diff --git a/.github/actions/prepare-native/action.yml b/.github/actions/prepare-native/action.yml
index b584a86e72..e209da771d 100644
--- a/.github/actions/prepare-native/action.yml
+++ b/.github/actions/prepare-native/action.yml
@@ -5,6 +5,10 @@ inputs:
     description: Installed Core interpreter command or executable path
     required: false
     default: python
+  host-dependencies:
+    description: Also install the locked runtime host packages Core's durable host imports from beside it (src/agent_comms)
+    required: false
+    default: "false"
 runs:
   using: composite
   steps:
@@ -18,3 +22,8 @@ runs:
     - name: Prepare pinned native Pi
       shell: bash
       run: stack/bin/prepare-pi-native --python "$(command -v '${{ inputs.python }}')"
+    - name: Install locked runtime host dependencies
+      if: inputs.host-dependencies == 'true'
+      shell: bash
+      working-directory: src/agent_comms
+      run: npm ci --ignore-scripts --omit=dev --no-audit --no-fund
diff --git a/.github/actions/prepare-python/action.yml b/.github/actions/prepare-python/action.yml
new file mode 100644
index 0000000000..919a0ca00c
--- /dev/null
+++ b/.github/actions/prepare-python/action.yml
@@ -0,0 +1,11 @@
+name: Prepare Python
+description: Set up the interpreter pyproject.toml names and install Core, the refactor-audit skill and the test dependencies, editable.
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-python@v5
+      with:
+        python-version-file: pyproject.toml
+    - name: Install agent-comms and test dependencies
+      shell: bash
+      run: python -m pip install -e src/agent_comms/skills/refactor-audit -e '.[dev]'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 38e53fe931..6191c7f3bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,18 +72,13 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: pyproject.toml
+      - name: Prepare Python
+        uses: ./.github/actions/prepare-python
 
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -e src/agent_comms/skills/refactor-audit -e ".[dev]"
-
-      - name: Prepare pinned native Pi
+      - name: Prepare pinned native Pi and its runtime host dependencies
         uses: ./.github/actions/prepare-native
+        with:
+          host-dependencies: "true"
 
       - name: Check the native pin matches the tree
         run: pytest tests/test_native_pin.py --no-cov -q
@@ -95,12 +90,6 @@ jobs:
         run: |
           npm install -g --prefix "$HOME/.local/pi-npm" --ignore-scripts --no-audit --no-fund @earendil-works/pi-coding-agent@0.85.1
 
-      # The durable host imports pi-durable, pi-ai and chord from beside it.
-      - name: Install locked runtime host dependencies
-        working-directory: src/agent_comms
-        shell: bash
-        run: npm ci --ignore-scripts --omit=dev --no-audit --no-fund
-
       - name: Run tests with coverage (85% enforced on Linux)
         if: matrix.os == 'ubuntu-latest'
         run: |
diff --git a/.github/workflows/debt-ratchet.yml b/.github/workflows/debt-ratchet.yml
index 0e03744890..9ada8de4d7 100644
--- a/.github/workflows/debt-ratchet.yml
+++ b/.github/workflows/debt-ratchet.yml
@@ -21,11 +21,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: actions/setup-python@v5
-        with:
-          python-version-file: pyproject.toml
-      - name: Install agent-comms and test dependencies
-        run: python -m pip install -e src/agent_comms/skills/refactor-audit -e '.[dev]'
+      - name: Prepare Python
+        uses: ./.github/actions/prepare-python
       - name: Compile production and tools
         run: python -m compileall -q src tools
       - name: Import every Core and hook module
@@ -47,6 +44,33 @@ jobs:
       - name: Stack clients import only modules Core has
         run: python tools/module_layers.py --check
 
+  touched-tests:
+    # A pull request that edits a test file runs it: two PRs on 2026-10-21 reported a touched
+    # test green while it failed (2510, 2560), and smoke only collects the suite.
+    name: touched-tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - name: Prepare Python
+        uses: ./.github/actions/prepare-python
+      - name: Prepare pinned native Pi and its runtime host dependencies
+        uses: ./.github/actions/prepare-native
+        with:
+          host-dependencies: "true"
+      - name: Run every test file the change touches
+        env:
+          BASE: ${{ github.event.merge_group.base_sha || github.event.pull_request.base.sha }}
+        run: |
+          changed=$(git diff --name-only --diff-filter=AMR "$BASE" HEAD -- 'tests/test_*.py' 'tests/**/test_*.py')
+          if [ -z "$changed" ]; then echo "no test file touched"; exit 0; fi
+          mapfile -t touched <<<"$changed"
+          printf '%s\n' "${touched[@]}"
+          timeout 15m pytest -q -p no:cacheprovider -o faulthandler_timeout=60 "${touched[@]}"
+
   native-scripts:
     name: native-scripts
     runs-on: ubuntu-latest