null, status = 200 } = {}) {
+  const body = core ? { resources: { core }, rate: core } : {};
+  return new Response(JSON.stringify(body), { status, headers });
+}
+
+function recordingFetch(answer) {
+  const calls = [];
+  const fetchImpl = async (url, init) => {
+    calls.push({ url, init });
+    if (answer instanceof Error) throw answer;
+    return typeof answer === "function" ? answer() : answer;
+  };
+  return { calls, fetchImpl };
+}
+
+const headersOf = (limit, remaining, reset) => ({
+  "x-ratelimit-limit": String(limit),
+  "x-ratelimit-remaining": String(remaining),
+  "x-ratelimit-reset": String(reset),
+  "x-ratelimit-used": String(limit - remaining),
+  "x-ratelimit-resource": "core",
+});
+
 test("proceeds only when the org and the repository switch both read exactly false", () => {
-  assert.deepEqual(checkKillSwitch("false", "false"), { proceed: "true", reason: "ok" });
+  assert.deepEqual(checkKillSwitch("false", "false", NOW_MS), { proceed: "true", reason: "ok", cause: "ok" });
 });
 
 const NOT_FALSE = [
@@ -41,31 +72,229 @@ const NOT_FALSE = [
 for (const [label, value] of NOT_FALSE) {
   test(`stops when the org switch is ${label}, whatever the repository switch`, () => {
     for (const repo of ["false", "true", undefined]) {
-      assert.deepEqual(checkKillSwitch(value, repo), { proceed: "false", reason: "kill-switch" });
+      assert.deepEqual(checkKillSwitch(value, repo, NOW_MS), { proceed: "false", reason: "kill-switch", cause: "switch" });
     }
   });
 
   test(`stops when the repository switch is ${label} and the org switch is false`, () => {
-    assert.deepEqual(checkKillSwitch("false", value), { proceed: "false", reason: "kill-switch" });
+    assert.deepEqual(checkKillSwitch("false", value, NOW_MS), { proceed: "false", reason: "kill-switch", cause: "switch" });
+  });
+}
+
+test("true@<time> stops until that time and proceeds from it", () => {
+  assert.equal(switchCause("true@2026-11-11T12:00:01Z", NOW_MS), "expiry", "one second ahead");
+  assert.equal(switchCause("true@2026-11-11T12:00:00Z", NOW_MS), "ok", "at the time");
+  assert.equal(switchCause("true@2026-11-11T11:59:59Z", NOW_MS), "ok", "one second past");
+  assert.deepEqual(checkKillSwitch("true@2026-11-11T13:00:00Z", "false", NOW_MS), { proceed: "false", reason: "kill-switch", cause: "expiry" });
+  assert.deepEqual(checkKillSwitch("false", "true@2026-11-11T13:00:00Z", NOW_MS), { proceed: "false", reason: "kill-switch", cause: "expiry" });
+  assert.deepEqual(checkKillSwitch("true@2026-11-11T11:00:00Z", "true@2026-11-10T00:00:00Z", NOW_MS), { proceed: "true", reason: "ok", cause: "ok" });
+});
+
+const MALFORMED = [
+  ["no Z", "true@2026-11-11T13:00:00"],
+  ["an offset", "true@2026-11-11T13:00:00+00:00"],
+  ["no seconds", "true@2026-11-11T13:00Z"],
+  ["milliseconds", "true@2026-11-11T13:00:00.000Z"],
+  ["a day that does not exist", "true@2026-02-30T00:00:00Z"],
+  ["hour 24", "true@2026-11-11T24:00:00Z"],
+  ["TRUE in capitals", "TRUE@2026-11-11T13:00:00Z"],
+  ["false@", "false@2026-11-11T11:00:00Z"],
+  ["a past time with trailing text", "true@2026-11-11T11:00:00Z "],
+];
+
+for (const [label, value] of MALFORMED) {
+  test(`a timed switch with ${label} stops as a plain switch`, () => {
+    assert.equal(switchCause(value, NOW_MS), "switch");
   });
 }
 
-test("CLI writes proceed=true when both switches are exactly false and exits 0", () => {
-  const { status, outputs } = runCli({ KILL_SWITCH_VALUE: "false", REPO_KILL_SWITCH_VALUE: "false" });
+test("a plain switch wins over a timed one still ahead", () => {
+  assert.deepEqual(checkKillSwitch("true", "true@2026-11-11T13:00:00Z", NOW_MS), { proceed: "false", reason: "kill-switch", cause: "switch" });
+  assert.deepEqual(checkKillSwitch("true@2026-11-11T13:00:00Z", "", NOW_MS), { proceed: "false", reason: "kill-switch", cause: "switch" });
+});
+
+// share 0.1 of a limit of 5000 is 500.
+test("the budget stops under the share of the limit while the reset is ahead", () => {
+  const at = (remaining, reset = RESET) => budgetStops({ limit: 5000, remaining, reset }, 0.1, NOW_S);
+  assert.equal(at(499), true, "499 left, under 500");
+  assert.equal(at(0), true, "nothing left");
+  assert.equal(at(500), false, "500 left, at the share");
+  assert.equal(at(501), false, "501 left");
+  assert.equal(at(10, NOW_S), false, "reset now");
+  assert.equal(at(10, NOW_S - 1), false, "reset already past");
+  assert.equal(budgetStops({ limit: 5000, remaining: 0, reset: RESET }, 0, NOW_S), false, "share 0 is off");
+  assert.equal(budgetStops({ limit: Number.NaN, remaining: 0, reset: RESET }, 0.1, NOW_S), false, "no limit");
+});
+
+test("the budget read decides from the headers when they carry limit, remaining and reset", async () => {
+  // The body has plenty left; the headers, which GitHub says win, do not.
+  const answer = rateLimitResponse({ headers: headersOf(5000, 499, RESET), core: { limit: 5000, remaining: 4000, reset: RESET, used: 1000 } });
+  const { calls, fetchImpl } = recordingFetch(answer);
+  const result = await checkBudget({ token: "t", api: "https://api.example", share: 0.1, now: NOW_S, fetchImpl });
+  assert.equal(result.stop, true);
+  assert.equal(calls.length, 1, "exactly one call");
+  assert.equal(calls[0].url, "https://api.example/rate_limit");
+  assert.equal(calls[0].init.headers.Authorization, "Bearer t");
+  assert.equal(
+    result.line,
+    `::notice title=start-gate::github-token start-gate=0.1 decided from headers: limit=5000 remaining=499 reset=${RESET} stop=true; ` +
+      `body core limit=5000 remaining=4000 reset=${RESET} used=1000; headers limit=5000 remaining=499 reset=${RESET} used=4501 resource=core`,
+  );
+});
+
+test("the budget read proceeds at the share and above it", async () => {
+  for (const remaining of [500, 501]) {
+    const { fetchImpl } = recordingFetch(rateLimitResponse({ headers: headersOf(5000, remaining, RESET) }));
+    const result = await checkBudget({ token: "t", share: 0.1, now: NOW_S, fetchImpl });
+    assert.equal(result.stop, false, `${remaining} left`);
+    assert.match(result.line, /^::notice title=start-gate::.* stop=false; body core absent; /);
+  }
+});
+
+test("the budget read proceeds when the reset is already past", async () => {
+  const { fetchImpl } = recordingFetch(rateLimitResponse({ headers: headersOf(5000, 3, NOW_S - 5) }));
+  assert.equal((await checkBudget({ token: "t", share: 0.1, now: NOW_S, fetchImpl })).stop, false);
+});
+
+test("the budget read falls back to the body's resources.core when a header is missing", async () => {
+  const headers = headersOf(5000, 4999, RESET);
+  delete headers["x-ratelimit-remaining"];
+  const { fetchImpl } = recordingFetch(rateLimitResponse({ headers, core: { limit: 1000, remaining: 99, reset: RESET, used: 901 } }));
+  const result = await checkBudget({ token: "t", share: 0.1, now: NOW_S, fetchImpl });
+  assert.equal(result.stop, true, "99 of 1000 is under 100");
+  assert.match(result.line, /decided from body: limit=1000 remaining=99 /);
+  assert.match(result.line, /headers limit=5000 remaining=na /);
+});
+
+const FAILED_READS = [
+  ["a 500", () => rateLimitResponse({ status: 500, headers: headersOf(5000, 0, RESET) }), /HTTP 500/],
+  ["a 401", () => rateLimitResponse({ status: 401 }), /HTTP 401/],
+  ["a network error", new Error("connect ECONNREFUSED"), /connect ECONNREFUSED/],
+  ["no headers and no body reading", () => new Response("not json", { status: 200 }), /neither the headers nor the body/],
+];
+
+for (const [label, answer, why] of FAILED_READS) {
+  test(`a budget read that meets ${label} proceeds with a warning`, async () => {
+    const { calls, fetchImpl } = recordingFetch(answer);
+    const result = await checkBudget({ token: "t", share: 0.1, now: NOW_S, fetchImpl });
+    assert.equal(result.stop, false);
+    assert.equal(calls.length, 1, "no retry");
+    assert.match(result.line, /^::warning title=start-gate::the GITHUB_TOKEN budget was not read \(/);
+    assert.match(result.line, why);
+    assert.match(result.line, /; the lane proceeds$/);
+  });
+}
+
+test("with no token the budget is not read and the lane proceeds with a warning", async () => {
+  const { calls, fetchImpl } = recordingFetch(rateLimitResponse({ headers: headersOf(5000, 0, RESET) }));
+  const result = await checkBudget({ token: "", share: 0.1, now: NOW_S, fetchImpl });
+  assert.deepEqual([result.stop, calls.length], [false, 0]);
+  assert.match(result.line, /^::warning title=start-gate::no token/);
+});
+
+test("a value in the answer cannot start a workflow command", async () => {
+  const headers = { ...headersOf(5000, 4000, RESET), "x-ratelimit-resource": "core%0A::error::x" };
+  const { fetchImpl } = recordingFetch(rateLimitResponse({ headers }));
+  const { line } = await checkBudget({ token: "t", share: 0.1, now: NOW_S, fetchImpl });
+  assert.equal(line.split("::").length, 3, "the notice's own two :: only");
+  assert.match(line, /resource=core 0A  error  x$/);
+});
+
+async function runMain(env, answer, { resolved } = {}) {
+  const dir = tempDir("kill-switch-");
+  try {
+    const outputPath = path.join(dir, "output");
+    writeFileSync(outputPath, "");
+    let config;
+    if (resolved) {
+      config = path.join(dir, "resolved.json");
+      writeFileSync(config, JSON.stringify(resolved));
+    }
+    const lines = [];
+    const { calls, fetchImpl } = recordingFetch(answer);
+    await main({ GITHUB_OUTPUT: outputPath, BUDGET_TOKEN: "t", RESOLVED_CONFIG: config, ...env }, { fetchImpl, now: () => NOW_MS, log: (line) => lines.push(line) });
+    return { calls, lines, outputs: readOutputs(readFileSync(outputPath, "utf8")) };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+const OFF = { KILL_SWITCH_VALUE: "false", REPO_KILL_SWITCH_VALUE: "false" };
+
+test("a switch that stops makes no budget call", async () => {
+  const { calls, outputs } = await runMain({ KILL_SWITCH_VALUE: "true", REPO_KILL_SWITCH_VALUE: "false" }, rateLimitResponse({ headers: headersOf(5000, 4000, RESET) }));
+  assert.equal(calls.length, 0);
+  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "switch" });
+});
+
+test("a low budget stops the lane with reason kill-switch and cause budget", async () => {
+  const { calls, lines, outputs } = await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 499, RESET) }));
+  assert.equal(calls.length, 1);
+  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "budget" });
+  assert.equal(lines.filter((line) => line.startsWith("::notice title=start-gate::")).length, 1, "one notice per run");
+});
+
+test("a budget at the default share proceeds", async () => {
+  const { outputs } = await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 500, RESET) }));
+  assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok" });
+});
+
+test("limits.api github-token start-gate in the resolved config overrides the default share", async () => {
+  // 0.5 of 5000 is 2500.
+  const resolved = { limits: { api: { "github-token": { "start-gate": 0.5 } } } };
+  assert.equal((await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 2499, RESET) }), { resolved })).outputs.cause, "budget");
+  assert.equal((await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 2500, RESET) }), { resolved })).outputs.cause, "ok");
+  const off = { limits: { api: { "github-token": { "start-gate": 0 } } } };
+  assert.equal((await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 0, RESET) }), { resolved: off })).outputs.cause, "ok", "0 turns it off");
+});
+
+test("a failed budget read proceeds", async () => {
+  const { outputs, lines } = await runMain(OFF, new Error("socket hang up"));
+  assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok" });
+  assert.ok(lines.some((line) => line.startsWith("::warning title=start-gate::the GITHUB_TOKEN budget was not read (socket hang up)")));
+});
+
+test("the fallback share is rate-limits.json's github-token start-gate", () => {
+  assert.equal(JSON.parse(readFileSync(RATE_LIMITS, "utf8"))["github-token"]["start-gate"], START_GATE_SHARE);
+});
+
+test("CLI writes proceed=true when both switches are exactly false, reads no budget without a token, and exits 0", () => {
+  const { status, stdout, outputs } = runCli({ KILL_SWITCH_VALUE: "false", REPO_KILL_SWITCH_VALUE: "false" });
   assert.equal(status, 0);
-  assert.deepEqual(outputs, { proceed: "true", reason: "ok" });
+  assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok" });
+  assert.match(stdout, /::warning title=start-gate::no token/);
+});
+
+test("CLI in a checkout without log-api-budget still writes its outputs and warns", () => {
+  const dir = tempDir("kill-switch-sparse-");
+  try {
+    const script = path.join(dir, "check-kill-switch", "check-kill-switch.mjs");
+    mkdirSync(path.dirname(script));
+    copyFileSync(SCRIPT, script);
+    const outputPath = path.join(dir, "output");
+    writeFileSync(outputPath, "");
+    const result = spawnSync(process.execPath, [script], {
+      env: { PATH: process.env.PATH, GITHUB_OUTPUT: outputPath, KILL_SWITCH_VALUE: "false", REPO_KILL_SWITCH_VALUE: "false" },
+      encoding: "utf8",
+    });
+    assert.equal(result.status, 0);
+    assert.match(result.stdout, /::warning title=start-gate::rate-guard\.mjs could not be loaded \(ERR_MODULE_NOT_FOUND\); start-gate share 0\.1/);
+    assert.deepEqual(readOutputs(readFileSync(outputPath, "utf8")), { proceed: "true", reason: "ok", cause: "ok" });
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
 });
 
 test("CLI writes proceed=false when the repository switch is unset and exits 0", () => {
   const { status, outputs } = runCli({ KILL_SWITCH_VALUE: "false" });
   assert.equal(status, 0);
-  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch" });
+  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "switch" });
 });
 
 test("CLI writes proceed=false when both variables are unset and exits 0", () => {
   const { status, outputs } = runCli({});
   assert.equal(status, 0);
-  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch" });
+  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "switch" });
 });
 
 test("output values cannot inject a second output line", () => {
diff --git a/.github/actions/log-api-budget/rate-guard.mjs b/.github/actions/log-api-budget/rate-guard.mjs
index 0b307b0e3d4..0afe4434d73 100644
--- a/.github/actions/log-api-budget/rate-guard.mjs
+++ b/.github/actions/log-api-budget/rate-guard.mjs
@@ -65,7 +65,7 @@ const DEFAULTS = new URL("./rate-limits.json", import.meta.url);
 // (rate-guard.test.mjs holds the two equal).
 const SHARES = { plan: 0.7, "writer-pause": 0.4, breaker: 0.2, "read-floor": 0.1, "stop-floor": 0.02 };
 export const BUILT_IN_LIMITS = Object.freeze({
-  "github-token": { ...SHARES, "limit-cap": 1000, pace: 0.2 },
+  "github-token": { ...SHARES, "limit-cap": 1000, pace: 0.2, "start-gate": 0.1 },
   "lanes-app": SHARES,
   graphql: SHARES,
   "owner-token": SHARES,
@@ -77,8 +77,9 @@ export const BUILT_IN_LIMITS = Object.freeze({
 const SHARE = (value) => typeof value === "number" && value >= 0 && value <= 1;
 const COUNT = (value) => Number.isInteger(value) && value >= 1;
 // pace, optional, is pace.mjs's share for timer-driven lanes; stop-floor,
-// optional, the share of the header's limit left at which the latch stops.
-const FIELDS = { plan: (value) => SHARE(value) && value > 0, "writer-pause": SHARE, breaker: SHARE, "read-floor": SHARE, "stop-floor": SHARE, "limit-cap": COUNT, pace: SHARE };
+// optional, the share of the header's limit left at which the latch stops;
+// start-gate, optional, check-kill-switch's share under which a lane does not start.
+const FIELDS = { plan: (value) => SHARE(value) && value > 0, "writer-pause": SHARE, breaker: SHARE, "read-floor": SHARE, "stop-floor": SHARE, "limit-cap": COUNT, pace: SHARE, "start-gate": SHARE };
 const CONTENT_FIELDS = { ...FIELDS, "per-minute": COUNT, "per-hour": COUNT };
 const REQUIRED = ["plan", "writer-pause", "breaker", "read-floor"];
 
diff --git a/.github/actions/log-api-budget/rate-limits.json b/.github/actions/log-api-budget/rate-limits.json
index 33976703a8a..3d2ca40ca5c 100644
--- a/.github/actions/log-api-budget/rate-limits.json
+++ b/.github/actions/log-api-budget/rate-limits.json
@@ -1,5 +1,5 @@
 {
-  "github-token": { "plan": 0.7, "writer-pause": 0.4, "breaker": 0.2, "read-floor": 0.1, "stop-floor": 0.02, "limit-cap": 1000, "pace": 0.2 },
+  "github-token": { "plan": 0.7, "writer-pause": 0.4, "breaker": 0.2, "read-floor": 0.1, "stop-floor": 0.02, "limit-cap": 1000, "pace": 0.2, "start-gate": 0.1 },
   "lanes-app": { "plan": 0.7, "writer-pause": 0.4, "breaker": 0.2, "read-floor": 0.1, "stop-floor": 0.02 },
   "graphql": { "plan": 0.7, "writer-pause": 0.4, "breaker": 0.2, "read-floor": 0.1, "stop-floor": 0.02 },
   "owner-token": { "plan": 0.7, "writer-pause": 0.4, "breaker": 0.2, "read-floor": 0.1, "stop-floor": 0.02 },
diff --git a/.github/scripts/work-unblock/label-unblocked.mjs b/.github/scripts/work-unblock/label-unblocked.mjs
index cf0faad7005..fcf9f76b988 100755
--- a/.github/scripts/work-unblock/label-unblocked.mjs
+++ b/.github/scripts/work-unblock/label-unblocked.mjs
@@ -207,7 +207,11 @@
 // limits.limit-stops-per-issue trips since a listed human last added
 // agent-ready or a run last reported, waits the kill-switch
 // limits.stranded-backoff-hours after the run ended, flat, never doubled,
-// with no cap on trips and no fail route. A sweep re-fires breaker trips,
+// with no cap on trips and no fail route. A run whose start gate stopped it
+// on the GITHUB_TOKEN budget (BUDGET_STEP green in a call's broker-check or
+// model job, from the jobs listing) is a breaker trip at broker-check whose
+// record carries BUDGET_TAG: it never counts toward that bound or that wait,
+// and re-fires on the next sweep. A sweep re-fires breaker trips,
 // oldest run end first, only while the work-resolve-issue runs not yet
 // finished (five status listings, read once a sweep that has one) are under
 // limits.refire-queue-per-slot times the lane's SLOTS, within
@@ -375,6 +379,11 @@ const UNTRUSTED_STEP = "Stop on untrusted provenance";
 const BROKER_STEP = "Ask the broker whether the lane may run";
 // broker-check's step before BROKER_STEP, which skips it while a kill switch is on.
 const KILL_STEP = "Check the kill switch";
+// The read runner's step, in broker-check and in its model job, that runs
+// exactly when KILL_STEP stopped on the GITHUB_TOKEN budget (cause budget).
+const BUDGET_STEP = "Stop on a low GITHUB_TOKEN budget";
+// The second line of a breaker record whose stop was a budget stop.
+const BUDGET_TAG = "<!-- work-unblock cause=budget -->";
 // A raw job log line, its timestamp first, whose rest matches the pattern `rest`.
 const stamped = (rest) => new RegExp(String.raw`^\d{4}-\d\d-\d\dT[\d:.]+Z ` + rest);
 // request-lane-token's last line when the broker refuses it, in check mode
@@ -545,11 +554,13 @@ function failedFor(github, number, error) {
 
 const isLabel = (event, kind) => event.event === kind && String(event.label?.name).toLowerCase() === LABEL;
 
-// A re-fire marker reads as outcome `refired` with its workflow key, and
-// `breaker` when a kill-switch refusal caused it.
+// A re-fire marker reads as outcome `refired` with its workflow key,
+// `breaker` when a kill-switch refusal caused it, and `budget` when that was
+// a stop on the GITHUB_TOKEN budget.
 const parseMarker = (body) => {
   const refire = REFIRED.exec(String(body ?? "")) ?? INFRA.exec(String(body ?? ""));
-  return refire ? { outcome: "refired", key: refire[1], breaker: refire[2] !== undefined } : parseOutcomeMarker(body);
+  const breaker = refire?.[2] !== undefined;
+  return refire ? { outcome: "refired", key: refire[1], breaker, budget: breaker && String(body).split("\n")[1] === BUDGET_TAG } : parseOutcomeMarker(body);
 };
 
 // The lanes App's outcome and re-fire markers on an issue, oldest first, each
@@ -1556,8 +1567,10 @@ const MINT_CAUSE = `The work-resolve-issue run that \`${LABEL}\` started could n
 // The record of a re-fire after a kill-switch refusal, posted before the
 // label moves, once per re-fire. It names the refused run and when it ended,
 // since the re-fire can come hours after the refusal.
-export const breakerComment = (key, { repo, run, ended }) =>
-  `<!-- work-unblock refired ${key} breaker -->\nThis records a re-fire of an earlier refusal, not a new refusal. The lanes kill switch stopped [run ${run}](https://github.com/${repo}/actions/runs/${run}), the work-resolve-issue run that \`${LABEL}\` started, before it finished; that run ended at ${new Date(ended).toISOString().replace(/\.\d{3}Z$/, "Z")}. work-unblock has now removed and added \`${LABEL}\` back to start a fresh run. A kill-switch refusal is no fault in this issue or the lanes, so it never counts against later re-fires; after limits.limit-stops-per-issue of them since a person last added \`${LABEL}\` or a run last reported, work-unblock waits the same limits.stranded-backoff-hours \`kill-switch\` hours after each refused run before re-firing it, never longer.`;
+export const breakerComment = (key, { repo, run, ended, budget = false }) =>
+  budget
+    ? `<!-- work-unblock refired ${key} breaker -->\n${BUDGET_TAG}\nThis records a re-fire of an earlier stop, not a new one. The start gate stopped [run ${run}](https://github.com/${repo}/actions/runs/${run}), the work-resolve-issue run that \`${LABEL}\` started, before any model turn, because the GITHUB_TOKEN budget was under its start-gate share (limits.api github-token start-gate); that run ended at ${new Date(ended).toISOString().replace(/\.\d{3}Z$/, "Z")}. work-unblock has now removed and added \`${LABEL}\` back to start a fresh run. A budget stop is the lanes' load, not a fault in this issue: it never counts toward limits.limit-stops-per-issue or the \`kill-switch\` wait.`
+    : `<!-- work-unblock refired ${key} breaker -->\nThis records a re-fire of an earlier refusal, not a new refusal. The lanes kill switch stopped [run ${run}](https://github.com/${repo}/actions/runs/${run}), the work-resolve-issue run that \`${LABEL}\` started, before it finished; that run ended at ${new Date(ended).toISOString().replace(/\.\d{3}Z$/, "Z")}. work-unblock has now removed and added \`${LABEL}\` back to start a fresh run. A kill-switch refusal is no fault in this issue or the lanes, so it never counts against later re-fires; after limits.limit-stops-per-issue of them since a person last added \`${LABEL}\` or a run last reported, work-unblock waits the same limits.stranded-backoff-hours \`kill-switch\` hours after each refused run before re-firing it, never longer.`;
 
 // The backoff record of an issue whose re-fires on these workflow files keep
 // ending the same way: one comment per issue, edited on each re-fire.
@@ -1704,7 +1717,11 @@ async function didNoWork(jobsOf, refusalOf, runs) {
   let stalled = null;
   let tripped = null;
   let stage = null;
-  const atLeast = (kind, run, at) => {
+  // A run the switches stopped makes the trip a switch trip, whatever other
+  // run a budget stop stopped.
+  let switched = false;
+  const atLeast = (kind, run, at, budget = false) => {
+    switched ||= kind === "breaker" && !budget;
     if (rank[kind] > (rank[stalled] ?? 0)) {
       stalled = kind;
       tripped = run;
@@ -1729,7 +1746,9 @@ async function didNoWork(jobsOf, refusalOf, runs) {
     const named = (name) => namedJobs(jobs, name);
     // Any call's broker-check: a later leg asks the broker again for its slot.
     const calls = RESOLVE_CALLS.flatMap(named);
-    const killed = calls.some((job) => endedAt(job, KILL_STEP, "success") && endedAt(job, BROKER_STEP, "skipped"));
+    // A budget stop, at broker-check or in the model job: no model ran.
+    const budget = calls.some((job) => endedAt(job, BUDGET_STEP, "success"));
+    const killed = budget || calls.some((job) => endedAt(job, KILL_STEP, "success") && endedAt(job, BROKER_STEP, "skipped"));
     const checked = calls.find((job) => failedAt(job, BROKER_STEP));
     const checkStopped = calls.find((job) => job.conclusion === "success" && endedAt(job, BROKER_STEP, "success") && endedAt(job, LEASE_STEP, "skipped"));
     const minting = jobs.find((job) => failedAt(job, MINT_STEP));
@@ -1761,7 +1780,7 @@ async function didNoWork(jobsOf, refusalOf, runs) {
               ? refusalOf(stopped, "stop")
               : null;
     if (killed || (await refused) === BREAKER) {
-      atLeast("breaker", run, killed || checked || checkStopped ? "check" : "token");
+      atLeast("breaker", run, killed || checked || checkStopped ? "check" : "token", budget);
     } else if (minting || checked || checkStopped || stopped) {
       atLeast("mint-failed");
     } else if (capped) {
@@ -1770,7 +1789,7 @@ async function didNoWork(jobsOf, refusalOf, runs) {
       atLeast(outage ? "outage" : "blocked");
     }
   }
-  return stalled && { stalled, run: tripped, stage };
+  return stalled && { stalled, run: tripped, stage, budget: stalled === "breaker" && !switched };
 }
 
 // The reason the broker refused `job`, from its log: the failed step's last
@@ -2187,19 +2206,21 @@ async function refireRefusal({ github, actions, jobLog, carry, repo, number, iss
   // A stale stop ran no model; a failed mint in its re-fire job is no failed
   // mint of the lane's, so it skips the did-no-work clock below.
   const stale = await stoppedStale(jobsOf, runs);
-  const { stalled, run: refused, stage } = (!stale && (await didNoWork(jobsOf, refusalReader(jobLog, repo, carry), runs))) || {};
+  const { stalled, run: refused, stage, budget } = (!stale && (await didNoWork(jobsOf, refusalReader(jobLog, repo, carry), runs))) || {};
   if (stalled) {
     // Breaker trips since a listed human last added agent-ready or a run last
     // reported; past limits.limit-stops-per-issue of them, a flat wait of the
     // kill-switch hours that never doubles: a trip is the lanes' load, not the
-    // issue's fault (owner decision Q109).
+    // issue's fault (owner decision Q109). A stop on the GITHUB_TOKEN budget is
+    // no trip: it neither counts nor waits, and re-fires on the next sweep,
+    // which itself runs only while its own start gate reads the budget clear.
     const from = Math.max(
       Number.NEGATIVE_INFINITY,
       ...events.filter((event) => isLabel(event, "labeled") && humans.has(event.actor?.id)).map((event) => Date.parse(event.created_at)),
       ...markers.filter((marker) => marker.outcome !== "refired").map((marker) => marker.at),
     );
-    const trips = stalled === "breaker" ? markers.filter((marker) => marker.breaker && marker.at > from).length : 0;
-    const over = trips - limits["limit-stops-per-issue"];
+    const trips = stalled === "breaker" && !budget ? markers.filter((marker) => marker.breaker && !marker.budget && marker.at > from).length : 0;
+    const over = budget ? -1 : trips - limits["limit-stops-per-issue"];
     // A broker-check trip ran no model, and this sweep runs only with the
     // kill switch off, so it re-fires now; a mint trip ran the model and
     // waits like any failed mint.
@@ -2234,7 +2255,7 @@ async function refireRefusal({ github, actions, jobLog, carry, repo, number, iss
     if (stalled === "mint-failed" && !recorded && fired >= limits["limit-stops-per-issue"]) {
       return backoff(key, ended, MINT_CAUSE, hoursFor["failed-mint"]);
     }
-    const trip = stalled === "breaker" ? { run: refused.id, ended: Date.parse(refused.updated_at) || ended } : undefined;
+    const trip = stalled === "breaker" ? { run: refused.id, ended: Date.parse(refused.updated_at) || ended, budget } : undefined;
     // Trips sort by when their run ended, not when they fell due, so the sweeps
     // after the switch clears drain them oldest first whatever their waits.
     return { reason: null, resets: trip ? ended : due, refire: key, recorded, stall: stalled, trip };
@@ -2592,7 +2613,7 @@ async function restartLimited({ github, actions, jobLog, carry, repo, bot, human
         console.log(`label-unblocked: #${number} left as is: its Work status is now ${restarted.state ?? "unset"}`);
         continue;
       }
-      const why = infra ? "re-fired on a backoff" : stall === "breaker" ? "re-fired after a kill-switch refusal" : stall === "outage" ? "re-fired after its upstream-status skip" : refire ? "re-fired after its failed run" : recurrence ? "relabeled after its reopen on a repeat failure" : "restarted after its limit stop";
+      const why = infra ? "re-fired on a backoff" : stall === "breaker" ? (trip?.budget ? "re-fired after a start-gate budget stop" : "re-fired after a kill-switch refusal") : stall === "outage" ? "re-fired after its upstream-status skip" : refire ? "re-fired after its failed run" : recurrence ? "relabeled after its reopen on a repeat failure" : "restarted after its limit stop";
       console.log(`label-unblocked: #${number} ${why}`);
     } catch (error) {
       failed += 1;
diff --git a/.github/scripts/work-unblock/label-unblocked.test.mjs b/.github/scripts/work-unblock/label-unblocked.test.mjs
index 6e18944d7cb..82b8770438d 100644
--- a/.github/scripts/work-unblock/label-unblocked.test.mjs
+++ b/.github/scripts/work-unblock/label-unblocked.test.mjs
@@ -3740,6 +3740,76 @@ test("a later leg's broker-check refused or skipped for the kill switch is a bre
   }
 });
 
+// broker-check's start gate stopped on the GITHUB_TOKEN budget (cause budget):
+// its `Stop on a low GITHUB_TOKEN budget` step ran and the broker ask skipped.
+const budgetStep = { name: "Stop on a low GITHUB_TOKEN budget", conclusion: "success" };
+const BUDGET_STOPPED = [ADMITTED, pickSlot, { ...KILL_SKIPPED[2], steps: [KILL_SKIPPED[2].steps[0], budgetStep, KILL_SKIPPED[2].steps[1]] }, ...KILL_SKIPPED.slice(3)];
+// broker-check allowed, then the model job's own start gate stopped on the budget.
+const RUN_BUDGET_STOPPED = [
+  ADMITTED,
+  pickSlot,
+  BROKER_ALLOWED,
+  { name: "resolve-issue / run", conclusion: "success", steps: [{ name: "Check the kill switch", conclusion: "success" }, budgetStep, { name: "Assert the broker allowed this attempt", conclusion: "skipped" }] },
+  { name: "report-outcome", conclusion: "skipped", steps: [] },
+];
+const BUDGET_RECORD = `${BREAKER_MARKER}\n<!-- work-unblock cause=budget -->\n`;
+const budgeted = (calls) => {
+  tripped(calls);
+  assert.ok(postedBody(calls).startsWith(BUDGET_RECORD), postedBody(calls));
+};
+const switched = (calls) => {
+  tripped(calls);
+  assert.ok(!postedBody(calls).includes("cause=budget"), postedBody(calls));
+};
+
+test("a run its start gate stopped on the GITHUB_TOKEN budget re-fires at once with a budget record, read from the job listing alone", async () => {
+  for (const jobs of [BUDGET_STOPPED, RUN_BUDGET_STOPPED]) {
+    // Ended two minutes before the sweep: no wait.
+    const { github, actions, calls } = stalledRun({ jobs, conclusion: "success", ended: "2026-10-16T11:58:00Z" });
+    assert.equal(await sweep({ github, actions }), 0);
+    budgeted(calls);
+    assert.deepEqual(logReads(calls), []);
+  }
+  // The same listing without the budget step is a switch trip.
+  const plain = stalledRun({ jobs: KILL_SKIPPED, conclusion: "success", ended: "2026-10-16T11:58:00Z" });
+  assert.equal(await sweep({ github: plain.github, actions: plain.actions }), 0);
+  switched(plain.calls);
+});
+
+test("a budget stop step that skipped is no budget stop", async () => {
+  const skipped = { ...budgetStep, conclusion: "skipped" };
+  const jobs = [ADMITTED, pickSlot, { ...KILL_SKIPPED[2], steps: [KILL_SKIPPED[2].steps[0], skipped, KILL_SKIPPED[2].steps[1]] }, ...KILL_SKIPPED.slice(3)];
+  const { github, actions, calls } = stalledRun({ jobs, conclusion: "success" });
+  assert.equal(await sweep({ github, actions }), 0);
+  switched(calls);
+});
+
+// limits.limit-stops-per-issue is 3: three switch trips make the fourth wait
+// the flat kill-switch hours; three budget stops do not.
+test("budget stops never count toward limits.limit-stops-per-issue or wait the kill-switch hours", async () => {
+  const switchTrips = await afterSweeps(3, KILL_SKIPPED);
+  const fourthSwitch = stalledRun({ jobs: KILL_SKIPPED, conclusion: "success", ...switchTrips });
+  assert.equal(await sweep({ github: fourthSwitch.github, actions: fourthSwitch.actions }), 0);
+  assert.deepEqual(writes(fourthSwitch.calls), [], "a fourth switch trip waits");
+
+  const budgetStops = await afterSweeps(5, BUDGET_STOPPED);
+  const afterBudget = stalledRun({ jobs: KILL_SKIPPED, conclusion: "success", ...budgetStops });
+  assert.equal(await sweep({ github: afterBudget.github, actions: afterBudget.actions }), 0);
+  switched(afterBudget.calls);
+
+  const budgetAfterSwitch = stalledRun({ jobs: BUDGET_STOPPED, conclusion: "success", ...switchTrips });
+  assert.equal(await sweep({ github: budgetAfterSwitch.github, actions: budgetAfterSwitch.actions }), 0);
+  budgeted(budgetAfterSwitch.calls);
+});
+
+test("the budget record says it never counts toward the per-issue bound", () => {
+  const body = breakerComment(KEY, { repo: REPO, run: 5030, ended: Date.parse("2026-10-16T10:05:00Z"), budget: true });
+  assert.ok(body.startsWith(BUDGET_RECORD), body);
+  assert.ok(body.includes(REFUSED_LINK), body);
+  assert.ok(body.includes("never counts toward limits.limit-stops-per-issue"), body);
+  assert.ok(!breakerComment(KEY, { repo: REPO, run: 5030, ended: 0 }).includes("cause=budget"));
+});
+
 test("a green run whose kill-switch check did not run, or whose broker ask ran, is no breaker trip", async () => {
   const [kill, ask] = KILL_SKIPPED[2].steps;
   const check = (steps) => ({ ...KILL_SKIPPED[2], steps });
@@ -3890,6 +3960,12 @@ test("the job ids and step names the sweep matches exist in the lane workflows",
   assert.ok(checkSteps.indexOf("Stop on an open blocker") > checkSteps.indexOf("Claim the issue with a lane lease"));
   assert.ok(read.run !== undefined);
   assert.ok(steps(read.run).includes("Stop on stale workflow files"));
+  // The budget step follows the kill switch's step and runs exactly on a budget stop.
+  for (const id of ["broker-check", "run"]) {
+    const named = steps(read[id]);
+    assert.equal(named.indexOf("Stop on a low GITHUB_TOKEN budget"), named.indexOf("Check the kill switch") + 1, id);
+    assert.match(read[id], /^ {6}- name: Stop on a low GITHUB_TOKEN budget\n {8}if: steps\.kill\.outputs\.cause == 'budget'\n/m, id);
+  }
   for (const id of ["broker-check", "run"]) {
     assert.doesNotMatch(read[id], /^ {4}name:/m, `read runner job ${id} keeps its id as its name`);
   }
diff --git a/.github/workflows/pr-run-activity-read.yml b/.github/workflows/pr-run-activity-read.yml
index afef8f916c7..5f80530abd5 100644
--- a/.github/workflows/pr-run-activity-read.yml
+++ b/.github/workflows/pr-run-activity-read.yml
@@ -520,6 +520,13 @@ jobs:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
 
