From 2e082ae7914a6cad52ce81fb48df0ffeb1a12c90 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Thu, 8 Oct 2026 16:24:22 +0200
Subject: [PATCH 01/11] ci(x86-main): fence the fat_driver case table so
 planted rows raise no annotations

The "external job 'workspace-test': not completed within 12000s" error on
x86-main never came from a wait. x86-main runs no --external-job. The line,
and "section a: failure" / "section a: cancelled" beside it, are ::error::
workflow commands printed by planted rows of `fat_driver.py self-test`,
which passed 60/60 about a minute into the job. GitHub turned them into
job error annotations. When the job went red later on another section
(#4813 pr-review-sign, #4913 guard-tree at its 3600 s budget), the
annotation was read as the cause.

scripts/ci/fence_workflow_commands.sh runs a case table between
`::stop-commands::<token>` and `::<token>::` (fresh token, never exported,
stderr merged into the one ordered pipe). The step's verdict is the
table's rc, and a failing table gets one live ::error:: naming it. Both
fat_driver self-test steps (x86-main, workspace-test-shard) go through
it. `fat_driver.py run`/`wait` stay unfenced, so a real deadline still
annotates. The script's wiring check is RED on an unfenced self-test step
and on a fenced real run. It runs, with its 19-row case table, in
x86-main's cheap-checks step.

No gate loosened: same commands, same exit codes, one guard added.

Refs #4936

Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml              |   8 +-
 docs/roadmaps/entries/PMAT-4936.yaml  |  18 +++
 docs/roadmaps/roadmap.yaml            |  18 +++
 scripts/ci/fence_workflow_commands.sh | 200 ++++++++++++++++++++++++++
 4 files changed, 242 insertions(+), 2 deletions(-)
 create mode 100644 docs/roadmaps/entries/PMAT-4936.yaml
 create mode 100644 scripts/ci/fence_workflow_commands.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index db2067e8ab..c0632a0d64 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -204,11 +204,15 @@ jobs:
           setsid --wait bash scripts/check_no_claim_literals.sh --selftest
           setsid --wait bash scripts/check_hardcoded_paths.sh --self-test
           setsid --wait bash scripts/check_pr_review_wiring.sh --self-test
+          setsid --wait bash scripts/ci/fence_workflow_commands.sh --self-test
+          setsid --wait bash scripts/ci/fence_workflow_commands.sh
       # The driver decides what every section's if:/matrix/needs means and whether
       # the vendored workflow is the upstream one; its case table must go RED on
       # each planted defect before it is trusted to report a section green.
+      # #4936: fenced, so the planted rows' ::error:: lines ("external job
+      # 'workspace-test': not completed within 12000s") are not job annotations.
       - name: fat_driver case table must still turn RED
-        run: python3 scripts/ci/fat_driver.py self-test
+        run: bash scripts/ci/fence_workflow_commands.sh -- python3 scripts/ci/fat_driver.py self-test
       # PMAT-4510: every secrets.<NAME> a section reads must be plumbed above as
       # FAT_SECRET_<NAME> under its full name; #4441 cut one short and the
       # receipt signer ran with an empty key on every PR. Text-only, no build.
@@ -500,7 +504,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: fat_driver case table must still turn RED
-        run: python3 scripts/ci/fat_driver.py self-test
+        run: bash scripts/ci/fence_workflow_commands.sh -- python3 scripts/ci/fat_driver.py self-test
       # `?` for the brackets and the comma: --sections splits on commas.
       - name: Sections
         id: run
diff --git a/docs/roadmaps/entries/PMAT-4936.yaml b/docs/roadmaps/entries/PMAT-4936.yaml
new file mode 100644
index 0000000000..852b202067
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4936.yaml
@@ -0,0 +1,18 @@
+- id: PMAT-4936
+  github_issue: 4936
+  item_type: task
+  title: 'x86-main: fat_driver self-test prints live ::error:: annotations (false 12000s red)'
+  status: inprogress
+  priority: high
+  assigned_to: null
+  created: 2026-10-08T14:17:11Z
+  updated: 2026-10-08T14:17:16.352731207+00:00
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: null
+  epic: 3998
diff --git a/docs/roadmaps/roadmap.yaml b/docs/roadmaps/roadmap.yaml
index 568507b532..c54e4f88a2 100644
--- a/docs/roadmaps/roadmap.yaml
+++ b/docs/roadmaps/roadmap.yaml
@@ -24294,3 +24294,21 @@ Not done, pending the ruling: moving the 31 fixture files to an obviously synthe
   labels:
   - kind:code
   notes: 'Cause: the test writes a script then execs it while sibling test threads fork; a child forked in that window holds the write fd, so exec fails with ETXTBSY (run 37403017673, workspace-test shard 3). Passed on the same PR head in run 37408602581.'
+- id: PMAT-4936
+  github_issue: 4936
+  item_type: task
+  title: 'x86-main: fat_driver self-test prints live ::error:: annotations (false 12000s red)'
+  status: inprogress
+  priority: high
+  assigned_to: null
+  created: 2026-10-08T14:17:11Z
+  updated: 2026-10-08T14:17:16.352731207+00:00
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: null
+  epic: 3998
diff --git a/scripts/ci/fence_workflow_commands.sh b/scripts/ci/fence_workflow_commands.sh
new file mode 100644
index 0000000000..d68a67a536
--- /dev/null
+++ b/scripts/ci/fence_workflow_commands.sh
@@ -0,0 +1,200 @@
+#!/usr/bin/env bash
+# fence_workflow_commands.sh -- run a case table with GitHub's workflow-command
+# processing stopped for its output, so a planted row cannot raise a live
+# annotation on the job (#4936).
+#
+# WHY THIS EXISTS
+# ---------------
+# `fat_driver.py self-test` drives the real code paths with planted failures,
+# and those paths print real `::error::` workflow commands: "section a:
+# failure", "section a: cancelled" and "external job 'workspace-test': not
+# completed within 12000s". The table passed 60/60, yet every x86-main and
+# workspace-test shard job carried those three as error annotations about a
+# minute in. x86-main runs no --external-job at all, so its 12000s line could
+# only ever come from the table; when the job went red half an hour later on
+# another section, the annotation was read as the cause (#4813, #4913).
+#
+# The fence is GitHub's own `::stop-commands::<token>` ... `::<token>::`. The
+# token is drawn fresh per call and never exported, so the child cannot end
+# the fence early. The child's stderr is merged into stdout so every line
+# crosses one pipe in order and none lands after the resume line. The verdict
+# is untouched: the child's exit status is the step's, and a failing table gets
+# one live ::error:: naming it, after the fence.
+#
+# Only case tables are fenced. `fat_driver.py run` and `wait` stay unfenced:
+# their deadline ::error:: is the real one, and the wiring check refuses a
+# fenced one.
+#
+#   bash scripts/ci/fence_workflow_commands.sh -- python3 scripts/ci/fat_driver.py self-test
+#   bash scripts/ci/fence_workflow_commands.sh            # wiring check of ci.yml
+#   bash scripts/ci/fence_workflow_commands.sh --self-test
+#   bash scripts/ci/fence_workflow_commands.sh --live <log>   # live annotation count
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WORKFLOW_REL=".github/workflows/ci.yml"
+FENCE_REL="scripts/ci/fence_workflow_commands.sh"
+
+# fenced <cmd...> -> the child's output between a stop line and its resume
+# line. rc = the child's rc; 2 when no command is given or no token is drawn.
+fenced() {
+  if [ "$#" -eq 0 ]; then
+    printf '::error::%s: no command to fence\n' "$FENCE_REL"
+    return 2
+  fi
+  local tok rc
+  tok="$(od -An -N16 -tx1 /dev/urandom | tr -d ' \n')"
+  if [ "${#tok}" -ne 32 ]; then
+    printf '::error::%s: no stop-commands token drawn\n' "$FENCE_REL"
+    return 2
+  fi
+  printf '::stop-commands::%s\n' "$tok"
+  "$@" 2>&1
+  rc=$?
+  printf '::%s::\n' "$tok"
+  if [ "$rc" -ne 0 ]; then
+    printf '::error::case table failed (rc=%s): %s\n' "$rc" "$*"
+  fi
+  return "$rc"
+}
+
+# live_commands <log> -> how many annotation commands the runner would act on:
+# ::error/::warning/::notice lines outside every stop..resume region.
+live_commands() {
+  awk '
+    stop != "" { if ($0 == "::" stop "::") stop = ""; next }
+    /^::stop-commands::/ { stop = substr($0, 18); next }
+    /^::(error|warning|notice)( [^:]*)?::/ { n++ }
+    END { print n + 0 }' "$1"
+}
+
+# check_wiring <ci.yml> -> one FAIL line per defect. rc 0 = every
+# `fat_driver.py self-test` runs through the fence and no `fat_driver.py run`
+# or `wait` does; 1 = a defect; 2 = unreadable, or no self-test step found.
+check_wiring() {
+  [ -r "$1" ] || return 2
+  local bad=0 seen=0 line
+  while IFS= read -r line; do
+    seen=$((seen + 1))
+    case "$line" in
+      *"$FENCE_REL -- python3 scripts/ci/fat_driver.py self-test"*) ;;
+      *)
+        printf 'FAIL: %s runs the fat_driver case table unfenced -- its planted rows raise live ::error:: annotations: %s\n' \
+          "$WORKFLOW_REL" "$(printf '%s' "$line" | sed -E 's/^[[:space:]]+//')"
+        bad=1 ;;
+    esac
+  done < <(grep -E 'fat_driver\.py self-test' "$1")
+  while IFS= read -r line; do
+    printf 'FAIL: %s fences a real fat_driver run -- its deadline ::error:: must stay live: %s\n' \
+      "$WORKFLOW_REL" "$(printf '%s' "$line" | sed -E 's/^[[:space:]]+//')"
+    bad=1
+  done < <(grep -E "$FENCE_REL.*fat_driver\\.py (run|wait)" "$1")
+  [ "$seen" -gt 0 ] || return 2
+  return "$bad"
+}
+
+self_test() {
+  printf '=== case table: fence_workflow_commands.sh ===\n'
+  local tmp fails=0 rc t1 t2 good
+  tmp="$(mktemp -d)"
+  trap 'rm -rf "${tmp:?}"' RETURN
+  row() {  # row <label> <want> <got>
+    if [ "$2" = "$3" ]; then
+      printf '  ok   %-66s %s\n' "$1" "$3"
+    else
+      printf '  FAIL %-66s want=%s got=%s\n' "$1" "$2" "$3"
+      fails=$((fails + 1))
+    fi
+  }
+  # The three lines the fat_driver table printed live on #4813 and #4913.
+  printf '%s\n' '#!/usr/bin/env bash' \
+    "printf '%s\n' '::error::section a: failure' '::error::section a: cancelled'" \
+    "printf '%s\n' \"::error::external job 'workspace-test': not completed within 12000s\"" \
+    'printf "fat_driver self-test: 60/60 rows as expected\n"' \
+    'exit "${1:-0}"' > "$tmp/table.sh"
+
+  bash "$tmp/table.sh" > "$tmp/bare.out" 2>&1
+  row 'control: the #4813 table unfenced raises 3 live annotations' 3 "$(live_commands "$tmp/bare.out")"
+
+  fenced bash "$tmp/table.sh" > "$tmp/pass.out"; rc=$?
+  row 'the #4813 table fenced: passes' 0 "$rc"
+  row 'the #4813 table fenced: 0 live annotations' 0 "$(live_commands "$tmp/pass.out")"
+  t1="$(sed -n '1s/^::stop-commands:://p' "$tmp/pass.out")"
+  row 'the fence opens on line 1 with a 32-hex token' 1 "$(printf '%s\n' "$t1" | grep -cE '^[0-9a-f]{32}$')"
+  row 'the fence closes on the last line with the same token' 1 "$([ "$(tail -n 1 "$tmp/pass.out")" = "::$t1::" ] && echo 1 || echo 0)"
+  row 'the table output is kept, inside the fence' 1 "$(grep -c '^fat_driver self-test: 60/60 rows as expected$' "$tmp/pass.out")"
+
+  fenced bash "$tmp/table.sh" 3 > "$tmp/fail.out"; rc=$?
+  row 'a failing table still fails: its rc is the step rc' 3 "$rc"
+  row 'a failing table: exactly 1 live annotation, after the fence' 1 "$(live_commands "$tmp/fail.out")"
+  row 'a failing table: the live annotation names it' 1 \
+    "$(tail -n 1 "$tmp/fail.out" | grep -cF "::error::case table failed (rc=3): bash $tmp/table.sh 3")"
+
+  fenced sh -c 'printf "::error::from stderr\n" >&2' > "$tmp/stderr.out"
+  row 'stderr is fenced too (merged into the one ordered pipe)' 0 "$(live_commands "$tmp/stderr.out")"
+
+  fenced sh -c 'printf "::0123456789abcdef0123456789abcdef::\n::error::after a guessed resume\n"' > "$tmp/guess.out"
+  row 'a resume line with another token does not end the fence' 0 "$(live_commands "$tmp/guess.out")"
+
+  fenced env > "$tmp/env.out"
+  t2="$(sed -n '1s/^::stop-commands:://p' "$tmp/env.out")"
+  row 'the token is not in the child environment' 0 "$(sed '1d;$d' "$tmp/env.out" | grep -c "${t2:-no-token-drawn}")"
+  row 'the token is fresh per call' 1 "$([ -n "$t1" ] && [ "$t1" != "$t2" ] && echo 1 || echo 0)"
+
+  fenced > "$tmp/none.out"; rc=$?
+  row 'no command to fence is refused' 2 "$rc"
+
+  # Wiring: the self-test steps go through the fence, the real runs never do.
+  good="          python3 scripts/ci/fat_driver.py run --sections x"
+  printf '        run: bash %s -- python3 scripts/ci/fat_driver.py self-test\n%s\n' "$FENCE_REL" "$good" > "$tmp/ok.yml"
+  check_wiring "$tmp/ok.yml" > /dev/null; row 'wiring: fenced self-test, unfenced run' 0 "$?"
+  printf '        run: python3 scripts/ci/fat_driver.py self-test\n%s\n' "$good" > "$tmp/bare.yml"
+  check_wiring "$tmp/bare.yml" > /dev/null; row 'wiring: an unfenced self-test is RED (the #4936 state)' 1 "$?"
+  printf '        run: bash %s -- python3 scripts/ci/fat_driver.py self-test\n        run: bash %s -- python3 scripts/ci/fat_driver.py run --sections x\n' \
+    "$FENCE_REL" "$FENCE_REL" > "$tmp/runfenced.yml"
+  check_wiring "$tmp/runfenced.yml" > /dev/null; row 'wiring: a fenced real run is RED (its deadline must stay live)' 1 "$?"
+  printf '%s\n' "$good" > "$tmp/noselftest.yml"
+  check_wiring "$tmp/noselftest.yml" > /dev/null; row 'wiring: no self-test step found is not clean' 2 "$?"
+  check_wiring "$tmp/absent.yml" > /dev/null; row 'wiring: an unreadable workflow is not clean' 2 "$?"
+
+  if [ "$fails" -gt 0 ]; then
+    printf '\nFAIL: %s case(s) failed. The fence does not do what it claims.\n' "$fails"
+    return 1
+  fi
+  printf 'PASS: all cases behave as declared.\n'
+  return 0
+}
+
+case "${1:-}" in
+  --self-test)
+    self_test
+    exit $?
+    ;;
+  --)
+    shift
+    fenced "$@"
+    exit $?
+    ;;
+  --live)
+    [ -r "${2:-}" ] || { printf 'usage: %s --live <log>\n' "$FENCE_REL" >&2; exit 2; }
+    live_commands "$2"
+    exit 0
+    ;;
+  "")
+    printf '=== every fat_driver case table in ci.yml is fenced, no real run is (fence_workflow_commands.sh) ===\n'
+    check_wiring "$REPO_ROOT/$WORKFLOW_REL"
+    rc=$?
+    if [ "$rc" -eq 2 ]; then
+      printf 'FAIL: %s is unreadable or runs no fat_driver self-test -- a check that read nothing certifies nothing.\n' "$WORKFLOW_REL"
+      exit 1
+    fi
+    [ "$rc" -eq 0 ] || exit 1
+    printf 'PASS: %s fat_driver self-test step(s), each fenced; no real run fenced.\n' \
+      "$(grep -cE 'fat_driver\.py self-test' "$REPO_ROOT/$WORKFLOW_REL")"
+    exit 0
+    ;;
+  *)
+    printf 'usage: %s [--self-test | --live <log> | -- <cmd> [args...]]\n' "$FENCE_REL" >&2
+    exit 2
+    ;;
+esac

