diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index 097fa65b3e..e2083c3ad2 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -3109,11 +3109,13 @@ jobs:
     # (`rate-limit-wait-seconds` on check-contract and aggregate-results), 45 s
     # of own-gate retries, 7 s of status-write retries and the 90 s
     # `rerun-wait-seconds` wait, about four and a half minutes, plus up to
-    # 15 s of retry sleeps for each of the hold-lift step's three reads, the
+    # 15 s of retry sleeps for each of the hold-lift step's two reads, the
     # review-lane step's four and the lanes-hold step's eight, about four
-    # minutes, plus the cost-hold step's reads: three for most pull requests,
+    # minutes, plus the cost-hold step's reads: one for most pull requests,
     # which stop at the label events; for a lane-labeled one whose body cites a
-    # decision, about ten, and two more per review run since the window opened.
+    # decision, about eight, and two more per review run since the window
+    # opened, plus the base-config checkout's fetch (seconds; its retries
+    # replace the contents reads' 15 s each).
     timeout-minutes: 11
     permissions:
       # `yield-to-full-run` lists this workflow's runs on the head SHA, and
@@ -3163,12 +3165,15 @@ jobs:
           BROKER_PATHS='.github/actions/resolve-config/package.json
           .github/actions/resolve-config/package-lock.json'
           for attempt in 1 2 3; do
-            if files=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100" --paginate --jq '.[] | .filename, (.previous_filename // empty)'); then
+            if pages=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100" --paginate); then
               break
             fi
             [ "$attempt" -lt 3 ] || { echo "::error::could not read the files of #$PR_NUMBER; re-run this run."; exit 1; }
             sleep $((attempt * 5))
           done
+          files=$(jq -r '.[] | .filename, (.previous_filename // empty)' <<<"$pages")
+          # The review-lane step reads the same list from here instead of again.
+          printf '%s\n' "$pages" >"$RUNNER_TEMP/pr-files.json"
           touched=
           for path in $BROKER_PATHS; do
             if grep -qxF "$path" <<<"$files"; then touched="$touched $path"; fi
@@ -3252,6 +3257,32 @@ jobs:
           msg="draft: lanes not run; the ready_for_review run lints and tests this SHA"
           echo "::notice::$msg"
           echo "$msg" >>"$GITHUB_STEP_SUMMARY"
+      # THE HOLD STEPS READ THEIR CONFIG FROM THE BASE COMMIT, ONCE. The tracker
+      # config names the human-gated label and the trusted-actor list names who
+      # may lift a hold; both are read at the base so the pull request cannot
+      # rewrite its own hold. A sparse checkout of the two files at the base SHA
+      # is a git fetch, not a REST request: as of actions/checkout v7.0.1 its
+      # API calls (default branch, object format, the stale-merge tracepoint, the
+      # no-git archive download) all return early for a 40-hex `ref` on a runner
+      # with git; recheck on a checkout bump. It checks out no pull request
+      # code: the ref is the base commit, nothing here is executed, and no
+      # credential is persisted.
+      # The steps below read BASE_CONFIG: empty when this step did not succeed,
+      # which each of them treats as an unreadable config; a file missing from
+      # a checkout that succeeded is a file the base commit does not have.
+      - name: Check out the base commit's hold config
+        id: base_config
+        if: ${{ !cancelled() && (github.event_name == 'pull_request' || github.event_name == 'merge_group') }}
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
+          path: base-config
+          persist-credentials: false
+          sparse-checkout: |
+            /.work-item-tracker.json
+            /.github/standards/trusted-actors/trusted-actors.json
+          sparse-checkout-cone-mode: false
       # A COST HOLD THE OWNER ALREADY DECIDED COMES OFF. A review lane re-holds
       # every new head, so its `cost` hold went back on after the owner had
       # recorded the cost decision. This step clears a hold only when all
@@ -3294,6 +3325,7 @@ jobs:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           LANES_APP_ID: ${{ vars.AUTOMATION_LANES_APP_SENDER_ID }}
+          BASE_CONFIG: ${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}
         run: |
           keep() {
             echo "The cost hold stays for a person: $1."
@@ -3314,15 +3346,18 @@ jobs:
           [[ $BASE_SHA =~ ^[0-9a-f]{40}$ && $HEAD_SHA =~ ^[0-9a-f]{40}$ && $PR_NUMBER =~ ^[1-9][0-9]*$ ]] || keep "the event names no commit or pull request"
           [[ $LANES_APP_ID =~ ^[1-9][0-9]*$ ]] || keep "AUTOMATION_LANES_APP_SENDER_ID is not set"
           repo=$GITHUB_REPOSITORY
-          tracker=$(read_api -H 'Accept: application/vnd.github.raw+json' "repos/$repo/contents/.work-item-tracker.json?ref=$BASE_SHA") && rc=0 || rc=$?
-          [ "$rc" -ne 1 ] || keep "the tracker config is unreadable"
+          [ -d "$BASE_CONFIG" ] || keep "the tracker config is unreadable"
+          tracker=
+          if [ -e "$BASE_CONFIG/.work-item-tracker.json" ]; then
+            tracker=$(cat "$BASE_CONFIG/.work-item-tracker.json") || keep "the tracker config is unreadable"
+          fi
           label=needs-human
-          if [ "$rc" -eq 0 ] && [ -n "$tracker" ]; then
+          if [ -n "$tracker" ]; then
             label=$(jq -er '[objects | .config | objects | .role_labels | objects
               | .["human-gated"] | strings | gsub("^\\s+|\\s+$"; "")][0] // ""
               | if . == "" then "needs-human" else . end' <<<"$tracker") || keep "the tracker config is invalid"
           fi
-          actors=$(read_api -H 'Accept: application/vnd.github.raw+json' "repos/$repo/contents/.github/standards/trusted-actors/trusted-actors.json?ref=$BASE_SHA") || keep "the trusted-actor list is unreadable"
+          actors=$(cat "$BASE_CONFIG/.github/standards/trusted-actors/trusted-actors.json") || keep "the trusted-actor list is unreadable"
           humans=$(jq -ec '[.actors[] | select(.kind == "human") | .id | numbers] | select(length > 0)' <<<"$actors") || keep "the trusted-actor list names no person"
           events=$(read_api "repos/$repo/issues/$PR_NUMBER/events?per_page=100" --paginate) || keep "the events are unreadable"
           # The window opens at the newest removal by a trusted person.
@@ -3458,21 +3493,17 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          BASE_CONFIG: ${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}
         run: |
           if [[ ! $BASE_SHA =~ ^[0-9a-f]{40}$ ]]; then
             echo "::error::the base commit '$BASE_SHA' is not a commit SHA."
             exit 1
           fi
-          for attempt in 1 2 3; do
-            if tracker=$(gh api -H 'Accept: application/vnd.github.raw+json' "repos/$GITHUB_REPOSITORY/contents/.work-item-tracker.json?ref=$BASE_SHA" 2>"$RUNNER_TEMP/tracker.err"); then
-              break
-            elif grep -q 'HTTP 404' "$RUNNER_TEMP/tracker.err"; then
-              tracker=
-              break
-            fi
-            [ "$attempt" -lt 3 ] || { echo "::error::could not read .work-item-tracker.json at $BASE_SHA; re-run this run."; exit 1; }
-            sleep $((attempt * 5))
-          done
+          tracker=
+          if [ ! -d "$BASE_CONFIG" ] || { [ -e "$BASE_CONFIG/.work-item-tracker.json" ] && ! tracker=$(cat "$BASE_CONFIG/.work-item-tracker.json"); }; then
+            echo "::error::could not read .work-item-tracker.json at $BASE_SHA; re-run this run."