+      # work-unblock's sweep reads this step's conclusion from the job listing
+      # (label-unblocked.mjs BUDGET_STEP): a stop on the GITHUB_TOKEN budget
+      # re-fires without counting as a kill-switch trip.
+      - name: Stop on a low GITHUB_TOKEN budget
+        if: steps.kill.outputs.cause == 'budget'
+        run: echo "::notice::the start gate stopped this run on a low GITHUB_TOKEN budget"
+
       # The broker repeats the kill switch, including the repository-variable
       # shadow this job cannot see, and checks the job's OIDC claims.
       - name: Ask the broker whether the lane may run
@@ -873,6 +880,11 @@ jobs:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
 
+      # As in broker-check: work-unblock's sweep reads it from the job listing.
+      - name: Stop on a low GITHUB_TOKEN budget
+        if: steps.kill.outputs.cause == 'budget'
+        run: echo "::notice::the start gate stopped this run on a low GITHUB_TOKEN budget"
+
       # A broker-check allow from an earlier attempt, reused by "Re-run failed
       # jobs", or a broker-check that skipped the broker because its own kill
       # switch read stopped, is not an allow for this attempt: fail red as a
diff --git a/docs/conventions/pr-pipeline.yaml b/docs/conventions/pr-pipeline.yaml
index 4216c6dffed..6c28da62a3e 100644
--- a/docs/conventions/pr-pipeline.yaml
+++ b/docs/conventions/pr-pipeline.yaml
@@ -1270,7 +1270,9 @@ limits:
   # content-creation adds per-minute and per-hour. The rate guard reads
   # read-floor and limit-cap, to warn, and stop-floor, to stop a pool until its
   # reset at or under that share left; github-token's pace (projected share left at reset)
-  # paces timer-driven lanes (log-api-budget/pace.mjs); the others are
+  # paces timer-driven lanes (log-api-budget/pace.mjs); github-token's
+  # start-gate (share of the header's limit left) stops a lane at its kill-switch
+  # gate (check-kill-switch), one GET /rate_limit per gate; the others are
   # thresholds meant for the hub's limits sampler, which nothing here enforces. Their
   # defaults live in .github/actions/log-api-budget/rate-limits.json, held
   # for a person like this file; add an `api:` entry here only to override one.
diff --git a/docs/conventions/pr-pipeline/README.md b/docs/conventions/pr-pipeline/README.md
index c2ab5c7468d..54bb7d6226d 100644
--- a/docs/conventions/pr-pipeline/README.md
+++ b/docs/conventions/pr-pipeline/README.md
@@ -3741,7 +3741,7 @@ with its default.
 | `fix-docs-per-run` | 2 | fix-docs dispatches one pr-unblock-dispatch `refine` run sends for its PR's event; 0 to 20. Each event offers one PR, so 0 turns CI fix-docs off and any other value turns it on. |
 | `admission-factor` | 0.8 | Share of the lane's hourly merge rate admitted per hour for the queued cap ([WIP cap](#wip-cap)); greater than 0, at most 1. |
 | `admission-min-per-hour` | 1 | Admissions per hour the queued cap never falls below, so a day with no lane merges cannot hold admissions shut; 0 to 100, and 0 removes the floor. |
-| `api` | schema | GitHub API margins per pool (`github-token`, `lanes-app`, `graphql`, `owner-token`, `content-creation`). `limit-cap` sets the pool's planned budget: planned = min(header limit, `limit-cap`), used = header limit - header remaining, left = planned - used. `github-token` defaults it to GitHub's documented GITHUB_TOKEN limit, so a higher header limit is headroom, never a target; the other pools have no cap and plan to their header limit. `plan` and `read-floor` are shares of the planned budget; `writer-pause`, `breaker` and `stop-floor` are shares of the header's limit, by its remaining; `content-creation` adds `per-minute` and `per-hour`. Their defaults are in `.github/actions/log-api-budget/rate-limits.json`, the only copy, which every merge hold list floors, so a change to a default waits for a person. The rate guard (`.github/actions/log-api-budget/rate-guard.mjs`, `planOf`) reads `read-floor` and `limit-cap`, to warn once while calls continue, and stops on the header's remaining and GitHub's refusals: at a remaining of 0, or at or under `stop-floor` of the header's limit, it sends no further call to that pool before the header's reset, records the stop in the job's stop file, and holds the step under `API_BUDGET_HOLD`, else fails it; a response with no readable limit, remaining or future reset never stops on `stop-floor`; `pace` (github-token, default 0.2) is the share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick when the previous scheduled run, by run id, marked a clean pass of its work (its `Mark this tick's work done` step, which a held or red pass and a paced tick skip), so two scheduled ticks in a row are never both skipped and its cadence halves (`.github/actions/log-api-budget/pace.mjs`; the lost-run reconciler, pr-unblock-dispatch and work-unblock's sweep read it, and pr-merge's post-merge-dispatch reads it for the merge and enable-auto-merge sweep jobs, which skip at job level while the post-merge check and cover dispatch run on every tick), so the timer lanes slow down before the breaker stops every lane; `0` turns pacing off; the others are thresholds meant for the hub's limits sampler, and nothing in this repository enforces them. resolve-config passes the block through as set. |
+| `api` | schema | GitHub API margins per pool (`github-token`, `lanes-app`, `graphql`, `owner-token`, `content-creation`). `limit-cap` sets the pool's planned budget: planned = min(header limit, `limit-cap`), used = header limit - header remaining, left = planned - used. `github-token` defaults it to GitHub's documented GITHUB_TOKEN limit, so a higher header limit is headroom, never a target; the other pools have no cap and plan to their header limit. `plan` and `read-floor` are shares of the planned budget; `writer-pause`, `breaker` and `stop-floor` are shares of the header's limit, by its remaining; `content-creation` adds `per-minute` and `per-hour`. Their defaults are in `.github/actions/log-api-budget/rate-limits.json`, the only copy, which every merge hold list floors, so a change to a default waits for a person. The rate guard (`.github/actions/log-api-budget/rate-guard.mjs`, `planOf`) reads `read-floor` and `limit-cap`, to warn once while calls continue, and stops on the header's remaining and GitHub's refusals: at a remaining of 0, or at or under `stop-floor` of the header's limit, it sends no further call to that pool before the header's reset, records the stop in the job's stop file, and holds the step under `API_BUDGET_HOLD`, else fails it; a response with no readable limit, remaining or future reset never stops on `stop-floor`; `pace` (github-token, default 0.2) is the share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick when the previous scheduled run, by run id, marked a clean pass of its work (its `Mark this tick's work done` step, which a held or red pass and a paced tick skip), so two scheduled ticks in a row are never both skipped and its cadence halves (`.github/actions/log-api-budget/pace.mjs`; the lost-run reconciler, pr-unblock-dispatch and work-unblock's sweep read it, and pr-merge's post-merge-dispatch reads it for the merge and enable-auto-merge sweep jobs, which skip at job level while the post-merge check and cover dispatch run on every tick), so the timer lanes slow down before the breaker stops every lane; `0` turns pacing off; `start-gate` (github-token, default 0.1) is the share of the header's limit, by its remaining, under which a lane's kill-switch gate (`.github/actions/check-kill-switch`) does not start it while the reset is still ahead: one GET /rate_limit per gate, its headers or else its body's `resources.core`, a stop with reason `kill-switch` and cause `budget`, and a failed read proceeds; `0` turns it off; the others are thresholds meant for the hub's limits sampler, and nothing in this repository enforces them. resolve-config passes the block through as set. |
 | `lane-level` | 2, 4, 3, 2, `[lanes-app]`, `true`, `CLAUDE_LANE_LEVEL`, 150 | The adaptive lane level L (owner decision Q111): `floor`, `ceiling`, `default`, `clean-windows` and `pools` for `decide()` in `.github/scripts/lib/lane-level.mjs`, whose truth table is `lane-level.vectors.json` beside it. `shadow` (default `true`), `variable` (default `CLAUDE_LANE_LEVEL`, must end in `_LANE_LEVEL`) and `valid-minutes` (default 150, 60 to 1440) govern publish and read: work-unblock's hourly `publish-lane-level` job publishes L as `<level>@<valid-until>` in `variable`, and pick-slot and label-unblocked read it through `.github/scripts/lib/lane-level-value.mjs` (empty, expired or malformed reads as `default`, clamped to `floor` and `ceiling`). While `shadow` is set the job mints no token and writes nothing, `SLOTS` stays `default`, and both log the level they would use. Each window L steps up 1 after `clean-windows` windows in a row that each had demand (runs waiting, or every slot running) and no limit signal, when every pool in `pools` fits: peak used, as a share of the pool's planned budget, times (L+1)/L at most `api.<pool>.plan`. A window where a pool has `api.<pool>.writer-pause` of its header's limit left or less resets the streak. Any limit signal the lanes App's own calls meet (403, 429, a secondary-limit or GraphQL rate-limit error, `retry-after`) halves L, rounded down, to no less than `floor`, and blocks a step up until the reset it names. A breaker trip is not a signal: it mostly reflects GITHUB_TOKEN spend, which pacing controls, and the breaker stays the backstop. Missing readings or demand hold L and the streak; a missing or malformed previous level reads as `default`, and every level is clamped to `floor` and `ceiling`. A `floor` above the `ceiling`, as set or defaulted, is rejected. An `api` pool field left unset reads from `rate-limits.json`, as the rate guard reads it. `.github/scripts/lib/lane-level-replay.mjs` replays the rule over the hub's recorded history. |
 
 report-outcome and the work-unblock sweep read them from resolve-config's output;
diff --git a/docs/conventions/pr-pipeline/pr-pipeline.schema.json b/docs/conventions/pr-pipeline/pr-pipeline.schema.json
index 781c60b7be1..d48468e36ef 100644
--- a/docs/conventions/pr-pipeline/pr-pipeline.schema.json
+++ b/docs/conventions/pr-pipeline/pr-pipeline.schema.json
@@ -532,6 +532,12 @@
           "maximum": 1,
           "description": "Share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick whose previous scheduled run marked a clean pass of its work(.github/actions/log-api-budget/pace.mjs), so the timer lanes slow to half cadence before the breaker stops every lane. 0 turns pacing off."
         },
+        "start-gate": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1,
+          "description": "github-token only. Share of the header's limit, by the header's remaining, under which a lane does not start (.github/actions/check-kill-switch): its gate reads GET /rate_limit once and stops with reason kill-switch, cause budget, while the reset is still ahead. A failed or unreadable read proceeds. 0 turns the budget stop off."
+        },
         "read-floor": {
           "type": "number",
           "minimum": 0,

From da634168c2dce084d8f8f024159cfebd25504ec7 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Wed, 11 Nov 2026 09:49:11 -0500
Subject: [PATCH 2/9] ci(intake-triage): check out log-api-budget beside the
 kill-switch gate

The gate reads its start-gate share through rate-guard.mjs; the one sparse
checkout that carried check-kill-switch without log-api-budget fell back to
the built-in share with a warning on every run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q1HHi6JACp77x2ZbE7
---
 .github/workflows/intake-triage.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml
index 9c40b8b6c54..f162beaa087 100644
--- a/.github/workflows/intake-triage.yml
+++ b/.github/workflows/intake-triage.yml
@@ -202,6 +202,7 @@ jobs:
             /.github/scripts/maintenance-reconcile-lost-runs/component-status.mjs
             /.github/actions/setup-pinned-node/
             /.node-version
+            /.github/actions/log-api-budget/
           sparse-checkout-cone-mode: false
 
       - name: Set up Node

From 07d327a262dc3ccfbfd8029f4a85656cdb74e8b4 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Wed, 11 Nov 2026 09:57:39 -0500
Subject: [PATCH 3/9] docs(pr-pipeline): say where the start-gate override is
 read

The gate reads limits.api github-token start-gate from a RESOLVED_CONFIG its
job's env sets, and no workflow sets one for the gate yet, so every gate
uses the rate-limits.json value today.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q1HHi6JACp77x2ZbE7
---
 .github/actions/check-kill-switch/README.md          | 4 ++--
 docs/conventions/pr-pipeline/README.md               | 2 +-
 docs/conventions/pr-pipeline/pr-pipeline.schema.json | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/actions/check-kill-switch/README.md b/.github/actions/check-kill-switch/README.md
index d33c3309010..f139743f891 100644
--- a/.github/actions/check-kill-switch/README.md
+++ b/.github/actions/check-kill-switch/README.md
@@ -21,8 +21,8 @@ With both switches proceeding, the gate makes one GET /rate_limit with `token` a
 pool from the `x-ratelimit-limit`, `-remaining` and `-reset` headers, or from the body's
 `resources.core` when a header is missing. It stops the lane while remaining is under
 `limits.api.github-token.start-gate` of the limit (default 0.1, in
-[`rate-limits.json`](../log-api-budget/rate-limits.json); `pr-pipeline.yaml` overrides it where
-the job's `RESOLVED_CONFIG` names a resolved config) and the reset is still ahead. A read that
+[`rate-limits.json`](../log-api-budget/rate-limits.json); `pr-pipeline.yaml` overrides it only where
+the job's env sets `RESOLVED_CONFIG`, which no workflow does for this gate yet) and the reset is still ahead. A read that
 fails, times out or carries no reading proceeds with a warning; the rate guard's `stop-floor` is
 the backstop. GitHub counts GET /rate_limit against the secondary limit, not the primary one, so
 the gate makes it once, with no retry, and not at all when a switch already stops. Each read
diff --git a/docs/conventions/pr-pipeline/README.md b/docs/conventions/pr-pipeline/README.md
index 54bb7d6226d..833c094af53 100644
--- a/docs/conventions/pr-pipeline/README.md
+++ b/docs/conventions/pr-pipeline/README.md
@@ -3741,7 +3741,7 @@ with its default.
 | `fix-docs-per-run` | 2 | fix-docs dispatches one pr-unblock-dispatch `refine` run sends for its PR's event; 0 to 20. Each event offers one PR, so 0 turns CI fix-docs off and any other value turns it on. |
 | `admission-factor` | 0.8 | Share of the lane's hourly merge rate admitted per hour for the queued cap ([WIP cap](#wip-cap)); greater than 0, at most 1. |
 | `admission-min-per-hour` | 1 | Admissions per hour the queued cap never falls below, so a day with no lane merges cannot hold admissions shut; 0 to 100, and 0 removes the floor. |
-| `api` | schema | GitHub API margins per pool (`github-token`, `lanes-app`, `graphql`, `owner-token`, `content-creation`). `limit-cap` sets the pool's planned budget: planned = min(header limit, `limit-cap`), used = header limit - header remaining, left = planned - used. `github-token` defaults it to GitHub's documented GITHUB_TOKEN limit, so a higher header limit is headroom, never a target; the other pools have no cap and plan to their header limit. `plan` and `read-floor` are shares of the planned budget; `writer-pause`, `breaker` and `stop-floor` are shares of the header's limit, by its remaining; `content-creation` adds `per-minute` and `per-hour`. Their defaults are in `.github/actions/log-api-budget/rate-limits.json`, the only copy, which every merge hold list floors, so a change to a default waits for a person. The rate guard (`.github/actions/log-api-budget/rate-guard.mjs`, `planOf`) reads `read-floor` and `limit-cap`, to warn once while calls continue, and stops on the header's remaining and GitHub's refusals: at a remaining of 0, or at or under `stop-floor` of the header's limit, it sends no further call to that pool before the header's reset, records the stop in the job's stop file, and holds the step under `API_BUDGET_HOLD`, else fails it; a response with no readable limit, remaining or future reset never stops on `stop-floor`; `pace` (github-token, default 0.2) is the share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick when the previous scheduled run, by run id, marked a clean pass of its work (its `Mark this tick's work done` step, which a held or red pass and a paced tick skip), so two scheduled ticks in a row are never both skipped and its cadence halves (`.github/actions/log-api-budget/pace.mjs`; the lost-run reconciler, pr-unblock-dispatch and work-unblock's sweep read it, and pr-merge's post-merge-dispatch reads it for the merge and enable-auto-merge sweep jobs, which skip at job level while the post-merge check and cover dispatch run on every tick), so the timer lanes slow down before the breaker stops every lane; `0` turns pacing off; `start-gate` (github-token, default 0.1) is the share of the header's limit, by its remaining, under which a lane's kill-switch gate (`.github/actions/check-kill-switch`) does not start it while the reset is still ahead: one GET /rate_limit per gate, its headers or else its body's `resources.core`, a stop with reason `kill-switch` and cause `budget`, and a failed read proceeds; `0` turns it off; the others are thresholds meant for the hub's limits sampler, and nothing in this repository enforces them. resolve-config passes the block through as set. |
+| `api` | schema | GitHub API margins per pool (`github-token`, `lanes-app`, `graphql`, `owner-token`, `content-creation`). `limit-cap` sets the pool's planned budget: planned = min(header limit, `limit-cap`), used = header limit - header remaining, left = planned - used. `github-token` defaults it to GitHub's documented GITHUB_TOKEN limit, so a higher header limit is headroom, never a target; the other pools have no cap and plan to their header limit. `plan` and `read-floor` are shares of the planned budget; `writer-pause`, `breaker` and `stop-floor` are shares of the header's limit, by its remaining; `content-creation` adds `per-minute` and `per-hour`. Their defaults are in `.github/actions/log-api-budget/rate-limits.json`, the only copy, which every merge hold list floors, so a change to a default waits for a person. The rate guard (`.github/actions/log-api-budget/rate-guard.mjs`, `planOf`) reads `read-floor` and `limit-cap`, to warn once while calls continue, and stops on the header's remaining and GitHub's refusals: at a remaining of 0, or at or under `stop-floor` of the header's limit, it sends no further call to that pool before the header's reset, records the stop in the job's stop file, and holds the step under `API_BUDGET_HOLD`, else fails it; a response with no readable limit, remaining or future reset never stops on `stop-floor`; `pace` (github-token, default 0.2) is the share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick when the previous scheduled run, by run id, marked a clean pass of its work (its `Mark this tick's work done` step, which a held or red pass and a paced tick skip), so two scheduled ticks in a row are never both skipped and its cadence halves (`.github/actions/log-api-budget/pace.mjs`; the lost-run reconciler, pr-unblock-dispatch and work-unblock's sweep read it, and pr-merge's post-merge-dispatch reads it for the merge and enable-auto-merge sweep jobs, which skip at job level while the post-merge check and cover dispatch run on every tick), so the timer lanes slow down before the breaker stops every lane; `0` turns pacing off; `start-gate` (github-token, default 0.1) is the share of the header's limit, by its remaining, under which a lane's kill-switch gate (`.github/actions/check-kill-switch`) does not start it while the reset is still ahead: one GET /rate_limit per gate, its headers or else its body's `resources.core`, a stop with reason `kill-switch` and cause `budget`, and a failed read proceeds; `0` turns it off; the gate reads an override only from a `RESOLVED_CONFIG` its job's env sets, which no workflow does yet, so today every gate uses the `rate-limits.json` value; the others are thresholds meant for the hub's limits sampler, and nothing in this repository enforces them. resolve-config passes the block through as set. |
 | `lane-level` | 2, 4, 3, 2, `[lanes-app]`, `true`, `CLAUDE_LANE_LEVEL`, 150 | The adaptive lane level L (owner decision Q111): `floor`, `ceiling`, `default`, `clean-windows` and `pools` for `decide()` in `.github/scripts/lib/lane-level.mjs`, whose truth table is `lane-level.vectors.json` beside it. `shadow` (default `true`), `variable` (default `CLAUDE_LANE_LEVEL`, must end in `_LANE_LEVEL`) and `valid-minutes` (default 150, 60 to 1440) govern publish and read: work-unblock's hourly `publish-lane-level` job publishes L as `<level>@<valid-until>` in `variable`, and pick-slot and label-unblocked read it through `.github/scripts/lib/lane-level-value.mjs` (empty, expired or malformed reads as `default`, clamped to `floor` and `ceiling`). While `shadow` is set the job mints no token and writes nothing, `SLOTS` stays `default`, and both log the level they would use. Each window L steps up 1 after `clean-windows` windows in a row that each had demand (runs waiting, or every slot running) and no limit signal, when every pool in `pools` fits: peak used, as a share of the pool's planned budget, times (L+1)/L at most `api.<pool>.plan`. A window where a pool has `api.<pool>.writer-pause` of its header's limit left or less resets the streak. Any limit signal the lanes App's own calls meet (403, 429, a secondary-limit or GraphQL rate-limit error, `retry-after`) halves L, rounded down, to no less than `floor`, and blocks a step up until the reset it names. A breaker trip is not a signal: it mostly reflects GITHUB_TOKEN spend, which pacing controls, and the breaker stays the backstop. Missing readings or demand hold L and the streak; a missing or malformed previous level reads as `default`, and every level is clamped to `floor` and `ceiling`. A `floor` above the `ceiling`, as set or defaulted, is rejected. An `api` pool field left unset reads from `rate-limits.json`, as the rate guard reads it. `.github/scripts/lib/lane-level-replay.mjs` replays the rule over the hub's recorded history. |
 
 report-outcome and the work-unblock sweep read them from resolve-config's output;
diff --git a/docs/conventions/pr-pipeline/pr-pipeline.schema.json b/docs/conventions/pr-pipeline/pr-pipeline.schema.json
index d48468e36ef..81540e5b2ae 100644
--- a/docs/conventions/pr-pipeline/pr-pipeline.schema.json
+++ b/docs/conventions/pr-pipeline/pr-pipeline.schema.json
@@ -536,7 +536,7 @@
           "type": "number",
           "minimum": 0,
           "maximum": 1,
-          "description": "github-token only. Share of the header's limit, by the header's remaining, under which a lane does not start (.github/actions/check-kill-switch): its gate reads GET /rate_limit once and stops with reason kill-switch, cause budget, while the reset is still ahead. A failed or unreadable read proceeds. 0 turns the budget stop off."
+          "description": "github-token only. Share of the header's limit, by the header's remaining, under which a lane does not start (.github/actions/check-kill-switch): its gate reads GET /rate_limit once and stops with reason kill-switch, cause budget, while the reset is still ahead. A failed or unreadable read proceeds. 0 turns the budget stop off. The gate reads a value set here only through a RESOLVED_CONFIG its job's env sets; no workflow sets one for the gate yet, so the rate-limits.json default applies."
         },
         "read-floor": {
           "type": "number",

From 031e68a187ad54f88878fd838f7b45e10af000b1 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Wed, 11 Nov 2026 10:09:02 -0500
Subject: [PATCH 4/9] feat(pr-pipeline): skip the budget read on gates after a
 model turn

check-kill-switch takes a budget input (default true). budget: "false"
skips the GET /rate_limit read, so the gate checks the switches only. It is
set on the 13 gates in jobs that run after a model turn and consume its
output (the write runner, intake-triage apply jobs, the audit, tidy, skill
edit and changelog push and publish jobs, and pr-unblock's
adjudicate-feedback), so a low budget never throws finished model work
away; the rate guard's stop-floor stays their backstop.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q1HHi6JACp77x2ZbE7
---
 .github/actions/check-kill-switch/README.md   | 10 ++++
 .github/actions/check-kill-switch/action.yml  |  9 +++
 .../check-kill-switch/check-kill-switch.mjs   |  6 +-
 .../check-kill-switch.test.mjs                | 60 +++++++++++++++++++
 .github/workflows/intake-triage.yml           |  4 ++
 .../workflows/maintenance-audit-lane-runs.yml |  6 ++
 .../maintenance-measure-skill-edit.yml        |  4 ++
 .../maintenance-tidy-code-upkeep.yml          |  4 ++
 .github/workflows/pr-run-activity-write.yml   |  2 +
 .github/workflows/pr-unblock.yml              |  2 +
 .../workflows/upstream-apply-changelog.yml    |  4 ++
 11 files changed, 109 insertions(+), 2 deletions(-)

diff --git a/.github/actions/check-kill-switch/README.md b/.github/actions/check-kill-switch/README.md
index f139743f891..7270f4e107c 100644
--- a/.github/actions/check-kill-switch/README.md
+++ b/.github/actions/check-kill-switch/README.md
@@ -41,6 +41,16 @@ and a read lane's broker check, while one exists.
 | `value` | empty | The org switch, normally `${{ vars.CLAUDE_LANES_DISABLED }}` |
 | `repo-value` | empty | The repository switch, normally `${{ vars.CLAUDE_LANES_REPO_DISABLED }}` |
 | `token` | `${{ github.token }}` | The token whose GET /rate_limit answer is the budget reading |
+| `budget` | `true` | `false` skips the budget read, so the gate checks the switches only |
+
+A gate in a job that runs after a model turn and consumes its output sets `budget: "false"`, so a
+low budget never throws that turn's work away; the rate guard's `stop-floor` stays its backstop.
+Those gates are the write runner's (`pr-run-activity-write.yml` `run`), intake-triage's
+`apply-verdict` and `apply-refinement`, maintenance-audit-lane-runs' `judge-handoffs`,
+`judge-subscription-handoffs` and `file`, the `push-branch(es)` and `publish` jobs of
+maintenance-measure-skill-edit, maintenance-tidy-code-upkeep and upstream-apply-changelog, and
+pr-unblock's `adjudicate-feedback`. A model leg that takes over after an earlier leg handed off
+starts a fresh turn, so its gate still reads the budget.
 
 ## Outputs
 
diff --git a/.github/actions/check-kill-switch/action.yml b/.github/actions/check-kill-switch/action.yml
index 83b0d0052a2..a4d0e18fa87 100644
--- a/.github/actions/check-kill-switch/action.yml
+++ b/.github/actions/check-kill-switch/action.yml
@@ -30,6 +30,14 @@ inputs:
       to the job's GITHUB_TOKEN.
     required: false
     default: ${{ github.token }}
+  budget:
+    description: >
+      `false` skips the budget read: the gate checks the switches only. Set
+      on a gate that runs after a model turn, so a low budget never throws
+      that turn's work away; the rate guard's stop-floor is its backstop.
+      Any other value reads the budget.
+    required: false
+    default: "true"
 
 outputs:
   proceed:
@@ -52,4 +60,5 @@ runs:
         KILL_SWITCH_VALUE: ${{ inputs.value }}
         REPO_KILL_SWITCH_VALUE: ${{ inputs.repo-value }}
         BUDGET_TOKEN: ${{ inputs.token }}
+        BUDGET_CHECK: ${{ inputs.budget }}
       run: node "$GITHUB_ACTION_PATH/check-kill-switch.mjs"
diff --git a/.github/actions/check-kill-switch/check-kill-switch.mjs b/.github/actions/check-kill-switch/check-kill-switch.mjs
index 825b457e731..5aa446891d5 100644
--- a/.github/actions/check-kill-switch/check-kill-switch.mjs
+++ b/.github/actions/check-kill-switch/check-kill-switch.mjs
@@ -11,7 +11,9 @@
 //   is still ahead. A read that fails or cannot be read proceeds with a
 //   warning; the rate guard's stop-floor (log-api-budget/rate-guard.mjs) is
 //   the backstop. GitHub counts this call against the secondary limit, not the
-//   primary one, so it is made once, with no retry.
+//   primary one, so it is made once, with no retry. BUDGET_CHECK=false (the
+//   action's `budget: false`, set on gates that run after a model turn) skips
+//   the read, so a low budget never throws finished model work away.
 //
 // Every stop is reason=kill-switch; cause says which: switch, expiry (a
 // `true@<time>` still ahead), budget, or ok when the lane proceeds.
@@ -135,7 +137,7 @@ export function writeOutputs(outputs, outputPath = process.env.GITHUB_OUTPUT) {
 
 export async function main(env = process.env, { fetchImpl = fetch, now = Date.now, log = (line) => console.log(line) } = {}) {
   let result = checkKillSwitch(env.KILL_SWITCH_VALUE, env.REPO_KILL_SWITCH_VALUE, now());
-  if (result.proceed === "true") {
+  if (result.proceed === "true" && env.BUDGET_CHECK !== "false") {
     const share = await startGateShare(env.RESOLVED_CONFIG, log);
     const budget = await checkBudget({ token: env.BUDGET_TOKEN, api: env.GITHUB_API_URL || undefined, share, now: now() / 1000, fetchImpl });
     log(budget.line);
diff --git a/.github/actions/check-kill-switch/check-kill-switch.test.mjs b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
index c97d5b363ab..76945ffde38 100644
--- a/.github/actions/check-kill-switch/check-kill-switch.test.mjs
+++ b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
@@ -248,6 +248,66 @@ test("limits.api github-token start-gate in the resolved config overrides the de
   assert.equal((await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 0, RESET) }), { resolved: off })).outputs.cause, "ok", "0 turns it off");
 });
 
+test("budget false makes no /rate_limit call and keeps switch-only semantics", async () => {
+  const empty = () => rateLimitResponse({ headers: headersOf(5000, 0, RESET) });
+  const off = await runMain({ ...OFF, BUDGET_CHECK: "false" }, empty);
+  assert.equal(off.calls.length, 0, "no budget call");
+  assert.deepEqual(off.outputs, { proceed: "true", reason: "ok", cause: "ok" }, "an empty pool does not stop it");
+  assert.ok(!off.lines.some((line) => line.includes("start-gate")), "no start-gate notice or warning");
+  for (const [org, repo, cause] of [
+    ["true", "false", "switch"],
+    ["false", undefined, "switch"],
+    ["true@2026-11-11T13:00:00Z", "false", "expiry"],
+  ]) {
+    const { calls, outputs } = await runMain({ KILL_SWITCH_VALUE: org, REPO_KILL_SWITCH_VALUE: repo, BUDGET_CHECK: "false" }, empty);
+    assert.deepEqual([calls.length, outputs], [0, { proceed: "false", reason: "kill-switch", cause }], `${org} / ${repo}`);
+  }
+  // Any other value reads the budget.
+  for (const value of ["true", "", "FALSE"]) {
+    const { calls, outputs } = await runMain({ ...OFF, BUDGET_CHECK: value }, empty);
+    assert.deepEqual([calls.length, outputs.cause], [1, "budget"], `BUDGET_CHECK=${JSON.stringify(value)}`);
+  }
+});
+
+// Gates in jobs that run after a model turn and consume its output read the
+// switches only; start gates before a model turn read the budget.
+const gateOf = (file, job) => {
+  const lines = readFileSync(fileURLToPath(new URL(`../../workflows/${file}`, import.meta.url)), "utf8").split("\n");
+  const jobsAt = lines.indexOf("jobs:");
+  const start = lines.findIndex((line, i) => i > jobsAt && line === `  ${job}:`);
+  assert.ok(start > 0, `${file}: job ${job}`);
+  const end = lines.findIndex((line, i) => i > start && /^ {2}[a-z][a-z0-9-]*:$/.test(line));
+  const body = lines.slice(start, end < 0 ? undefined : end);
+  const uses = body.findIndex((line) => line.includes("uses: ./.base/.github/actions/check-kill-switch"));
+  assert.ok(uses > 0, `${file} ${job}: gate`);
+  const next = body.findIndex((line, i) => i > uses && /^ {6}- /.test(line));
+  return body.slice(uses, next < 0 ? undefined : next).join("\n");
+};
+const POST_MODEL = [
+  ["pr-run-activity-write.yml", "run"],
+  ["intake-triage.yml", "apply-verdict"],
+  ["intake-triage.yml", "apply-refinement"],
+  ["maintenance-audit-lane-runs.yml", "judge-handoffs"],
+  ["maintenance-audit-lane-runs.yml", "judge-subscription-handoffs"],
+  ["maintenance-audit-lane-runs.yml", "file"],
+  ["maintenance-measure-skill-edit.yml", "push-branch"],
+  ["maintenance-measure-skill-edit.yml", "publish"],
+  ["maintenance-tidy-code-upkeep.yml", "push-branches"],
+  ["maintenance-tidy-code-upkeep.yml", "publish"],
+  ["upstream-apply-changelog.yml", "push-branches"],
+  ["upstream-apply-changelog.yml", "publish"],
+  ["pr-unblock.yml", "adjudicate-feedback"],
+];
+
+test("gates after a model turn skip the budget; start gates before one read it", () => {
+  for (const [file, job] of POST_MODEL) {
+    assert.match(gateOf(file, job), /^ {10}budget: "false"$/m, `${file} ${job}`);
+  }
+  for (const [file, job] of [["pr-run-activity-read.yml", "broker-check"], ["pr-run-activity-read.yml", "run"], ["intake-triage.yml", "refine-issue"], ["work-unblock.yml", "label-unblocked"]]) {
+    assert.doesNotMatch(gateOf(file, job), /budget:/, `${file} ${job}`);
+  }
+});
+
 test("a failed budget read proceeds", async () => {
   const { outputs, lines } = await runMain(OFF, new Error("socket hang up"));
   assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok" });
diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml
index f162beaa087..0f3838dcc21 100644
--- a/.github/workflows/intake-triage.yml
+++ b/.github/workflows/intake-triage.yml
@@ -520,6 +520,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       # The broker mints only for a listed human, or github-actions[bot] on a
       # dispatch (intake-reenter.yml, the triage sweep), and a re-run only for
@@ -2048,6 +2050,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       - name: Check who started the run
         id: who
diff --git a/.github/workflows/maintenance-audit-lane-runs.yml b/.github/workflows/maintenance-audit-lane-runs.yml
index cc74fc66c64..83926ca709b 100644
--- a/.github/workflows/maintenance-audit-lane-runs.yml
+++ b/.github/workflows/maintenance-audit-lane-runs.yml
@@ -512,6 +512,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       - name: Download the handoff markers
         id: download
@@ -910,6 +912,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       - name: Download the handoff markers
         id: download
@@ -1214,6 +1218,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       - name: Download the units
         if: steps.kill.outputs.proceed == 'true'
diff --git a/.github/workflows/maintenance-measure-skill-edit.yml b/.github/workflows/maintenance-measure-skill-edit.yml
index 57e3e2b1e06..c2a1bc8138f 100644
--- a/.github/workflows/maintenance-measure-skill-edit.yml
+++ b/.github/workflows/maintenance-measure-skill-edit.yml
@@ -1091,6 +1091,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       - name: Resolve the config
         id: config
@@ -1239,6 +1241,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       - name: Resolve the config
         id: config
diff --git a/.github/workflows/maintenance-tidy-code-upkeep.yml b/.github/workflows/maintenance-tidy-code-upkeep.yml
index b8ecf7fe392..b673cdb9f72 100644
--- a/.github/workflows/maintenance-tidy-code-upkeep.yml
+++ b/.github/workflows/maintenance-tidy-code-upkeep.yml
@@ -1269,6 +1269,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       - name: Resolve the config
         id: config
@@ -1398,6 +1400,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       - name: Resolve the config
         id: config
diff --git a/.github/workflows/pr-run-activity-write.yml b/.github/workflows/pr-run-activity-write.yml
index 4d228f60d9b..56a30ffd2ab 100644
--- a/.github/workflows/pr-run-activity-write.yml
+++ b/.github/workflows/pr-run-activity-write.yml
@@ -790,6 +790,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       # The lanes App bot never starts a write activity, on any event, so one
       # write cannot chain into the next; a re-run must be started by a listed
diff --git a/.github/workflows/pr-unblock.yml b/.github/workflows/pr-unblock.yml
index aa076ece35f..36c4432b91a 100644
--- a/.github/workflows/pr-unblock.yml
+++ b/.github/workflows/pr-unblock.yml
@@ -2014,6 +2014,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       # The select job's thread file and the scan job's replies, from the one
       # leg the reply job reads; prepare checks each against its writer's SHA-256.
diff --git a/.github/workflows/upstream-apply-changelog.yml b/.github/workflows/upstream-apply-changelog.yml
index 05e09e14c9e..98f141fba5c 100644
--- a/.github/workflows/upstream-apply-changelog.yml
+++ b/.github/workflows/upstream-apply-changelog.yml
@@ -2185,6 +2185,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       - name: Resolve the config
         id: config
@@ -2322,6 +2324,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # After a model turn: switches only, so a low budget never drops its work.
+          budget: "false"
 
       - name: Resolve the config
         id: config

From 8c9e3a019a633df778ff255a7f6453c4f8a15410 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Wed, 11 Nov 2026 10:36:01 -0500
Subject: [PATCH 5/9] feat(pr-pipeline): read the budget only at gates that
 start new work

check-kill-switch's budget input now defaults to "false" (switches only).
budget: "true" is set on the 17 gates that start new work: the read
runner's broker-check, intake triage and refine select, intake re-entry,
the work-unblock sweep, the pr-unblock dispatcher and the schedule ticks
that start work. Reviews, merges, verdicts, verify notes, writes after a
model turn, handed-off model legs and evals check the switches only.
check-kill-switch.test.mjs classifies every gate in .github/workflows and
fails on one it does not know.

