diff --git a/GLOSSARY.md b/GLOSSARY.md
index facf4e938..7cc1459d2 100644
--- a/GLOSSARY.md
+++ b/GLOSSARY.md
@@ -107,6 +107,9 @@ _Avoid_: invocation, job
 A **Command** that stopped at a plan-limit warning or rejection, with outcome `paused`: an **Experiment** or **Scoring run**. Its **Command record** keeps the stopping Harness and window, utilization and reset time when reported, and the command that resumes it. It waits in **Needs you** as Paused until a later Command resumes the same work or the Day shift makes a **Dismissal**. Resuming continues the same work with finished Trials and Scores kept and nothing finished repeated. This is separate from interruption, is neither success nor failure, and does not resume automatically.
 _Avoid_: failed Command (for a plan-limit pause)
 
+**Quota wait**:
+The time until GitHub's quota for a GitHub user resets, during which **Passes** are skipped and running **Commands** wait instead of failing.
+
 **Ticket run**:
 One invocation of the factory on a single issue that is not a **Spec**, from launch to cleanup, normally ending in one pull request ready for review, or a **Self-merge** when its command or the **User config** asks for one. A Ticket run on an issue labelled `bug` reproduces the bug before fixing it, in a fresh Ticket run or a **Continuation**, except for **Flaky-test Tickets**, Security fixes and **Base fixes**, which have their own flow. A Continuation whose **Issue branch** has commits beyond the **Base branch** reproduces at their merge base, then checks the fix on the branch; a fix already there still goes on to review and the pull request. If the bug is not reproduced, including when it is absent at that merge base, the Ticket run ends successfully with triage notes and `needs-info` on the issue, without opening or merging a pull request. Started directly on an **Issue URL**, by a **Spec run** for one of its **Tickets**, by an **Architect run** for the Ticket its **Architecture review** published, by a **Pickup run** for the **Ready issue** it took, or by a **Security run** for a **Security finding** it fixes. Every Ticket run carries out a **Process**: the **Built-in process** by default, or a **Custom process** selected by the Process that starts it. That Process owns its sequence of Steps. Dispatch chooses Spec or Ticket and makes any Claim before work starts; child Ticket runs inherit their Command's choices and limits.
 _Avoid_: Run, Merge run (former names), auto-merge (GitHub's own feature)
@@ -295,14 +298,14 @@ The token counts and cost reported in one **Session trace**, grouped by observed
 A **Command**'s whole tree of work, its child **Ticket runs** and all of their **Session traces** included. Their shared identity keeps the tree together across sessions.
 
 **Command log**:
-Everything one **Ticket run**, **Spec run**, **Architect run**, **Pickup run**, **Security run** or **Custom process** printed, kept in a file of its own with its repository's other logs, stamped like its **Session traces**. The start stamp is for display and grouping; Commands with the same start time still have distinct storage ownership for their Command logs, Session traces and **Command records**. An Architect run's, Pickup run's, Security run's or Custom process's covers the Spec runs or Ticket runs it dispatched, and a Spec run's covers its **Ticket runs**, as a Ticket run's covers its **Base fix**: none of those keeps one of its own. It is kept once the command starts work: a Pickup run, Architect run or Security run skipped before doing any work keeps none, and neither does a Ticket run that fails before it starts work, such as on **Origin match**.
+Everything one **Ticket run**, **Spec run**, **Architect run**, **Pickup run**, **Security run** or **Custom process** printed, kept in a file of its own with its repository's other logs, stamped like its **Session traces**. The start stamp is for display and grouping; Commands with the same start time still have distinct storage ownership for their Command logs, Session traces and **Command records**. An Architect run's, Pickup run's, Security run's or Custom process's covers the Spec runs or Ticket runs it dispatched, and a Spec run's covers its **Ticket runs**, as a Ticket run's covers its **Base fix**: none of those keeps one of its own. It is kept once the command starts work, or earlier when a **Quota wait** needs a visible, stoppable Command record. Without such a wait, a Pickup run, Architect run or Security run skipped before doing any work keeps none, and neither does a Ticket run that fails before it starts work, such as on **Origin match**.
 _Avoid_: cron log, output log, run log (a **Ticket run** is one kind of command)
 
 **Log inventory**:
 The retained Command logs and Session traces available to list on a machine, each naming an exact file under the User config's log folder. A Command's referenced Session traces may include files outside that inventory.
 
 **Activity log**:
-One running record per repository of what the factory did there: a line when a **Ticket run**, **Spec run**, **Architect run**, **Pickup run**, **Security run**, **Triage run** or **Custom process** starts work, naming its **Command log**, a line when it is given a **Stop** or a **Dismissal**, or a Dismissal is taken back, naming who asked and whether from the CLI or the **Console**, and a line when it ends, with its outcome. A Custom process's lines name it as Process `<name>`. A skipped Architect run, Pickup run, Security run or Triage Pass writes a line only when its reason differs from the last one recorded for its kind, so a repository that sits idle shows one line, not one per pass. A skipped Custom process started with no issue writes `Process <name> skipped: <reason>` when that is not already the last Process line. A warning about the **User config**, such as a setting it ignores, is written once per change. It is what thirdshift writes about a scheduled pass, in place of output to the scheduler.
+One running record per repository of what the factory did there: a line when a **Ticket run**, **Spec run**, **Architect run**, **Pickup run**, **Security run**, **Triage run** or **Custom process** starts work, naming its **Command log**, a line when it is given a **Stop** or a **Dismissal**, or a Dismissal is taken back, naming who asked and whether from the CLI or the **Console**, and a line when it ends, with its outcome. A Custom process's lines name it as Process `<name>`. A skipped Architect run, Pickup run, Security run or Triage Pass writes a line only when its reason differs from the last one recorded for its kind, so a repository that sits idle shows one line, not one per pass. A skipped Custom process started with no issue writes `Process <name> skipped: <reason>` when that is not already the last Process line. During a **Quota wait**, each named Custom process compares its own last reason instead, so alternating processes do not repeat an unchanged quota skip. A warning about the **User config**, such as a setting it ignores, is written once per change. It is what thirdshift writes about a scheduled pass, in place of output to the scheduler.
 _Avoid_: cron log, pass log, history
 
 **Command record**:
diff --git a/docs/guide.md b/docs/guide.md
index 399380d8a..1e0d21bcd 100644
--- a/docs/guide.md
+++ b/docs/guide.md
@@ -45,6 +45,8 @@ From a clone of the issue's repository, `thirdshift <Issue URL>`:
 7. In a **Ticket run** that Self-merges (`thirdshift merge <Issue URL>`), does the **Self-merge**: once the pull request is open, ready for review, mergeable and green, thirdshift merges it into the Base branch with a merge commit, on exactly the head commit whose CI it watched (`gh pr merge --merge --match-head-commit <sha>`). Just before each attempt, it reads the PR's `reviewDecision`: `REVIEW_REQUIRED` or `CHANGES_REQUESTED` ends the Ticket run as **review required**, a policy refusal, without attempting the merge or taking another Repair round. An empty or `APPROVED` decision, or a failed read, keeps the existing merge behavior. It never uses GitHub's auto-merge ([ADR-0004](adr/0004-self-merge-by-thirdshift-not-github-auto-merge.md)). A merge that fails goes back round step 6, within the same budgets, and is tried again on the new green head. If that round finds nothing to fix, the refusal is a **policy refusal**, such as merge commits being disallowed or a review being required. After the merge, thirdshift deletes the Issue branch on `origin`, and closes the issue if it is still open, with the comment `Closed by #<pr>, merged into <base> by a thirdshift Ticket run with Self-merge.` GitHub closes it on its own only for a merge into the repository's default branch, and then thirdshift leaves it alone. Once the issue is closed, either way, thirdshift takes `in-progress` off it, [removing the Claim](#when-the-claim-ends).
 8. Cleans up: removes the worktree, the local Issue branch and the temporary directory the Factory skills were written out to, whether the Ticket run succeeded or not. The one exception is a **Failed ticket run** whose work could not be pushed: see below.
 
+CI watch quota exhaustion follows the [Command's Quota wait policy](#delivery-and-pull-request-identity): reset plus one minute and 0–60 seconds of jitter, within a shared two-hour cap. Secondary limits retry after 60 seconds, at most five times. Neither is a CI failure or a reason to start a Repair while retries remain.
+
 ### Worktree ownership and cleanup
 
 A factory-owned checkout, on an **Issue branch** for a **Ticket run** or detached for an **Architecture review**.
@@ -63,6 +65,10 @@ See [ADR-0014](adr/0014-successful-review-acquisition-authorizes-stale-disposal.
 
 What a **Ticket run**, or a **Spec run** for its **Spec PR**, does from its worktree once its work begins. It runs the opening session (the implement session, or the **Spec review**), pushes, marks the pull request ready, keeps it mergeable and green through the **Repair loop**, and, in a **Ticket run** that Self-merges, does the **Self-merge**.
 
+When thirdshift's own GitHub reads or writes hit primary quota exhaustion, the running **Command** records a **Quota wait**, waits until reset plus one minute and a random 0–60 seconds, then retries the same call. This includes CI watch and Delivery's pull request updates, labels, comments and Self-merge, across Ticket, Spec, Review, Fix, Security and Triage runs, Custom processes and work a Pass dispatched. The Command and its child Ticket runs share a two-hour total wait cap; a call that would exceed it fails as before. A secondary-limit failure instead waits 60 seconds and retries up to five times, without recording a Quota wait.
+
+While waiting, `status`, `show` and the Console show `Quota wait until <time>` as the stage; afterwards the previous stage resumes. Slow timing includes the wait. Stop or another interruption ends an ordinary wait immediately. Claim ending, Failed ticket run salvage, confirmed Self-merge completion and Spec accounting still wait within the cap after interruption. A Quota wait itself is no failure and adds no `agent-failed` label. Agent sessions' own `gh` calls keep their existing behavior.
+
 For a Spec PR, Delivery ends Ticket accounting's capture before the Spec review, allowing that session to replace the PR. The first successful observation after the opening session, or during Failed ticket run completion after an opening failure, captures one pull request number and URL in the issue's repository; all later observations and transitions use that identity. Readiness and every mergeability poll validate its expected **Issue branch** and **Base branch**, open state and readiness where required. A missing, closed or retargeted captured PR fails Delivery; a replacement from the same branch is never substituted.
 
 A Delivery that fails takes the **Failed ticket run** path, drafting that same captured open PR after preserving work. Spec PR checklist restoration uses that Delivery capture before readiness and for final accounting after failure.
@@ -164,7 +170,7 @@ For each repository and kind of Pass whose latest Activity log line is a skip, s
 Architect run idle on acme/widgets: Ready issue #7 "Make widgets" goes first: https://github.com/acme/widgets/issues/7
 ```
 
-`status` and the Console Inbox also show `Pickup last fired <age> ago on <owner>/<repo>` (and the equivalent for Architect and Security), even when repeated Passes skip for the same reason. Every Pass saves its start once its repository is known, before launch checks and the Command limit, in `<logs.dir>/<owner>/<repo>/<pickup|architect|secure|review|fix|triage>.last-fired`. This replaces the previous time without adding Activity log lines. A repository with no saved start has no last-fired entry; older Activity log times are not used as evidence that the scheduler recently fired.
+`status` and the Console Inbox also show `Pickup last fired <age> ago on <owner>/<repo>` (and the equivalent for Architect and Security), even when repeated Passes skip for the same reason. Beside those lines, `GitHub Quota wait until <time>` appears while this machine has a Quota wait and disappears after its reset. Every Pass saves its start once its repository is known, before launch checks and the Command limit, in `<logs.dir>/<owner>/<repo>/<pickup|architect|secure|review|fix|triage>.last-fired`. This replaces the previous time without adding Activity log lines. A repository with no saved start has no last-fired entry; older Activity log times are not used as evidence that the scheduler recently fired.
 
 When no Commands are running, each bullet in the Inbox's **Last recorded skipped Passes** and **Last fired Passes** starts with its recorded date and time. A skipped reason uses its Activity log time, which repeated skips do not advance; a last-fired entry uses the saved Pass start and keeps its relative age. An unreadable skip time shows **Time unknown**.
 
@@ -2869,6 +2875,8 @@ Setup validates the Credentials before asking questions on a terminal. For email
 
 #### Run notifications
 
+A Command that waited for primary GitHub quota includes one line, `Waited <duration> for the GitHub quota (<resource>)`, totaling its waits and its child Ticket runs' waits. A Command that never waited has no such line; secondary-limit retries add none.
+
 `--email` (or `email`) asks a Ticket run for a **Run notification**: one email, sent when the Ticket run ends, whatever the outcome. The word after the flag is the address only if it contains `@` and doesn't start with `https://`, so the Issue URL is never taken for it; otherwise the email goes to the matching `email.to_by_repo` entry, falling back to `email.to`. With `email.always = true` in the [User config](#user-config), a Ticket run asks for one without the flag, and `--no-email` (or `no-email`) skips it for that Ticket run; an address after `--email` still wins over both configured recipients. Giving a flag twice, or any two of `--email`, `--email-unless-merged` and `--no-email`, is an argument error.
 
 `--email-unless-merged` (or `email-unless-merged`), optionally followed by an address as `--email` is, asks for a Run notification that is emailed only when the command did not end `merged`, whatever else it ended as. A merged one is still saved beside the [Command log](#logs), with nothing sent, unless it is a [Security run](#security-runs) whose fix left its finding open or whose audit left findings waiting for the Day shift: that one is emailed. It makes the same checks as `--email` before any work.
@@ -3639,6 +3647,7 @@ The `PATH` line, the `cd` and `base main` and the logins are as in [On a schedul
 
 Most passes are skipped, and that is what paces frequent Architect runs. A pass is skipped while:
 
+- **GitHub is in a Quota wait or below the reserve**: every Pass checks the machine's Quota wait record, then `gh api rate_limit`, before any other GitHub work or taking a Command-limit slot. Either fewer than 500 REST requests or fewer than 500 GraphQL points records a Quota wait until that resource resets. This covers Pickup, Architect, Security, Triage without a Report or issue, Review with `--author`, Fix without a pull request, and a Custom process without an issue, whether started by cron or by a person. A quota check that fails for a reason other than exhaustion lets the Pass proceed. A quota skip exits `0`, prints nothing on stdout and sends no Run notification. Its Activity log reason, `skipped: GitHub Quota wait until <time> (<resource>: <n> left)`, is recorded only when it changes for that kind;
 - **a run is still going**: the repository is at its Command limit, a Pass's Spec run or Ticket run counted, or another Architect run is running there ([The Command limit](#the-command-limit));
 - **an Architect plan is open**: one whose pull request waits for review, one whose run failed, or one published with `--plan-only` and not yet built ([One Architect plan at a time](#one-architect-plan-at-a-time));
 - **an Architect idea waits for triage**, since the factory has run out of Strong ideas ([An Architect idea waits for triage](#an-architect-idea-waits-for-triage));
@@ -3862,9 +3871,10 @@ PATH=/home/you/.local/bin:/home/you/.cargo/bin:/usr/local/bin:/usr/bin:/bin
 
 The `PATH` line, the `cd` and `base main`, the log file's directory, the logins the Harness's CLI and `gh` need, and schedulers other than cron are as for an Architect run: see its [On a schedule](#on-a-schedule). What differs for a Pickup run:
 
+- **Budget per GitHub user across hosts.** Every host authenticated as the same GitHub user shares one quota across repositories. Budget Pass frequency per user across all those hosts, rather than giving each host or repository a separate quota budget. A machine's Quota wait record is local; the shared GitHub quota still applies everywhere.
 - **The interval** sets how soon a Ready issue is taken and how much work is started: a pass takes one issue, so `*/30` starts at most one every half hour. A pass lasts as long as the run it dispatched, and the passes that fire meanwhile are skipped, so at the default [Command limit](#the-command-limit) of 1 the schedule builds one issue of a repository at a time on a machine, and the first pass after it ends takes the next, unless the repository is by then at its [Failure limit](#the-failure-limit): at 3 failures left for you, or the `pickup.failure_limit` you set, the passes take nothing until you have dealt with one. A pull request left for review never holds them back. An issue you have just labelled also waits five minutes by default, or the `pickup.wait_minutes` you set, until it is settled. A Ticket run you start by hand on an Issue URL never waits for a pass, but it fills a slot, so at the limit it makes one skip. Raise `pass.command_limit` to let a repository's passes overlap.
 - **One line per repository.** thirdshift keeps no list of repositories. Each Pass on one repository skips at its [Command limit](#the-command-limit), 1 by default, so both lines can go in one crontab and, by default, two Passes never build that repository at once. Passes on different repositories do run at the same time: give their lines different minutes, such as `15,45`, if they would compete for the machine.
-- **A pass is skipped** when the repository is at its [Command limit](#the-command-limit), when the repository has no Ready issue, and when it is at its Failure limit. A skip exits `0`, so the scheduler sees no failure, and sends no email, even with Run notifications on. The repository's [Activity log](#logs) records a skip when its reason changes. Unless `activity.quiet_skips` is set, the log file holds each skip's line too, and before the line of a pass that found no Ready issue, as before the line of one that took an issue, [why each issue was passed over](#why-an-issue-was-passed-over). A pass skipped for the Command limit or the Failure limit looks at no issue, so it has no such lines.
+- **A pass is skipped** during a GitHub Quota wait or below the 500-unit reserve, when the repository is at its [Command limit](#the-command-limit), when the repository has no Ready issue, and when it is at its Failure limit. A skip exits `0`, so the scheduler sees no failure, and sends no email, even with Run notifications on. The repository's [Activity log](#logs) records a skip when its reason changes. Unless `activity.quiet_skips` is set, the log file holds each skip's line too, and before the line of a pass that found no Ready issue, as before the line of one that took an issue, [why each issue was passed over](#why-an-issue-was-passed-over). A pass skipped for quota, the Command limit or the Failure limit looks at no issue, so it has no such lines.
 - **A Run notification**, by `email.always = true` or `email.unless_merged = true` in the [User config](#user-config), or `email` or `email-unless-merged` on the line, is sent [only for an issue taken](#one-run-notification-for-the-issue-taken). So a day without email doesn't say the passes are running: a pass that fails before it takes an issue, on a broken User config, a missing Resend key or a failed check, shows up only in the log file.
 
 A whole crontab with both frequent Architect runs and a Pickup run on one repository looks like this, with `activity.quiet_skips = true` in the User config, every line sending its output to the one log file, which catches only what went wrong, so `tail ~/.thirdshift/logs/acme/widgets/activity.log` shows what the factory has been doing on the repository lately:
diff --git a/site/architecture/index.html b/site/architecture/index.html
index bb5164f47..b66537a9a 100644
--- a/site/architecture/index.html
+++ b/site/architecture/index.html
@@ -556,6 +556,7 @@ <h1>Architecture</h1>
   <section class="sec arch-sec" id="passes" aria-labelledby="passes-title">
     <div class="wrap">
       <div class="sec-head"><p class="eyebrow">Figure 5 · <code>thirdshift pickup</code>, <code>architect</code>, <code>secure</code></p><h2 id="passes-title">The Passes: the factory finds its own work</h2></div>
+      <p>Quota admission precedes every Pass's other GitHub work and Command-limit slot: consult the machine's Quota wait record, then <code>gh api rate_limit</code>. Either a current wait or fewer than 500 REST requests or GraphQL points skips the Pass; a low resource records a wait until reset. Non-quota probe failures let work proceed. This applies to Pickup, Architect, Security, Triage without input, Review with <code>--author</code>, Fix without a pull request and issue-less Custom processes, from cron or by hand. Skips exit zero without stdout or notifications and deduplicate the Activity log reason per kind. The Inbox and <code>status</code> show the wait beside last-fired Passes until reset. Frequency is a budget per GitHub user across hosts and repositories sharing that quota.</p>
       <p>Before selecting a Ready issue, Pickup immediately requests one re-run of failed jobs in the Base branch's latest push CI. Green on re-run files a Flaky-test Ticket with the recorded failure as evidence; its Ticket run goes straight to implementation. Red again files an ordinary bug Ticket after 30 minutes from that attempt's completion. That ticket's title, body and comments leave job names and log lines out, and it waits until you write the task and apply <code>ready-for-agent</code>. A CI-red Ticket in <code>needs-info</code> does not block new reports; another open CI-red Ticket receives new failing commits as comments, once per commit. Concurrent hosts reserve evidence reads, re-running, filing and commenting on origin. CI read failures warn and leave Pickup running; this check does not hold Self-merges.</p>
       <p>Once a Pickup run, an Architect run or a Security run knows its repository, it replaces that kind's last-fired time under the repository's log folder, before launch checks or the Command limit. Repeated skips update the time without adding Activity log lines. <code>thirdshift status</code>, <code>thirdshift cronjobs</code> and their Console views read the same per-repository times; no reader starts work. A Custom process started with no issue, and neither an Issue-branch nor a Spec-branch worktree, counts toward the Command limit, runs beside other Passes up to it, takes no lock of a kind, and does not record a last-fired time. A file that declares either branch worktree is refused when no issue is given, before the Command limit.</p>
       <p class="lede">A <strong>Pass</strong> takes no Issue URL, so your operating system's scheduler can start it; thirdshift never schedules itself. A Pass is skipped while its repository is at its Command limit, <code>[pass] command_limit</code>, 1 by default: every live Command on the repository on the machine counts, a Ticket run started on an Issue URL included, but only a Pass is skipped. Passes of different kinds share a repository up to the limit, but never two Architect runs or two Security runs at once: each of those holds a lock of its kind and a review worktree of its own, and reserves the plan or fix it dispatches on <code>origin</code>, as a Pickup run reserves its Ready issue. A Pass with nothing to do is skipped, not failed. Architect and Security runs wait while a Ready issue is open, so work you shaped goes first. A Custom process started with no issue is a Pass for that rule and does not wait on a Ready issue or an Architect idea, unless the file declares either branch worktree: that is refused before any session, rather than skipped. One started with an issue is not a Pass. Your scheduler can start <a href="/docs/#architect-runs-every-few-minutes">Architect runs every few minutes</a> and <a href="/docs/#security-runs-on-a-schedule-with-fixing-allowed">Security runs on a schedule, with fixing allowed</a>.</p>
diff --git a/site/docs/index.html b/site/docs/index.html
index f5b2fd017..ece5065e2 100644
--- a/site/docs/index.html
+++ b/site/docs/index.html
@@ -102,6 +102,7 @@
 <li><p>Cleans up: removes the worktree, the local Issue branch and the temporary directory the Factory skills were written out to, whether the Ticket run succeeded or not. The one exception is a <strong>Failed ticket run</strong> whose work could not be pushed: see below.</p>
 </li>
 </ol>
+<p>CI watch quota exhaustion follows the <a href="#delivery-and-pull-request-identity">Command&#39;s Quota wait policy</a>: reset plus one minute and 0–60 seconds of jitter, within a shared two-hour cap. Secondary limits retry after 60 seconds, at most five times. Neither is a CI failure or a reason to start a Repair while retries remain.</p>
 <details class="fold"><summary><h3>Worktree ownership and cleanup</h3></summary>
 <div class="manual-content" id="worktree-ownership-and-cleanup">
 <p>A factory-owned checkout, on an <strong>Issue branch</strong> for a <strong>Ticket run</strong> or detached for an <strong>Architecture review</strong>.</p>
@@ -114,6 +115,8 @@
 <details class="fold"><summary><h3>Delivery and pull request identity</h3></summary>
 <div class="manual-content" id="delivery-and-pull-request-identity">
 <p>What a <strong>Ticket run</strong>, or a <strong>Spec run</strong> for its <strong>Spec PR</strong>, does from its worktree once its work begins. It runs the opening session (the implement session, or the <strong>Spec review</strong>), pushes, marks the pull request ready, keeps it mergeable and green through the <strong>Repair loop</strong>, and, in a <strong>Ticket run</strong> that Self-merges, does the <strong>Self-merge</strong>.</p>
+<p>When thirdshift&#39;s own GitHub reads or writes hit primary quota exhaustion, the running <strong>Command</strong> records a <strong>Quota wait</strong>, waits until reset plus one minute and a random 0–60 seconds, then retries the same call. This includes CI watch and Delivery&#39;s pull request updates, labels, comments and Self-merge, across Ticket, Spec, Review, Fix, Security and Triage runs, Custom processes and work a Pass dispatched. The Command and its child Ticket runs share a two-hour total wait cap; a call that would exceed it fails as before. A secondary-limit failure instead waits 60 seconds and retries up to five times, without recording a Quota wait.</p>
+<p>While waiting, <code>status</code>, <code>show</code> and the Console show <code>Quota wait until &lt;time&gt;</code> as the stage; afterwards the previous stage resumes. Slow timing includes the wait. Stop or another interruption ends an ordinary wait immediately. Claim ending, Failed ticket run salvage, confirmed Self-merge completion and Spec accounting still wait within the cap after interruption. A Quota wait itself is no failure and adds no <code>agent-failed</code> label. Agent sessions&#39; own <code>gh</code> calls keep their existing behavior.</p>
 <p>For a Spec PR, Delivery ends Ticket accounting&#39;s capture before the Spec review, allowing that session to replace the PR. The first successful observation after the opening session, or during Failed ticket run completion after an opening failure, captures one pull request number and URL in the issue&#39;s repository; all later observations and transitions use that identity. Readiness and every mergeability poll validate its expected <strong>Issue branch</strong> and <strong>Base branch</strong>, open state and readiness where required. A missing, closed or retargeted captured PR fails Delivery; a replacement from the same branch is never substituted.</p>