From d7785eaa6f6c930ff5bb0ab4dbc973245749b593 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Thu, 8 Oct 2026 17:51:33 +0200
Subject: [PATCH 02/11] fix(ci): section git fetch reads up to 3 times under
 P6, a stalled read is cut

Shard, determinism and x86-main sections died on one git fetch:
"curl 92 HTTP/2 stream was not closed cleanly: CANCEL" or "curl 56
Recv failure: Connection reset by peer", on every host alike. The tier
step's depth-1 fetch of main ran 376 s and died although main's objects
were already in the section clone: the read did not answer, it was not
too big. Every section fetch was a single read.

scripts/ci/fetch_p6.sh replaces `git fetch` at all 11 call sites in
ci/sections.yml. P6: a read that did not answer is read at most 3 times;
an answer (missing ref, not found, 401/403/404) is never re-read; each
re-read is one status line. Every read runs under http.lowSpeedLimit
1000 B/s for 60 s, so a stall ends in a re-read, not a hung section.
A failure on all 3 reads still fails the step, and the `|| true` fallback
at the tier step is unchanged.

Case table: 23 rows (planted git + real file:// remote); 6 mutants each
lose rows (1 read, 4 reads, answers re-read, no stall cut, no wait,
wiring that read nothing). --check-wiring is RED on any bare git fetch
in ci/sections.yml (12 FAIL lines before this change). Both run in
x86-main Cheap checks.