A budget stop writes the window's reset as an output. broker-check's
budget step carries it in its name, and work-unblock's sweep re-fires a
budget-stopped issue run only once that reset has passed (an hour after the
run ended when the name carries none), so each stop gets one record.

The true@<time> switch form is dropped: the other switch readers do not
honor it. Each kill-switch report step prints the cause beside the reason.
The start-gate share is read from rate-limits.json alone, with no copy in
the gate; the docs say a pr-pipeline.yaml value has no effect on it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q1HHi6JACp77x2ZbE7
---
 ...-kill-switch-start-gate-budget-16d00f6e.md |   2 +-
 .github/actions/check-kill-switch/README.md   |  63 ++--
 .github/actions/check-kill-switch/action.yml  |  46 +--
 .../check-kill-switch/check-kill-switch.mjs   | 106 +++---
 .../check-kill-switch.test.mjs                | 311 ++++++++++--------
 .github/actions/log-api-budget/rate-guard.mjs |   3 +-
 .../actions/resolve-config/callers.test.mjs   |   8 +-
 .../scripts/work-unblock/label-unblocked.mjs  |  47 ++-
 .../work-unblock/label-unblocked.test.mjs     |  69 ++--
 .github/workflows/eval-browser-dispatch.yml   |  10 +-
 .github/workflows/eval-hill-climb-pass.yml    |  10 +-
 .github/workflows/intake-reenter.yml          |   5 +-
 .github/workflows/intake-triage.yml           |  11 +-
 .../workflows/maintenance-audit-lane-runs.yml |  13 +-
 .../maintenance-delete-stale-branches.yml     |   8 +-
 .../maintenance-file-recurring-issues.yml     |   5 +-
 .../maintenance-measure-skill-edit.yml        |  12 +-
 .../workflows/maintenance-monitor-signals.yml |   5 +-
 .../maintenance-reconcile-lost-runs.yml       |   2 +
 .../maintenance-tidy-code-upkeep.yml          |   9 +-
 .../workflows/post-merge-demotion-alert.yml   |   3 +-
 .../workflows/post-merge-test-mutation.yml    |   5 +-
 .github/workflows/pr-feedback-dispatch.yml    |   6 +-
 .github/workflows/pr-merge.yml                |   3 +-
 .github/workflows/pr-review-hosted.yml        |   3 +-
 .github/workflows/pr-review-main.yml          |   9 +-
 .../workflows/pr-review-security-hosted.yml   |   3 +-
 .github/workflows/pr-run-activity-read.yml    |  22 +-
 .github/workflows/pr-run-activity-write.yml   |   2 -
 .github/workflows/pr-unblock-dispatch.yml     |   7 +-
 .github/workflows/pr-unblock.yml              |   2 -
 .github/workflows/pr-verify.yml               |   9 +-
 .../workflows/upstream-apply-changelog.yml    |   9 +-
 .github/workflows/work-unblock.yml            |  11 +-
 docs/conventions/pr-pipeline.yaml             |   4 +-
 docs/conventions/pr-pipeline/README.md        |   2 +-
 .../pr-pipeline/pr-pipeline.schema.json       |   2 +-
 37 files changed, 470 insertions(+), 377 deletions(-)

diff --git a/.changes/pr-pipeline/feat-kill-switch-start-gate-budget-16d00f6e.md b/.changes/pr-pipeline/feat-kill-switch-start-gate-budget-16d00f6e.md
index 29cb22566c8..a1fd099afa3 100644
--- a/.changes/pr-pipeline/feat-kill-switch-start-gate-budget-16d00f6e.md
+++ b/.changes/pr-pipeline/feat-kill-switch-start-gate-budget-16d00f6e.md
@@ -4,4 +4,4 @@ bump: minor
 
 ### Added
 
-- `limits.api.github-token.start-gate`, a share of the header's `x-ratelimit-limit` (default 0.1, in `.github/actions/log-api-budget/rate-limits.json`). The kill-switch gate (`.github/actions/check-kill-switch`) now also stops a lane at its start while the GITHUB_TOKEN core pool's remaining is under that share and the reset is still ahead, from one GET /rate_limit with the job's token (its `x-ratelimit-*` headers, else the body's `resources.core`). The stop keeps `reason=kill-switch`; a new `cause` output says `switch`, `expiry`, `budget` or `ok`. A failed or unreadable read proceeds with a warning. Each switch variable also accepts `true@<UTC time>`, which stops until that time. work-unblock's sweep re-fires a budget-stopped issue run on its next sweep and never counts it toward `limits.limit-stops-per-issue`.
+- The kill-switch gate (`.github/actions/check-kill-switch`) takes a `budget` input. On a gate that starts new work (`budget: "true"`), it stops the lane while the GITHUB_TOKEN core pool's remaining is under github-token's `start-gate` share (0.1, read from `.github/actions/log-api-budget/rate-limits.json` alone) and the reset is still ahead, from one GET /rate_limit with the job's token: its `x-ratelimit-*` headers, else the body's `resources.core`. A gate that finishes or judges existing work keeps the default, switches only. The stop keeps `reason=kill-switch`. New outputs: `cause` (`switch`, `budget` or `ok`) and `reset`. A failed or unreadable read proceeds with a warning. work-unblock's sweep re-fires a budget-stopped issue run once the window's reset has passed, and never counts it toward `limits.limit-stops-per-issue`.
diff --git a/.github/actions/check-kill-switch/README.md b/.github/actions/check-kill-switch/README.md
index 7270f4e107c..4ed1e4152b0 100644
--- a/.github/actions/check-kill-switch/README.md
+++ b/.github/actions/check-kill-switch/README.md
@@ -1,33 +1,22 @@
 # check-kill-switch
 
-Gate a CI lane on the org and repository kill switches, then on the GITHUB_TOKEN budget, before
-its model step. Each switch proceeds only on exactly `false`, or on `true@<time>` once that time
-has passed; a switch that is unset, empty or holds any other value stops the lane
+Gate a CI lane on the org and repository kill switches before its model step, and, on a gate that
+starts new work, on the GITHUB_TOKEN budget too. The lane proceeds only when both switches read
+exactly `false`; a switch that is unset, empty or holds any other value stops it
 ([ADR 0049](../../../docs/adr/0049-run-ci-lanes-on-github-hosted-runners-under-trigger-and-token-hardening.md)
 condition 4). Nothing writes the switches automatically: they are manual brakes.
 
-| Switch value | Gate |
-|---|---|
-| `false` | proceeds |
-| `true@2026-11-11T18:00:00Z` (UTC, seconds, `Z`) | stops until that time, then proceeds |
-| unset, empty, `true`, a malformed time, anything else | stops |
-
-The `true@<time>` form is this gate's alone. `merge-holds.mjs` `switchHold` and
-`babysit_merge_policy.py` still hold on any value but `false`, and the token broker reads the
-switches by its own rule, so a lapsed `true@<time>` can still hold those until someone sets
-`false`.
-
-With both switches proceeding, the gate makes one GET /rate_limit with `token` and reads the core
-pool from the `x-ratelimit-limit`, `-remaining` and `-reset` headers, or from the body's
-`resources.core` when a header is missing. It stops the lane while remaining is under
-`limits.api.github-token.start-gate` of the limit (default 0.1, in
-[`rate-limits.json`](../log-api-budget/rate-limits.json); `pr-pipeline.yaml` overrides it only where
-the job's env sets `RESOLVED_CONFIG`, which no workflow does for this gate yet) and the reset is still ahead. A read that
-fails, times out or carries no reading proceeds with a warning; the rate guard's `stop-floor` is
-the backstop. GitHub counts GET /rate_limit against the secondary limit, not the primary one, so
-the gate makes it once, with no retry, and not at all when a switch already stops. Each read
-logs one `start-gate` notice with the body's core block and the response's rate-limit headers,
-so the two can be compared.
+With `budget: "true"` and both switches proceeding, the gate makes one GET /rate_limit with
+`token` and reads the core pool from the `x-ratelimit-limit`, `-remaining` and `-reset` headers,
+or from the body's `resources.core` when a header is missing. It stops the lane while remaining
+is under github-token's `start-gate` share of the limit and the reset is still ahead. The share
+is read from [`rate-limits.json`](../log-api-budget/rate-limits.json) alone (0.1); no
+`pr-pipeline.yaml` field overrides it. A read that fails, times out or carries no reading, or a
+share that cannot be read, proceeds with a warning; the rate guard's `stop-floor` is the
+backstop. GitHub counts GET /rate_limit against the secondary limit, not the primary one, so the
+gate makes it once, with no retry, and not at all when a switch already stops. Each read logs one
+`start-gate` notice with the body's core block and the response's rate-limit headers, so the two
+can be compared.
 
 The repository switch has its own name because a repository variable named
 `CLAUDE_LANES_DISABLED` replaces the org value in `vars`, so it could re-enable lanes under an
@@ -40,17 +29,17 @@ and a read lane's broker check, while one exists.
 |---|---|---|
 | `value` | empty | The org switch, normally `${{ vars.CLAUDE_LANES_DISABLED }}` |
 | `repo-value` | empty | The repository switch, normally `${{ vars.CLAUDE_LANES_REPO_DISABLED }}` |
+| `budget` | `false` | `true` also reads the GITHUB_TOKEN budget |
 | `token` | `${{ github.token }}` | The token whose GET /rate_limit answer is the budget reading |
-| `budget` | `true` | `false` skips the budget read, so the gate checks the switches only |
 
-A gate in a job that runs after a model turn and consumes its output sets `budget: "false"`, so a
-low budget never throws that turn's work away; the rate guard's `stop-floor` stays its backstop.
-Those gates are the write runner's (`pr-run-activity-write.yml` `run`), intake-triage's
-`apply-verdict` and `apply-refinement`, maintenance-audit-lane-runs' `judge-handoffs`,
-`judge-subscription-handoffs` and `file`, the `push-branch(es)` and `publish` jobs of
-maintenance-measure-skill-edit, maintenance-tidy-code-upkeep and upstream-apply-changelog, and
-pr-unblock's `adjudicate-feedback`. A model leg that takes over after an earlier leg handed off
-starts a fresh turn, so its gate still reads the budget.
+Set `budget: "true"` only on a gate that starts new work: the read runner's `broker-check`, a
+workflow's first gate on a schedule or event that begins a run's work (intake triage and its
+refine select, the audit, cleanup, recurring-issue, skill-edit, signals, reconcile, tidy,
+mutation and changelog ticks, the pr-unblock dispatcher, and the work-unblock sweep). A gate
+that finishes or judges existing work keeps the default, so a low budget never throws that work
+away: reviews, merges, verdicts and verify notes, writes after a model turn, and model legs that
+take over a handed-off turn. Evals, which a person or a pull request starts, keep it too. `check-kill-switch.test.mjs` classifies
+every gate in `.github/workflows` and fails on one it does not know.
 
 ## Outputs
 
@@ -58,9 +47,11 @@ starts a fresh turn, so its gate still reads the budget.
 |---|---|
 | `proceed` | `true` when both switches proceed and the budget does not stop the lane; otherwise `false` |
 | `reason` | `ok` or `kill-switch`, for every stop |
-| `cause` | `ok`, `switch` (a switch stops), `expiry` (a `true@<time>` still ahead) or `budget` |
+| `cause` | `ok`, `switch` (a switch stops) or `budget` |
+| `reset` | on a budget stop, the epoch second the reading's window resets; otherwise empty |
 
-The step always exits 0. A stopped lane is an expected outcome, not a failure.
+The step always exits 0. A stopped lane is an expected outcome, not a failure. A step that
+reports the stop prints `cause` beside `reason`, so a budget stop is not read as a switch.
 
 ## Job contract
 
diff --git a/.github/actions/check-kill-switch/action.yml b/.github/actions/check-kill-switch/action.yml
index a4d0e18fa87..1e756199e2c 100644
--- a/.github/actions/check-kill-switch/action.yml
+++ b/.github/actions/check-kill-switch/action.yml
@@ -1,43 +1,42 @@
 name: Check Kill Switch
 description: >
-  Start gate for a CI lane: the org and repository kill switches, then the
-  GITHUB_TOKEN budget. Each switch proceeds only on exactly `false`;
-  `true@<UTC time>` stops until that time; unset, empty and every other value
-  stop. With both switches off, one GET /rate_limit stops the lane while the
-  core pool's remaining is under limits.api github-token start-gate of its
-  limit; a failed read proceeds. Every stop is proceed=false
-  reason=kill-switch, with cause switch, expiry or budget. Always exits 0:
-  the model step's `if:` reads the output, so a missing output also keeps the
-  lane stopped.
+  Gate a CI lane on the org and repository kill switches, and, on a gate
+  that starts new work (budget "true"), the GITHUB_TOKEN budget. Each switch
+  proceeds only on exactly `false`; unset, empty and every other value stop.
+  With budget "true" and both switches off, one GET /rate_limit stops the
+  lane while the core pool's remaining is under rate-limits.json's
+  github-token start-gate share of its limit; a failed read proceeds. Every
+  stop is proceed=false reason=kill-switch, with cause switch or budget.
+  Always exits 0: the model step's `if:` reads the output, so a missing
+  output also keeps the lane stopped.
 
 inputs:
   value:
     description: >
       The org kill-switch value, normally `vars.CLAUDE_LANES_DISABLED`. Only
-      `false`, or a `true@<UTC time>` already past, lets the lane proceed.
+      the exact string `false` lets the lane proceed.
     required: false
     default: ""
   repo-value:
     description: >
       The repository kill-switch value, normally
-      `vars.CLAUDE_LANES_REPO_DISABLED`. Only `false`, or a
-      `true@<UTC time>` already past, lets the lane proceed.
+      `vars.CLAUDE_LANES_REPO_DISABLED`. Only the exact string `false` lets
+      the lane proceed.
     required: false
     default: ""
+  budget:
+    description: >
+      `true` also reads the GITHUB_TOKEN budget. Set it only on a gate that
+      starts new work; a gate that finishes or judges existing work keeps the
+      default, switches only, so a low budget never throws that work away.
+    required: false
+    default: "false"
   token:
     description: >
       The token whose GET /rate_limit answer is the budget reading. Defaults
       to the job's GITHUB_TOKEN.
     required: false
     default: ${{ github.token }}
-  budget:
-    description: >
-      `false` skips the budget read: the gate checks the switches only. Set
-      on a gate that runs after a model turn, so a low budget never throws
-      that turn's work away; the rate guard's stop-floor is its backstop.
-      Any other value reads the budget.
-    required: false
-    default: "true"
 
 outputs:
   proceed:
@@ -47,8 +46,11 @@ outputs:
     description: "`ok` or `kill-switch`."
     value: ${{ steps.check.outputs.reason }}
   cause:
-    description: "`ok`, or why the lane stopped: `switch`, `expiry` or `budget`."
+    description: "`ok`, or why the lane stopped: `switch` or `budget`."
     value: ${{ steps.check.outputs.cause }}
+  reset:
+    description: "On a budget stop, the epoch second the reading's window resets; otherwise empty."
+    value: ${{ steps.check.outputs.reset }}
 
 runs:
   using: composite
@@ -59,6 +61,6 @@ runs:
       env:
         KILL_SWITCH_VALUE: ${{ inputs.value }}
         REPO_KILL_SWITCH_VALUE: ${{ inputs.repo-value }}
-        BUDGET_TOKEN: ${{ inputs.token }}
         BUDGET_CHECK: ${{ inputs.budget }}
+        BUDGET_TOKEN: ${{ inputs.token }}
       run: node "$GITHUB_ACTION_PATH/check-kill-switch.mjs"
diff --git a/.github/actions/check-kill-switch/check-kill-switch.mjs b/.github/actions/check-kill-switch/check-kill-switch.mjs
index 5aa446891d5..69847814453 100644
--- a/.github/actions/check-kill-switch/check-kill-switch.mjs
+++ b/.github/actions/check-kill-switch/check-kill-switch.mjs
@@ -1,51 +1,36 @@
-// Start gate for CI lanes. Two manual switches, then the GITHUB_TOKEN budget:
+// Gate for CI lanes: two manual switches, then, on a gate that starts new
+// work, the GITHUB_TOKEN budget.
 //
 // - The org switch and the repository switch each proceed only on exactly
-//   `false`. `true@<time>` (`true@2026-11-11T18:00:00Z`, UTC, seconds, `Z`)
-//   stops until that time and then proceeds; any other value, a malformed time
-//   included, stops (fail closed).
-// - With both switches proceeding, one GET /rate_limit with the job's token
-//   reads the core pool: x-ratelimit-limit, -remaining and -reset when the
-//   response carries all three, else the body's resources.core. The lane stops
-//   while remaining < limits.api github-token start-gate x limit and the reset
-//   is still ahead. A read that fails or cannot be read proceeds with a
-//   warning; the rate guard's stop-floor (log-api-budget/rate-guard.mjs) is
-//   the backstop. GitHub counts this call against the secondary limit, not the
-//   primary one, so it is made once, with no retry. BUDGET_CHECK=false (the
-//   action's `budget: false`, set on gates that run after a model turn) skips
-//   the read, so a low budget never throws finished model work away.
+//   `false`. Unset, empty and every other value stop the lane (fail closed).
+// - With BUDGET_CHECK=true (the action's `budget: "true"`, set only on gates
+//   that start new work) and both switches proceeding, one GET /rate_limit
+//   with the job's token reads the core pool: x-ratelimit-limit, -remaining
+//   and -reset when the response carries all three, else the body's
+//   resources.core. The lane stops while remaining < start-gate x limit and
+//   the reset is still ahead; start-gate is github-token's entry in
+//   ../log-api-budget/rate-limits.json. A read that fails or cannot be read,
+//   or a share that cannot be read, proceeds with a warning; the rate guard's
+//   stop-floor (log-api-budget/rate-guard.mjs) is the backstop. GitHub counts
+//   this call against the secondary limit, not the primary one, so it is made
+//   once, with no retry. A gate that finishes or judges existing work leaves
+//   the budget off, so a low budget never throws that work away.
 //
-// Every stop is reason=kill-switch; cause says which: switch, expiry (a
-// `true@<time>` still ahead), budget, or ok when the lane proceeds.
+// Every stop is reason=kill-switch; cause says which: switch, budget, or ok
+// when the lane proceeds. A budget stop also writes reset, the epoch second
+// the reading's window resets.
 import { randomUUID } from "node:crypto";
-import { appendFileSync } from "node:fs";
+import { appendFileSync, readFileSync } from "node:fs";
 import process from "node:process";
 import { pathToFileURL } from "node:url";
 
-// rate-limits.json's github-token start-gate, used when log-api-budget is not
-// in the job's checkout (check-kill-switch.test.mjs holds the two equal).
-export const START_GATE_SHARE = 0.1;
 const READ_TIMEOUT_MS = 10_000;
-const TIMED = /^true@(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\dZ)$/;
+const RATE_LIMITS = new URL("../log-api-budget/rate-limits.json", import.meta.url);
 
-// One switch value at `now` (ms): ok, switch, or expiry while its time is ahead.
-export function switchCause(value, now = Date.now()) {
-  if (value === "false") {
-    return "ok";
-  }
-  const time = TIMED.exec(value ?? "")?.[1];
-  const until = time ? Date.parse(time) : Number.NaN;
-  // Date.parse rolls 2026-02-30 over to March; only a real date round-trips.
-  if (!Number.isFinite(until) || new Date(until).toISOString() !== time.replace("Z", ".000Z")) {
-    return "switch";
-  }
-  return now < until ? "expiry" : "ok";
-}
-
-export function checkKillSwitch(value, repoValue, now = Date.now()) {
-  const causes = [switchCause(value, now), switchCause(repoValue, now)];
-  const cause = causes.includes("switch") ? "switch" : causes.includes("expiry") ? "expiry" : "ok";
-  return cause === "ok" ? { proceed: "true", reason: "ok", cause } : { proceed: "false", reason: "kill-switch", cause };
+export function checkKillSwitch(value, repoValue) {
+  return value === "false" && repoValue === "false"
+    ? { proceed: "true", reason: "ok", cause: "ok" }
+    : { proceed: "false", reason: "kill-switch", cause: "switch" };
 }
 
 // Whether `reading` ({ limit, remaining, reset }, reset in epoch seconds) is
@@ -73,8 +58,8 @@ export function readingOf(headers, body) {
 const clean = (text) => String(text).replace(/[\r\n%:]/g, " ");
 const show = (fields) => Object.entries(fields ?? {}).map(([name, value]) => `${name}=${clean(value ?? "na")}`).join(" ");
 
-// The budget half of the gate: { stop, line } where line is the run's one
-// notice or warning. Never throws.
+// The budget half of the gate: { stop, reset, line } where line is the run's
+// one notice or warning. Never throws.
 export async function checkBudget({ token, api = "https://api.github.com", share, now = Date.now() / 1000, fetchImpl = fetch } = {}) {
   if (!token) {
     return { stop: false, line: "::warning title=start-gate::no token to read the GITHUB_TOKEN budget; the lane proceeds" };
@@ -95,6 +80,7 @@ export async function checkBudget({ token, api = "https://api.github.com", share
     const coreFields = core && { limit: core.limit, remaining: core.remaining, reset: core.reset, used: core.used };
     return {
       stop,
+      reset: reading.reset,
       line:
         `::notice title=start-gate::github-token start-gate=${share} decided from ${reading.source}: limit=${reading.limit} remaining=${reading.remaining} reset=${reading.reset} stop=${stop}; ` +
         `body core ${core ? show(coreFields) : "absent"}; headers ${show(header)}`,
@@ -104,16 +90,18 @@ export async function checkBudget({ token, api = "https://api.github.com", share
   }
 }
 
-// limits.api github-token start-gate, from RESOLVED_CONFIG over rate-limits.json
-// (rate-guard.mjs apiLimitsOrBuiltIn), or START_GATE_SHARE when that module is
-// not in the job's checkout.
-async function startGateShare(resolvedPath, log) {
+// github-token's start-gate share from rate-limits.json, the only copy, or
+// null with a warning when it cannot be read.
+export function startGateShare(path = RATE_LIMITS, log = (line) => console.log(line)) {
   try {
-    const { apiLimitsOrBuiltIn } = await import(new URL("../log-api-budget/rate-guard.mjs", import.meta.url));
-    return apiLimitsOrBuiltIn({ resolvedPath: resolvedPath ?? "", log })["github-token"]["start-gate"] ?? START_GATE_SHARE;
+    const share = JSON.parse(readFileSync(path, "utf8"))?.["github-token"]?.["start-gate"];
+    if (typeof share !== "number" || share < 0 || share > 1) {
+      throw new Error("github-token start-gate is not a share from 0 to 1");
+    }
+    return share;
   } catch (error) {
-    log(`::warning title=start-gate::rate-guard.mjs could not be loaded (${clean(error?.code ?? error?.message)}); start-gate share ${START_GATE_SHARE}`);
-    return START_GATE_SHARE;
+    log(`::warning title=start-gate::rate-limits.json gave no start-gate share (${clean(error?.code ?? error?.message)}); the lane proceeds without a budget read`);
+    return null;
   }
 }
 
@@ -135,18 +123,20 @@ export function writeOutputs(outputs, outputPath = process.env.GITHUB_OUTPUT) {
   appendFileSync(outputPath, text);
 }
 
-export async function main(env = process.env, { fetchImpl = fetch, now = Date.now, log = (line) => console.log(line) } = {}) {
-  let result = checkKillSwitch(env.KILL_SWITCH_VALUE, env.REPO_KILL_SWITCH_VALUE, now());
-  if (result.proceed === "true" && env.BUDGET_CHECK !== "false") {
-    const share = await startGateShare(env.RESOLVED_CONFIG, log);
-    const budget = await checkBudget({ token: env.BUDGET_TOKEN, api: env.GITHUB_API_URL || undefined, share, now: now() / 1000, fetchImpl });
-    log(budget.line);
-    if (budget.stop) {
-      result = { proceed: "false", reason: "kill-switch", cause: "budget" };
+export async function main(env = process.env, { fetchImpl = fetch, now = Date.now, log = (line) => console.log(line), rateLimits = RATE_LIMITS } = {}) {
+  let result = { ...checkKillSwitch(env.KILL_SWITCH_VALUE, env.REPO_KILL_SWITCH_VALUE), reset: "" };
+  if (result.proceed === "true" && env.BUDGET_CHECK === "true") {
+    const share = startGateShare(rateLimits, log);
+    if (share !== null) {
+      const budget = await checkBudget({ token: env.BUDGET_TOKEN, api: env.GITHUB_API_URL || undefined, share, now: now() / 1000, fetchImpl });
+      log(budget.line);
+      if (budget.stop) {
+        result = { proceed: "false", reason: "kill-switch", cause: "budget", reset: String(budget.reset) };
+      }
     }
   }
   writeOutputs(result, env.GITHUB_OUTPUT);
-  log(`check-kill-switch: proceed=${result.proceed} reason=${result.reason} cause=${result.cause}`);
+  log(`check-kill-switch: proceed=${result.proceed} reason=${result.reason} cause=${result.cause}${result.reset ? ` reset=${result.reset}` : ""}`);
 }
 
 if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
diff --git a/.github/actions/check-kill-switch/check-kill-switch.test.mjs b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
index 76945ffde38..1556cb7ac6e 100644
--- a/.github/actions/check-kill-switch/check-kill-switch.test.mjs
+++ b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
@@ -1,28 +1,28 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { copyFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { test } from "node:test";
 import { fileURLToPath } from "node:url";
 
-import { budgetStops, checkBudget, checkKillSwitch, main, START_GATE_SHARE, switchCause, writeOutputs } from "./check-kill-switch.mjs";
+import { budgetStops, checkBudget, checkKillSwitch, main, startGateShare, writeOutputs } from "./check-kill-switch.mjs";
 import { readOutputs } from "./fixtures/read-outputs.mjs";
 import { tempDir } from "../../../lib/test-tmp.mjs";
 
 const SCRIPT = fileURLToPath(new URL("./check-kill-switch.mjs", import.meta.url));
-const RATE_LIMITS = fileURLToPath(new URL("../log-api-budget/rate-limits.json", import.meta.url));
+const WORKFLOWS = fileURLToPath(new URL("../../workflows/", import.meta.url));
 
 // 2026-11-11T12:00:00Z.
 const NOW_MS = Date.parse("2026-11-11T12:00:00Z");
 const NOW_S = NOW_MS / 1000;
 const RESET = NOW_S + 1200;
 
-function runCli(env) {
+function runCli(env, script = SCRIPT) {
   const dir = tempDir("kill-switch-");
   try {
     const outputPath = path.join(dir, "output");
     writeFileSync(outputPath, "");
-    const result = spawnSync(process.execPath, [SCRIPT], {
+    const result = spawnSync(process.execPath, [script], {
       env: { PATH: process.env.PATH, GITHUB_OUTPUT: outputPath, ...env },
       encoding: "utf8",
     });
@@ -58,7 +58,7 @@ const headersOf = (limit, remaining, reset) => ({
 });
 
 test("proceeds only when the org and the repository switch both read exactly false", () => {
-  assert.deepEqual(checkKillSwitch("false", "false", NOW_MS), { proceed: "true", reason: "ok", cause: "ok" });
+  assert.deepEqual(checkKillSwitch("false", "false"), { proceed: "true", reason: "ok", cause: "ok" });
 });
 
 const NOT_FALSE = [
@@ -67,52 +67,21 @@ const NOT_FALSE = [
   ["true", "true"],
   ["FALSE in capitals", "FALSE"],
   ["false with whitespace", " false"],
+  ["a timed value", "true@2026-11-11T11:00:00Z"],
 ];
 
 for (const [label, value] of NOT_FALSE) {
   test(`stops when the org switch is ${label}, whatever the repository switch`, () => {
     for (const repo of ["false", "true", undefined]) {
-      assert.deepEqual(checkKillSwitch(value, repo, NOW_MS), { proceed: "false", reason: "kill-switch", cause: "switch" });
+      assert.deepEqual(checkKillSwitch(value, repo), { proceed: "false", reason: "kill-switch", cause: "switch" });
     }
   });
 
   test(`stops when the repository switch is ${label} and the org switch is false`, () => {
-    assert.deepEqual(checkKillSwitch("false", value, NOW_MS), { proceed: "false", reason: "kill-switch", cause: "switch" });
-  });
-}
-
-test("true@<time> stops until that time and proceeds from it", () => {
-  assert.equal(switchCause("true@2026-11-11T12:00:01Z", NOW_MS), "expiry", "one second ahead");
-  assert.equal(switchCause("true@2026-11-11T12:00:00Z", NOW_MS), "ok", "at the time");
-  assert.equal(switchCause("true@2026-11-11T11:59:59Z", NOW_MS), "ok", "one second past");
-  assert.deepEqual(checkKillSwitch("true@2026-11-11T13:00:00Z", "false", NOW_MS), { proceed: "false", reason: "kill-switch", cause: "expiry" });
-  assert.deepEqual(checkKillSwitch("false", "true@2026-11-11T13:00:00Z", NOW_MS), { proceed: "false", reason: "kill-switch", cause: "expiry" });
-  assert.deepEqual(checkKillSwitch("true@2026-11-11T11:00:00Z", "true@2026-11-10T00:00:00Z", NOW_MS), { proceed: "true", reason: "ok", cause: "ok" });
-});
-
-const MALFORMED = [
-  ["no Z", "true@2026-11-11T13:00:00"],
-  ["an offset", "true@2026-11-11T13:00:00+00:00"],
-  ["no seconds", "true@2026-11-11T13:00Z"],
-  ["milliseconds", "true@2026-11-11T13:00:00.000Z"],
-  ["a day that does not exist", "true@2026-02-30T00:00:00Z"],
-  ["hour 24", "true@2026-11-11T24:00:00Z"],
-  ["TRUE in capitals", "TRUE@2026-11-11T13:00:00Z"],
-  ["false@", "false@2026-11-11T11:00:00Z"],
-  ["a past time with trailing text", "true@2026-11-11T11:00:00Z "],
-];
-
-for (const [label, value] of MALFORMED) {
-  test(`a timed switch with ${label} stops as a plain switch`, () => {
-    assert.equal(switchCause(value, NOW_MS), "switch");
+    assert.deepEqual(checkKillSwitch("false", value), { proceed: "false", reason: "kill-switch", cause: "switch" });
   });
 }
 
-test("a plain switch wins over a timed one still ahead", () => {
-  assert.deepEqual(checkKillSwitch("true", "true@2026-11-11T13:00:00Z", NOW_MS), { proceed: "false", reason: "kill-switch", cause: "switch" });
-  assert.deepEqual(checkKillSwitch("true@2026-11-11T13:00:00Z", "", NOW_MS), { proceed: "false", reason: "kill-switch", cause: "switch" });
-});
-
 // share 0.1 of a limit of 5000 is 500.
 test("the budget stops under the share of the limit while the reset is ahead", () => {
   const at = (remaining, reset = RESET) => budgetStops({ limit: 5000, remaining, reset }, 0.1, NOW_S);
@@ -132,6 +101,7 @@ test("the budget read decides from the headers when they carry limit, remaining
   const { calls, fetchImpl } = recordingFetch(answer);
   const result = await checkBudget({ token: "t", api: "https://api.example", share: 0.1, now: NOW_S, fetchImpl });
   assert.equal(result.stop, true);
+  assert.equal(result.reset, RESET);
   assert.equal(calls.length, 1, "exactly one call");
   assert.equal(calls[0].url, "https://api.example/rate_limit");
   assert.equal(calls[0].init.headers.Authorization, "Bearer t");
@@ -159,9 +129,10 @@ test("the budget read proceeds when the reset is already past", async () => {
 test("the budget read falls back to the body's resources.core when a header is missing", async () => {
   const headers = headersOf(5000, 4999, RESET);
   delete headers["x-ratelimit-remaining"];
-  const { fetchImpl } = recordingFetch(rateLimitResponse({ headers, core: { limit: 1000, remaining: 99, reset: RESET, used: 901 } }));
+  const { fetchImpl } = recordingFetch(rateLimitResponse({ headers, core: { limit: 1000, remaining: 99, reset: RESET + 60, used: 901 } }));
   const result = await checkBudget({ token: "t", share: 0.1, now: NOW_S, fetchImpl });
   assert.equal(result.stop, true, "99 of 1000 is under 100");
+  assert.equal(result.reset, RESET + 60, "the body's reset");
   assert.match(result.line, /decided from body: limit=1000 remaining=99 /);
   assert.match(result.line, /headers limit=5000 remaining=na /);
 });
@@ -200,19 +171,19 @@ test("a value in the answer cannot start a workflow command", async () => {
   assert.match(line, /resource=core 0A  error  x$/);
 });
 
-async function runMain(env, answer, { resolved } = {}) {
+async function runMain(env, answer, { rateLimits } = {}) {
   const dir = tempDir("kill-switch-");
   try {
     const outputPath = path.join(dir, "output");
     writeFileSync(outputPath, "");
-    let config;
-    if (resolved) {
-      config = path.join(dir, "resolved.json");
-      writeFileSync(config, JSON.stringify(resolved));
+    let limitsPath;
+    if (rateLimits !== undefined) {
+      limitsPath = path.join(dir, "rate-limits.json");
+      writeFileSync(limitsPath, typeof rateLimits === "string" ? rateLimits : JSON.stringify(rateLimits));
     }
     const lines = [];
     const { calls, fetchImpl } = recordingFetch(answer);
-    await main({ GITHUB_OUTPUT: outputPath, BUDGET_TOKEN: "t", RESOLVED_CONFIG: config, ...env }, { fetchImpl, now: () => NOW_MS, log: (line) => lines.push(line) });
+    await main({ GITHUB_OUTPUT: outputPath, BUDGET_TOKEN: "t", ...env }, { fetchImpl, now: () => NOW_MS, log: (line) => lines.push(line), ...(limitsPath && { rateLimits: limitsPath }) });
     return { calls, lines, outputs: readOutputs(readFileSync(outputPath, "utf8")) };
   } finally {
     rmSync(dir, { recursive: true, force: true });
@@ -220,126 +191,196 @@ async function runMain(env, answer, { resolved } = {}) {
 }
 
 const OFF = { KILL_SWITCH_VALUE: "false", REPO_KILL_SWITCH_VALUE: "false" };
+const START = { ...OFF, BUDGET_CHECK: "true" };
+const empty = () => rateLimitResponse({ headers: headersOf(5000, 0, RESET) });
+
+test("by default the gate checks the switches only and makes no /rate_limit call", async () => {
+  for (const value of [undefined, "", "false", "FALSE", "yes"]) {
+    const { calls, lines, outputs } = await runMain({ ...OFF, BUDGET_CHECK: value }, empty);
+    assert.equal(calls.length, 0, `BUDGET_CHECK=${JSON.stringify(value)}`);
+    assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok", reset: "" }, "an empty pool does not stop it");
+    assert.ok(!lines.some((line) => line.includes("start-gate")), "no start-gate notice or warning");
+  }
+  const { calls, outputs } = await runMain({ KILL_SWITCH_VALUE: "true", REPO_KILL_SWITCH_VALUE: "false" }, empty);
+  assert.deepEqual([calls.length, outputs], [0, { proceed: "false", reason: "kill-switch", cause: "switch", reset: "" }]);
+});
 