 <p>A Delivery that fails takes the <strong>Failed ticket run</strong> path, drafting that same captured open PR after preserving work. Spec PR checklist restoration uses that Delivery capture before readiness and for final accounting after failure.</p>
 <p>If a Delivery gate observes that its pull request has already merged into the expected Base branch, and its merged head includes all local work (the exact local head, with no uncommitted changes), the Ticket run ends as merged, even when it originally asked only for ready for review. Delivery stops further publication, PR edits and Self-merge work. A merged PR that leaves local work out still fails and retains that work; a merged state alone never establishes completion.</p>
@@ -193,7 +196,7 @@
 <p>For each repository and kind of Pass whose latest Activity log line is a skip, status also shows that Pass as idle with its reason, even when the skip is older than another kind&#39;s activity. A later start or end for that kind clears its idle entry. For example:</p>
 <pre><code class="language-text">Architect run idle on acme/widgets: Ready issue #7 &quot;Make widgets&quot; goes first: https://github.com/acme/widgets/issues/7
 </code></pre>
-<p><code>status</code> and the Console Inbox also show <code>Pickup last fired &lt;age&gt; ago on &lt;owner&gt;/&lt;repo&gt;</code> (and the equivalent for Architect and Security), even when repeated Passes skip for the same reason. Every Pass saves its start once its repository is known, before launch checks and the Command limit, in <code>&lt;logs.dir&gt;/&lt;owner&gt;/&lt;repo&gt;/&lt;pickup|architect|secure|review|fix|triage&gt;.last-fired</code>. This replaces the previous time without adding Activity log lines. A repository with no saved start has no last-fired entry; older Activity log times are not used as evidence that the scheduler recently fired.</p>
+<p><code>status</code> and the Console Inbox also show <code>Pickup last fired &lt;age&gt; ago on &lt;owner&gt;/&lt;repo&gt;</code> (and the equivalent for Architect and Security), even when repeated Passes skip for the same reason. Beside those lines, <code>GitHub Quota wait until &lt;time&gt;</code> appears while this machine has a Quota wait and disappears after its reset. Every Pass saves its start once its repository is known, before launch checks and the Command limit, in <code>&lt;logs.dir&gt;/&lt;owner&gt;/&lt;repo&gt;/&lt;pickup|architect|secure|review|fix|triage&gt;.last-fired</code>. This replaces the previous time without adding Activity log lines. A repository with no saved start has no last-fired entry; older Activity log times are not used as evidence that the scheduler recently fired.</p>
 <p>When no Commands are running, each bullet in the Inbox&#39;s <strong>Last recorded skipped Passes</strong> and <strong>Last fired Passes</strong> starts with its recorded date and time. A skipped reason uses its Activity log time, which repeated skips do not advance; a last-fired entry uses the saved Pass start and keeps its relative age. An unreadable skip time shows <strong>Time unknown</strong>.</p>
 <p><code>thirdshift cronjobs</code> and the Console&#39;s Cron jobs page group this account&#39;s thirdshift crontab entries alphabetically by full <code>owner/repo</code>, preserving crontab order and duplicate jobs within each group. A literal <code>cd &lt;directory&gt; &amp;&amp; ... thirdshift ...</code> command is associated through that directory&#39;s GitHub <code>origin</code> remote on the owning machine, using the same quoted and home paths as Launch directory discovery. Unresolved entries stay visible in a trailing <strong>Other</strong> group. Cron command text is never executed. The page gives each group its own terminal-style block, with <strong>Run Passes now</strong> and <strong>Last fired by repository</strong> kept separately below.</p>
 <p><code>cronjobs --json</code> and <code>/api/v1/cronjobs</code> retain the object with a flat <code>jobs</code> array in group order (each entry&#39;s <code>schedule</code>, <code>command</code>, nullable <code>repository</code> and nullable <code>command_kind</code>) and independent <code>pass_starts</code>. Command kinds are recognized conservatively from literal CLI arguments; unknown or shell-dependent invocations remain visible. A selected Fleet machine supplies its own repository associations; older inventories without that metadata display under <strong>Other</strong>. The starts include manually launched Passes and other schedulers; they do not prove a particular cron entry fired. Both this inventory and <code>status --json</code> expose <code>pass_starts</code> entries with <code>repository</code>, <code>kind</code>, RFC 3339 <code>last_fired_at</code> and nonnegative <code>age_seconds</code>.</p>
@@ -2828,6 +2831,7 @@
 <p>Setup validates the Credentials before asking questions on a terminal. For email, <code>email-test</code>, the Console and a Run or a Pass that asks for a notification read them only when <code>RESEND_API_KEY</code> is unset or empty. A missing file just means no key from it. The file accepts quoted <code>resend.key</code>, <code>claude.setup_token</code> and <code>opencode.api_key</code> values, and an <code>[opencode.keys]</code> table of quoted keys by OpenCode provider name. Invalid TOML, unknown sections or keys (such as <code>kye</code>), and values of other types stop the command with exit <code>1</code>, naming the file and the offending key, and nothing is sent. An OpenCode Trial&#39;s provider key goes there by hand until <code>setup</code> asks for it: one per provider under <code>[opencode.keys]</code>, such as <code>fireworks-ai = &quot;…&quot;</code> and <code>baseten = &quot;…&quot;</code>, or a single <code>api_key</code> under <code>[opencode]</code> for any provider without its own. Each OpenCode session takes the key for the provider its Model names, so two OpenCode sessions on different providers, such as two Graders in a Grader panel, each get their own; without one, an OpenCode Trial fails before its session starts. A Grok Trial signs its own Trials home in once, with <code>GROK_HOME=~/.thirdshift/trials/grok grok login</code>; without that login, a Grok Trial fails before its session starts. One that others can read is still used, with a <code>warning:</code> line on stderr saying to <code>chmod 600</code> it. Nothing is sent to check the key itself. When Resend accepts the email, it prints <code>accepted by Resend; check your inbox</code> and exits <code>0</code>; that is all it can verify, so check that the email arrives. When Resend refuses it, for example for a bad key or a sender it won&#39;t send from, it prints Resend&#39;s error text word for word, with where the key came from, and exits <code>1</code>. It gives up after 30 seconds without an answer.</p>
 <details class="fold"><summary><h4>Run notifications</h4></summary>
 <div class="manual-content" id="run-notifications">
+<p>A Command that waited for primary GitHub quota includes one line, <code>Waited &lt;duration&gt; for the GitHub quota (&lt;resource&gt;)</code>, totaling its waits and its child Ticket runs&#39; waits. A Command that never waited has no such line; secondary-limit retries add none.</p>
 <p><code>--email</code> (or <code>email</code>) asks a Ticket run for a <strong>Run notification</strong>: one email, sent when the Ticket run ends, whatever the outcome. The word after the flag is the address only if it contains <code>@</code> and doesn&#39;t start with <code>https://</code>, so the Issue URL is never taken for it; otherwise the email goes to the matching <code>email.to_by_repo</code> entry, falling back to <code>email.to</code>. With <code>email.always = true</code> in the <a href="#user-config">User config</a>, a Ticket run asks for one without the flag, and <code>--no-email</code> (or <code>no-email</code>) skips it for that Ticket run; an address after <code>--email</code> still wins over both configured recipients. Giving a flag twice, or any two of <code>--email</code>, <code>--email-unless-merged</code> and <code>--no-email</code>, is an argument error.</p>
 <p><code>--email-unless-merged</code> (or <code>email-unless-merged</code>), optionally followed by an address as <code>--email</code> is, asks for a Run notification that is emailed only when the command did not end <code>merged</code>, whatever else it ended as. A merged one is still saved beside the <a href="#logs">Command log</a>, with nothing sent, unless it is a <a href="#security-runs">Security run</a> whose fix left its finding open or whose audit left findings waiting for the Day shift: that one is emailed. It makes the same checks as <code>--email</code> before any work.</p>
 <p>A Ticket run that asks for a notification, by either flag or by <code>email.always</code> or <code>email.unless_merged</code>, makes the same checks as <code>email-test</code> before any other work: an address is known, and a key is found, in <code>RESEND_API_KEY</code> or else the Credentials. If either fails, or the Credentials are broken, the Ticket run stops, exits <code>1</code> naming what&#39;s wrong (with no key, the message above listing every way to give one), and sends nothing. A Ticket run that asks for no notification never reads the Credentials, so a broken file can&#39;t stop it, and <code>update</code>, <code>version</code> and <code>help</code> never read it either. Once they pass, every way the Ticket run ends sends exactly one notification, after its outcome is final and its cleanup done: ready for review, merged, a <a href="#failed-ticket-runs">Failed ticket run</a> (including a later preflight failure such as an origin mismatch), or interrupted by Ctrl-C, SIGTERM or a closed terminal.</p>
@@ -3458,6 +3462,7 @@
 <p>The <code>PATH</code> line, the <code>cd</code> and <code>base main</code> and the logins are as in <a href="#on-a-schedule">On a schedule</a>. Set <code>activity.quiet_skips = true</code> in the User config too, so the skips leave the log file alone: each is in the repository&#39;s <a href="#logs">Activity log</a>, once per change of reason.</p>
 <p>Most passes are skipped, and that is what paces frequent Architect runs. A pass is skipped while:</p>
 <ul>
+<li><strong>GitHub is in a Quota wait or below the reserve</strong>: every Pass checks the machine&#39;s Quota wait record, then <code>gh api rate_limit</code>, before any other GitHub work or taking a Command-limit slot. Either fewer than 500 REST requests or fewer than 500 GraphQL points records a Quota wait until that resource resets. This covers Pickup, Architect, Security, Triage without a Report or issue, Review with <code>--author</code>, Fix without a pull request, and a Custom process without an issue, whether started by cron or by a person. A quota check that fails for a reason other than exhaustion lets the Pass proceed. A quota skip exits <code>0</code>, prints nothing on stdout and sends no Run notification. Its Activity log reason, <code>skipped: GitHub Quota wait until &lt;time&gt; (&lt;resource&gt;: &lt;n&gt; left)</code>, is recorded only when it changes for that kind;</li>
 <li><strong>a run is still going</strong>: the repository is at its Command limit, a Pass&#39;s Spec run or Ticket run counted, or another Architect run is running there (<a href="#the-command-limit">The Command limit</a>);</li>
 <li><strong>an Architect plan is open</strong>: one whose pull request waits for review, one whose run failed, or one published with <code>--plan-only</code> and not yet built (<a href="#one-architect-plan-at-a-time">One Architect plan at a time</a>);</li>
 <li><strong>an Architect idea waits for triage</strong>, since the factory has run out of Strong ideas (<a href="#an-architect-idea-waits-for-triage">An Architect idea waits for triage</a>);</li>
@@ -3631,9 +3636,10 @@
 </code></pre>
 <p>The <code>PATH</code> line, the <code>cd</code> and <code>base main</code>, the log file&#39;s directory, the logins the Harness&#39;s CLI and <code>gh</code> need, and schedulers other than cron are as for an Architect run: see its <a href="#on-a-schedule">On a schedule</a>. What differs for a Pickup run:</p>
 <ul>
+<li><strong>Budget per GitHub user across hosts.</strong> Every host authenticated as the same GitHub user shares one quota across repositories. Budget Pass frequency per user across all those hosts, rather than giving each host or repository a separate quota budget. A machine&#39;s Quota wait record is local; the shared GitHub quota still applies everywhere.</li>
 <li><strong>The interval</strong> sets how soon a Ready issue is taken and how much work is started: a pass takes one issue, so <code>*/30</code> starts at most one every half hour. A pass lasts as long as the run it dispatched, and the passes that fire meanwhile are skipped, so at the default <a href="#the-command-limit">Command limit</a> of 1 the schedule builds one issue of a repository at a time on a machine, and the first pass after it ends takes the next, unless the repository is by then at its <a href="#the-failure-limit">Failure limit</a>: at 3 failures left for you, or the <code>pickup.failure_limit</code> you set, the passes take nothing until you have dealt with one. A pull request left for review never holds them back. An issue you have just labelled also waits five minutes by default, or the <code>pickup.wait_minutes</code> you set, until it is settled. A Ticket run you start by hand on an Issue URL never waits for a pass, but it fills a slot, so at the limit it makes one skip. Raise <code>pass.command_limit</code> to let a repository&#39;s passes overlap.</li>
 <li><strong>One line per repository.</strong> thirdshift keeps no list of repositories. Each Pass on one repository skips at its <a href="#the-command-limit">Command limit</a>, 1 by default, so both lines can go in one crontab and, by default, two Passes never build that repository at once. Passes on different repositories do run at the same time: give their lines different minutes, such as <code>15,45</code>, if they would compete for the machine.</li>
-<li><strong>A pass is skipped</strong> when the repository is at its <a href="#the-command-limit">Command limit</a>, when the repository has no Ready issue, and when it is at its Failure limit. A skip exits <code>0</code>, so the scheduler sees no failure, and sends no email, even with Run notifications on. The repository&#39;s <a href="#logs">Activity log</a> records a skip when its reason changes. Unless <code>activity.quiet_skips</code> is set, the log file holds each skip&#39;s line too, and before the line of a pass that found no Ready issue, as before the line of one that took an issue, <a href="#why-an-issue-was-passed-over">why each issue was passed over</a>. A pass skipped for the Command limit or the Failure limit looks at no issue, so it has no such lines.</li>
+<li><strong>A pass is skipped</strong> during a GitHub Quota wait or below the 500-unit reserve, when the repository is at its <a href="#the-command-limit">Command limit</a>, when the repository has no Ready issue, and when it is at its Failure limit. A skip exits <code>0</code>, so the scheduler sees no failure, and sends no email, even with Run notifications on. The repository&#39;s <a href="#logs">Activity log</a> records a skip when its reason changes. Unless <code>activity.quiet_skips</code> is set, the log file holds each skip&#39;s line too, and before the line of a pass that found no Ready issue, as before the line of one that took an issue, <a href="#why-an-issue-was-passed-over">why each issue was passed over</a>. A pass skipped for quota, the Command limit or the Failure limit looks at no issue, so it has no such lines.</li>
 <li><strong>A Run notification</strong>, by <code>email.always = true</code> or <code>email.unless_merged = true</code> in the <a href="#user-config">User config</a>, or <code>email</code> or <code>email-unless-merged</code> on the line, is sent <a href="#one-run-notification-for-the-issue-taken">only for an issue taken</a>. So a day without email doesn&#39;t say the passes are running: a pass that fails before it takes an issue, on a broken User config, a missing Resend key or a failed check, shows up only in the log file.</li>
 </ul>
 <p>A whole crontab with both frequent Architect runs and a Pickup run on one repository looks like this, with <code>activity.quiet_skips = true</code> in the User config, every line sending its output to the one log file, which catches only what went wrong, so <code>tail ~/.thirdshift/logs/acme/widgets/activity.log</code> shows what the factory has been doing on the repository lately:</p>
diff --git a/site/how-it-works/index.html b/site/how-it-works/index.html
index fe0c84579..03808b366 100644
--- a/site/how-it-works/index.html
+++ b/site/how-it-works/index.html
@@ -124,6 +124,7 @@ <h1>How thirdshift works</h1>
     <details class="wrap guide-section fold">
       <summary class="sec-head"><p class="eyebrow">04 / From a published change to a checked result</p><h2 id="delivery-title">Deliver against the latest Base branch</h2></summary>
       <div class="guide-content" id="delivery">
+      <p>A running Command whose own GitHub call hits primary quota exhaustion waits until reset plus one minute and a random 0–60 seconds, then retries. CI watch and Delivery share a two-hour total cap with child Ticket runs. A secondary limit gets up to five retries, 60 seconds apart. During a primary wait, <code>status</code>, <code>show</code> and the Console show <code>Quota wait until &lt;time&gt;</code>; Slow timing includes the wait. Stop interrupts ordinary waits; Claim ending and other completion work still finish within the cap. The Run notification totals primary waits in one <code>Waited &lt;duration&gt; for the GitHub quota (&lt;resource&gt;)</code> line. Waiting itself adds no <code>agent-failed</code>; agent sessions' own <code>gh</code> calls are unchanged.</p>
       <p>A pull request existing is not the finish line. <strong>Delivery</strong> runs the opening session, then keeps the captured pull request mergeable and checks CI. This orchestration is thirdshift's code; a <strong>Repair</strong> is another agent session started when the branch needs work.</p>
       <p>For an existing open pull request, <code>thirdshift fix &lt;PR URL or number&gt;</code> starts a <a href="/docs/#fix-runs">Fix run</a> directly at Delivery. Ready and draft PRs by Trusted accounts are accepted, with or without closing issues. It uses the PR's own Base branch, reserves the PR while running and gives each Repair trusted PR and linked-issue context. The usual merge, Base fix, Harness and email defaults apply; failure preserves work and offers <code>thirdshift fix</code> again.</p>
       <p>With no PR target, <code>thirdshift fix [base &lt;branch&gt;] [--author &lt;login&gt;]</code> is a Pass. Without <code>--author</code>, it first checks the Base branch's origin tip: a failed first push attempt gets one failed-jobs re-run, then PR selection continues without waiting. Persistent or non-rerunnable failures get a CI-fix session on <code>fix-&lt;base&gt;-&lt;short-sha&gt;</code> and a repair PR targeting the Base branch, treating every red check as its own; that Fix run ends the Pass. Existing PRs from that branch prevent duplicates, failed drafts included. Merge and email policy apply, and Self-merge closes the Base branch's CI-red reports and Base fix issues.</p>
@@ -244,6 +245,7 @@ <h1>How thirdshift works</h1>
   <section class="sec" aria-labelledby="scheduled-title">
     <details class="wrap guide-section fold">
       <summary class="sec-head"><p class="eyebrow">07 / Where the next issue comes from</p><h2 id="scheduled-title">Choose how the next work starts</h2></summary>
+      <p>Every Pass checks the machine's GitHub Quota wait, then the quota, before other GitHub work or taking a Command-limit slot. It skips during a wait or below 500 REST requests or GraphQL points, with no stdout or Run notification. Pickup, Architect, Security, Triage without input, Review with <code>--author</code>, Fix without a pull request and issue-less Custom processes all follow this rule, from cron or by hand. The Activity log records each kind's changed reason; <code>status</code> and the Inbox show the wait beside last-fired Passes until reset. Budget Pass frequency per GitHub user across all hosts and repositories sharing that user's quota.</p>
       <div class="guide-content" id="scheduled">
       <p>Review Passes recognize reviewed and pushed heads only in comments by the GitHub account thirdshift acts as. When an upper pull request lacks Review run fixes delivered to its base, its comment says it needs updating before merge; the author updates the stack.</p>
       <p>A Review retry recovers its clean retained checkout only after verifying ownership, the same captured PR head and descendant commits. Other local conflicts stay preserved: author Passes notify once per state and scan later waiting pull requests; explicit PR targets fail with recovery advice.</p>
diff --git a/site/index.html b/site/index.html
index a1a9cec9c..ccd8e2b88 100644
--- a/site/index.html
+++ b/site/index.html
@@ -461,6 +461,7 @@ <h2 id="grows-title">Seven workflows</h2>
         <details class="workflow">
           <summary>Schedules and passes</summary>
           <div class="workflow-content">
+            <p>Every Pass skips during a GitHub Quota wait or below 500 REST requests or GraphQL points, before other GitHub work and without taking a Command-limit slot or sending a Run notification. This includes Review with <code>--author</code>, Fix without a pull request and issue-less Custom processes, whether started by cron or by hand. The Activity log records the reason only when it changes for that kind; <code>status</code> and the Console Inbox show the Quota wait beside the last-fired lines until reset. Budget Pass frequency per GitHub user across hosts and repositories: hosts authenticated as the same user share one quota.</p>
             <p>Start passes with <code>thirdshift architect base main</code>, <code>thirdshift pickup base main</code>, <code>thirdshift triage base main</code> or <code>thirdshift secure base main</code>. A Custom process started with no issue, and neither an Issue-branch nor a Spec-branch worktree, follows the same <a href="/docs/#the-command-limit">Command limit</a>, running beside other Passes up to it, and does not wait on a Ready issue or an Architect idea. A file that declares either branch worktree is refused when no issue is given, before any session. Your operating system schedules them. <code>[pass] command_limit</code>, 1 by default, is how many Commands on one repository on the machine skip a Pass there; raise it to let Passes overlap: Pickup runs, one Architect run and one Security run side by side, never two Architect runs or two Security runs. A Ticket run you start on an Issue URL counts toward it, but is never refused. <code>thirdshift status</code>, <code>thirdshift cronjobs</code> and the Console show when each repository's Pickup, Architect and Security Pass last fired, including repeated skips. <a href="/docs/#architect-runs-every-few-minutes">Architect runs every few minutes</a> and <a href="/docs/#security-runs-on-a-schedule-with-fixing-allowed">Security runs on a schedule, with fixing allowed</a>. Both yield to work the Day shift shaped, and pause when a decision needs you.</p>
           </div>
         </details>
diff --git a/src/architect.rs b/src/architect.rs
index 4511ffc9e..436f0364c 100644
--- a/src/architect.rs
+++ b/src/architect.rs
@@ -27,7 +27,7 @@ use anyhow::{Context, Result, bail};
 use chrono::{DateTime, Utc};
 
 use crate::asks::Flags;
-use crate::command_limit::{AlreadyRunning, PassKind, Sharing};
+use crate::command_limit::{NotAdmitted, PassKind, Sharing};
 use crate::config::UserConfig;
 use crate::failed_run::FailedRun;
 use crate::github::{Issue, ListedIssue};
@@ -83,10 +83,11 @@ pub enum Outcome {
 /// skipped run's progress line gives it.
 #[derive(Debug)]
 pub enum Skipped {
-    /// Its repository is at its Command limit on this machine, the Spec run
+    /// GitHub is in a Quota wait, or its repository is at its Command limit
+    /// on this machine, the Spec run
     /// or Run each Pass dispatched counted, or another Architect run is
     /// still running there.
-    AlreadyRunning(AlreadyRunning),
+    NotAdmitted(NotAdmitted),
     /// These Architect plans are still open on this repository: at least
     /// one.
     OpenPlans(Vec<ListedIssue>),
@@ -106,7 +107,7 @@ impl Skipped {
     /// its start, at the Command limit or beside another Architect run.
     pub fn urls(&self) -> Vec<&str> {
         match self {
-            Self::AlreadyRunning(_) => Vec::new(),
+            Self::NotAdmitted(_) => Vec::new(),
             Self::OpenPlans(issues) | Self::IdeasWaiting(issues) => issues
                 .iter()
                 .map(|listed| listed.issue.url.as_str())
@@ -121,7 +122,7 @@ impl Skipped {
 impl fmt::Display for Skipped {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match self {
-            Self::AlreadyRunning(running) => running.fmt(f),
+            Self::NotAdmitted(running) => running.fmt(f),
             Self::OpenPlans(plans) => write_joined(f, plans, |plan, title| {
                 format!(
                     "Architect plan #{} \"{title}\" is still open: pick it up with thirdshift {}",
@@ -313,9 +314,9 @@ pub fn run(
         Sharing::OneOfAKind(PassKind::Architect),
     ) {
         Ok(Start::Clear(launch)) => launch,
-        Ok(Start::AlreadyRunning(running)) => {
+        Ok(Start::NotAdmitted(running)) => {
             logs::skipped(Pass::Architect, &running.repo, &running);
-            return Outcome::Skipped(Skipped::AlreadyRunning(running));
+            return Outcome::Skipped(Skipped::NotAdmitted(running));
         }
         Err(error) => return failed(error.into()),
     };
diff --git a/src/command.rs b/src/command.rs
index 7df3767af..a7e60cd73 100644
--- a/src/command.rs
+++ b/src/command.rs
@@ -116,6 +116,9 @@ pub fn start(
     // First, so no interrupt can end the command once its notification is
     // checked.
     interrupt::install().map_err(|error| failure(&error))?;
+    if let About::Issue(issue) = &about {
+        logs::preflight_issue(issue);
+    }
     let notification = if started.is_some() {
         Some(
             RunNotification::new(ask(&config), &config.email, about)
@@ -186,6 +189,14 @@ impl Started {
             | Ending::Security(_)
             | Ending::Skipped(_) => None,
         };
+        // progress::step keeps lines in a Command log a Quota wait may already
+        // have opened. The raw pre-audit diagnostic stays on the terminal.
+        if let Some(diagnostic) = account
+            .pre_audit_failure
+            .and(account.ended.as_ref().err().map(|cause| cause.full()))
+        {
+            eprintln!("{diagnostic}");
+        }
         let code = account.show(elapsed);
         if let Some(notification) = self.notification {
             notification.finish(&account);
diff --git a/src/command_limit.rs b/src/command_limit.rs
index 0e6e47ec3..b138a3bb8 100644
--- a/src/command_limit.rs
+++ b/src/command_limit.rs
@@ -13,6 +13,9 @@
 //! one repository at once. A Pickup run or an issue-less Custom process
 //! takes no lock of a kind.
 //!
+//! Quota admission comes before remote preparation and slot acquisition.
+//! A Quota wait skips every Pass without holding any of these locks.
+//!
 //! A Pass also tries a shared lock on the file a thirdshift from before the
 //! Command limit locks exclusively. Every overlapping newer Pass keeps its
 //! shared lock until it ends, so an older Pass cannot start until they all
@@ -65,19 +68,28 @@ impl PassKind {
     }
 }
 
-/// Why a Pass is skipped at its start, on `repo`, at the Command `limit`.
+/// Why a Pass is skipped at admission, on `repo`.
 /// Its `Display` is the reason, as the skipped run gives it.
 #[derive(Debug)]
-pub struct AlreadyRunning {
+pub struct NotAdmitted {
     pub repo: Repo,
     limit: NonZeroUsize,
     why: Why,
 }
 
+impl NotAdmitted {
+    pub fn is_quota_wait(&self) -> bool {
+        matches!(self.why, Why::QuotaWait(_))
+    }
+}
+
 #[derive(Debug)]
 enum Why {
+    QuotaWait(String),
     /// `running` Commands are running, at or over the limit.
-    AtLimit { running: usize },
+    AtLimit {
+        running: usize,
+    },
     /// Another Pass of this one's kind is running.
     SameKind(PassKind),
     /// A thirdshift from before the Command limit is running an exclusive
@@ -85,10 +97,11 @@ enum Why {
     Older,
 }
 
-impl fmt::Display for AlreadyRunning {
+impl fmt::Display for NotAdmitted {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         let (repo, limit) = (self.repo.slug(), self.limit);
         match self.why {
+            Why::QuotaWait(ref reason) => f.write_str(reason),
             Why::AtLimit { running } => write!(
                 f,
                 "at the Command limit on {repo}: {}, pass.command_limit is {limit}",
@@ -100,6 +113,16 @@ impl fmt::Display for AlreadyRunning {
     }
 }
 
+/// Check quota before any remote preparation or Command-limit slot. Probe
+/// failures other than exhaustion preserve the existing admission behavior.
