diff --git a/.changes/pr-pipeline/perf-ci-status-wait-rate-limit-reset-7c3e41d2.md b/.changes/pr-pipeline/perf-ci-status-wait-rate-limit-reset-7c3e41d2.md
new file mode 100644
index 0000000000..98590ccb16
--- /dev/null
+++ b/.changes/pr-pipeline/perf-ci-status-wait-rate-limit-reset-7c3e41d2.md
@@ -0,0 +1,5 @@
+---
+bump: none
+---
+
+No release needed (ci): ci-status waits for a GitHub API rate-limit reset instead of failing closed at once
diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index e2083c3ad2..d2a28b5061 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -3117,6 +3117,15 @@ jobs:
     # opened, plus the base-config checkout's fetch (seconds; its retries
     # replace the contents reads' 15 s each).
     timeout-minutes: 11
+    env:
+      # gh_read's wait budget: a rate-limit wait must end by
+      # GH_READ_JOB_SECONDS (timeout-minutes in seconds) less
+      # GH_READ_MARGIN_SECONDS after the first step starts. The margin keeps
+      # five minutes for the job's setup and the steps after the wait:
+      # aggregate-results' 60 s rate-limit wait, 45 s of own-gate retries, 7 s
+      # of status writes and the 90 s rerun wait, plus retry sleeps.
+      GH_READ_JOB_SECONDS: 660
+      GH_READ_MARGIN_SECONDS: 300
     permissions:
       # `yield-to-full-run` lists this workflow's runs on the head SHA, and
       # `rerun-contract-only-siblings` re-runs the red contract-only ones once
@@ -3134,6 +3143,92 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
+      # A RATE-LIMITED READ WAITS FOR THE RESET. The fail-closed steps below
+      # read through gh_read, which runs `gh api` and, when that fails on a
+      # rate limit, waits once and reads again. Without -i, gh drops the failed
+      # response's headers, and GET /rate_limit does not report the
+      # GITHUB_TOKEN's installation limit (it read core 'remaining > 0' while
+      # every read failed on it), so the wait comes from the x-ratelimit-* and
+      # retry-after headers of one probe request to the same resource (core,
+      # or graphql for a graphql call): retry-after seconds when sent, else
+      # five seconds past x-ratelimit-reset while remaining is 0, one second
+      # when the probe shows the limit has cleared, else 60 s. It is a rate
+      # limit when gh's error names one, or is an HTTP 403 or 429 while the
+      # probe reads remaining 0 or retry-after. The job's timeout is not raised
+      # for it: a wait is taken only when it ends inside the budget the job
+      # env sets, so the steps after it still fit. A wait past that fails the
+      # read at once, red and never neutral (a neutral required check counts
+      # as passing), with an error naming the reset and asking for a re-run
+      # after it; later reads of that resource before the reset fail without
+      # a call. Nothing here re-runs the job: the next review lane's
+      # rerun-ci-status, or a person, re-runs it after the reset. Any other
+      # failure, or a second rate limit after the wait, returns gh's status at
+      # once, so each caller's own retries and fail-closed exit stay as they
+      # were. The cost-hold step keeps plain `gh api`: an unreadable input
+      # keeps its hold, and a wait there would act on reads made before it.
+      # Every other `gh api` in this job is a write or marked gh-read-exempt.
+      # This step writes the function for the others to source. Pinned by
+      # scripts/ci-gh-read.test.sh, which runs this body.
+      - name: Write the rate-limit-aware read helper
+        run: |
+          gh_read() {
+            local resource=core until=0 deadline arg err out now limit remaining reset after wait at waited=
+            for arg; do [ "$arg" != graphql ] || resource=graphql; done
+            local blocked="$RUNNER_TEMP/gh-read.until-$resource"
+            deadline=$(cat "$RUNNER_TEMP/gh-read.deadline")
+            [ ! -s "$blocked" ] || until=$(cat "$blocked")
+            [ "$until" -le "$(date +%s)" ] || return 1
+            err=$(mktemp)
+            while :; do
+              if out=$(gh api "$@" 2>"$err"); then
+                cat "$err" >&2
+                rm -f "$err"
+                [ -z "$out" ] || printf '%s\n' "$out"
+                return 0
+              fi
+              cat "$err" >&2
+              wait=
+              if [ -z "$waited" ] && grep -qiE 'rate limit|HTTP (403|429)' "$err"; then
+                now=$(date +%s)
+                if [ "$resource" = graphql ]; then
+                  limit=$(gh api -i graphql -f query='{rateLimit{remaining}}' 2>/dev/null) || true
+                else
+                  limit=$(gh api -i "repos/$GITHUB_REPOSITORY" 2>/dev/null) || true
+                fi
+                limit=$(tr -d '\r' <<<"$limit" | sed '/^$/q' | awk -F': *' '{ h[tolower($1)] = $2 }
+                  END { print h["x-ratelimit-remaining"] " " h["x-ratelimit-reset"] " " h["retry-after"] }')
+                read -r remaining reset after <<<"$limit"
+                if [[ $after =~ ^[0-9]{1,5}$ ]]; then
+                  wait=$((10#$after)) reset=$((now + 10#$after))
+                elif [ "$remaining" = 0 ] && [[ $reset =~ ^[0-9]{1,10}$ ]]; then
+                  wait=$((reset - now + 5))
+                  [ "$wait" -ge 5 ] || wait=5
+                elif grep -qi 'secondary rate limit' "$err" || { grep -qi 'rate limit' "$err" && [[ ! $remaining =~ ^[0-9]+$ ]]; }; then
+                  wait=60 reset=$((now + 60))
+                elif grep -qi 'rate limit' "$err"; then
+                  wait=1 reset=$((now + 1))
+                fi
+              fi
+              if [ -z "$wait" ]; then
+                rm -f "$err"
+                return 1
+              fi
+              if [ $((now + wait)) -gt "$deadline" ]; then
+                at=$(jq -rn --argjson t "$reset" '$t | todate')
+                echo "::error::GitHub's $resource API rate limit blocks 'gh api $*' until $at, past the $(jq -rn --argjson t "$deadline" '$t | todate') ci-status can wait to inside its timeout; a re-run after $at is needed." >&9
+                echo "$reset" >"$blocked"
+                rm -f "$err"
+                return 1
+              fi
+              echo "::notice::'gh api $*' is rate limited ($resource); waiting ${wait}s for the reset, then reading again." >&9
+              sleep "$wait"
+              waited=1
+            done
+          }
+          echo $(($(date +%s) + GH_READ_JOB_SECONDS - GH_READ_MARGIN_SECONDS)) >"$RUNNER_TEMP/gh-read.deadline"
+          # fd 9 is each sourcing step's stderr, so the notices reach the log
+          # when a caller captures or redirects gh_read's own stderr.