Refs #4936
Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml             |   2 +
 ci/sections.yml                      |  22 +--
 docs/roadmaps/entries/PMAT-4936.yaml |   2 +-
 docs/roadmaps/roadmap.yaml           |   2 +-
 scripts/ci/fetch_p6.sh               | 226 +++++++++++++++++++++++++++
 5 files changed, 241 insertions(+), 13 deletions(-)
 create mode 100644 scripts/ci/fetch_p6.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c0632a0d64..230c8f4938 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -206,6 +206,8 @@ jobs:
           setsid --wait bash scripts/check_pr_review_wiring.sh --self-test
           setsid --wait bash scripts/ci/fence_workflow_commands.sh --self-test
           setsid --wait bash scripts/ci/fence_workflow_commands.sh
+          setsid --wait bash scripts/ci/fetch_p6.sh --self-test
+          setsid --wait bash scripts/ci/fetch_p6.sh --check-wiring
       # The driver decides what every section's if:/matrix/needs means and whether
       # the vendored workflow is the upstream one; its case table must go RED on
       # each planted defect before it is trusted to report a section green.
diff --git a/ci/sections.yml b/ci/sections.yml
index 249aedae8c..cf2507c8e6 100644
--- a/ci/sections.yml
+++ b/ci/sections.yml
@@ -370,8 +370,8 @@ jobs:
           # warning below says so instead of the run silently paying the hour.
           case "${GITHUB_EVENT_NAME}" in
             merge_group|push)
-              git fetch --no-tags --depth=2 origin "${GITHUB_SHA}" 2>/dev/null \
-                || git fetch --no-tags --deepen=1 origin 2>/dev/null \
+              bash scripts/ci/fetch_p6.sh --no-tags --depth=2 origin "${GITHUB_SHA}" 2>/dev/null \
+                || bash scripts/ci/fetch_p6.sh --no-tags --deepen=1 origin 2>/dev/null \
                 || true
               if git rev-parse -q --verify 'HEAD^1' >/dev/null 2>&1; then
                 printf 'first parent available: %s\n' "$(git rev-parse HEAD^1)"
@@ -382,7 +382,7 @@ jobs:
           esac
           case "${GITHUB_EVENT_NAME}" in
             pull_request)
-              git fetch --no-tags --depth=1 origin "+refs/heads/${GITHUB_BASE_REF}:refs/remotes/origin/${GITHUB_BASE_REF}"
+              bash scripts/ci/fetch_p6.sh --no-tags --depth=1 origin "+refs/heads/${GITHUB_BASE_REF}:refs/remotes/origin/${GITHUB_BASE_REF}"
               # --no-renames (#3664): a rename must list BOTH paths, or a source
               # moved into docs/ reads as docs-only and runs zero tests.
               git diff --no-renames --name-only "origin/${GITHUB_BASE_REF}" HEAD > "$RUNNER_TEMP/touched.txt"
@@ -393,7 +393,7 @@ jobs:
               pr=$(printf '%s' "${GITHUB_REF_NAME}" | sed -n 's|^gh-readonly-queue/[^/]*/pr-\([0-9]*\)-.*|\1|p')
               if [ -n "$pr" ]; then
                 head=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${pr}" --jq .head.sha)
-                git fetch --no-tags --depth=1 origin "$head"
+                bash scripts/ci/fetch_p6.sh --no-tags --depth=1 origin "$head"
                 concl=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${head}/check-runs?check_name=workspace-test&per_page=20" --jq '[.check_runs[]|select(.status=="completed")]|sort_by(.completed_at)|last|.conclusion // "none"')
                 args+=(--pr-head "$head" --pr-head-conclusion "${concl:-none}")
               fi
@@ -439,7 +439,7 @@ jobs:
             merge_group) base="${MG_BASE_SHA:-}" ;;
             push) base="${PUSH_BEFORE:-}" ;;
             workflow_dispatch)
-              git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
+              bash scripts/ci/fetch_p6.sh --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
               printf 'refinement base: origin/main tip %s (workflow_dispatch has no event base)\n' "$(git rev-parse origin/main)"
               exit 0
               ;;
@@ -449,7 +449,7 @@ jobs:
             printf '::error::refinement base: %s event carries no base sha (got "%s")\n' "${GITHUB_EVENT_NAME}" "$base"
             exit 1
           fi
-          git fetch --no-tags --depth=1 origin "$base"
+          bash scripts/ci/fetch_p6.sh --no-tags --depth=1 origin "$base"
           git update-ref refs/remotes/origin/main "$base"
           printf 'refinement base: %s base %s pinned as origin/main\n' "${GITHUB_EVENT_NAME}" "$(git rev-parse 'origin/main^{commit}')"
       - name: Workspace lib tests (25,300+)
@@ -1154,11 +1154,11 @@ jobs:
       - id: guard-setup
         name: Fetch origin/main as the comparand for every ratchet in this job
         run: |
-          git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
+          bash scripts/ci/fetch_p6.sh --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
           # push shape: HEAD IS the origin/main tip, so every differential ratchet judges it against
           # its FIRST PARENT (scripts/lib/resolve_base.sh: HEAD vs HEAD would pass vacuously, the
           # G-10 quorum's finding), and a depth-1 checkout has not fetched that parent. Deepen by one.
-          if [ "${GITHUB_EVENT_NAME:-}" = push ]; then git fetch --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main; fi
+          if [ "${GITHUB_EVENT_NAME:-}" = push ]; then bash scripts/ci/fetch_p6.sh --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main; fi
       # #4415 (operator A4, 2026-09-25): ONE step runs every guard step of guard-tree-steps
       # below, keeps going past a red one, and reports every failure. GitHub would
       # stop this job at its first red step, and the others would never be seen.
@@ -1691,11 +1691,11 @@ jobs:
       # passes on the merge-base can still red here, and CI is authoritative.
       - name: Fetch origin/main as the comparand for every ratchet in this job
         run: |
-          git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
+          bash scripts/ci/fetch_p6.sh --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
           # push shape: HEAD IS the origin/main tip, so every differential ratchet judges it against
           # its FIRST PARENT (scripts/lib/resolve_base.sh: HEAD vs HEAD would pass vacuously, the
           # G-10 quorum's finding), and a depth-1 checkout has not fetched that parent. Deepen by one.
-          if [ "${GITHUB_EVENT_NAME:-}" = push ]; then git fetch --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main; fi
+          if [ "${GITHUB_EVENT_NAME:-}" = push ]; then bash scripts/ci/fetch_p6.sh --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main; fi
       # DOCKER CREATES A MISSING BIND SOURCE AS root:root, AND `--user` ALONE
       # THEN EACCESs ON IT. The per-RUN target path is fresh every run, so a
       # container that mounts it and drops to the runner's uid cannot write
@@ -3034,7 +3034,7 @@ jobs:
           # PR's diff, which is the safe direction for a selector — it can only
           # run the GPU jobs when they were not needed, never skip them when
           # they were.
-          git fetch --no-tags --depth=1 origin \
+          bash scripts/ci/fetch_p6.sh --no-tags --depth=1 origin \
             "+refs/heads/${GITHUB_BASE_REF}:refs/remotes/origin/${GITHUB_BASE_REF}"
           git diff --name-only "origin/${GITHUB_BASE_REF}" HEAD > "$RUNNER_TEMP/touched.txt"
           printf 'touched (tip vs tip): %s path(s)\n' \
diff --git a/docs/roadmaps/entries/PMAT-4936.yaml b/docs/roadmaps/entries/PMAT-4936.yaml
index 852b202067..564c1640c5 100644
--- a/docs/roadmaps/entries/PMAT-4936.yaml
+++ b/docs/roadmaps/entries/PMAT-4936.yaml
@@ -1,7 +1,7 @@
 - id: PMAT-4936
   github_issue: 4936
   item_type: task
-  title: 'x86-main: fat_driver self-test prints live ::error:: annotations (false 12000s red)'
+  title: 'x86-main: fence the fat_driver case-table annotations; section git fetch reads up to 3 times (P6)'
   status: inprogress
   priority: high
   assigned_to: null
diff --git a/docs/roadmaps/roadmap.yaml b/docs/roadmaps/roadmap.yaml
index c54e4f88a2..f780ba23e9 100644
--- a/docs/roadmaps/roadmap.yaml
+++ b/docs/roadmaps/roadmap.yaml
@@ -24297,7 +24297,7 @@ Not done, pending the ruling: moving the 31 fixture files to an obviously synthe
 - id: PMAT-4936
   github_issue: 4936
   item_type: task
-  title: 'x86-main: fat_driver self-test prints live ::error:: annotations (false 12000s red)'
+  title: 'x86-main: fence the fat_driver case-table annotations; section git fetch reads up to 3 times (P6)'
   status: inprogress
   priority: high
   assigned_to: null
diff --git a/scripts/ci/fetch_p6.sh b/scripts/ci/fetch_p6.sh
new file mode 100644
index 0000000000..c4081c31b2
--- /dev/null
+++ b/scripts/ci/fetch_p6.sh
@@ -0,0 +1,226 @@
+#!/usr/bin/env bash
+# fetch_p6.sh -- `git fetch` for the CI sections, read up to 3 times under P6
+# (#4936, operator C343 #9).
+#
+# WHY THIS EXISTS
+# ---------------
+# Shard, determinism and x86-main sections died on `git fetch` with
+# "RPC failed; curl 92 HTTP/2 stream 5 was not closed cleanly: CANCEL (err 8)"
+# or "curl 56 Recv failure: Connection reset by peer", on every host alike.
+# The tier step's depth-1 fetch of main ran 376 s and died, although main's
+# objects were already in the section clone: the read did not answer, it was
+# not too big. Every section fetch was a single read, so one stalled
+# connection was a red section.
+#
+# P6: a read that did not answer (non-zero exit, HTTP 5xx, timeout, empty
+# body) is read at most 3 times in all. A read that answered is never re-read:
+# a missing ref, an unadvertised object, a 401/403/404 are answers. Each
+# re-read is one status line. A read that stalls is cut (under