+            exit 1
+          fi
           human_gated=needs-human
           if [ -n "$tracker" ]; then
             human_gated=$(jq -er '[objects | .config | objects | .role_labels | objects
@@ -3533,6 +3564,7 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HUMAN_GATED: ${{ steps.human_gated.outputs.label }}
+          BASE_CONFIG: ${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}
         run: |
           if [[ ! $BASE_SHA =~ ^[0-9a-f]{40}$ ]]; then
             echo "::error::the base commit '$BASE_SHA' is not a commit SHA."
@@ -3568,13 +3600,10 @@ jobs:
             echo "No review lane has held #$PR_NUMBER."
             exit 0
           fi
-          for attempt in 1 2 3; do
-            if actors=$(gh api -H 'Accept: application/vnd.github.raw+json' "repos/$GITHUB_REPOSITORY/contents/.github/standards/trusted-actors/trusted-actors.json?ref=$BASE_SHA"); then
-              break
-            fi
-            [ "$attempt" -lt 3 ] || { echo "::error::could not read the trusted-actor list at $BASE_SHA; re-run this run."; exit 1; }
-            sleep $((attempt * 5))
-          done
+          if [ ! -d "$BASE_CONFIG" ] || ! actors=$(cat "$BASE_CONFIG/.github/standards/trusted-actors/trusted-actors.json"); then
+            echo "::error::could not read the trusted-actor list at $BASE_SHA; re-run this run."
+            exit 1
+          fi
           humans=$(jq -er '[.actors[] | select(.kind == "human") | .id | numbers | tostring] | select(length > 0) | join(" ")' <<<"$actors") || {
             echo "::error::the trusted-actor list at $BASE_SHA names no person."
             exit 1
@@ -3656,13 +3685,19 @@ jobs:
               exit 1
             fi
             pr=$(read_api "#$PR_NUMBER" "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER") || exit 1
-            for attempt in 1 2 3; do
-              if files=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100" --paginate --jq '.[] | [.filename, (.previous_filename // "")] | @tsv'); then
-                break
-              fi
-              [ "$attempt" -lt 3 ] || { echo "::error::could not read the files of #$PR_NUMBER; re-run this run."; exit 1; }
-              sleep $((attempt * 5))
-            done
+            # The broker step above leaves the file list it read; read it again
+            # only when that step could not.
+            if [ -s "$RUNNER_TEMP/pr-files.json" ]; then
+              files=$(jq -r '.[] | [.filename, (.previous_filename // "")] | @tsv' "$RUNNER_TEMP/pr-files.json")
+            else
+              for attempt in 1 2 3; do
+                if files=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100" --paginate --jq '.[] | [.filename, (.previous_filename // "")] | @tsv'); then
+                  break
+                fi
+                [ "$attempt" -lt 3 ] || { echo "::error::could not read the files of #$PR_NUMBER; re-run this run."; exit 1; }
+                sleep $((attempt * 5))
+              done
+            fi
             if [ "$(grep -c . <<<"$files")" -lt "$(jq '.changed_files // 0' <<<"$pr")" ]; then
               echo "::error::GitHub listed fewer files than #$PR_NUMBER changes, so its hold-paths cannot be checked; a person merges it."
               exit 1
@@ -3748,6 +3783,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           BASE_SHA: ${{ github.event.merge_group.base_sha }}
+          BASE_CONFIG: ${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}
         run: |
           pr=$(sed -nE 's#^(refs/heads/)?gh-readonly-queue/.+/pr-([0-9]+)-[0-9a-f]{40}$#\2#p' <<<"$GITHUB_REF")
           if [ -z "$pr" ]; then
@@ -3758,16 +3794,11 @@ jobs:
             echo "::error::the base commit '$BASE_SHA' is not a commit SHA."
             exit 1
           fi
-          for attempt in 1 2 3; do
-            if tracker=$(gh api -H 'Accept: application/vnd.github.raw+json' "repos/$GITHUB_REPOSITORY/contents/.work-item-tracker.json?ref=$BASE_SHA" 2>"$RUNNER_TEMP/tracker.err"); then
-              break
-            elif grep -q 'HTTP 404' "$RUNNER_TEMP/tracker.err"; then
-              tracker=
-              break
-            fi
-            [ "$attempt" -lt 3 ] || { echo "::error::could not read .work-item-tracker.json at $BASE_SHA; re-run this run."; exit 1; }
-            sleep $((attempt * 5))
-          done
+          tracker=
+          if [ ! -d "$BASE_CONFIG" ] || { [ -e "$BASE_CONFIG/.work-item-tracker.json" ] && ! tracker=$(cat "$BASE_CONFIG/.work-item-tracker.json"); }; then
+            echo "::error::could not read .work-item-tracker.json at $BASE_SHA; re-run this run."
+            exit 1
+          fi
           human_gated=needs-human
           if [ -n "$tracker" ]; then
             human_gated=$(jq -er '[objects | .config | objects | .role_labels | objects
diff --git a/scripts/ci-broker-pin.test.sh b/scripts/ci-broker-pin.test.sh
index daa9829a10..05b9d277c3 100755
--- a/scripts/ci-broker-pin.test.sh
+++ b/scripts/ci-broker-pin.test.sh
@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # Runs the `Require a broker deploy PR for a resolve-config dependency change` step body of
 # .github/workflows/pr-require-checks.yml's ci-status under the shell Actions
-# gives a step with no `shell:` (bash -e), against a stub `gh` that applies the
-# step's own --jq filter to a pull-request files fixture.
+# gives a step with no `shell:` (bash -e), against a stub `gh` that prints a
+# pull-request files fixture. The step leaves the pages it read under
+# RUNNER_TEMP for the review-lane step.