-test("a switch that stops makes no budget call", async () => {
-  const { calls, outputs } = await runMain({ KILL_SWITCH_VALUE: "true", REPO_KILL_SWITCH_VALUE: "false" }, rateLimitResponse({ headers: headersOf(5000, 4000, RESET) }));
+test("a start gate whose switch stops makes no budget call", async () => {
+  const { calls, outputs } = await runMain({ ...START, KILL_SWITCH_VALUE: "true" }, empty);
   assert.equal(calls.length, 0);
-  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "switch" });
+  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "switch", reset: "" });
 });
 
-test("a low budget stops the lane with reason kill-switch and cause budget", async () => {
-  const { calls, lines, outputs } = await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 499, RESET) }));
+test("a low budget stops a start gate with reason kill-switch, cause budget and the window's reset", async () => {
+  const { calls, lines, outputs } = await runMain(START, rateLimitResponse({ headers: headersOf(5000, 499, RESET) }));
   assert.equal(calls.length, 1);
-  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "budget" });
+  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "budget", reset: String(RESET) });
   assert.equal(lines.filter((line) => line.startsWith("::notice title=start-gate::")).length, 1, "one notice per run");
+  assert.ok(lines.includes(`check-kill-switch: proceed=false reason=kill-switch cause=budget reset=${RESET}`));
 });
 
-test("a budget at the default share proceeds", async () => {
-  const { outputs } = await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 500, RESET) }));
-  assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok" });
+test("a start gate at the share proceeds", async () => {
+  const { outputs } = await runMain(START, rateLimitResponse({ headers: headersOf(5000, 500, RESET) }));
+  assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok", reset: "" });
 });
 
-test("limits.api github-token start-gate in the resolved config overrides the default share", async () => {
+test("the share is rate-limits.json's github-token start-gate", async () => {
   // 0.5 of 5000 is 2500.
-  const resolved = { limits: { api: { "github-token": { "start-gate": 0.5 } } } };
-  assert.equal((await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 2499, RESET) }), { resolved })).outputs.cause, "budget");
-  assert.equal((await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 2500, RESET) }), { resolved })).outputs.cause, "ok");
-  const off = { limits: { api: { "github-token": { "start-gate": 0 } } } };
-  assert.equal((await runMain(OFF, rateLimitResponse({ headers: headersOf(5000, 0, RESET) }), { resolved: off })).outputs.cause, "ok", "0 turns it off");
+  const half = { "github-token": { "start-gate": 0.5 } };
+  assert.equal((await runMain(START, rateLimitResponse({ headers: headersOf(5000, 2499, RESET) }), { rateLimits: half })).outputs.cause, "budget");
+  assert.equal((await runMain(START, rateLimitResponse({ headers: headersOf(5000, 2500, RESET) }), { rateLimits: half })).outputs.cause, "ok");
+  assert.equal((await runMain(START, empty, { rateLimits: { "github-token": { "start-gate": 0 } } })).outputs.cause, "ok", "0 turns it off");
+  assert.equal(startGateShare(fileURLToPath(new URL("../log-api-budget/rate-limits.json", import.meta.url)), () => {}), 0.1, "the shipped value");
 });
 
-test("budget false makes no /rate_limit call and keeps switch-only semantics", async () => {
-  const empty = () => rateLimitResponse({ headers: headersOf(5000, 0, RESET) });
-  const off = await runMain({ ...OFF, BUDGET_CHECK: "false" }, empty);
-  assert.equal(off.calls.length, 0, "no budget call");
-  assert.deepEqual(off.outputs, { proceed: "true", reason: "ok", cause: "ok" }, "an empty pool does not stop it");
-  assert.ok(!off.lines.some((line) => line.includes("start-gate")), "no start-gate notice or warning");
-  for (const [org, repo, cause] of [
-    ["true", "false", "switch"],
-    ["false", undefined, "switch"],
-    ["true@2026-11-11T13:00:00Z", "false", "expiry"],
+test("a share that cannot be read makes no call and proceeds with a warning", async () => {
+  for (const [label, rateLimits] of [
+    ["not JSON", "{"],
+    ["no start-gate", { "github-token": {} }],
+    ["a share over 1", { "github-token": { "start-gate": 2 } }],
   ]) {
-    const { calls, outputs } = await runMain({ KILL_SWITCH_VALUE: org, REPO_KILL_SWITCH_VALUE: repo, BUDGET_CHECK: "false" }, empty);
-    assert.deepEqual([calls.length, outputs], [0, { proceed: "false", reason: "kill-switch", cause }], `${org} / ${repo}`);
-  }
-  // Any other value reads the budget.
-  for (const value of ["true", "", "FALSE"]) {
-    const { calls, outputs } = await runMain({ ...OFF, BUDGET_CHECK: value }, empty);
-    assert.deepEqual([calls.length, outputs.cause], [1, "budget"], `BUDGET_CHECK=${JSON.stringify(value)}`);
+    const { calls, lines, outputs } = await runMain(START, empty, { rateLimits });
+    assert.equal(calls.length, 0, label);
+    assert.equal(outputs.cause, "ok", label);
+    assert.ok(lines.some((line) => line.startsWith("::warning title=start-gate::rate-limits.json gave no start-gate share")), label);
   }
 });
 
-// Gates in jobs that run after a model turn and consume its output read the
-// switches only; start gates before a model turn read the budget.
-const gateOf = (file, job) => {
-  const lines = readFileSync(fileURLToPath(new URL(`../../workflows/${file}`, import.meta.url)), "utf8").split("\n");
-  const jobsAt = lines.indexOf("jobs:");
-  const start = lines.findIndex((line, i) => i > jobsAt && line === `  ${job}:`);
-  assert.ok(start > 0, `${file}: job ${job}`);
-  const end = lines.findIndex((line, i) => i > start && /^ {2}[a-z][a-z0-9-]*:$/.test(line));
-  const body = lines.slice(start, end < 0 ? undefined : end);
-  const uses = body.findIndex((line) => line.includes("uses: ./.base/.github/actions/check-kill-switch"));
-  assert.ok(uses > 0, `${file} ${job}: gate`);
-  const next = body.findIndex((line, i) => i > uses && /^ {6}- /.test(line));
-  return body.slice(uses, next < 0 ? undefined : next).join("\n");
+test("a failed budget read proceeds", async () => {
+  const { outputs, lines } = await runMain(START, new Error("socket hang up"));
+  assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok", reset: "" });
+  assert.ok(lines.some((line) => line.startsWith("::warning title=start-gate::the GITHUB_TOKEN budget was not read (socket hang up)")));
+});
+
+// Every check-kill-switch gate in the workflows, by workflow and job: `start`
+// gates begin new work and read the budget; `switch` gates finish or judge
+// existing work (reviews, merges, verdicts, post-model writes, model legs that
+// take over a handed-off turn) and check the switches only.
+const GATES = {
+  "eval-browser-dispatch.yml": { eval: "switch", "eval-subscription": "switch", "eval-fallback": "switch" },
+  "eval-hill-climb-pass.yml": { pass: "switch", "pass-subscription": "switch", "pass-fallback": "switch" },
+  "intake-reenter.yml": { reenter: "start" },
+  "intake-triage.yml": {
+    "kill-switch": "start",
+    "apply-verdict": "switch",
+    "refine-select": "start",
+    "refine-issue": "switch",
+    "refine-issue-subscription": "switch",
+    "refine-issue-fallback": "switch",
+    "apply-refinement": "switch",
+  },
+  "maintenance-audit-lane-runs.yml": {
+    collect: "start",
+    judge: "switch",
+    "judge-handoffs": "switch",
+    "judge-subscription": "switch",
+    "judge-subscription-handoffs": "switch",
+    "judge-fallback": "switch",
+    file: "switch",
+    "triage-sweep": "start",
+  },
+  "maintenance-delete-stale-branches.yml": { plan: "start", delete: "switch" },
+  "maintenance-file-recurring-issues.yml": { "file-recurring-issues": "start" },
+  "maintenance-measure-skill-edit.yml": { gate: "start", propose: "switch", "push-branch": "switch", publish: "switch" },
+  "maintenance-monitor-signals.yml": { monitor: "start" },
+  "maintenance-reconcile-lost-runs.yml": { reconcile: "start" },
+  "maintenance-tidy-code-upkeep.yml": { gate: "start", model: "switch", "model-subscription": "switch", "model-fallback": "switch", "push-branches": "switch", publish: "switch" },
+  "post-merge-demotion-alert.yml": { "report-red-main": "switch" },
+  "post-merge-test-mutation.yml": { prep: "start" },
+  "pr-feedback-dispatch.yml": { "post-verify-notes": "switch", dispatch: "switch", "rerun-ci-status": "switch" },
+  "pr-merge.yml": { "post-merge-dispatch": "switch", merge: "switch", "enable-auto-merge": "switch" },
+  "pr-rate-merge-risk.yml": { "rate-merge-risk": "switch", "rate-merge-risk-subscription": "switch", "rate-merge-risk-fallback": "switch" },
+  "pr-review-hosted.yml": { "kill-switch": "switch" },
+  "pr-review-main.yml": { trigger: "switch", "trusted-text": "switch", review: "switch", "review-subscription": "switch", "review-fallback": "switch" },
+  "pr-review-security-hosted.yml": { "kill-switch": "switch" },
+  "pr-run-activity-read.yml": { "broker-check": "start", run: "switch" },
+  "pr-run-activity-write.yml": { run: "switch" },
+  "pr-unblock-dispatch.yml": { dispatch: "start", refine: "start" },
+  "pr-unblock.yml": {
+    "resolve-conflicts-select": "switch",
+    "sync-shared-copies-select": "switch",
+    "address-feedback-select": "switch",
+    "adjudicate-feedback": "switch",
+    "review-dependency-select": "switch",
+    "fix-ci-context": "switch",
+  },
+  "pr-verify-capture.yml": { capture: "switch" },
+  "pr-verify.yml": { "check-intent": "switch", "check-intent-subscription": "switch", "check-intent-fallback": "switch" },
+  "upstream-apply-changelog.yml": {
+    gate: "start",
+    model: "switch",
+    "model-subscription": "switch",
+    "model-fallback": "switch",
+    "scrub-probe": "switch",
+    "scrub-probe-subscription": "switch",
+    "scrub-probe-fallback": "switch",
+    "push-branches": "switch",
+    publish: "switch",
+  },
+  "work-unblock.yml": { "label-unblocked": "start", "publish-lane-level": "switch", "sync-status": "switch" },
 };
-const POST_MODEL = [
-  ["pr-run-activity-write.yml", "run"],
-  ["intake-triage.yml", "apply-verdict"],
-  ["intake-triage.yml", "apply-refinement"],
-  ["maintenance-audit-lane-runs.yml", "judge-handoffs"],
-  ["maintenance-audit-lane-runs.yml", "judge-subscription-handoffs"],
-  ["maintenance-audit-lane-runs.yml", "file"],
-  ["maintenance-measure-skill-edit.yml", "push-branch"],
-  ["maintenance-measure-skill-edit.yml", "publish"],
-  ["maintenance-tidy-code-upkeep.yml", "push-branches"],
-  ["maintenance-tidy-code-upkeep.yml", "publish"],
-  ["upstream-apply-changelog.yml", "push-branches"],
-  ["upstream-apply-changelog.yml", "publish"],
-  ["pr-unblock.yml", "adjudicate-feedback"],
-];
 
-test("gates after a model turn skip the budget; start gates before one read it", () => {
-  for (const [file, job] of POST_MODEL) {
-    assert.match(gateOf(file, job), /^ {10}budget: "false"$/m, `${file} ${job}`);
+// Each gate step in a workflow: its job and the step's text.
+function gatesIn(file) {
+  const lines = readFileSync(path.join(WORKFLOWS, file), "utf8").split("\n");
+  const jobsAt = lines.indexOf("jobs:");
+  const found = [];
+  let job = null;
+  lines.forEach((line, i) => {
+    const id = i > jobsAt && /^ {2}([a-z][a-z0-9-]*):$/.exec(line);
+    if (id) job = id[1];
+    if (!line.includes("uses: ./.base/.github/actions/check-kill-switch")) return;
+    const next = lines.findIndex((other, j) => j > i && /^ {6}- |^ {2}[a-z]/.test(other));
+    found.push({ job, step: lines.slice(i, next < 0 ? undefined : next).join("\n") });
+  });
+  return found;
+}
+
+test("every gate in the workflows is classified, and only start gates read the budget", () => {
+  const seen = new Set();
+  for (const file of readdirSync(WORKFLOWS).filter((name) => name.endsWith(".yml"))) {
+    for (const { job, step } of gatesIn(file)) {
+      const kind = GATES[file]?.[job];
+      assert.ok(kind, `${file} ${job}: a gate this test does not classify as start or switch`);
+      seen.add(`${file} ${job}`);
+      if (kind === "start") {
+        assert.match(step, /^ {10}budget: "true"$/m, `${file} ${job} starts new work`);
+      } else {
+        assert.doesNotMatch(step, /budget:/, `${file} ${job} checks the switches only`);
+      }
+    }
   }
-  for (const [file, job] of [["pr-run-activity-read.yml", "broker-check"], ["pr-run-activity-read.yml", "run"], ["intake-triage.yml", "refine-issue"], ["work-unblock.yml", "label-unblocked"]]) {
-    assert.doesNotMatch(gateOf(file, job), /budget:/, `${file} ${job}`);
+  for (const [file, jobs] of Object.entries(GATES)) {
+    for (const job of Object.keys(jobs)) {
+      assert.ok(seen.has(`${file} ${job}`), `${file} ${job}: classified but has no gate`);
+    }
   }
 });
 
-test("a failed budget read proceeds", async () => {
-  const { outputs, lines } = await runMain(OFF, new Error("socket hang up"));
-  assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok" });
-  assert.ok(lines.some((line) => line.startsWith("::warning title=start-gate::the GITHUB_TOKEN budget was not read (socket hang up)")));
-});
-
-test("the fallback share is rate-limits.json's github-token start-gate", () => {
-  assert.equal(JSON.parse(readFileSync(RATE_LIMITS, "utf8"))["github-token"]["start-gate"], START_GATE_SHARE);
+test("CLI writes proceed=true when both switches are exactly false and exits 0", () => {
+  const { status, stdout, outputs } = runCli({ KILL_SWITCH_VALUE: "false", REPO_KILL_SWITCH_VALUE: "false" });
+  assert.equal(status, 0);
+  assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok", reset: "" });
+  assert.doesNotMatch(stdout, /start-gate/);
 });
 
-test("CLI writes proceed=true when both switches are exactly false, reads no budget without a token, and exits 0", () => {
-  const { status, stdout, outputs } = runCli({ KILL_SWITCH_VALUE: "false", REPO_KILL_SWITCH_VALUE: "false" });
+test("CLI start gate without a token reads no budget, warns and proceeds", () => {
+  const { status, stdout, outputs } = runCli({ ...START });
   assert.equal(status, 0);
-  assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok" });
+  assert.equal(outputs.cause, "ok");
   assert.match(stdout, /::warning title=start-gate::no token/);
 });
 
-test("CLI in a checkout without log-api-budget still writes its outputs and warns", () => {
+test("CLI start gate in a checkout without log-api-budget warns, reads no budget and proceeds", () => {
   const dir = tempDir("kill-switch-sparse-");
   try {
     const script = path.join(dir, "check-kill-switch", "check-kill-switch.mjs");
     mkdirSync(path.dirname(script));
     copyFileSync(SCRIPT, script);
-    const outputPath = path.join(dir, "output");
-    writeFileSync(outputPath, "");
-    const result = spawnSync(process.execPath, [script], {
-      env: { PATH: process.env.PATH, GITHUB_OUTPUT: outputPath, KILL_SWITCH_VALUE: "false", REPO_KILL_SWITCH_VALUE: "false" },
-      encoding: "utf8",
-    });
-    assert.equal(result.status, 0);
-    assert.match(result.stdout, /::warning title=start-gate::rate-guard\.mjs could not be loaded \(ERR_MODULE_NOT_FOUND\); start-gate share 0\.1/);
-    assert.deepEqual(readOutputs(readFileSync(outputPath, "utf8")), { proceed: "true", reason: "ok", cause: "ok" });
+    const { status, stdout, outputs } = runCli({ ...START, BUDGET_TOKEN: "t" }, script);
+    assert.equal(status, 0);
+    assert.match(stdout, /::warning title=start-gate::rate-limits\.json gave no start-gate share \(ENOENT\)/);
+    assert.deepEqual(outputs, { proceed: "true", reason: "ok", cause: "ok", reset: "" });
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }
@@ -348,13 +389,13 @@ test("CLI in a checkout without log-api-budget still writes its outputs and warn
 test("CLI writes proceed=false when the repository switch is unset and exits 0", () => {
   const { status, outputs } = runCli({ KILL_SWITCH_VALUE: "false" });
   assert.equal(status, 0);
-  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "switch" });
+  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "switch", reset: "" });
 });
 
 test("CLI writes proceed=false when both variables are unset and exits 0", () => {
   const { status, outputs } = runCli({});
   assert.equal(status, 0);
-  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "switch" });
+  assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "switch", reset: "" });
 });
 
 test("output values cannot inject a second output line", () => {
diff --git a/.github/actions/log-api-budget/rate-guard.mjs b/.github/actions/log-api-budget/rate-guard.mjs
index 0afe4434d73..15a39ae5712 100644
--- a/.github/actions/log-api-budget/rate-guard.mjs
+++ b/.github/actions/log-api-budget/rate-guard.mjs
@@ -78,7 +78,8 @@ const SHARE = (value) => typeof value === "number" && value >= 0 && value <= 1;
 const COUNT = (value) => Number.isInteger(value) && value >= 1;
 // pace, optional, is pace.mjs's share for timer-driven lanes; stop-floor,
 // optional, the share of the header's limit left at which the latch stops;
-// start-gate, optional, check-kill-switch's share under which a lane does not start.
+// start-gate, optional, check-kill-switch's share under which a lane does not
+// start, which that gate reads from rate-limits.json alone.
 const FIELDS = { plan: (value) => SHARE(value) && value > 0, "writer-pause": SHARE, breaker: SHARE, "read-floor": SHARE, "stop-floor": SHARE, "limit-cap": COUNT, pace: SHARE, "start-gate": SHARE };
 const CONTENT_FIELDS = { ...FIELDS, "per-minute": COUNT, "per-hour": COUNT };
 const REQUIRED = ["plan", "writer-pause", "breaker", "read-floor"];
diff --git a/.github/actions/resolve-config/callers.test.mjs b/.github/actions/resolve-config/callers.test.mjs
index c06d7fe2f73..1edb5d36160 100644
--- a/.github/actions/resolve-config/callers.test.mjs
+++ b/.github/actions/resolve-config/callers.test.mjs
@@ -284,8 +284,9 @@ function importClosure(entry) {
 }
 
 // The kill-switch job reads the action from the default branch with a
-// read-only token and passes it the org and repository switches.
-function assertKillSwitchJob(gate) {
+// read-only token and passes it the org and repository switches; a gate
+// that starts new work also passes budget "true".
+function assertKillSwitchJob(gate, { starts = false } = {}) {
   assert.deepEqual(gate.permissions, { contents: "read" });
   const checkout = gate.steps.find((step) => step.uses?.startsWith("actions/checkout@"));
   assertMainTip(gate.steps, checkout);
@@ -297,6 +298,7 @@ function assertKillSwitchJob(gate) {
   assert.deepEqual(kill.with, {
     value: "${{ vars.CLAUDE_LANES_DISABLED }}",
     "repo-value": "${{ vars.CLAUDE_LANES_REPO_DISABLED }}",
+    ...(starts && { budget: "true" }),
   });
 }
 
@@ -349,7 +351,7 @@ test("intake-triage.yml: intake runs only with claude-args resolved from triage-
   assert.equal(intake.with["claude-args"], "${{ needs.born-triaged.outputs.claude-args }}");
   assert.deepEqual(intake.needs, ["born-triaged", "kill-switch"]);
   const killSwitch = jobs["kill-switch"];
-  assertKillSwitchJob(killSwitch);
+  assertKillSwitchJob(killSwitch, { starts: true });
   const killRuns = (event, action, ref = "refs/heads/main") =>
     evaluate(killSwitch.if, { "github.event_name": event, "github.event.action": action, "github.ref": ref });
   assert.equal(killRuns("issues", "opened"), true);
diff --git a/.github/scripts/work-unblock/label-unblocked.mjs b/.github/scripts/work-unblock/label-unblocked.mjs
index fcf9f76b988..5a1d4112a1c 100755
--- a/.github/scripts/work-unblock/label-unblocked.mjs
+++ b/.github/scripts/work-unblock/label-unblocked.mjs
@@ -208,10 +208,10 @@
 // agent-ready or a run last reported, waits the kill-switch
 // limits.stranded-backoff-hours after the run ended, flat, never doubled,
 // with no cap on trips and no fail route. A run whose start gate stopped it
-// on the GITHUB_TOKEN budget (BUDGET_STEP green in a call's broker-check or
-// model job, from the jobs listing) is a breaker trip at broker-check whose
-// record carries BUDGET_TAG: it never counts toward that bound or that wait,
-// and re-fires on the next sweep. A sweep re-fires breaker trips,
+// on the GITHUB_TOKEN budget (BUDGET_STEP green in a call's broker-check,
+// from the jobs listing) is a breaker trip at broker-check whose record
+// carries BUDGET_TAG: it never counts toward that bound or that wait, and
+// re-fires once the window reset its step names has passed. A sweep re-fires breaker trips,
 // oldest run end first, only while the work-resolve-issue runs not yet
 // finished (five status listings, read once a sweep that has one) are under
 // limits.refire-queue-per-slot times the lane's SLOTS, within
@@ -379,9 +379,10 @@ const UNTRUSTED_STEP = "Stop on untrusted provenance";
 const BROKER_STEP = "Ask the broker whether the lane may run";
 // broker-check's step before BROKER_STEP, which skips it while a kill switch is on.
 const KILL_STEP = "Check the kill switch";
-// The read runner's step, in broker-check and in its model job, that runs
-// exactly when KILL_STEP stopped on the GITHUB_TOKEN budget (cause budget).
-const BUDGET_STEP = "Stop on a low GITHUB_TOKEN budget";
+// broker-check's step that runs exactly when KILL_STEP stopped on the
+// GITHUB_TOKEN budget (cause budget). Its name carries the window's reset,
+// in epoch seconds, from the gate's reset output.
+const BUDGET_STEP = /^Stop on a low GITHUB_TOKEN budget(?: until (.*))?$/;
 // The second line of a breaker record whose stop was a budget stop.
 const BUDGET_TAG = "<!-- work-unblock cause=budget -->";
 // A raw job log line, its timestamp first, whose rest matches the pattern `rest`.
@@ -1720,6 +1721,8 @@ async function didNoWork(jobsOf, refusalOf, runs) {
   // A run the switches stopped makes the trip a switch trip, whatever other
   // run a budget stop stopped.
   let switched = false;
+  // The latest window reset a budget stop names, in ms.
+  let resetAt = null;
   const atLeast = (kind, run, at, budget = false) => {
     switched ||= kind === "breaker" && !budget;
     if (rank[kind] > (rank[stalled] ?? 0)) {
@@ -1746,8 +1749,17 @@ async function didNoWork(jobsOf, refusalOf, runs) {
     const named = (name) => namedJobs(jobs, name);
     // Any call's broker-check: a later leg asks the broker again for its slot.
     const calls = RESOLVE_CALLS.flatMap(named);
-    // A budget stop, at broker-check or in the model job: no model ran.
-    const budget = calls.some((job) => endedAt(job, BUDGET_STEP, "success"));
+    // A budget stop at broker-check: no model ran.
+    const budgetSteps = calls.flatMap((job) => (job?.steps ?? []).filter((step) => step?.conclusion === "success" && BUDGET_STEP.test(String(step?.name))));
+    const budget = budgetSteps.length > 0;
+    for (const step of budgetSteps) {
+      // A name whose reset is not a plain epoch second names none.
+      const until = BUDGET_STEP.exec(step.name)[1] ?? "";
+      const seconds = /^[0-9]{1,12}$/.test(until) ? Number(until) : 0;
+      if (seconds > 0) {
+        resetAt = Math.max(resetAt ?? 0, seconds * 1000);
+      }
+    }
     const killed = budget || calls.some((job) => endedAt(job, KILL_STEP, "success") && endedAt(job, BROKER_STEP, "skipped"));
     const checked = calls.find((job) => failedAt(job, BROKER_STEP));
     const checkStopped = calls.find((job) => job.conclusion === "success" && endedAt(job, BROKER_STEP, "success") && endedAt(job, LEASE_STEP, "skipped"));
@@ -1789,7 +1801,8 @@ async function didNoWork(jobsOf, refusalOf, runs) {
       atLeast(outage ? "outage" : "blocked");
     }
   }
-  return stalled && { stalled, run: tripped, stage, budget: stalled === "breaker" && !switched };
+  const budget = stalled === "breaker" && !switched;
+  return stalled && { stalled, run: tripped, stage, budget, resetAt: budget ? resetAt : null };
 }
 
 // The reason the broker refused `job`, from its log: the failed step's last
@@ -2206,14 +2219,15 @@ async function refireRefusal({ github, actions, jobLog, carry, repo, number, iss
   // A stale stop ran no model; a failed mint in its re-fire job is no failed
   // mint of the lane's, so it skips the did-no-work clock below.
   const stale = await stoppedStale(jobsOf, runs);
-  const { stalled, run: refused, stage, budget } = (!stale && (await didNoWork(jobsOf, refusalReader(jobLog, repo, carry), runs))) || {};
+  const { stalled, run: refused, stage, budget, resetAt } = (!stale && (await didNoWork(jobsOf, refusalReader(jobLog, repo, carry), runs))) || {};
   if (stalled) {
     // Breaker trips since a listed human last added agent-ready or a run last
     // reported; past limits.limit-stops-per-issue of them, a flat wait of the
     // kill-switch hours that never doubles: a trip is the lanes' load, not the
     // issue's fault (owner decision Q109). A stop on the GITHUB_TOKEN budget is
-    // no trip: it neither counts nor waits, and re-fires on the next sweep,
-    // which itself runs only while its own start gate reads the budget clear.
+    // no trip: it never counts, and re-fires once the window it read has
+    // reset (the reset its step names, else an hour after the run ended, a
+    // primary window's length), so it re-fires once per stop, never per sweep.
     const from = Math.max(
       Number.NEGATIVE_INFINITY,
       ...events.filter((event) => isLabel(event, "labeled") && humans.has(event.actor?.id)).map((event) => Date.parse(event.created_at)),
@@ -2230,10 +2244,11 @@ async function refireRefusal({ github, actions, jobLog, carry, repo, number, iss
     // next sweep, which reads the page again.
     const outage = stalled === "outage";
     const clamp = (stalled === "breaker" && stage === "check") || (outage && (await upstreamClear())) ? 0 : limits["reset-clamp-min"];
-    const due = ended + (over >= 0 ? hoursFor["kill-switch"] : clamp) * HOUR_MS;
+    const due = budget ? (resetAt ?? ended + HOUR_MS) : ended + (over >= 0 ? hoursFor["kill-switch"] : clamp) * HOUR_MS;
     if (now < due) {
-      const why =
-        stalled === "breaker"
+      const why = budget
+        ? "the start gate stopped its lane run on a low GITHUB_TOKEN budget"
+        : stalled === "breaker"
           ? `the broker refused its lane run for the lanes kill switch (trip ${trips + 1})`
           : outage
             ? "the upstream-status stop skipped its lane run, and the status page does not read clear"
diff --git a/.github/scripts/work-unblock/label-unblocked.test.mjs b/.github/scripts/work-unblock/label-unblocked.test.mjs
index 82b8770438d..550280f424b 100644
--- a/.github/scripts/work-unblock/label-unblocked.test.mjs
+++ b/.github/scripts/work-unblock/label-unblocked.test.mjs
@@ -3741,17 +3741,12 @@ test("a later leg's broker-check refused or skipped for the kill switch is a bre
 });
 
 // broker-check's start gate stopped on the GITHUB_TOKEN budget (cause budget):
-// its `Stop on a low GITHUB_TOKEN budget` step ran and the broker ask skipped.
-const budgetStep = { name: "Stop on a low GITHUB_TOKEN budget", conclusion: "success" };
-const BUDGET_STOPPED = [ADMITTED, pickSlot, { ...KILL_SKIPPED[2], steps: [KILL_SKIPPED[2].steps[0], budgetStep, KILL_SKIPPED[2].steps[1]] }, ...KILL_SKIPPED.slice(3)];
-// broker-check allowed, then the model job's own start gate stopped on the budget.
-const RUN_BUDGET_STOPPED = [
-  ADMITTED,
-  pickSlot,
-  BROKER_ALLOWED,
-  { name: "resolve-issue / run", conclusion: "success", steps: [{ name: "Check the kill switch", conclusion: "success" }, budgetStep, { name: "Assert the broker allowed this attempt", conclusion: "skipped" }] },
-  { name: "report-outcome", conclusion: "skipped", steps: [] },
-];
+// its `Stop on a low GITHUB_TOKEN budget until <reset>` step ran, named with
+// the gate's reset output, and the broker ask skipped.
+const epoch = (at) => Date.parse(at) / 1000;
+const budgetStep = (name = `Stop on a low GITHUB_TOKEN budget until ${epoch("2026-10-16T10:30:00Z")}`) => ({ name, conclusion: "success" });
+const budgetStopped = (step = budgetStep()) => [ADMITTED, pickSlot, { ...KILL_SKIPPED[2], steps: [KILL_SKIPPED[2].steps[0], step, KILL_SKIPPED[2].steps[1]] }, ...KILL_SKIPPED.slice(3)];
+const BUDGET_STOPPED = budgetStopped();
 const BUDGET_RECORD = `${BREAKER_MARKER}\n<!-- work-unblock cause=budget -->\n`;
 const budgeted = (calls) => {
   tripped(calls);
@@ -3762,22 +3757,38 @@ const switched = (calls) => {
   assert.ok(!postedBody(calls).includes("cause=budget"), postedBody(calls));
 };
 
-test("a run its start gate stopped on the GITHUB_TOKEN budget re-fires at once with a budget record, read from the job listing alone", async () => {
-  for (const jobs of [BUDGET_STOPPED, RUN_BUDGET_STOPPED]) {
-    // Ended two minutes before the sweep: no wait.
-    const { github, actions, calls } = stalledRun({ jobs, conclusion: "success", ended: "2026-10-16T11:58:00Z" });
-    assert.equal(await sweep({ github, actions }), 0);
-    budgeted(calls);
-    assert.deepEqual(logReads(calls), []);
+test("a run its start gate stopped on the GITHUB_TOKEN budget re-fires once its window has reset, with a budget record, read from the job listing alone", async () => {
+  // The sweep runs at 12:00; the run ended at 11:58.
+  const ended = "2026-10-16T11:58:00Z";
+  const reset = budgetStopped(budgetStep(`Stop on a low GITHUB_TOKEN budget until ${epoch("2026-10-16T12:30:00Z")}`));
+  const before = stalledRun({ jobs: reset, conclusion: "success", ended });
+  assert.equal(await sweep({ github: before.github, actions: before.actions }), 0);
+  assert.deepEqual(writes(before.calls), [], "no record and no re-fire before the reset");
+  for (const now of ["2026-10-16T12:30:00Z", "2026-10-16T12:45:00Z"]) {
+    const after = stalledRun({ jobs: reset, conclusion: "success", ended });
+    assert.equal(await sweep({ github: after.github, actions: after.actions, now: Date.parse(now) }), 0);
+    budgeted(after.calls);
+    assert.deepEqual(logReads(after.calls), []);
+  }
+  // A step name with no readable reset, bare or with its expression left
+  // unevaluated, is still a budget stop and waits an hour after the run ended.
+  for (const name of ["Stop on a low GITHUB_TOKEN budget", "Stop on a low GITHUB_TOKEN budget until ${{ steps.kill.outputs.reset }}"]) {
+    const unnamed = budgetStopped(budgetStep(name));
+    const early = stalledRun({ jobs: unnamed, conclusion: "success", ended });
+    assert.equal(await sweep({ github: early.github, actions: early.actions, now: Date.parse("2026-10-16T12:57:59Z") }), 0);
+    assert.deepEqual(writes(early.calls), [], name);
+    const due = stalledRun({ jobs: unnamed, conclusion: "success", ended });
+    assert.equal(await sweep({ github: due.github, actions: due.actions, now: Date.parse("2026-10-16T12:58:00Z") }), 0);
+    budgeted(due.calls);
   }
-  // The same listing without the budget step is a switch trip.
-  const plain = stalledRun({ jobs: KILL_SKIPPED, conclusion: "success", ended: "2026-10-16T11:58:00Z" });
+  // The same listing without the budget step is a switch trip, re-fired at once.
+  const plain = stalledRun({ jobs: KILL_SKIPPED, conclusion: "success", ended });
   assert.equal(await sweep({ github: plain.github, actions: plain.actions }), 0);
   switched(plain.calls);
 });
 
 test("a budget stop step that skipped is no budget stop", async () => {
-  const skipped = { ...budgetStep, conclusion: "skipped" };
+  const skipped = { ...budgetStep(), conclusion: "skipped" };
   const jobs = [ADMITTED, pickSlot, { ...KILL_SKIPPED[2], steps: [KILL_SKIPPED[2].steps[0], skipped, KILL_SKIPPED[2].steps[1]] }, ...KILL_SKIPPED.slice(3)];
   const { github, actions, calls } = stalledRun({ jobs, conclusion: "success" });
   assert.equal(await sweep({ github, actions }), 0);
@@ -3960,12 +3971,16 @@ test("the job ids and step names the sweep matches exist in the lane workflows",
   assert.ok(checkSteps.indexOf("Stop on an open blocker") > checkSteps.indexOf("Claim the issue with a lane lease"));
   assert.ok(read.run !== undefined);
   assert.ok(steps(read.run).includes("Stop on stale workflow files"));
-  // The budget step follows the kill switch's step and runs exactly on a budget stop.
-  for (const id of ["broker-check", "run"]) {
-    const named = steps(read[id]);
-    assert.equal(named.indexOf("Stop on a low GITHUB_TOKEN budget"), named.indexOf("Check the kill switch") + 1, id);
-    assert.match(read[id], /^ {6}- name: Stop on a low GITHUB_TOKEN budget\n {8}if: steps\.kill\.outputs\.cause == 'budget'\n/m, id);
-  }
+  // broker-check's budget step follows its kill-switch step, runs exactly on a
+  // budget stop, and carries the gate's reset in its name; its gate reads the
+  // budget. The model job's gate checks the switches only.
+  const budgetName = "Stop on a low GITHUB_TOKEN budget until ${{ steps.kill.outputs.reset }}";
+  const checkNamed = steps(read["broker-check"]);
+  assert.equal(checkNamed.indexOf(budgetName), checkNamed.indexOf("Check the kill switch") + 1);
+  assert.match(read["broker-check"], /^ {6}- name: Stop on a low GITHUB_TOKEN budget until \$\{\{ steps\.kill\.outputs\.reset \}\}\n {8}if: steps\.kill\.outputs\.cause == 'budget'\n/m);
+  assert.match(read["broker-check"], /^ {10}budget: "true"$/m);
+  assert.ok(!steps(read.run).some((name) => name.startsWith("Stop on a low GITHUB_TOKEN budget")));
+  assert.doesNotMatch(read.run, /^ {10}budget:/m);
   for (const id of ["broker-check", "run"]) {
     assert.doesNotMatch(read[id], /^ {4}name:/m, `read runner job ${id} keeps its id as its name`);
   }
diff --git a/.github/workflows/eval-browser-dispatch.yml b/.github/workflows/eval-browser-dispatch.yml
index 5b3a36abd59..80974bcdf31 100644
--- a/.github/workflows/eval-browser-dispatch.yml
+++ b/.github/workflows/eval-browser-dispatch.yml
@@ -251,7 +251,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-
       # Skips the run while Actions or npm installs report a degraded component,
       # with a logged reason; fails open (.github/actions/check-upstream-status).
       - name: Check upstream status
@@ -265,8 +264,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       - name: Stop while upstream is degraded
@@ -1096,8 +1096,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       - name: Stop while upstream is degraded
@@ -1881,8 +1882,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       - name: Stop while upstream is degraded
diff --git a/.github/workflows/eval-hill-climb-pass.yml b/.github/workflows/eval-hill-climb-pass.yml
index 5544815b64c..4b17e56ace2 100644
--- a/.github/workflows/eval-hill-climb-pass.yml
+++ b/.github/workflows/eval-hill-climb-pass.yml
@@ -176,13 +176,13 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-
       - name: Stop when the kill switch is on
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       # Only whether each secret is set reaches the action, never its value.
@@ -592,8 +592,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       # Only whether each secret is set reaches the action, never its value.
@@ -966,8 +967,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       # Only whether each secret is set reaches the action, never its value.
diff --git a/.github/workflows/intake-reenter.yml b/.github/workflows/intake-reenter.yml
index 8764d42ff70..e8c3a37be06 100644
--- a/.github/workflows/intake-reenter.yml
+++ b/.github/workflows/intake-reenter.yml
@@ -157,12 +157,15 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       - name: Report the kill switch
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing read or labeled"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or labeled"
 