+          { echo 'exec 9>&2'; declare -f gh_read; } >"$RUNNER_TEMP/gh-read.sh"
       - name: Check the pull-request contract
         uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c # v0.58.0
         with:
@@ -3162,10 +3257,11 @@ jobs:
           PR_BODY: ${{ github.event.pull_request.body }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
+          . "$RUNNER_TEMP/gh-read.sh"
           BROKER_PATHS='.github/actions/resolve-config/package.json
           .github/actions/resolve-config/package-lock.json'
           for attempt in 1 2 3; do
-            if pages=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100" --paginate); then
+            if pages=$(gh_read "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100" --paginate); then
               break
             fi
             [ "$attempt" -lt 3 ] || { echo "::error::could not read the files of #$PR_NUMBER; re-run this run."; exit 1; }
@@ -3334,6 +3430,7 @@ jobs:
           read_api() {
             local attempt out
             for attempt in 1 2 3; do
+              # gh-read-exempt: an unreadable input keeps the hold, and a wait would act on stale reads.
               if out=$(gh api "$@" 2>"$RUNNER_TEMP/cost-hold.err"); then
                 printf '%s\n' "$out"
                 return 0
@@ -3495,6 +3592,7 @@ jobs:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           BASE_CONFIG: ${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}
         run: |
+          . "$RUNNER_TEMP/gh-read.sh"
           if [[ ! $BASE_SHA =~ ^[0-9a-f]{40}$ ]]; then
             echo "::error::the base commit '$BASE_SHA' is not a commit SHA."
             exit 1
@@ -3515,7 +3613,7 @@ jobs:
           fi
           echo "label=$human_gated" >>"$GITHUB_OUTPUT"
           for attempt in 1 2 3; do
-            if labels=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/labels?per_page=100" --paginate --jq '.[].name'); then
+            if labels=$(gh_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/labels?per_page=100" --paginate --jq '.[].name'); then
               break
             fi
             [ "$attempt" -lt 3 ] || { echo "::error::could not read the labels of #$PR_NUMBER; re-run this run."; exit 1; }
@@ -3526,6 +3624,7 @@ jobs:
             echo "#$PR_NUMBER carries no '$human_gated' label."
             exit 0
           fi
+          # gh-read-exempt: the reason is best effort; the step fails either way.
           reason=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments?per_page=100" --paginate \
             --jq '.[] | select(.user.type == "Bot" and (.body | test("(^|\n)<!-- claude-lane-hold lane="))
               and (.user.login == "claude[bot]" or (.user.login == "github-actions[bot]"
@@ -3566,13 +3665,14 @@ jobs:
           HUMAN_GATED: ${{ steps.human_gated.outputs.label }}
           BASE_CONFIG: ${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}
         run: |
+          . "$RUNNER_TEMP/gh-read.sh"
           if [[ ! $BASE_SHA =~ ^[0-9a-f]{40}$ ]]; then
             echo "::error::the base commit '$BASE_SHA' is not a commit SHA."
             exit 1
           fi
           # shellcheck disable=SC2016 # the $ in the --jq filter is a regex anchor
           for attempt in 1 2 3; do
-            if held_at=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments?per_page=100" --paginate \
+            if held_at=$(gh_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments?per_page=100" --paginate \
               --jq '.[] | select(.user.type == "Bot" and (.body | test("(^|\n)<!-- claude-lane-hold lane="))
                 and (.user.login == "claude[bot]" or (.user.login == "github-actions[bot]"
                   and ([.body | splits("\r?\n") | gsub("^\\s+|\\s+$"; "") | select(. != "")] | last // ""
@@ -3584,7 +3684,7 @@ jobs:
             sleep $((attempt * 5))
           done
           for attempt in 1 2 3; do
-            if events=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/events?per_page=100" --paginate); then
+            if events=$(gh_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/events?per_page=100" --paginate); then
               break
             fi
             [ "$attempt" -lt 3 ] || { echo "::error::could not read the events of #$PR_NUMBER; re-run this run."; exit 1; }
@@ -3656,6 +3756,7 @@ jobs:
           AUTHOR_ID: ${{ github.event.pull_request.user.id }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
+          . "$RUNNER_TEMP/gh-read.sh"