 #
 # The lanes token broker in melodic-software/azure-iac loads resolve-config's
 # modules from main's tip but imports ajv and yaml from its own deployment, and
@@ -55,20 +56,15 @@ else
   fail "step is not inside ci-status before the aggregate (lines: $order)"
 fi
 
-# The stub logs its arguments, fails the first STUB_FAILS calls, then applies
-# the --jq argument to STUB_JSON, as gh does to each page.
+# The stub logs its arguments, fails the first STUB_FAILS calls, then prints
+# STUB_JSON, one page.
 mkdir -p "$TMP_ROOT/bin"
 cat >"$TMP_ROOT/bin/gh" <<'EOF'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >>"$STUB_LOG"
 calls=$(wc -l <"$STUB_LOG")
 [[ "$calls" -gt "${STUB_FAILS:-0}" ]] || exit 1
-filter=
-while [[ $# -gt 0 ]]; do
-  [[ "$1" == --jq ]] && { filter="$2"; shift; }
-  shift
-done
-jq -r "$filter" <<<"$STUB_JSON"
+printf '%s\n' "$STUB_JSON"
 EOF
 printf '#!/usr/bin/env bash\n' >"$TMP_ROOT/bin/sleep"
 chmod +x "$TMP_ROOT/bin/gh" "$TMP_ROOT/bin/sleep"
@@ -87,15 +83,20 @@ files() {
 expect() {
   local label="$1" want_rc="$2" want_calls="$3" out rc calls
   : >"$TMP_ROOT/log"
+  rm -f "$TMP_ROOT/pr-files.json"
   out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" STUB_JSON="$4" PR_BODY="$5" STUB_FAILS="$6" \
-    PR_NUMBER=8313 GITHUB_REPOSITORY=o/r bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
+    PR_NUMBER=8313 GITHUB_REPOSITORY=o/r RUNNER_TEMP="$TMP_ROOT" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
   calls=$(wc -l <"$TMP_ROOT/log")
   if [[ "$rc" -ne "$want_rc" ]]; then
     fail "$label: expected rc=$want_rc got rc=$rc out='$out'"
   elif [[ "$calls" -ne "$want_calls" ]]; then
     fail "$label: expected $want_calls gh call(s) got $calls"
-  elif [[ "$want_calls" -gt 0 && "$(sort -u "$TMP_ROOT/log")" != "api repos/o/r/pulls/8313/files?per_page=100 --paginate --jq "* ]]; then
+  elif [[ "$want_calls" -gt 0 && "$(sort -u "$TMP_ROOT/log")" != "api repos/o/r/pulls/8313/files?per_page=100 --paginate" ]]; then
     fail "$label: unexpected gh call '$(sort -u "$TMP_ROOT/log")'"
+  elif [[ "$want_calls" -gt "$6" ]] && ! jq -se --argjson want "$(jq -sc . <<<"$4")" '. == $want' "$TMP_ROOT/pr-files.json" >/dev/null 2>&1; then
+    fail "$label: the pages read were not left for the review-lane step: '$(cat "$TMP_ROOT/pr-files.json" 2>&1)'"
+  elif [[ "$want_calls" -le "$6" && -e "$TMP_ROOT/pr-files.json" ]]; then
+    fail "$label: an unread file list left a pr-files.json"
   elif [[ -n "${7:-}" && "$out" != *"$7"* ]]; then
     fail "$label: output lacks '$7': '$out'"
   else
@@ -117,6 +118,8 @@ expect "files the broker does not load need no line" 0 1 \
 expect "a same-named file elsewhere needs no line" 0 1 "$(files "package.json" "$RC/sub/package.json" "$RC/package.json.orig")" "" 0
 expect "a rename away from a dependency path fails" 1 1 \
   "[{\"filename\":\"$RC/old/package.json\",\"previous_filename\":\"$RC/package.json\",\"status\":\"renamed\"}]" "" 0 "$RC/package.json"
+expect "a dependency path on the second page fails" 1 1 "$(files README.md)$(files "$RC/package.json")" "" 0 "$RC/package.json"
+expect "a dependency path on the second page passes with the line" 0 1 "$(files README.md)$(files "$RC/package.json")" "$LINE" 0
 expect "a CRLF body line counts" 0 1 "$(files "$RC/package.json")" $'Closes #1\r\n'"$LINE"$'\r\n## Summary\r' 0
 expect "trailing blanks after the number count" 0 1 "$(files "$RC/package.json")" "$LINE  " 0
 expect "the line inside other text does not count" 1 1 "$(files "$RC/package.json")" "see $LINE" 0
diff --git a/scripts/ci-hold-cost-decision.test.sh b/scripts/ci-hold-cost-decision.test.sh
index 57f3effc32..87a2882f2f 100755
--- a/scripts/ci-hold-cost-decision.test.sh
+++ b/scripts/ci-hold-cost-decision.test.sh
@@ -49,7 +49,8 @@ else
   fail "step lost its cost_hold id"
 fi
 # shellcheck disable=SC2016 # the ${{ }} text is workflow source, not shell
-for env in 'BASE_SHA: ${{ github.event.pull_request.base.sha }}' 'HEAD_SHA: ${{ github.event.pull_request.head.sha }}'; do
+for env in 'BASE_SHA: ${{ github.event.pull_request.base.sha }}' 'HEAD_SHA: ${{ github.event.pull_request.head.sha }}' \
+  "BASE_CONFIG: \${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}"; do
   if [[ "$step" == *"$env"* ]]; then ok "step env carries $env"; else fail "step env lacks $env"; fi
 done
 order="$(grep -nE "^  ci-status:$|^      - name: ($NAME|Fail a pull request carrying the human-gated label|Fail a review-lane hold an untrusted account lifted)$" "$WORKFLOW" | cut -d: -f1 | paste -sd' ')"
@@ -67,7 +68,10 @@ else
 fi
 
 # The stub logs its arguments and answers from STUB_* variables; a read whose
-# name is in STUB_FAIL fails. Runs, jobs and annotations come from JSON maps
+# name is in STUB_FAIL fails. The base commit's config is a fixture directory:
+# STUB_TRACKER (absent when unset) and STUB_ACTORS; a `tracker` failure leaves
+# BASE_CONFIG empty, as a failed checkout does, and an `actors` failure leaves
+# the trusted-actor list out of it. Runs, jobs and annotations come from JSON maps
 # keyed by workflow file, run id and check-run id.
 mkdir -p "$TMP_ROOT/bin"
 cat >"$TMP_ROOT/bin/gh" <<'EOF'
@@ -78,12 +82,6 @@ from() { jq -ce --arg k "$2" '.[$k] // error' <<<"$1" || { echo 'gh: Not Found (