       # reenter.mjs reads an issue's Work status field through resolve-config.mjs,
       # whose packages only the resolve-config action installs; this job does
diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml
index 0f3838dcc21..1df2b626ec4 100644
--- a/.github/workflows/intake-triage.yml
+++ b/.github/workflows/intake-triage.yml
@@ -216,6 +216,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       # Skips the run while Actions or npm installs report a degraded component,
       # with a logged reason; fails open (.github/actions/check-upstream-status).
@@ -230,8 +232,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::notice::the lanes kill switch stops this triage and the needs-triage label (reason: ${REASON:-unreadable})"
+          echo "::notice::the lanes kill switch stops this triage and the needs-triage label (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
 
   # The floor label, on an issues event only: a dispatch asks for triage. A
   # failed or skipped born-triaged gate (always skipped on a reopen) leaves
@@ -520,8 +523,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       # The broker mints only for a listed human, or github-actions[bot] on a
       # dispatch (intake-reenter.yml, the triage sweep), and a re-run only for
@@ -718,6 +719,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       # The same actors apply-verdict writes for, so a run whose verdict the
       # broker would not write starts no model either.
@@ -2050,8 +2053,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       - name: Check who started the run
         id: who
diff --git a/.github/workflows/maintenance-audit-lane-runs.yml b/.github/workflows/maintenance-audit-lane-runs.yml
index 83926ca709b..eea71d028f5 100644
--- a/.github/workflows/maintenance-audit-lane-runs.yml
+++ b/.github/workflows/maintenance-audit-lane-runs.yml
@@ -92,12 +92,15 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       - name: Report the kill switch
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing read or filed"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or filed"
 
       - name: Collect the units
         id: collect
@@ -512,8 +515,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       - name: Download the handoff markers
         id: download
@@ -912,8 +913,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       - name: Download the handoff markers
         id: download
@@ -1218,8 +1217,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       - name: Download the units
         if: steps.kill.outputs.proceed == 'true'
@@ -1311,6 +1308,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       # The Work status writer (write-status.mjs) reads models.issue-status
       # through resolve-config.mjs, whose packages only the resolve-config
diff --git a/.github/workflows/maintenance-delete-stale-branches.yml b/.github/workflows/maintenance-delete-stale-branches.yml
index 57a2968ff83..ca14d8da5f4 100644
--- a/.github/workflows/maintenance-delete-stale-branches.yml
+++ b/.github/workflows/maintenance-delete-stale-branches.yml
@@ -92,12 +92,15 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       - name: Report the kill switch
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing read or deleted"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or deleted"
 
       # cleanup.mjs reads the branch-cleanup leaf through the base's
       # resolve-config, which needs its dependencies.
@@ -184,7 +187,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing deleted"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing deleted"
 
       # The delete stage checks the list against the configured cap.
       - name: Install resolve-config's dependencies
diff --git a/.github/workflows/maintenance-file-recurring-issues.yml b/.github/workflows/maintenance-file-recurring-issues.yml
index bd61a00fd77..a4aa1bb3083 100644
--- a/.github/workflows/maintenance-file-recurring-issues.yml
+++ b/.github/workflows/maintenance-file-recurring-issues.yml
@@ -65,12 +65,15 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       - name: Report the kill switch
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing read or filed"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or filed"
 
       - name: File the due rows
         if: steps.kill.outputs.proceed == 'true'
diff --git a/.github/workflows/maintenance-measure-skill-edit.yml b/.github/workflows/maintenance-measure-skill-edit.yml
index c2a1bc8138f..92f3c7ee66f 100644
--- a/.github/workflows/maintenance-measure-skill-edit.yml
+++ b/.github/workflows/maintenance-measure-skill-edit.yml
@@ -114,6 +114,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       - name: Check upstream status
         id: upstream
@@ -137,6 +139,7 @@ jobs:
         env:
           KILL: ${{ steps.kill.outputs.proceed }}
           KILL_REASON: ${{ steps.kill.outputs.reason }}
+          KILL_CAUSE: ${{ steps.kill.outputs.cause }}
           DEGRADED: ${{ steps.upstream.outputs.degraded }}
           DEGRADED_REASON: ${{ steps.upstream.outputs.reason }}
           WHO: ${{ steps.who.outputs.proceed }}
@@ -147,7 +150,7 @@ jobs:
             echo "::error::$1: $2"
             exit 1
           }
-          [ "$KILL" = true ] || stop kill-switch "the lanes kill switch is on (reason: ${KILL_REASON:-unreadable})"
+          [ "$KILL" = true ] || stop kill-switch "the lanes start gate stops this run (reason: ${KILL_REASON:-unreadable}, cause: ${KILL_CAUSE:-unreadable})"
           [ "$DEGRADED" != true ] || stop upstream-degraded "${DEGRADED_REASON}; dispatch again once it recovers"
           [ "$WHO" = true ] || stop untrusted-dispatcher "the dispatcher is not a listed human (reason: ${WHO_REASON:-unreadable})"
 
@@ -332,8 +335,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       # Under the workspace: --restricted confines the file tools to it.
@@ -1091,8 +1095,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       - name: Resolve the config
         id: config
@@ -1241,8 +1243,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       - name: Resolve the config
         id: config
diff --git a/.github/workflows/maintenance-monitor-signals.yml b/.github/workflows/maintenance-monitor-signals.yml
index adb3b239eef..ea465d54160 100644
--- a/.github/workflows/maintenance-monitor-signals.yml
+++ b/.github/workflows/maintenance-monitor-signals.yml
@@ -74,12 +74,15 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       - name: Report the kill switch
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing read or filed"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or filed"
 
       # The Work status writer (write-status.mjs) reads models.issue-status
       # through resolve-config.mjs, whose packages only the resolve-config
diff --git a/.github/workflows/maintenance-reconcile-lost-runs.yml b/.github/workflows/maintenance-reconcile-lost-runs.yml
index 8f5b8b5bf16..2eb0a160840 100644
--- a/.github/workflows/maintenance-reconcile-lost-runs.yml
+++ b/.github/workflows/maintenance-reconcile-lost-runs.yml
@@ -140,6 +140,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       # The base config's limits.api, in resolve-config's output shape, for
       # the pacer; a failed read leaves rate-limits.json's defaults.
diff --git a/.github/workflows/maintenance-tidy-code-upkeep.yml b/.github/workflows/maintenance-tidy-code-upkeep.yml
index b673cdb9f72..5b6a2d2061e 100644
--- a/.github/workflows/maintenance-tidy-code-upkeep.yml
+++ b/.github/workflows/maintenance-tidy-code-upkeep.yml
@@ -129,12 +129,15 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       - name: Report the kill switch
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing read or written"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
 
       # A dispatch, and any re-run, must come from a listed human; the broker
       # checks the same, so this only keeps the model from running for nothing.
@@ -1269,8 +1272,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       - name: Resolve the config
         id: config
@@ -1400,8 +1401,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       - name: Resolve the config
         id: config
diff --git a/.github/workflows/post-merge-demotion-alert.yml b/.github/workflows/post-merge-demotion-alert.yml
index 399c7abdf36..c06a89f90c1 100644
--- a/.github/workflows/post-merge-demotion-alert.yml
+++ b/.github/workflows/post-merge-demotion-alert.yml
@@ -1531,7 +1531,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this report (reason ${REASON:-unreadable}); nothing read or written"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this report (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
 
       # report.mjs reads the red-main leaf through the base's resolve-config,
       # which needs its dependencies.
diff --git a/.github/workflows/post-merge-test-mutation.yml b/.github/workflows/post-merge-test-mutation.yml
index 7eac9c86846..6468f416f16 100644
--- a/.github/workflows/post-merge-test-mutation.yml
+++ b/.github/workflows/post-merge-test-mutation.yml
@@ -100,12 +100,15 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       - name: Report the kill switch
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing mutated"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing mutated"
 
       - name: Download the range
         id: download-range
diff --git a/.github/workflows/pr-feedback-dispatch.yml b/.github/workflows/pr-feedback-dispatch.yml
index b617139a42d..77aa2a63db7 100644
--- a/.github/workflows/pr-feedback-dispatch.yml
+++ b/.github/workflows/pr-feedback-dispatch.yml
@@ -188,8 +188,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true' && github.event.workflow_run.conclusion == 'success'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); the verdict is applied when the lost-run reconciler re-runs this job"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); the verdict is applied when the lost-run reconciler re-runs this job"
           exit 1
 
       - name: Download the verdict
@@ -404,8 +405,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::notice::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); nothing dispatched"
+          echo "::notice::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing dispatched"
 
       # The script resolves the pr-unblock lane's address-feedback slot with
       # the base's resolve-config once it has found the PR and its head, and
diff --git a/.github/workflows/pr-merge.yml b/.github/workflows/pr-merge.yml
index 2650fbdc260..a2988181d5c 100644
--- a/.github/workflows/pr-merge.yml
+++ b/.github/workflows/pr-merge.yml
@@ -1074,7 +1074,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing checked or merged"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing checked or merged"
 
       # The token broker gives this lane its merge token only when the person
       # behind the run is a listed human (trusted-actors.json on main), matched
diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
index ee8849de8a9..a759b92f16b 100644
--- a/.github/workflows/pr-review-hosted.yml
+++ b/.github/workflows/pr-review-hosted.yml
@@ -207,9 +207,10 @@ jobs:
         if: steps.kill.outputs.proceed != 'true' || vars.CLAUDE_REVIEW_DISABLED == 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
           LANE_SWITCH: ${{ vars.CLAUDE_REVIEW_DISABLED }}
         run: |
-          echo "::notice::a kill switch stops this review (lanes: ${REASON:-unreadable}, CLAUDE_REVIEW_DISABLED: ${LANE_SWITCH:-unset})"
+          echo "::notice::a kill switch stops this review (lanes: ${REASON:-unreadable} cause ${CAUSE:-unreadable}, CLAUDE_REVIEW_DISABLED: ${LANE_SWITCH:-unset})"
 
       # A skip fails this job, so the run is a failed first attempt: the
       # lost-run reconciler re-runs it once GitHub Actions is operational
diff --git a/.github/workflows/pr-review-main.yml b/.github/workflows/pr-review-main.yml
index ac651e25232..8275e2d17fc 100644
--- a/.github/workflows/pr-review-main.yml
+++ b/.github/workflows/pr-review-main.yml
@@ -792,6 +792,7 @@ jobs:
         env:
           PROCEED: ${{ steps.kill.outputs.proceed }}
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
           LANE_SWITCH: ${{ vars[matrix.switch] }}
           UPSTREAM_DEGRADED: ${{ steps.upstream.outputs.degraded }}
         run: |
@@ -803,7 +804,7 @@ jobs:
             echo "::error::an upstream outage stops this review; the lost-run reconciler re-runs it once GitHub Actions is operational"
             exit 1
           else
-            echo "::notice::a kill switch stops this review (lanes: ${REASON:-unreadable}, lane: ${LANE_SWITCH:-unset}); no verdict, so the lane stays unbound"
+            echo "::notice::a kill switch stops this review (lanes: ${REASON:-unreadable} cause ${CAUSE:-unreadable}, lane: ${LANE_SWITCH:-unset}); no verdict, so the lane stays unbound"
           fi
 
       # The upstream run's actors, the re-runner and the PR author must all be
@@ -1741,6 +1742,7 @@ jobs:
         env:
           PROCEED: ${{ steps.kill.outputs.proceed }}
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
           LANE_SWITCH: ${{ vars[matrix.switch] }}
           UPSTREAM_DEGRADED: ${{ steps.upstream.outputs.degraded }}
         run: |
@@ -1752,7 +1754,7 @@ jobs:
             echo "::error::an upstream outage stops this review; the lost-run reconciler re-runs it once GitHub Actions is operational"
             exit 1
           else
-            echo "::notice::a kill switch stops this review (lanes: ${REASON:-unreadable}, lane: ${LANE_SWITCH:-unset}); no verdict, so the lane stays unbound"
+            echo "::notice::a kill switch stops this review (lanes: ${REASON:-unreadable} cause ${CAUSE:-unreadable}, lane: ${LANE_SWITCH:-unset}); no verdict, so the lane stays unbound"
           fi
 
       # The upstream run's actors, the re-runner and the PR author must all be
@@ -2658,6 +2660,7 @@ jobs:
         env:
           PROCEED: ${{ steps.kill.outputs.proceed }}
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
           LANE_SWITCH: ${{ vars[matrix.switch] }}
           UPSTREAM_DEGRADED: ${{ steps.upstream.outputs.degraded }}
         run: |
@@ -2669,7 +2672,7 @@ jobs:
             echo "::error::an upstream outage stops this review; the lost-run reconciler re-runs it once GitHub Actions is operational"
             exit 1
           else
-            echo "::notice::a kill switch stops this review (lanes: ${REASON:-unreadable}, lane: ${LANE_SWITCH:-unset}); no verdict, so the lane stays unbound"
+            echo "::notice::a kill switch stops this review (lanes: ${REASON:-unreadable} cause ${CAUSE:-unreadable}, lane: ${LANE_SWITCH:-unset}); no verdict, so the lane stays unbound"
           fi
 
       # The upstream run's actors, the re-runner and the PR author must all be
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
index 8f41e8a8b57..88aa8623765 100644
--- a/.github/workflows/pr-review-security-hosted.yml
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -212,9 +212,10 @@ jobs:
         if: steps.kill.outputs.proceed != 'true' || vars.CLAUDE_SECURITY_REVIEW_DISABLED == 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
           LANE_SWITCH: ${{ vars.CLAUDE_SECURITY_REVIEW_DISABLED }}
         run: |
-          echo "::notice::a kill switch stops this security review (lanes: ${REASON:-unreadable}, CLAUDE_SECURITY_REVIEW_DISABLED: ${LANE_SWITCH:-unset})"
+          echo "::notice::a kill switch stops this security review (lanes: ${REASON:-unreadable} cause ${CAUSE:-unreadable}, CLAUDE_SECURITY_REVIEW_DISABLED: ${LANE_SWITCH:-unset})"
 
       # A skip fails this job, so the run is a failed first attempt: the
       # lost-run reconciler re-runs it once GitHub Actions is operational
diff --git a/.github/workflows/pr-run-activity-read.yml b/.github/workflows/pr-run-activity-read.yml
index 5f80530abd5..1189a0d99bb 100644
--- a/.github/workflows/pr-run-activity-read.yml
+++ b/.github/workflows/pr-run-activity-read.yml
@@ -519,13 +519,18 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-
-      # work-unblock's sweep reads this step's conclusion from the job listing
-      # (label-unblocked.mjs BUDGET_STEP): a stop on the GITHUB_TOKEN budget
-      # re-fires without counting as a kill-switch trip.
-      - name: Stop on a low GITHUB_TOKEN budget
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
+
+      # work-unblock's sweep reads this step's name and conclusion from the
+      # job listing (label-unblocked.mjs BUDGET_STEP): a stop on the
+      # GITHUB_TOKEN budget re-fires after the window's reset the name
+      # carries, without counting as a kill-switch trip.
+      - name: Stop on a low GITHUB_TOKEN budget until ${{ steps.kill.outputs.reset }}
         if: steps.kill.outputs.cause == 'budget'
-        run: echo "::notice::the start gate stopped this run on a low GITHUB_TOKEN budget"
+        env:
+          RESET: ${{ steps.kill.outputs.reset }}
+        run: echo "::notice::the start gate stopped this run on a low GITHUB_TOKEN budget until $RESET (epoch seconds)"
 
       # The broker repeats the kill switch, including the repository-variable
       # shadow this job cannot see, and checks the job's OIDC claims.
@@ -880,11 +885,6 @@ jobs:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
 
-      # As in broker-check: work-unblock's sweep reads it from the job listing.
-      - name: Stop on a low GITHUB_TOKEN budget
-        if: steps.kill.outputs.cause == 'budget'
-        run: echo "::notice::the start gate stopped this run on a low GITHUB_TOKEN budget"
-
       # A broker-check allow from an earlier attempt, reused by "Re-run failed
       # jobs", or a broker-check that skipped the broker because its own kill
       # switch read stopped, is not an allow for this attempt: fail red as a
diff --git a/.github/workflows/pr-run-activity-write.yml b/.github/workflows/pr-run-activity-write.yml
index 56a30ffd2ab..4d228f60d9b 100644
--- a/.github/workflows/pr-run-activity-write.yml
+++ b/.github/workflows/pr-run-activity-write.yml
@@ -790,8 +790,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       # The lanes App bot never starts a write activity, on any event, so one
       # write cannot chain into the next; a re-run must be started by a listed
diff --git a/.github/workflows/pr-unblock-dispatch.yml b/.github/workflows/pr-unblock-dispatch.yml
index 1b8e53572ea..6ce7b97abc4 100644
--- a/.github/workflows/pr-unblock-dispatch.yml
+++ b/.github/workflows/pr-unblock-dispatch.yml
@@ -139,6 +139,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       # Skips the run while Actions or npm installs report a degraded component,
       # with a logged reason; fails open (.github/actions/check-upstream-status).
@@ -153,8 +155,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::notice::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); nothing dispatched"
+          echo "::notice::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing dispatched"
 
       # A push or scheduled run on its first attempt was started by the event
       # itself. A hand run, or any re-run, is checked against the base list:
@@ -421,6 +424,8 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       # refine-event-dispatch.mjs reads the base config's `limits` through the
       # base's resolve-config, which needs its dependencies.
diff --git a/.github/workflows/pr-unblock.yml b/.github/workflows/pr-unblock.yml
index 36c4432b91a..aa076ece35f 100644
--- a/.github/workflows/pr-unblock.yml
+++ b/.github/workflows/pr-unblock.yml
@@ -2014,8 +2014,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       # The select job's thread file and the scan job's replies, from the one
       # leg the reply job reads; prepare checks each against its writer's SHA-256.
diff --git a/.github/workflows/pr-verify.yml b/.github/workflows/pr-verify.yml
index 6719fcdd0f9..84505a65cad 100644
--- a/.github/workflows/pr-verify.yml
+++ b/.github/workflows/pr-verify.yml
@@ -169,8 +169,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); no verdict until the lost-run reconciler re-runs it"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
           exit 1
 
       # The resolver reads only, and skips on its own reads every run it
@@ -2246,8 +2247,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); no verdict until the lost-run reconciler re-runs it"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
           exit 1
 
       # The resolver reads only, and skips on its own reads every run it
@@ -4178,8 +4180,9 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
+          CAUSE: ${{ steps.kill.outputs.cause }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); no verdict until the lost-run reconciler re-runs it"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
           exit 1
 
       # The resolver reads only, and skips on its own reads every run it
diff --git a/.github/workflows/upstream-apply-changelog.yml b/.github/workflows/upstream-apply-changelog.yml
index 98f141fba5c..707356dd952 100644
--- a/.github/workflows/upstream-apply-changelog.yml
+++ b/.github/workflows/upstream-apply-changelog.yml
@@ -109,12 +109,15 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       - name: Report the kill switch
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing read or written"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
 
       # A dispatch, and any re-run of one, must come from a listed human; the
       # broker checks the same, so this only keeps the model from running for
@@ -2185,8 +2188,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       - name: Resolve the config
         id: config
@@ -2324,8 +2325,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # After a model turn: switches only, so a low budget never drops its work.
-          budget: "false"
 
       - name: Resolve the config
         id: config
diff --git a/.github/workflows/work-unblock.yml b/.github/workflows/work-unblock.yml
index 04eb8fe0c3a..a7e283d70c8 100644
--- a/.github/workflows/work-unblock.yml
+++ b/.github/workflows/work-unblock.yml
@@ -185,12 +185,15 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+          # Starts new work: also stop on a low GITHUB_TOKEN budget.
+          budget: "true"
 
       - name: Report the kill switch
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing read or labeled"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or labeled"
 
       # The base config's limits.api, in resolve-config's output shape, for
       # the pacer; a failed read leaves rate-limits.json's defaults.
@@ -506,7 +509,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); no level decided or published"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no level decided or published"
 
       - name: Resolve the config
         id: config
@@ -705,7 +709,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing read or written"
+          CAUSE: ${{ steps.kill.outputs.cause }}
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
 
       # The broker mints on a label event only for a listed human (the
       # trusted-actor list on main, by id), so anyone else stops here quietly,
diff --git a/docs/conventions/pr-pipeline.yaml b/docs/conventions/pr-pipeline.yaml
index 6c28da62a3e..4216c6dffed 100644
--- a/docs/conventions/pr-pipeline.yaml
+++ b/docs/conventions/pr-pipeline.yaml
@@ -1270,9 +1270,7 @@ limits:
   # content-creation adds per-minute and per-hour. The rate guard reads
   # read-floor and limit-cap, to warn, and stop-floor, to stop a pool until its
   # reset at or under that share left; github-token's pace (projected share left at reset)
-  # paces timer-driven lanes (log-api-budget/pace.mjs); github-token's
-  # start-gate (share of the header's limit left) stops a lane at its kill-switch
-  # gate (check-kill-switch), one GET /rate_limit per gate; the others are
+  # paces timer-driven lanes (log-api-budget/pace.mjs); the others are
   # thresholds meant for the hub's limits sampler, which nothing here enforces. Their
   # defaults live in .github/actions/log-api-budget/rate-limits.json, held
   # for a person like this file; add an `api:` entry here only to override one.
diff --git a/docs/conventions/pr-pipeline/README.md b/docs/conventions/pr-pipeline/README.md
index 833c094af53..a66ad53585d 100644
--- a/docs/conventions/pr-pipeline/README.md
+++ b/docs/conventions/pr-pipeline/README.md
@@ -3741,7 +3741,7 @@ with its default.
 | `fix-docs-per-run` | 2 | fix-docs dispatches one pr-unblock-dispatch `refine` run sends for its PR's event; 0 to 20. Each event offers one PR, so 0 turns CI fix-docs off and any other value turns it on. |
 | `admission-factor` | 0.8 | Share of the lane's hourly merge rate admitted per hour for the queued cap ([WIP cap](#wip-cap)); greater than 0, at most 1. |
 | `admission-min-per-hour` | 1 | Admissions per hour the queued cap never falls below, so a day with no lane merges cannot hold admissions shut; 0 to 100, and 0 removes the floor. |
-| `api` | schema | GitHub API margins per pool (`github-token`, `lanes-app`, `graphql`, `owner-token`, `content-creation`). `limit-cap` sets the pool's planned budget: planned = min(header limit, `limit-cap`), used = header limit - header remaining, left = planned - used. `github-token` defaults it to GitHub's documented GITHUB_TOKEN limit, so a higher header limit is headroom, never a target; the other pools have no cap and plan to their header limit. `plan` and `read-floor` are shares of the planned budget; `writer-pause`, `breaker` and `stop-floor` are shares of the header's limit, by its remaining; `content-creation` adds `per-minute` and `per-hour`. Their defaults are in `.github/actions/log-api-budget/rate-limits.json`, the only copy, which every merge hold list floors, so a change to a default waits for a person. The rate guard (`.github/actions/log-api-budget/rate-guard.mjs`, `planOf`) reads `read-floor` and `limit-cap`, to warn once while calls continue, and stops on the header's remaining and GitHub's refusals: at a remaining of 0, or at or under `stop-floor` of the header's limit, it sends no further call to that pool before the header's reset, records the stop in the job's stop file, and holds the step under `API_BUDGET_HOLD`, else fails it; a response with no readable limit, remaining or future reset never stops on `stop-floor`; `pace` (github-token, default 0.2) is the share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick when the previous scheduled run, by run id, marked a clean pass of its work (its `Mark this tick's work done` step, which a held or red pass and a paced tick skip), so two scheduled ticks in a row are never both skipped and its cadence halves (`.github/actions/log-api-budget/pace.mjs`; the lost-run reconciler, pr-unblock-dispatch and work-unblock's sweep read it, and pr-merge's post-merge-dispatch reads it for the merge and enable-auto-merge sweep jobs, which skip at job level while the post-merge check and cover dispatch run on every tick), so the timer lanes slow down before the breaker stops every lane; `0` turns pacing off; `start-gate` (github-token, default 0.1) is the share of the header's limit, by its remaining, under which a lane's kill-switch gate (`.github/actions/check-kill-switch`) does not start it while the reset is still ahead: one GET /rate_limit per gate, its headers or else its body's `resources.core`, a stop with reason `kill-switch` and cause `budget`, and a failed read proceeds; `0` turns it off; the gate reads an override only from a `RESOLVED_CONFIG` its job's env sets, which no workflow does yet, so today every gate uses the `rate-limits.json` value; the others are thresholds meant for the hub's limits sampler, and nothing in this repository enforces them. resolve-config passes the block through as set. |
+| `api` | schema | GitHub API margins per pool (`github-token`, `lanes-app`, `graphql`, `owner-token`, `content-creation`). `limit-cap` sets the pool's planned budget: planned = min(header limit, `limit-cap`), used = header limit - header remaining, left = planned - used. `github-token` defaults it to GitHub's documented GITHUB_TOKEN limit, so a higher header limit is headroom, never a target; the other pools have no cap and plan to their header limit. `plan` and `read-floor` are shares of the planned budget; `writer-pause`, `breaker` and `stop-floor` are shares of the header's limit, by its remaining; `content-creation` adds `per-minute` and `per-hour`. Their defaults are in `.github/actions/log-api-budget/rate-limits.json`, the only copy, which every merge hold list floors, so a change to a default waits for a person. The rate guard (`.github/actions/log-api-budget/rate-guard.mjs`, `planOf`) reads `read-floor` and `limit-cap`, to warn once while calls continue, and stops on the header's remaining and GitHub's refusals: at a remaining of 0, or at or under `stop-floor` of the header's limit, it sends no further call to that pool before the header's reset, records the stop in the job's stop file, and holds the step under `API_BUDGET_HOLD`, else fails it; a response with no readable limit, remaining or future reset never stops on `stop-floor`; `pace` (github-token, default 0.2) is the share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick when the previous scheduled run, by run id, marked a clean pass of its work (its `Mark this tick's work done` step, which a held or red pass and a paced tick skip), so two scheduled ticks in a row are never both skipped and its cadence halves (`.github/actions/log-api-budget/pace.mjs`; the lost-run reconciler, pr-unblock-dispatch and work-unblock's sweep read it, and pr-merge's post-merge-dispatch reads it for the merge and enable-auto-merge sweep jobs, which skip at job level while the post-merge check and cover dispatch run on every tick), so the timer lanes slow down before the breaker stops every lane; `0` turns pacing off; `start-gate` (github-token, 0.1) is the share of the header's limit, by its remaining, under which a kill-switch gate that starts new work (`.github/actions/check-kill-switch`, `budget: "true"`) does not start its lane while the reset is still ahead (one GET /rate_limit per such gate, a stop with reason `kill-switch`, cause `budget` and the window's `reset`; a failed read proceeds); that gate reads it from rate-limits.json alone, so a value set here is accepted and has no effect; the others are thresholds meant for the hub's limits sampler, and nothing in this repository enforces them. resolve-config passes the block through as set. |
 | `lane-level` | 2, 4, 3, 2, `[lanes-app]`, `true`, `CLAUDE_LANE_LEVEL`, 150 | The adaptive lane level L (owner decision Q111): `floor`, `ceiling`, `default`, `clean-windows` and `pools` for `decide()` in `.github/scripts/lib/lane-level.mjs`, whose truth table is `lane-level.vectors.json` beside it. `shadow` (default `true`), `variable` (default `CLAUDE_LANE_LEVEL`, must end in `_LANE_LEVEL`) and `valid-minutes` (default 150, 60 to 1440) govern publish and read: work-unblock's hourly `publish-lane-level` job publishes L as `<level>@<valid-until>` in `variable`, and pick-slot and label-unblocked read it through `.github/scripts/lib/lane-level-value.mjs` (empty, expired or malformed reads as `default`, clamped to `floor` and `ceiling`). While `shadow` is set the job mints no token and writes nothing, `SLOTS` stays `default`, and both log the level they would use. Each window L steps up 1 after `clean-windows` windows in a row that each had demand (runs waiting, or every slot running) and no limit signal, when every pool in `pools` fits: peak used, as a share of the pool's planned budget, times (L+1)/L at most `api.<pool>.plan`. A window where a pool has `api.<pool>.writer-pause` of its header's limit left or less resets the streak. Any limit signal the lanes App's own calls meet (403, 429, a secondary-limit or GraphQL rate-limit error, `retry-after`) halves L, rounded down, to no less than `floor`, and blocks a step up until the reset it names. A breaker trip is not a signal: it mostly reflects GITHUB_TOKEN spend, which pacing controls, and the breaker stays the backstop. Missing readings or demand hold L and the streak; a missing or malformed previous level reads as `default`, and every level is clamped to `floor` and `ceiling`. A `floor` above the `ceiling`, as set or defaulted, is rejected. An `api` pool field left unset reads from `rate-limits.json`, as the rate guard reads it. `.github/scripts/lib/lane-level-replay.mjs` replays the rule over the hub's recorded history. |
 
 report-outcome and the work-unblock sweep read them from resolve-config's output;
diff --git a/docs/conventions/pr-pipeline/pr-pipeline.schema.json b/docs/conventions/pr-pipeline/pr-pipeline.schema.json
index 81540e5b2ae..8072fcd4938 100644
--- a/docs/conventions/pr-pipeline/pr-pipeline.schema.json
+++ b/docs/conventions/pr-pipeline/pr-pipeline.schema.json
@@ -536,7 +536,7 @@
           "type": "number",
           "minimum": 0,
           "maximum": 1,
-          "description": "github-token only. Share of the header's limit, by the header's remaining, under which a lane does not start (.github/actions/check-kill-switch): its gate reads GET /rate_limit once and stops with reason kill-switch, cause budget, while the reset is still ahead. A failed or unreadable read proceeds. 0 turns the budget stop off. The gate reads a value set here only through a RESOLVED_CONFIG its job's env sets; no workflow sets one for the gate yet, so the rate-limits.json default applies."
+          "description": "github-token's share of the header's limit, by the header's remaining, under which a kill-switch gate that starts new work (.github/actions/check-kill-switch, budget \"true\") stops its lane while the reset is still ahead. The gate reads it from rate-limits.json alone: a value set here is accepted and has no effect on the gate."
         },
         "read-floor": {
           "type": "number",

From 66532926c51811a9e79cfc7ae804eba98400145a Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Wed, 11 Nov 2026 10:54:46 -0500
Subject: [PATCH 6/9] fix(pr-pipeline): end a budget stop neutral and keep one
 budget record

On a start-gate budget stop, broker-check sets skip-reason budget, so the
read runner's run job skips instead of failing at "Assert the broker
allowed this attempt". The report job posts the same neutral check and
skips the lane-run comment, as it does for the broker's kill-switch refusal.

broker-check reads the budget only for a caller that passes the new
start-gate input (the issue lane and pr-refine), and only on the first call
in the slot. Handed-off and fallback legs, and pr-unblock, which fixes
existing pull requests, check the switches only.

work-unblock's sweep keeps one budget record per issue and edits it in
place for each window. Report steps name a budget stop as the low
GITHUB_TOKEN budget and its reset. The pr-pipeline.yaml schema rejects
start-gate, which stays valid in rate-limits.json. The gate test matches
any uses: path to the action and checks which read-runner calls pass
start-gate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q1HHi6JACp77x2ZbE7
---
 .github/actions/check-kill-switch/README.md   |  5 +-
 .../check-kill-switch.test.mjs                | 38 ++++++++++-
 .github/actions/log-api-budget/rate-guard.mjs |  3 +
 .../log-api-budget/rate-guard.test.mjs        | 11 +++-
 .../credential-legs.test.mjs                  |  3 +-
 .../scripts/work-unblock/label-unblocked.mjs  | 23 +++++--
 .../work-unblock/label-unblocked.test.mjs     | 65 +++++++++++++++++--
 .github/workflows/eval-browser-dispatch.yml   |  9 ++-
 .github/workflows/eval-hill-climb-pass.yml    |  9 ++-
 .github/workflows/intake-reenter.yml          |  3 +-
 .github/workflows/intake-triage.yml           |  3 +-
 .../workflows/maintenance-audit-lane-runs.yml |  3 +-
 .../maintenance-delete-stale-branches.yml     |  6 +-
 .../maintenance-file-recurring-issues.yml     |  3 +-
 .../maintenance-measure-skill-edit.yml        |  6 +-
 .../workflows/maintenance-monitor-signals.yml |  3 +-
 .../maintenance-tidy-code-upkeep.yml          |  3 +-
 .../workflows/post-merge-demotion-alert.yml   |  3 +-
 .../workflows/post-merge-test-mutation.yml    |  3 +-
 .github/workflows/pr-feedback-dispatch.yml    |  6 +-
 .github/workflows/pr-merge.yml                |  3 +-
 .github/workflows/pr-refine.yml               |  3 +
 .github/workflows/pr-run-activity-read.yml    | 33 +++++++---
 .github/workflows/pr-unblock-dispatch.yml     |  3 +-
 .github/workflows/pr-verify.yml               |  9 ++-
 .../workflows/upstream-apply-changelog.yml    |  3 +-
 .github/workflows/work-resolve-issue.yml      |  3 +
 .github/workflows/work-unblock.yml            |  9 ++-
 docs/conventions/pr-pipeline/README.md        |  2 +-
 .../pr-pipeline/pr-pipeline.schema.json       |  6 --
 30 files changed, 218 insertions(+), 64 deletions(-)

diff --git a/.github/actions/check-kill-switch/README.md b/.github/actions/check-kill-switch/README.md
index 4ed1e4152b0..97c6ef39d54 100644
--- a/.github/actions/check-kill-switch/README.md
+++ b/.github/actions/check-kill-switch/README.md
@@ -32,8 +32,9 @@ and a read lane's broker check, while one exists.
 | `budget` | `false` | `true` also reads the GITHUB_TOKEN budget |
 | `token` | `${{ github.token }}` | The token whose GET /rate_limit answer is the budget reading |
 