+pub fn quota_wait(repo: &Repo, limit: NonZeroUsize) -> Option<NotAdmitted> {
+    Some(NotAdmitted {
+        repo: repo.clone(),
+        limit,
+        why: Why::QuotaWait(crate::github::GitHub::new().pass_quota_wait()?),
+    })
+}
+
 /// "1 Command is running", or "`n` Commands are running".
 fn commands_running(n: usize) -> String {
     match n {
@@ -136,11 +159,11 @@ pub fn hold_pass(
     repo: &Repo,
     limit: NonZeroUsize,
     sharing: Sharing,
-) -> Result<Option<AlreadyRunning>> {
+) -> Result<Option<NotAdmitted>> {
     let slots = Slots::of(repo)?;
     let _counting = slots.counting()?;
     let skipped = |why| {
-        Ok(Some(AlreadyRunning {
+        Ok(Some(NotAdmitted {
             repo: repo.clone(),
             limit,
             why,
diff --git a/src/console/changes.rs b/src/console/changes.rs
index 883183cf9..b5c96fff5 100644
--- a/src/console/changes.rs
+++ b/src/console/changes.rs
@@ -10,6 +10,8 @@ use anyhow::Result;
 use notify::{Event, EventKind, RecursiveMode, Watcher};
 use tokio::sync::watch;
 
+use crate::github::{GitHub, QuotaWait};
+
 #[derive(Clone, Copy, Default, PartialEq)]
 pub(super) struct Revision {
     pub commands: u64,
@@ -70,6 +72,7 @@ struct Paths {
     other_logs: Vec<PathBuf>,
     executable: PathBuf,
     assets: Option<PathBuf>,
+    quota_warning: Mutex<Option<String>>,
 }
 
 impl Paths {
@@ -80,6 +83,7 @@ impl Paths {
             other_logs: Vec::new(),
             executable: observed_path(&executable),
             assets: None,
+            quota_warning: Mutex::new(None),
         }
     }
 
@@ -140,6 +144,16 @@ impl Paths {
             if path == self.root.join("console-accounts.json") {
                 revision.accounts += 1;
             }
+            if path == self.root.join("github-quota.json") {
+                // Identity-cache bookkeeping shares this file with waits.
+                // Wake readers only when their displayed quota state changes.
+                let current = quota_warning();
+                let mut previous = self.quota_warning.lock().unwrap();
+                if *previous != current {
+                    *previous = current;
+                    revision.commands += 1;
+                }
+            }
             if path.starts_with(&self.logs)
                 || self.logs.starts_with(&path)
                 || self
@@ -207,6 +221,10 @@ impl Paths {
     }
 }
 
+fn quota_warning() -> Option<String> {
+    QuotaWait::warning(&GitHub::new().quota_waits().unwrap_or_default())
+}
+
 // Native backends may report canonical paths.
 // Resolve the existing ancestor so roots created later use the same spelling.
 pub(super) fn observed_path(path: &std::path::Path) -> PathBuf {
@@ -228,6 +246,7 @@ pub(super) fn observe(
         config.logs_dir.clone(),
         executable.path.clone(),
     );
+    paths.quota_warning = Mutex::new(quota_warning());
     paths.assets = assets.directory().map(PathBuf::from);
     paths.other_logs = crate::logs::accounts::discover(config)
         .logs
@@ -298,6 +317,10 @@ pub(super) fn observe(
             }
             reconcile(&mut watcher, &mut watched, &paths.read().unwrap());
             reconcile(&mut recovery, &mut recovered, &paths.read().unwrap());
+            if revision.commands != previous.commands {
+                // Clock-driven notices also advance the displayed quota state.
+                *paths.read().unwrap().quota_warning.lock().unwrap() = quota_warning();
+            }
             sender.send_if_modified(|current| {
                 let before = *current;
                 if revision.commands != previous.commands {
diff --git a/src/console/inbox.html b/src/console/inbox.html
index d7812cb22..bca1cc2ef 100644
--- a/src/console/inbox.html
+++ b/src/console/inbox.html
@@ -63,6 +63,7 @@ <h3>{% if machines.len() > 1 %}No Commands are running in this Fleet.{% else %}N
       {% endif %}
     </section>
     {% endif %}
+    {% match inbox.github_quota_wait %}{% when Some with (wait) %}<p class="github-quota-wait" role="status">{{ wait }}</p>{% when None %}{% endmatch %}
     {% for section in inbox.sections %}
     <details id="group-{{ loop.index }}" class="group" data-group="{{ section.group }}" aria-label="{{ section.title }}"{% if self.in_overview(section.group) %} data-overview{% endif %}{% if !self.shown(section.group) %} hidden{% endif %} open>
       <summary><h3>{{ section.title }} <span class="count">{{ section.rows.len() }}</span></h3></summary>
diff --git a/src/fix.rs b/src/fix.rs
index e31578d8d..4232c0deb 100644
--- a/src/fix.rs
+++ b/src/fix.rs
@@ -44,7 +44,7 @@ pub(crate) fn run(
                 crate::command_limit::Sharing::UpToTheLimit,
             )? {
                 crate::launch::Start::Clear(launch) => launch,
-                crate::launch::Start::AlreadyRunning(running) => {
+                crate::launch::Start::NotAdmitted(running) => {
                     return Ok(skipped(&running.repo, running.to_string()));
                 }
             };
diff --git a/src/github.rs b/src/github.rs
index b39fa8f0b..c10093a4f 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -20,9 +20,9 @@ pub const GENERATED: &str = "This comment was generated by AI.";
 
 mod check_read;
 pub(crate) mod evals;
-mod quota;
+pub(crate) mod quota;
 pub(crate) use check_read::is_transient as check_read_is_transient;
-pub(crate) use quota::{Quota, Quotas};
+pub(crate) use quota::{Quota, QuotaWait};
 
 mod advisories;
 mod base_ci;
@@ -98,18 +98,21 @@ pub(crate) fn operational_cause(error: &anyhow::Error) -> Option<&'static str> {
 /// independently without changing the recorded request or other views.
 pub struct GitHub {
     interruption: Interruption,
+    wait_for_quota: bool,
 }
 
 impl GitHub {
     pub fn new() -> Self {
         Self {
             interruption: Interruption::Ordinary,
+            wait_for_quota: true,
         }
     }
 
     pub fn completion(&self) -> Self {
         Self {
             interruption: Interruption::Completion,
+            wait_for_quota: self.wait_for_quota,
         }
     }
 
@@ -775,15 +778,12 @@ impl GitHub {
     }
 
     /// What GitHub last showed for one batch of up to a hundred issues and pull requests.
-    /// The Inbox checks the returned quota before asking for another batch. Each
+    /// The Inbox checks the shared quota before asking for another batch. Each
     /// alias asks for state and settlement times (plus issue triage labels),
     /// and for the query's own `rateLimit`. A subject GitHub can't
     /// resolve answers null and stays out of the map, without failing the
     /// rest of the read. Only reads; nothing here writes to GitHub.
-    pub(crate) fn inbox_states(
-        &self,
-        urls: &[String],
-    ) -> Result<(BTreeMap<String, InboxState>, Quota)> {
+    pub(crate) fn inbox_states(&self, urls: &[String]) -> Result<BTreeMap<String, InboxState>> {
         let mut states = BTreeMap::new();
         let mut query = String::from("query {");
         let mut aliases = Vec::new();
@@ -841,6 +841,7 @@ impl GitHub {
         })?;
         let data = &json["data"];
         let quota = Quota::graphql(&data["rateLimit"])?;
+        self.observe_quota(quota::Resource::Graphql, quota)?;
         for (alias, url, subject) in aliases {
             if json["errors"]
                 .as_array()
@@ -855,7 +856,7 @@ impl GitHub {
             }
             states.insert(url.clone(), subject.read(&url, pull)?);
         }
-        Ok((states, quota))
+        Ok(states)
     }
 
     /// Open a draft pull request from `head` into `base`, and return its URL.
@@ -1278,6 +1279,36 @@ impl GitHub {
     }
 
     fn output_with_input(&self, args: &[&str], input: Option<&[u8]>) -> Result<Output> {
+        let mut secondary_retries = 0;
+        loop {
+            let output = self.raw_output_with_input(args, input)?;
+            if output.status.success() {
+                return Ok(output);
+            }
+            match quota::Limit::of(args, &output.stderr) {
+                Some(quota::Limit::Primary(resource)) => {
+                    let reset = self.record_quota_failure(args, resource);
+                    if !self.wait_for_quota
+                        || !quota::command::wait(reset, resource, self.interruption)?
+                    {
+                        return Ok(output);
+                    }
+                }
+                Some(quota::Limit::Secondary)
+                    if self.wait_for_quota && quota::command::active() && secondary_retries < 5 =>
+                {
+                    secondary_retries += 1;
+                    crate::progress::step(format!(
+                        "GitHub secondary limit; retry {secondary_retries}/5 in 60s"
+                    ));
+                    self.interruption.pause(quota::wait::minute())?;
+                }
+                _ => return Ok(output),
+            }
+        }
+    }
+
+    fn raw_output_with_input(&self, args: &[&str], input: Option<&[u8]>) -> Result<Output> {
         process::output(
             Command::new("gh").args(args),
             input,
diff --git a/src/github/advisories.rs b/src/github/advisories.rs
index f0440f079..15226fc36 100644
--- a/src/github/advisories.rs
+++ b/src/github/advisories.rs
@@ -735,7 +735,7 @@ impl GitHub {
 
     pub(crate) fn inbox_findings(&self, repo: &str) -> Result<BTreeMap<String, bool>> {
         self.list_security_records(repo, || {
-            if let Some(warning) = self.inbox_quotas()?.warning() {
+            if let Some(warning) = super::QuotaWait::warning(&self.inbox_quotas()?) {
                 bail!(warning);
             }
             Ok(())
diff --git a/src/github/check_read.rs b/src/github/check_read.rs
index 460750c02..cf0e4086a 100644
--- a/src/github/check_read.rs
+++ b/src/github/check_read.rs
@@ -45,10 +45,7 @@ pub(crate) fn is_transient(error: &anyhow::Error) -> bool {
     let stderr = failure.stderr.trim().to_ascii_lowercase();
     // Quota exhaustion belongs to quota-aware deferral, not a short retry.
     // gh can report GraphQL quota errors with or without an HTTP status.
-    if stderr.contains("api rate limit")
-        || stderr.contains("rate_limited")
-        || stderr.contains("rate_limit_exceeded")
-    {
+    if super::quota::Limit::of(&[], stderr.as_bytes()).is_some() {
         return false;
     }
     // gh reports HTTP status in stderr. Prefer it to incidental prose, so
diff --git a/src/github/execution_tests.rs b/src/github/execution_tests.rs
index d96c158c2..bac7b8936 100644
--- a/src/github/execution_tests.rs
+++ b/src/github/execution_tests.rs
@@ -58,6 +58,209 @@ use std::fs;
 use std::path::PathBuf;
 use std::time::{Duration, Instant};
 
+#[test]
+fn primary_quota_failure_records_a_shared_wait() {
+    with_recorded_signal(
+        "github::execution_tests::primary_quota_failure_records_a_shared_wait",
+        |_| {
+            let fixture = Fixture::new("");
+            // SAFETY: this test runs in an isolated child before any workers.
+            unsafe { std::env::set_var("HOME", fixture.temp.path()) };
+            fixture.script(
+                r#"case "$*" in
+  'api user --hostname github.com') echo '{"login":"octocat"}' ;;
+  'api rate_limit --hostname github.com')
+    echo '{"resources":{"core":{"remaining":0,"reset":4102444800}}}' ;;
+  *) echo 'API rate limit exceeded for user ID 123. (HTTP 403)' >&2; exit 1 ;;
+esac"#,
+            );
+            let error = GitHub::new().issue_title(&issue()).unwrap_err();
+            assert!(format!("{error:#}").contains("API rate limit exceeded"));
+            let path = fixture.path(".thirdshift/github-quota.json");
+            assert!(
+                path.exists(),
+                "primary quota failure left no shared Quota wait"
+            );
+            let record: Value = serde_json::from_slice(&fs::read(path).unwrap()).unwrap();
+            assert_eq!(record["waits"][0]["host"], "github.com");
+            assert_eq!(record["waits"][0]["login"], "octocat");
+            assert_eq!(record["waits"][0]["resource"], "core");
+            assert_eq!(record["waits"][0]["reset_at"], "2100-01-01T00:00:00Z");
+            assert_eq!(record["waits"][0]["remaining"], 0);
+        },
+    );
+}
+
+#[test]
+fn primary_quota_failure_scopes_graphql_and_defaults_only_unreadable_resets() {
+    with_recorded_signal(
+        "github::execution_tests::primary_quota_failure_scopes_graphql_and_defaults_only_unreadable_resets",
+        |_| {
+            for (index, response) in [
+                "{}",
+                r#"{"resources":{"graphql":{"reset":"bad"}}}"#,
+                r#"{"resources":{"graphql":{"reset":4102444800}}}"#,
+            ]
+            .into_iter()
+            .enumerate()
+            {
+                let fixture = Fixture::new("");
+                // SAFETY: isolated test process, before workers start.
+                unsafe {
+                    std::env::set_var("GH_HOST", "git.example.com");
+                    std::env::set_var("GH_ENTERPRISE_TOKEN", "test-secret-never-stored");
+                }
+                fixture.script(&format!(
+                    "case \"$1 $2\" in\n  'api user') echo '{{\"login\":\"enterprise-user\"}}' ;;\n  'api rate_limit') echo '{response}' ;;\n  *) echo 'GraphQL: RATE_LIMIT_EXCEEDED (HTTP 429)' >&2; exit 1 ;;\nesac"
+                ));
+                let before = Utc::now();
+                assert!(GitHub::new().issue_title(&issue()).is_err());
+                let after = Utc::now();
+                let bytes = fs::read(fixture.path(".thirdshift/github-quota.json")).unwrap();
+                assert!(!String::from_utf8_lossy(&bytes).contains("test-secret-never-stored"));
+                let record: Value = serde_json::from_slice(&bytes).unwrap();
+                let wait = &record["waits"][0];
+                assert_eq!(wait["host"], "git.example.com");
+                assert_eq!(wait["login"], "enterprise-user");
+                assert_eq!(wait["resource"], "graphql");
+                let reset = DateTime::parse_from_rfc3339(wait["reset_at"].as_str().unwrap())
+                    .unwrap()
+                    .to_utc();
+                if index == 2 {
+                    assert_eq!(reset.timestamp(), 4102444800);
+                } else {
+                    assert!(reset >= before + chrono::Duration::minutes(15));
+                    assert!(reset <= after + chrono::Duration::minutes(15));
+                }
+                assert!(
+                    GitHub::new()
+                        .quota_waits_for("github.com")
+                        .unwrap()
+                        .is_empty()
+                );
+                assert_eq!(
+                    GitHub::new()
+                        .quota_waits_for("git.example.com")
+                        .unwrap()
+                        .len(),
+                    1
+                );
+            }
+        },
+    );
+}
+
+#[test]
+fn a_rest_quota_failure_in_a_repository_named_graphql_keeps_the_core_resource() {
+    with_recorded_signal(
+        "github::execution_tests::a_rest_quota_failure_in_a_repository_named_graphql_keeps_the_core_resource",
+        |_| {
+            let fixture = Fixture::new("");
+            fixture.script(
+                r#"case "$1 $2" in
+  'api user') echo '{"login":"octocat"}' ;;
+  'api rate_limit') echo '{"resources":{"core":{"remaining":0,"reset":4102444800}}}' ;;
+  *) echo 'HTTP 403: API rate limit exceeded (https://api.github.com/repos/acme/graphql/issues/7/comments)' >&2; exit 1 ;;
+esac"#,
+            );
+            let issue = IssueUrl::parse("https://github.com/acme/graphql/issues/7").unwrap();
+            assert!(GitHub::new().comment_issue(&issue, "hello").is_err());
+            let waits = GitHub::new().quota_waits().unwrap();
+            assert_eq!(waits.len(), 1);
+            assert!(matches!(waits[0].resource, quota::Resource::Core));
+        },
+    );
+}
+
+#[test]
+fn changing_credentials_does_not_reuse_another_users_wait() {
+    with_recorded_signal(
+        "github::execution_tests::changing_credentials_does_not_reuse_another_users_wait",
+        |_| {
+            let fixture = Fixture::new("");
+            fixture.script(
+                r#"case "$1 $2" in
+  'api user') printf '{"login":"%s"}\n' "$GH_TOKEN" ;;
+  'api rate_limit') echo '{"resources":{"core":{"remaining":0,"reset":4102444800}}}' ;;
+  *) echo 'API rate limit exceeded' >&2; exit 1 ;;
+esac"#,
+            );
+            // SAFETY: isolated test process, before workers start.
+            unsafe { std::env::set_var("GH_TOKEN", "alice") };
+            assert!(GitHub::new().issue_title(&issue()).is_err());
+            assert_eq!(GitHub::new().quota_waits().unwrap().len(), 1);
+            unsafe { std::env::set_var("GH_TOKEN", "bob") };
+            assert!(GitHub::new().quota_waits().unwrap().is_empty());
+            assert!(GitHub::new().issue_title(&issue()).is_err());
+            assert_eq!(GitHub::new().quota_waits().unwrap().len(), 1);
+            unsafe { std::env::set_var("GH_TOKEN", "alice") };
+            assert_eq!(GitHub::new().quota_waits().unwrap().len(), 1);
+        },
+    );
+}
+
+#[test]
+fn quota_failure_does_not_treat_a_close_comment_as_a_host_selector() {
+    with_recorded_signal(
+        "github::execution_tests::quota_failure_does_not_treat_a_close_comment_as_a_host_selector",
+        |_| {
+            let fixture = Fixture::new("");
+            fixture.script(
+                r#"case "$1 $2" in
+  'api user') echo '{"login":"octocat"}' ;;
+  'api rate_limit') echo '{"resources":{"core":{"remaining":0,"reset":4102444800}}}' ;;
+  *) echo 'API rate limit exceeded' >&2; exit 1 ;;
+esac"#,
+            );
+            assert!(
+                GitHub::new()
+                    .close_issue(&issue(), "--hostname=docs.example.net")
+                    .is_err()
+            );
+            assert_eq!(
+                GitHub::new().quota_waits_for("github.com").unwrap().len(),
+                1
+            );
+            assert!(
+                GitHub::new()
+                    .quota_waits_for("docs.example.net")
+                    .unwrap()
+                    .is_empty()
+            );
+        },
+    );
+}
+
+#[test]
+fn quota_failure_uses_repository_host_instead_of_comment_url() {
+    with_recorded_signal(
+        "github::execution_tests::quota_failure_uses_repository_host_instead_of_comment_url",
+        |_| {
+            let fixture = Fixture::new("");
+            fixture.script(
+                r#"case "$1 $2" in
+  'api user') echo '{"login":"octocat"}' ;;
+  'api rate_limit')
+    echo '{"resources":{"core":{"remaining":0,"reset":4102444800}}}' ;;
+  *) echo 'API rate limit exceeded for user ID 123. (HTTP 403)' >&2; exit 1 ;;
+esac"#,
+            );
+            assert!(
+                GitHub::new()
+                    .comment_issue(&issue(), "https://docs.example.net/")
+                    .is_err()
+            );
+            let record: Value = serde_json::from_slice(
+                &fs::read(fixture.path(".thirdshift/github-quota.json")).unwrap(),
+            )
+            .unwrap();
+            assert_eq!(record["waits"][0]["host"], "github.com");
+            assert_eq!(record["waits"][0]["login"], "octocat");
+            assert_eq!(record["waits"][0]["resource"], "core");
+        },
+    );
+}
+
 /// PATH changes happen only in the isolated process. Cleanup uses the
 /// executable's recorded PID, including after a failed assertion.
 struct Fixture {
@@ -77,7 +280,11 @@ impl Fixture {
         );
         // SAFETY: this isolated process runs one test; no environment readers
         // or execution workers have started.
-        unsafe { std::env::set_var("PATH", path) };
+        unsafe {
+            std::env::set_var("PATH", path);
+            std::env::set_var("HOME", fixture.temp.path());
+            std::env::remove_var("GH_HOST");
+        }
         fixture
     }
 
@@ -407,9 +614,9 @@ printf '%s' '{{"title":"Recovered"}}'
 }
 
 #[test]
-fn permanent_and_quota_read_failures_are_not_retried() {
+fn permanent_reads_and_quota_reads_outside_a_command_are_not_retried() {
     with_recorded_signal(
-        "github::execution_tests::permanent_and_quota_read_failures_are_not_retried",
+        "github::execution_tests::permanent_reads_and_quota_reads_outside_a_command_are_not_retried",
         |_| {
             let fixture = Fixture::new("");
             for stderr in [
@@ -424,7 +631,7 @@ fn permanent_and_quota_read_failures_are_not_retried() {
                 "API rate limit exceeded for user ID 123. (HTTP 429)",
             ] {
                 fixture.script(&format!(
-                    "echo read >> '{}'\ncat >&2 <<'ERROR'\n{stderr}\nERROR\nexit 1",
+                    "case \"$1 $2\" in\n  'api user') echo '{{\"login\":\"runner\"}}'; exit 0 ;;\n  'api rate_limit') echo '{{}}'; exit 0 ;;\nesac\necho read >> '{}'\ncat >&2 <<'ERROR'\n{stderr}\nERROR\nexit 1",
                     fixture.path("reads").display()
                 ));
                 let error = GitHub::new().issue_title(&issue()).unwrap_err();
@@ -1413,7 +1620,7 @@ fn check_reads_classify_transport_and_api_failures_without_hiding_diagnostics()
                 ("read tcp: connection reset by peer", true),
                 ("net/http: TLS handshake timeout", true),
                 ("gh: too many requests (HTTP 429)", true),
-                ("GraphQL: secondary rate limit exceeded (HTTP 429)", true),
+                ("GraphQL: secondary rate limit exceeded (HTTP 429)", false),
                 ("gh: Bad Gateway (HTTP 502)", true),
                 ("gh: service unavailable (HTTP 503)", true),
                 ("gh: Gateway Timeout (HTTP 504)", true),
diff --git a/src/github/quota.rs b/src/github/quota.rs
index da759ee96..db99c6d64 100644
--- a/src/github/quota.rs
+++ b/src/github/quota.rs
@@ -1,4 +1,4 @@
-//! GitHub's two quota clocks. The Inbox leaves a fixed reserve for the factory.
+//! Shared machine-local Quota waits, Pass admission and running Command recovery.
 use anyhow::{Context, Result};
 use chrono::{DateTime, SecondsFormat, Utc};
 use serde::{Deserialize, Serialize};
@@ -6,7 +6,33 @@ use serde_json::Value;
 
 use super::GitHub;
 
-#[derive(Clone, Serialize, Deserialize)]
+pub(crate) mod command;
+mod identity;
+mod store;
+#[cfg(test)]
+mod tests;
+pub(crate) mod wait;
+
+pub(crate) use store::QuotaWait;
+use store::Store;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub(crate) enum Resource {
+    Core,
+    Graphql,
+}
+
+impl Resource {
+    fn name(self) -> &'static str {
+        match self {
+            Self::Core => "core",
+            Self::Graphql => "graphql",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
 pub(crate) struct Quota {
     remaining: u64,
     reset_at: DateTime<Utc>,
@@ -39,46 +65,199 @@ impl Quota {
         })
     }
 
-    fn low(&self) -> bool {
-        self.remaining < 500 && self.reset_at > Utc::now()
+    fn low(&self, now: DateTime<Utc>) -> bool {
+        self.remaining < 500 && self.reset_at > now
     }
-}
 
-#[derive(Clone, Serialize, Deserialize)]
-pub(crate) struct Quotas {
-    pub graphql: Quota,
-    rest: Quota,
+    fn pass_reason(&self, resource: Resource) -> String {
+        format!(
+            "GitHub Quota wait until {} ({}: {} left)",
+            self.reset_at.to_rfc3339_opts(SecondsFormat::Secs, true),
+            resource.name(),
+            self.remaining,
+        )
+    }
 }
 
-impl Quotas {
-    pub fn warning(&self) -> Option<String> {
-        let reasons: Vec<_> = [
-            (&self.graphql, "GraphQL points"),
-            (&self.rest, "REST requests"),
-        ]
-        .into_iter()
-        .filter(|(quota, _)| quota.low())
-        .map(|(quota, name)| {
-            format!(
-                "{} {name} remaining (fewer than 500); Inbox reads paused until {}",
-                quota.remaining,
-                quota.reset_at.to_rfc3339_opts(SecondsFormat::Secs, true),
-            )
-        })
-        .collect();
+impl QuotaWait {
+    /// One stable reason, held until the last depleted resource resets.
+    pub fn pass_reason(waits: &[Self]) -> Option<String> {
+        let wait = waits
+            .iter()
+            .filter(|wait| wait.reset_at() > Utc::now())
+            .max_by_key(|wait| wait.reset_at())?;
+        Some(wait.quota.pass_reason(wait.resource))
+    }
+
+    pub fn reset_at(&self) -> DateTime<Utc> {
+        self.quota.reset_at
+    }
+
+    pub fn remaining(&self) -> u64 {
+        self.quota.remaining
+    }
+
+    pub fn warning(waits: &[Self]) -> Option<String> {
+        let reasons: Vec<_> = waits
+            .iter()
+            .filter(|wait| wait.reset_at() > Utc::now())
+            .map(|wait| {
+                let name = match wait.resource {
+                    Resource::Graphql => "GraphQL points",
+                    Resource::Core => "REST requests",
+                };
+                let reserve = if wait.remaining() < 500 {
+                    " (fewer than 500)"
+                } else {
+                    ""
+                };
+                format!(
+                    "{} {name} remaining{reserve}; Inbox reads paused until {}",
+                    wait.remaining(),
+                    wait.reset_at().to_rfc3339_opts(SecondsFormat::Secs, true),
+                )
+            })
+            .collect();
         (!reasons.is_empty()).then(|| reasons.join("; "))
     }
 }
 
 impl GitHub {
+    /// A known wait needs no probe. Non-quota probe failures fail open;
+    /// exhaustion recorded by a failed probe still skips this Pass.
+    pub(crate) fn pass_quota_wait(&self) -> Option<String> {
+        if let Some(reason) = QuotaWait::pass_reason(&self.quota_waits().unwrap_or_default()) {
+            return Some(reason);
+        }
+        // Admission records exhaustion and skips; only admitted Commands
+        // wait and retry. Keep the probe's ordinary read-failure handling.
+        let probe = Self {
+            interruption: self.interruption,
+            wait_for_quota: false,
+        };
+        if let Ok(quotas) = probe.current_quotas() {
+            // Admission depends on GitHub's observation even when an
+            // exhausted account cannot identify itself for shared storage.