+# LOW_SPEED_LIMIT bytes/s for LOW_SPEED_TIME s), so "did not answer" never
+# hangs a section.
+#
+#   bash scripts/ci/fetch_p6.sh <git fetch args...>     # in place of `git fetch`
+#   bash scripts/ci/fetch_p6.sh --check-wiring          # no bare `git fetch` in ci/sections.yml
+#   bash scripts/ci/fetch_p6.sh --self-test
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SECTIONS_REL="ci/sections.yml"
+HELPER_REL="scripts/ci/fetch_p6.sh"
+P6_READS=3
+LOW_SPEED_LIMIT=1000
+LOW_SPEED_TIME=60
+# Seconds before re-read n is (n * SLEEP_S). The case table sets SLEEP_S=0 in its subshell.
+SLEEP_S=10
+
+# answered <stderr-file> -> 0 when the remote answered and a re-read cannot
+# change the answer.
+answered() {
+  grep -qiE "couldn't find remote ref|not our ref|unadvertised object|Repository not found|does not appear to be a git repository|Authentication failed|The requested URL returned error: 40[134]" "$1"
+}
+
+# p6_fetch <git fetch args...> -> git fetch, read up to P6_READS times.
+# rc = the last read's rc. git's stderr reaches the caller's stderr.
+p6_fetch() {
+  local err n rc why
+  err="$(mktemp)" || return 2
+  for ((n = 1; n <= P6_READS; n++)); do
+    git -c "http.lowSpeedLimit=$LOW_SPEED_LIMIT" -c "http.lowSpeedTime=$LOW_SPEED_TIME" \
+      fetch "$@" 2> "$err"
+    rc=$?
+    cat "$err" >&2
+    if [ "$rc" -eq 0 ] || answered "$err"; then
+      rm -f -- "${err:?}"
+      return "$rc"
+    fi
+    why="$(grep -E '^(error|fatal):' "$err" | head -n 1)"
+    if [ "$n" -lt "$P6_READS" ]; then
+      printf 'fetch_p6: read %d/%d did not answer (rc=%d: %s); reading again\n' \
+        "$n" "$P6_READS" "$rc" "${why:-no error line}"
+      sleep "$((n * SLEEP_S))"
+    else
+      printf 'fetch_p6: read %d/%d did not answer (rc=%d: %s); no answer under P6\n' \
+        "$n" "$P6_READS" "$rc" "${why:-no error line}"
+    fi
+  done
+  rm -f -- "${err:?}"
+  return "$rc"
+}
+
+# check_wiring <sections.yml> -> one FAIL line per bare `git fetch` outside a
+# comment. rc 0 = every fetch goes through the helper; 1 = a bare fetch;
+# 2 = unreadable, or no helper call found (a check that read nothing).
+check_wiring() {
+  [ -r "$1" ] || return 2
+  local bad=0 line
+  while IFS= read -r line; do
+    printf 'FAIL: %s fetches without P6 re-reads -- use bash %s: %s\n' \
+      "$SECTIONS_REL" "$HELPER_REL" "$line"
+    bad=1
+  done < <(grep -nE '(^|[^[:alnum:]_./-])git( -[cC] [^ ]+)* fetch( |$)' "$1" \
+             | grep -vE '^[0-9]+:[[:space:]]*#')
+  grep -qF "bash $HELPER_REL " "$1" || return 2
+  return "$bad"
+}
+
+self_test() {
+  printf '=== case table: fetch_p6.sh ===\n'
+  local tmp fails=0 rc real_git
+  tmp="$(mktemp -d)" || return 1
+  trap 'rm -rf "${tmp:?}"' RETURN
+  real_git="$(command -v git)"
+  row() {  # row <label> <want> <got>
+    if [ "$2" = "$3" ]; then
+      printf '  ok   %-70s %s\n' "$1" "$3"
+    else
+      printf '  FAIL %-70s want=%s got=%s\n' "$1" "$2" "$3"
+      fails=$((fails + 1))
+    fi
+  }
+  # A planted git: counts its reads, records its args, answers per SHIM_MODE.
+  mkdir -p "$tmp/bin"
+  cat > "$tmp/bin/git" <<'SHIM'
+#!/usr/bin/env bash
+n=$(( $(cat "$SHIM_DIR/count" 2>/dev/null || echo 0) + 1 ))
+echo "$n" > "$SHIM_DIR/count"
+printf '%s\n' "$*" >> "$SHIM_DIR/args"
+cancel() { printf '%s\n' 'error: RPC failed; curl 92 HTTP/2 stream 5 was not closed cleanly: CANCEL (err 8)' 'fatal: early EOF' >&2; exit 128; }
+case "$SHIM_MODE" in
+  ok) exit 0 ;;
+  cancel-twice) [ "$n" -le 2 ] && cancel; exit 0 ;;
+  never) printf '%s\n' 'error: RPC failed; curl 56 Recv failure: Connection reset by peer' >&2; exit 128 ;;
+  http500-once) [ "$n" -le 1 ] && { printf '%s\n' 'fatal: unable to access: The requested URL returned error: 500' >&2; exit 128; }; exit 0 ;;
+  silent-once) [ "$n" -le 1 ] && exit 1; exit 0 ;;
+  missing) printf '%s\n' "fatal: couldn't find remote ref refs/heads/nope" >&2; exit 128 ;;
+  notfound) printf '%s\n' 'remote: Repository not found.' 'fatal: repository not found' >&2; exit 128 ;;
+  real) exec "$SHIM_REAL" "$@" ;;
+esac
+SHIM
+  chmod +x "$tmp/bin/git"
+  run() {  # run <mode> <fetch args...> -> rc; reads in $tmp/<mode>/count
+    local mode="$1"; shift
+    mkdir -p "$tmp/$mode"
+    ( cd "$tmp/client" && SLEEP_S=0 && PATH="$tmp/bin:$PATH" SHIM_DIR="$tmp/$mode" SHIM_MODE="$mode" \
+        SHIM_REAL="$real_git" p6_fetch "$@" ) \
+      > "$tmp/$mode/out" 2> "$tmp/$mode/err"
+  }
+  reads() { cat "$tmp/$1/count" 2>/dev/null || echo 0; }
+  status_lines() { grep -c '^fetch_p6: read ' "$tmp/$1/out"; }
+
+  # A real remote for the rows that run real git.
+  "$real_git" init -q --bare "$tmp/remote.git"
+  "$real_git" init -q "$tmp/seed"
+  "$real_git" -C "$tmp/seed" -c core.hooksPath=/dev/null -c user.name=t -c user.email=t@t commit -q --allow-empty -m seed
+  "$real_git" -C "$tmp/seed" push -q "$tmp/remote.git" HEAD:refs/heads/main
+  "$real_git" init -q "$tmp/client"
+  "$real_git" -C "$tmp/client" remote add origin "$tmp/remote.git"
+
+  run ok origin main; rc=$?
+  row 'a read that answers at once: rc 0' 0 "$rc"
+  row 'a read that answers at once: read once, no status line' '1 0' "$(reads ok) $(status_lines ok)"
+  row 'every read is cut on a stall (lowSpeedLimit and lowSpeedTime set)' 1 \
+    "$(grep -c "^-c http.lowSpeedLimit=$LOW_SPEED_LIMIT -c http.lowSpeedTime=$LOW_SPEED_TIME fetch origin main\$" "$tmp/ok/args")"
+
+  run cancel-twice --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main; rc=$?
+  row 'curl 92 CANCEL twice, then an answer (#4934): rc 0' 0 "$rc"
+  row 'curl 92 CANCEL twice, then an answer: 3 reads, 2 status lines' '3 2' "$(reads cancel-twice) $(status_lines cancel-twice)"
+  row 'each status line names its read and the error' 1 \
+    "$(grep -c '^fetch_p6: read 2/3 did not answer (rc=128: error: RPC failed; curl 92' "$tmp/cancel-twice/out")"
+
+  run never origin main; rc=$?
+  row 'curl 56 reset on every read: the step still fails (rc 128)' 128 "$rc"
+  row 'curl 56 reset on every read: exactly 3 reads, never a 4th' 3 "$(reads never)"
+  row 'curl 56 reset on every read: the last line says no answer' 1 \
+    "$(tail -n 1 "$tmp/never/out" | grep -c '^fetch_p6: read 3/3 did not answer .*no answer under P6$')"
+  row 'a re-read waits first: SLEEP_S > 0 outside the table' 1 "$([ "$SLEEP_S" -gt 0 ] && echo 1 || echo 0)"
+
+  run http500-once origin main; rc=$?
+  row 'HTTP 500 once, then an answer: rc 0 after 2 reads' '0 2' "$rc $(reads http500-once)"
+  run silent-once origin main; rc=$?
+  row 'non-zero exit with no error line, then an answer: 2 reads' '0 2' "$rc $(reads silent-once)"
+
+  run missing origin nope; rc=$?
+  row 'a missing ref is an answer: rc 128, read once' '128 1' "$rc $(reads missing)"
+  row "git's stderr still reaches the caller" 1 "$(grep -c "couldn't find remote ref" "$tmp/missing/err")"
+  run notfound origin main; rc=$?
+  row 'repository not found is an answer: read once' '128 1' "$rc $(reads notfound)"
+
+  run real origin +refs/heads/main:refs/remotes/origin/main; rc=$?
+  row 'real git, a ref that exists: rc 0, read once' '0 1' "$rc $(reads real)"
+  row 'real git, a ref that exists: the ref is fetched' 1 \
+    "$("$real_git" -C "$tmp/client" rev-parse -q --verify refs/remotes/origin/main >/dev/null && echo 1 || echo 0)"
+  rm -f -- "${tmp:?}/real/count"
+  run real origin +refs/heads/nope:refs/remotes/origin/nope; rc=$?
+  row "real git, a missing ref: fails, read once (git's own wording is an answer)" '1 1' \
+    "$([ "$rc" -ne 0 ] && echo 1 || echo 0) $(reads real)"
+
+  # Wiring: no bare `git fetch` in the sections file.
+  printf '          bash %s --no-tags --depth=1 origin x\n          # git fetch in a comment is prose\n' \
+    "$HELPER_REL" > "$tmp/ok.yml"
+  check_wiring "$tmp/ok.yml" > /dev/null; row 'wiring: every fetch through the helper, a comment ignored' 0 "$?"
+  printf '          bash %s origin x\n          git fetch --no-tags --depth=1 origin main\n' \
+    "$HELPER_REL" > "$tmp/bare.yml"
+  check_wiring "$tmp/bare.yml" > /dev/null; row 'wiring: a bare git fetch is RED (the #4936 state)' 1 "$?"
+  printf '          bash %s origin x\n          git -C "$ws" fetch origin main\n' \
+    "$HELPER_REL" > "$tmp/bareC.yml"
+  check_wiring "$tmp/bareC.yml" > /dev/null; row 'wiring: a bare git -C <dir> fetch is RED' 1 "$?"
+  printf '          git status\n' > "$tmp/none.yml"
+  check_wiring "$tmp/none.yml" > /dev/null; row 'wiring: no helper call found is not clean' 2 "$?"
+  check_wiring "$tmp/absent.yml" > /dev/null; row 'wiring: an unreadable sections file is not clean' 2 "$?"
+
+  if [ "$fails" -gt 0 ]; then
+    printf '\nFAIL: %s case(s) failed. The helper does not do what P6 says.\n' "$fails"
+    return 1
+  fi
+  printf 'PASS: all cases behave as declared.\n'
+  return 0
+}
+
+case "${1:-}" in
+  --self-test)
+    self_test
+    exit $?
+    ;;
+  --check-wiring)
+    printf '=== every git fetch in %s reads under P6 (fetch_p6.sh) ===\n' "$SECTIONS_REL"
+    check_wiring "$REPO_ROOT/$SECTIONS_REL"
+    rc=$?
+    if [ "$rc" -eq 2 ]; then
+      printf 'FAIL: %s is unreadable or calls no %s -- a check that read nothing certifies nothing.\n' \
+        "$SECTIONS_REL" "$HELPER_REL"
+      exit 1
+    fi
+    [ "$rc" -eq 0 ] || exit 1
+    printf 'PASS: %s fetch call(s) in %s, each through the helper.\n' \
+      "$(grep -cF "bash $HELPER_REL " "$REPO_ROOT/$SECTIONS_REL")" "$SECTIONS_REL"
+    exit 0
+    ;;
+  "")
+    printf 'usage: %s <git fetch args...> | --check-wiring | --self-test\n' "$HELPER_REL" >&2
+    exit 2
+    ;;
+  *)
+    p6_fetch "$@"
+    exit $?
+    ;;
+esac