-Set `budget: "true"` only on a gate that starts new work: the read runner's `broker-check`, a
-workflow's first gate on a schedule or event that begins a run's work (intake triage and its
+Set `budget: "true"` only on a gate that starts new work: the read runner's `broker-check` on the
+first call of a caller that passes `start-gate: true` (the issue lane and pr-refine; pr-unblock
+fixes existing pull requests and passes none), a workflow's first gate on a schedule or event that begins a run's work (intake triage and its
 refine select, the audit, cleanup, recurring-issue, skill-edit, signals, reconcile, tidy,
 mutation and changelog ticks, the pr-unblock dispatcher, and the work-unblock sweep). A gate
 that finishes or judges existing work keeps the default, so a low budget never throws that work
diff --git a/.github/actions/check-kill-switch/check-kill-switch.test.mjs b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
index 1556cb7ac6e..7de4c92a7ee 100644
--- a/.github/actions/check-kill-switch/check-kill-switch.test.mjs
+++ b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
@@ -293,7 +293,9 @@ const GATES = {
   "pr-review-hosted.yml": { "kill-switch": "switch" },
   "pr-review-main.yml": { trigger: "switch", "trusted-text": "switch", review: "switch", "review-subscription": "switch", "review-fallback": "switch" },
   "pr-review-security-hosted.yml": { "kill-switch": "switch" },
-  "pr-run-activity-read.yml": { "broker-check": "start", run: "switch" },
+  // broker-check reads the budget only for a caller passing start-gate, and
+  // only on a call that is the first in its slot (FIRST_CALL).
+  "pr-run-activity-read.yml": { "broker-check": "first-call", run: "switch" },
   "pr-run-activity-write.yml": { run: "switch" },
   "pr-unblock-dispatch.yml": { dispatch: "start", refine: "start" },
   "pr-unblock.yml": {
@@ -320,6 +322,35 @@ const GATES = {
   "work-unblock.yml": { "label-unblocked": "start", "publish-lane-level": "switch", "sync-status": "switch" },
 };
 
+const FIRST_CALL = /^ {10}budget: \$\{\{ inputs\.start-gate && \(inputs\.fallback == '' \|\| inputs\.fallback == 'credit-stop'\) && 'true' \|\| 'false' \}\}$/m;
+
+// The read-runner calls that pass start-gate, by workflow and job: the issue
+// lane and pr-refine start new work; pr-unblock fixes existing PRs and passes
+// none. Each listed call's handed-off and fallback legs read no budget
+// through FIRST_CALL's fallback test.
+const START_CALLS = {
+  "work-resolve-issue.yml": ["resolve-issue", "resolve-issue-subscription", "resolve-issue-fallback"],
+  "pr-refine.yml": ["fix-docs", "fix-docs-subscription", "fix-docs-fallback"],
+};
+
+test("only the issue lane's and pr-refine's read-runner calls pass start-gate", () => {
+  for (const file of readdirSync(WORKFLOWS).filter((name) => name.endsWith(".yml"))) {
+    const lines = readFileSync(path.join(WORKFLOWS, file), "utf8").split("\n");
+    const starting = [];
+    let calls = 0;
+    let job = null;
+    lines.forEach((line, i) => {
+      const id = /^ {2}([a-z][a-z0-9-]*):$/.exec(line);
+      if (id) job = id[1];
+      if (!/^ {4}uses: \.\/\.github\/workflows\/pr-run-activity-read\.yml\b/.test(line)) return;
+      calls += 1;
+      const next = lines.findIndex((other, j) => j > i && /^ {2}[a-z]/.test(other));
+      if (/^ {6}start-gate: true$/m.test(lines.slice(i, next < 0 ? undefined : next).join("\n"))) starting.push(job);
+    });
+    if (calls) assert.deepEqual(starting, START_CALLS[file] ?? [], file);
+  }
+});
+
 // Each gate step in a workflow: its job and the step's text.
 function gatesIn(file) {
   const lines = readFileSync(path.join(WORKFLOWS, file), "utf8").split("\n");
@@ -329,7 +360,8 @@ function gatesIn(file) {
   lines.forEach((line, i) => {
     const id = i > jobsAt && /^ {2}([a-z][a-z0-9-]*):$/.exec(line);
     if (id) job = id[1];
-    if (!line.includes("uses: ./.base/.github/actions/check-kill-switch")) return;
+    // Any path to the action, at any ref.
+    if (!/^\s*(?:-\s+)?uses:\s*["']?[^\s"'#]*actions\/check-kill-switch(?:@[^\s"'#]*)?["']?\s*(?:#.*)?$/.test(line)) return;
     const next = lines.findIndex((other, j) => j > i && /^ {6}- |^ {2}[a-z]/.test(other));
     found.push({ job, step: lines.slice(i, next < 0 ? undefined : next).join("\n") });
   });
@@ -345,6 +377,8 @@ test("every gate in the workflows is classified, and only start gates read the b
       seen.add(`${file} ${job}`);
       if (kind === "start") {
         assert.match(step, /^ {10}budget: "true"$/m, `${file} ${job} starts new work`);
+      } else if (kind === "first-call") {
+        assert.match(step, FIRST_CALL, `${file} ${job} starts new work on a starting caller's first call only`);
       } else {
         assert.doesNotMatch(step, /budget:/, `${file} ${job} checks the switches only`);
       }
diff --git a/.github/actions/log-api-budget/rate-guard.mjs b/.github/actions/log-api-budget/rate-guard.mjs
index 15a39ae5712..887a1eefaa9 100644
--- a/.github/actions/log-api-budget/rate-guard.mjs
+++ b/.github/actions/log-api-budget/rate-guard.mjs
@@ -82,6 +82,9 @@ const COUNT = (value) => Number.isInteger(value) && value >= 1;
 // start, which that gate reads from rate-limits.json alone.
 const FIELDS = { plan: (value) => SHARE(value) && value > 0, "writer-pause": SHARE, breaker: SHARE, "read-floor": SHARE, "stop-floor": SHARE, "limit-cap": COUNT, pace: SHARE, "start-gate": SHARE };
 const CONTENT_FIELDS = { ...FIELDS, "per-minute": COUNT, "per-hour": COUNT };
+// Fields rate-limits.json holds that pr-pipeline.yaml's limits.api cannot set
+// (its schema rejects them): their one reader takes the file's value alone.
+export const FILE_ONLY_FIELDS = Object.freeze(["start-gate"]);
 const REQUIRED = ["plan", "writer-pause", "breaker", "read-floor"];
 
 // rate-limits.json, checked: every pool in API_POOLS and no other, each with
diff --git a/.github/actions/log-api-budget/rate-guard.test.mjs b/.github/actions/log-api-budget/rate-guard.test.mjs
index 3349e9b86c3..c47318e280d 100644
--- a/.github/actions/log-api-budget/rate-guard.test.mjs
+++ b/.github/actions/log-api-budget/rate-guard.test.mjs
@@ -4,7 +4,7 @@ import { spawnSync } from "node:child_process";
 import { chmodSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { test } from "node:test";
-import { apiLimits, apiLimitsOrBuiltIn, classify, createRateLimitLatch, entryOf, isContentWrite, poolOf, RateLimitStop } from "./rate-guard.mjs";
+import { apiLimits, apiLimitsOrBuiltIn, classify, createRateLimitLatch, entryOf, FILE_ONLY_FIELDS, isContentWrite, poolOf, RateLimitStop } from "./rate-guard.mjs";
 import { tempDir } from "../../../lib/test-tmp.mjs";
 
 const VECTORS = JSON.parse(readFileSync(new URL("./rate-guard.vectors.json", import.meta.url), "utf8"));
@@ -105,9 +105,16 @@ test("the schema states no limits.api default: rate-limits.json holds the only c
   }
   assert.deepEqual(Object.keys(defaults).sort(), Object.keys(entries).sort());
   for (const [name, fields] of Object.entries(defaults)) {
-    const allowed = Object.keys(schema.$defs[name === "content-creation" ? "api-content-pool" : "api-pool"].properties);
+    const allowed = [...Object.keys(schema.$defs[name === "content-creation" ? "api-content-pool" : "api-pool"].properties), ...FILE_ONLY_FIELDS];
     assert.deepEqual(Object.keys(fields).filter((field) => !allowed.includes(field)), [], name);
   }
+  // A file-only field is one the config cannot set: no pool's schema names it.
+  for (const pool of pools) {
+    for (const field of FILE_ONLY_FIELDS) {
+      assert.equal(field in pool.properties, false, field);
+    }
+  }
+  assert.equal(defaults["github-token"]["start-gate"], 0.1, "start-gate stays valid in rate-limits.json");
 });
 
 // github-token plans to a limit-cap of 1,000, the figure GitHub documents for
diff --git a/.github/scripts/pr-run-activity-read/credential-legs.test.mjs b/.github/scripts/pr-run-activity-read/credential-legs.test.mjs
index a97f534ced2..83cfb0694f6 100644
--- a/.github/scripts/pr-run-activity-read/credential-legs.test.mjs
+++ b/.github/scripts/pr-run-activity-read/credential-legs.test.mjs
@@ -212,7 +212,8 @@ test("the workflow_call outputs the run and broker-check jobs set, and their sou
   };
   const brokerCheck = {
     allowed: "${{ steps.broker.outcome == 'success' && steps.broker.outputs.allowed == 'true' }}",
-    "skip-reason": "${{ steps.broker.outputs.skip-reason }}",
+    // Since 5599e627fc, a start-gate budget stop also sets skip-reason budget.
+    "skip-reason": "${{ steps.kill.outputs.cause == 'budget' && 'budget' || steps.broker.outputs.skip-reason }}",
     attempt: "${{ github.run_attempt }}",
     lease: "${{ steps.lease.outputs.lease }}",
     "lease-comment-id": "${{ steps.lease.outputs.lease-comment-id }}",
diff --git a/.github/scripts/work-unblock/label-unblocked.mjs b/.github/scripts/work-unblock/label-unblocked.mjs
index 5a1d4112a1c..f93c4d36183 100755
--- a/.github/scripts/work-unblock/label-unblocked.mjs
+++ b/.github/scripts/work-unblock/label-unblocked.mjs
@@ -565,14 +565,16 @@ const parseMarker = (body) => {
 };
 
 // The lanes App's outcome and re-fire markers on an issue, oldest first, each
-// with when it was posted (the backoff comment: last edited).
+// with when it was posted (the backoff comment and the budget record, each
+// edited in place: last edited).
 const appMarkers = (comments, bot) =>
   comments
     .filter((comment) => comment.user?.login === bot)
-    .map((comment) => ({
-      ...parseMarker(comment.body),
-      at: Date.parse(INFRA.test(String(comment.body ?? "")) ? (comment.updated_at ?? comment.created_at) : comment.created_at),
-    }))
+    .map((comment) => {
+      const marker = parseMarker(comment.body);
+      const edited = marker?.budget || INFRA.test(String(comment.body ?? ""));
+      return { ...marker, at: Date.parse(edited ? (comment.updated_at ?? comment.created_at) : comment.created_at) };
+    })
     .filter((marker) => marker.outcome !== undefined && Number.isFinite(marker.at))
     .sort((a, b) => a.at - b.at);
 
@@ -2270,7 +2272,11 @@ async function refireRefusal({ github, actions, jobLog, carry, repo, number, iss
     if (stalled === "mint-failed" && !recorded && fired >= limits["limit-stops-per-issue"]) {
       return backoff(key, ended, MINT_CAUSE, hoursFor["failed-mint"]);
     }
-    const trip = stalled === "breaker" ? { run: refused.id, ended: Date.parse(refused.updated_at) || ended, budget } : undefined;
+    // An issue keeps one budget record, edited in place for each window.
+    const budgetRecord = budget
+      ? comments.filter((comment) => comment.user?.login === bot && parseMarker(comment.body)?.budget && RUN_ID.test(String(comment.id))).at(-1)?.id
+      : undefined;
+    const trip = stalled === "breaker" ? { run: refused.id, ended: Date.parse(refused.updated_at) || ended, budget, record: budgetRecord } : undefined;
     // Trips sort by when their run ended, not when they fell due, so the sweeps
     // after the switch clears drain them oldest first whatever their waits.
     return { reason: null, resets: trip ? ended : due, refire: key, recorded, stall: stalled, trip };
@@ -2598,7 +2604,10 @@ async function restartLimited({ github, actions, jobLog, carry, repo, bot, human
     try {
       // The record first: a failed comment re-fires nothing, so the bound holds.
       if (refire && !recorded) {
-        await github("POST", `${base}/comments`, { body: stall === "breaker" ? breakerComment(refire, { repo, ...trip }) : refireComment(refire, cause) });
+        const body = stall === "breaker" ? breakerComment(refire, { repo, ...trip }) : refireComment(refire, cause);
+        await (trip?.record === undefined
+          ? github("POST", `${base}/comments`, { body })
+          : github("PATCH", `/repos/${repo}/issues/comments/${trip.record}`, { body }));
       }
       if (infra) {
         await (infra.id === undefined
diff --git a/.github/scripts/work-unblock/label-unblocked.test.mjs b/.github/scripts/work-unblock/label-unblocked.test.mjs
index 550280f424b..445ada08730 100644
--- a/.github/scripts/work-unblock/label-unblocked.test.mjs
+++ b/.github/scripts/work-unblock/label-unblocked.test.mjs
@@ -3740,12 +3740,43 @@ test("a later leg's broker-check refused or skipped for the kill switch is a bre
   }
 });
 
-// broker-check's start gate stopped on the GITHUB_TOKEN budget (cause budget):
-// its `Stop on a low GITHUB_TOKEN budget until <reset>` step ran, named with
-// the gate's reset output, and the broker ask skipped.
+// The run a start-gate budget stop leaves (pr-run-activity-read.yml): the
+// first call's broker-check ran its kill-switch step, its `Stop on a low
+// GITHUB_TOKEN budget until <reset>` step (named with the gate's reset
+// output), and skipped the broker ask and the lease, ending green with
+// skip-reason budget. That skip-reason skips the call's run job, so its
+// issue-fields, scan and summary jobs skip too, and report skips with no lease
+// held. No handoff, no scan output: work-resolve-issue's later calls,
+// apply-issue-patch and report-outcome all skip, and the run ends green.
 const epoch = (at) => Date.parse(at) / 1000;
 const budgetStep = (name = `Stop on a low GITHUB_TOKEN budget until ${epoch("2026-10-16T10:30:00Z")}`) => ({ name, conclusion: "success" });
-const budgetStopped = (step = budgetStep()) => [ADMITTED, pickSlot, { ...KILL_SKIPPED[2], steps: [KILL_SKIPPED[2].steps[0], step, KILL_SKIPPED[2].steps[1]] }, ...KILL_SKIPPED.slice(3)];
+const skippedJob = (name) => ({ name, conclusion: "skipped", steps: [] });
+const budgetStopped = (step = budgetStep()) => [
+  ADMITTED,
+  pickSlot,
+  {
+    name: "resolve-issue / broker-check",
+    conclusion: "success",
+    steps: [
+      { name: "Check the kill switch", conclusion: "success" },
+      step,
+      { name: "Ask the broker whether the lane may run", conclusion: "skipped" },
+      { name: "Claim the issue with a lane lease", conclusion: "skipped" },
+    ],
+  },
+  skippedJob("resolve-issue / broker-allowed"),
+  skippedJob("resolve-issue / run"),
+  skippedJob("resolve-issue / issue-fields"),
+  skippedJob("resolve-issue / scan"),
+  skippedJob("resolve-issue / summary"),
+  skippedJob("resolve-issue / report"),
+  { name: "resolve-issue-handoff", conclusion: "success", steps: [{ name: "Read whether the call handed off", conclusion: "success" }] },
+  skippedJob("resolve-issue-subscription"),
+  skippedJob("resolve-issue-fallback"),
+  skippedJob("apply-issue-patch"),
+  skippedJob("report-skip"),
+  skippedJob("report-outcome"),
+];
 const BUDGET_STOPPED = budgetStopped();
 const BUDGET_RECORD = `${BREAKER_MARKER}\n<!-- work-unblock cause=budget -->\n`;
 const budgeted = (calls) => {
@@ -3803,7 +3834,8 @@ test("budget stops never count toward limits.limit-stops-per-issue or wait the k
   assert.equal(await sweep({ github: fourthSwitch.github, actions: fourthSwitch.actions }), 0);
   assert.deepEqual(writes(fourthSwitch.calls), [], "a fourth switch trip waits");
 
-  const budgetStops = await afterSweeps(5, BUDGET_STOPPED);
+  // Five budget records, as separate comments, each followed by its re-add.
+  const budgetStops = history(Array.from({ length: 5 }, (_, index) => breakerComment(KEY, { repo: REPO, run: 4100 + index, ended: Date.parse("2026-10-16T05:00:00Z"), budget: true })));
   const afterBudget = stalledRun({ jobs: KILL_SKIPPED, conclusion: "success", ...budgetStops });
   assert.equal(await sweep({ github: afterBudget.github, actions: afterBudget.actions }), 0);
   switched(afterBudget.calls);
@@ -3813,6 +3845,22 @@ test("budget stops never count toward limits.limit-stops-per-issue or wait the k
   budgeted(budgetAfterSwitch.calls);
 });
 
+test("a later budget stop edits the issue's one budget record in place, never posting a second", async () => {
+  const once = await afterSweeps(1, BUDGET_STOPPED);
+  const recordId = once.comments.at(-1).id;
+  const again = stalledRun({ jobs: budgetStopped(budgetStep(`Stop on a low GITHUB_TOKEN budget until ${epoch("2026-10-16T11:30:00Z")}`)), conclusion: "success", ...once });
+  assert.equal(await sweep({ github: again.github, actions: again.actions }), 0);
+  const done = writes(again.calls);
+  assert.ok(done[0].startsWith(`PATCH /repos/${REPO}/issues/comments/${recordId} `), done[0]);
+  assert.ok(done[0].includes("cause=budget"), done[0]);
+  assert.ok(!done.some((call) => call.startsWith(`POST /repos/${REPO}/issues/30/comments `)), done.join("\n"));
+  assert.deepEqual(done.slice(1), restarted(30));
+  // A switch trip after it posts its own record: only budget records are edited.
+  const switchAfter = stalledRun({ jobs: KILL_SKIPPED, conclusion: "success", ...once });
+  assert.equal(await sweep({ github: switchAfter.github, actions: switchAfter.actions }), 0);
+  switched(switchAfter.calls);
+});
+
 test("the budget record says it never counts toward the per-issue bound", () => {
   const body = breakerComment(KEY, { repo: REPO, run: 5030, ended: Date.parse("2026-10-16T10:05:00Z"), budget: true });
   assert.ok(body.startsWith(BUDGET_RECORD), body);
@@ -3978,7 +4026,12 @@ test("the job ids and step names the sweep matches exist in the lane workflows",
   const checkNamed = steps(read["broker-check"]);
   assert.equal(checkNamed.indexOf(budgetName), checkNamed.indexOf("Check the kill switch") + 1);
   assert.match(read["broker-check"], /^ {6}- name: Stop on a low GITHUB_TOKEN budget until \$\{\{ steps\.kill\.outputs\.reset \}\}\n {8}if: steps\.kill\.outputs\.cause == 'budget'\n/m);
-  assert.match(read["broker-check"], /^ {10}budget: "true"$/m);
+  // Its gate reads the budget on a starting caller's first call, and a budget
+  // stop sets skip-reason budget, which skips the run job.
+  assert.match(read["broker-check"], /^ {10}budget: \$\{\{ inputs\.start-gate && \(inputs\.fallback == '' \|\| inputs\.fallback == 'credit-stop'\) && 'true' \|\| 'false' \}\}$/m);
+  assert.match(read["broker-check"], /^ {6}skip-reason: \$\{\{ steps\.kill\.outputs\.cause == 'budget' && 'budget' \|\| steps\.broker\.outputs\.skip-reason \}\}$/m);
+  assert.match(read.run, /^ {6}&& needs\.broker-check\.outputs\.skip-reason == ''$/m);
+  assert.match(caller["resolve-issue"], /^ {6}start-gate: true$/m);
   assert.ok(!steps(read.run).some((name) => name.startsWith("Stop on a low GITHUB_TOKEN budget")));
   assert.doesNotMatch(read.run, /^ {10}budget:/m);
   for (const id of ["broker-check", "run"]) {
diff --git a/.github/workflows/eval-browser-dispatch.yml b/.github/workflows/eval-browser-dispatch.yml
index 80974bcdf31..c09778bd999 100644
--- a/.github/workflows/eval-browser-dispatch.yml
+++ b/.github/workflows/eval-browser-dispatch.yml
@@ -265,8 +265,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       - name: Stop while upstream is degraded
@@ -1097,8 +1098,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       - name: Stop while upstream is degraded
@@ -1883,8 +1885,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       - name: Stop while upstream is degraded
diff --git a/.github/workflows/eval-hill-climb-pass.yml b/.github/workflows/eval-hill-climb-pass.yml
index 4b17e56ace2..f2bc6a91428 100644
--- a/.github/workflows/eval-hill-climb-pass.yml
+++ b/.github/workflows/eval-hill-climb-pass.yml
@@ -181,8 +181,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       # Only whether each secret is set reaches the action, never its value.
@@ -593,8 +594,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       # Only whether each secret is set reaches the action, never its value.
@@ -968,8 +970,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       # Only whether each secret is set reaches the action, never its value.
diff --git a/.github/workflows/intake-reenter.yml b/.github/workflows/intake-reenter.yml
index e8c3a37be06..c7927ecbb33 100644
--- a/.github/workflows/intake-reenter.yml
+++ b/.github/workflows/intake-reenter.yml
@@ -165,7 +165,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or labeled"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or labeled"
 
       # reenter.mjs reads an issue's Work status field through resolve-config.mjs,
       # whose packages only the resolve-config action installs; this job does
diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml
index 1df2b626ec4..feccbf542e8 100644
--- a/.github/workflows/intake-triage.yml
+++ b/.github/workflows/intake-triage.yml
@@ -233,8 +233,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::notice::the lanes kill switch stops this triage and the needs-triage label (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::notice::${WHY} this triage and the needs-triage label (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
 
   # The floor label, on an issues event only: a dispatch asks for triage. A
   # failed or skipped born-triaged gate (always skipped on a reopen) leaves
diff --git a/.github/workflows/maintenance-audit-lane-runs.yml b/.github/workflows/maintenance-audit-lane-runs.yml
index eea71d028f5..7122937e71e 100644
--- a/.github/workflows/maintenance-audit-lane-runs.yml
+++ b/.github/workflows/maintenance-audit-lane-runs.yml
@@ -100,7 +100,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or filed"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or filed"
 
       - name: Collect the units
         id: collect
diff --git a/.github/workflows/maintenance-delete-stale-branches.yml b/.github/workflows/maintenance-delete-stale-branches.yml
index ca14d8da5f4..e9bb824eb2e 100644
--- a/.github/workflows/maintenance-delete-stale-branches.yml
+++ b/.github/workflows/maintenance-delete-stale-branches.yml
@@ -100,7 +100,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or deleted"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or deleted"
 
       # cleanup.mjs reads the branch-cleanup leaf through the base's
       # resolve-config, which needs its dependencies.
@@ -188,7 +189,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing deleted"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing deleted"
 
       # The delete stage checks the list against the configured cap.
       - name: Install resolve-config's dependencies
diff --git a/.github/workflows/maintenance-file-recurring-issues.yml b/.github/workflows/maintenance-file-recurring-issues.yml
index a4aa1bb3083..f4c03030f73 100644
--- a/.github/workflows/maintenance-file-recurring-issues.yml
+++ b/.github/workflows/maintenance-file-recurring-issues.yml
@@ -73,7 +73,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or filed"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or filed"
 
       - name: File the due rows
         if: steps.kill.outputs.proceed == 'true'
diff --git a/.github/workflows/maintenance-measure-skill-edit.yml b/.github/workflows/maintenance-measure-skill-edit.yml
index 92f3c7ee66f..c2b67d3f817 100644
--- a/.github/workflows/maintenance-measure-skill-edit.yml
+++ b/.github/workflows/maintenance-measure-skill-edit.yml
@@ -140,6 +140,7 @@ jobs:
           KILL: ${{ steps.kill.outputs.proceed }}
           KILL_REASON: ${{ steps.kill.outputs.reason }}
           KILL_CAUSE: ${{ steps.kill.outputs.cause }}
+          KILL_WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops this run', steps.kill.outputs.reset) || 'the lanes kill switch stops this run' }}
           DEGRADED: ${{ steps.upstream.outputs.degraded }}
           DEGRADED_REASON: ${{ steps.upstream.outputs.reason }}
           WHO: ${{ steps.who.outputs.proceed }}
@@ -150,7 +151,7 @@ jobs:
             echo "::error::$1: $2"
             exit 1
           }
-          [ "$KILL" = true ] || stop kill-switch "the lanes start gate stops this run (reason: ${KILL_REASON:-unreadable}, cause: ${KILL_CAUSE:-unreadable})"
+          [ "$KILL" = true ] || stop kill-switch "${KILL_WHY} (reason: ${KILL_REASON:-unreadable}, cause: ${KILL_CAUSE:-unreadable})"
           [ "$DEGRADED" != true ] || stop upstream-degraded "${DEGRADED_REASON}; dispatch again once it recovers"
           [ "$WHO" = true ] || stop untrusted-dispatcher "the dispatcher is not a listed human (reason: ${WHO_REASON:-unreadable})"
 
@@ -336,8 +337,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
           exit 1
 
       # Under the workspace: --restricted confines the file tools to it.
diff --git a/.github/workflows/maintenance-monitor-signals.yml b/.github/workflows/maintenance-monitor-signals.yml
index ea465d54160..f7b4bb235c3 100644
--- a/.github/workflows/maintenance-monitor-signals.yml
+++ b/.github/workflows/maintenance-monitor-signals.yml
@@ -82,7 +82,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or filed"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or filed"
 
       # The Work status writer (write-status.mjs) reads models.issue-status
       # through resolve-config.mjs, whose packages only the resolve-config
diff --git a/.github/workflows/maintenance-tidy-code-upkeep.yml b/.github/workflows/maintenance-tidy-code-upkeep.yml
index 5b6a2d2061e..5dc24ece6e9 100644
--- a/.github/workflows/maintenance-tidy-code-upkeep.yml
+++ b/.github/workflows/maintenance-tidy-code-upkeep.yml
@@ -137,7 +137,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
 
       # A dispatch, and any re-run, must come from a listed human; the broker
       # checks the same, so this only keeps the model from running for nothing.
diff --git a/.github/workflows/post-merge-demotion-alert.yml b/.github/workflows/post-merge-demotion-alert.yml
index c06a89f90c1..26013167442 100644
--- a/.github/workflows/post-merge-demotion-alert.yml
+++ b/.github/workflows/post-merge-demotion-alert.yml
@@ -1532,7 +1532,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this report (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this report (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
 
       # report.mjs reads the red-main leaf through the base's resolve-config,
       # which needs its dependencies.
diff --git a/.github/workflows/post-merge-test-mutation.yml b/.github/workflows/post-merge-test-mutation.yml
index 6468f416f16..31c7136d3b7 100644
--- a/.github/workflows/post-merge-test-mutation.yml
+++ b/.github/workflows/post-merge-test-mutation.yml
@@ -108,7 +108,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing mutated"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing mutated"
 
       - name: Download the range
         id: download-range
diff --git a/.github/workflows/pr-feedback-dispatch.yml b/.github/workflows/pr-feedback-dispatch.yml
index 77aa2a63db7..e73251dff98 100644
--- a/.github/workflows/pr-feedback-dispatch.yml
+++ b/.github/workflows/pr-feedback-dispatch.yml
@@ -189,8 +189,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); the verdict is applied when the lost-run reconciler re-runs this job"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); the verdict is applied when the lost-run reconciler re-runs this job"
           exit 1
 
       - name: Download the verdict
@@ -406,8 +407,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::notice::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing dispatched"
+          echo "::notice::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing dispatched"
 
       # The script resolves the pr-unblock lane's address-feedback slot with
       # the base's resolve-config once it has found the PR and its head, and
diff --git a/.github/workflows/pr-merge.yml b/.github/workflows/pr-merge.yml
index a2988181d5c..6f666d799b6 100644
--- a/.github/workflows/pr-merge.yml
+++ b/.github/workflows/pr-merge.yml
@@ -1075,7 +1075,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing checked or merged"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing checked or merged"
 
       # The token broker gives this lane its merge token only when the person
       # behind the run is a listed human (trusted-actors.json on main), matched
diff --git a/.github/workflows/pr-refine.yml b/.github/workflows/pr-refine.yml
index dad2f80b9fc..12cda6243be 100644
--- a/.github/workflows/pr-refine.yml
+++ b/.github/workflows/pr-refine.yml
@@ -418,6 +418,7 @@ jobs:
       queue: max
     uses: ./.github/workflows/pr-run-activity-read.yml # zizmor: ignore[self-repository]
     with:
+      start-gate: true
       role: pr-unblock
       lane: pr-refine
       activity: fix-docs
@@ -633,6 +634,7 @@ jobs:
       queue: max
     uses: ./.github/workflows/pr-run-activity-read.yml # zizmor: ignore[self-repository]
     with:
+      start-gate: true
       role: pr-unblock
       lane: pr-refine
       activity: fix-docs
@@ -740,6 +742,7 @@ jobs:
       queue: max
     uses: ./.github/workflows/pr-run-activity-read.yml # zizmor: ignore[self-repository]
     with:
+      start-gate: true
       role: pr-unblock
       lane: pr-refine
       activity: fix-docs
diff --git a/.github/workflows/pr-run-activity-read.yml b/.github/workflows/pr-run-activity-read.yml
index 1189a0d99bb..6ceeba32927 100644
--- a/.github/workflows/pr-run-activity-read.yml
+++ b/.github/workflows/pr-run-activity-read.yml
@@ -82,6 +82,17 @@ on:
         required: false
         type: string
         default: ""
+      start-gate:
+        description: >-
+          `true` for a caller whose call starts new work (the issue lane, pr-refine):
+          broker-check's kill-switch gate then also stops on a low
+          GITHUB_TOKEN budget, on the first call in the slot only (fallback
+          empty or `credit-stop`); a call that takes over a handed-off turn,
+          and every call of a caller that leaves this `false`, checks the
+          switches only.
+        type: boolean
+        required: false
+        default: false
       fallback:
         description: >-
           Empty for the first call, which runs on claude-api-key and hands off
@@ -412,7 +423,8 @@ on:
       skip-reason:
         description: >-
           `kill-switch` when the broker refused the check because a lanes kill
-          switch is on, so no lane ran; empty otherwise.
+          switch is on, `budget` when broker-check's start gate stopped on a
+          low GITHUB_TOKEN budget, so no lane ran; empty otherwise.
         value: ${{ jobs.broker-check.outputs.skip-reason }}
       lease:
         description: >-
@@ -438,7 +450,9 @@ jobs:
   # neutral. A broker kill-switch refusal (a switch turned on after this run
   # read its variables) also ends green, with skip-reason kill-switch, which
   # skips the run job and every job after it but report, which posts the
-  # check neutral on a pull_request run. Any other broker answer but an allow, or none, fails this
+  # check neutral on a pull_request run. A start-gate stop on a low
+  # GITHUB_TOKEN budget ends green the same way, with skip-reason budget, and
+  # report posts the same neutral kill-switch check. Any other broker answer but an allow, or none, fails this
   # job, which skips the run job and fails the check. issues: write is for the issue
   # lease alone, posted before any model turn (CONTRACT.md "Lease protocol").
   broker-check:
@@ -456,7 +470,7 @@ jobs:
     # so the run job also checks that the allow came from its own attempt.
     outputs:
       allowed: ${{ steps.broker.outcome == 'success' && steps.broker.outputs.allowed == 'true' }}
-      skip-reason: ${{ steps.broker.outputs.skip-reason }}
+      skip-reason: ${{ steps.kill.outputs.cause == 'budget' && 'budget' || steps.broker.outputs.skip-reason }}
       attempt: ${{ github.run_attempt }}
       lease: ${{ steps.lease.outputs.lease }}
       lease-comment-id: ${{ steps.lease.outputs.lease-comment-id }}
@@ -519,8 +533,9 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # Starts new work: also stop on a low GITHUB_TOKEN budget.
-          budget: "true"
+          # A first call that starts new work also stops on a low GITHUB_TOKEN
+          # budget; a handed-off or fallback leg checks the switches only.
+          budget: ${{ inputs.start-gate && (inputs.fallback == '' || inputs.fallback == 'credit-stop') && 'true' || 'false' }}
 
       # work-unblock's sweep reads this step's name and conclusion from the
       # job listing (label-unblocked.mjs BUDGET_STEP): a stop on the
@@ -3941,7 +3956,7 @@ jobs:
           API_HEAD: ${{ steps.pr-head.outputs.sha }}
           PR_MISMATCH: ${{ steps.pr-head.outputs.pr-mismatch }}
           TRUSTED_SKIP: ${{ needs.broker-check.outputs.allowed != 'true' }}
-          BROKER_STOP: ${{ needs.broker-check.outputs.skip-reason == 'kill-switch' }}
+          BROKER_STOP: ${{ needs.broker-check.outputs.skip-reason == 'kill-switch' || needs.broker-check.outputs.skip-reason == 'budget' }}
           POST_DECLINE: ${{ inputs.post-decline }}
         run: |
           out() { printf 'post=true\nsha=%s\nforged=%s\n' "$1" "$2" >>"$GITHUB_OUTPUT"; }
@@ -3951,7 +3966,9 @@ jobs:
             valid "$gated" || gated=$EVENT_HEAD
             if [ "$TRUSTED_SKIP" = true ] || [ "$POST_DECLINE" = false ] || ! valid "$gated"; then
               out "" false
-              # The broker's kill-switch refusal skipped the run job: neutral.
+              # The broker's kill-switch refusal, or broker-check's budget
+              # stop, skipped the run job: neutral, under the skip-reason
+              # enum's kill-switch.
               if [ "$BROKER_STOP" = true ]; then echo "not-run-reason=kill-switch" >>"$GITHUB_OUTPUT"; fi
             else
               out "$gated" false
@@ -4073,7 +4090,7 @@ jobs:
       # post, warns and leaves the job green. A broker kill-switch refusal ran
       # no lane, so it posts none.
       - name: Post the lane run report comment
-        if: always() && needs.broker-check.outputs.skip-reason != 'kill-switch'
+        if: always() && needs.broker-check.outputs.skip-reason != 'kill-switch' && needs.broker-check.outputs.skip-reason != 'budget'
         continue-on-error: true
         env:
           LANE: ${{ inputs.lane }}
diff --git a/.github/workflows/pr-unblock-dispatch.yml b/.github/workflows/pr-unblock-dispatch.yml
index 6ce7b97abc4..ddcaea0b937 100644
--- a/.github/workflows/pr-unblock-dispatch.yml
+++ b/.github/workflows/pr-unblock-dispatch.yml
@@ -156,8 +156,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::notice::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing dispatched"
+          echo "::notice::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing dispatched"
 
       # A push or scheduled run on its first attempt was started by the event
       # itself. A hand run, or any re-run, is checked against the base list:
diff --git a/.github/workflows/pr-verify.yml b/.github/workflows/pr-verify.yml
index 84505a65cad..5f54cea3642 100644
--- a/.github/workflows/pr-verify.yml
+++ b/.github/workflows/pr-verify.yml
@@ -170,8 +170,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
           exit 1
 
       # The resolver reads only, and skips on its own reads every run it
@@ -2248,8 +2249,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
           exit 1
 