           # dependabot[bot], melodic-plugin-release[bot] and
           # melodic-standards-sync[bot], as
           # .github/standards/trusted-actors/trusted-actors.json lists them.
@@ -3669,7 +3770,7 @@ jobs:
           read_api() {
             local attempt body
             for attempt in 1 2 3; do
-              if body=$(gh api "$2"); then
+              if body=$(gh_read "$2"); then
                 printf '%s\n' "$body"
                 return 0
               fi
@@ -3691,7 +3792,7 @@ jobs:
               files=$(jq -r '.[] | [.filename, (.previous_filename // "")] | @tsv' "$RUNNER_TEMP/pr-files.json")
             else
               for attempt in 1 2 3; do
-                if files=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100" --paginate --jq '.[] | [.filename, (.previous_filename // "")] | @tsv'); then
+                if files=$(gh_read "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100" --paginate --jq '.[] | [.filename, (.previous_filename // "")] | @tsv'); then
                   break
                 fi
                 [ "$attempt" -lt 3 ] || { echo "::error::could not read the files of #$PR_NUMBER; re-run this run."; exit 1; }
@@ -3785,6 +3886,7 @@ jobs:
           BASE_SHA: ${{ github.event.merge_group.base_sha }}
           BASE_CONFIG: ${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}
         run: |
+          . "$RUNNER_TEMP/gh-read.sh"
           pr=$(sed -nE 's#^(refs/heads/)?gh-readonly-queue/.+/pr-([0-9]+)-[0-9a-f]{40}$#\2#p' <<<"$GITHUB_REF")
           if [ -z "$pr" ]; then
             echo "::error::cannot read a pull request number from the merge-group ref '$GITHUB_REF'."
@@ -3809,7 +3911,7 @@ jobs:
             }
           fi
           for attempt in 1 2 3; do
-            if labels=$(gh api "repos/$GITHUB_REPOSITORY/issues/$pr/labels?per_page=100" --paginate --jq '.[].name'); then
+            if labels=$(gh_read "repos/$GITHUB_REPOSITORY/issues/$pr/labels?per_page=100" --paginate --jq '.[].name'); then
               break
             fi
             [ "$attempt" -lt 3 ] || { echo "::error::could not read the labels of #$pr; re-run this run."; exit 1; }
@@ -3877,6 +3979,7 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
         run: |
+          . "$RUNNER_TEMP/gh-read.sh"
           lanes_app_id=337595936
           pr=$PR_NUMBER
           if [ "$GITHUB_EVENT_NAME" = merge_group ]; then
@@ -3893,7 +3996,7 @@ jobs:
           read_api() {
             local attempt body
             for attempt in 1 2 3; do
-              if body=$(gh api "${@:2}"); then
+              if body=$(gh_read "${@:2}"); then
                 printf '%s\n' "$body"
                 return 0
               fi
diff --git a/scripts/ci-broker-pin.test.sh b/scripts/ci-broker-pin.test.sh
index 05b9d277c3..2436a90051 100755
--- a/scripts/ci-broker-pin.test.sh
+++ b/scripts/ci-broker-pin.test.sh
@@ -23,6 +23,11 @@ WORKFLOW="$ROOT/.github/workflows/pr-require-checks.yml"
 TMP_ROOT="$(mktemp -d)"
 trap 'rm -rf "$TMP_ROOT"' EXIT
 
+# shellcheck source=lib/ci-gh-read.sh
+. "$ROOT/scripts/lib/ci-gh-read.sh"
+export RUNNER_TEMP="$TMP_ROOT"
+ci_gh_read::install "$WORKFLOW" "$TMP_ROOT" || fail "the ci-status gh_read helper step is missing or fails"
+
 NAME='Require a broker deploy PR for a resolve-config dependency change'
 step="$(awk -v name="      - name: $NAME" '$0 == name { on = 1; print; next }
   on && /^      - / { exit }
diff --git a/scripts/ci-gh-read.test.sh b/scripts/ci-gh-read.test.sh
new file mode 100755
index 0000000000..de66cb3d3b
--- /dev/null
+++ b/scripts/ci-gh-read.test.sh
@@ -0,0 +1,248 @@
+#!/usr/bin/env bash
+# Runs the `Write the rate-limit-aware read helper` step body of
+# .github/workflows/pr-require-checks.yml's ci-status, then calls the gh_read
+# function it writes, under bash -e, against stub `gh`, `sleep` and `date`.
+#
+# gh_read runs `gh api`. On a rate limit it waits once and reads again, taking
+# the wait from the headers of one `gh api -i` probe to the same resource:
+# retry-after seconds, else five seconds past x-ratelimit-reset while
+# remaining is 0, one second when the probe shows the limit cleared, else
+# 60 s. A wait that would end past the deadline the step sets (the job's
+# timeout less a margin, from when the step runs) fails the read at once
+# naming the reset and blocks that resource until it. Any other failure
+# returns at once.