From 2481ab6c7584557c01ca7659dfb5d37d5a2c99de Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Thu, 8 Oct 2026 17:56:53 +0200
Subject: [PATCH 03/11] fix(ci): resolve_base's merge_group deepen reads under
 P6 too

The stacked merge_group entry deepens its depth-1 checkout by one commit
in scripts/lib/resolve_base.sh, which the section guards source. It was
one read with no stall cutoff. It now goes through scripts/ci/fetch_p6.sh,
located next to the library (REPO_ROOT may be a repo without scripts/).
The helper's status lines go to stderr, never into a caller's $(...);
git's own stderr is still dropped, and `|| true` is unchanged.

check_roadmap_diff_additive row 20 does that deepen for real: 25/25.
Mutant (helper path broken): row 20 FAILs. Six other resolve_base users
and check_sourced_libs_option_neutral: rc 0.

Refs #4936
Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/lib/resolve_base.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/scripts/lib/resolve_base.sh b/scripts/lib/resolve_base.sh
index 12e854c994..621126deb4 100644
--- a/scripts/lib/resolve_base.sh
+++ b/scripts/lib/resolve_base.sh
@@ -71,7 +71,11 @@ resolve_base() {
         # case table's mutation.
         if [ -n "$p1" ] && [ "${GITHUB_EVENT_NAME:-}" = merge_group ] && [ "${ROADMAP_DIFF_NO_DEEPEN:-0}" != 1 ]; then
             if ! git -C "$REPO_ROOT" cat-file -e "$p1^{commit}" 2>/dev/null; then
-                git -C "$REPO_ROOT" fetch -q --deepen=1 origin 2>/dev/null || git -C "$REPO_ROOT" fetch -q origin "$p1" 2>/dev/null || true
+                # Read up to 3 times under P6 (#4936); its status lines go to stderr, never into a caller's $(...).
+                local p6
+                p6="$(dirname -- "${BASH_SOURCE[0]}")/../ci/fetch_p6.sh"
+                ( cd "$REPO_ROOT" && bash "$p6" -q --deepen=1 origin ) >&2 2>/dev/null \
+                    || ( cd "$REPO_ROOT" && bash "$p6" -q origin "$p1" ) >&2 2>/dev/null || true
             fi
             if git -C "$REPO_ROOT" cat-file -e "$p1^{commit}" 2>/dev/null; then
                 BASE_REF="$p1"; BASE_HOW="single parent (stacked merge_group entry: the previous entry's squash, fetched by deepening the shallow checkout)"; return 0

From 656bf90db5298d7b2af4852aaab6c87afbd7d51d Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Thu, 8 Oct 2026 20:28:54 +0200
Subject: [PATCH 04/11] fix(ci): the review findings on the fence and P6 halves
 (#4936)

Two non-author reviews of 2481ab6c75 approved with findings. Each one that
changes behaviour now has a planted row and a mutant that turns it red.

- fence: the resume line starts its own line. A child whose last line had
  no newline glued it on, the fence never closed and the failure ::error::
  was swallowed. New rows: partial last line, fence closes, rc 3, 1 live.
- fetch_p6: git runs under LC_ALL=C, so the answered() texts are git's own.
  rc 129 (usage), "could not read Username" and "not a git repository" are
  answers and are never re-read. The wiring regex now sees git's global
  options between git and fetch (-C, -c, --git-dir, --no-pager, quoted
  words, any blank run); 9 must-match and 5 must-not-match forms.
- fetch_p6: the backoff row records each planted sleep (7 14 at SLEEP_S=7)
  instead of passing with sleep stubbed out.
- resolve_base: the helper path is absolute before the cd into REPO_ROOT. A
  caller that sourced the library by a relative path from another tree lost
  the deepen and was refused; the probe is red on 2481ab6c75, green here.

Refs #4936

Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/ci/fence_workflow_commands.sh | 10 ++-
 scripts/ci/fetch_p6.sh                | 88 ++++++++++++++++++++-------
 scripts/lib/resolve_base.sh           |  3 +-
 3 files changed, 78 insertions(+), 23 deletions(-)

diff --git a/scripts/ci/fence_workflow_commands.sh b/scripts/ci/fence_workflow_commands.sh
index d68a67a536..eb5c5613ca 100644
--- a/scripts/ci/fence_workflow_commands.sh
+++ b/scripts/ci/fence_workflow_commands.sh
@@ -51,7 +51,10 @@ fenced() {
   printf '::stop-commands::%s\n' "$tok"
   "$@" 2>&1
   rc=$?
-  printf '::%s::\n' "$tok"
+  # The resume line must start a line. A child whose last line has no newline
+  # would get it glued on, the fence would never close, and the failure
+  # ::error:: below would be swallowed too. One blank line is the cost.
+  printf '\n::%s::\n' "$tok"
   if [ "$rc" -ne 0 ]; then
     printf '::error::case table failed (rc=%s): %s\n' "$rc" "$*"
   fi
@@ -130,6 +133,11 @@ self_test() {
   row 'a failing table: the live annotation names it' 1 \
     "$(tail -n 1 "$tmp/fail.out" | grep -cF "::error::case table failed (rc=3): bash $tmp/table.sh 3")"
 
+  fenced sh -c 'printf "::error::planted\nno newline at the end"; exit 3' > "$tmp/partial.out"; rc=$?
+  t2="$(sed -n '1s/^::stop-commands:://p' "$tmp/partial.out")"
+  row 'a last line with no newline: the fence still closes on its own line' 1 "$(grep -cxF "::$t2::" "$tmp/partial.out")"
+  row 'a last line with no newline: rc 3 and only the failure annotation is live' '3 1' "$rc $(live_commands "$tmp/partial.out")"
+
   fenced sh -c 'printf "::error::from stderr\n" >&2' > "$tmp/stderr.out"
   row 'stderr is fenced too (merged into the one ordered pipe)' 0 "$(live_commands "$tmp/stderr.out")"
 
diff --git a/scripts/ci/fetch_p6.sh b/scripts/ci/fetch_p6.sh
index c4081c31b2..7a68f6126e 100644
--- a/scripts/ci/fetch_p6.sh
+++ b/scripts/ci/fetch_p6.sh
@@ -14,10 +14,10 @@
 #
 # P6: a read that did not answer (non-zero exit, HTTP 5xx, timeout, empty
 # body) is read at most 3 times in all. A read that answered is never re-read:
-# a missing ref, an unadvertised object, a 401/403/404 are answers. Each
-# re-read is one status line. A read that stalls is cut (under
-# LOW_SPEED_LIMIT bytes/s for LOW_SPEED_TIME s), so "did not answer" never
-# hangs a section.
+# a missing ref, an unadvertised object, a 401/403/404 and a usage error are
+# answers. Each read that did not answer prints one status line. A read that
+# stalls is cut (under LOW_SPEED_LIMIT bytes/s for LOW_SPEED_TIME s), so "did
+# not answer" never hangs a section.
 #
 #   bash scripts/ci/fetch_p6.sh <git fetch args...>     # in place of `git fetch`
 #   bash scripts/ci/fetch_p6.sh --check-wiring          # no bare `git fetch` in ci/sections.yml
@@ -30,13 +30,17 @@ HELPER_REL="scripts/ci/fetch_p6.sh"
 P6_READS=3
 LOW_SPEED_LIMIT=1000
 LOW_SPEED_TIME=60
-# Seconds before re-read n is (n * SLEEP_S). The case table sets SLEEP_S=0 in its subshell.
+# Seconds before re-read n is (n * SLEEP_S). The case table plants a `sleep`
+# that records its argument and returns at once.
 SLEEP_S=10
 
-# answered <stderr-file> -> 0 when the remote answered and a re-read cannot
-# change the answer.
+# answered <rc> <stderr-file> -> 0 when the read answered and a re-read cannot
+# change the answer. git runs under LC_ALL=C, so these are git's own texts.
+# rc 129 is git's usage error: the read never left this host.
+# "could not read Username" is a 401 with no credentials to offer.
 answered() {
-  grep -qiE "couldn't find remote ref|not our ref|unadvertised object|Repository not found|does not appear to be a git repository|Authentication failed|The requested URL returned error: 40[134]" "$1"
+  [ "$1" -eq 129 ] && return 0
+  grep -qiE "couldn't find remote ref|not our ref|unadvertised object|Repository not found|does not appear to be a git repository|not a git repository|Authentication failed|could not read Username|The requested URL returned error: 40[134]" "$2"
 }
 
 # p6_fetch <git fetch args...> -> git fetch, read up to P6_READS times.
@@ -45,11 +49,11 @@ p6_fetch() {
   local err n rc why
   err="$(mktemp)" || return 2
   for ((n = 1; n <= P6_READS; n++)); do
-    git -c "http.lowSpeedLimit=$LOW_SPEED_LIMIT" -c "http.lowSpeedTime=$LOW_SPEED_TIME" \
+    LC_ALL=C git -c "http.lowSpeedLimit=$LOW_SPEED_LIMIT" -c "http.lowSpeedTime=$LOW_SPEED_TIME" \
       fetch "$@" 2> "$err"
     rc=$?
     cat "$err" >&2
-    if [ "$rc" -eq 0 ] || answered "$err"; then
+    if [ "$rc" -eq 0 ] || answered "$rc" "$err"; then
       rm -f -- "${err:?}"
       return "$rc"
     fi
@@ -67,6 +71,12 @@ p6_fetch() {
   return "$rc"
 }
 