       # The resolver reads only, and skips on its own reads every run it
@@ -4181,8 +4183,9 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
+          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
           exit 1
 
       # The resolver reads only, and skips on its own reads every run it
diff --git a/.github/workflows/upstream-apply-changelog.yml b/.github/workflows/upstream-apply-changelog.yml
index 707356dd952..921501bd1f1 100644
--- a/.github/workflows/upstream-apply-changelog.yml
+++ b/.github/workflows/upstream-apply-changelog.yml
@@ -117,7 +117,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
 
       # A dispatch, and any re-run of one, must come from a listed human; the
       # broker checks the same, so this only keeps the model from running for
diff --git a/.github/workflows/work-resolve-issue.yml b/.github/workflows/work-resolve-issue.yml
index d7c31983d5d..0e02506ae70 100644
--- a/.github/workflows/work-resolve-issue.yml
+++ b/.github/workflows/work-resolve-issue.yml
@@ -408,6 +408,7 @@ jobs:
       id-token: write
     uses: ./.github/workflows/pr-run-activity-read.yml # zizmor: ignore[self-repository]
     with:
+      start-gate: true
       lane: work-resolve-issue
       role: issue-lane
       activity: resolve-issue
@@ -605,6 +606,7 @@ jobs:
       id-token: write
     uses: ./.github/workflows/pr-run-activity-read.yml # zizmor: ignore[self-repository]
     with:
+      start-gate: true
       lane: work-resolve-issue
       role: issue-lane
       activity: resolve-issue
@@ -701,6 +703,7 @@ jobs:
       id-token: write
     uses: ./.github/workflows/pr-run-activity-read.yml # zizmor: ignore[self-repository]
     with:
+      start-gate: true
       lane: work-resolve-issue
       role: issue-lane
       activity: resolve-issue
diff --git a/.github/workflows/work-unblock.yml b/.github/workflows/work-unblock.yml
index a7e283d70c8..9a505e26b1a 100644
--- a/.github/workflows/work-unblock.yml
+++ b/.github/workflows/work-unblock.yml
@@ -193,7 +193,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or labeled"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or labeled"
 
       # The base config's limits.api, in resolve-config's output shape, for
       # the pacer; a failed read leaves rate-limits.json's defaults.
@@ -510,7 +511,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no level decided or published"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no level decided or published"
 
       - name: Resolve the config
         id: config
@@ -710,7 +712,8 @@ jobs:
         env:
           REASON: ${{ steps.kill.outputs.reason }}
           CAUSE: ${{ steps.kill.outputs.cause }}
-        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
+          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
+        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
 
       # The broker mints on a label event only for a listed human (the
       # trusted-actor list on main, by id), so anyone else stops here quietly,
diff --git a/docs/conventions/pr-pipeline/README.md b/docs/conventions/pr-pipeline/README.md
index a66ad53585d..b69a22e56d6 100644
--- a/docs/conventions/pr-pipeline/README.md
+++ b/docs/conventions/pr-pipeline/README.md
@@ -3741,7 +3741,7 @@ with its default.
 | `fix-docs-per-run` | 2 | fix-docs dispatches one pr-unblock-dispatch `refine` run sends for its PR's event; 0 to 20. Each event offers one PR, so 0 turns CI fix-docs off and any other value turns it on. |
 | `admission-factor` | 0.8 | Share of the lane's hourly merge rate admitted per hour for the queued cap ([WIP cap](#wip-cap)); greater than 0, at most 1. |
 | `admission-min-per-hour` | 1 | Admissions per hour the queued cap never falls below, so a day with no lane merges cannot hold admissions shut; 0 to 100, and 0 removes the floor. |
-| `api` | schema | GitHub API margins per pool (`github-token`, `lanes-app`, `graphql`, `owner-token`, `content-creation`). `limit-cap` sets the pool's planned budget: planned = min(header limit, `limit-cap`), used = header limit - header remaining, left = planned - used. `github-token` defaults it to GitHub's documented GITHUB_TOKEN limit, so a higher header limit is headroom, never a target; the other pools have no cap and plan to their header limit. `plan` and `read-floor` are shares of the planned budget; `writer-pause`, `breaker` and `stop-floor` are shares of the header's limit, by its remaining; `content-creation` adds `per-minute` and `per-hour`. Their defaults are in `.github/actions/log-api-budget/rate-limits.json`, the only copy, which every merge hold list floors, so a change to a default waits for a person. The rate guard (`.github/actions/log-api-budget/rate-guard.mjs`, `planOf`) reads `read-floor` and `limit-cap`, to warn once while calls continue, and stops on the header's remaining and GitHub's refusals: at a remaining of 0, or at or under `stop-floor` of the header's limit, it sends no further call to that pool before the header's reset, records the stop in the job's stop file, and holds the step under `API_BUDGET_HOLD`, else fails it; a response with no readable limit, remaining or future reset never stops on `stop-floor`; `pace` (github-token, default 0.2) is the share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick when the previous scheduled run, by run id, marked a clean pass of its work (its `Mark this tick's work done` step, which a held or red pass and a paced tick skip), so two scheduled ticks in a row are never both skipped and its cadence halves (`.github/actions/log-api-budget/pace.mjs`; the lost-run reconciler, pr-unblock-dispatch and work-unblock's sweep read it, and pr-merge's post-merge-dispatch reads it for the merge and enable-auto-merge sweep jobs, which skip at job level while the post-merge check and cover dispatch run on every tick), so the timer lanes slow down before the breaker stops every lane; `0` turns pacing off; `start-gate` (github-token, 0.1) is the share of the header's limit, by its remaining, under which a kill-switch gate that starts new work (`.github/actions/check-kill-switch`, `budget: "true"`) does not start its lane while the reset is still ahead (one GET /rate_limit per such gate, a stop with reason `kill-switch`, cause `budget` and the window's `reset`; a failed read proceeds); that gate reads it from rate-limits.json alone, so a value set here is accepted and has no effect; the others are thresholds meant for the hub's limits sampler, and nothing in this repository enforces them. resolve-config passes the block through as set. |
+| `api` | schema | GitHub API margins per pool (`github-token`, `lanes-app`, `graphql`, `owner-token`, `content-creation`). `limit-cap` sets the pool's planned budget: planned = min(header limit, `limit-cap`), used = header limit - header remaining, left = planned - used. `github-token` defaults it to GitHub's documented GITHUB_TOKEN limit, so a higher header limit is headroom, never a target; the other pools have no cap and plan to their header limit. `plan` and `read-floor` are shares of the planned budget; `writer-pause`, `breaker` and `stop-floor` are shares of the header's limit, by its remaining; `content-creation` adds `per-minute` and `per-hour`. Their defaults are in `.github/actions/log-api-budget/rate-limits.json`, the only copy, which every merge hold list floors, so a change to a default waits for a person. The rate guard (`.github/actions/log-api-budget/rate-guard.mjs`, `planOf`) reads `read-floor` and `limit-cap`, to warn once while calls continue, and stops on the header's remaining and GitHub's refusals: at a remaining of 0, or at or under `stop-floor` of the header's limit, it sends no further call to that pool before the header's reset, records the stop in the job's stop file, and holds the step under `API_BUDGET_HOLD`, else fails it; a response with no readable limit, remaining or future reset never stops on `stop-floor`; `pace` (github-token, default 0.2) is the share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick when the previous scheduled run, by run id, marked a clean pass of its work (its `Mark this tick's work done` step, which a held or red pass and a paced tick skip), so two scheduled ticks in a row are never both skipped and its cadence halves (`.github/actions/log-api-budget/pace.mjs`; the lost-run reconciler, pr-unblock-dispatch and work-unblock's sweep read it, and pr-merge's post-merge-dispatch reads it for the merge and enable-auto-merge sweep jobs, which skip at job level while the post-merge check and cover dispatch run on every tick), so the timer lanes slow down before the breaker stops every lane; `0` turns pacing off; `start-gate` (github-token, 0.1) is the share of the header's limit, by its remaining, under which a kill-switch gate that starts new work (`.github/actions/check-kill-switch`, `budget: "true"`) does not start its lane while the reset is still ahead (one GET /rate_limit per such gate, a stop with reason `kill-switch`, cause `budget` and the window's `reset`; a failed read proceeds); that gate reads it from rate-limits.json alone, and the schema rejects a `start-gate` set here; the others are thresholds meant for the hub's limits sampler, and nothing in this repository enforces them. resolve-config passes the block through as set. |
 | `lane-level` | 2, 4, 3, 2, `[lanes-app]`, `true`, `CLAUDE_LANE_LEVEL`, 150 | The adaptive lane level L (owner decision Q111): `floor`, `ceiling`, `default`, `clean-windows` and `pools` for `decide()` in `.github/scripts/lib/lane-level.mjs`, whose truth table is `lane-level.vectors.json` beside it. `shadow` (default `true`), `variable` (default `CLAUDE_LANE_LEVEL`, must end in `_LANE_LEVEL`) and `valid-minutes` (default 150, 60 to 1440) govern publish and read: work-unblock's hourly `publish-lane-level` job publishes L as `<level>@<valid-until>` in `variable`, and pick-slot and label-unblocked read it through `.github/scripts/lib/lane-level-value.mjs` (empty, expired or malformed reads as `default`, clamped to `floor` and `ceiling`). While `shadow` is set the job mints no token and writes nothing, `SLOTS` stays `default`, and both log the level they would use. Each window L steps up 1 after `clean-windows` windows in a row that each had demand (runs waiting, or every slot running) and no limit signal, when every pool in `pools` fits: peak used, as a share of the pool's planned budget, times (L+1)/L at most `api.<pool>.plan`. A window where a pool has `api.<pool>.writer-pause` of its header's limit left or less resets the streak. Any limit signal the lanes App's own calls meet (403, 429, a secondary-limit or GraphQL rate-limit error, `retry-after`) halves L, rounded down, to no less than `floor`, and blocks a step up until the reset it names. A breaker trip is not a signal: it mostly reflects GITHUB_TOKEN spend, which pacing controls, and the breaker stays the backstop. Missing readings or demand hold L and the streak; a missing or malformed previous level reads as `default`, and every level is clamped to `floor` and `ceiling`. A `floor` above the `ceiling`, as set or defaulted, is rejected. An `api` pool field left unset reads from `rate-limits.json`, as the rate guard reads it. `.github/scripts/lib/lane-level-replay.mjs` replays the rule over the hub's recorded history. |
 
 report-outcome and the work-unblock sweep read them from resolve-config's output;
diff --git a/docs/conventions/pr-pipeline/pr-pipeline.schema.json b/docs/conventions/pr-pipeline/pr-pipeline.schema.json
index 8072fcd4938..781c60b7be1 100644
--- a/docs/conventions/pr-pipeline/pr-pipeline.schema.json
+++ b/docs/conventions/pr-pipeline/pr-pipeline.schema.json
@@ -532,12 +532,6 @@
           "maximum": 1,
           "description": "Share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick whose previous scheduled run marked a clean pass of its work(.github/actions/log-api-budget/pace.mjs), so the timer lanes slow to half cadence before the breaker stops every lane. 0 turns pacing off."
         },
-        "start-gate": {
-          "type": "number",
-          "minimum": 0,
-          "maximum": 1,
-          "description": "github-token's share of the header's limit, by the header's remaining, under which a kill-switch gate that starts new work (.github/actions/check-kill-switch, budget \"true\") stops its lane while the reset is still ahead. The gate reads it from rate-limits.json alone: a value set here is accepted and has no effect on the gate."
-        },
         "read-floor": {
           "type": "number",
           "minimum": 0,

From d7fc23abf9ee21dfccc3793afde2e047e2f22a63 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Wed, 11 Nov 2026 11:37:40 -0500
Subject: [PATCH 7/9] fix(pr-pipeline): stop on a refused budget read and keep
 pr-unblock off it

A refused GET /rate_limit (403, 429, retry-after, or
x-ratelimit-remaining 0) now stops a start gate with cause budget and a
future reset (the header's, else now + retry-after, else now + 60), so a
spent token never leads to more calls. Transport errors, timeouts, 5xx,
401 and unreadable bodies still proceed. A share of 0 makes no read.

The skill-edit gate ends a budget stop neutral with a notice, and its
later steps wait on the gate. The pr-unblock dispatcher, pr-refine and
the issue lane's fallback leg check the switches only. Gates that never
read the budget keep main's stop wording.

The gate test now checks that no step a budget stop runs fails the job,
and that every budget job checks out log-api-budget beside the gate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/actions/check-kill-switch/README.md   |  32 ++--
 .github/actions/check-kill-switch/action.yml  |   3 +-
 .../check-kill-switch/check-kill-switch.mjs   |  35 +++-
 .../check-kill-switch.test.mjs                | 170 +++++++++++++++++-
 .../actions/resolve-config/callers.test.mjs   |   7 +-
 .github/workflows/eval-browser-dispatch.yml   |  13 +-
 .github/workflows/eval-hill-climb-pass.yml    |  13 +-
 .../maintenance-delete-stale-branches.yml     |   4 +-
 .../maintenance-measure-skill-edit.yml        |  20 ++-
 .../workflows/post-merge-demotion-alert.yml   |   4 +-
 .github/workflows/pr-feedback-dispatch.yml    |   8 +-
 .github/workflows/pr-merge.yml                |   4 +-
 .github/workflows/pr-refine.yml               |   3 -
 .github/workflows/pr-run-activity-read.yml    |   2 +-
 .github/workflows/pr-unblock-dispatch.yml     |   8 +-
 .github/workflows/pr-verify.yml               |  12 +-
 .github/workflows/work-resolve-issue.yml      |   1 -
 .github/workflows/work-unblock.yml            |   8 +-
 docs/conventions/pr-pipeline/README.md        |   2 +-
 19 files changed, 255 insertions(+), 94 deletions(-)

diff --git a/.github/actions/check-kill-switch/README.md b/.github/actions/check-kill-switch/README.md
index 97c6ef39d54..592b88b248d 100644
--- a/.github/actions/check-kill-switch/README.md
+++ b/.github/actions/check-kill-switch/README.md
@@ -11,10 +11,14 @@ With `budget: "true"` and both switches proceeding, the gate makes one GET /rate
 or from the body's `resources.core` when a header is missing. It stops the lane while remaining
 is under github-token's `start-gate` share of the limit and the reset is still ahead. The share
 is read from [`rate-limits.json`](../log-api-budget/rate-limits.json) alone (0.1); no
-`pr-pipeline.yaml` field overrides it. A read that fails, times out or carries no reading, or a
-share that cannot be read, proceeds with a warning; the rate guard's `stop-floor` is the
-backstop. GitHub counts GET /rate_limit against the secondary limit, not the primary one, so the
-gate makes it once, with no retry, and not at all when a switch already stops. Each read logs one
+`pr-pipeline.yaml` field overrides it. A share of 0 turns the read off. A refused read (403, 429,
+a `retry-after` header, or `x-ratelimit-remaining: 0`) stops the lane with cause `budget`, since
+more calls would be refused too; its reset is `x-ratelimit-reset`, else now plus `retry-after`,
+else now plus 60 seconds. A read that fails otherwise (a transport error, a timeout, a 5xx or a
+401) or carries no reading, or a share that cannot be read, proceeds with a warning; the rate
+guard's `stop-floor` is the backstop. GitHub counts GET /rate_limit against the secondary limit,
+not the primary one, so the gate makes it once, with no retry, and not at all when a switch
+already stops. Each read logs one
 `start-gate` notice with the body's core block and the response's rate-limit headers, so the two
 can be compared.
 
@@ -33,14 +37,18 @@ and a read lane's broker check, while one exists.
 | `token` | `${{ github.token }}` | The token whose GET /rate_limit answer is the budget reading |
 
 Set `budget: "true"` only on a gate that starts new work: the read runner's `broker-check` on the
-first call of a caller that passes `start-gate: true` (the issue lane and pr-refine; pr-unblock
-fixes existing pull requests and passes none), a workflow's first gate on a schedule or event that begins a run's work (intake triage and its
-refine select, the audit, cleanup, recurring-issue, skill-edit, signals, reconcile, tidy,
-mutation and changelog ticks, the pr-unblock dispatcher, and the work-unblock sweep). A gate
-that finishes or judges existing work keeps the default, so a low budget never throws that work
-away: reviews, merges, verdicts and verify notes, writes after a model turn, and model legs that
-take over a handed-off turn. Evals, which a person or a pull request starts, keep it too. `check-kill-switch.test.mjs` classifies
-every gate in `.github/workflows` and fails on one it does not know.
+first call of a caller that passes `start-gate: true` (the issue lane only), and a workflow's
+first gate on a schedule or event that begins a run's work (intake triage and its refine select,
+the audit, cleanup, recurring-issue, skill-edit, signals, reconcile, tidy, mutation and changelog
+ticks, and the work-unblock sweep). A gate that finishes or judges existing work keeps the
+default, so a low budget never throws that work away: reviews, merges, verdicts and verify notes,
+writes after a model turn, model legs that take over a handed-off turn or run as the fallback,
+and the pr-unblock legs (its dispatcher and pr-refine), which fix existing pull requests. Evals,
+which a person or a pull request starts, keep it too. A budget stop ends the run neutral: a
+notice, no failed step. A job that sets `budget: "true"` checks out fully or lists
+`.github/actions/log-api-budget/` in its sparse checkout, where the share is read.
+`check-kill-switch.test.mjs` classifies every gate in `.github/workflows` and fails on one it
+does not know.
 
 ## Outputs
 
diff --git a/.github/actions/check-kill-switch/action.yml b/.github/actions/check-kill-switch/action.yml
index 1e756199e2c..a218a4e19c3 100644
--- a/.github/actions/check-kill-switch/action.yml
+++ b/.github/actions/check-kill-switch/action.yml
@@ -5,7 +5,8 @@ description: >
   proceeds only on exactly `false`; unset, empty and every other value stop.
   With budget "true" and both switches off, one GET /rate_limit stops the
   lane while the core pool's remaining is under rate-limits.json's
-  github-token start-gate share of its limit; a failed read proceeds. Every
+  github-token start-gate share of its limit, or when the read is refused
+  (403, 429, retry-after, remaining 0); any other failed read proceeds. Every
   stop is proceed=false reason=kill-switch, with cause switch or budget.
   Always exits 0: the model step's `if:` reads the output, so a missing
   output also keeps the lane stopped.
diff --git a/.github/actions/check-kill-switch/check-kill-switch.mjs b/.github/actions/check-kill-switch/check-kill-switch.mjs
index 69847814453..3899adf3c31 100644
--- a/.github/actions/check-kill-switch/check-kill-switch.mjs
+++ b/.github/actions/check-kill-switch/check-kill-switch.mjs
@@ -9,8 +9,10 @@
 //   and -reset when the response carries all three, else the body's
 //   resources.core. The lane stops while remaining < start-gate x limit and
 //   the reset is still ahead; start-gate is github-token's entry in
-//   ../log-api-budget/rate-limits.json. A read that fails or cannot be read,
-//   or a share that cannot be read, proceeds with a warning; the rate guard's
+//   ../log-api-budget/rate-limits.json. A refused read (403, 429, retry-after
+//   or x-ratelimit-remaining 0) stops, since more calls would be refused too.
+//   A read that fails otherwise (transport, timeout, 5xx, 401) or cannot be
+//   parsed, or a share that cannot be read, proceeds with a warning; the rate guard's
 //   stop-floor (log-api-budget/rate-guard.mjs) is the backstop. GitHub counts
 //   this call against the secondary limit, not the primary one, so it is made
 //   once, with no retry. A gate that finishes or judges existing work leaves
@@ -58,6 +60,29 @@ export function readingOf(headers, body) {
 const clean = (text) => String(text).replace(/[\r\n%:]/g, " ");
 const show = (fields) => Object.entries(fields ?? {}).map(([name, value]) => `${name}=${clean(value ?? "na")}`).join(" ");
 
+const DEFAULT_WAIT_S = 60;
+const whole = (value) => (/^\d+$/.test(value ?? "") ? Number(value) : Number.NaN);
+
+// A response that says the token is already limited (403, 429, retry-after, or
+// no requests remaining) stops the lane rather than proceeding into more calls
+// that would be refused too. Its reset is always ahead of now: the header's
+// reset, else now + retry-after, else now + 60.
+function refusal(response, now) {
+  const { status, headers } = response;
+  const header = (name) => headers?.get?.(name) ?? null;
+  const [retryAfter, remaining, headerReset] = [header("retry-after"), header("x-ratelimit-remaining"), header("x-ratelimit-reset")];
+  if (status !== 403 && status !== 429 && retryAfter === null && remaining !== "0") {
+    return null;
+  }
+  const wait = Number.isFinite(whole(retryAfter)) ? whole(retryAfter) : DEFAULT_WAIT_S;
+  const reset = whole(headerReset) > now ? whole(headerReset) : Math.ceil(now + wait);
+  return {
+    stop: true,
+    reset,
+    line: `::warning title=start-gate::the GITHUB_TOKEN budget read was refused (HTTP ${status} ${show({ "retry-after": retryAfter, remaining, reset: headerReset })}); the lane stops until ${reset}`,
+  };
+}
+
 // The budget half of the gate: { stop, reset, line } where line is the run's
 // one notice or warning. Never throws.
 export async function checkBudget({ token, api = "https://api.github.com", share, now = Date.now() / 1000, fetchImpl = fetch } = {}) {
@@ -69,6 +94,10 @@ export async function checkBudget({ token, api = "https://api.github.com", share
       headers: { Accept: "application/vnd.github+json", Authorization: `Bearer ${token}`, "X-GitHub-Api-Version": "2022-11-28" },
       signal: AbortSignal.timeout(READ_TIMEOUT_MS),
     });
+    const refused = refusal(response, now);
+    if (refused) {
+      return refused;
+    }
     if (!response.ok) {
       throw new Error(`HTTP ${response.status}`);
     }
@@ -127,7 +156,7 @@ export async function main(env = process.env, { fetchImpl = fetch, now = Date.no
   let result = { ...checkKillSwitch(env.KILL_SWITCH_VALUE, env.REPO_KILL_SWITCH_VALUE), reset: "" };
   if (result.proceed === "true" && env.BUDGET_CHECK === "true") {
     const share = startGateShare(rateLimits, log);
-    if (share !== null) {
+    if (share) {
       const budget = await checkBudget({ token: env.BUDGET_TOKEN, api: env.GITHUB_API_URL || undefined, share, now: now() / 1000, fetchImpl });
       log(budget.line);
       if (budget.stop) {
diff --git a/.github/actions/check-kill-switch/check-kill-switch.test.mjs b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
index 7de4c92a7ee..8fc7872dc7d 100644
--- a/.github/actions/check-kill-switch/check-kill-switch.test.mjs
+++ b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
@@ -137,8 +137,34 @@ test("the budget read falls back to the body's resources.core when a header is m
   assert.match(result.line, /headers limit=5000 remaining=na /);
 });
 
+// GitHub answers an exhausted token with 403 or 429, x-ratelimit-remaining 0
+// and, for a secondary limit, retry-after in seconds; another call would be
+// refused too, so each stops with a reset still ahead.
+const REFUSED_READS = [
+  ["a 403 with the window's reset", () => rateLimitResponse({ status: 403, headers: headersOf(5000, 0, RESET) }), RESET],
+  ["a 429 with retry-after 30", () => rateLimitResponse({ status: 429, headers: { "retry-after": "30" } }), NOW_S + 30],
+  ["a bare 403", () => rateLimitResponse({ status: 403 }), NOW_S + 60],
+  ["a bare 429", () => rateLimitResponse({ status: 429 }), NOW_S + 60],
+  ["a 200 with retry-after 120", () => rateLimitResponse({ headers: { "retry-after": "120" } }), NOW_S + 120],
+  ["a 200 with remaining 0 and a reset already past", () => rateLimitResponse({ headers: headersOf(5000, 0, NOW_S - 5) }), NOW_S + 60],
+  // remaining 0 outranks the 5xx rule: the pool is spent whatever the status.
+  ["a 500 with remaining 0", () => rateLimitResponse({ status: 500, headers: headersOf(5000, 0, RESET) }), RESET],
+];
+
+for (const [label, answer, reset] of REFUSED_READS) {
+  test(`a budget read that meets ${label} stops with a future reset and makes no other call`, async () => {
+    const { calls, fetchImpl } = recordingFetch(answer);
+    const result = await checkBudget({ token: "t", share: 0.1, now: NOW_S, fetchImpl });
+    assert.equal(result.stop, true);
+    assert.equal(result.reset, reset);
+    assert.equal(calls.length, 1, "no retry");
+    assert.match(result.line, new RegExp(`^::warning title=start-gate::the GITHUB_TOKEN budget read was refused \\(HTTP \\d+ .*\\); the lane stops until ${reset}$`));
+  });
+}
+
 const FAILED_READS = [
-  ["a 500", () => rateLimitResponse({ status: 500, headers: headersOf(5000, 0, RESET) }), /HTTP 500/],
+  ["a 500", () => rateLimitResponse({ status: 500 }), /HTTP 500/],
+  ["a 503 with headers to spare", () => rateLimitResponse({ status: 503, headers: headersOf(5000, 4000, RESET) }), /HTTP 503/],
   ["a 401", () => rateLimitResponse({ status: 401 }), /HTTP 401/],
   ["a network error", new Error("connect ECONNREFUSED"), /connect ECONNREFUSED/],
   ["no headers and no body reading", () => new Response("not json", { status: 200 }), /neither the headers nor the body/],
@@ -194,6 +220,14 @@ const OFF = { KILL_SWITCH_VALUE: "false", REPO_KILL_SWITCH_VALUE: "false" };
 const START = { ...OFF, BUDGET_CHECK: "true" };
 const empty = () => rateLimitResponse({ headers: headersOf(5000, 0, RESET) });
 
+for (const status of [403, 429]) {
+  test(`a start gate whose budget read meets a ${status} stops with cause budget after one call`, async () => {
+    const { calls, outputs } = await runMain(START, () => rateLimitResponse({ status }));
+    assert.equal(calls.length, 1, "no retry");
+    assert.deepEqual(outputs, { proceed: "false", reason: "kill-switch", cause: "budget", reset: String(NOW_S + 60) });
+  });
+}
+
 test("by default the gate checks the switches only and makes no /rate_limit call", async () => {
   for (const value of [undefined, "", "false", "FALSE", "yes"]) {
     const { calls, lines, outputs } = await runMain({ ...OFF, BUDGET_CHECK: value }, empty);
@@ -229,7 +263,8 @@ test("the share is rate-limits.json's github-token start-gate", async () => {
   const half = { "github-token": { "start-gate": 0.5 } };
   assert.equal((await runMain(START, rateLimitResponse({ headers: headersOf(5000, 2499, RESET) }), { rateLimits: half })).outputs.cause, "budget");
   assert.equal((await runMain(START, rateLimitResponse({ headers: headersOf(5000, 2500, RESET) }), { rateLimits: half })).outputs.cause, "ok");
-  assert.equal((await runMain(START, empty, { rateLimits: { "github-token": { "start-gate": 0 } } })).outputs.cause, "ok", "0 turns it off");
+  const off = await runMain(START, empty, { rateLimits: { "github-token": { "start-gate": 0 } } });
+  assert.deepEqual([off.outputs.cause, off.calls.length], ["ok", 0], "0 turns it off: no read");
   assert.equal(startGateShare(fileURLToPath(new URL("../log-api-budget/rate-limits.json", import.meta.url)), () => {}), 0.1, "the shipped value");
 });
 
@@ -297,7 +332,7 @@ const GATES = {
   // only on a call that is the first in its slot (FIRST_CALL).
   "pr-run-activity-read.yml": { "broker-check": "first-call", run: "switch" },
   "pr-run-activity-write.yml": { run: "switch" },
-  "pr-unblock-dispatch.yml": { dispatch: "start", refine: "start" },
+  "pr-unblock-dispatch.yml": { dispatch: "switch", refine: "switch" },
   "pr-unblock.yml": {
     "resolve-conflicts-select": "switch",
     "sync-shared-copies-select": "switch",
@@ -325,15 +360,15 @@ const GATES = {
 const FIRST_CALL = /^ {10}budget: \$\{\{ inputs\.start-gate && \(inputs\.fallback == '' \|\| inputs\.fallback == 'credit-stop'\) && 'true' \|\| 'false' \}\}$/m;
 
 // The read-runner calls that pass start-gate, by workflow and job: the issue
-// lane and pr-refine start new work; pr-unblock fixes existing PRs and passes
-// none. Each listed call's handed-off and fallback legs read no budget
-// through FIRST_CALL's fallback test.
+// lane's key leg and its subscription leg, which is the slot's first call
+// when the key leg was skipped (fallback credit-stop). pr-unblock and
+// pr-refine fix existing PRs and pass none, nor does the fallback leg, which
+// never makes a first call.
 const START_CALLS = {
-  "work-resolve-issue.yml": ["resolve-issue", "resolve-issue-subscription", "resolve-issue-fallback"],
-  "pr-refine.yml": ["fix-docs", "fix-docs-subscription", "fix-docs-fallback"],
+  "work-resolve-issue.yml": ["resolve-issue", "resolve-issue-subscription"],
 };
 
-test("only the issue lane's and pr-refine's read-runner calls pass start-gate", () => {
+test("only the issue lane's first-call read-runner calls pass start-gate", () => {
   for (const file of readdirSync(WORKFLOWS).filter((name) => name.endsWith(".yml"))) {
     const lines = readFileSync(path.join(WORKFLOWS, file), "utf8").split("\n");
     const starting = [];
@@ -391,6 +426,123 @@ test("every gate in the workflows is classified, and only start gates read the b
   }
 });
 
+// The steps of each job in a workflow, as text, by job id.
+function stepsByJob(file) {
+  const lines = readFileSync(path.join(WORKFLOWS, file), "utf8").split("\n");
+  const jobsAt = lines.indexOf("jobs:");
+  const jobs = {};
+  let job = null;
+  let step = null;
+  lines.forEach((line, i) => {
+    const id = i > jobsAt && /^ {2}([a-z][a-z0-9-]*):$/.exec(line);
+    if (id) {
+      job = id[1];
+      jobs[job] = [];
+      step = null;
+    } else if (job && /^ {6}- /.test(line)) {
+      step = [line];
+      jobs[job].push(step);
+    } else if (step && /^ {0,5}\S/.test(line)) {
+      step = null;
+    } else if (step) {
+      step.push(line);
+    }
+  });
+  return Object.fromEntries(Object.entries(jobs).map(([name, steps]) => [name, steps.map((text) => text.join("\n"))]));
+}
+
+const KILL_STEP = /^\s*(?:-\s+)?uses:\s*["']?[^\s"'#]*actions\/check-kill-switch\b/m;
+const budgetJobs = () =>
+  Object.entries(GATES).flatMap(([file, jobs]) =>
+    Object.entries(jobs)
+      .filter(([, kind]) => kind === "start" || kind === "first-call")
+      .map(([job]) => ({ file, job, steps: stepsByJob(file)[job] })),
+  );
+
+test("budget jobs are found", () => {
+  const jobs = budgetJobs();
+  assert.ok(jobs.length >= 15, `${jobs.length} budget jobs`);
+  for (const { file, job, steps } of jobs) {
+    assert.ok(steps?.some((step) => KILL_STEP.test(step)), `${file} ${job}: its steps hold the gate`);
+  }
+});
+
+// Split `text` on `separator` outside parentheses.
+function splitTop(text, separator) {
+  const parts = [""];
+  let depth = 0;
+  for (let i = 0; i < text.length; i += 1) {
+    if (depth === 0 && text.startsWith(separator, i)) {
+      parts.push("");
+      i += separator.length - 1;
+      continue;
+    }
+    depth += text[i] === "(" ? 1 : text[i] === ")" ? -1 : 0;
+    parts[parts.length - 1] += text[i];
+  }
+  return parts.map((part) => part.trim());
+}
+
+// Whether a step `if:` is false on a budget stop: every top-level disjunct
+// has a conjunct that needs the gate to proceed, the cause not to be budget,
+// or a success or a non-empty output from a step that was skipped.
+function falseOnBudget(condition, skipped) {
+  const falseAtom = (atom) => {
+    if (/^steps\.kill\.outputs\.proceed == 'true'$|^steps\.kill\.outputs\.cause != 'budget'$/.test(atom)) return true;
+    const ref = /^steps\.([a-z0-9-]+)\.(?:(?:outcome|conclusion) == 'success'|outputs\.[a-z0-9-]+ == '[^']+')$/.exec(atom);
+    return Boolean(ref && skipped.has(ref[1]));
+  };
+  const text = condition.replace(/^\$\{\{|\}\}$/g, "").replace(/\s+/g, " ").trim();
+  return text !== "" && splitTop(text, "||").every((disjunct) => splitTop(disjunct, "&&").some(falseAtom));
+}
+
+test("a budget stop ends neutral: no step it runs fails the job or writes ::error", () => {
+  for (const { file, job, steps } of budgetJobs()) {
+    const skipped = new Set();
+    for (const step of steps.slice(steps.findIndex((s) => KILL_STEP.test(s)) + 1)) {
+      const condition = /^ {8}if: (?:>-\n)?([\s\S]*?)\n {8}[a-z-]+:/m.exec(`${step}\n        end:`)?.[1] ?? "";
+      if (falseOnBudget(condition, skipped)) {
+        const id = /^ {8}id: ([a-z0-9-]+)$/m.exec(step)?.[1];
+        if (id) skipped.add(id);
+        continue;
+      }
+      const name = /name: (.*)/.exec(step)?.[1] ?? step.split("\n")[0];
+      assert.doesNotMatch(step, /::error|\bexit 1\b/, `${file} ${job} "${name}" runs on a budget stop and fails it`);
+    }
+  }
+});
+
+test("the budget-stop reading of a step condition", () => {
+  const skipped = new Set(["broker"]);
+  assert.equal(falseOnBudget("steps.kill.outputs.proceed == 'true'", skipped), true);
+  assert.equal(falseOnBudget("steps.kill.outputs.cause != 'budget'", skipped), true);
+  assert.equal(falseOnBudget("steps.broker.outcome == 'success' && inputs.x != ''", skipped), true, "a skipped step's success");
+  assert.equal(falseOnBudget("steps.other.outcome == 'success'", skipped), false, "a step that ran");
+  assert.equal(falseOnBudget("steps.kill.outputs.proceed != 'true'", skipped), false, "the stop report runs");
+  assert.equal(falseOnBudget("always()", skipped), false);
+  assert.equal(falseOnBudget("", skipped), false, "no condition runs");
+  assert.equal(falseOnBudget("steps.broker.outputs.allowed == 'true' || inputs.force", skipped), false, "one disjunct may hold");
+  assert.equal(falseOnBudget("inputs.a == '' && (inputs.b == '' || steps.kill.outputs.proceed == 'true')", skipped), false, "a parenthesized disjunction may hold");
+});
+
+// check-kill-switch reads the share from ../log-api-budget/rate-limits.json
+// beside it; a sparse checkout without that directory turns the read off.
+test("every budget job checks out log-api-budget beside the gate", () => {
+  for (const { file, job, steps } of budgetJobs()) {
+    const gate = steps.find((step) => KILL_STEP.test(step));
+    const root = /uses:\s*\.\/(.*?)\.github\/actions\/check-kill-switch/.exec(gate)?.[1]?.replace(/\/$/, "") ?? "";
+    const checkout = steps.find((step) => /uses: actions\/checkout@/.test(step) && (/^ {10}path: (.*)$/m.exec(step)?.[1]?.trim() ?? "") === root);
+    assert.ok(checkout, `${file} ${job}: a checkout at "${root}" holds the gate`);
+    const sparse = /^ {10}sparse-checkout: \|\n((?: {12}.*\n?)+)/m.exec(checkout)?.[1];
+    if (sparse === undefined) continue;
+    const covers = sparse
+      .split("\n")
+      .map((entry) => entry.trim().replace(/^\//, "").replace(/\/\**$/, ""))
+      .some((entry) => entry && ".github/actions/log-api-budget/".startsWith(`${entry}/`));
+    assert.ok(covers, `${file} ${job}: its sparse checkout lists .github/actions/log-api-budget/`);
+  }
+});
+
 test("CLI writes proceed=true when both switches are exactly false and exits 0", () => {
   const { status, stdout, outputs } = runCli({ KILL_SWITCH_VALUE: "false", REPO_KILL_SWITCH_VALUE: "false" });
   assert.equal(status, 0);
diff --git a/.github/actions/resolve-config/callers.test.mjs b/.github/actions/resolve-config/callers.test.mjs
index 1edb5d36160..deab90cabcb 100644
--- a/.github/actions/resolve-config/callers.test.mjs
+++ b/.github/actions/resolve-config/callers.test.mjs
@@ -8194,11 +8194,14 @@ test("work-resolve-issue.yml: resolve-issue-subscription starts on resolve-issue
   const { fallback, "fallback-ready": fallbackReady, ...same } = sub.with;
   assert.deepEqual(same, firstSame, "the fallback call runs the same activity on the same inputs");
   assert.deepEqual(sub.concurrency, jobs["resolve-issue"].concurrency, "in the same slot");
-  // The third call: the same inputs on the fallback token, in the same slot.
+  // The third call: the same inputs on the fallback token, in the same slot,
+  // without start-gate, since it never makes the slot's first call.
   const third = jobs["resolve-issue-fallback"];
   const { fallback: thirdFallback, ...thirdSame } = third.with;
   assert.equal(thirdFallback, "fallback");
-  assert.deepEqual(thirdSame, firstSame, "the third call runs the same activity on the same inputs");
+  const { "start-gate": firstStartGate, ...firstUngated } = firstSame;
+  assert.equal(firstStartGate, true, "the first call starts new work");
+  assert.deepEqual(thirdSame, firstUngated, "the third call runs the same activity on the same inputs, switches only");
   assert.deepEqual(third.concurrency, jobs["resolve-issue"].concurrency, "in the same slot");
   // The handoff job: the default branch tip's handoff-evidence.sh on
   // read-only tokens, no secret, as every pr-unblock handoff job runs it.
diff --git a/.github/workflows/eval-browser-dispatch.yml b/.github/workflows/eval-browser-dispatch.yml
index c09778bd999..5b3a36abd59 100644
--- a/.github/workflows/eval-browser-dispatch.yml
+++ b/.github/workflows/eval-browser-dispatch.yml
@@ -251,6 +251,7 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+
       # Skips the run while Actions or npm installs report a degraded component,
       # with a logged reason; fails open (.github/actions/check-upstream-status).
       - name: Check upstream status
@@ -264,10 +265,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
           exit 1
 