 # The path segment after /<1>/ in the api path argument.
 key() { local a; for a in "${@:2}"; do [[ "$a" == */"$1"/* ]] && { a="${a##*/"$1"/}"; printf '%s' "${a%%[/?]*}"; return; }; done; }
 case "$*" in
-*/contents/.work-item-tracker.json*)
-  failing tracker
-  [[ -n "${STUB_TRACKER+set}" ]] || { echo 'gh: Not Found (HTTP 404)' >&2; exit 1; }
-  printf '%s\n' "$STUB_TRACKER"
-  ;;
-*/contents/.github/standards/trusted-actors/*) failing actors; printf '%s\n' "$STUB_ACTORS" ;;
 *'-X DELETE'*/labels/*) failing delete ;;
 */issues/6419/labels*) failing labels; [[ -z "$STUB_LABELS" ]] || tr ',' '\n' <<<"$STUB_LABELS" ;;
 */issues/6419/events*) failing events; printf '%s\n' "$STUB_EVENTS" ;;
@@ -165,18 +163,25 @@ lifted() {
 
 # expect <label> <want-cleared: yes|no> <want-delete: yes|no> <want-post: yes|no> [want-out]
 expect() {
-  local label="$1" out rc cleared deleted posted
+  local label="$1" out rc cleared deleted posted config="$TMP_ROOT/base-config"
   : >"$TMP_ROOT/log"
   : >"$TMP_ROOT/output"
+  rm -rf "$config"
+  mkdir -p "$config/.github/standards/trusted-actors"
+  [[ -z "${STUB_TRACKER+set}" ]] || printf '%s\n' "$STUB_TRACKER" >"$config/.work-item-tracker.json"
+  [[ " $STUB_FAIL " == *" actors "* ]] || printf '%s\n' "$STUB_ACTORS" >"$config/.github/standards/trusted-actors/trusted-actors.json"
+  [[ " $STUB_FAIL " != *" tracker "* ]] || config=
   out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" PR_NUMBER=6419 GITHUB_REPOSITORY=o/r \
     RUNNER_TEMP="$TMP_ROOT" GITHUB_OUTPUT="$TMP_ROOT/output" BASE_SHA="$BASE" HEAD_SHA="$HEAD" \
-    bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
+    BASE_CONFIG="$config" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
   cleared=no deleted=no posted=no
   grep -qxF 'cleared=true' "$TMP_ROOT/output" && cleared=yes
   grep -q -- '-X DELETE repos/o/r/issues/6419/labels/needs-human' "$TMP_ROOT/log" && deleted=yes
   grep -q -- '-X POST repos/o/r/issues/6419/comments' "$TMP_ROOT/log" && posted=yes
   if [[ "$rc" -ne 0 ]]; then
     fail "$label: the step must never fail the job, got rc=$rc out='$out'"
+  elif grep -q '/contents/' "$TMP_ROOT/log"; then
+    fail "$label: the base config was read through the API: '$(grep '/contents/' "$TMP_ROOT/log")'"
   elif [[ "$cleared" != "$2" || "$deleted" != "$3" || "$posted" != "$4" ]]; then
     fail "$label: cleared=$cleared deleted=$deleted posted=$posted, wanted $2/$3/$4; out='$out'"
   elif [[ "$cleared" == yes ]] && ! grep -qxF "decision=${WANT_LINK:-$LINK}" "$TMP_ROOT/output"; then
@@ -320,11 +325,16 @@ STUB_EVENTS="[$(event labeled "$LANE" 2026-10-23T13:00:00Z)]"
 expect "a lane label with no held review within ten minutes clears nothing" no no no "no held review after it"
 STUB_EVENTS='[]'
 expect "a hold with no label event clears nothing" no no no "no label was added"
-if grep -qE 'actions/workflows|check-runs|graphql|/pulls/' "$TMP_ROOT/log"; then
-  fail "with no lane label event the step read more than the events: '$(grep -E 'actions/|check-runs|graphql|/pulls/' "$TMP_ROOT/log")'"
+if [[ "$(grep -c '^api ' "$TMP_ROOT/log")" -eq 1 ]] && grep -q '^api repos/o/r/issues/6419/events' "$TMP_ROOT/log"; then
+  ok "with no lane label event the events are the step's one read"
 else
-  ok "with no lane label event the step stops before the pull request, run and GraphQL reads"
+  fail "with no lane label event the step read more than the events: '$(cat "$TMP_ROOT/log")'"
 fi
+export STUB_TRACKER='{"config":{"role_labels":{"human-gated":"owner-call"}}}'
+STUB_EVENTS="[$(jq -c '.label.name = "owner-call"' <<<"$(event labeled "$OWNER" 2026-10-23T13:20:20Z)")]"
+expect "the base tracker's human-gated label is the one judged" no no no "someone other than a review lane"
+export STUB_TRACKER='{not json'
+expect "an invalid tracker config clears nothing" no no no "the tracker config is invalid"
 # A pull_request run takes its workflow from the head, so a head that edits a
 # lane workflow could write the cost notice itself.
 reset
diff --git a/scripts/ci-hold-human-gated.test.sh b/scripts/ci-hold-human-gated.test.sh
index acac62c00d..ab5fb02f23 100755
--- a/scripts/ci-hold-human-gated.test.sh
+++ b/scripts/ci-hold-human-gated.test.sh
@@ -5,7 +5,8 @@
 #
 # On a pull_request event, contract-only runs included, ci-status fails while
 # the pull request carries the human-gated label the base commit's
-# .work-item-tracker.json names (default `needs-human`), read live from the API.
+# .work-item-tracker.json names (default `needs-human`), read from the base
+# commit's sparse checkout; the labels are read live from the API.
 # The error names the reason from the newest review-lane hold comment, and says
 # that removing the label approves. It fails closed when it cannot tell.
 # test-scope: .github/workflows/pr-require-checks.yml
@@ -51,10 +52,10 @@ if [[ "$step" == *$'\n        id: human_gated\n'* ]]; then
 else
   fail "step lost its human_gated id"
 fi
-if [[ "$step" == *"BASE_SHA: \${{ github.event.pull_request.base.sha }}"* ]]; then
-  ok "step reads the tracker config at the base commit, never the head"
+if [[ "$step" == *"BASE_CONFIG: \${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}"* ]]; then
+  ok "step reads the tracker config from the base checkout, and none when it failed"
 else
-  fail "step does not read the tracker config at pull_request.base.sha"
+  fail "step does not read the tracker config from the base_config checkout"
 fi
 order="$(grep -nE "^  ci-status:$|^      - name: ($NAME|Aggregate lane results)$" "$WORKFLOW" | cut -d: -f1 | paste -sd' ')"
 read -r job_line hold_line agg_line <<<"$order"
@@ -63,6 +64,25 @@ if [[ -n "${agg_line:-}" && "$job_line" -lt "$hold_line" && "$hold_line" -lt "$a
 else
   fail "step is not inside ci-status before the aggregate (lines: $order)"
 fi
+# The config comes from a sparse checkout of the base commit: never the head,
+# never a persisted credential, and before every step that reads it.