+# test-scope: .github/workflows/pr-require-checks.yml
+# shellcheck disable=SC2016 # the step snippets are literal
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WORKFLOW="$ROOT/.github/workflows/pr-require-checks.yml"
+
+# shellcheck source=lib/test-harness.sh
+. "$ROOT/scripts/lib/test-harness.sh"
+# shellcheck source=lib/ci-gh-read.sh
+. "$ROOT/scripts/lib/ci-gh-read.sh"
+
+TMP_ROOT="$(mktemp -d)"
+trap 'rm -rf "$TMP_ROOT"' EXIT
+
+if ! ci_gh_read::install "$WORKFLOW" "$TMP_ROOT"; then
+  fail "no working 'Write the rate-limit-aware read helper' step, or no GH_READ_* env, in $WORKFLOW"
+  test_harness::report
+  exit 1
+fi
+
+job="$(awk '/^  ci-status:$/ { on = 1 } on && /^  [a-z-]+:$/ && !/ci-status/ { exit } on { print }' "$WORKFLOW")"
+timeout="$(sed -nE 's/^    timeout-minutes: ([0-9]+)$/\1/p' <<<"$job")"
+job_seconds="$(sed -nE 's/^      GH_READ_JOB_SECONDS: ([0-9]+)$/\1/p' <<<"$job")"
+margin="$(sed -nE 's/^      GH_READ_MARGIN_SECONDS: ([0-9]+)$/\1/p' <<<"$job")"
+if [[ -n "$timeout" && "$job_seconds" == $((timeout * 60)) ]]; then
+  ok "GH_READ_JOB_SECONDS ($job_seconds) is ci-status's timeout-minutes ($timeout) in seconds"
+else
+  fail "GH_READ_JOB_SECONDS '$job_seconds' is not ci-status's timeout-minutes '$timeout' in seconds"
+fi
+if [[ -n "$margin" && "$margin" -ge 240 && "$margin" -lt "${job_seconds:-0}" ]]; then
+  ok "the ${margin}s margin leaves room for aggregate-results' 202 s of waits and the setup"
+else
+  fail "the margin '$margin' does not leave room for the steps after a wait"
+fi
+want=$(($(date +%s) + job_seconds - margin))
+got="$(cat "$TMP_ROOT/gh-read.deadline")"
+if [[ "$got" -ge $((want - 5)) && "$got" -le "$want" ]]; then
+  ok "the step sets the deadline at its start plus the timeout less the margin"
+else
+  fail "the step set the deadline '$got', want about '$want'"
+fi
+if [[ "$job" != *"rate-limit-wait-seconds:"* ]]; then
+  ok "the pinned composites keep their own rate-limit-wait-seconds default"
+else
+  fail "ci-status passes rate-limit-wait-seconds to a composite, which the unchanged timeout does not hold"
+fi
+first="$(grep -m1 '^      - name: ' <<<"$job")"
+if [[ "$first" == "      - name: Write the rate-limit-aware read helper" ]]; then
+  ok "the helper is ci-status's first step, so no failure before it skips it"
+else
+  fail "ci-status's first step is '$first', not the helper"
+fi
+# Every step that reads through gh_read sources it first.
+while IFS= read -r name; do
+  body="$(awk -v name="      - name: $name" '$0 == name { on = 1; next } on && /^      - / { exit } on { print }' <<<"$job")"
+  if [[ "$body" == *$'        run: |\n          . "$RUNNER_TEMP/gh-read.sh"\n'* ]]; then
+    ok "'$name' sources gh_read before its reads"
+  else
+    fail "'$name' calls gh_read without sourcing it first"
+  fi
+done < <(awk '/^      - name: / { name = substr($0, 15) } /gh_read [-"]/ && name != "Write the rate-limit-aware read helper" { print name }' <<<"$job" | sort -u)
+# Every other `gh api` in the job is a write, or marked gh-read-exempt on the
+# line above, so a new fail-closed read cannot skip the wait unnoticed.
+stray="$(awk '/^      - name: / { helper = ($0 == "      - name: Write the rate-limit-aware read helper") }
+  !helper && /gh api / && $0 !~ /^ *#/ && $0 !~ /gh api -X (POST|DELETE|PATCH|PUT) / && prev !~ /# gh-read-exempt: / { print }
+  { prev = $0 }' <<<"$job")"
+if [[ -z "$stray" ]]; then
+  ok "every other gh api in ci-status is a write or marked gh-read-exempt"
+else
+  fail "ci-status reads through plain gh api without a gh-read-exempt mark: $stray"
+fi
+
+# The stub logs its arguments. A `gh api -i` probe (graphql, or any other path
+# for core) prints a response whose x-ratelimit-remaining, x-ratelimit-reset
+# and optional retry-after come from STUB_LIMIT_<resource> ("<remaining>
+# <reset> [<retry-after>]"), and fails with no output when that is unset. Any
+# other call takes the next line of STUB_SCRIPT: `ok <stdout>`, or
+# `fail <stderr>`.
+mkdir -p "$TMP_ROOT/bin"
+cat >"$TMP_ROOT/bin/gh" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >>"$STUB_LOG"
+if [[ "$2" == -i ]]; then
+  [[ "$3" == graphql ]] && v=${STUB_LIMIT_graphql:-} || v=${STUB_LIMIT_core:-}
+  [[ -n "$v" ]] || exit 1
+  read -r remaining reset after <<<"$v"
+  printf 'HTTP/2.0 403 Forbidden\r\nX-Ratelimit-Remaining: %s\r\nX-Ratelimit-Reset: %s\r\n' "$remaining" "$reset"
+  [[ -z "$after" ]] || printf 'Retry-After: %s\r\n' "$after"
+  printf '\r\n{"message":"x"}\n'
+  [[ "$remaining" != 0 && -z "$after" ]] || exit 1
+  exit 0
+fi
+n=$(grep -vc '^api -i ' "$STUB_LOG")
+line=$(sed -n "${n}p" <<<"$STUB_SCRIPT")
+case $line in
+ok\ *) printf '%s\n' "${line#ok }" ;;
+fail\ *) printf '%s\n' "${line#fail }" >&2; exit 1 ;;
+*) echo "unscripted call $n" >&2; exit 1 ;;
+esac
+EOF
+cat >"$TMP_ROOT/bin/sleep" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >>"$STUB_SLEEPS"
+EOF
+cat >"$TMP_ROOT/bin/date" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$STUB_NOW"
+EOF
+chmod +x "$TMP_ROOT/bin/gh" "$TMP_ROOT/bin/sleep" "$TMP_ROOT/bin/date"
+
+LIMITED='fail gh: API rate limit exceeded for installation. (HTTP 403)'
+NOW=1792800000
+
+# run <commands>: sources gh-read.sh, then runs <commands>, in one bash -e
+# step. The blocks and deadline stay from earlier runs until fresh.