+# A git command whose subcommand is fetch. git's global options may sit
+# between them (-C <dir>, -c <k=v>, --git-dir=<d>, --no-pager), quoted or not,
+# and any run of blanks separates words. The self-test's must-match and
+# must-not-match forms are this pattern's case table.
+FETCH_RE='(^|[^[:alnum:]_./-])"?git"?([[:space:]]+(-[cC][[:space:]]+("[^"]*"|[^[:space:]]+)|--?[^[:space:]]+))*[[:space:]]+fetch([[:space:];&|)]|$)'
+
 # check_wiring <sections.yml> -> one FAIL line per bare `git fetch` outside a
 # comment. rc 0 = every fetch goes through the helper; 1 = a bare fetch;
 # 2 = unreadable, or no helper call found (a check that read nothing).
@@ -77,8 +87,7 @@ check_wiring() {
     printf 'FAIL: %s fetches without P6 re-reads -- use bash %s: %s\n' \
       "$SECTIONS_REL" "$HELPER_REL" "$line"
     bad=1
-  done < <(grep -nE '(^|[^[:alnum:]_./-])git( -[cC] [^ ]+)* fetch( |$)' "$1" \
-             | grep -vE '^[0-9]+:[[:space:]]*#')
+  done < <(grep -nE "$FETCH_RE" "$1" | grep -vE '^[0-9]+:[[:space:]]*#')
   grep -qF "bash $HELPER_REL " "$1" || return 2
   return "$bad"
 }
@@ -104,6 +113,7 @@ self_test() {
 n=$(( $(cat "$SHIM_DIR/count" 2>/dev/null || echo 0) + 1 ))
 echo "$n" > "$SHIM_DIR/count"
 printf '%s\n' "$*" >> "$SHIM_DIR/args"
+printf '%s\n' "${LC_ALL:-unset}" > "$SHIM_DIR/lc"
 cancel() { printf '%s\n' 'error: RPC failed; curl 92 HTTP/2 stream 5 was not closed cleanly: CANCEL (err 8)' 'fatal: early EOF' >&2; exit 128; }
 case "$SHIM_MODE" in
   ok) exit 0 ;;
@@ -113,14 +123,19 @@ case "$SHIM_MODE" in
   silent-once) [ "$n" -le 1 ] && exit 1; exit 0 ;;
   missing) printf '%s\n' "fatal: couldn't find remote ref refs/heads/nope" >&2; exit 128 ;;
   notfound) printf '%s\n' 'remote: Repository not found.' 'fatal: repository not found' >&2; exit 128 ;;
+  noauth) printf '%s\n' "fatal: could not read Username for 'https://github.com': terminal prompts disabled" >&2; exit 128 ;;
+  norepo) printf '%s\n' 'fatal: not a git repository (or any of the parent directories): .git' >&2; exit 128 ;;
+  usage) printf '%s\n' 'usage: git fetch [<options>] [<repository> [<refspec>...]]' >&2; exit 129 ;;
   real) exec "$SHIM_REAL" "$@" ;;
 esac
 SHIM
-  chmod +x "$tmp/bin/git"
+  # A planted sleep: records how long each re-read would wait, returns at once.
+  printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$1" >> "$SHIM_DIR/sleeps"\n' > "$tmp/bin/sleep"
+  chmod +x "$tmp/bin/git" "$tmp/bin/sleep"
   run() {  # run <mode> <fetch args...> -> rc; reads in $tmp/<mode>/count
     local mode="$1"; shift
     mkdir -p "$tmp/$mode"
-    ( cd "$tmp/client" && SLEEP_S=0 && PATH="$tmp/bin:$PATH" SHIM_DIR="$tmp/$mode" SHIM_MODE="$mode" \
+    ( cd "$tmp/client" && SLEEP_S=7 && PATH="$tmp/bin:$PATH" SHIM_DIR="$tmp/$mode" SHIM_MODE="$mode" \
         SHIM_REAL="$real_git" p6_fetch "$@" ) \
       > "$tmp/$mode/out" 2> "$tmp/$mode/err"
   }
@@ -140,6 +155,7 @@ SHIM
   row 'a read that answers at once: read once, no status line' '1 0' "$(reads ok) $(status_lines ok)"
   row 'every read is cut on a stall (lowSpeedLimit and lowSpeedTime set)' 1 \
     "$(grep -c "^-c http.lowSpeedLimit=$LOW_SPEED_LIMIT -c http.lowSpeedTime=$LOW_SPEED_TIME fetch origin main\$" "$tmp/ok/args")"
+  row "git runs under LC_ALL=C, so the answer texts are git's own" C "$(cat "$tmp/ok/lc")"
 
   run cancel-twice --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main; rc=$?
   row 'curl 92 CANCEL twice, then an answer (#4934): rc 0' 0 "$rc"
@@ -152,7 +168,9 @@ SHIM
   row 'curl 56 reset on every read: exactly 3 reads, never a 4th' 3 "$(reads never)"
   row 'curl 56 reset on every read: the last line says no answer' 1 \
     "$(tail -n 1 "$tmp/never/out" | grep -c '^fetch_p6: read 3/3 did not answer .*no answer under P6$')"
-  row 'a re-read waits first: SLEEP_S > 0 outside the table' 1 "$([ "$SLEEP_S" -gt 0 ] && echo 1 || echo 0)"
+  row 'curl 56 reset on every read: waits n*SLEEP_S before re-read n+1, none after' '7 14' \
+    "$(paste -sd' ' "$tmp/never/sleeps" 2>/dev/null)"
+  row 'outside the table the backoff step is SLEEP_S=10' 10 "$SLEEP_S"
 
   run http500-once origin main; rc=$?
   row 'HTTP 500 once, then an answer: rc 0 after 2 reads' '0 2' "$rc $(reads http500-once)"
@@ -164,6 +182,12 @@ SHIM
   row "git's stderr still reaches the caller" 1 "$(grep -c "couldn't find remote ref" "$tmp/missing/err")"
   run notfound origin main; rc=$?
   row 'repository not found is an answer: read once' '128 1' "$rc $(reads notfound)"
+  run noauth origin main; rc=$?
+  row 'a 401 with no credentials (could not read Username) is an answer: read once' '128 1' "$rc $(reads noauth)"
+  run norepo origin main; rc=$?
+  row 'not a git repository is an answer: read once' '128 1' "$rc $(reads norepo)"
+  run usage --bogus origin main; rc=$?
+  row "git's usage error (rc 129) never left the host: read once" '129 1' "$rc $(reads usage)"
 
   run real origin +refs/heads/main:refs/remotes/origin/main; rc=$?
   row 'real git, a ref that exists: rc 0, read once' '0 1' "$rc $(reads real)"
@@ -178,12 +202,34 @@ SHIM
   printf '          bash %s --no-tags --depth=1 origin x\n          # git fetch in a comment is prose\n' \
     "$HELPER_REL" > "$tmp/ok.yml"
   check_wiring "$tmp/ok.yml" > /dev/null; row 'wiring: every fetch through the helper, a comment ignored' 0 "$?"
-  printf '          bash %s origin x\n          git fetch --no-tags --depth=1 origin main\n' \
-    "$HELPER_REL" > "$tmp/bare.yml"
-  check_wiring "$tmp/bare.yml" > /dev/null; row 'wiring: a bare git fetch is RED (the #4936 state)' 1 "$?"
-  printf '          bash %s origin x\n          git -C "$ws" fetch origin main\n' \
-    "$HELPER_REL" > "$tmp/bareC.yml"
-  check_wiring "$tmp/bareC.yml" > /dev/null; row 'wiring: a bare git -C <dir> fetch is RED' 1 "$?"
+  # FETCH_RE's case table: each form sits beside a helper call, alone.
+  local form i=0
+  while IFS= read -r form; do
+    i=$((i + 1))
+    printf '          bash %s origin x\n          %s\n' "$HELPER_REL" "$form" > "$tmp/m$i.yml"
+    check_wiring "$tmp/m$i.yml" > /dev/null; row "wiring: RED on: $form" 1 "$?"
+  done <<'MUST_MATCH'
+git fetch --no-tags --depth=1 origin main
+git -C "$ws" fetch origin main
+git -C "$a b" fetch origin main
+git -c http.version=HTTP/1.1 fetch origin
+git --no-pager fetch origin
+git --git-dir=.git fetch origin
+git  fetch origin
+cd "$ws" && git fetch; echo done
+"git" fetch origin
+MUST_MATCH
+  while IFS= read -r form; do
+    i=$((i + 1))
+    printf '          bash %s origin x\n          %s\n' "$HELPER_REL" "$form" > "$tmp/m$i.yml"
+    check_wiring "$tmp/m$i.yml" > /dev/null; row "wiring: clean on: $form" 0 "$?"
+  done <<'MUST_NOT_MATCH'
+bash scripts/ci/fetch_p6.sh --no-tags --deepen=1 origin
+git log --grep fetch origin/main
+git status && echo fetch
+echo "the git fetched it"
+legit fetch
+MUST_NOT_MATCH
   printf '          git status\n' > "$tmp/none.yml"
   check_wiring "$tmp/none.yml" > /dev/null; row 'wiring: no helper call found is not clean' 2 "$?"
   check_wiring "$tmp/absent.yml" > /dev/null; row 'wiring: an unreadable sections file is not clean' 2 "$?"
diff --git a/scripts/lib/resolve_base.sh b/scripts/lib/resolve_base.sh
index 621126deb4..8291d610f0 100644
--- a/scripts/lib/resolve_base.sh
+++ b/scripts/lib/resolve_base.sh
@@ -72,8 +72,9 @@ resolve_base() {
         if [ -n "$p1" ] && [ "${GITHUB_EVENT_NAME:-}" = merge_group ] && [ "${ROADMAP_DIFF_NO_DEEPEN:-0}" != 1 ]; then
             if ! git -C "$REPO_ROOT" cat-file -e "$p1^{commit}" 2>/dev/null; then
                 # Read up to 3 times under P6 (#4936); its status lines go to stderr, never into a caller's $(...).
+                # The path is made absolute first: a caller may source this file by a relative path and REPO_ROOT may be another tree.
                 local p6
-                p6="$(dirname -- "${BASH_SOURCE[0]}")/../ci/fetch_p6.sh"
+                p6="$(cd "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/../ci/fetch_p6.sh"
                 ( cd "$REPO_ROOT" && bash "$p6" -q --deepen=1 origin ) >&2 2>/dev/null \
                     || ( cd "$REPO_ROOT" && bash "$p6" -q origin "$p1" ) >&2 2>/dev/null || true
             fi

From 967b7ea6a4e95115f2760970eff4df0734216ca2 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Thu, 8 Oct 2026 20:55:16 +0200
Subject: [PATCH 05/11] fix(ci): two rows that could not fail, and the helper
 path found at source time (#4936)

Second review round on 656bf90db5 (both APPROVE, non-blocking findings):

- fence: the "stderr is fenced too" row sent only stdout to its file, so it
  passed with the 2>&1 merge removed. stdout and stderr now go to two files,
  as they are two pipes on the runner; the merge mutant fails the row.
- fence: live_commands now errs on the high side only. An indented command
  and a property value with a colon count; an indented stop line does not
  start a region. A new row fails on the old counter.
- fetch_p6: the LC_ALL=C row passed with the helper's own LC_ALL=C removed
  whenever the caller already exported LC_ALL=C. The table's caller now runs
  under LC_ALL=POSIX; the mutant fails the row under an exported LC_ALL=C too.
- resolve_base: the helper path was resolved at CALL time from a possibly
  relative BASH_SOURCE, so a caller that cds after sourcing, or a CDPATH with a
  decoy scripts/lib, was refused on a stacked merge_group entry that the base
  deepened fine. It is found once at source time, with CDPATH cleared.