+checkout="$(awk '$0 == "      - name: Check out the base commit'"'"'s hold config" { on = 1; print; next }
+  on && /^      - / { exit }
+  on { print }' "$WORKFLOW")"
+# shellcheck disable=SC2016 # workflow literals to match, not shell expansions
+for line in $'\n        id: base_config\n' 'continue-on-error: true' \
+  'ref: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}' \
+  'persist-credentials: false' '/.work-item-tracker.json' '/.github/standards/trusted-actors/trusted-actors.json' \
+  'sparse-checkout-cone-mode: false' 'path: base-config'; do
+  if [[ "$checkout" == *"$line"* ]]; then ok "the base checkout carries '${line//$'\n'/}'"; else fail "the base checkout lost '${line//$'\n'/}'"; fi
+done
+order="$(grep -nE "^  ci-status:$|^      - name: (Check out the base commit's hold config|Clear a cost-only review hold the owner decided)$" "$WORKFLOW" | cut -d: -f1 | paste -sd' ')"
+read -r job_line checkout_line cost_line <<<"$order"
+if [[ -n "${cost_line:-}" && "$job_line" -lt "$checkout_line" && "$checkout_line" -lt "$cost_line" ]]; then
+  ok "the base checkout sits in ci-status before the first step that reads it"
+else
+  fail "the base checkout is not in ci-status before the cost-hold step (lines: $order)"
+fi
 gate="$(awk '/^  ci-status:$/ { on = 1; next } on && /^    if: / { print; exit }' "$WORKFLOW")"
 if [[ "$gate" == "    if: \${{ !cancelled() }}" ]]; then
   ok "ci-status carries no contract-only gate, so the step runs on label events"
@@ -70,9 +90,10 @@ else
   fail "ci-status gained a gate that could skip the hold: '$gate'"
 fi
 
-# The stub logs its arguments. A contents read fails its first
-# STUB_TRACKER_FAILS calls, then answers 404 when STUB_TRACKER is unset, else
-# prints STUB_TRACKER. A labels read fails its first STUB_FAILS calls, then
+# The base commit's config is a fixture directory: STUB_TRACKER is its
+# .work-item-tracker.json (absent when unset), and STUB_CHECKOUT_FAILED leaves
+# BASE_CONFIG empty, as a failed checkout does. The gh stub logs its
+# arguments. A labels read fails its first STUB_FAILS calls, then
 # prints STUB_LABELS one per line. A comments read fails when STUB_COMMENTS_FAIL
 # is set, else applies the --jq filter to the STUB_COMMENTS array, as gh does
 # per page.
@@ -81,11 +102,6 @@ cat >"$TMP_ROOT/bin/gh" <<'EOF'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >>"$STUB_LOG"
 case "$*" in
-*/contents/.work-item-tracker.json*)
-  [[ "$(grep -c '/contents/' "$STUB_LOG")" -gt "${STUB_TRACKER_FAILS:-0}" ]] || { echo 'gh: Server Error (HTTP 502)' >&2; exit 1; }
-  [[ -n "${STUB_TRACKER+set}" ]] || { echo 'gh: Not Found (HTTP 404)' >&2; exit 1; }
-  printf '%s\n' "$STUB_TRACKER"
-  ;;
 */labels*)
   [[ "$(grep -c '/labels' "$STUB_LOG")" -gt "${STUB_FAILS:-0}" ]] || exit 1
   [[ -z "$STUB_LABELS" ]] || tr ',' '\n' <<<"$STUB_LABELS"
@@ -118,9 +134,14 @@ expect() {
   local label="$1" want_rc="$2" want_calls="$3" out rc calls
   : >"$TMP_ROOT/log"
   : >"$TMP_ROOT/output"
+  rm -rf "$TMP_ROOT/base-config"
+  mkdir -p "$TMP_ROOT/base-config"
+  [[ -z "${STUB_TRACKER+set}" ]] || printf '%s\n' "$STUB_TRACKER" >"$TMP_ROOT/base-config/.work-item-tracker.json"
+  local config="$TMP_ROOT/base-config"
+  [[ -z "${STUB_CHECKOUT_FAILED:-}" ]] || config=
   out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" STUB_LABELS="$4" STUB_FAILS="$5" PR_NUMBER=6419 \
     GITHUB_REPOSITORY=o/r RUNNER_TEMP="$TMP_ROOT" GITHUB_OUTPUT="$TMP_ROOT/output" BASE_SHA="${BASE_SHA-$BASE}" \
-    bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
+    BASE_CONFIG="$config" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
   calls=$(grep -c '/labels' "$TMP_ROOT/log")
   if [[ "$rc" -ne "$want_rc" ]]; then
     fail "$label: expected rc=$want_rc got rc=$rc out='$out'"
@@ -128,8 +149,8 @@ expect() {
     fail "$label: expected $want_calls labels call(s) got $calls"
   elif [[ "$calls" -gt 0 && "$(grep '/labels' "$TMP_ROOT/log" | sort -u)" != "api repos/o/r/issues/6419/labels?per_page=100 --paginate --jq .[].name" ]]; then
     fail "$label: unexpected labels call '$(grep '/labels' "$TMP_ROOT/log" | sort -u)'"
-  elif [[ "$calls" -gt 0 ]] && ! grep -qxF "api -H Accept: application/vnd.github.raw+json repos/o/r/contents/.work-item-tracker.json?ref=$BASE" "$TMP_ROOT/log"; then
-    fail "$label: the tracker config was not read at the base commit: '$(sort -u "$TMP_ROOT/log")'"
+  elif grep -q '/contents/' "$TMP_ROOT/log"; then
+    fail "$label: the tracker config was read through the API: '$(sort -u "$TMP_ROOT/log")'"
   elif [[ -n "${6:-}" && "$out" != *"$6"* ]]; then
     fail "$label: output lacks '$6': '$out'"
   elif [[ -n "${7:-}" && "$out" == *"$7"* ]]; then
@@ -191,11 +212,12 @@ fi
 expect "needs-human does not hold when the tracker names another label" 0 1 "needs-human" 0 "#6419 carries no 'owner-call' label."
 export STUB_TRACKER='{not json'
 expect "an invalid tracker config fails closed" 1 0 "" 0 "::error::cannot read the human-gated role label"
-export STUB_TRACKER="$CUSTOM" STUB_TRACKER_FAILS=1
-expect "a transient tracker read failure is retried" 1 1 "owner-call" 0 "carries 'owner-call'"
-export STUB_TRACKER_FAILS=3
-expect "an unreadable tracker config fails closed" 1 0 "" 0 "::error::could not read .work-item-tracker.json"
-unset STUB_TRACKER STUB_TRACKER_FAILS
+export STUB_TRACKER="$CUSTOM" STUB_CHECKOUT_FAILED=1
+expect "a base checkout that failed fails closed" 1 0 "" 0 "::error::could not read .work-item-tracker.json at $BASE; re-run this run."