+run() {
+  : >"$TMP_ROOT/log"
+  : >"$TMP_ROOT/sleeps"
+  out="$(PATH="$TMP_ROOT/bin:$PATH" RUNNER_TEMP="$TMP_ROOT" GITHUB_REPOSITORY=o/r STUB_LOG="$TMP_ROOT/log" STUB_SLEEPS="$TMP_ROOT/sleeps" \
+    STUB_NOW="${STUB_NOW:-$NOW}" bash -ec ". \"\$RUNNER_TEMP/gh-read.sh\"; $1" 2>&1)" && rc=0 || rc=$?
+  calls=$(grep -vc '^api -i ' "$TMP_ROOT/log")
+  sleeps=$(paste -sd' ' "$TMP_ROOT/sleeps")
+}
+fresh() { ci_gh_read::reset "$TMP_ROOT" $((NOW + 600)); }
+# check <label> <want-rc> <want-calls> <want-sleeps> [want-out] [refuse-out]
+check() {
+  if [[ "$rc" -ne "$2" ]]; then
+    fail "$1: expected rc=$2 got rc=$rc out='$out'"
+  elif [[ "$calls" -ne "$3" ]]; then
+    fail "$1: expected $3 read(s) got $calls: '$(cat "$TMP_ROOT/log")'"
+  elif [[ "$sleeps" != "$4" ]]; then
+    fail "$1: expected sleeps '$4' got '$sleeps'"
+  elif [[ -n "${5:-}" && "$out" != *"$5"* ]]; then
+    fail "$1: output lacks '$5': '$out'"
+  elif [[ -n "${6:-}" && "$out" == *"$6"* ]]; then
+    fail "$1: output has '$6': '$out'"
+  else
+    ok "$1"
+  fi
+}
+
+fresh
+STUB_SCRIPT='ok hello' run 'x=$(gh_read repos/o/r/pulls/1); echo "got $x"'
+check "a read that succeeds prints its output once" 0 1 "" "got hello"
+if [[ "$(cat "$TMP_ROOT/log")" == "api repos/o/r/pulls/1" ]]; then
+  ok "gh_read passes its arguments to gh api unchanged and sends no probe"
+else
+  fail "gh_read called '$(cat "$TMP_ROOT/log")'"
+fi
+
+fresh
+STUB_LIMIT_core="0 $((NOW + 30))" STUB_SCRIPT="$LIMITED
+ok after" run 'x=$(gh_read repos/o/r/pulls/1); echo "got $x"'
+check "a primary rate limit waits until five seconds past the reset and reads again" 0 2 "35" "got after" "got API"
+if [[ "$out" == *"::notice::'gh api repos/o/r/pulls/1' is rate limited (core); waiting 35s for the reset, then reading again."* ]]; then
+  ok "the wait is announced on the step's stderr even inside a capture"
+else
+  fail "the wait notice is missing: '$out'"
+fi
+
+if grep -qxF 'api -i repos/o/r' "$TMP_ROOT/log"; then
+  ok "a core read probes the repository with -i for the limit's headers"
+else
+  fail "a core read probed '$(grep '^api -i' "$TMP_ROOT/log")'"
+fi
+
+fresh
+STUB_LIMIT_core="0 $((NOW + 30)) 7" STUB_SCRIPT="$LIMITED
+ok after" run 'gh_read repos/o/r/pulls/1 >/dev/null'
+check "a retry-after header sets the wait" 0 2 "7"
+
+fresh
+STUB_LIMIT_graphql="0 $((NOW + 50))" STUB_LIMIT_core="4999 $((NOW + 9))" STUB_SCRIPT='fail gh: GraphQL: API rate limit already exceeded for installation ID 1.
+ok {}' run 'gh_read graphql -f query=x >/dev/null'
+check "a graphql read waits for the graphql reset, not the core one" 0 2 "55"
+
+fresh
+STUB_LIMIT_core="4999 $((NOW + 9))" STUB_SCRIPT='fail gh: You have exceeded a secondary rate limit. (HTTP 403)
+ok fine' run 'gh_read repos/o/r/pulls/1 >/dev/null'
+check "a secondary rate limit waits 60 s" 0 2 "60"
+
+fresh
+STUB_SCRIPT="$LIMITED
+ok fine" run 'gh_read repos/o/r/pulls/1 >/dev/null'
+check "a rate limit whose reset is unreadable waits 60 s" 0 2 "60"
+
+fresh
+STUB_LIMIT_core="4999 $((NOW + 3000))" STUB_SCRIPT="$LIMITED
+ok fine" run 'gh_read repos/o/r/pulls/1 >/dev/null'
+check "a primary limit whose window has already reset reads again after a second" 0 2 "1"
+
+fresh
+STUB_LIMIT_core="0 $((NOW + 30))" STUB_SCRIPT='fail gh: Forbidden (HTTP 403)
+ok fine' run 'gh_read repos/o/r/pulls/1 >/dev/null'
+check "a 403 while the core limit is at 0 is a rate limit" 0 2 "35"
+
+fresh
+STUB_LIMIT_core="0 $((NOW + 30))" STUB_SCRIPT="$LIMITED
+$LIMITED
+ok never" run 'gh_read repos/o/r/pulls/1 || echo "rc=$?"'