+            let reason = quotas
+                .iter()
+                .filter(|(_, quota)| quota.low(Utc::now()))
+                .max_by_key(|(_, quota)| quota.reset_at)
+                .map(|(resource, quota)| quota.pass_reason(*resource));
+            for (resource, quota) in quotas {
+                let _ = probe.observe_quota(resource, quota);
+            }
+            return reason;
+        }
+        QuotaWait::pass_reason(&self.quota_waits().unwrap_or_default())
+    }
+
+    // Quota probes deliberately bypass failure recording: learning a reset or
+    // identity must never recursively probe another failure.
+    fn quota_json(&self, args: &[&str]) -> Result<Value> {
+        let output = self.raw_output_with_input(args, None)?;
+        anyhow::ensure!(output.status.success(), "GitHub quota probe failed");
+        Ok(serde_json::from_slice(&output.stdout)?)
+    }
+
+    /// Read-only access for the Inbox and later GitHub callers. With a known
+    /// identity this makes no GitHub calls, even across process restarts.
+    pub(crate) fn quota_waits(&self) -> Result<Vec<QuotaWait>> {
+        let host = identity::host(&[]);
+        self.quota_waits_for(&host)
+    }
+
+    pub(crate) fn quota_waits_for(&self, host: &str) -> Result<Vec<QuotaWait>> {
+        let store = Store::machine()?;
+        let host = host.to_ascii_lowercase();
+        match identity::cached(&store, &host)? {
+            Some(account) => store.waiting(&account, Utc::now()),
+            None => Ok(Vec::new()),
+        }
+    }
+
+    pub(super) fn observe_quota(&self, resource: Resource, quota: Quota) -> Result<()> {
+        let store = Store::machine()?;
+        let host = identity::host(&[]);
+        let account = identity::resolve(self, &store, &host)?;
+        store.observe(&account, resource, quota, Utc::now())
+    }
+
     /// This endpoint reports both quotas and does not spend REST requests:
     /// https://docs.github.com/en/rest/rate-limit/rate-limit
-    pub(crate) fn inbox_quotas(&self) -> Result<Quotas> {
+    fn current_quotas(&self) -> Result<[(Resource, Quota); 2]> {
         let json = self.gh_json(&["api", "rate_limit"])?;
-        let resources = &json["resources"];
-        Ok(Quotas {
-            graphql: Quota::rest(&resources["graphql"])?,
-            rest: Quota::rest(&resources["core"])?,
-        })
+        Ok([
+            (
+                Resource::Graphql,
+                Quota::rest(&json["resources"]["graphql"])?,
+            ),
+            (Resource::Core, Quota::rest(&json["resources"]["core"])?),
+        ])
+    }
+
+    pub(crate) fn inbox_quotas(&self) -> Result<Vec<QuotaWait>> {
+        for (resource, quota) in self.current_quotas()? {
+            self.observe_quota(resource, quota)?;
+        }
+        self.quota_waits()
+    }
+
+    pub(super) fn record_quota_failure(&self, args: &[&str], resource: Resource) -> DateTime<Utc> {
+        let host = identity::host(args);
+        let now = Utc::now();
+        let resource_json = self
+            .quota_json(&["api", "rate_limit", "--hostname", &host])
+            .unwrap_or(Value::Null);
+        let resource_json = &resource_json["resources"][resource.name()];
+        let quota = Quota {
+            remaining: resource_json["remaining"].as_u64().unwrap_or(0),
+            reset_at: resource_json["reset"]
+                .as_i64()
+                .and_then(|reset| DateTime::from_timestamp(reset, 0))
+                .unwrap_or(now + chrono::Duration::minutes(15)),
+        };
+        let reset = quota.reset_at;
+        let record = || -> Result<()> {
+            let store = Store::machine()?;
+            let account = identity::resolve(self, &store, &host)?;
+            store.exhausted(&account, resource, quota, now)
+        };
+        if record().is_err() {
+            // Recording failure must not prevent waiting or hide the original
+            // GitHub diagnostic if the Command reaches its wait cap.
+            crate::progress::step("warning: could not record GitHub Quota wait");
+        }
+        reset
+    }
+}
+
+pub(super) enum Limit {
+    Primary(Resource),
+    Secondary,
+}
+
+impl Limit {
+    pub(super) fn of(args: &[&str], stderr: &[u8]) -> Option<Self> {
+        let diagnostic = String::from_utf8_lossy(stderr).to_ascii_lowercase();
+        if diagnostic.contains("secondary rate limit") || diagnostic.contains("abuse detection") {
+            return Some(Self::Secondary);
+        }
+        if !(diagnostic.contains("api rate limit exceeded")
+            || diagnostic.contains("api rate limit already exceeded")
+            || diagnostic.contains("rate_limit_exceeded")
+            || diagnostic.contains("rate_limited"))
+        {
+            return None;
+        }
+        let graphql = diagnostic.contains("graphql:")
+            || args.starts_with(&["api", "graphql"])
+            || args.first() != Some(&"api")
+                && (diagnostic.contains("rate_limit_exceeded")
+                    || diagnostic.contains("rate_limited"));
+        Some(Self::Primary(if graphql {
+            Resource::Graphql
+        } else {
+            Resource::Core
+        }))
     }
 }
diff --git a/src/github/quota/command.rs b/src/github/quota/command.rs
new file mode 100644
index 000000000..f0da97b6c
--- /dev/null
+++ b/src/github/quota/command.rs
@@ -0,0 +1,180 @@
+//! One budget and notification total per owning Command, including subprocess
+//! Ticket runs. The Command log owner supplies their shared sidecar path.
+use std::collections::BTreeSet;
+use std::fs;
+use std::io::Write;
+use std::path::PathBuf;
+use std::sync::Mutex;
+use std::time::{Duration, Instant};
+
+use anyhow::Result;
+use chrono::{DateTime, SecondsFormat, Utc};
+use serde::{Deserialize, Serialize};
+
+use super::{Resource, wait::WaitBudget};
+use crate::{logs, process::Interruption, progress};
+
+#[derive(Clone, Default, Serialize, Deserialize)]
+struct Totals {
+    budget: WaitBudget,
+    waited: Duration,
+    resources: BTreeSet<String>,
+}
+
+#[derive(Default)]
+struct Command {
+    totals: Totals,
+    path: Option<PathBuf>,
+}
+
+static COMMAND: Mutex<Option<Command>> = Mutex::new(None);
+
+pub(crate) fn begin() {
+    COMMAND.lock().unwrap().get_or_insert_with(Command::default);
+}
+
+pub(in crate::github) fn active() -> bool {
+    COMMAND.lock().unwrap().is_some()
+}
+
+/// Called outside the recording lock, once its owner is known. A child uses
+/// the inherited outermost owner, never its own child record's path.
+pub(crate) fn attach(path: PathBuf) -> Result<()> {
+    let mut command = COMMAND.lock().unwrap();
+    let Some(command) = command.as_mut() else {
+        return Ok(());
+    };
+    if command.path.is_none() {
+        let totals = std::mem::take(&mut command.totals);
+        command.path = Some(path.with_extension("quota-wait.json"));
+        // Before log allocation, only the parent can have waited. Commands
+        // that never wait need no quota sidecar.
+        if !totals.budget.is_empty() {
+            command.update(|stored| *stored = totals)?;
+        }
+    }
+    Ok(())
+}
+
+impl Command {
+    fn read(&self) -> Result<Totals> {
+        let Some(path) = &self.path else {
+            return Ok(self.totals.clone());
+        };
+        match fs::read(path) {
+            Ok(bytes) => Ok(serde_json::from_slice(&bytes)?),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(Totals::default()),
+            Err(error) => Err(error.into()),
+        }
+    }
+
+    fn update<T>(&mut self, change: impl FnOnce(&mut Totals) -> T) -> Result<T> {
+        let Some(path) = &self.path else {
+            return Ok(change(&mut self.totals));
+        };
+        let _lock = super::store::lock_exclusive(&path.with_extension("lock"))?;
+        let mut totals = self.read()?;
+        let value = change(&mut totals);
+        let mut tmp = tempfile::NamedTempFile::new_in(path.parent().unwrap())?;
+        tmp.write_all(&serde_json::to_vec(&totals)?)?;
+        tmp.persist(path)?;
+        Ok(value)
+    }
+}
+
+/// The ordinary sleep and the completion sleep share accounting but preserve
+/// their caller's interruption policy. A rejected reservation leaves the
+/// caller's original GitHub failure intact.
+pub(in crate::github) fn wait(
+    reset: DateTime<Utc>,
+    resource: Resource,
+    interruption: Interruption,
+) -> Result<bool> {
+    let delay = {
+        let mut command = COMMAND.lock().unwrap();
+        let Some(command) = command.as_mut() else {
+            return Ok(false);
+        };
+        command.update(|totals| totals.budget.next(reset.max(Utc::now())))?
+    };
+    let Ok(delay) = delay else { return Ok(false) };
+    let until = (Utc::now() + chrono::Duration::from_std(delay)?)
+        .to_rfc3339_opts(SecondsFormat::Secs, true);
+    logs::quota_wait(Some(&until));
+    let started = Instant::now();
+    let mut left = delay;
+    let result = loop {
+        progress::step(format!("Quota wait until {until} ({})", resource.name()));
+        if let Err(error) = interruption.pause(left.min(Duration::from_secs(30))) {
+            break Err(error);
+        }
+        left = delay.saturating_sub(started.elapsed());
+        if left.is_zero() {
+            break Ok(());
+        }
+    };
+    logs::quota_wait(None);
+    let elapsed = started.elapsed().min(delay);
+    if let Some(command) = COMMAND.lock().unwrap().as_mut() {
+        command.update(|totals| {
+            totals.budget.refund(delay.saturating_sub(elapsed));
+            totals.waited += elapsed;
+            if !elapsed.is_zero() {
+                totals.resources.insert(resource.name().into());
+            }
+        })?;
+    }
+    result.map(|()| true)
+}
+
+pub(crate) fn notification_line() -> Result<Option<String>> {
+    let command = COMMAND.lock().unwrap();
+    let Some(command) = command.as_ref() else {
+        return Ok(None);
+    };
+    let totals = command.read()?;
+    Ok((!totals.waited.is_zero()).then(|| {
+        format!(
+            "Waited {} for the GitHub quota ({})",
+            progress::duration(totals.waited),
+            totals
+                .resources
+                .iter()
+                .cloned()
+                .collect::<Vec<_>>()
+                .join(", ")
+        )
+    }))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use std::os::unix::fs::PermissionsExt;
+    use std::time::Duration;
+
+    #[test]
+    fn quota_wait_sidecar_lock_stays_private_to_the_owner() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("run.quota-wait.json");
+        let lock_path = path.with_extension("lock");
+        fs::write(&lock_path, []).unwrap();
+        fs::set_permissions(&lock_path, fs::Permissions::from_mode(0o644)).unwrap();
+        let mut command = Command {
+            totals: Totals::default(),
+            path: Some(path),
+        };
+        command
+            .update(|totals| {
+                totals.waited = Duration::from_secs(1);
+            })
+            .unwrap();
+        let mode = fs::metadata(&lock_path).unwrap().permissions().mode();
+        assert_eq!(
+            mode & 0o077,
+            0,
+            "sidecar lock mode {mode:o} lets another local user block the owner"
+        );
+    }
+}
diff --git a/src/github/quota/identity.rs b/src/github/quota/identity.rs
new file mode 100644
index 000000000..99a100676
--- /dev/null
+++ b/src/github/quota/identity.rs
@@ -0,0 +1,143 @@
+//! Cache the authenticated login without keeping credentials. A changed
+//! environment token or gh account configuration requires a new observation.
+use anyhow::{Context, Result};
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+
+use super::store::{Account, Store};
+use crate::github::GitHub;
+
+pub(super) fn host(args: &[&str]) -> String {
+    let mut hostname = None;
+    let mut repository = None;
+    let mut args = args.iter().copied();
+    while let Some(arg) = args.next() {
+        match arg {
+            "--hostname" | "-h" => hostname = args.next(),
+            "--repo" | "-R" => repository = args.next(),
+            // Text and API field values are payload, even when they look
+            // like URLs or selector flags.
+            "--body" | "--title" | "--comment" | "--label" | "--search" | "-b" | "-t" | "-f"
+            | "-F" => {
+                args.next();
+            }
+            _ => {
+                if let Some(value) = arg.strip_prefix("--hostname=") {
+                    hostname = Some(value);
+                } else if let Some(value) = arg.strip_prefix("--repo=") {
+                    repository = Some(value);
+                }
+            }
+        }
+    }
+    if let Some(hostname) = hostname {
+        return hostname.to_ascii_lowercase();
+    }
+    if let Some(repository) = repository {
+        if let Some(host) = url_host(repository) {
+            return host;
+        }
+        if let [host, _, _] = repository.split('/').collect::<Vec<_>>().as_slice() {
+            return host.to_ascii_lowercase();
+        }
+    }
+    std::env::var("GH_HOST")
+        .ok()
+        .filter(|host| !host.is_empty())
+        .unwrap_or_else(|| "github.com".into())
+        .to_ascii_lowercase()
+}
+
+fn url_host(value: &str) -> Option<String> {
+    let url = reqwest::Url::parse(value).ok()?;
+    let host = url.host_str()?;
+    Some(if host == "api.github.com" {
+        "github.com".into()
+    } else {
+        host.to_ascii_lowercase()
+    })
+}
+
+fn credential() -> Result<String> {
+    let mut digest = Sha256::new();
+    for name in [
+        "GH_TOKEN",
+        "GITHUB_TOKEN",
+        "GH_ENTERPRISE_TOKEN",
+        "GITHUB_ENTERPRISE_TOKEN",
+    ] {
+        digest.update(name);
+        digest.update([0]);
+        if let Ok(value) = std::env::var(name) {
+            digest.update(value);
+        }
+        digest.update([0]);
+    }
+    let dir = std::env::var_os("GH_CONFIG_DIR")
+        .map(std::path::PathBuf::from)
+        .or_else(|| {
+            std::env::var_os("XDG_CONFIG_HOME").map(|dir| std::path::PathBuf::from(dir).join("gh"))
+        })
+        .unwrap_or(crate::config::home()?.join(".config/gh"));
+    digest.update(dir.as_os_str().as_encoded_bytes());
+    match std::fs::read(dir.join("hosts.yml")) {
+        Ok(bytes) => digest.update(bytes),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Err(error) => return Err(error.into()),
+    }
+    // Only this one-way fingerprint is persisted, never the token or config.
+    Ok(format!("{:x}", digest.finalize()))
+}
+
+pub(super) fn cached(store: &Store, host: &str) -> Result<Option<Account>> {
+    store.account(host, &credential()?)
+}
+
+pub(super) fn resolve(github: &GitHub, store: &Store, host: &str) -> Result<Account> {
+    let credential = credential()?;
+    if let Some(account) = store.account(host, &credential)? {
+        return Ok(account);
+    }
+    // Try both quota resources: a depleted REST quota can still leave GraphQL
+    // available. gh's auth report can also retain a configured active login.
+    let login = github
+        .quota_json(&["api", "user", "--hostname", host])
+        .ok()
+        .and_then(|json| json["login"].as_str().map(str::to_owned))
+        .or_else(|| {
+            github
+                .quota_json(&[
+                    "api",
+                    "graphql",
+                    "--hostname",
+                    host,
+                    "-f",
+                    "query={viewer{login}}",
+                ])
+                .ok()
+                .and_then(|json| json["data"]["viewer"]["login"].as_str().map(str::to_owned))
+        })
+        .or_else(|| {
+            let json = github
+                .quota_json(&[
+                    "auth",
+                    "status",
+                    "--active",
+                    "--hostname",
+                    host,
+                    "--json",
+                    "hosts",
+                ])
+                .ok()?;
+            json["hosts"][host].as_array()?.iter().find_map(|account| {
+                (account["active"] == Value::Bool(true))
+                    .then(|| account["login"].as_str().map(str::to_owned))
+                    .flatten()
+            })
+        })
+        .filter(|login| !login.is_empty())
+        .context("could not identify the authenticated GitHub user for Quota wait")?;
+    let account = Account::new(host, &login);
+    store.remember(account.clone(), credential)?;
+    Ok(account)
+}
diff --git a/src/github/quota/store.rs b/src/github/quota/store.rs
new file mode 100644
index 000000000..9c504ea35
--- /dev/null
+++ b/src/github/quota/store.rs
@@ -0,0 +1,181 @@
+//! One machine-local record, with a stable lock across atomic replacements.
+use std::fs::{self, File, OpenOptions};
+use std::io::Write;
+use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
+use std::path::{Path, PathBuf};
+
+use anyhow::Result;
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+use super::{Quota, Resource};
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub(crate) struct Account {
+    host: String,
+    login: String,
+}
+
+impl Account {
+    pub fn new(host: &str, login: &str) -> Self {
+        Self {
+            host: host.to_ascii_lowercase(),
+            login: login.to_ascii_lowercase(),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub(crate) struct QuotaWait {
+    #[serde(flatten)]
+    account: Account,
+    pub resource: Resource,
+    #[serde(flatten)]
+    pub quota: Quota,
+}
+
+#[derive(Serialize, Deserialize)]
+struct Identity {
+    credential: String,
+    account: Account,
+}
+
+#[derive(Default, Serialize, Deserialize)]
+struct Record {
+    identities: Vec<Identity>,
+    waits: Vec<QuotaWait>,
+}
+
+pub(crate) struct Store {
+    path: PathBuf,
+}
+
+impl Store {
+    pub fn new(path: PathBuf) -> Self {
+        Self { path }
+    }
+
+    pub fn machine() -> Result<Self> {
+        Ok(Self::new(
+            crate::config::home()?.join(".thirdshift/github-quota.json"),
+        ))
+    }
+
+    pub fn waiting(&self, account: &Account, now: DateTime<Utc>) -> Result<Vec<QuotaWait>> {
+        Ok(self
+            .read()?
+            .waits
+            .into_iter()
+            .filter(|wait| &wait.account == account && wait.quota.reset_at > now)
+            .collect())
+    }
+
+    /// A successful quota observation supersedes the previous one, including
+    /// clearing a wait when the reserve is available again.
+    pub fn observe(
+        &self,
+        account: &Account,
+        resource: Resource,
+        quota: Quota,
+        now: DateTime<Utc>,
+    ) -> Result<()> {
+        let waiting = quota.low(now);
+        self.record(account, resource, quota, waiting, now)
+    }
+
+    pub fn exhausted(
+        &self,
+        account: &Account,
+        resource: Resource,
+        quota: Quota,
+        now: DateTime<Utc>,
+    ) -> Result<()> {
+        self.record(account, resource, quota, true, now)
+    }
+
+    fn record(
+        &self,
+        account: &Account,
+        resource: Resource,
+        quota: Quota,
+        waiting: bool,
+        now: DateTime<Utc>,
+    ) -> Result<()> {
+        self.update(|record| {
+            record.waits.retain(|wait| {
+                wait.quota.reset_at > now
+                    && !(&wait.account == account && wait.resource == resource)
+            });
+            if waiting && quota.reset_at > now {
+                record.waits.push(QuotaWait {
+                    account: account.clone(),
+                    resource,
+                    quota,
+                });
+            }
+        })
+    }
+
+    pub fn account(&self, host: &str, credential: &str) -> Result<Option<Account>> {
+        Ok(self
+            .read()?
+            .identities
+            .into_iter()
+            .find(|identity| identity.account.host == host && identity.credential == credential)
+            .map(|identity| identity.account))
+    }
+
+    pub fn remember(&self, account: Account, credential: String) -> Result<()> {
+        self.update(|record| {
+            record.identities.retain(|identity| {
+                identity.account.host != account.host || identity.credential != credential
+            });
+            record.identities.push(Identity {
+                account,
+                credential,
+            });
+        })
+    }
+
+    fn read(&self) -> Result<Record> {
+        match fs::read(&self.path) {
+            Ok(bytes) => Ok(serde_json::from_slice(&bytes)?),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(Record::default()),
+            Err(error) => Err(error.into()),
+        }
+    }
+
+    fn update(&self, change: impl FnOnce(&mut Record)) -> Result<()> {
+        let dir = self.path.parent().expect("quota record has a parent");
+        fs::create_dir_all(dir)?;
+        let _lock = lock_exclusive(&self.path.with_extension("lock"))?;
+        let mut record = self.read()?;
+        let previous = serde_json::to_vec(&record)?;
+        change(&mut record);
+        let bytes = serde_json::to_vec(&record)?;
+        // The Console watches this record: unchanged quota observations
+        // must not wake open Inbox pages.
+        if bytes == previous {
+            return Ok(());
+        }
+        let mut tmp = tempfile::NamedTempFile::new_in(dir)?;
+        tmp.write_all(&bytes)?;
+        tmp.persist(&self.path)?;
+        Ok(())
+    }
+}
+
+/// Another local user can take an exclusive flock on a lock they can open,
+/// even with a read-only descriptor, and stall every Quota update. Creation
+/// mode is masked by umask, so an existing lock is tightened explicitly.
+pub(super) fn lock_exclusive(path: &Path) -> Result<File> {
+    let lock = OpenOptions::new()
+        .create(true)
+        .truncate(false)
+        .write(true)
+        .mode(0o600)
+        .open(path)?;
+    lock.set_permissions(fs::Permissions::from_mode(0o600))?;
+    lock.lock()?;
+    Ok(lock)
+}
diff --git a/src/github/quota/tests.rs b/src/github/quota/tests.rs
new file mode 100644
index 000000000..c66feadc1
--- /dev/null
+++ b/src/github/quota/tests.rs
@@ -0,0 +1,160 @@
+use super::*;
+use std::os::unix::fs::PermissionsExt;
+use std::time::Duration;
+use store::Account;
+use wait::{WaitBudget, WaitCapExceeded};
+
+fn now() -> DateTime<Utc> {
+    DateTime::parse_from_rfc3339("2026-11-10T12:00:00Z")
+        .unwrap()
+        .to_utc()
+}
+
+fn quota(remaining: u64) -> Quota {
+    Quota {
+        remaining,
+        reset_at: now() + chrono::Duration::hours(1),
+    }
+}
+
+#[test]
+fn waits_are_isolated_by_host_user_and_resource_and_expire_at_reset() {
+    let dir = tempfile::tempdir().unwrap();
+    let store = Store::new(dir.path().join("quota.json"));
+    let alice = Account::new("github.com", "Alice");
+    let bob = Account::new("github.com", "Bob");
+    let enterprise = Account::new("git.example.com", "Alice");
+    store
+        .observe(&alice, Resource::Core, quota(499), now())
+        .unwrap();
+    store
+        .observe(&bob, Resource::Graphql, quota(123), now())
+        .unwrap();
+    store
+        .observe(&enterprise, Resource::Core, quota(42), now())
+        .unwrap();
+    let waits = store
+        .waiting(&Account::new("GITHUB.COM", "ALICE"), now())
+        .unwrap();
+    assert_eq!(waits.len(), 1);
+    assert_eq!(waits[0].resource, Resource::Core);
+    assert_eq!(waits[0].remaining(), 499);
+    assert_eq!(waits[0].reset_at(), now() + chrono::Duration::hours(1));
+    assert_eq!(
+        store.waiting(&bob, now()).unwrap()[0].resource,
+        Resource::Graphql
+    );
+    assert_eq!(
+        store.waiting(&enterprise, now()).unwrap()[0]
+            .quota
+            .remaining,
+        42
+    );
+    assert!(
+        store
+            .waiting(&alice, now() + chrono::Duration::hours(1))
+            .unwrap()
+            .is_empty()
+    );
+    store
+        .observe(&alice, Resource::Core, quota(500), now())
+        .unwrap();
+    assert!(store.waiting(&alice, now()).unwrap().is_empty());
+    assert_eq!(store.waiting(&bob, now()).unwrap().len(), 1);
+}
+
+#[test]
+fn concurrent_writers_preserve_each_other_and_readers_only_see_complete_records() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("quota.json");
+    let barrier = std::sync::Barrier::new(17);
+    std::thread::scope(|scope| {
+        for user in 0..16 {
+            let path = &path;
+            let barrier = &barrier;
+            scope.spawn(move || {
+                let store = Store::new(path.clone());
+                let account = Account::new("github.com", &format!("user{user}"));
+                barrier.wait();
+                for resource in [Resource::Core, Resource::Graphql] {
+                    store
+                        .observe(&account, resource, quota(100 + user), now())
+                        .unwrap();
+                }
+            });
+        }
+        barrier.wait();
+        let store = Store::new(path.clone());
+        for _ in 0..100 {
+            store
+                .waiting(&Account::new("github.com", "user0"), now())
+                .unwrap();
+        }
+    });
+    let store = Store::new(path);
+    for user in 0..16 {
+        let waits = store
+            .waiting(&Account::new("github.com", &format!("user{user}")), now())
+            .unwrap();
+        assert_eq!(waits.len(), 2);
+        assert!(waits.iter().all(|wait| wait.quota.remaining == 100 + user));
+    }
+}
+
+#[test]
+fn quota_record_lock_stays_private_to_the_owner() {
+    let dir = tempfile::tempdir().unwrap();
+    let lock_path = dir.path().join("quota.lock");
+    // A lock created under the usual umask is group- and world-readable.
+    // Opening it read-only is enough to take an exclusive flock.