+unset STUB_TRACKER STUB_CHECKOUT_FAILED
+export STUB_TRACKER=''
+expect "an empty tracker config falls back to needs-human" 1 1 "needs-human" 0 "carries 'needs-human'"
+unset STUB_TRACKER
 export BASE_SHA=main
 expect "a base that is not a commit SHA fails closed without a call" 1 0 "" 0 "::error::the base commit 'main' is not a commit SHA"
 unset BASE_SHA
diff --git a/scripts/ci-hold-lifted-by.test.sh b/scripts/ci-hold-lifted-by.test.sh
index 531900ceb0..5e877d5299 100755
--- a/scripts/ci-hold-lifted-by.test.sh
+++ b/scripts/ci-hold-lifted-by.test.sh
@@ -44,7 +44,8 @@ else
   ok "step fails the job on its exit code"
 fi
 # shellcheck disable=SC2016 # the ${{ }} text is workflow source, not shell
-for env in 'BASE_SHA: ${{ github.event.pull_request.base.sha }}' 'HUMAN_GATED: ${{ steps.human_gated.outputs.label }}'; do
+for env in 'BASE_SHA: ${{ github.event.pull_request.base.sha }}' 'HUMAN_GATED: ${{ steps.human_gated.outputs.label }}' \
+  "BASE_CONFIG: \${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}"; do
   if [[ "$step" == *"$env"* ]]; then ok "step env carries $env"; else fail "step env lacks $env"; fi
 done
 order="$(grep -nE "^  ci-status:$|^      - name: (Fail a pull request carrying the human-gated label|$NAME|Aggregate lane results)$" "$WORKFLOW" | cut -d: -f1 | paste -sd' ')"
@@ -57,10 +58,11 @@ fi
 
 # The stub logs its arguments. A comments read fails when STUB_COMMENTS_FAIL is
 # set, else applies the --jq filter to the STUB_COMMENTS array, as gh does per
-# page. A contents read of the trusted-actor list fails its first
-# STUB_ACTORS_FAILS calls, then prints STUB_ACTORS. An events read fails when
-# STUB_EVENTS_FAIL is set, else prints STUB_EVENTS (pages concatenated, as
-# --paginate prints them).
+# page. An events read fails when STUB_EVENTS_FAIL is set, else prints
+# STUB_EVENTS (pages concatenated, as --paginate prints them). The base
+# commit's config is a fixture directory holding STUB_ACTORS as the
+# trusted-actor list; STUB_CHECKOUT_FAILED leaves BASE_CONFIG empty, as a
+# failed checkout does.
 mkdir -p "$TMP_ROOT/bin"
 cat >"$TMP_ROOT/bin/gh" <<'EOF'
 #!/usr/bin/env bash
@@ -71,10 +73,6 @@ case "$*" in
   while [[ $# -gt 0 && "$1" != --jq ]]; do shift; done
   jq -r "$2" <<<"${STUB_COMMENTS:-[]}"
   ;;
-*/contents/.github/standards/trusted-actors/trusted-actors.json*)
-  [[ "$(grep -c '/contents/' "$STUB_LOG")" -gt "${STUB_ACTORS_FAILS:-0}" ]] || { echo 'gh: Server Error (HTTP 502)' >&2; exit 1; }
-  printf '%s\n' "$STUB_ACTORS"
-  ;;
 */events*)
   [[ -z "${STUB_EVENTS_FAIL:-}" ]] || exit 1
   printf '%s\n' "${STUB_EVENTS:-[]}"
@@ -102,11 +100,19 @@ EARLY_LIFT="$(unlabeled needs-human 2026-10-23T09:00:00Z 153232337 kyle-sexton)"
 
 # expect <label> <want-rc> [want-out] [refuse-out]; stubs come from the environment.
 expect() {
-  local label="$1" want_rc="$2" out rc
+  local label="$1" want_rc="$2" out rc config="$TMP_ROOT/base-config"
   : >"$TMP_ROOT/log"
-  out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" STUB_ACTORS="${STUB_ACTORS-$ACTORS}" PR_NUMBER=6419 \
+  rm -rf "$config"
+  mkdir -p "$config/.github/standards/trusted-actors"
+  printf '%s\n' "${STUB_ACTORS-$ACTORS}" >"$config/.github/standards/trusted-actors/trusted-actors.json"
+  [[ -z "${STUB_CHECKOUT_FAILED:-}" ]] || config=
+  out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" PR_NUMBER=6419 \
     GITHUB_REPOSITORY=o/r HUMAN_GATED="${HUMAN_GATED-needs-human}" BASE_SHA="${BASE_SHA-$BASE}" \
-    bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
+    BASE_CONFIG="$config" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
+  if grep -q '/contents/' "$TMP_ROOT/log"; then
+    fail "$label: the trusted-actor list was read through the API"
+    return
+  fi
   if [[ "$rc" -ne "$want_rc" ]]; then
     fail "$label: expected rc=$want_rc got rc=$rc out='$out'"
   elif [[ -n "${3:-}" && "$out" != *"$3"* ]]; then
@@ -118,8 +124,14 @@ expect() {
   fi
 }
 
-expect "a pull request no review lane held passes without reading the actor list" 0 "No review lane has held #6419."
-if grep -q '/contents/' "$TMP_ROOT/log"; then fail "actors read with no hold"; else ok "the actor list is read only after a hold"; fi
+expect "a pull request no review lane held passes" 0 "No review lane has held #6419."
+if [[ "$(grep -c '^api ' "$TMP_ROOT/log")" -eq 2 ]] && grep -q '^api repos/o/r/issues/6419/comments' "$TMP_ROOT/log" &&
+  grep -q '^api repos/o/r/issues/6419/events' "$TMP_ROOT/log"; then
+  ok "with no hold the step makes two reads, the comments and the events, both needed for that verdict"
+else
+  fail "with no hold the step's reads are not exactly comments and events: '$(cat "$TMP_ROOT/log")'"
+fi
+STUB_CHECKOUT_FAILED=1 expect "with no hold the actor list is not needed, so a failed base checkout passes" 0 "No review lane has held #6419."
 export STUB_EVENTS
 STUB_EVENTS="[$(labeled needs-human 2026-10-23T09:00:00Z),$BOT_LIFT]"
 expect "a label the lanes App added (an escalation) is not a review-lane hold" 0 "No review lane has held #6419."