+check "a second rate limit after the wait fails the read without another wait" 0 2 "35" "rc=1"
+
+fresh
+STUB_LIMIT_core="0 $((NOW + 3000))" STUB_SCRIPT="$LIMITED" run 'gh_read repos/o/r/pulls/1 || echo "rc=$?"'
+check "a reset past the deadline fails the read at once" 0 1 "" \
+  "::error::GitHub's core API rate limit blocks 'gh api repos/o/r/pulls/1' until 2026-10-24T00:50:00Z, past the 2026-10-24T00:10:00Z ci-status can wait to inside its timeout; a re-run after 2026-10-24T00:50:00Z is needed."
+STUB_SCRIPT='ok never' run 'gh_read repos/o/r/pulls/2 || echo "rc=$?"'
+check "a later read of that resource, in a later step, before its reset fails without a call" 0 0 "" "rc=1" "::error::"
+STUB_SCRIPT='ok graphql' run 'gh_read graphql -f query=x'
+check "a block on core does not stop a graphql read" 0 1 "" "graphql"
+STUB_NOW=$((NOW + 3000)) STUB_SCRIPT='ok again' run 'gh_read repos/o/r/pulls/2'
+check "a read after that reset is sent" 0 1 "" "again"
+
+fresh
+STUB_LIMIT_core="0 $((NOW + 400))" STUB_SCRIPT="$LIMITED
+ok one" run 'gh_read repos/o/r/pulls/1 >/dev/null'
+check "a 405 s wait inside the deadline is taken" 0 2 "405"
+STUB_NOW=$((NOW + 560)) STUB_LIMIT_core="4999 $((NOW + 3600))" STUB_SCRIPT='fail gh: You have exceeded a secondary rate limit. (HTTP 403)' \
+  run 'gh_read repos/o/r/pulls/2 || echo "rc=$?"'
+check "a later step's wait that would end past the deadline is not taken" 0 1 "" "past the 2026-10-24T00:10:00Z ci-status can wait to"
+
+fresh
+STUB_SCRIPT='fail gh: Not Found (HTTP 404)' run 'gh_read repos/o/r/contents/x 2>"$RUNNER_TEMP/err" || echo "rc=$?"; grep -c "HTTP 404" "$RUNNER_TEMP/err"'
+check "any other error returns at once, its text on the caller's stderr" 0 1 "" $'rc=1\n1'
+if grep -q '^api -i ' "$TMP_ROOT/log"; then
+  fail "a 404 sent a rate-limit probe"
+else
+  ok "a 404 sends no rate-limit probe"
+fi
+fresh
+STUB_LIMIT_core="4999 $((NOW + 30))" STUB_SCRIPT='fail gh: Resource not accessible by integration (HTTP 403)' run 'gh_read repos/o/r/pulls/1 || echo "rc=$?"'
+check "a 403 that is not a rate limit returns at once" 0 1 "" "rc=1" "::error::"
+
+test_harness::report
diff --git a/scripts/ci-hold-human-gated.test.sh b/scripts/ci-hold-human-gated.test.sh
index ab5fb02f23..327886b1fa 100755
--- a/scripts/ci-hold-human-gated.test.sh
+++ b/scripts/ci-hold-human-gated.test.sh
@@ -21,6 +21,11 @@ WORKFLOW="$ROOT/.github/workflows/pr-require-checks.yml"
 TMP_ROOT="$(mktemp -d)"
 trap 'rm -rf "$TMP_ROOT"' EXIT
 
+# shellcheck source=lib/ci-gh-read.sh
+. "$ROOT/scripts/lib/ci-gh-read.sh"
+export RUNNER_TEMP="$TMP_ROOT"
+ci_gh_read::install "$WORKFLOW" "$TMP_ROOT" || fail "the ci-status gh_read helper step is missing or fails"
+
 NAME='Fail a pull request carrying the human-gated label'
 step="$(awk -v name="      - name: $NAME" '$0 == name { on = 1; print; next }
   on && /^      - / { exit }
@@ -103,7 +108,7 @@ cat >"$TMP_ROOT/bin/gh" <<'EOF'
 printf '%s\n' "$*" >>"$STUB_LOG"
 case "$*" in
 */labels*)
-  [[ "$(grep -c '/labels' "$STUB_LOG")" -gt "${STUB_FAILS:-0}" ]] || exit 1
+  [[ "$(grep -c '/labels' "$STUB_LOG")" -gt "${STUB_FAILS:-0}" ]] || { printf '%s\n' "${STUB_FAIL_TEXT:-}" >&2; exit 1; }
   [[ -z "$STUB_LABELS" ]] || tr ',' '\n' <<<"$STUB_LABELS"
   ;;
 */comments*)
@@ -111,11 +116,25 @@ case "$*" in
   while [[ $# -gt 0 && "$1" != --jq ]]; do shift; done
   jq -r "$2" <<<"${STUB_COMMENTS:-[]}"
   ;;
+'api -i '*)
+  [[ -n "${STUB_RATE_LIMIT:-}" ]] || exit 1
+  read -r remaining reset <<<"$STUB_RATE_LIMIT"
+  printf 'HTTP/2.0 403 Forbidden\r\nX-Ratelimit-Remaining: %s\r\nX-Ratelimit-Reset: %s\r\n\r\n{}\n' "$remaining" "$reset"
+  [[ "$remaining" != 0 ]] || exit 1
+  ;;
 *) exit 1 ;;
 esac
 EOF
-printf '#!/usr/bin/env bash\n' >"$TMP_ROOT/bin/sleep"
-chmod +x "$TMP_ROOT/bin/gh" "$TMP_ROOT/bin/sleep"
+# sleep logs its seconds; date +%s answers STUB_NOW.