+    std::fs::write(&lock_path, []).unwrap();
+    std::fs::set_permissions(&lock_path, std::fs::Permissions::from_mode(0o644)).unwrap();
+    let store = Store::new(dir.path().join("quota.json"));
+    store
+        .observe(
+            &Account::new("github.com", "octocat"),
+            Resource::Core,
+            quota(100),
+            now(),
+        )
+        .unwrap();
+    let mode = std::fs::metadata(&lock_path).unwrap().permissions().mode();
+    assert_eq!(
+        mode & 0o077,
+        0,
+        "quota lock mode {mode:o} lets another local user block the owner"
+    );
+}
+
+#[test]
+fn wait_calculation_uses_injected_clock_and_inclusive_jitter_endpoints() {
+    let reset = now() + chrono::Duration::minutes(5);
+    for (jitter, expected) in [(0, 360), (37, 397), (60, 420)] {
+        let mut budget = WaitBudget::default();
+        assert_eq!(
+            budget.next_with(reset, now, || jitter),
+            Ok(Duration::from_secs(expected))
+        );
+    }
+}
+
+#[test]
+fn a_commands_wait_total_accepts_two_hours_and_rejects_more_without_spending_it() {
+    let mut budget = WaitBudget::default();
+    let reset = now() + chrono::Duration::seconds(3539);
+    assert_eq!(
+        budget.next_with(reset, now, || 0),
+        Ok(Duration::from_secs(3599))
+    );
+    assert_eq!(
+        budget.next_with(reset, now, || 0),
+        Ok(Duration::from_secs(3599))
+    );
+    assert_eq!(budget.next_with(now(), now, || 0), Err(WaitCapExceeded));
+    let reset = now() - chrono::Duration::seconds(58);
+    assert_eq!(
+        budget.next_with(reset, now, || 0),
+        Ok(Duration::from_secs(2))
+    );
+    assert_eq!(budget.next_with(reset, now, || 0), Err(WaitCapExceeded));
+}
diff --git a/src/github/quota/wait.rs b/src/github/quota/wait.rs
new file mode 100644
index 000000000..343bc4cd7
--- /dev/null
+++ b/src/github/quota/wait.rs
@@ -0,0 +1,61 @@
+//! A running Command's primary-quota wait budget, shared by its child Runs.
+use std::time::Duration;
+
+use chrono::{DateTime, Utc};
+
+const COMMAND_CAP: Duration = Duration::from_secs(2 * 60 * 60);
+
+#[derive(Clone, Default, serde::Serialize, serde::Deserialize)]
+pub(crate) struct WaitBudget {
+    total: Duration,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) struct WaitCapExceeded;
+
+impl WaitBudget {
+    pub(super) fn is_empty(&self) -> bool {
+        self.total.is_zero()
+    }
+    pub fn next(&mut self, reset: DateTime<Utc>) -> Result<Duration, WaitCapExceeded> {
+        self.next_with(reset, Utc::now, || rand::random_range(0..=60))
+    }
+
+    /// Reserve this wait in the Command's running total. Rejected waits leave
+    /// the total unchanged; the caller never sleeps beyond the two-hour cap.
+    pub fn next_with(
+        &mut self,
+        reset: DateTime<Utc>,
+        clock: impl FnOnce() -> DateTime<Utc>,
+        jitter_seconds: impl FnOnce() -> u64,
+    ) -> Result<Duration, WaitCapExceeded> {
+        let jitter = jitter_seconds();
+        assert!(jitter <= 60, "Quota wait jitter must be in 0..=60 seconds");
+        // The override shortens the safety minute and jitter for binary tests;
+        // the reset itself remains a real wall-clock deadline.
+        let minute = minute();
+        let margin = minute + minute.mul_f64(jitter as f64 / 60.0);
+        let until = reset + chrono::Duration::from_std(margin).unwrap();
+        let wait = (until - clock()).to_std().unwrap_or(Duration::ZERO);
+        let total = self.total.checked_add(wait).ok_or(WaitCapExceeded)?;
+        if total > COMMAND_CAP {
+            return Err(WaitCapExceeded);
+        }
+        self.total = total;
+        Ok(wait)
+    }
+
+    pub(super) fn refund(&mut self, unused: Duration) {
+        self.total = self.total.saturating_sub(unused);
+    }
+}
+
+/// Shorten a quota safety minute for binary tests, as with CI's grace period.
+pub(in crate::github) fn minute() -> Duration {
+    std::env::var("THIRDSHIFT_QUOTA_MINUTE_MS")
+        .ok()
+        .and_then(|ms| ms.parse().ok())
+        .filter(|ms| *ms > 0)
+        .map(Duration::from_millis)
+        .unwrap_or(Duration::from_secs(60))
+}
diff --git a/src/launch.rs b/src/launch.rs
index a3b53de9e..0a9066e47 100644
--- a/src/launch.rs
+++ b/src/launch.rs
@@ -19,7 +19,7 @@ use std::path::PathBuf;
 use anyhow::{Context, Result, bail};
 
 use crate::command_limit;
-use crate::command_limit::{AlreadyRunning, Sharing};
+use crate::command_limit::{NotAdmitted, Sharing};
 use crate::git::Git;
 use crate::github::GitHub;
 use crate::issue::{IssueInput, IssueUrl, Repo};
@@ -338,7 +338,7 @@ pub enum Start {
     /// Its checks passed and it holds a slot on its repository.
     Clear(Launch),
     /// It is skipped, with nothing done.
-    AlreadyRunning(AlreadyRunning),
+    NotAdmitted(NotAdmitted),
 }
 
 /// Start a run with no Issue URL from the Launch directory, the current
@@ -346,8 +346,9 @@ pub enum Start {
 /// whatever the Launch directory has checked out, or without one the branch
 /// checked out there, so a detached HEAD with neither fails it.
 ///
-/// Once the preflight checks pass, the run is [`AlreadyRunning`], with
-/// nothing done, if its repository is at its Command `limit` on this
+/// A Quota wait skips the Pass before remote preparation. Once the preflight
+/// checks pass, the run is also [`NotAdmitted`], with nothing done, if its
+/// repository is at its Command `limit` on this
 /// machine, or, as `sharing` says, another Pass of its kind runs there.
 /// Otherwise this process holds a slot there, and the lock of its kind if it
 /// has one, until it exits, through whatever it dispatches.
@@ -355,10 +356,13 @@ pub fn start(base: Option<&str>, limit: NonZeroUsize, sharing: Sharing) -> Resul
     let directory = LaunchDirectory::open(current_dir()?, Opening::Pass)?;
     let repo = directory.repo()?;
     crate::logs::pass_fired(&repo);
+    if let Some(skipped) = command_limit::quota_wait(&repo, limit) {
+        return Ok(Start::NotAdmitted(skipped));
+    }
     directory.check_identity()?;
     let base = directory.prepare_base_branch(base)?;
     if let Some(running) = command_limit::hold_pass(&repo, limit, sharing)? {
-        return Ok(Start::AlreadyRunning(running));
+        return Ok(Start::NotAdmitted(running));
     }
     Ok(Start::Clear(Launch {
         directory,
diff --git a/src/logs.rs b/src/logs.rs
index bb1295060..df564231f 100644
--- a/src/logs.rs
+++ b/src/logs.rs
@@ -184,6 +184,12 @@ pub enum Begin<'a> {
 /// The work a command starts.
 #[derive(Clone, Copy)]
 pub enum Work<'a> {
+    /// A Command still in preflight, retained only because it hit a Quota wait.
+    Starting {
+        repo: &'a Repo,
+        command: CommandKind,
+        issue: Option<&'a IssueUrl>,
+    },
     /// A Run on its issue.
     Run(&'a IssueUrl),
     /// A Base fix, a child Run into the Run's Base branch.
@@ -277,6 +283,7 @@ const PARENT_DISPATCH: &str = "THIRDSHIFT_PARENT_DISPATCH";
 /// shows them, so a skipped pass may print nothing. A child Run prints no
 /// such line, and takes the stamp it was given.
 pub fn begin(begin: Begin) {
+    crate::github::quota::command::begin();
     let mut record = record();
     if matches!(begin, Begin::ChildRun(..)) {
         record.inherit_owner(owner::Owner::inherited());
@@ -284,6 +291,19 @@ pub fn begin(begin: Begin) {
         record.child_dispatch(std::env::var(PARENT_DISPATCH).ok());
     }
     record.begin(begin);
+    drop(record);
+    attach_quota_budget();
+}
+
+fn attach_quota_budget() {
+    if let Ok(owner) = captured_owner()
+        && let Some(path) = owner.log_path()
+        && let Err(error) = crate::github::quota::command::attach(path.into())
+    {
+        crate::progress::step(format!(
+            "warning: could not attach Command quota budget: {error:#}"
+        ));
+    }
 }
 
 /// Give a child Run its exact parent, independently of second-resolution stamps.
@@ -316,6 +336,10 @@ pub fn configured(config: &UserConfig) {
     record().configured(config);
 }
 
+pub(crate) fn preflight_issue(issue: &IssueUrl) {
+    record().preflight_issue(issue.clone());
+}
+
 /// Keep the Pass's latest start once its repository is known, before gates.
 pub(crate) fn pass_fired(repo: &Repo) {
     record().pass_fired(repo);
@@ -330,6 +354,7 @@ pub(crate) fn pass_fired(repo: &Repo) {
 /// immediate parent, with no Command log of its own.
 pub fn started(work: Work, harness: &Choice) {
     record().started(work, harness);
+    attach_quota_budget();
 }
 
 /// Capture the Custom process's loaded source before recording its start or skip.
@@ -362,7 +387,8 @@ pub(crate) fn base_ci_skipped(repo: &Repo, reason: &str) {
 
 /// Record that the Custom process `name`, started with no issue, was skipped
 /// on `repo` for `reason`. The Activity log keeps `Process <name> skipped:
-/// <reason>` unless that is already its last Process line. Unlike the other
+/// <reason>` unless that is already its last Process line (its own named
+/// Process's last skip during a Quota wait). Unlike the other
 /// Passes, it also keeps a Command record whose outcome is `skipped`: the
 /// Process's record shows that ending. `harness` is the choice it would have
 /// run on; the skip does not check that it can run.
@@ -370,9 +396,9 @@ pub fn skipped_process(
     repo: &Repo,
     name: &str,
     harness: &crate::harness::Choice,
-    reason: impl Display,
+    reason: &crate::command_limit::NotAdmitted,
 ) {
-    record().skipped_process(repo, name, harness, &reason.to_string());
+    record().skipped_process(repo, name, harness, reason);
 }
 
 /// Add an observation to the running command's repository Activity log.
@@ -398,6 +424,18 @@ pub fn stage(stage: Stage) {
     record().stage(stage, None);
 }
 
+/// Temporarily overlay the active stage without resetting its timing.
+pub(crate) fn quota_wait(until: Option<&str>) {
+    if until.is_some() && record().needs_quota_repo() {
+        let repo = crate::launch::repo().ok();
+        record().preflight_repo(repo);
+    }
+    record().quota_wait(until);
+    if until.is_some() {
+        attach_quota_budget();
+    }
+}
+
 /// Keep the current Session trace, including a Resume's own log, as
 /// `session` enters its stage.
 pub fn session(session: Logged, path: &Path) {
@@ -586,6 +624,7 @@ impl<'a> Work<'a> {
     fn process(self) -> crate::processes::Identity {
         use crate::processes::Identity;
         let file = match self {
+            Self::Starting { .. } => return Identity::default(),
             Self::Run(_) | Self::BaseFix(_) => "ticket-run",
             Self::SpecRun(_) => "spec-run",
             Self::ArchitectRun(_) => "architect-run",
@@ -603,6 +642,7 @@ impl<'a> Work<'a> {
 
     fn initial_stage(self) -> Option<Stage> {
         match self {
+            Work::Starting { .. } => None,
             Work::Run(_) | Work::BaseFix(_) => Some(Stage::Implement),
             Work::SpecRun(_) => Some(Stage::Tickets),
             Work::ArchitectRun(_) => Some(Stage::ArchitectureReview),
@@ -618,6 +658,7 @@ impl<'a> Work<'a> {
     /// The repository whose work it records.
     fn repo(self) -> Repo {
         match self {
+            Work::Starting { repo, .. } => repo.clone(),
             Work::Run(issue) | Work::BaseFix(issue) | Work::SpecRun(issue) => issue.repo(),
             Work::PickupRun(listed) => listed.issue.repo(),
             Work::ArchitectRun(repo)
@@ -634,6 +675,18 @@ impl<'a> Work<'a> {
     /// Its kind, in the Activity log.
     fn kind(self) -> Kind {
         match self {
+            Work::Starting { command, .. } => match command {
+                CommandKind::Issue => Kind::Run,
+                CommandKind::Architect => Kind::Pass(Pass::Architect),
+                CommandKind::Pickup => Kind::Pass(Pass::Pickup),
+                CommandKind::Secure => Kind::Pass(Pass::Security),
+                CommandKind::Scoring => Kind::ScoringRun,
+                CommandKind::Review => Kind::ReviewRun,
+                CommandKind::Fix => Kind::FixRun,
+                CommandKind::Triage => Kind::TriageRun,
+                CommandKind::Experiment => Kind::Experiment,
+                CommandKind::Process => Kind::Process,
+            },
             Work::Run(_) | Work::BaseFix(_) => Kind::Run,
             Work::SpecRun(_) => Kind::SpecRun,
             Work::PickupRun(_) => Kind::Pass(Pass::Pickup),
@@ -651,6 +704,7 @@ impl<'a> Work<'a> {
     /// Its issue, if it has one.
     pub(crate) fn issue_url(self) -> Option<&'a IssueUrl> {
         match self {
+            Work::Starting { issue, .. } => issue,
             Work::Run(issue) | Work::BaseFix(issue) | Work::SpecRun(issue) => Some(issue),
             Work::PickupRun(listed) => Some(&listed.issue),
             Work::ArchitectRun(_)
diff --git a/src/logs/activity.rs b/src/logs/activity.rs
index 3b3628d17..88ac853b7 100644
--- a/src/logs/activity.rs
+++ b/src/logs/activity.rs
@@ -78,10 +78,26 @@ pub(super) fn tail(path: &Path, limit: u64) -> Result<Tail> {
 /// The time and unstamped text of the last line of `kind` in the tail.
 pub(super) fn last_of(tail: &str, kind: Kind) -> Option<(&str, &str)> {
     let kind = kind.to_string();
-    tail.lines().rev().find_map(|line| {
-        let unstamped = line.get(TIME_FORMAT_LENGTH + 1..)?;
-        let rest = unstamped.strip_prefix(&kind)?;
-        (rest.starts_with(' ') || rest.starts_with(':'))
-            .then_some((line.get(..TIME_FORMAT_LENGTH)?, unstamped))
+    lines(tail).rev().find(|(_, text)| {
+        text.strip_prefix(&kind)
+            .is_some_and(|rest| rest.starts_with(' ') || rest.starts_with(':'))
+    })
+}
+
+/// Compare the complete Process name: names can contain spaces and colons.
+pub(super) fn last_process_skip<'a>(tail: &'a str, name: &str) -> Option<(&'a str, &'a str)> {
+    lines(tail).rev().find(|(_, text)| {
+        text.rsplit_once(" skipped: ")
+            .and_then(|(subject, _)| subject.strip_prefix("Process "))
+            == Some(name)
+    })
+}
+
+fn lines(tail: &str) -> impl DoubleEndedIterator<Item = (&str, &str)> {
+    tail.lines().filter_map(|line| {
+        Some((
+            line.get(..TIME_FORMAT_LENGTH)?,
+            line.get(TIME_FORMAT_LENGTH + 1..)?,
+        ))
     })
 }
diff --git a/src/logs/command_record.rs b/src/logs/command_record.rs
index 8cf33a117..594e1ee3c 100644
--- a/src/logs/command_record.rs
+++ b/src/logs/command_record.rs
@@ -104,6 +104,8 @@ pub(super) struct CommandRecord {
     #[serde(skip)]
     pub end_time_estimated: bool,
     pub stages: Vec<Stage>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub quota_wait_until: Option<String>,
     pub session_log: Option<PathBuf>,
     pub outcome: Option<String>,
     #[serde(default)]
@@ -259,6 +261,7 @@ impl StageName {
     /// The stage a pass enters while `work`, the Command it dispatched, runs.
     pub(super) fn dispatched(work: Work<'_>) -> Self {
         match work {
+            Work::Starting { .. } => Self::ProcessStep,
             Work::SpecRun(_) => Self::DispatchedSpecRun,
             Work::Run(_)
             | Work::BaseFix(_)
@@ -365,11 +368,15 @@ impl CommandRecord {
     ) {
         self.ended_at = Some(outside.now().to_rfc3339());
         self.outcome = Some(account.outcome.into());
-        self.cause = account
-            .ended
-            .as_ref()
-            .err()
-            .map(|cause| cause.full().into());
+        // A Quota wait may already have opened this record. Pre-audit GitHub
+        // diagnostics stay on the terminal; the record keeps the fixed cause.
+        self.cause = account.pre_audit_failure.map(str::to_owned).or_else(|| {
+            account
+                .ended
+                .as_ref()
+                .err()
+                .map(|cause| cause.full().to_owned())
+        });
         self.pull_request = account.pr_url.map(String::from);
         self.security_findings_waiting = account.security_findings_waiting;
         self.security_findings = account.security_findings.unwrap_or_default().to_vec();
@@ -396,7 +403,8 @@ impl CommandRecord {
             // The Ready issue listing named a Pickup run's issue before it started.
             title: match work {
                 Work::PickupRun(listed) => Some(listed.title.clone()),
-                Work::Run(_)
+                Work::Starting { .. }
+                | Work::Run(_)
                 | Work::BaseFix(_)
                 | Work::SpecRun(_)
                 | Work::ArchitectRun(_)
@@ -410,6 +418,10 @@ impl CommandRecord {
             },
         });
         let name = match work {
+            Work::Starting { command, issue, .. } => match issue {
+                Some(issue) => format!("{}#{}", issue.repo_slug(), issue.number),
+                None => format!("{}-{stamp}", command.folder()),
+            },
             Work::ArchitectRun(_) => format!("architect-{stamp}"),
             Work::SecurityRun(_) => format!("secure-{stamp}"),
             Work::ScoringRun(_) => format!("scoring-{stamp}"),
@@ -444,6 +456,7 @@ impl CommandRecord {
             ended_at: None,
             end_time_estimated: false,
             stages: Vec::new(),
+            quota_wait_until: None,
             session_log: None,
             outcome: None,
             run_metrics: None,
diff --git a/src/logs/github.rs b/src/logs/github.rs
index da122f790..6a28cd38b 100644
--- a/src/logs/github.rs
+++ b/src/logs/github.rs
@@ -16,7 +16,7 @@ use serde::{Deserialize, Serialize};
 
 use super::reading::Snapshot;
 use crate::config::UserConfig;
-use crate::github::{GitHub, InboxState, IssueState, PullRequestState, Quotas};
+use crate::github::{GitHub, InboxState, IssueState, PullRequestState, QuotaWait};
 
 /// How long `status` reuses the kept answer before reading GitHub again.
 pub const FRESH_FOR: Duration = Duration::from_secs(5 * 60);
@@ -60,8 +60,6 @@ struct File {
     answered_at: BTreeMap<String, String>,
     #[serde(default)]
     failure: Option<String>,
-    #[serde(default)]
-    quotas: Option<Quotas>,
     /// The warning at the last refresh, so crossing the age threshold
     /// wakes pages even when the facts and failure are unchanged.
     #[serde(default)]
@@ -81,7 +79,7 @@ pub struct Kept {
     pub age: Option<Duration>,
     last_answered: Option<DateTime<Utc>>,
     pub failure: Option<String>,
-    quotas: Option<Quotas>,
+    waits: Vec<QuotaWait>,
 }
 
 /// The exact kept facts for a row, including dispatched work and private
@@ -185,9 +183,13 @@ impl Kept {
             .map(|at| at.to_rfc3339_opts(SecondsFormat::Secs, true))
     }
 
+    pub fn quota_wait(&self) -> Option<String> {
+        QuotaWait::pass_reason(&self.waits)
+    }
+
     pub fn warning(&self) -> Option<String> {
         let mut reasons = Vec::new();
-        if let Some(reason) = self.quotas.as_ref().and_then(Quotas::warning) {
+        if let Some(reason) = QuotaWait::warning(&self.waits) {
             reasons.push(reason);
         }
         if self.age.is_none_or(|age| age > FRESH_FOR)
@@ -208,10 +210,23 @@ impl Kept {
         })
     }
 
-    /// An open Inbox must also learn when a failed answer becomes stale.
+    /// An open Inbox must learn when an answer becomes stale or a Quota wait resets.
     pub fn next_warning_change(&self) -> Option<Duration> {
-        let age = self.age?;
-        (age <= FRESH_FOR).then(|| FRESH_FOR - age + Duration::from_millis(1))
+        let freshness = self
+            .age
+            .and_then(|age| (age <= FRESH_FOR).then(|| FRESH_FOR - age + Duration::from_millis(1)));
+        let now = Utc::now();
+        let reset = self
+            .waits
+            .iter()
+            .filter_map(|wait| {
+                (wait.reset_at() - now)
+                    .to_std()
+                    .ok()
+                    .filter(|delay| !delay.is_zero())
+            })
+            .min();
+        freshness.into_iter().chain(reset).min()
     }
 
     fn state(&self, row: &str, url: &str) -> Option<&InboxState> {
@@ -306,10 +321,13 @@ pub fn load(logs_dir: &Path) -> Kept {
                 age: modified.and_then(|at| at.elapsed().ok()),
                 last_answered: modified.map(DateTime::from),
                 failure: file.failure,
-                quotas: file.quotas,
+                waits: GitHub::new().quota_waits().unwrap_or_default(),
             }
         }
-        None => Kept::default(),
+        None => Kept {
+            waits: GitHub::new().quota_waits().unwrap_or_default(),
+            ..Kept::default()
+        },
     }
 }
 
@@ -360,16 +378,20 @@ pub(super) fn refresh(
     }
     let subjects = &work.subjects;
     let findings = &work.findings;
-    if kept.age.is_some_and(|age| age < fresh_for)
-        || !work.has_remote_reads()
-        || kept.quotas.as_ref().and_then(Quotas::warning).is_some()
-    {
+    if QuotaWait::warning(&kept.waits).is_some() {
+        // A factory call may have learned this wait outside the Inbox. Keep
+        // the warning marker in sync so open pages learn about it too.
+        save(&config.logs_dir, &kept, false)?;
+        return Ok(kept);
+    }
+    if kept.age.is_some_and(|age| age < fresh_for) || !work.has_remote_reads() {
         return Ok(kept);
     }
     let github = GitHub::new();
     match github.inbox_quotas() {
-        Ok(quotas) => kept.quotas = Some(quotas),
+        Ok(waits) => kept.waits = waits,
         Err(error) => {
+            kept.waits = github.quota_waits().unwrap_or_default();
             kept.failure = Some(format!("{error:#}"));
             save(&config.logs_dir, &kept, false)?;
             return Ok(kept);
@@ -378,12 +400,12 @@ pub(super) fn refresh(
     let mut answered = false;
     let mut read_failed = false;
     for chunk in subjects.chunks(100) {
-        if kept.quotas.as_ref().and_then(Quotas::warning).is_some() {
+        if QuotaWait::warning(&kept.waits).is_some() {
             break;
         }
         let urls: Vec<_> = chunk.iter().map(|subject| subject.url.clone()).collect();
         match github.inbox_states(&urls) {
-            Ok((states, quota)) => {
+            Ok(states) => {
                 let answered_at = Utc::now().to_rfc3339();
                 for subject in chunk {
                     let url = &subject.url;
@@ -406,13 +428,11 @@ pub(super) fn refresh(
                     kept.states.insert(url.clone(), state);
                     kept.answered_at.insert(url.clone(), answered_at.clone());
                 }
-                kept.quotas
-                    .as_mut()
-                    .expect("quotas read before rows")
-                    .graphql = quota;
+                kept.waits = github.quota_waits()?;
                 answered = true;
             }
             Err(error) => {
+                kept.waits = github.quota_waits().unwrap_or_default();
                 kept.failure = Some(format!("{error:#}"));
                 read_failed = true;
                 break;
@@ -427,7 +447,7 @@ pub(super) fn refresh(
             .push(subject);
     }
     for (repository, subjects) in repositories {
-        if kept.quotas.as_ref().and_then(Quotas::warning).is_some() {
+        if QuotaWait::warning(&kept.waits).is_some() {
             break;
         }
         // One record must not choose the request path or fail every other read.