@@ -129,11 +141,6 @@ expect "a hold comment from a person or with no lane footer is not a hold" 0 "No
 export STUB_COMMENTS="[$OLD_HOLD,$HOLD]"
 STUB_EVENTS="[$(labeled needs-human 2026-10-23T09:59:00Z),$OWNER_LIFT]"
 expect "a trusted person's removal after the hold passes" 0 "kyle-sexton, a person on the trusted-actor list, lifted"
-if grep -qxF "api -H Accept: application/vnd.github.raw+json repos/o/r/contents/.github/standards/trusted-actors/trusted-actors.json?ref=$BASE" "$TMP_ROOT/log"; then
-  ok "the trusted-actor list is read at the base commit"
-else
-  fail "the trusted-actor list was not read at the base commit: '$(sort -u "$TMP_ROOT/log")'"
-fi
 export STUB_EVENTS="[$OWNER_LIFT][$BOT_LIFT]"
 expect "a later escalation's removal by a bot, across pages, does not undo the trusted lift" 0 "kyle-sexton, a person on the trusted-actor list, lifted"
 STUB_EVENTS="[$(unlabeled needs-human 2026-10-23T10:30:00Z 337595936 'melodic-automation-lanes[bot]'),$OWNER_LIFT]"
@@ -181,11 +188,7 @@ expect "a person missing from the base list is not trusted" 1 "kyle-sexton remov
 export STUB_ACTORS='{not json'
 expect "an unreadable trusted-actor list fails closed" 1 "names no person"
 unset STUB_ACTORS
-export STUB_ACTORS_FAILS=1
-expect "a transient trusted-actor read failure is retried" 0 "lifted the review-lane hold"
-export STUB_ACTORS_FAILS=3
-expect "a trusted-actor list that never reads fails closed" 1 "::error::could not read the trusted-actor list at $BASE; re-run this run."
-unset STUB_ACTORS_FAILS
+STUB_CHECKOUT_FAILED=1 expect "a hold with a failed base checkout fails closed" 1 "::error::could not read the trusted-actor list at $BASE; re-run this run."
 export STUB_EVENTS_FAIL=1
 expect "an unreadable event list fails closed" 1 "::error::could not read the events of #6419; re-run this run."
 unset STUB_EVENTS_FAIL
diff --git a/scripts/ci-hold-merge-group.test.sh b/scripts/ci-hold-merge-group.test.sh
index b756a105ea..5a57c6a0e1 100755
--- a/scripts/ci-hold-merge-group.test.sh
+++ b/scripts/ci-hold-merge-group.test.sh
@@ -44,9 +44,14 @@ else
   ok "step fails the job on its exit code"
 fi
 if [[ "$step" == *"BASE_SHA: \${{ github.event.merge_group.base_sha }}"* ]]; then
-  ok "step reads the tracker config at the group's base commit"
+  ok "step names the group's base commit"
 else
-  fail "step does not read the tracker config at merge_group.base_sha"
+  fail "step does not name merge_group.base_sha"
+fi
+if [[ "$step" == *"BASE_CONFIG: \${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}"* ]]; then
+  ok "step reads the tracker config from the base checkout, and none when it failed"
+else
+  fail "step does not read the tracker config from the base_config checkout"
 fi
 # Inside ci-status, before the aggregate, so a red here is the job's answer.
 order="$(grep -nE "^  ci-status:$|^      - name: ($NAME|Aggregate lane results)$" "$WORKFLOW" | cut -d: -f1 | paste -sd' ')"
@@ -57,20 +62,16 @@ else
   fail "step is not inside ci-status before the aggregate (lines: $order)"
 fi
 
-# The stub logs its arguments. A contents read fails its first
-# STUB_TRACKER_FAILS calls, then answers 404 when STUB_TRACKER is unset, else
-# prints STUB_TRACKER. A labels read fails its first STUB_FAILS calls, then
-# prints STUB_LABELS one per line.
+# The base commit's config is a fixture directory: STUB_TRACKER is its
+# .work-item-tracker.json (absent when unset), and STUB_CHECKOUT_FAILED leaves
+# BASE_CONFIG empty, as a failed checkout does. The gh stub logs its
+# arguments. A labels read fails its first STUB_FAILS calls, then prints
+# STUB_LABELS one per line.
 mkdir -p "$TMP_ROOT/bin"
 cat >"$TMP_ROOT/bin/gh" <<'EOF'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >>"$STUB_LOG"
 case "$*" in
-*/contents/.work-item-tracker.json*)
-  [[ "$(grep -c '/contents/' "$STUB_LOG")" -gt "${STUB_TRACKER_FAILS:-0}" ]] || { echo 'gh: Server Error (HTTP 502)' >&2; exit 1; }
-  [[ -n "${STUB_TRACKER+set}" ]] || { echo 'gh: Not Found (HTTP 404)' >&2; exit 1; }
-  printf '%s\n' "$STUB_TRACKER"
-  ;;
 */labels*)
   [[ "$(grep -c '/labels' "$STUB_LOG")" -gt "${STUB_FAILS:-0}" ]] || exit 1
   [[ -z "$STUB_LABELS" ]] || tr ',' '\n' <<<"$STUB_LABELS"
@@ -87,12 +88,17 @@ QUEUE="refs/heads/gh-readonly-queue/main/pr-6419-$SHA"
 CUSTOM='{"config":{"role_labels":{"human-gated":" owner-call "}}}'
 
 # expect <label> <want-rc> <want-label-calls> <want-pr|-> <GITHUB_REF> <STUB_LABELS> <STUB_FAILS> [want-out]
-# The tracker stub is set by the caller's environment (STUB_TRACKER, STUB_TRACKER_FAILS, BASE_SHA).
+# The tracker fixture is set by the caller's environment (STUB_TRACKER, STUB_CHECKOUT_FAILED, BASE_SHA).