+cat >"$TMP_ROOT/bin/sleep" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >>"$STUB_SLEEPS"
+EOF
+cat >"$TMP_ROOT/bin/date" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$STUB_NOW"
+EOF
+chmod +x "$TMP_ROOT/bin/gh" "$TMP_ROOT/bin/sleep" "$TMP_ROOT/bin/date"
 
 BASE=89abcdef0123456789abcdef0123456789abcdef
 CUSTOM='{"config":{"role_labels":{"human-gated":"owner-call"}}}'
@@ -133,13 +152,15 @@ OTHER_BOT="$(hold "$LANE" $'A comment with no hold marker.\nclaude-lane: claude-
 expect() {
   local label="$1" want_rc="$2" want_calls="$3" out rc calls
   : >"$TMP_ROOT/log"
+  : >"$TMP_ROOT/sleeps"
+  ci_gh_read::reset "$TMP_ROOT" 1792800600
   : >"$TMP_ROOT/output"
   rm -rf "$TMP_ROOT/base-config"
   mkdir -p "$TMP_ROOT/base-config"
   [[ -z "${STUB_TRACKER+set}" ]] || printf '%s\n' "$STUB_TRACKER" >"$TMP_ROOT/base-config/.work-item-tracker.json"
   local config="$TMP_ROOT/base-config"
   [[ -z "${STUB_CHECKOUT_FAILED:-}" ]] || config=
-  out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" STUB_LABELS="$4" STUB_FAILS="$5" PR_NUMBER=6419 \
+  out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" STUB_SLEEPS="$TMP_ROOT/sleeps" STUB_NOW=1792800000 STUB_LABELS="$4" STUB_FAILS="$5" PR_NUMBER=6419 \
     GITHUB_REPOSITORY=o/r RUNNER_TEMP="$TMP_ROOT" GITHUB_OUTPUT="$TMP_ROOT/output" BASE_SHA="${BASE_SHA-$BASE}" \
     BASE_CONFIG="$config" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
   calls=$(grep -c '/labels' "$TMP_ROOT/log")
@@ -195,6 +216,35 @@ expect "an unreadable comment list still fails, without a reason" 1 1 "needs-hum
 unset STUB_COMMENTS STUB_COMMENTS_FAIL
 
 expect "a transient label read failure is retried" 1 2 "needs-human" 1
+
+# A rate-limited read waits until five seconds past the reset and reads again;
+# a reset past the deadline fails closed naming it; any other error keeps
+# the caller's retries and is never waited on.
+sleeps() { paste -sd' ' "$TMP_ROOT/sleeps"; }
+export STUB_FAIL_TEXT='gh: API rate limit exceeded for installation. (HTTP 403)' STUB_RATE_LIMIT='0 1792800120'
+expect "a rate-limited label read recovers after the reset" 0 2 "enhancement" 1 \
+  "is rate limited (core); waiting 125s for the reset, then reading again."
+if [[ "$(sleeps)" == 125 ]]; then
+  ok "the rate-limited read slept until five seconds past the reset"
+else
+  fail "the rate-limited read slept '$(sleeps)', not 125"
+fi
+export STUB_RATE_LIMIT='0 1792803000'
+expect "a reset past the deadline fails closed naming the reset" 1 1 "enhancement" 3 \
+  "::error::GitHub's core API rate limit blocks 'gh api repos/o/r/issues/6419/labels?per_page=100 --paginate --jq .[].name' until 2026-10-24T00:50:00Z, past the 2026-10-24T00:10:00Z ci-status can wait to inside its timeout; a re-run after 2026-10-24T00:50:00Z is needed."
+if [[ "$(sleeps)" == "5 10" ]]; then
+  ok "a reset past the deadline is not waited for, and the retries make no call"
+else
+  fail "a reset past the deadline slept '$(sleeps)', not the caller's '5 10'"
+fi
+export STUB_FAIL_TEXT='gh: Resource not accessible by integration (HTTP 403)' STUB_RATE_LIMIT='4999 1792800120'
+expect "a 403 that is not a rate limit fails closed without a wait" 1 3 "" 3 "::error::could not read the labels of #6419" "rate limited"
+if [[ "$(sleeps)" == "5 10" ]]; then
+  ok "a 403 that is not a rate limit keeps the caller's retries only"
+else
+  fail "a 403 that is not a rate limit slept '$(sleeps)'"
+fi
+unset STUB_FAIL_TEXT STUB_RATE_LIMIT
 expect "an unreadable label list fails closed" 1 3 "" 3 "::error::could not read the labels of #6419"
 if grep -q '^held=' "$TMP_ROOT/output"; then
   fail "an unreadable label list output held"
diff --git a/scripts/ci-hold-lifted-by.test.sh b/scripts/ci-hold-lifted-by.test.sh
index 5e877d5299..9527089d6c 100755
--- a/scripts/ci-hold-lifted-by.test.sh
+++ b/scripts/ci-hold-lifted-by.test.sh
@@ -19,6 +19,11 @@ WORKFLOW="$ROOT/.github/workflows/pr-require-checks.yml"
 TMP_ROOT="$(mktemp -d)"
 trap 'rm -rf "$TMP_ROOT"' EXIT
 
+# shellcheck source=lib/ci-gh-read.sh
+. "$ROOT/scripts/lib/ci-gh-read.sh"
+export RUNNER_TEMP="$TMP_ROOT"
