[noahgift]

Fail-fast in the shard command runner converts unknowns into an absence, and an absence is indistinguishable from "passed" to every consumer downstream.

Two commits, so the RED is in the history and a reviewer can run it:

git checkout <RED>  && bash scripts/check_explicit_test_commands.sh --self-test   # rc=1, 6 failing of 72
git checkout <HEAD> && bash scripts/check_explicit_test_commands.sh --self-test   # rc=0, 72/72

What it cost

Measured on #3581: one test failing on a missing interpreter (git rev-parse --show-toplevel, #3586) produced

FAIL  [1/16] exit 101: cargo test -p aprender-core --test monorepo_invariants
      fail-fast: the 15 command(s) after it did not run

Fifteen commands never ran and nothing downstream said so. The shard reported one failure; the truth was one failure and fifteen unmeasured. One earlier shard hid 8,576 tests. Among the fifteen was the PR's own new fragment — the change most in need of proof was the least exercised, and the receipt could not tell anyone.

The same defect, in the harness written to fix it

Worth more than the 8,576, because it is the defect happening to someone who already knew about it.

While writing the RED fixture I wrote a malformed row — notfact … ; test $? -eq 7. Under set -e that aborted the self-test after row 33, hiding rows 34-37, and it reported 3 failures where there were 6.

A fail-fast abort concealing later rows, inside the harness built to stop fail-fast aborts concealing later rows. Nothing flagged it. I caught it only because the count looked too small for the number of behaviours I had asserted — which is the only way anyone ever catches this, and it is precisely the check a consumer of a shard receipt cannot make today.

A second one, kept for the same reason: my all-pass fixture used true for both fragments and the runner correctly refused a duplicate command (rc 2). My first reading was "the runner is broken". Both are recorded in the RED commit rather than quietly fixed — the wrong count is the lesson.

What lands

The default flips. Not a flag for the workflow to pass: the operator's framing is "fail-fast is a verdict-discarding default", and a flag would leave the caller choosing, per invocation, whether to discard verdicts — the defect restated, not removed.

default	every command runs; a red run still measures everything else it was going to measure
--fail-fast	opt-in, restores the old stop-at-first behaviour

A RESULT line on both paths, always:

RESULT ran=N skipped=S total=T failed=F
RESULT first-failure [i/T] exit R: <cmd>

skipped is a number. That is the whole point — an absence reads as "nothing to report"; a 2 reads as two commands nobody measured.

The exit code is the runner's own vocabulary and never a passthrough of a command's rc. Propagating one would let a test exiting 2 mean the same thing as "commands were not run" — two meanings, one spelling:

rc	meaning
0	every command ran, none failed
1	every command ran, F ≥ 1 failed — a measured failure
2	unmeasured commands exist — Unknown, doctrine 4; also every refusal

The individual rc lives in RESULT first-failure, where it is information. Row 34 pins this: the fixture's failing command exits 7, and the runner must not exit 7.

Measured end to end

A 4-command fixture whose 2nd exits 7:

	RESULT	rc
default	ran=4 skipped=0 total=4 failed=1	1 — not 7
--fail-fast	ran=2 skipped=2 total=4 failed=1	2 — UNKNOWN

No workflow edit, and that is a measurement not a hope

Callers checked on origin/main, not on a local checkout: the only invocation is ci.yml:634, a plain run: step whose rc is the step's rc, so 1 and 2 both fail it exactly as before and nothing branches on the value. .github/workflows/ is untouched by this PR. --shard and --fail-fast parse in either order; both orders measured.

Gates

Fresh worktree off origin/main (00e5d2dde):

gate	rc
check_explicit_test_commands.sh and --self-test	0 (72 rows)
check_hardcoded_paths.sh --full-if-capable	0
check_bashrs_gate.sh · check_apr_bin_pinned.sh	0
check_no_pipe_into_grep_q.sh · check_shell_lint_ratchet.sh	0
check_guards_are_wired.sh · check_sourced_libs_option_neutral.sh	0

keep-open: #3581 and #3586 are their own rows; #3561 is the same class in the T-0 preflight and is #3614; #3080 is the parent epic. Refs #3080, #3561, #3581, #3586.
ont-delta: none — a runner default and its case table, with no ontology type, shape or known-red list touched.

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3616 head=1cd876418d65380a06ae253ee53fc3ebc4b421c1 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.