Refs #4936

Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/ci/fence_workflow_commands.sh | 21 ++++++++++++++++-----
 scripts/ci/fetch_p6.sh                |  6 ++++--
 scripts/lib/resolve_base.sh           | 16 ++++++++++------
 3 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/scripts/ci/fence_workflow_commands.sh b/scripts/ci/fence_workflow_commands.sh
index eb5c5613ca..a58a21ce8c 100644
--- a/scripts/ci/fence_workflow_commands.sh
+++ b/scripts/ci/fence_workflow_commands.sh
@@ -62,12 +62,17 @@ fenced() {
 }
 
 # live_commands <log> -> how many annotation commands the runner would act on:
-# ::error/::warning/::notice lines outside every stop..resume region.
+# ::error/::warning/::notice lines outside every stop..resume region. It errs
+# on the high side only: an indented command and a property value with a colon
+# count, an indented resume line ends a region, and an indented stop line does
+# not start one. Each can make the count larger than what the runner acts on,
+# never smaller.
 live_commands() {
   awk '
-    stop != "" { if ($0 == "::" stop "::") stop = ""; next }
+    { line = $0; sub(/^[ \t]+/, "", line) }
+    stop != "" { if (line == "::" stop "::") stop = ""; next }
     /^::stop-commands::/ { stop = substr($0, 18); next }
-    /^::(error|warning|notice)( [^:]*)?::/ { n++ }
+    line ~ /^::(error|warning|notice)( .*)?::/ { n++ }
     END { print n + 0 }' "$1"
 }
 
@@ -138,8 +143,14 @@ self_test() {
   row 'a last line with no newline: the fence still closes on its own line' 1 "$(grep -cxF "::$t2::" "$tmp/partial.out")"
   row 'a last line with no newline: rc 3 and only the failure annotation is live' '3 1' "$rc $(live_commands "$tmp/partial.out")"
 
-  fenced sh -c 'printf "::error::from stderr\n" >&2' > "$tmp/stderr.out"
-  row 'stderr is fenced too (merged into the one ordered pipe)' 0 "$(live_commands "$tmp/stderr.out")"
+  # stdout and stderr are two pipes on the runner, so they go to two files here:
+  # a stderr line that kept its own pipe would land in stderr.err, unfenced.
+  fenced sh -c 'printf "::error::from stderr\n" >&2' > "$tmp/stderr.out" 2> "$tmp/stderr.err"
+  row 'stderr is fenced too: none on its own pipe, 1 inside the fence, 0 live' '0 1 0' \
+    "$(wc -l < "$tmp/stderr.err" | tr -d ' ') $(sed '1d;$d' "$tmp/stderr.out" | grep -cxF '::error::from stderr') $(live_commands "$tmp/stderr.out")"
+
+  printf '%s\n' '  ::error::indented' '::warning file=a.rs:1,line=2::a colon in a property' '::notice::plain' > "$tmp/forms.log"
+  row 'the live counter counts an indented command and a colon in a property' 3 "$(live_commands "$tmp/forms.log")"
 
   fenced sh -c 'printf "::0123456789abcdef0123456789abcdef::\n::error::after a guessed resume\n"' > "$tmp/guess.out"
   row 'a resume line with another token does not end the fence' 0 "$(live_commands "$tmp/guess.out")"
diff --git a/scripts/ci/fetch_p6.sh b/scripts/ci/fetch_p6.sh
index 7a68f6126e..8cb3655f16 100644
--- a/scripts/ci/fetch_p6.sh
+++ b/scripts/ci/fetch_p6.sh
@@ -132,10 +132,12 @@ SHIM
   # A planted sleep: records how long each re-read would wait, returns at once.
   printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$1" >> "$SHIM_DIR/sleeps"\n' > "$tmp/bin/sleep"
   chmod +x "$tmp/bin/git" "$tmp/bin/sleep"
+  # The caller runs under LC_ALL=POSIX, not C: a runner that already exports LC_ALL=C would
+  # otherwise pass the locale row with the helper's own LC_ALL=C removed.
   run() {  # run <mode> <fetch args...> -> rc; reads in $tmp/<mode>/count
     local mode="$1"; shift
     mkdir -p "$tmp/$mode"
-    ( cd "$tmp/client" && SLEEP_S=7 && PATH="$tmp/bin:$PATH" SHIM_DIR="$tmp/$mode" SHIM_MODE="$mode" \
+    ( cd "$tmp/client" && SLEEP_S=7 && LC_ALL=POSIX PATH="$tmp/bin:$PATH" SHIM_DIR="$tmp/$mode" SHIM_MODE="$mode" \
         SHIM_REAL="$real_git" p6_fetch "$@" ) \
       > "$tmp/$mode/out" 2> "$tmp/$mode/err"
   }
@@ -155,7 +157,7 @@ SHIM
   row 'a read that answers at once: read once, no status line' '1 0' "$(reads ok) $(status_lines ok)"
   row 'every read is cut on a stall (lowSpeedLimit and lowSpeedTime set)' 1 \
     "$(grep -c "^-c http.lowSpeedLimit=$LOW_SPEED_LIMIT -c http.lowSpeedTime=$LOW_SPEED_TIME fetch origin main\$" "$tmp/ok/args")"
-  row "git runs under LC_ALL=C, so the answer texts are git's own" C "$(cat "$tmp/ok/lc")"
+  row "git runs under LC_ALL=C, not the caller's locale, so the answer texts are git's own" C "$(cat "$tmp/ok/lc")"
 
   run cancel-twice --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main; rc=$?
   row 'curl 92 CANCEL twice, then an answer (#4934): rc 0' 0 "$rc"
diff --git a/scripts/lib/resolve_base.sh b/scripts/lib/resolve_base.sh
index 8291d610f0..cb31fee8b4 100644
--- a/scripts/lib/resolve_base.sh
+++ b/scripts/lib/resolve_base.sh
@@ -18,6 +18,12 @@
 # the G-10 review quorum's blocking finding, 2026-09-06); and a refusal -
 # never the tree against itself - for anything else.
 # ROADMAP_DIFF_FORCE_SHALLOW=1 makes a full clone behave like depth-1 (tests).
+# fetch_p6.sh is found once, at SOURCE time: a caller may source this file by a relative path
+# and cd before it calls resolve_base, and REPO_ROOT may be another tree. CDPATH is cleared so
+# cd neither prints nor goes elsewhere. A failed lookup leaves the deepen to fail, and the
+# stacked entry is refused below, as it was before #4936 when the fetch failed.
+_RESOLVE_BASE_P6="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/../ci/fetch_p6.sh" || _RESOLVE_BASE_P6=""
+
 resolve_base() {
     local head=$1 mb parents headid main_tip
     local PROG="${PROG:-resolve_base}"
@@ -71,12 +77,10 @@ resolve_base() {
         # case table's mutation.
         if [ -n "$p1" ] && [ "${GITHUB_EVENT_NAME:-}" = merge_group ] && [ "${ROADMAP_DIFF_NO_DEEPEN:-0}" != 1 ]; then
             if ! git -C "$REPO_ROOT" cat-file -e "$p1^{commit}" 2>/dev/null; then
-                # Read up to 3 times under P6 (#4936); its status lines go to stderr, never into a caller's $(...).
-                # The path is made absolute first: a caller may source this file by a relative path and REPO_ROOT may be another tree.
-                local p6
-                p6="$(cd "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/../ci/fetch_p6.sh"
-                ( cd "$REPO_ROOT" && bash "$p6" -q --deepen=1 origin ) >&2 2>/dev/null \
-                    || ( cd "$REPO_ROOT" && bash "$p6" -q origin "$p1" ) >&2 2>/dev/null || true
+                # Read up to 3 times under P6 (#4936). `>&2 2>/dev/null` applies left to right: the helper's
+                # status lines (its stdout) go to stderr, never into a caller's $(...); git's own stderr is dropped.
+                ( CDPATH='' cd -- "$REPO_ROOT" && bash "$_RESOLVE_BASE_P6" -q --deepen=1 origin ) >&2 2>/dev/null \
+                    || ( CDPATH='' cd -- "$REPO_ROOT" && bash "$_RESOLVE_BASE_P6" -q origin "$p1" ) >&2 2>/dev/null || true
             fi
             if git -C "$REPO_ROOT" cat-file -e "$p1^{commit}" 2>/dev/null; then
                 BASE_REF="$p1"; BASE_HOW="single parent (stacked merge_group entry: the previous entry's squash, fetched by deepening the shallow checkout)"; return 0

From b7544bab37a97aad25c417ce0a799c0f5ab38526 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Thu, 8 Oct 2026 21:12:48 +0200
Subject: [PATCH 06/11] fix(ci): the live counter could count fewer commands
 than the runner acts on (#4936)

live_commands is the oracle for every "0 live" row, and it claimed to err on
the high side only. It did not: it matched error/warning/notice in one case,
trimmed only space and tab, ignored the legacy ##[error] form and a line the
runner splits on \r, and ended a region only on an exact resume line.

Now an annotation counts anywhere in a line and in any case, a region starts
only at the fence's own stop line, and it ends at the first line holding
::<token> in any case, which is counted too. Three rows pin it (7 forms, 2
region ends, 2 region starts); each of the 7 counter mutants fails one. The
fence itself is unchanged. On mawk, gawk and busybox awk: 24/24.

An upper bound can say only "at most 1" live, so the failing-table row now
also wants the exact resume line just before the failure annotation.