@@ -472,8 +492,8 @@ pub(super) fn refresh(
             Err(error) => {
                 kept.failure = Some(format!("{error:#}"));
                 read_failed = true;
-                if let Ok(quotas) = github.inbox_quotas() {
-                    kept.quotas = Some(quotas);
+                if let Ok(waits) = github.inbox_quotas() {
+                    kept.waits = waits;
                 }
                 break;
             }
@@ -481,8 +501,9 @@ pub(super) fn refresh(
         // Includes every paginated request and private-storage discovery, so
         // another repository cannot start a list on an exhausted reserve.
         match github.inbox_quotas() {
-            Ok(quotas) => kept.quotas = Some(quotas),
+            Ok(waits) => kept.waits = waits,
             Err(error) => {
+                kept.waits = github.quota_waits().unwrap_or_default();
                 kept.failure = Some(format!("{error:#}"));
                 read_failed = true;
                 break;
@@ -510,7 +531,6 @@ fn save(logs_dir: &Path, kept: &Kept, answered: bool) -> Result<()> {
         findings: kept.findings.clone(),
         answered_at: kept.answered_at.clone(),
         failure: kept.failure.clone(),
-        quotas: kept.quotas.clone(),
         warning: kept.warning(),
     };
     let bytes = serde_json::to_vec(&file)?;
diff --git a/src/logs/owner.rs b/src/logs/owner.rs
index ee17ede39..4786e8689 100644
--- a/src/logs/owner.rs
+++ b/src/logs/owner.rs
@@ -136,6 +136,12 @@ pub(super) fn allocate<F: Files>(
     stamp: &str,
 ) -> Result<Allocation<F::CommandLog>> {
     let (kind, subject) = match work {
+        Work::Starting { command, issue, .. } => (
+            command,
+            issue
+                .map(|issue| format!("{}-", issue.number))
+                .unwrap_or_default(),
+        ),
         Work::Run(issue) | Work::BaseFix(issue) | Work::SpecRun(issue) => {
             (CommandKind::Issue, format!("{}-", issue.number))
         }
diff --git a/src/logs/reading.rs b/src/logs/reading.rs
index f9a6e9dca..bdabb539f 100644
--- a/src/logs/reading.rs
+++ b/src/logs/reading.rs
@@ -418,13 +418,26 @@ impl Command {
         } else {
             "died"
         };
-        let stage = record.current_stage().map(|stage| CurrentStage {
-            name: stage.name.clone(),
-            began_at: stage.began_at.clone(),
-            age_seconds: DateTime::parse_from_rfc3339(&stage.began_at)
-                .map(|began| now.signed_duration_since(began).num_seconds().max(0))
-                .unwrap_or(0),
-        });
+        let stage = record
+            .current_stage()
+            .map(|stage| CurrentStage {
+                name: record
+                    .quota_wait_until
+                    .as_ref()
+                    .map(|until| format!("Quota wait until {until}"))
+                    .unwrap_or_else(|| stage.name.clone()),
+                began_at: stage.began_at.clone(),
+                age_seconds: DateTime::parse_from_rfc3339(&stage.began_at)
+                    .map(|began| now.signed_duration_since(began).num_seconds().max(0))
+                    .unwrap_or(0),
+            })
+            .or_else(|| {
+                record.quota_wait_until.as_ref().map(|until| CurrentStage {
+                    name: format!("Quota wait until {until}"),
+                    began_at: record.started_at.clone(),
+                    age_seconds: 0,
+                })
+            });
         Self {
             account: None,
             activity: captured_activity::Activity::new(log, record.session_log.as_deref(), now),
diff --git a/src/logs/reading/health.rs b/src/logs/reading/health.rs
index ebbfa869f..e9c62c4ce 100644
--- a/src/logs/reading/health.rs
+++ b/src/logs/reading/health.rs
@@ -80,7 +80,11 @@ pub(super) fn observe(
         if let Some(stage) = &command.stage
             && !StageName::is_dispatch(&stage.name)
         {
-            if let Some(range) = ranges.get(&command.record.repository, &stage.name) {
+            if let Some(range) = command
+                .record
+                .current_stage()
+                .and_then(|underlying| ranges.get(&command.record.repository, &underlying.name))
+            {
                 // The first Slow step starts strictly above the upper range;
                 // the second starts at twice that range, on sampled seconds.
                 for threshold in [
diff --git a/src/logs/reading/tests.rs b/src/logs/reading/tests.rs
index 96cf5224c..7d53b338e 100644
--- a/src/logs/reading/tests.rs
+++ b/src/logs/reading/tests.rs
@@ -66,6 +66,39 @@ fn retained_pull_request_lookup_orders_instants_across_offsets() {
     );
 }
 
+#[test]
+fn quota_wait_keeps_slow_timing_on_the_underlying_stage() {
+    let dir = tempfile::tempdir().unwrap();
+    for number in 1..=8 {
+        let mut past = record(number);
+        past["outcome"] = "ready for review".into();
+        past["ended_at"] = "2026-10-19T11:01:00-04:00".into();
+        past["stages"] = json!([{"name":"CI watch", "began_at":"2026-10-19T11:00:00-04:00", "session_log":null}]);
+        write(dir.path(), &format!("{number}-past.command.json"), &past);
+    }
+    let mut live = record(9);
+    live["stages"] =
+        json!([{"name":"CI watch", "began_at":"2026-10-19T11:30:00-04:00", "session_log":null}]);
+    live["quota_wait_until"] = "2026-10-19T12:01:37-04:00".into();
+    write(dir.path(), "9-live.command.json", &live);
+    fs::write(
+        dir.path().join("acme/widgets/commands/issue/9-live.log"),
+        "still waiting\n",
+    )
+    .unwrap();
+    let snapshot = Snapshot::load(dir.path(), now()).unwrap();
+    let selected = snapshot.resolve("widgets#9").unwrap();
+    let Observation::Record(command) = selected.observation else {
+        panic!("record-backed Command")
+    };
+    assert_eq!(
+        command.stage.as_ref().unwrap().name,
+        "Quota wait until 2026-10-19T12:01:37-04:00"
+    );
+    assert_eq!(command.stage.as_ref().unwrap().age_seconds, 1800);
+    assert!(matches!(command.health, Some(health::Health::Slow { .. })));
+}
+
 #[test]
 fn direct_run_selection_captures_its_owner_and_reloads_retained_work() {
     let dir = tempfile::tempdir().unwrap();
diff --git a/src/logs/recording.rs b/src/logs/recording.rs
index b5ef70cc2..75885e142 100644
--- a/src/logs/recording.rs
+++ b/src/logs/recording.rs
@@ -37,6 +37,9 @@ pub(super) struct Record<O: Outside> {
     /// repository has them.
     config_warnings: Vec<String>,
     command_record: Option<(PathBuf, CommandTree)>,
+    preflight_repo: Option<Repo>,
+    preflight_issue: Option<crate::issue::IssueUrl>,
+    quota_record: bool,
     custom_process: Option<crate::processes::Identity>,
     parent_record: Option<PathBuf>,
     parent_dispatch: Option<String>,
@@ -69,6 +72,11 @@ struct Started {
     process: Option<String>,
 }
 
+enum History<'a> {
+    Kind(Kind),
+    ProcessSkip(&'a str),
+}
+
 impl Started {
     fn subject(&self) -> String {
         if let Some(name) = &self.process {
@@ -98,6 +106,9 @@ impl<O: Outside> Record<O> {
             activity_warned: false,
             config_warnings: Vec::new(),
             command_record: None,
+            preflight_repo: None,
+            preflight_issue: None,
+            quota_record: false,
             custom_process: None,
             parent_record: None,
             parent_dispatch: None,
@@ -107,6 +118,9 @@ impl<O: Outside> Record<O> {
     }
 
     pub(super) fn begin(&mut self, begin: Begin) {
+        if let Begin::Run(issue) = &begin {
+            self.preflight_issue((*issue).clone());
+        }
         self.command = match &begin {
             Begin::Run(_) => CommandKind::Issue,
             Begin::ChildRun(_, command) => *command,
@@ -162,6 +176,21 @@ impl<O: Outside> Record<O> {
         }
     }
 
+    pub(super) fn preflight_repo(&mut self, repo: Option<Repo>) {
+        if self.preflight_repo.is_none() {
+            self.preflight_repo = repo;
+        }
+    }
+
+    pub(super) fn needs_quota_repo(&self) -> bool {
+        self.command_record.is_none() && self.preflight_repo.is_none()
+    }
+
+    pub(super) fn preflight_issue(&mut self, issue: crate::issue::IssueUrl) {
+        self.preflight_repo = Some(issue.repo());
+        self.preflight_issue = Some(issue);
+    }
+
     /// Hand on the progress line `message`, to the terminal even while a
     /// quiet pass holds its other lines, and to the Command log as any
     /// other.
@@ -255,7 +284,7 @@ impl<O: Outside> Record<O> {
         let stamp = self.stamp();
         let began = matches!(self.command_log, Log::Held { .. });
         self.keep(&root, work, &stamp);
-        if began {
+        if began || self.quota_record {
             self.start_record(work, harness);
         }
         self.step(format_args!("sessions run on {harness}"));
@@ -273,7 +302,8 @@ impl<O: Outside> Record<O> {
             issue: work.issue(),
             process: match work {
                 Work::Process { name, .. } => Some((*name).to_string()),
-                Work::Run(_)
+                Work::Starting { .. }
+                | Work::Run(_)
                 | Work::BaseFix(_)
                 | Work::SpecRun(_)
                 | Work::PickupRun(_)
@@ -335,6 +365,12 @@ impl<O: Outside> Record<O> {
     fn start_record(&mut self, work: Work, harness: &Choice) {
         let stamp = self.stamp();
         let mut facts = CommandRecord::new(work, &stamp, harness, self.outside.now());
+        if self.quota_record
+            && let Some((_, tree)) = &self.command_record
+        {
+            facts.started_at = tree.command.started_at.clone();
+        }
+        self.quota_record = false;
         if matches!(work, Work::Process { .. })
             && let Some(identity) = &self.custom_process
         {
@@ -384,6 +420,9 @@ impl<O: Outside> Record<O> {
     }
 
     pub(super) fn skipped(&mut self, pass: Pass, repo: &Repo, reason: impl Display) {
+        if self.quota_record {
+            self.outcome("skipped", Some(&reason.to_string()));
+        }
         let kind = Kind::Pass(pass);
         self.activity_write(
             &self.root(repo),
@@ -407,21 +446,28 @@ impl<O: Outside> Record<O> {
         repo: &Repo,
         name: &str,
         harness: &Choice,
-        reason: &str,
+        reason: &crate::command_limit::NotAdmitted,
     ) {
         let root = self.root(repo);
         self.record_config_warnings(&root);
-        self.activity_write(
+        // Quota waits compare this named Process's last reason even when
+        // another Custom process fires between its Passes.
+        let history = if reason.is_quota_wait() {
+            History::ProcessSkip(name)
+        } else {
+            History::Kind(Kind::Process)
+        };
+        self.activity_write_with_history(
             &root,
             &format!("Process {name} skipped: {reason}"),
-            Some(Kind::Process),
+            Some(history),
         );
         let stamp = self.stamp();
         // Leave held lines unshown, so a quiet skip prints nothing. They are
         // still the Command log.
         self.retain(&root, Work::Process { repo, name }, &stamp, false);
         self.start_record(Work::Process { repo, name }, harness);
-        self.outcome("skipped", Some(reason));
+        self.outcome("skipped", Some(&reason.to_string()));
     }
 
     pub(super) fn activity(&mut self, message: impl Display) {
@@ -495,6 +541,36 @@ impl<O: Outside> Record<O> {
         self.write_record();
     }
 
+    pub(super) fn quota_wait(&mut self, until: Option<&str>) {
+        if until.is_some()
+            && self.command_record.is_none()
+            && let Some(repo) = self.preflight_repo.clone()
+            && self.logs_dir.is_some()
+            && (!self.child || self.preflight_issue.is_some())
+        {
+            let issue = self.preflight_issue.clone();
+            let work = Work::Starting {
+                repo: &repo,
+                command: self.command,
+                issue: issue.as_ref(),
+            };
+            if !self.child {
+                let stamp = self.stamp();
+                self.keep(&self.root(&repo), work, &stamp);
+            }
+            self.start_record(work, &Choice::default());
+            if let Some((_, tree)) = &mut self.command_record {
+                // No Harness has been selected or launched during preflight.
+                tree.command.harness = "not started".into();
+            }
+            self.quota_record = true;
+        }
+        if let Some((_, tree)) = &mut self.command_record {
+            tree.active().quota_wait_until = until.map(str::to_owned);
+            self.write_record();
+        }
+    }
+
     pub(super) fn unaddressed_findings(
         &mut self,
         counts: Option<crate::pull_request::UnaddressedFindings>,
@@ -825,6 +901,15 @@ impl<O: Outside> Record<O> {
     }
 
     fn activity_write(&mut self, root: &Path, line: &str, unless_last_of: Option<Kind>) {
+        self.activity_write_with_history(root, line, unless_last_of.map(History::Kind));
+    }
+
+    fn activity_write_with_history(
+        &mut self,
+        root: &Path,
+        line: &str,
+        unless_last_of: Option<History<'_>>,
+    ) {
         let appended = self.activity_append(&root.join(activity::FILE), line, unless_last_of);
         if let Err(error) = appended
             && !self.activity_warned
@@ -841,9 +926,9 @@ impl<O: Outside> Record<O> {
         &mut self,
         path: &Path,
         line: &str,
-        unless_last_of: Option<Kind>,
+        unless_last_of: Option<History<'_>>,
     ) -> Result<()> {
-        if let Some(kind) = unless_last_of {
+        if let Some(history) = unless_last_of {
             let tail = self.outside.activity_tail(path, activity::TAIL)?;
             let text = String::from_utf8_lossy(&tail.bytes);
             let whole = if tail.from > 0 {
@@ -851,7 +936,11 @@ impl<O: Outside> Record<O> {
             } else {
                 &text
             };
-            if activity::last_of(whole, kind).map(|(_, text)| text) == Some(line) {
+            let last = match history {
+                History::Kind(kind) => activity::last_of(whole, kind),
+                History::ProcessSkip(name) => activity::last_process_skip(whole, name),
+            };
+            if last.map(|(_, text)| text) == Some(line) {
                 return Ok(());
             }
         }
diff --git a/src/logs/recording/tests.rs b/src/logs/recording/tests.rs
index d2540c56d..959f626b5 100644
--- a/src/logs/recording/tests.rs
+++ b/src/logs/recording/tests.rs
@@ -292,6 +292,36 @@ fn a_stop_request_in_the_file_adapter_is_logged_before_the_ending() {
     assert!(stopped < activity.find("Run #7 ended: interrupted").unwrap());
 }
 
+#[test]
+fn quota_wait_restores_the_previous_stage_without_restarting_its_clock() {
+    let memory = Scripted::default();
+    let mut record = Record::new(memory.clone());
+    record.begin(Begin::Run(&issue()));
+    record.configured(&config(false));
+    record.started(Work::Run(&issue()), &harness());
+    record.stage(StageName::CiWatch, None);
+    let stages_before = memory.command_record().stages.len();
+    let began = memory
+        .command_record()
+        .current_stage()
+        .unwrap()
+        .began_at
+        .clone();
+    record.quota_wait(Some("2026-11-11T12:01:37Z"));
+    let waiting = memory.command_record();
+    assert_eq!(
+        waiting.quota_wait_until.as_deref(),
+        Some("2026-11-11T12:01:37Z")
+    );
+    assert_eq!(waiting.current_stage().unwrap().began_at, began);
+    record.quota_wait(None);
+    let resumed = memory.command_record();
+    assert!(resumed.quota_wait_until.is_none());
+    assert_eq!(resumed.current_stage().unwrap().name, "CI watch");
+    assert_eq!(resumed.current_stage().unwrap().began_at, began);
+    assert_eq!(resumed.stages.len(), stages_before);
+}
+
 #[test]
 fn a_command_record_write_failure_warns_once_and_keeps_the_outcome() {
     let memory = Scripted::default();
diff --git a/src/logs/status.rs b/src/logs/status.rs
index 2261e9fac..49326d7b2 100644
--- a/src/logs/status.rs
+++ b/src/logs/status.rs
@@ -29,6 +29,7 @@ struct Status<'a> {
     commands: Vec<InboxItem<'a>>,
     idle_passes: &'a [IdlePass],
     pass_starts: &'a [PassStart],
+    github_quota_wait: Option<String>,
     /// How old the Inbox's kept GitHub answer is, in seconds. `None` where
     /// no answer is kept: with no ready pull requests to read, or before
     /// the first read.
@@ -71,6 +72,7 @@ impl Read {
                 .into_rows(all),
             idle_passes: &self.snapshot.idle_passes,
             pass_starts: &self.snapshot.pass_starts,
+            github_quota_wait: self.kept.quota_wait(),
             github_answer_age_seconds: self.kept.age.map(|age| age.as_secs()),
             github_last_answered_at: self.kept.last_answered_at(),
             github_failure: self.kept.failure.as_deref(),
@@ -261,6 +263,9 @@ pub fn show(json: bool, all: bool, machine: Option<&str>, local_only: bool) -> R
         for pass in status.pass_starts.iter().filter(|_| include_local) {
             println!("{}", pass.line());
         }
+        if include_local && let Some(wait) = status.github_quota_wait {
+            println!("{wait}");
+        }
     }
     Ok(())
 }
diff --git a/src/logs/status/inbox.rs b/src/logs/status/inbox.rs
index d98e65a10..3addea989 100644
--- a/src/logs/status/inbox.rs
+++ b/src/logs/status/inbox.rs
@@ -16,6 +16,7 @@ pub(crate) struct Inbox {
     pub sections: Vec<Section>,
     pub idle_passes: Vec<IdlePass>,
     pub pass_starts: Vec<PassStart>,
+    pub github_quota_wait: Option<String>,
     pub warning: Option<&'static str>,
     pub github_warning: Option<String>,
 }
@@ -780,6 +781,7 @@ pub(super) fn from_read(
         github_warning: kept.warning(),
         idle_passes: snapshot.idle_passes.clone(),
         pass_starts: snapshot.pass_starts.clone(),
+        github_quota_wait: kept.quota_wait(),
         warning: (config.effective_waiting_line_interval() != config.waiting_line_interval).then_some(
             "logs.waiting_line_minutes must be less than inbox.silent_minutes; using half the silent time for waiting lines"),
     })
@@ -1072,6 +1074,7 @@ mod tests {
             ],
             idle_passes: Vec::new(),
             pass_starts: Vec::new(),
+            github_quota_wait: None,
             warning: None,
             github_warning: None,
         };
diff --git a/src/notification.rs b/src/notification.rs
index cd22d72b5..f7672ab30 100644
--- a/src/notification.rs
+++ b/src/notification.rs
@@ -236,6 +236,13 @@ impl RunNotification {
             host.as_deref().unwrap_or("unknown host"),
             self.started.elapsed(),
         );
+        match crate::github::quota::command::notification_line() {
+            Ok(Some(line)) => text += &format!("\n{line}\n"),
+            Ok(None) => {}
+            Err(error) => progress::step(format!(
+                "warning: could not read Command quota waits: {error:#}"
+            )),
+        }
         if account.pre_audit_failure.is_some() {
             text += &format!(
                 "Started (UTC): {}\nDiagnostics:  Check this command's stderr on {} at that time (or the scheduler's captured stderr, if scheduled).\n",
@@ -481,7 +488,11 @@ fn body(
     if let Some(log) = account.log {
         text += &format!("Session trace:  {}\n", log.display());
     }
-    if let Some(log) = command_log {
+    // A pre-audit notification uses the fixed cause. The Command log path
+    // stays on this machine: the email goes through a third party.
+    if account.pre_audit_failure.is_none()
+        && let Some(log) = command_log
+    {
         text += &format!("Command log:  {}\n", log.display());
     }
     if let Some(configured) = configured {
diff --git a/src/pickup.rs b/src/pickup.rs
index 1d15a1c11..f8d0e2f06 100644
--- a/src/pickup.rs
+++ b/src/pickup.rs
@@ -19,7 +19,7 @@ use anyhow::Result;
 
 use crate::asks::Flags;
 use crate::claim;
-use crate::command_limit::{AlreadyRunning, Sharing};
+use crate::command_limit::{NotAdmitted, Sharing};
 use crate::config::UserConfig;
 use crate::github::{GitHub, ListedIssue};
 use crate::harness::Choice;
@@ -54,9 +54,10 @@ pub struct Took {
 /// Why a Pickup run was skipped. Its `Display` is the reason, as the skipped
 /// run's one line gives it.
 pub enum Skipped {
-    /// The repository is at its Command limit on this machine, each Pass's
+    /// GitHub is in a Quota wait, or the repository is at its Command limit
+    /// on this machine, each Pass's
     /// dispatched Spec run or Run counted as part of it.
-    AlreadyRunning(AlreadyRunning),
+    NotAdmitted(NotAdmitted),
     /// The repository is at its Failure limit: `failed` lists the open
     /// issues labelled `agent-failed` that still wait for the Day shift,
     /// lowest number first, and `limit` or more stop a Pickup run from
@@ -77,7 +78,7 @@ pub enum Skipped {
 impl fmt::Display for Skipped {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match self {
-            Self::AlreadyRunning(running) => running.fmt(f),
+            Self::NotAdmitted(running) => running.fmt(f),
             Self::AtFailureLimit {
                 repo,
                 failed,
@@ -172,9 +173,9 @@ pub fn run(
         base,
     } = match launch::start(base, config.command_limit, Sharing::UpToTheLimit)? {
         Start::Clear(launch) => launch,
-        Start::AlreadyRunning(running) => {
+        Start::NotAdmitted(running) => {
             logs::skipped(Pass::Pickup, &running.repo, &running);
-            return Ok(Outcome::Skipped(Skipped::AlreadyRunning(running)));
+            return Ok(Outcome::Skipped(Skipped::NotAdmitted(running)));
         }
     };
     // Only Pickup handles Base branch CI reporting. A CI or publication failure
diff --git a/src/processes.rs b/src/processes.rs
index 57d0f4716..10e120078 100644
--- a/src/processes.rs
+++ b/src/processes.rs
@@ -636,6 +636,14 @@ fn run(command: &ProcessRun) -> Result<String> {
         Ok(issue) => issue,
         Err(error) => return Err(failed_before_steps(notification, error)),
     };
+    if let Some(issue) = &issue {
+        // Issue validation, branch selection and Claim creation all use
+        // GitHub before the first Step. They share the Command's wait budget
+        // and must already have a visible, stoppable record when they wait.
+        logs::begin(Begin::Process { name, pass: false });
+        logs::configured(&config);
+        logs::preflight_issue(issue);
+    }
     if let Err(error) = require_issue(&path, &file, issue.as_ref()) {
         return Err(failed_before_steps(notification, error));
     }
@@ -648,25 +656,30 @@ fn run(command: &ProcessRun) -> Result<String> {
     if issue.is_none() {
         logs::begin(Begin::Process { name, pass: true });
         logs::configured(&config);
-        let base = match launch::checked_out_base() {
-            Ok(base) => base,
-            Err(error) => return Err(failed_before_steps(notification, error)),
-        };
         let repo = match launch::repo() {
             Ok(repo) => repo,
             Err(error) => return Err(failed_before_steps(notification, error)),
         };
+        let skip = |reason: &command_limit::NotAdmitted| {
+            let choice = Choice::of(&command.asked, &config.harness);
+            progress::step(reason);
+            logs::skipped_process(&repo, name, &choice, reason);
+            String::new()
+        };
+        if let Some(skipped) = command_limit::quota_wait(&repo, config.command_limit) {
+            return Ok(skip(&skipped));
+        }
+        let base = match launch::checked_out_base() {
+            Ok(base) => base,
+            Err(error) => return Err(failed_before_steps(notification, error)),
+        };
         match command_limit::hold_pass(
             &repo,
             config.command_limit,
             command_limit::Sharing::UpToTheLimit,
         ) {
             Ok(Some(running)) => {
-                let reason = running.to_string();
-                let choice = Choice::of(&command.asked, &config.harness);
-                progress::step(&reason);
-                logs::skipped_process(&repo, name, &choice, &reason);
-                return Ok(String::new());
+                return Ok(skip(&running));
             }
             Ok(None) => {}
             Err(error) => return Err(failed_before_steps(notification, error)),
@@ -738,17 +751,18 @@ fn run(command: &ProcessRun) -> Result<String> {
         Ok(repo) => repo,
         Err(error) => return Err(failed_before_steps(notification, error)),
     };
-    logs::begin(Begin::Process { name, pass: false });
-    logs::configured(&config);
     finish_run(name, &repo, prepared, notification)
 }
 
 /// A stop after the email check and before any Step is still a failed Process.
 fn failed_before_steps(notification: RunNotification, error: anyhow::Error) -> anyhow::Error {
     let cause = format!("{error:#}");
+    let outcome = failure_outcome();
+    logs::ended(outcome);
+    logs::complete(outcome, Some(&cause));
     notify(
         notification,
-        "failed",
+        outcome,
         Some(&cause),
         &CompletedRuns::default(),
     );
diff --git a/src/processes/review.rs b/src/processes/review.rs
index 1272e6963..44cd55331 100644
--- a/src/processes/review.rs
+++ b/src/processes/review.rs
@@ -25,14 +25,20 @@ pub(crate) fn run(command: ReviewArgs) -> Result<String> {
                 crate::issue::Repo::of_origin(&launch.run(&["config", "remote.origin.url"])?)
                     .context("review --author needs a GitHub origin")?;
             logs::pass_fired(&repo);
+            let skip = |reason: &dyn std::fmt::Display| {
+                logs::skipped(logs::Pass::Review, &repo, reason);
+                progress::step(reason);
+                String::new()
+            };
+            if let Some(skipped) = command_limit::quota_wait(&repo, config.command_limit) {
+                return Ok(skip(&skipped));
+            }
             if let Some(running) = command_limit::hold_pass(
                 &repo,
                 config.command_limit,
                 command_limit::Sharing::UpToTheLimit,
             )? {
-                logs::skipped(logs::Pass::Review, &repo, &running);
-                progress::step(&running);
-                return Ok(String::new());
+                return Ok(skip(&running));
             }
             let github = GitHub::new();
             let mut selected = None;
@@ -49,9 +55,7 @@ pub(crate) fn run(command: ReviewArgs) -> Result<String> {
             }
             let Some(selected) = selected else {
                 let reason = format!("no waiting pull request by {author} on {}", repo.slug());
-                logs::skipped(logs::Pass::Review, &repo, &reason);
-                progress::step(reason);
-                return Ok(String::new());
+                return Ok(skip(&reason));
             };
             selected
         }
diff --git a/src/processes/source.rs b/src/processes/source.rs
index 0ed74b4b4..e1e60dae8 100644
--- a/src/processes/source.rs
+++ b/src/processes/source.rs
@@ -912,11 +912,8 @@ pub(super) fn run_issue_branch(
         }
     };
     let mut held = Some(checkout);
-    // Session traces ask for the log root, which exists once this command is
-    // configured. The Command record stays the Process; the traces are named
-    // for the issue.
-    logs::begin(Begin::Process { name, pass: false });
-    logs::configured(config);
+    // Recording began before preflight GitHub reads. The Command record
+    // stays the Process; the Session traces are named for the issue.
     if let Some(made) = &mut claim.claim {
         made.capture_private_reports();
     }
diff --git a/src/run.rs b/src/run.rs
index e5251bd72..9cd5b2051 100644
--- a/src/run.rs
+++ b/src/run.rs
@@ -777,7 +777,8 @@ mod tests {
             let spec_run = match work {
                 Work::Run(_) | Work::BaseFix(_) => false,
                 Work::SpecRun(_) => true,
-                Work::PickupRun(_)
+                Work::Starting { .. }
+                | Work::PickupRun(_)
                 | Work::ArchitectRun(_)
                 | Work::SecurityRun(_)
                 | Work::ScoringRun(_)
diff --git a/src/run_ending.rs b/src/run_ending.rs
index 59d2e21a3..176117385 100644
--- a/src/run_ending.rs
+++ b/src/run_ending.rs
@@ -586,10 +586,15 @@ impl Shown {
         match &account.ended {
             // Also on stderr, so the outcome shows even when stdout is captured.