+ci_gh_read::install "$WORKFLOW" "$TMP_ROOT" || fail "the ci-status gh_read helper step is missing or fails"
+
 NAME='Fail a review-lane hold an untrusted account lifted'
 step="$(awk -v name="      - name: $NAME" '$0 == name { on = 1; print; next }
   on && /^      - / { exit }
diff --git a/scripts/ci-hold-merge-group.test.sh b/scripts/ci-hold-merge-group.test.sh
index 5a57c6a0e1..88d7973036 100755
--- a/scripts/ci-hold-merge-group.test.sh
+++ b/scripts/ci-hold-merge-group.test.sh
@@ -19,6 +19,11 @@ WORKFLOW="$ROOT/.github/workflows/pr-require-checks.yml"
 TMP_ROOT="$(mktemp -d)"
 trap 'rm -rf "$TMP_ROOT"' EXIT
 
+# shellcheck source=lib/ci-gh-read.sh
+. "$ROOT/scripts/lib/ci-gh-read.sh"
+export RUNNER_TEMP="$TMP_ROOT"
+ci_gh_read::install "$WORKFLOW" "$TMP_ROOT" || fail "the ci-status gh_read helper step is missing or fails"
+
 NAME='Fail a queued pull request carrying a hold label'
 step="$(awk -v name="      - name: $NAME" '$0 == name { on = 1; print; next }
   on && /^      - / { exit }
diff --git a/scripts/ci-lanes-pr-hold.test.sh b/scripts/ci-lanes-pr-hold.test.sh
index 1e4f5f467b..b164ce0be0 100755
--- a/scripts/ci-lanes-pr-hold.test.sh
+++ b/scripts/ci-lanes-pr-hold.test.sh
@@ -23,6 +23,11 @@ MODULE="$ROOT/.github/scripts/pr-merge/merge-holds.mjs"
 TMP_ROOT="$(mktemp -d)"
 trap 'rm -rf "$TMP_ROOT"' EXIT
 
+# shellcheck source=lib/ci-gh-read.sh
+. "$ROOT/scripts/lib/ci-gh-read.sh"
+export RUNNER_TEMP="$TMP_ROOT"
+ci_gh_read::install "$WORKFLOW" "$TMP_ROOT" || fail "the ci-status gh_read helper step is missing or fails"
+
 NAME='Fail a lanes App pull request its body or a member holds'
 step="$(awk -v name="      - name: $NAME" '$0 == name { on = 1; print; next }
   on && /^      - / { exit }
diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh
index 1a1bc4dffe..2779a4b704 100755
--- a/scripts/ci-review-lanes.test.sh
+++ b/scripts/ci-review-lanes.test.sh
@@ -21,6 +21,11 @@ WORKFLOW="$ROOT/.github/workflows/pr-require-checks.yml"
 TMP_ROOT="$(mktemp -d)"
 trap 'rm -rf "$TMP_ROOT"' EXIT
 
+# shellcheck source=lib/ci-gh-read.sh
+. "$ROOT/scripts/lib/ci-gh-read.sh"
+export RUNNER_TEMP="$TMP_ROOT"
+ci_gh_read::install "$WORKFLOW" "$TMP_ROOT" || fail "the ci-status gh_read helper step is missing or fails"
+
 NAME='Require both review lanes on this head'
 step="$(awk -v name="      - name: $NAME" '$0 == name { on = 1; print; next }
   on && /^      - / { exit }
diff --git a/scripts/lib/ci-gh-read.sh b/scripts/lib/ci-gh-read.sh
new file mode 100644
index 0000000000..03ad83dde6
--- /dev/null
+++ b/scripts/lib/ci-gh-read.sh
@@ -0,0 +1,36 @@
+# shellcheck shell=bash
+# Writes ci-status's gh_read helper for the step-body tests. Sourced, never
+# executed.
+#
+#   ci_gh_read::install <workflow> <dir>
+#
+# Runs the `Write the rate-limit-aware read helper` step body of <workflow>
+# with RUNNER_TEMP=<dir> and the job's GH_READ_* env values, which leaves
+# <dir>/gh-read.sh for the step bodies under test to source. Returns non-zero
+# when the step is missing or fails.
+#
+#   ci_gh_read::reset <dir> <deadline>
+#
+# Clears the per-resource blocks an earlier case left in <dir> and sets the
+# wait deadline to the epoch second <deadline>, so a case runs on a stub clock.
+ci_gh_read::install() {
+  local workflow="$1" dir="$2"
+  awk '$0 == "      - name: Write the rate-limit-aware read helper" { on = 1; next }
+    on && /^      - / { exit }
+    on && /^        run: \|$/ { body = 1; next }
+    body && /^          / { print substr($0, 11); next }
+    body && /^[[:blank:]]*$/ { print ""; next }
+    body { exit }' "$workflow" >"$dir/gh-read-step.sh"
+  [[ -s "$dir/gh-read-step.sh" ]] || return 1
+  local job_seconds margin
+  job_seconds=$(sed -nE 's/^      GH_READ_JOB_SECONDS: ([0-9]+)$/\1/p' "$workflow")
+  margin=$(sed -nE 's/^      GH_READ_MARGIN_SECONDS: ([0-9]+)$/\1/p' "$workflow")
+  [[ -n "$job_seconds" && -n "$margin" ]] || return 1
+  RUNNER_TEMP="$dir" GH_READ_JOB_SECONDS="$job_seconds" GH_READ_MARGIN_SECONDS="$margin" \
+    bash -e "$dir/gh-read-step.sh" && [[ -s "$dir/gh-read.sh" ]]
+}
+
+ci_gh_read::reset() {
+  rm -f "$1"/gh-read.until-*
+  echo "$2" >"$1/gh-read.deadline"
+}