       - name: Stop while upstream is degraded
@@ -1097,10 +1096,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
           exit 1
 
       - name: Stop while upstream is degraded
@@ -1884,10 +1881,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
           exit 1
 
       - name: Stop while upstream is degraded
diff --git a/.github/workflows/eval-hill-climb-pass.yml b/.github/workflows/eval-hill-climb-pass.yml
index f2bc6a91428..5544815b64c 100644
--- a/.github/workflows/eval-hill-climb-pass.yml
+++ b/.github/workflows/eval-hill-climb-pass.yml
@@ -176,14 +176,13 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+
       - name: Stop when the kill switch is on
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
           exit 1
 
       # Only whether each secret is set reaches the action, never its value.
@@ -593,10 +592,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
           exit 1
 
       # Only whether each secret is set reaches the action, never its value.
@@ -969,10 +966,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
           exit 1
 
       # Only whether each secret is set reaches the action, never its value.
diff --git a/.github/workflows/maintenance-delete-stale-branches.yml b/.github/workflows/maintenance-delete-stale-branches.yml
index e9bb824eb2e..11c1df80ed2 100644
--- a/.github/workflows/maintenance-delete-stale-branches.yml
+++ b/.github/workflows/maintenance-delete-stale-branches.yml
@@ -188,9 +188,7 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
-        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing deleted"
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing deleted"
 
       # The delete stage checks the list against the configured cap.
       - name: Install resolve-config's dependencies
diff --git a/.github/workflows/maintenance-measure-skill-edit.yml b/.github/workflows/maintenance-measure-skill-edit.yml
index c2b67d3f817..faf0009510d 100644
--- a/.github/workflows/maintenance-measure-skill-edit.yml
+++ b/.github/workflows/maintenance-measure-skill-edit.yml
@@ -133,14 +133,22 @@ jobs:
           require-pr: "false"
           require-kind: human
 
+      # A low budget ends the run neutral: go stays unset, so no pass runs.
+      - name: Report a budget stop
+        if: steps.kill.outputs.cause == 'budget'
+        env:
+          RESET: ${{ steps.kill.outputs.reset }}
+        run: |
+          echo "gate: kill-switch: the GITHUB_TOKEN budget is low until ${RESET} (epoch seconds)" >>"$GITHUB_STEP_SUMMARY"
+          echo "::notice::the GITHUB_TOKEN budget is low until ${RESET} (epoch seconds), which stops this run; nothing read or written"
+
       # Each stop names its gate in the job summary. Each pass checks the
       # credential is set, so no job here reads a secret.
       - name: Check the run may spend
+        if: steps.kill.outputs.cause != 'budget'
         env:
           KILL: ${{ steps.kill.outputs.proceed }}
           KILL_REASON: ${{ steps.kill.outputs.reason }}
-          KILL_CAUSE: ${{ steps.kill.outputs.cause }}
-          KILL_WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops this run', steps.kill.outputs.reset) || 'the lanes kill switch stops this run' }}
           DEGRADED: ${{ steps.upstream.outputs.degraded }}
           DEGRADED_REASON: ${{ steps.upstream.outputs.reason }}
           WHO: ${{ steps.who.outputs.proceed }}
@@ -151,12 +159,13 @@ jobs:
             echo "::error::$1: $2"
             exit 1
           }
-          [ "$KILL" = true ] || stop kill-switch "${KILL_WHY} (reason: ${KILL_REASON:-unreadable}, cause: ${KILL_CAUSE:-unreadable})"
+          [ "$KILL" = true ] || stop kill-switch "the lanes kill switch is on (reason: ${KILL_REASON:-unreadable})"
           [ "$DEGRADED" != true ] || stop upstream-degraded "${DEGRADED_REASON}; dispatch again once it recovers"
           [ "$WHO" = true ] || stop untrusted-dispatcher "the dispatcher is not a listed human (reason: ${WHO_REASON:-unreadable})"
 
       - name: Check the inputs
         id: inputs
+        if: steps.kill.outputs.proceed == 'true'
         env:
           PLUGIN: ${{ inputs.plugin }}
           SKILL: ${{ inputs.skill }}
@@ -191,6 +200,7 @@ jobs:
       # case count after the tag or case filter is known only after pass a.
       - name: Check the suite
         id: stage
+        if: steps.kill.outputs.proceed == 'true'
         env:
           DIR: .base/plugins/${{ steps.inputs.outputs.plugin }}
         run: |
@@ -336,10 +346,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable})"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable})"
           exit 1
 
       # Under the workspace: --restricted confines the file tools to it.
diff --git a/.github/workflows/post-merge-demotion-alert.yml b/.github/workflows/post-merge-demotion-alert.yml
index 26013167442..399c7abdf36 100644
--- a/.github/workflows/post-merge-demotion-alert.yml
+++ b/.github/workflows/post-merge-demotion-alert.yml
@@ -1531,9 +1531,7 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
-        run: echo "::notice::${WHY} this report (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
+        run: echo "::notice::the lanes kill switch stops this report (reason ${REASON:-unreadable}); nothing read or written"
 
       # report.mjs reads the red-main leaf through the base's resolve-config,
       # which needs its dependencies.
diff --git a/.github/workflows/pr-feedback-dispatch.yml b/.github/workflows/pr-feedback-dispatch.yml
index e73251dff98..b617139a42d 100644
--- a/.github/workflows/pr-feedback-dispatch.yml
+++ b/.github/workflows/pr-feedback-dispatch.yml
@@ -188,10 +188,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true' && github.event.workflow_run.conclusion == 'success'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); the verdict is applied when the lost-run reconciler re-runs this job"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); the verdict is applied when the lost-run reconciler re-runs this job"
           exit 1
 
       - name: Download the verdict
@@ -406,10 +404,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::notice::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing dispatched"
+          echo "::notice::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); nothing dispatched"
 
       # The script resolves the pr-unblock lane's address-feedback slot with
       # the base's resolve-config once it has found the PR and its head, and
diff --git a/.github/workflows/pr-merge.yml b/.github/workflows/pr-merge.yml
index 6f666d799b6..2650fbdc260 100644
--- a/.github/workflows/pr-merge.yml
+++ b/.github/workflows/pr-merge.yml
@@ -1074,9 +1074,7 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
-        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing checked or merged"
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing checked or merged"
 
       # The token broker gives this lane its merge token only when the person
       # behind the run is a listed human (trusted-actors.json on main), matched
diff --git a/.github/workflows/pr-refine.yml b/.github/workflows/pr-refine.yml
index 12cda6243be..dad2f80b9fc 100644
--- a/.github/workflows/pr-refine.yml
+++ b/.github/workflows/pr-refine.yml
@@ -418,7 +418,6 @@ jobs:
       queue: max
     uses: ./.github/workflows/pr-run-activity-read.yml # zizmor: ignore[self-repository]
     with:
-      start-gate: true
       role: pr-unblock
       lane: pr-refine
       activity: fix-docs
@@ -634,7 +633,6 @@ jobs:
       queue: max
     uses: ./.github/workflows/pr-run-activity-read.yml # zizmor: ignore[self-repository]
     with:
-      start-gate: true
       role: pr-unblock
       lane: pr-refine
       activity: fix-docs
@@ -742,7 +740,6 @@ jobs:
       queue: max
     uses: ./.github/workflows/pr-run-activity-read.yml # zizmor: ignore[self-repository]
     with:
-      start-gate: true
       role: pr-unblock
       lane: pr-refine
       activity: fix-docs
diff --git a/.github/workflows/pr-run-activity-read.yml b/.github/workflows/pr-run-activity-read.yml
index 6ceeba32927..ad54772518d 100644
--- a/.github/workflows/pr-run-activity-read.yml
+++ b/.github/workflows/pr-run-activity-read.yml
@@ -84,7 +84,7 @@ on:
         default: ""
       start-gate:
         description: >-
-          `true` for a caller whose call starts new work (the issue lane, pr-refine):
+          `true` for a caller whose call starts new work (the issue lane):
           broker-check's kill-switch gate then also stops on a low
           GITHUB_TOKEN budget, on the first call in the slot only (fallback
           empty or `credit-stop`); a call that takes over a handed-off turn,
diff --git a/.github/workflows/pr-unblock-dispatch.yml b/.github/workflows/pr-unblock-dispatch.yml
index ddcaea0b937..1b8e53572ea 100644
--- a/.github/workflows/pr-unblock-dispatch.yml
+++ b/.github/workflows/pr-unblock-dispatch.yml
@@ -139,8 +139,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # Starts new work: also stop on a low GITHUB_TOKEN budget.
-          budget: "true"
 
       # Skips the run while Actions or npm installs report a degraded component,
       # with a logged reason; fails open (.github/actions/check-upstream-status).
@@ -155,10 +153,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::notice::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing dispatched"
+          echo "::notice::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); nothing dispatched"
 
       # A push or scheduled run on its first attempt was started by the event
       # itself. A hand run, or any re-run, is checked against the base list:
@@ -425,8 +421,6 @@ jobs:
         with:
           value: ${{ vars.CLAUDE_LANES_DISABLED }}
           repo-value: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
-          # Starts new work: also stop on a low GITHUB_TOKEN budget.
-          budget: "true"
 
       # refine-event-dispatch.mjs reads the base config's `limits` through the
       # base's resolve-config, which needs its dependencies.
diff --git a/.github/workflows/pr-verify.yml b/.github/workflows/pr-verify.yml
index 5f54cea3642..6719fcdd0f9 100644
--- a/.github/workflows/pr-verify.yml
+++ b/.github/workflows/pr-verify.yml
@@ -169,10 +169,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); no verdict until the lost-run reconciler re-runs it"
           exit 1
 
       # The resolver reads only, and skips on its own reads every run it
@@ -2248,10 +2246,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); no verdict until the lost-run reconciler re-runs it"
           exit 1
 
       # The resolver reads only, and skips on its own reads every run it
@@ -4182,10 +4178,8 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
         run: |
-          echo "::error::${WHY} this run (reason: ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no verdict until the lost-run reconciler re-runs it"
+          echo "::error::the lanes kill switch stops this run (reason: ${REASON:-unreadable}); no verdict until the lost-run reconciler re-runs it"
           exit 1
 
       # The resolver reads only, and skips on its own reads every run it
diff --git a/.github/workflows/work-resolve-issue.yml b/.github/workflows/work-resolve-issue.yml
index 0e02506ae70..aceac75b40e 100644
--- a/.github/workflows/work-resolve-issue.yml
+++ b/.github/workflows/work-resolve-issue.yml
@@ -703,7 +703,6 @@ jobs:
       id-token: write
     uses: ./.github/workflows/pr-run-activity-read.yml # zizmor: ignore[self-repository]
     with:
-      start-gate: true
       lane: work-resolve-issue
       role: issue-lane
       activity: resolve-issue
diff --git a/.github/workflows/work-unblock.yml b/.github/workflows/work-unblock.yml
index 9a505e26b1a..9c423f86eb5 100644
--- a/.github/workflows/work-unblock.yml
+++ b/.github/workflows/work-unblock.yml
@@ -510,9 +510,7 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
-        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); no level decided or published"
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); no level decided or published"
 
       - name: Resolve the config
         id: config
@@ -711,9 +709,7 @@ jobs:
         if: steps.kill.outputs.proceed != 'true'
         env:
           REASON: ${{ steps.kill.outputs.reason }}
-          CAUSE: ${{ steps.kill.outputs.cause }}
-          WHY: ${{ steps.kill.outputs.cause == 'budget' && format('the GITHUB_TOKEN budget is low until {0} (epoch seconds), which stops', steps.kill.outputs.reset) || 'the lanes kill switch stops' }}
-        run: echo "::notice::${WHY} this run (reason ${REASON:-unreadable}, cause ${CAUSE:-unreadable}); nothing read or written"
+        run: echo "::notice::the lanes kill switch stops this run (reason ${REASON:-unreadable}); nothing read or written"
 
       # The broker mints on a label event only for a listed human (the
       # trusted-actor list on main, by id), so anyone else stops here quietly,
diff --git a/docs/conventions/pr-pipeline/README.md b/docs/conventions/pr-pipeline/README.md
index b69a22e56d6..9a643ef674f 100644
--- a/docs/conventions/pr-pipeline/README.md
+++ b/docs/conventions/pr-pipeline/README.md
@@ -3741,7 +3741,7 @@ with its default.
 | `fix-docs-per-run` | 2 | fix-docs dispatches one pr-unblock-dispatch `refine` run sends for its PR's event; 0 to 20. Each event offers one PR, so 0 turns CI fix-docs off and any other value turns it on. |
 | `admission-factor` | 0.8 | Share of the lane's hourly merge rate admitted per hour for the queued cap ([WIP cap](#wip-cap)); greater than 0, at most 1. |
 | `admission-min-per-hour` | 1 | Admissions per hour the queued cap never falls below, so a day with no lane merges cannot hold admissions shut; 0 to 100, and 0 removes the floor. |
-| `api` | schema | GitHub API margins per pool (`github-token`, `lanes-app`, `graphql`, `owner-token`, `content-creation`). `limit-cap` sets the pool's planned budget: planned = min(header limit, `limit-cap`), used = header limit - header remaining, left = planned - used. `github-token` defaults it to GitHub's documented GITHUB_TOKEN limit, so a higher header limit is headroom, never a target; the other pools have no cap and plan to their header limit. `plan` and `read-floor` are shares of the planned budget; `writer-pause`, `breaker` and `stop-floor` are shares of the header's limit, by its remaining; `content-creation` adds `per-minute` and `per-hour`. Their defaults are in `.github/actions/log-api-budget/rate-limits.json`, the only copy, which every merge hold list floors, so a change to a default waits for a person. The rate guard (`.github/actions/log-api-budget/rate-guard.mjs`, `planOf`) reads `read-floor` and `limit-cap`, to warn once while calls continue, and stops on the header's remaining and GitHub's refusals: at a remaining of 0, or at or under `stop-floor` of the header's limit, it sends no further call to that pool before the header's reset, records the stop in the job's stop file, and holds the step under `API_BUDGET_HOLD`, else fails it; a response with no readable limit, remaining or future reset never stops on `stop-floor`; `pace` (github-token, default 0.2) is the share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick when the previous scheduled run, by run id, marked a clean pass of its work (its `Mark this tick's work done` step, which a held or red pass and a paced tick skip), so two scheduled ticks in a row are never both skipped and its cadence halves (`.github/actions/log-api-budget/pace.mjs`; the lost-run reconciler, pr-unblock-dispatch and work-unblock's sweep read it, and pr-merge's post-merge-dispatch reads it for the merge and enable-auto-merge sweep jobs, which skip at job level while the post-merge check and cover dispatch run on every tick), so the timer lanes slow down before the breaker stops every lane; `0` turns pacing off; `start-gate` (github-token, 0.1) is the share of the header's limit, by its remaining, under which a kill-switch gate that starts new work (`.github/actions/check-kill-switch`, `budget: "true"`) does not start its lane while the reset is still ahead (one GET /rate_limit per such gate, a stop with reason `kill-switch`, cause `budget` and the window's `reset`; a failed read proceeds); that gate reads it from rate-limits.json alone, and the schema rejects a `start-gate` set here; the others are thresholds meant for the hub's limits sampler, and nothing in this repository enforces them. resolve-config passes the block through as set. |
+| `api` | schema | GitHub API margins per pool (`github-token`, `lanes-app`, `graphql`, `owner-token`, `content-creation`). `limit-cap` sets the pool's planned budget: planned = min(header limit, `limit-cap`), used = header limit - header remaining, left = planned - used. `github-token` defaults it to GitHub's documented GITHUB_TOKEN limit, so a higher header limit is headroom, never a target; the other pools have no cap and plan to their header limit. `plan` and `read-floor` are shares of the planned budget; `writer-pause`, `breaker` and `stop-floor` are shares of the header's limit, by its remaining; `content-creation` adds `per-minute` and `per-hour`. Their defaults are in `.github/actions/log-api-budget/rate-limits.json`, the only copy, which every merge hold list floors, so a change to a default waits for a person. The rate guard (`.github/actions/log-api-budget/rate-guard.mjs`, `planOf`) reads `read-floor` and `limit-cap`, to warn once while calls continue, and stops on the header's remaining and GitHub's refusals: at a remaining of 0, or at or under `stop-floor` of the header's limit, it sends no further call to that pool before the header's reset, records the stop in the job's stop file, and holds the step under `API_BUDGET_HOLD`, else fails it; a response with no readable limit, remaining or future reset never stops on `stop-floor`; `pace` (github-token, default 0.2) is the share of the header's limit, projected left at the window's reset from the burn rate so far, under which a timer-driven lane skips a scheduled tick when the previous scheduled run, by run id, marked a clean pass of its work (its `Mark this tick's work done` step, which a held or red pass and a paced tick skip), so two scheduled ticks in a row are never both skipped and its cadence halves (`.github/actions/log-api-budget/pace.mjs`; the lost-run reconciler, pr-unblock-dispatch and work-unblock's sweep read it, and pr-merge's post-merge-dispatch reads it for the merge and enable-auto-merge sweep jobs, which skip at job level while the post-merge check and cover dispatch run on every tick), so the timer lanes slow down before the breaker stops every lane; `0` turns pacing off; `start-gate` (github-token, 0.1) is the share of the header's limit, by its remaining, under which a kill-switch gate that starts new work (`.github/actions/check-kill-switch`, `budget: "true"`) does not start its lane while the reset is still ahead (one GET /rate_limit per such gate, a stop with reason `kill-switch`, cause `budget` and the window's `reset`; a refused read, 403, 429, `retry-after` or a remaining of 0, also stops, and any other failed read proceeds); that gate reads it from rate-limits.json alone, and the schema rejects a `start-gate` set here; the others are thresholds meant for the hub's limits sampler, and nothing in this repository enforces them. resolve-config passes the block through as set. |
 | `lane-level` | 2, 4, 3, 2, `[lanes-app]`, `true`, `CLAUDE_LANE_LEVEL`, 150 | The adaptive lane level L (owner decision Q111): `floor`, `ceiling`, `default`, `clean-windows` and `pools` for `decide()` in `.github/scripts/lib/lane-level.mjs`, whose truth table is `lane-level.vectors.json` beside it. `shadow` (default `true`), `variable` (default `CLAUDE_LANE_LEVEL`, must end in `_LANE_LEVEL`) and `valid-minutes` (default 150, 60 to 1440) govern publish and read: work-unblock's hourly `publish-lane-level` job publishes L as `<level>@<valid-until>` in `variable`, and pick-slot and label-unblocked read it through `.github/scripts/lib/lane-level-value.mjs` (empty, expired or malformed reads as `default`, clamped to `floor` and `ceiling`). While `shadow` is set the job mints no token and writes nothing, `SLOTS` stays `default`, and both log the level they would use. Each window L steps up 1 after `clean-windows` windows in a row that each had demand (runs waiting, or every slot running) and no limit signal, when every pool in `pools` fits: peak used, as a share of the pool's planned budget, times (L+1)/L at most `api.<pool>.plan`. A window where a pool has `api.<pool>.writer-pause` of its header's limit left or less resets the streak. Any limit signal the lanes App's own calls meet (403, 429, a secondary-limit or GraphQL rate-limit error, `retry-after`) halves L, rounded down, to no less than `floor`, and blocks a step up until the reset it names. A breaker trip is not a signal: it mostly reflects GITHUB_TOKEN spend, which pacing controls, and the breaker stays the backstop. Missing readings or demand hold L and the streak; a missing or malformed previous level reads as `default`, and every level is clamped to `floor` and `ceiling`. A `floor` above the `ceiling`, as set or defaulted, is rejected. An `api` pool field left unset reads from `rate-limits.json`, as the rate guard reads it. `.github/scripts/lib/lane-level-replay.mjs` replays the rule over the hub's recorded history. |
 
 report-outcome and the work-unblock sweep read them from resolve-config's output;

From 49fe4e9ceb10e3077976564c8a6df24e2692ad17 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Wed, 11 Nov 2026 12:46:58 -0500
Subject: [PATCH 8/9] fix(pr-pipeline): keep each budget re-fire dated in the
 one budget record

Editing the single budget record moved its date to the latest edit, so the
backoff charged earlier budget re-adds as infrastructure re-fires. Each
edit now carries the dates of the edits before it, and the record reads as
one re-fire marker per date.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../scripts/work-unblock/label-unblocked.mjs  | 24 ++++++++++------
 .../work-unblock/label-unblocked.test.mjs     | 28 +++++++++++++++++++
 2 files changed, 44 insertions(+), 8 deletions(-)

diff --git a/.github/scripts/work-unblock/label-unblocked.mjs b/.github/scripts/work-unblock/label-unblocked.mjs
index f93c4d36183..388e8bf8d0f 100755
--- a/.github/scripts/work-unblock/label-unblocked.mjs
+++ b/.github/scripts/work-unblock/label-unblocked.mjs
@@ -385,6 +385,10 @@ const KILL_STEP = "Check the kill switch";
 const BUDGET_STEP = /^Stop on a low GITHUB_TOKEN budget(?: until (.*))?$/;
 // The second line of a breaker record whose stop was a budget stop.
 const BUDGET_TAG = "<!-- work-unblock cause=budget -->";
+// The budget record's last line: when each of its earlier edits was made, so
+// every budget re-fire keeps its date once the record is edited again.
+const BUDGET_EARLIER = /^<!-- work-unblock earlier ([^>]*) -->$/m;
+const budgetEarlier = (body) => (BUDGET_EARLIER.exec(String(body ?? ""))?.[1] ?? "").split(" ").filter(Boolean);
 // A raw job log line, its timestamp first, whose rest matches the pattern `rest`.
 const stamped = (rest) => new RegExp(String.raw`^\d{4}-\d\d-\d\dT[\d:.]+Z ` + rest);
 // request-lane-token's last line when the broker refuses it, in check mode
@@ -566,14 +570,16 @@ const parseMarker = (body) => {
 
 // The lanes App's outcome and re-fire markers on an issue, oldest first, each
 // with when it was posted (the backoff comment and the budget record, each
-// edited in place: last edited).
+// edited in place: last edited). The budget record is one marker per re-fire
+// it records, its earlier edits included.
 const appMarkers = (comments, bot) =>
   comments
     .filter((comment) => comment.user?.login === bot)
-    .map((comment) => {
+    .flatMap((comment) => {
       const marker = parseMarker(comment.body);
       const edited = marker?.budget || INFRA.test(String(comment.body ?? ""));
-      return { ...marker, at: Date.parse(edited ? (comment.updated_at ?? comment.created_at) : comment.created_at) };
+      const at = Date.parse(edited ? (comment.updated_at ?? comment.created_at) : comment.created_at);
+      return [...(marker?.budget ? budgetEarlier(comment.body) : []).map(Date.parse), at].map((when) => ({ ...marker, at: when }));
     })
     .filter((marker) => marker.outcome !== undefined && Number.isFinite(marker.at))
     .sort((a, b) => a.at - b.at);
@@ -1570,9 +1576,9 @@ const MINT_CAUSE = `The work-resolve-issue run that \`${LABEL}\` started could n
 // The record of a re-fire after a kill-switch refusal, posted before the
 // label moves, once per re-fire. It names the refused run and when it ended,
 // since the re-fire can come hours after the refusal.
-export const breakerComment = (key, { repo, run, ended, budget = false }) =>
+export const breakerComment = (key, { repo, run, ended, budget = false, earlier = [] }) =>
   budget
-    ? `<!-- work-unblock refired ${key} breaker -->\n${BUDGET_TAG}\nThis records a re-fire of an earlier stop, not a new one. The start gate stopped [run ${run}](https://github.com/${repo}/actions/runs/${run}), the work-resolve-issue run that \`${LABEL}\` started, before any model turn, because the GITHUB_TOKEN budget was under its start-gate share (limits.api github-token start-gate); that run ended at ${new Date(ended).toISOString().replace(/\.\d{3}Z$/, "Z")}. work-unblock has now removed and added \`${LABEL}\` back to start a fresh run. A budget stop is the lanes' load, not a fault in this issue: it never counts toward limits.limit-stops-per-issue or the \`kill-switch\` wait.`
+    ? `<!-- work-unblock refired ${key} breaker -->\n${BUDGET_TAG}\nThis records a re-fire of an earlier stop, not a new one. The start gate stopped [run ${run}](https://github.com/${repo}/actions/runs/${run}), the work-resolve-issue run that \`${LABEL}\` started, before any model turn, because the GITHUB_TOKEN budget was under its start-gate share (limits.api github-token start-gate); that run ended at ${new Date(ended).toISOString().replace(/\.\d{3}Z$/, "Z")}. work-unblock has now removed and added \`${LABEL}\` back to start a fresh run. A budget stop is the lanes' load, not a fault in this issue: it never counts toward limits.limit-stops-per-issue or the \`kill-switch\` wait.${earlier.length > 0 ? `\n<!-- work-unblock earlier ${earlier.join(" ")} -->` : ""}`
     : `<!-- work-unblock refired ${key} breaker -->\nThis records a re-fire of an earlier refusal, not a new refusal. The lanes kill switch stopped [run ${run}](https://github.com/${repo}/actions/runs/${run}), the work-resolve-issue run that \`${LABEL}\` started, before it finished; that run ended at ${new Date(ended).toISOString().replace(/\.\d{3}Z$/, "Z")}. work-unblock has now removed and added \`${LABEL}\` back to start a fresh run. A kill-switch refusal is no fault in this issue or the lanes, so it never counts against later re-fires; after limits.limit-stops-per-issue of them since a person last added \`${LABEL}\` or a run last reported, work-unblock waits the same limits.stranded-backoff-hours \`kill-switch\` hours after each refused run before re-firing it, never longer.`;
 
 // The backoff record of an issue whose re-fires on these workflow files keep
@@ -2272,11 +2278,13 @@ async function refireRefusal({ github, actions, jobLog, carry, repo, number, iss
     if (stalled === "mint-failed" && !recorded && fired >= limits["limit-stops-per-issue"]) {
       return backoff(key, ended, MINT_CAUSE, hoursFor["failed-mint"]);
     }
-    // An issue keeps one budget record, edited in place for each window.
+    // An issue keeps one budget record, edited in place for each window; the
+    // edit carries the dates of the ones before it.
     const budgetRecord = budget
-      ? comments.filter((comment) => comment.user?.login === bot && parseMarker(comment.body)?.budget && RUN_ID.test(String(comment.id))).at(-1)?.id
+      ? comments.filter((comment) => comment.user?.login === bot && parseMarker(comment.body)?.budget && RUN_ID.test(String(comment.id))).at(-1)
       : undefined;
-    const trip = stalled === "breaker" ? { run: refused.id, ended: Date.parse(refused.updated_at) || ended, budget, record: budgetRecord } : undefined;
+    const earlier = budgetRecord ? [...budgetEarlier(budgetRecord.body), budgetRecord.updated_at ?? budgetRecord.created_at] : [];
+    const trip = stalled === "breaker" ? { run: refused.id, ended: Date.parse(refused.updated_at) || ended, budget, record: budgetRecord?.id, earlier } : undefined;
     // Trips sort by when their run ended, not when they fell due, so the sweeps
     // after the switch clears drain them oldest first whatever their waits.
     return { reason: null, resets: trip ? ended : due, refire: key, recorded, stall: stalled, trip };
diff --git a/.github/scripts/work-unblock/label-unblocked.test.mjs b/.github/scripts/work-unblock/label-unblocked.test.mjs
index 445ada08730..f414799674c 100644
--- a/.github/scripts/work-unblock/label-unblocked.test.mjs
+++ b/.github/scripts/work-unblock/label-unblocked.test.mjs
@@ -3861,6 +3861,34 @@ test("a later budget stop edits the issue's one budget record in place, never po
   switched(switchAfter.calls);
 });
 
+// One re-fire of a failed run on these workflow files (06:00), then two budget
+// stops on the one budget record (re-added 07:00 and 10:00), then a failed run
+// ending at 10:05: the backoff counts one re-fire, so it waits 6 hours, not 12.
+test("an edited budget record keeps each budget re-fire its own, so none counts toward a later backoff", async () => {
+  const failedLater = [ADMITTED, pickSlot, BROKER_ALLOWED, { name: "resolve-issue / run", conclusion: "failure", steps: [{ name: "Request the lane token", conclusion: "success" }] }];
+  const unlabeled = (at) => ({ event: "unlabeled", label: { name: "agent-ready" }, actor: LANES_BOT, created_at: at });
+  const first = { id: 71, body: breakerComment(KEY, { repo: REPO, run: 4100, ended: Date.parse("2026-10-16T06:50:00Z"), budget: true }), user: LANES_BOT, created_at: "2026-10-16T07:00:00Z" };
+  const before = [added("2026-10-16T05:00:00Z", OWNER), unlabeled("2026-10-16T06:00:00Z"), added("2026-10-16T06:00:01Z"), unlabeled("2026-10-16T07:00:00Z"), added("2026-10-16T07:00:01Z")];
+  const second = stalledRun({ jobs: BUDGET_STOPPED, conclusion: "success", comments: [note(), refireNote(KEY, "2026-10-16T06:00:00Z"), first], events: [...before.slice(0, -1), added(LABELED_AT)] });
+  assert.equal(await sweep({ github: second.github, actions: second.actions }), 0);
+  const patch = writes(second.calls)[0];
+  assert.ok(patch.startsWith(`PATCH /repos/${REPO}/issues/comments/71 `), patch);
+  const edited = { ...first, body: JSON.parse(patch.slice(patch.indexOf(" {") + 1)).body, updated_at: "2026-10-16T09:59:59Z" };
+  const history = {
+    comments: [note(), refireNote(KEY, "2026-10-16T06:00:00Z"), edited],
+    events: [...before, unlabeled("2026-10-16T09:59:59Z"), added(LABELED_AT)],
+  };
+  const early = stalledRun({ jobs: failedLater, ...history });
+  assert.equal(await sweep({ github: early.github, actions: early.actions, now: Date.parse("2026-10-16T16:04:59Z") }), 0);
+  assert.deepEqual(writes(early.calls), [], "one re-fire waits 6 hours");
+  const due = stalledRun({ jobs: failedLater, ...history });
+  assert.equal(await sweep({ github: due.github, actions: due.actions, now: Date.parse("2026-10-16T16:05:00Z") }), 0);
+  const done = writes(due.calls);
+  assert.ok(done[0].startsWith(`POST /repos/${REPO}/issues/30/comments `), done.join("\n"));
+  assert.ok(done[0].includes("has re-fired it 2 time(s)"), done[0]);
+  assert.deepEqual(done.slice(1), restarted(30));
+});
+
 test("the budget record says it never counts toward the per-issue bound", () => {
   const body = breakerComment(KEY, { repo: REPO, run: 5030, ended: Date.parse("2026-10-16T10:05:00Z"), budget: true });
   assert.ok(body.startsWith(BUDGET_RECORD), body);

From 9336cb0cc66efb52e530598dc82bca383846c9ad Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Wed, 11 Nov 2026 14:55:21 -0500
Subject: [PATCH 9/9] test(pr-pipeline): classify main's admit and pick-slot
 gates, assert start-gate calls once

Main added check-kill-switch gates to work-resolve-issue.yml's admit and
pick-slot jobs. They pass no budget input, so they are switch gates; the
issue lane's budget is read at broker-check's first call, the one place
label-unblocked reads a budget stop from.

The read-runner start-gate test asserted only inside an if, which the
cant-fail scan rejects; it now collects each workflow's start-gate calls
and asserts the whole map once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q1HHi6JACp77x2ZbE7
---
 .../check-kill-switch/check-kill-switch.test.mjs       | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/actions/check-kill-switch/check-kill-switch.test.mjs b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
index 8fc7872dc7d..d99812b8aa3 100644
--- a/.github/actions/check-kill-switch/check-kill-switch.test.mjs
+++ b/.github/actions/check-kill-switch/check-kill-switch.test.mjs
@@ -354,6 +354,10 @@ const GATES = {
     "push-branches": "switch",
     publish: "switch",
   },
+  // The issue lane's budget is read at broker-check's first call (START_CALLS),
+  // the one place label-unblocked reads a budget stop from; admit and pick-slot
+  // check the switches only.
+  "work-resolve-issue.yml": { admit: "switch", "pick-slot": "switch" },
   "work-unblock.yml": { "label-unblocked": "start", "publish-lane-level": "switch", "sync-status": "switch" },
 };
 
@@ -369,21 +373,21 @@ const START_CALLS = {
 };
 
 test("only the issue lane's first-call read-runner calls pass start-gate", () => {
+  const passing = {};
   for (const file of readdirSync(WORKFLOWS).filter((name) => name.endsWith(".yml"))) {
     const lines = readFileSync(path.join(WORKFLOWS, file), "utf8").split("\n");
     const starting = [];
-    let calls = 0;
     let job = null;
     lines.forEach((line, i) => {
       const id = /^ {2}([a-z][a-z0-9-]*):$/.exec(line);
       if (id) job = id[1];
       if (!/^ {4}uses: \.\/\.github\/workflows\/pr-run-activity-read\.yml\b/.test(line)) return;
-      calls += 1;
       const next = lines.findIndex((other, j) => j > i && /^ {2}[a-z]/.test(other));
       if (/^ {6}start-gate: true$/m.test(lines.slice(i, next < 0 ? undefined : next).join("\n"))) starting.push(job);
     });
-    if (calls) assert.deepEqual(starting, START_CALLS[file] ?? [], file);
+    if (starting.length) passing[file] = starting;
   }
+  assert.deepEqual(passing, START_CALLS);
 });
 
 // Each gate step in a workflow: its job and the step's text.