             Ok(line) => steps.push(line.clone()),
-            Err(cause) => steps.push(cause.full().to_string()),
+            Err(cause) => steps.push(
+                account
+                    .pre_audit_failure
+                    .unwrap_or_else(|| cause.full())
+                    .to_string(),
+            ),
         }
         steps.extend(account.advice.iter().map(Advice::to_string));
-        if account.ended.is_err() {
+        if account.ended.is_err() && account.pre_audit_failure.is_none() {
             if let Some(log) = account.log {
                 steps.push(format!("{SESSION_LOG}{}", log.display()));
             }
diff --git a/src/security.rs b/src/security.rs
index b8d321bb0..a7ec97d1f 100644
--- a/src/security.rs
+++ b/src/security.rs
@@ -7,7 +7,7 @@ use anyhow::Result;
 
 use crate::asks::Flags;
 use crate::base_fix::Advice;
-use crate::command_limit::{AlreadyRunning, PassKind, Sharing};
+use crate::command_limit::{NotAdmitted, PassKind, Sharing};
 use crate::config::UserConfig;
 use crate::failed_run::FailedRun;
 use crate::github::ListedIssue;
@@ -95,7 +95,7 @@ impl From<anyhow::Error> for Ended {
 pub use crate::github::RecordedFinding;
 
 pub enum Skipped {
-    AlreadyRunning(AlreadyRunning),
+    NotAdmitted(NotAdmitted),
     ReadyIssue(ListedIssue),
     FailedFix(crate::issue::IssueUrl),
     UnchangedBase(String),
@@ -104,7 +104,7 @@ pub enum Skipped {
 impl fmt::Display for Skipped {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match self {
-            Self::AlreadyRunning(running) => running.fmt(f),
+            Self::NotAdmitted(running) => running.fmt(f),
             Self::ReadyIssue(listed) => write!(
                 f,
                 "Ready issue #{} \"{}\" goes first: {}",
@@ -157,9 +157,9 @@ pub fn run(
         Sharing::OneOfAKind(PassKind::Security),
     ) {
         Ok(Start::Clear(launch)) => launch,
-        Ok(Start::AlreadyRunning(running)) => {
+        Ok(Start::NotAdmitted(running)) => {
             logs::skipped(Pass::Security, &running.repo, &running);
-            return Outcome::Skipped(Skipped::AlreadyRunning(running));
+            return Outcome::Skipped(Skipped::NotAdmitted(running));
         }
         Err(error) => return Outcome::Audited(error.into()),
     };
diff --git a/src/triage/pass.rs b/src/triage/pass.rs
index c489ff638..0879c820f 100644
--- a/src/triage/pass.rs
+++ b/src/triage/pass.rs
@@ -44,7 +44,7 @@ pub fn run(
         base,
     } = match launch::start(base, config.command_limit, Sharing::UpToTheLimit)? {
         Start::Clear(launch) => launch,
-        Start::AlreadyRunning(running) => return Ok(skipped(&running.repo, &running)),
+        Start::NotAdmitted(running) => return Ok(skipped(&running.repo, &running)),
     };
     let failed = crate::pickup::failures(&mut LaunchAndGitHub {
         launch: directory.git(),
diff --git a/tests/architect_run.rs b/tests/architect_run.rs
index c089271c6..beade1736 100644
--- a/tests/architect_run.rs
+++ b/tests/architect_run.rs
@@ -2055,7 +2055,10 @@ fn a_second_architect_run_on_the_repository_is_skipped_while_the_first_is_mid_re
     );
     assert_eq!(scenario.entries("work"), [REPO, "widgets-architect"]);
     assert_eq!(scenario.gh_state(), github);
-    assert_eq!(scenario.gh_calls(), gh_calls);
+    assert_eq!(
+        scenario.gh_calls(),
+        [gh_calls, vec![vec!["api".into(), "rate_limit".into()]]].concat()
+    );
 
     release(&scenario);
     let first = first.finish();
diff --git a/tests/console.rs b/tests/console.rs
index 315470c6c..ff83961aa 100644
--- a/tests/console.rs
+++ b/tests/console.rs
@@ -297,6 +297,30 @@ fn console_pages_show_the_running_thirdshift_version() {
     }
 }
 
+#[test]
+fn quota_wait_stage_is_shared_by_status_show_and_console_and_resumes() {
+    let home = tempfile::tempdir().unwrap();
+    configure(home.path());
+    let mut value = record(home.path(), 7, None, 0);
+    value["quota_wait_until"] = "2026-11-11T12:01:37Z".into();
+    write_record(home.path(), 7, &value);
+    let binary = Path::new(env!("CARGO_BIN_EXE_thirdshift"));
+    let console = Console::start(binary, home.path());
+    let name = "Quota wait until";
+    let mut url = reqwest::Url::parse("http://localhost/peek").unwrap();
+    url.query_pairs_mut().append_pair("command", "widgets#7");
+    let peek_path = format!("/peek?{}", url.query().unwrap());
+    for path in ["/", &peek_path] {
+        let text = console.get(path).text().unwrap();
+        assert!(text.contains(name), "{path}: {text}");
+    }
+    value["quota_wait_until"] = Value::Null;
+    write_record(home.path(), 7, &value);
+    let text = console.get(&peek_path).text().unwrap();
+    assert!(!text.contains(name), "{text}");
+    assert!(text.contains("implement"), "{text}");
+}
+
 #[test]
 fn command_changes_push_events_over_http() {
     let home = tempfile::tempdir().unwrap();
diff --git a/tests/console/github.rs b/tests/console/github.rs
index 0bf3b0023..1239ed01b 100644
--- a/tests/console/github.rs
+++ b/tests/console/github.rs
@@ -10,7 +10,9 @@ fn start_binary(scenario: &Scenario, binary: &Path) -> Console {
     let mut command = Command::new(binary);
     command
         .args(["console", "--no-sign-in"])
+        .env_clear()
         .env("HOME", scenario.path("home"))
+        .env("XDG_CONFIG_HOME", scenario.path("home/.config"))
         .env(
             "PATH",
             format!(
@@ -609,16 +611,109 @@ fn console_and_status_share_both_quota_reserves_and_resume_at_reset() {
         );
         gh["rate_limits"][resource]["remaining"] = json!(5000);
         scenario.write_gh_state(&gh);
+        pr_is(&scenario, "MERGED");
         let mut stream = events(&console);
-        loop {
-            assert!(sse_event(&mut stream).contains("event: commands"));
-            if !console.get("/").text().unwrap().contains(description) {
-                break;
-            }
-        }
+        // The warning expires with the clock; the row moves only after the
+        // background read resumes and observes the merged pull request.
+        wait_for(&console, &mut stream, "resolved");
+        assert!(!console.get("/").text().unwrap().contains(description));
         assert!(scenario.gh_calls_of("api", "graphql").len() >= 2);
         drop(stream);
         drop(console);
         assert!(!scenario.run(&["status"]).stdout.contains("Warning:"));
     }
 }
+
+#[test]
+fn inbox_shows_a_pass_quota_wait_and_updates_when_the_machine_record_expires() {
+    let scenario = Scenario::new();
+    configure(&scenario.path("home"));
+    let mut gh = scenario.gh_state();
+    gh["rate_limits"]["core"] = json!({
+        "remaining": 499,
+        "reset": (chrono::Utc::now() + chrono::Duration::hours(1)).timestamp(),
+    });
+    scenario.write_gh_state(&gh);
+    assert_eq!(scenario.run(&["pickup"]).code, Some(0));
+    let console = start(&scenario);
+    let page = console.get("/").text().unwrap();
+    assert!(page.contains("Pickup last fired"), "{page}");
+    assert!(page.contains("class=\"github-quota-wait\""), "{page}");
+    assert!(page.contains("GitHub Quota wait until"), "{page}");
+    let response = reqwest::blocking::Client::builder()
+        .timeout(Duration::from_secs(20))
+        .build()
+        .unwrap()
+        .get(format!("{}/events", console.address))
+        .send()
+        .unwrap();
+    let mut stream = BufReader::new(response);
+    assert!(sse_event(&mut stream).contains("event: commands"));
+    assert_idle_events(&console, Duration::from_secs(1));
+    let path = scenario.path("home/.thirdshift/github-quota.json");
+    let mut record: Value = serde_json::from_slice(&fs::read(&path).unwrap()).unwrap();
+    for wait in record["waits"].as_array_mut().unwrap() {
+        wait["reset_at"] = json!((chrono::Utc::now() + chrono::Duration::seconds(6)).to_rfc3339());
+    }
+    fs::write(path, serde_json::to_vec(&record).unwrap()).unwrap();
+    loop {
+        let event = sse_event(&mut stream);
+        assert!(event.contains("event: commands"));
+        if !console
+            .get("/")
+            .text()
+            .unwrap()
+            .contains("class=\"github-quota-wait\"")
+        {
+            break;
+        }
+    }
+    assert!(
+        !console
+            .get("/")
+            .text()
+            .unwrap()
+            .contains("class=\"github-quota-wait\"")
+    );
+    drop(stream);
+    drop(console);
+}
+
+#[test]
+fn relearning_quota_identity_without_a_wait_keeps_the_inbox_idle() {
+    let scenario = Scenario::new();
+    let home = scenario.path("home");
+    configure(&home);
+    record(&home, 81, Some("failed"), 10);
+    scenario.issue_is(81, "OPEN");
+    let console = start(&scenario);
+    let mut first = events(&console);
+    wait_for(&console, &mut first, "needs you");
+    assert_idle_events(&console, Duration::from_secs(1));
+    // Keep the first subscription alive so this one does not restart the observer.
+    let mut stream = events(&console);
+    assert!(sse_event(&mut stream).contains("event: commands"));
+    let path = scenario.path("home/.thirdshift/github-quota.json");
+    assert!(path.exists());
+    fs::remove_file(&path).unwrap();
+    let began = std::time::Instant::now();
+    loop {
+        let mut line = String::new();
+        match stream.read_line(&mut line) {
+            Ok(0) => panic!("Inbox stream closed"),
+            Ok(_) => assert!(
+                !line.starts_with("event: commands"),
+                "identity bookkeeping woke the Inbox: {line}"
+            ),
+            Err(_) => {
+                assert!(began.elapsed() >= Duration::from_secs(2));
+                break;
+            }
+        }
+    }
+    assert!(path.exists(), "the quota identity was not relearned");
+    assert!(scenario.gh_calls_of("api", "user").len() >= 2);
+    drop(stream);
+    drop(first);
+    drop(console);
+}
diff --git a/tests/fakes/gh.rs b/tests/fakes/gh.rs
index 84399eea2..bafaf0458 100644
--- a/tests/fakes/gh.rs
+++ b/tests/fakes/gh.rs
@@ -1566,7 +1566,7 @@ fn api(state: &mut Json, positional: &[String], flags: &Flags) {
         advisory_api(state, positional, flags);
         return;
     }
-    if path == "user" && flags.is_empty() {
+    if path == "user" && flags.keys().all(|flag| flag == "hostname") {
         let email = state.get("user_email").cloned().unwrap_or(Null);
         println!(
             "{}",
diff --git a/tests/pass_quota.rs b/tests/pass_quota.rs
new file mode 100644
index 000000000..f54c0e2fc
--- /dev/null
+++ b/tests/pass_quota.rs
@@ -0,0 +1,310 @@
+//! Every Pass shares GitHub quota admission before its first GitHub read.
+mod support;
+
+use serde_json::json;
+use support::Scenario;
+use support::resend::ResendStandIn;
+
+fn commands() -> Vec<Vec<&'static str>> {
+    vec![
+        vec!["pickup"],
+        vec!["architect"],
+        vec!["secure"],
+        vec!["triage"],
+        vec!["review", "--author", "factory"],
+        vec!["fix"],
+        vec!["process", "notes"],
+    ]
+}
+
+fn setup(scenario: &Scenario) {
+    let dir = scenario.path("home/.thirdshift/processes");
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(
+        dir.join("notes.toml"),
+        "version = 1\ndescription = \"Notes\"\n[[steps]]\nname = \"notes\"\nskill = \"code-review\"\n",
+    )
+    .unwrap();
+}
+
+fn expire_wait(scenario: &Scenario) {
+    let path = scenario.path("home/.thirdshift/github-quota.json");
+    let mut record: serde_json::Value =
+        serde_json::from_slice(&std::fs::read(&path).unwrap()).unwrap();
+    for wait in record["waits"].as_array_mut().unwrap() {
+        wait["reset_at"] = json!("2000-01-01T00:00:00Z");
+    }
+    std::fs::write(path, serde_json::to_vec(&record).unwrap()).unwrap();
+}
+
+#[test]
+fn status_shows_the_machine_quota_wait_beside_pass_starts_until_reset() {
+    let scenario = Scenario::new();
+    let mut gh = scenario.gh_state();
+    gh["rate_limits"]["graphql"] = json!({
+        "remaining": 42,
+        "reset": (chrono::Utc::now() + chrono::Duration::hours(1)).timestamp(),
+    });
+    scenario.write_gh_state(&gh);
+    assert_eq!(scenario.run(&["pickup"]).code, Some(0));
+    let before = scenario.gh_calls();
+    let status = scenario.run(&["status"]);
+    assert_eq!(status.code, Some(0), "{}", status.stderr);
+    assert!(
+        status.stdout.contains("Pickup last fired"),
+        "{}",
+        status.stdout
+    );
+    assert!(
+        status
+            .stdout
+            .lines()
+            .any(|line| line.starts_with("GitHub Quota wait until")),
+        "{}",
+        status.stdout
+    );
+    assert!(
+        status.stdout.contains("graphql: 42 left"),
+        "{}",
+        status.stdout
+    );
+    assert_eq!(scenario.gh_calls(), before);
+    expire_wait(&scenario);
+    assert!(
+        !scenario
+            .run(&["status"])
+            .stdout
+            .lines()
+            .any(|line| line.starts_with("GitHub Quota wait until"))
+    );
+}
+
+#[test]
+fn each_pass_checks_live_quota_before_work_and_admits_exactly_500() {
+    for resource in ["core", "graphql"] {
+        for args in commands() {
+            let scenario = Scenario::new();
+            setup(&scenario);
+            let reset = (chrono::Utc::now() + chrono::Duration::hours(1)).timestamp();
+            let mut gh = scenario.gh_state();
+            gh["rate_limits"][resource] = json!({"remaining": 499, "reset": reset});
+            scenario.write_gh_state(&gh);
+            let output = scenario.run(&args);
+            assert_eq!(output.code, Some(0), "{args:?}: {}", output.stderr);
+            assert!(output.stdout.is_empty(), "{args:?}: {}", output.stdout);
+            assert!(
+                output.stderr.contains("GitHub Quota wait until"),
+                "{args:?}: {}",
+                output.stderr
+            );
+            assert!(scenario.gh_calls().iter().all(|call| {
+                call.starts_with(&["api".into(), "rate_limit".into()])
+                    || call.starts_with(&["api".into(), "user".into()])
+            }));
+            assert!(scenario.claude_calls().is_empty());
+            assert!(
+                !scenario
+                    .path("home/.thirdshift/command-slots/acme/widgets/0.slot")
+                    .exists()
+            );
+            expire_wait(&scenario);
+            gh["rate_limits"][resource]["remaining"] = json!(500);
+            scenario.write_gh_state(&gh);
+            let calls = scenario.gh_calls().len();
+            let output = scenario.run(&args);
+            assert!(
+                !output.stderr.contains("GitHub Quota wait until"),
+                "{args:?}: {}",
+                output.stderr
+            );
+            assert!(
+                scenario.gh_calls()[calls..]
+                    .iter()
+                    .any(|call| { !call.starts_with(&["api".into(), "rate_limit".into()]) })
+                    || !scenario.claude_calls().is_empty(),
+                "no work after reset: {args:?}"
+            );
+        }
+    }
+}
+
+#[test]
+fn a_non_quota_probe_failure_admits_every_pass_but_exhaustion_records_a_wait() {
+    for args in commands() {
+        let scenario = Scenario::new();
+        setup(&scenario);
+        scenario.gh_fails("api rate_limit");
+        let output = scenario.run(&args);
+        assert!(
+            !output.stderr.contains("GitHub Quota wait until"),
+            "{args:?}: {}",
+            output.stderr
+        );
+        assert!(
+            scenario
+                .gh_calls()
+                .iter()
+                .any(|call| { !call.starts_with(&["api".into(), "rate_limit".into()]) })
+                || !scenario.claude_calls().is_empty(),
+            "{args:?}"
+        );
+    }
+    for diagnostic in [
+        "HTTP 403: API rate limit exceeded for factory",
+        "GraphQL: API rate limit already exceeded (RATE_LIMITED)",
+    ] {
+        let scenario = Scenario::new();
+        let mut gh = scenario.gh_state();
+        gh["failing"] = json!(["api rate_limit"]);
+        gh["failing_stderr"] = json!(diagnostic);
+        scenario.write_gh_state(&gh);
+        let skipped = scenario.run(&["pickup"]);
+        assert_eq!(skipped.code, Some(0), "{}", skipped.stderr);
+        assert!(skipped.stdout.is_empty());
+        assert!(
+            skipped.stderr.contains("GitHub Quota wait until"),
+            "{}",
+            skipped.stderr
+        );
+        let before = scenario.gh_calls();
+        assert_eq!(scenario.run(&["pickup"]).code, Some(0));
+        assert_eq!(scenario.gh_calls(), before);
+        assert!(
+            !scenario
+                .path("home/.thirdshift/command-slots/acme/widgets/0.slot")
+                .exists()
+        );
+    }
+}
+
+#[test]
+fn exhausted_quotas_skip_even_when_login_cannot_be_probed() {
+    let scenario = Scenario::new();
+    let reset = (chrono::Utc::now() + chrono::Duration::hours(1)).timestamp();
+    let mut state = scenario.gh_state();
+    state["rate_limits"] = json!({
+        "core": {"remaining": 0, "reset": reset},
+        "graphql": {"remaining": 0, "reset": reset}
+    });
+    state["failing"] = json!(["api user", "api graphql", "auth status"]);
+    state["failing_stderr"] = json!("API rate limit exceeded (HTTP 403)");
+    scenario.write_gh_state(&state);
+    let result = scenario.run(&["pickup"]);
+    assert_eq!(result.code, Some(0), "{}", result.stderr);
+    assert!(
+        result.stderr.contains("GitHub Quota wait until"),
+        "{}",
+        result.stderr
+    );
+    assert!(
+        !scenario
+            .path("home/.thirdshift/command-slots/acme/widgets/0.slot")
+            .exists()
+    );
+    assert!(scenario.claude_calls().is_empty());
+}
+
+#[test]
+fn unchanged_quota_wait_deduplicates_alternating_custom_processes() {
+    for names in [["notes", "other-notes"], ["notes", "notes daily"]] {
+        let scenario = Scenario::new();
+        setup(&scenario);
+        std::fs::copy(
+            scenario.path("home/.thirdshift/processes/notes.toml"),
+            scenario.path(&format!("home/.thirdshift/processes/{}.toml", names[1])),
+        )
+        .unwrap();
+        let mut gh = scenario.gh_state();
+        gh["rate_limits"]["core"] = json!({
+            "remaining": 499,
+            "reset": (chrono::Utc::now() + chrono::Duration::hours(1)).timestamp(),
+        });
+        scenario.write_gh_state(&gh);
+        for _ in 0..3 {
+            for name in names {
+                let output = scenario.run(&["process", name]);
+                assert_eq!(output.code, Some(0), "{name}: {}", output.stderr);
+                assert!(output.stdout.is_empty(), "{name}: {}", output.stdout);
+            }
+        }
+        let activity = std::fs::read_to_string(
+            scenario.path("home/.thirdshift/logs/acme/widgets/activity.log"),
+        )
+        .unwrap();
+        for name in names {
+            let prefix = format!("Process {name} skipped: GitHub Quota wait until");
+            assert_eq!(
+                activity
+                    .lines()
+                    .filter(|line| line.contains(&prefix))
+                    .count(),
+                1,
+                "unchanged quota reason repeated for {name}:\n{activity}"
+            );
+        }
+    }
+}
+
+#[test]
+fn every_pass_skips_below_either_reserve_and_reuses_the_wait_without_notifications() {
+    for resource in ["core", "graphql"] {
+        let scenario = Scenario::new();
+        setup(&scenario);
+        let reset = chrono::Utc::now() + chrono::Duration::hours(1);
+        let mut gh = scenario.gh_state();
+        gh["rate_limits"][resource] = json!({"remaining": 499, "reset": reset.timestamp()});
+        // A healthy subsequent observation must not bypass the recorded wait.
+        gh["next_rate_limits"] = json!({});
+        scenario.write_gh_state(&gh);
+        let resend = ResendStandIn::replying(200, "{}");
+        scenario.user_config_is("[email]\nalways = true\nto = \"operator@example.test\"\n");
+        for _ in 0..3 {
+            for args in commands() {
+                let output = scenario.run_with_env(
+                    &args,
+                    &[
+                        ("RESEND_API_KEY", "re_test_123"),
+                        ("THIRDSHIFT_RESEND_URL", resend.url()),
+                    ],
+                );
+                assert_eq!(output.code, Some(0), "{args:?}: {}", output.stderr);
+                assert!(output.stdout.is_empty(), "{args:?}: {}", output.stdout);
+            }
+        }
+        let calls = scenario.gh_calls();
+        assert_eq!(
+            calls
+                .iter()
+                .filter(|call| call.starts_with(&["api".into(), "rate_limit".into()]))
+                .count(),
+            1,
+            "{calls:?}"
+        );
+        assert!(
+            calls.iter().all(
+                |call| call.starts_with(&["api".into(), "rate_limit".into()])
+                    || call.starts_with(&["api".into(), "user".into()])
+            ),
+            "GitHub work after skip: {calls:?}"
+        );
+        assert!(scenario.claude_calls().is_empty());
+        assert!(resend.requests().is_empty());
+        let activity = std::fs::read_to_string(
+            scenario.path("home/.thirdshift/logs/acme/widgets/activity.log"),
+        )
+        .unwrap();
+        assert_eq!(activity.lines().count(), 7, "{activity}");
+        assert!(
+            activity
+                .lines()
+                .all(|line| line.contains("skipped: GitHub Quota wait until")
+                    && line.contains(&format!("({resource}: 499 left)"))),
+            "{activity}"
+        );
+        assert!(
+            !scenario
+                .path("home/.thirdshift/command-slots/acme/widgets/0.slot")
+                .exists()
+        );
+    }
+}
diff --git a/tests/pickup_run.rs b/tests/pickup_run.rs
index b23a6e1a8..fc90ccbaa 100644
--- a/tests/pickup_run.rs
+++ b/tests/pickup_run.rs
@@ -2026,12 +2026,21 @@ fn base_makes_the_named_branch_the_dispatched_spec_runs_base_branch() {
 }
 
 /// Assert the Pickup run was stopped by a preflight check with `message`,
-/// exit 1, before any work: no session, and no call to GitHub, so no label
-/// was read or changed.
+/// exit 1, before any work: no session or issue read/change. Quota admission
+/// may have checked the resource and authenticated account first.