 expect() {
-  local label="$1" want_rc="$2" want_calls="$3" want_pr="$4" out rc calls
+  local label="$1" want_rc="$2" want_calls="$3" want_pr="$4" out rc calls config="$TMP_ROOT/base-config"
   : >"$TMP_ROOT/log"
+  rm -rf "$config"
+  mkdir -p "$config"
+  [[ -z "${STUB_TRACKER+set}" ]] || printf '%s\n' "$STUB_TRACKER" >"$config/.work-item-tracker.json"
+  [[ -z "${STUB_CHECKOUT_FAILED:-}" ]] || config=
   out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" GITHUB_REF="$5" STUB_LABELS="$6" STUB_FAILS="$7" \
-    GITHUB_REPOSITORY=o/r RUNNER_TEMP="$TMP_ROOT" BASE_SHA="${BASE_SHA-$BASE}" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
+    GITHUB_REPOSITORY=o/r RUNNER_TEMP="$TMP_ROOT" BASE_SHA="${BASE_SHA-$BASE}" BASE_CONFIG="$config" \
+    bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
   calls=$(grep -c '/labels' "$TMP_ROOT/log")
   if [[ "$rc" -ne "$want_rc" ]]; then
     fail "$label: expected rc=$want_rc got rc=$rc out='$out'"
@@ -101,8 +107,8 @@ expect() {
   elif [[ "$want_pr" != - ]] &&
     [[ "$(grep '/labels' "$TMP_ROOT/log" | sort -u)" != "api repos/o/r/issues/$want_pr/labels?per_page=100 --paginate --jq .[].name" ]]; then
     fail "$label: unexpected gh call '$(sort -u "$TMP_ROOT/log")'"
-  elif [[ "$want_pr" != - ]] && ! grep -qxF "api -H Accept: application/vnd.github.raw+json repos/o/r/contents/.work-item-tracker.json?ref=${BASE_SHA-$BASE}" "$TMP_ROOT/log"; then
-    fail "$label: the tracker config was not read at the base commit: '$(sort -u "$TMP_ROOT/log")'"
+  elif grep -q '/contents/' "$TMP_ROOT/log"; then
+    fail "$label: the tracker config was read through the API: '$(sort -u "$TMP_ROOT/log")'"
   elif [[ -n "${8:-}" && "$out" != *"$8"* ]]; then
     fail "$label: output lacks '$8': '$out'"
   else
@@ -129,11 +135,9 @@ export STUB_TRACKER='{"config":{"lease_ttl_hours":24}}'
 expect "a tracker naming no label falls back to needs-human" 1 1 6419 "$QUEUE" "needs-human" 0 "carries 'needs-human'"
 export STUB_TRACKER='{not json'
 expect "an invalid tracker config fails closed" 1 0 - "$QUEUE" "" 0 "::error::cannot read the human-gated role label"
-export STUB_TRACKER="$CUSTOM" STUB_TRACKER_FAILS=1
-expect "a transient tracker read failure is retried" 1 1 6419 "$QUEUE" "owner-call" 0 "carries 'owner-call'"
-export STUB_TRACKER_FAILS=3
-expect "an unreadable tracker config fails closed" 1 0 - "$QUEUE" "" 0 "::error::could not read .work-item-tracker.json"
-unset STUB_TRACKER STUB_TRACKER_FAILS
+export STUB_TRACKER="$CUSTOM" STUB_CHECKOUT_FAILED=1
+expect "a base checkout that failed fails closed" 1 0 - "$QUEUE" "" 0 "::error::could not read .work-item-tracker.json at $BASE; re-run this run."
+unset STUB_TRACKER STUB_CHECKOUT_FAILED
 export BASE_SHA=main
 expect "a base that is not a commit SHA fails closed without a call" 1 0 - "$QUEUE" "" 0 "::error::the base commit 'main' is not a commit SHA"
 unset BASE_SHA
diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh
index 21626577ac..fc955609b4 100755
--- a/scripts/ci-review-lanes.test.sh
+++ b/scripts/ci-review-lanes.test.sh
@@ -151,8 +151,11 @@ jobs() { local IFS=,; printf '{"jobs":[%s]}' "$*"; }
 expect() {
   local label="$1" want_rc="$2" out rc
   : >"$TMP_ROOT/log"
+  # SHARED_FILES stands for the pages the broker step left under RUNNER_TEMP.
+  rm -f "$TMP_ROOT/pr-files.json"
+  [[ -z "${SHARED_FILES:-}" ]] || printf '%s\n' "$SHARED_FILES" >"$TMP_ROOT/pr-files.json"
   out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" GITHUB_REPOSITORY=o/r HEAD_SHA="${HEAD_SHA-$HEAD}" \
-    AUTHOR_ID="${AUTHOR_ID-153232337}" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
+    AUTHOR_ID="${AUTHOR_ID-153232337}" RUNNER_TEMP="$TMP_ROOT" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
   if [[ "$rc" -ne "$want_rc" ]]; then
     fail "$label: expected rc=$want_rc got rc=$rc out='$out'"
   elif [[ -n "${3:-}" && "$out" != *"$3"* ]]; then
@@ -241,6 +244,14 @@ done
 STUB_FILES="$(files README.md)" STUB_CHANGED=3
 AUTHOR_ID=49699333 expect "a short file listing fails closed" 1 "::error::GitHub listed fewer files than #77 changes"
 STUB_CHANGED=1 STUB_FILES_FAIL=1 AUTHOR_ID=49699333 expect "an unreadable file listing fails closed" 1 "::error::could not read the files of #77"
+# The broker step's pages are reused, so the files are not read again.
+STUB_FILES_FAIL=1 STUB_CHANGED=3 SHARED_FILES="$(files README.md)$(files docs/a.md 'docs/b.md<docs/c.md')" \
+  AUTHOR_ID=49699333 expect "the broker step's file pages, across pages, are reused" 0 "no trust-gate path changed"
+if grep -q '/files' "$TMP_ROOT/log"; then fail "the files were read again"; else ok "a reused file list makes no files read"; fi
+STUB_FILES_FAIL=1 STUB_CHANGED=2 SHARED_FILES="$(files README.md 'docs/new.md<CODEOWNERS')" \
+  AUTHOR_ID=49699333 expect "a renamed trust-gate path in the reused list fails" 1 "trust-gate paths: CODEOWNERS."
+STUB_FILES_FAIL=1 STUB_CHANGED=4 SHARED_FILES="$(files README.md)" \
+  AUTHOR_ID=49699333 expect "a reused list shorter than the change fails closed" 1 "::error::GitHub listed fewer files than #77 changes"
 STUB_FILES='[]' STUB_CHANGED=0
 AUTHOR_ID=49699333999 expect "an id that only contains an exempt id is not exempt" 1 "is missing"
 RUNS_CODE="$(runs "$(run 10 $CODE)")"
diff --git a/scripts/lane-coverage-step-opt-outs.txt b/scripts/lane-coverage-step-opt-outs.txt
index 2c5d5be794..e5fe0c85cb 100644
--- a/scripts/lane-coverage-step-opt-outs.txt
+++ b/scripts/lane-coverage-step-opt-outs.txt
@@ -22,3 +22,4 @@
 
 select-tests/detect  the resolver's own step: a failed detector must leave its outputs unset so every consumer resolves toward RUNNING its lane, and feeding that outcome to an aggregator would red the run for the one case it exists to survive
 select-tests/match  the resolver's own filter-group step, on the same fall-through contract as select-tests/detect; the pair is gated instead by the non-continue-on-error detector self-test above them and by scripts/check-docs-only-gate.sh
+ci-status/base_config  the hold steps' sparse checkout of the base config: a failure must fall through to those steps, which read steps.base_config.outcome through BASE_CONFIG and fail closed (human-gated, hold-lift, merge-group) or keep the hold (cost-hold) on it, so feeding it to the aggregator would add no gate the steps do not already enforce