 fn assert_stopped_by_preflight(scenario: &Scenario, result: &RunResult, message: &str) {
     scenario.assert_rejected_before_any_work(result, message);
     assert_eq!(result.code, Some(1), "stderr: {}", result.stderr);
-    assert_eq!(scenario.gh_calls(), Vec::<Vec<String>>::new());
+    let calls = scenario.gh_calls();
+    assert!(
+        calls.is_empty()
+            || calls
+                == [
+                    vec!["api", "rate_limit"],
+                    vec!["api", "user", "--hostname", "github.com"]
+                ],
+        "GitHub work beyond quota admission: {calls:?}"
+    );
     assert_eq!(scenario.issue_labels(7), [READY_FOR_AGENT]);
 }
 
@@ -2137,7 +2146,10 @@ fn a_pickup_run_is_skipped_while_an_architect_run_on_the_repository_is_still_run
     assert_eq!(result.stdout, "");
     assert_eq!(scenario.claude_calls().len(), 1, "a session was started");
     assert_eq!(scenario.gh_state(), github);
-    assert_eq!(scenario.gh_calls(), gh_calls);
+    assert_eq!(
+        scenario.gh_calls(),
+        [gh_calls, vec![vec!["api".into(), "rate_limit".into()]]].concat()
+    );
     assert_eq!(scenario.entries("work"), [REPO, "widgets-architect"]);
     release(&scenario);
     architect.finish();
@@ -2170,7 +2182,10 @@ fn a_pickup_run_or_an_architect_run_is_skipped_while_a_pickup_runs_dispatched_ru
         assert_eq!(skipped.stdout, "");
         assert_eq!(scenario.claude_calls().len(), 1, "a session was started");
         assert_eq!(scenario.gh_state(), github);
-        assert_eq!(scenario.gh_calls(), gh_calls);
+        assert_eq!(
+            scenario.gh_calls(),
+            [gh_calls, vec![vec!["api".into(), "rate_limit".into()]]].concat()
+        );
         release(&scenario);
         let first = first.finish();
         assert_ended_with_pr(&first, &pr_from(&scenario, "issue-7"), "ready for review");
@@ -2241,7 +2256,10 @@ fn at_a_command_limit_of_2_two_pickup_runs_run_at_once_and_a_third_is_skipped_na
         assert_eq!(skipped.stdout, "");
     }
     assert_eq!(scenario.gh_state(), github);
-    assert_eq!(scenario.gh_calls(), gh_calls);
+    assert_eq!(
+        scenario.gh_calls(),
+        [gh_calls, vec![vec!["api".into(), "rate_limit".into()]; 2]].concat()
+    );
     let reason = "Pickup run skipped: at the Command limit on acme/widgets: \
                   2 Commands are running, pass.command_limit is 2";
     assert_eq!(
@@ -3036,6 +3054,13 @@ fn a_failure_limit_skip_names_every_failure_lowest_first_without_extra_github_re
     assert_eq!(
         scenario.gh_calls(),
         [
+            vec!["api".to_string(), "rate_limit".into()],
+            vec![
+                "api".to_string(),
+                "user".into(),
+                "--hostname".into(),
+                "github.com".into()
+            ],
             vec![
                 "api".to_string(),
                 "repos/acme/widgets/actions/runs?branch=main&event=push&per_page=1".into(),
diff --git a/tests/process.rs b/tests/process.rs
index 242a3965b..f819ec182 100644
--- a/tests/process.rs
+++ b/tests/process.rs
@@ -21,6 +21,38 @@ mod spec_review;
 #[path = "process/spec_run.rs"]
 mod spec_run;
 mod support;
+
+#[test]
+fn issue_branch_process_retries_quota_during_branch_selection() {
+    let scenario = Scenario::new();
+    write_process(&scenario, "ship", SHIP);
+    scenario.issue_labelled(7, &["ready-for-agent"]);
+    scenario.agent_does_for_in_session(
+        7,
+        1,
+        "echo feature > feature.txt\ngit add feature.txt\ngit commit -qm 'Add feature'\nprintf implemented > \"$FAKE_CLAUDE_FINAL_MESSAGE\"\n",
+    );
+    scenario.agent_does_for_in_session(7, 2, "printf reviewed > \"$FAKE_CLAUDE_FINAL_MESSAGE\"\n");
+    let reset = (chrono::Utc::now() + chrono::Duration::seconds(2)).timestamp();
+    let mut state = scenario.gh_state();
+    state["fail_next"] = serde_json::json!({
+        "call": "pr list", "times": 1,
+        "error": "GraphQL: API rate limit exceeded (HTTP 403)"
+    });
+    state["rate_limits"]["graphql"] = serde_json::json!({"remaining": 0, "reset": reset});
+    scenario.write_gh_state(&state);
+    let result = scenario.run_with_env(
+        &["process", "ship", "issue", "7"],
+        &[("THIRDSHIFT_QUOTA_MINUTE_MS", "1")],
+    );
+    assert_eq!(result.code, Some(0), "{}", result.stderr);
+    assert!(
+        result.stderr.contains("Quota wait until"),
+        "{}",
+        result.stderr
+    );
+    assert!(scenario.gh_calls_of("pr", "list").len() >= 2);
+}
 #[path = "process/ticket_run.rs"]
 mod ticket_run;
 
@@ -3246,7 +3278,10 @@ fn a_pickup_run_is_skipped_while_a_process_with_no_issue_is_still_running() {
     );
     assert!(scenario.claude_calls().is_empty(), "a session started");
     assert_eq!(scenario.gh_state(), github);
-    assert_eq!(scenario.gh_calls(), gh_calls);
+    assert_eq!(
+        scenario.gh_calls(),
+        [gh_calls, vec![vec!["api".into(), "rate_limit".into()]]].concat()
+    );
     assert_eq!(scenario.issue_labels(7), ["ready-for-agent"]);
     release(&scenario);
     let process = process.finish();
diff --git a/tests/quota_wait.rs b/tests/quota_wait.rs
new file mode 100644
index 000000000..a8676f7ba
--- /dev/null
+++ b/tests/quota_wait.rs
@@ -0,0 +1,370 @@
+mod support;
+
+use serde_json::json;
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+use support::Scenario;
+
+const COMMIT: &str =
+    "echo feature > feature.txt\ngit add feature.txt\ngit commit -qm 'Add feature'\n";
+const PR: &str =
+    "gh pr create --base main --head issue-7 --title 'Add feature' --body 'Closes #7' --draft\n";
+
+#[test]
+fn delivery_write_waits_for_primary_quota_and_notifies_once() {
+    let scenario = Scenario::new();
+    scenario.agent_does(&format!("{COMMIT}{PR}"));
+    let reset = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs()
+        + 3;
+    let mut state = scenario.gh_state();
+    state["fail_next"] = json!({"call":"pr ready", "times":1,
+        "error":"GraphQL: API rate limit exceeded (HTTP 403)"});
+    state["rate_limits"] = json!({"graphql":{"remaining":0,"reset":reset}});
+    scenario.write_gh_state(&state);
+
+    let result = scenario.run_with_env(
+        &[&scenario.issue_url(7)],
+        &[("THIRDSHIFT_QUOTA_MINUTE_MS", "1")],
+    );
+
+    assert_eq!(result.code, Some(0), "{}", result.stderr);
+    assert!(
+        result.stderr.contains("Quota wait until"),
+        "{}",
+        result.stderr
+    );
+    assert_eq!(scenario.gh_calls_of("pr", "ready").len(), 2);
+    let (_, notification) = support::resend::saved_notification(&scenario, "issue");
+    assert_eq!(
+        notification
+            .matches("for the GitHub quota (graphql)")
+            .count(),
+        1,
+        "{notification}"
+    );
+    assert!(
+        !scenario.gh_state()["labels"]["7"]
+            .as_array()
+            .unwrap()
+            .contains(&json!("agent-failed"))
+    );
+}
+
+#[test]
+fn ci_watch_waits_until_reset_then_delivers_without_a_repair() {
+    let scenario = Scenario::new();
+    scenario.agent_does(&format!(r#"{COMMIT}{PR}
+gh fake checks "$(git rev-parse HEAD)" '[{{"name":"test","conclusion":"success","url":"https://ci.example/test"}}]'
+python3 - <<'PY'
+import json, os, time
+path = os.environ['FAKE_GH_STATE']
+with open(path) as f: state = json.load(f)
+state['fail_next'] = {{'call':'api --paginate --jq .check_runs[]','times':1,'error':'API rate limit exceeded (HTTP 403)'}}
+state['rate_limits'] = {{'core':{{'remaining':0,'reset':int(time.time())+3}}}}
+with open(path, 'w') as f: json.dump(state, f)
+PY
+"#));
+    let result = scenario.run_with_env(
+        &[&scenario.issue_url(7)],
+        &[("THIRDSHIFT_QUOTA_MINUTE_MS", "1")],
+    );
+    assert_eq!(result.code, Some(0), "{}", result.stderr);
+    assert!(result.stderr.contains("CI passed"), "{}", result.stderr);
+    assert!(
+        result.stderr.contains("Quota wait until"),
+        "{}",
+        result.stderr
+    );
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+    assert!(
+        now >= scenario.gh_state()["rate_limits"]["core"]["reset"]
+            .as_u64()
+            .unwrap()
+    );
+    assert_eq!(
+        scenario.claude_calls().len(),
+        1,
+        "quota wait started a Repair"
+    );
+    assert_eq!(scenario.gh_state()["prs"][0]["isDraft"], false);
+    let (_, text) = support::resend::saved_notification(&scenario, "issue");
+    assert_eq!(
+        text.matches("for the GitHub quota (core)").count(),
+        1,
+        "{text}"
+    );
+    assert!(
+        !scenario
+            .issue_labels(7)
+            .iter()
+            .any(|label| label == "agent-failed")
+    );
+}
+
+#[test]
+fn secondary_limit_stops_after_five_retries_without_a_quota_wait() {
+    for failures in [1, 6] {
+        let scenario = Scenario::new();
+        scenario.agent_does(&format!("{COMMIT}{PR}"));
+        let mut state = scenario.gh_state();
+        state["fail_next"] = json!({"call":"pr ready", "times":failures,
+            "error":"GraphQL: secondary rate limit exceeded (HTTP 429)"});
+        scenario.write_gh_state(&state);
+        let result = scenario.run_with_env(
+            &[&scenario.issue_url(7)],
+            &[("THIRDSHIFT_QUOTA_MINUTE_MS", "10")],
+        );
+        assert_eq!(
+            result.code,
+            Some(if failures == 1 { 0 } else { 1 }),
+            "{}",
+            result.stderr
+        );
+        assert_eq!(
+            scenario.gh_calls_of("pr", "ready").len(),
+            failures.min(5) + 1
+        );
+        assert!(
+            !result.stderr.contains("Quota wait until"),
+            "{}",
+            result.stderr
+        );
+        let (_, text) = support::resend::saved_notification(&scenario, "issue");
+        assert!(!text.contains("for the GitHub quota"), "{text}");
+        assert!(!scenario.path("home/.thirdshift/github-quota.json").exists());
+    }
+}
+
+#[test]
+fn a_primary_wait_beyond_the_cap_returns_the_original_github_failure() {
+    let scenario = Scenario::new();
+    scenario.agent_does(&format!("{COMMIT}{PR}"));
+    let mut state = scenario.gh_state();
+    state["fail_next"] = json!({"call":"pr ready", "times":1,
+        "error":"GraphQL: API rate limit exceeded (HTTP 403)"});
+    state["rate_limits"] = json!({"graphql":{"remaining":0,"reset":4102444800u64}});
+    scenario.write_gh_state(&state);
+    let result = scenario.run(&[&scenario.issue_url(7)]);
+    assert_eq!(result.code, Some(1), "{}", result.stderr);
+    assert!(
+        result.stderr.contains(
+            "gh pr ready 1 --repo acme/widgets failed: GraphQL: API rate limit exceeded (HTTP 403)"
+        ),
+        "{}",
+        result.stderr
+    );
+    assert_eq!(scenario.gh_calls_of("pr", "ready").len(), 1);
+    let (_, text) = support::resend::saved_notification(&scenario, "issue");
+    assert!(!text.contains("for the GitHub quota"), "{text}");
+}
+
+fn wait_for_quota_stage(scenario: &Scenario) {
+    let deadline = Instant::now() + Duration::from_secs(30);
+    loop {
+        if scenario.command_record("home/.thirdshift/logs/acme/widgets/commands/issue")
+            ["quota_wait_until"].is_string() { return; }
+        assert!(
+            Instant::now() < deadline,
+            "Command never entered Quota wait"
+        );
+        std::thread::sleep(Duration::from_millis(20));
+    }
+}
+
+#[test]
+fn stop_cancels_an_ordinary_wait_but_claim_ending_waits_and_restores_its_stage() {
+    let scenario = Scenario::new();
+    scenario.issue_labelled(7, &["ready-for-agent"]);
+    scenario.agent_does(&format!(
+        "{COMMIT}{PR}touch '{}'\n",
+        scenario.path("started").display()
+    ));
+    let mut state = scenario.gh_state();
+    state["fail_next"] = json!({"call":"pr ready", "times":1,
+        "error":"GraphQL: API rate limit exceeded (HTTP 403)"});
+    let reset = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_secs()
+        + 3600;
+    state["rate_limits"] = json!({"graphql":{"remaining":0,"reset":reset}});
+    scenario.write_gh_state(&state);
+    let held = scenario.run_until(
+        &[&scenario.issue_url(7)],
+        &[("THIRDSHIFT_QUOTA_MINUTE_MS", "1")],
+        "started",
+    );
+    wait_for_quota_stage(&scenario);
+    for args in [vec!["status"], vec!["show", "widgets#7"]] {
+        let shown = scenario.run(&args);
+        assert_eq!(shown.code, Some(0), "{}", shown.stderr);
+        assert!(
+            shown.stdout.contains("Quota wait until"),
+            "{}",
+            shown.stdout
+        );
+    }
+    let mut state = scenario.gh_state();
+    state["fail_next"] = json!({"call":"api --method PUT", "times":1,
+        "error":"API rate limit exceeded (HTTP 403)"});
+    let reset = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_secs()
+        + 3;
+    state["rate_limits"]["core"] = json!({"remaining":0,"reset":reset});
+    scenario.write_gh_state(&state);
+    let stopped_at = Instant::now();
+    let stopped = scenario.run(&["stop", "widgets#7"]);
+    let result = held.finish();
+    assert_eq!(stopped.code, Some(0), "{}", stopped.stderr);
+    assert_eq!(result.code, Some(1), "{}", result.stderr);
+    assert!(
+        stopped_at.elapsed() < Duration::from_secs(30),
+        "ordinary hour wait survived Stop"
+    );
+    assert!(
+        SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_secs()
+            >= reset
+    );
+    assert_eq!(scenario.gh_state()["fail_next"]["times"], 0);
+    assert!(
+        scenario
+            .issue_labels(7)
+            .contains(&"needs-triage".to_string())
+    );
+    assert!(
+        !scenario
+            .issue_labels(7)
+            .contains(&"agent-failed".to_string())
+    );
+    let record = scenario.command_record("home/.thirdshift/logs/acme/widgets/commands/issue");
+    assert!(record["quota_wait_until"].is_null(), "{record}");
+    let (_, text) = support::resend::saved_notification(&scenario, "issue");
+    assert_eq!(
+        text.matches("for the GitHub quota (core, graphql)").count(),
+        1,
+        "{text}"
+    );
+}
+
+#[test]
+fn a_child_tickets_quota_wait_belongs_to_its_spec_commands_notification() {
+    let scenario = Scenario::new();
+    scenario.spec_has_tickets(20, &[(21, &[])]);
+    scenario.agent_does_for(21, &format!("{COMMIT}gh pr create --base issue-20 --head issue-21 --title Ticket --body 'Closes #21' --draft\n"));
+    let mut state = scenario.gh_state();
+    let reset = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_secs()
+        + 3;
+    state["fail_next"] = json!({"call":"pr ready", "times":1,
+        "error":"GraphQL: API rate limit exceeded (HTTP 403)"});
+    state["rate_limits"] = json!({"graphql":{"remaining":0,"reset":reset}});
+    scenario.write_gh_state(&state);
+    let result = scenario.run_with_env(
+        &[&scenario.issue_url(20)],
+        &[("THIRDSHIFT_QUOTA_MINUTE_MS", "1")],
+    );
+    assert_eq!(result.code, Some(0), "{}", result.stderr);
+    let (_, text) = support::resend::saved_notification(&scenario, "issue");
+    assert_eq!(
+        text.matches("for the GitHub quota (graphql)").count(),
+        1,
+        "{text}"
+    );
+    let sidecars = scenario
+        .entries("home/.thirdshift/logs/acme/widgets/commands/issue")
+        .into_iter()
+        .filter(|name| name.ends_with(".quota-wait.json"))
+        .collect::<Vec<_>>();
+    assert_eq!(sidecars.len(), 1, "{sidecars:?}");
+    assert!(sidecars[0].starts_with("20-"), "{sidecars:?}");
+}
+
+#[test]
+fn preflight_quota_wait_is_visible_and_can_be_stopped() {
+    use std::{fs, process::Stdio};
+    let scenario = Scenario::new();
+    let reset = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_secs()
+        + 3600;
+    let mut state = scenario.gh_state();
+    state["fail_next"] = json!({"call":"api graphql", "times":1,
+        "error":"GraphQL: API rate limit exceeded (HTTP 403)"});
+    state["rate_limits"] = json!({"graphql":{"remaining":0,"reset":reset}});
+    scenario.write_gh_state(&state);
+    let stderr_path = scenario.path("preflight.stderr");
+    let owned = support::child_lifetime::OwnedRuns::new();
+    let mut command = scenario.command(&[&scenario.issue_url(7)]);
+    command
+        .env("THIRDSHIFT_QUOTA_MINUTE_MS", "1")
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(fs::File::create(&stderr_path).unwrap());
+    let mut child = owned.spawn(&mut command);
+    let deadline = Instant::now() + Duration::from_secs(30);
+    loop {
+        let stderr = fs::read_to_string(&stderr_path).unwrap();
+        if stderr.contains("Quota wait until") {
+            break;
+        }
+        assert!(
+            child.try_wait().is_none() && Instant::now() < deadline,
+            "{stderr}"
+        );
+        std::thread::sleep(Duration::from_millis(20));
+    }
+    for args in [vec!["status"], vec!["show", "widgets#7"]] {
+        let result = scenario.run(&args);
+        assert_eq!(result.code, Some(0), "{}", result.stderr);
+        assert!(
+            result.stdout.contains("Quota wait until"),
+            "{}",
+            result.stdout
+        );
+    }
+    let stopped = scenario.run(&["stop", "widgets#7"]);
+    assert_eq!(stopped.code, Some(0), "{}", stopped.stderr);
+    assert!(!child.wait().success());
+    assert!(scenario.claude_calls().is_empty());
+}
+
+#[test]
+fn a_pass_that_waited_before_skipping_finishes_its_command_record() {
+    let scenario = Scenario::new();
+    let reset = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_secs()
+        + 2;
+    let mut state = scenario.gh_state();
+    state["fail_next"] = json!({"call":"api --paginate --jq", "times":1,
+        "error":"API rate limit exceeded (HTTP 403)"});
+    // Admission sees enough quota; the Sweep's subsequent read exhausts it.
+    state["next_rate_limits"] = json!({"core":{"remaining":0,"reset":reset}});
+    scenario.write_gh_state(&state);
+    let result = scenario.run_with_env(&["pickup"], &[("THIRDSHIFT_QUOTA_MINUTE_MS", "1")]);
+    assert_eq!(result.code, Some(0), "{}", result.stderr);
+    assert!(
+        result.stderr.contains("Quota wait until"),
+        "{}",
+        result.stderr
+    );
+    let record = scenario.command_record("home/.thirdshift/logs/acme/widgets/commands/pickup");
+    assert_eq!(record["outcome"], "skipped", "{record}");
+    assert!(record["ended_at"].is_string(), "{record}");
+    let shown = scenario.run(&["status"]);
+    assert!(!shown.stdout.contains("Died"), "{}", shown.stdout);
+}
diff --git a/tests/security_run.rs b/tests/security_run.rs
index fc814c854..8bac29b6d 100644
--- a/tests/security_run.rs
+++ b/tests/security_run.rs
@@ -4073,11 +4073,19 @@ fn pre_audit_github_failures_report_a_safe_cause_without_claiming_an_audit_ran()
             github["failing_stderr"] = json!(format!(
                 "{diagnostic} token=PRIVATE-CREDENTIAL Private candidate write-up. Private provider/verifier diagnostic."
             ));
+            // Admit the Pass, then report a reset beyond the Command's cap
+            // to reach the failure path whose notification privacy this checks.
+            github["next_rate_limits"] = json!({
+                "core": {"remaining": 0, "reset": 4102444800u64},
+                "graphql": {"remaining": 0, "reset": 4102444800u64}
+            });
             scenario.write_gh_state(&github);
             let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
+            let mut env = resend_env(&resend).to_vec();
+            env.push(("THIRDSHIFT_QUOTA_MINUTE_MS", "1"));
             let result = scenario.run_with_env(
                 &["secure", "harness", "codex", "email", "me@example.com"],
-                &resend_env(&resend),
+                &env,
             );
             assert_eq!(result.code, Some(1), "{}", result.stderr);
             assert!(result.stderr.contains(diagnostic), "{}", result.stderr);
@@ -4149,6 +4157,116 @@ fn pre_audit_github_failures_report_a_safe_cause_without_claiming_an_audit_ran()
     }
 }
 
+/// A within-cap Quota wait creates the Command record before pre-audit work
+/// finishes. The raw GitHub diagnostic still must not reach the Run
+/// notification, the Command log or the Command record: those outlive the
+/// process, and the notification is sent through a third party.
+#[test]
+fn within_cap_quota_wait_keeps_pre_audit_github_diagnostics_local() {
+    let scenario = Scenario::new();
+    scenario.user_config_is(&format!(
+        "[harness.codex]\nmodel = \"gpt-6.1-sol\"\neffort = \"high\"\n[logs]\ndir = {:?}\n",
+        scenario.path("custom-logs")
+    ));
+    let call = "api --paginate --jq .[] repos/acme/widgets/issues?state=open&labels=ready-for-agent&sort=created&direction=desc&per_page=100";
+    scenario.gh_fails(call);
+    let reset = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs()
+        + 3;
+    let mut github = scenario.gh_state();
+    let private = "for user ID PRIVATE-IDENTIFIER. token=PRIVATE-CREDENTIAL Private candidate write-up. Private provider/verifier diagnostic.";
+    github["fail_next"] = json!({
+        "call": call, "times": 1,
+        "error": format!("GraphQL: API rate limit already exceeded {private}")
+    });
+    github["failing_stderr"] = json!(format!("API rate limit exceeded {private}"));
+    // Both reserves admit the Pass. GraphQL exhaustion waits within the cap;
+    // the retry exhausts REST past the cap and keeps its original diagnostic.
+    github["rate_limits"] = json!({
+        "core": {"remaining": 5000, "reset": 4102444800u64},
+        "graphql": {"remaining": 5000, "reset": reset}
+    });
+    scenario.write_gh_state(&github);
+    let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
+    let mut env = resend_env(&resend).to_vec();
+    env.push(("THIRDSHIFT_QUOTA_MINUTE_MS", "1"));
+    let result = scenario.run_with_env(
+        &["secure", "harness", "codex", "email", "me@example.com"],
+        &env,
+    );
+
+    assert_eq!(result.code, Some(1), "{}", result.stderr);
+    assert!(
+        result.stderr.contains("Quota wait until"),
+        "{}",
+        result.stderr
+    );
+    assert!(
+        result.stderr.contains("PRIVATE-CREDENTIAL"),
+        "the operator's stderr keeps the diagnostic: {}",
+        result.stderr
+    );
+    for root in ["custom-logs", "home/.thirdshift/logs"] {
+        let root = scenario.path(root);
+        if !root.exists() {
+            continue;
+        }
+        for body in log_bodies(&root) {
+            for private in [
+                "PRIVATE-IDENTIFIER",
+                "PRIVATE-CREDENTIAL",
+                "Private candidate write-up.",
+                "Private provider/verifier diagnostic.",
+            ] {
+                assert!(
+                    !body.contains(private),
+                    "{private} was stored under {}: {body}",
+                    root.display()
+                );
+            }
+        }
+    }
+    let (_subject, text) = the_one_notification(&resend);
+    assert!(
+        text.contains("Cause:        GitHub rate-limit exhaustion"),
+        "{text}"
+    );
+    for private in [
+        "PRIVATE-IDENTIFIER",
+        "PRIVATE-CREDENTIAL",
+        "Private candidate write-up.",
+        "Private provider/verifier diagnostic.",
+        "Command log:",
+        "token=",
+    ] {
+        assert!(
+            !text.contains(private),
+            "{private} reached the notification: {text}"
+        );
+    }
+}
+
+fn log_bodies(root: &std::path::Path) -> Vec<String> {
+    let mut bodies = Vec::new();
+    let mut pending = vec![root.to_path_buf()];
+    while let Some(dir) = pending.pop() {
+        let Ok(entries) = fs::read_dir(&dir) else {
+            continue;
+        };
+        for entry in entries.flatten() {
+            let path = entry.path();
+            if path.is_dir() {
+                pending.push(path);
+            } else if let Ok(bytes) = fs::read(&path) {
+                bodies.push(String::from_utf8_lossy(&bytes).into_owned());
+            }
+        }
+    }
+    bodies
+}
+
 fn assert_pre_audit_response_dependency_cause(response: &str, diagnostic: &str) {
     let scenario = Scenario::new();
     let gh = scenario.path("bin/gh");
diff --git a/tests/status.rs b/tests/status.rs
index 536219931..fd67528bf 100644
--- a/tests/status.rs
+++ b/tests/status.rs
@@ -624,12 +624,14 @@ fn inbox_clears_ended_problems_on_a_later_local_start_or_the_configured_age() {
     assert_eq!(commands[0]["issue"]["number"], 12);
     assert_eq!(commands[0]["group"], "needs you");
     assert_eq!(graphql_calls(&scenario).len(), 1);
-    assert!(
-        scenario
-            .gh_calls()
-            .iter()
-            .all(|call| call[0] == "api" && matches!(call[1].as_str(), "graphql" | "rate_limit"))
-    );
+    assert!(scenario.gh_calls().iter().all(|call| {
+        call[0] == "api"
+            && (matches!(call[1].as_str(), "graphql" | "rate_limit")
+                || call
+                    .iter()
+                    .map(String::as_str)
+                    .eq(["api", "user", "--hostname", "github.com"]))
+    }));
 }
 
 #[test]
@@ -2073,6 +2075,19 @@ fn graphql_calls(scenario: &Scenario) -> Vec<Vec<String>> {
     scenario.gh_calls_of("api", "graphql")
 }
 
+fn expire_quota_wait(scenario: &Scenario, resource: &str) {
+    let path = scenario.path("home/.thirdshift/github-quota.json");
+    let mut record: Value = serde_json::from_slice(&fs::read(&path).unwrap()).unwrap();
+    let wait = record["waits"]
+        .as_array_mut()
+        .unwrap()
+        .iter_mut()
+        .find(|wait| wait["resource"] == resource)
+        .unwrap();
+    wait["reset_at"] = hours_ago(1).into();
+    fs::write(path, serde_json::to_vec(&record).unwrap()).unwrap();
+}
+
 fn age_cache_file(scenario: &Scenario, seconds: u64) {
     let file = fs::File::options()
         .write(true)
@@ -2931,10 +2946,14 @@ fn merged_pull_request_takes_its_ready_row_into_resolved_saying_so() {
         "{calls:?}"
     );
     assert!(
-        scenario
-            .gh_calls()
-            .iter()
-            .all(|call| call[0] == "api" && matches!(call[1].as_str(), "graphql" | "rate_limit")),
+        scenario.gh_calls().iter().all(|call| call[0] == "api"
+            && (matches!(call[1].as_str(), "graphql" | "rate_limit")
+                || call.iter().map(String::as_str).eq([
+                    "api",
+                    "user",
+                    "--hostname",
+                    "github.com"
+                ]))),
         "{:?}",
         scenario.gh_calls()
     );
@@ -3428,6 +3447,15 @@ fn github_failures_warn_with_last_answer_and_clear_after_recovery() {
         assert!(text.stdout.contains(diagnostic), "{}", text.stdout);
         gh["failing"] = serde_json::json!([]);
         scenario.write_gh_state(&gh);
+        if diagnostic.contains("API rate limit exceeded") {
+            let before = scenario.gh_calls();
+            let paused = scenario.run(&["status"]);
+            assert!(paused.stdout.contains("Inbox reads paused until"));
+            assert_eq!(scenario.gh_calls(), before, "read before quota reset");
+            // Removing the diagnostic does not replenish GitHub's quota.
+            // Advance the recorded reset at the fixture's time seam first.
+            expire_quota_wait(&scenario, "graphql");
+        }
         let output = scenario.run(&["status", "--json"]);
         let status: Value = serde_json::from_str(&output.stdout).unwrap();
         assert_eq!(status["github_failure"], Value::Null, "{status}");
@@ -3451,9 +3479,7 @@ fn github_failures_warn_with_last_answer_and_clear_after_recovery() {
 
 #[test]
 fn status_reserves_both_quotas_until_their_resets() {
-    for (resource, kept_name, description) in
-        [("graphql", "graphql", "GraphQL"), ("core", "rest", "REST")]
-    {
+    for (resource, description) in [("graphql", "GraphQL"), ("core", "REST")] {
         let scenario = Scenario::new();
         ready_record_with_pr(&scenario, 7, &hours_ago(48), Some(7));
         github_pr_is(&scenario, 7, "OPEN", None, None);
@@ -3504,10 +3530,7 @@ fn status_reserves_both_quotas_until_their_resets() {
             "read while {description} quota was low"
         );
         // Move the recorded reset into the past at the fixture's time seam.
-        let path = scenario.path(GITHUB_CACHE);
-        let mut kept: Value = serde_json::from_slice(&fs::read(&path).unwrap()).unwrap();
-        kept["quotas"][kept_name]["reset_at"] = hours_ago(1).into();
-        fs::write(path, serde_json::to_vec(&kept).unwrap()).unwrap();
+        expire_quota_wait(&scenario, resource);
         gh["rate_limits"][resource]["remaining"] = 5000.into();
         scenario.write_gh_state(&gh);
         let output = scenario.run(&["status", "--json"]);