Refs #4936

Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/ci/fence_workflow_commands.sh | 58 +++++++++++++++++++--------
 1 file changed, 42 insertions(+), 16 deletions(-)

diff --git a/scripts/ci/fence_workflow_commands.sh b/scripts/ci/fence_workflow_commands.sh
index a58a21ce8c..bb6c8e1027 100644
--- a/scripts/ci/fence_workflow_commands.sh
+++ b/scripts/ci/fence_workflow_commands.sh
@@ -61,18 +61,25 @@ fenced() {
   return "$rc"
 }
 
-# live_commands <log> -> how many annotation commands the runner would act on:
-# ::error/::warning/::notice lines outside every stop..resume region. It errs
-# on the high side only: an indented command and a property value with a colon
-# count, an indented resume line ends a region, and an indented stop line does
-# not start one. Each can make the count larger than what the runner acts on,
-# never smaller.
+# live_commands <log> -> how many annotation commands the runner would act on,
+# outside every stop..resume region. Each rule errs on the high side, so a 0
+# here is a 0 on the runner and a 1 is at most 1:
+#  - An annotation is ::error, ::warning or ::notice, or the legacy ##[error,
+#    ##[warning or ##[notice, anywhere in a line and in any case. The runner
+#    wants it first after any whitespace, and it also splits lines on a \r.
+#  - A region starts only at the fence's own stop line: column 0, lower case,
+#    a 32-hex token and nothing after it. Any other stop line starts none, so
+#    the lines after it count.
+#  - A region ends at the first line holding ::<token> in any case, and that
+#    line is counted too.
+# Problem matchers are not workflow commands: the fence does not stop them,
+# and this does not count them.
 live_commands() {
-  awk '
-    { line = $0; sub(/^[ \t]+/, "", line) }
-    stop != "" { if (line == "::" stop "::") stop = ""; next }
-    /^::stop-commands::/ { stop = substr($0, 18); next }
-    line ~ /^::(error|warning|notice)( .*)?::/ { n++ }
+  LC_ALL=C awk '
+    { lc = tolower($0) }
+    stop != "" { if (index(lc, "::" stop) == 0) next; stop = "" }
+    /^::stop-commands::/ { t = substr($0, 18); if (length(t) == 32 && t !~ /[^0-9a-f]/) { stop = t; next } }
+    lc ~ /(::|##[[])(error|warning|notice)/ { n++ }
     END { print n + 0 }' "$1"
 }
 
@@ -103,7 +110,7 @@ check_wiring() {
 
 self_test() {
   printf '=== case table: fence_workflow_commands.sh ===\n'
-  local tmp fails=0 rc t1 t2 good
+  local tmp fails=0 rc t1 t2 t3 tk got i f good
   tmp="$(mktemp -d)"
   trap 'rm -rf "${tmp:?}"' RETURN
   row() {  # row <label> <want> <got>
@@ -135,8 +142,11 @@ self_test() {
   fenced bash "$tmp/table.sh" 3 > "$tmp/fail.out"; rc=$?
   row 'a failing table still fails: its rc is the step rc' 3 "$rc"
   row 'a failing table: exactly 1 live annotation, after the fence' 1 "$(live_commands "$tmp/fail.out")"
-  row 'a failing table: the live annotation names it' 1 \
-    "$(tail -n 1 "$tmp/fail.out" | grep -cF "::error::case table failed (rc=3): bash $tmp/table.sh 3")"
+  # The counter can only say "at most 1". The exact resume line just before the
+  # last line is what makes the failure annotation live.
+  t3="$(sed -n '1s/^::stop-commands:://p' "$tmp/fail.out")"
+  row 'a failing table: the last line names it, after the exact resume line' '1 1' \
+    "$(tail -n 2 "$tmp/fail.out" | head -n 1 | grep -cxF "::$t3::") $(tail -n 1 "$tmp/fail.out" | grep -cF "::error::case table failed (rc=3): bash $tmp/table.sh 3")"
 
   fenced sh -c 'printf "::error::planted\nno newline at the end"; exit 3' > "$tmp/partial.out"; rc=$?
   t2="$(sed -n '1s/^::stop-commands:://p' "$tmp/partial.out")"
@@ -149,8 +159,24 @@ self_test() {
   row 'stderr is fenced too: none on its own pipe, 1 inside the fence, 0 live' '0 1 0' \
     "$(wc -l < "$tmp/stderr.err" | tr -d ' ') $(sed '1d;$d' "$tmp/stderr.out" | grep -cxF '::error::from stderr') $(live_commands "$tmp/stderr.out")"
 
-  printf '%s\n' '  ::error::indented' '::warning file=a.rs:1,line=2::a colon in a property' '::notice::plain' > "$tmp/forms.log"
-  row 'the live counter counts an indented command and a colon in a property' 3 "$(live_commands "$tmp/forms.log")"
+  # The counter is the oracle for every "0 live" row above, so each form the
+  # runner acts on must count, one file each.
+  got=""; i=0
+  for f in '  ::error::indented' '\f::error::after a form feed' '\0302\0240::notice::after a no-break space' \
+    '::Error::mixed case' '::WARNING file=a.rs:1,line=2::upper case, a colon in a property' \
+    '##[notice]the legacy form' 'progress 40%\r::error::after a carriage return'; do
+    i=$((i + 1)); printf '%b\n' "$f" > "$tmp/form$i.log"; got="$got $(live_commands "$tmp/form$i.log")"
+  done
+  row 'the live counter counts each of 7 forms the runner acts on' ' 1 1 1 1 1 1 1' "$got"
+  tk=0123456789abcdef0123456789abcdef
+  printf '%b\n' "::stop-commands::$tk" 'inside' '  ::0123456789ABCDEF0123456789ABCDEF:: trailing' '::error::after it' > "$tmp/end1.log"
+  printf '%b\n' "::stop-commands::$tk" "x\r::$tk::\r::error::on the resume line" > "$tmp/end2.log"
+  row 'a region ends at ::<token> in any case and place, and that line counts' '1 1' \
+    "$(live_commands "$tmp/end1.log") $(live_commands "$tmp/end2.log")"
+  printf '%b\n' "  ::stop-commands::$tk" '::error::after an indented stop' "::$tk::" > "$tmp/start1.log"
+  printf '%b\n' '::stop-commands::short' '::error::after a short token' '::short::' > "$tmp/start2.log"
+  row 'a region starts only at the fence form of the stop line' '1 1' \
+    "$(live_commands "$tmp/start1.log") $(live_commands "$tmp/start2.log")"
 
   fenced sh -c 'printf "::0123456789abcdef0123456789abcdef::\n::error::after a guessed resume\n"' > "$tmp/guess.out"
   row 'a resume line with another token does not end the fence' 0 "$(live_commands "$tmp/guess.out")"

From a5e3f09a30cb2f0c7fcf6c1334987d5b3465d98a Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Thu, 8 Oct 2026 21:48:08 +0200
Subject: [PATCH 07/11] fix(ci): the counter missed \r-joined commands; `||
 true` passed the wiring check (#4936)

Review of b7544bab37 found two ways the fence's proof could pass while the
runner saw something else.

1. The live counter read one \n-line as one command. The runner splits on
   \r too, so `::error::a\r::error::b\r::error::c` is 3 commands, and the
   counter said 1: "a 1 is at most 1" was false. The counter now splits on \r
   and counts each piece. Two more under-counts were closed on the way:
   - A region ends at ##[<token> as well as ::<token> (the legacy form
     resumes the runner too).
   - After an odd stop line (one the fence never prints) or an odd end (a
     ::<token> line other than the exact resume), the runner may be stopped
     on another token or still be stopped. No region starts again after
     either, so every later annotation counts.
2. check_wiring took any line holding the fenced command as wired, so
   `... self-test || true`, `; true`, `| tee x` and `|| :` passed and could
   mask the case table's rc. A self-test line must now be exactly
   `bash scripts/ci/fence_workflow_commands.sh -- python3
   scripts/ci/fat_driver.py self-test`, after indentation, an optional `- `
   and `run: `, and before trailing blanks. Any whitespace run between
   fat_driver.py and self-test is found, so two spaces is RED, not missed.

Self-test now 27 rows, all green under gawk, mawk and busybox awk. The new
rows: an 8th counter form (3 commands on one \r-joined line, want 3), a
##[<token> region end, two doubt rows, 5 masked or re-spaced wiring lines,
and the fenced command alone in a run block. Each of 16 literal mutants
and both earlier counters (967b7ea6a4, b7544bab37) turns at least one row RED.

Refs #4936
Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/ci/fence_workflow_commands.sh | 87 +++++++++++++++++++--------
 1 file changed, 63 insertions(+), 24 deletions(-)

diff --git a/scripts/ci/fence_workflow_commands.sh b/scripts/ci/fence_workflow_commands.sh
index bb6c8e1027..211461c6c7 100644
--- a/scripts/ci/fence_workflow_commands.sh
+++ b/scripts/ci/fence_workflow_commands.sh
@@ -64,53 +64,72 @@ fenced() {
 # live_commands <log> -> how many annotation commands the runner would act on,
 # outside every stop..resume region. Each rule errs on the high side, so a 0
 # here is a 0 on the runner and a 1 is at most 1:
+#  - Lines split on \r as well as \n, as the runner splits them. The runner
+#    acts on at most one command per line, so a line counts once.
 #  - An annotation is ::error, ::warning or ::notice, or the legacy ##[error,
 #    ##[warning or ##[notice, anywhere in a line and in any case. The runner
-#    wants it first after any whitespace, and it also splits lines on a \r.
+#    wants it first after any whitespace.
 #  - A region starts only at the fence's own stop line: column 0, lower case,
-#    a 32-hex token and nothing after it. Any other stop line starts none, so
-#    the lines after it count.
-#  - A region ends at the first line holding ::<token> in any case, and that
-#    line is counted too.
+#    a 32-hex token and nothing after it.
+#  - A region ends at the first line holding ::<token> or ##[<token> in any
+#    case. That line is never live: it is the resume, or the runner is still
+#    stopped.
+#  - Doubt: any other line naming stop-commands may stop the runner, and a
+#    region that ends on a line other than ::<token>:: may not resume it.
+#    After either, no region starts again, so every later annotation counts.
 # Problem matchers are not workflow commands: the fence does not stop them,
 # and this does not count them.
 live_commands() {
   LC_ALL=C awk '
-    { lc = tolower($0) }
-    stop != "" { if (index(lc, "::" stop) == 0) next; stop = "" }
-    /^::stop-commands::/ { t = substr($0, 18); if (length(t) == 32 && t !~ /[^0-9a-f]/) { stop = t; next } }
-    lc ~ /(::|##[[])(error|warning|notice)/ { n++ }
+    function one(s,  lc, t) {
+      lc = tolower(s)
+      if (stop != "") {
+        if (index(lc, "::" stop) == 0 && index(lc, "##[" stop) == 0) return
+        if (lc != "::" stop "::") doubt = 1
+        stop = ""; return
+      }
+      if (index(lc, "stop-commands")) {
+        t = substr(s, 18)
+        if (!doubt && substr(s, 1, 17) == "::stop-commands::" && length(t) == 32 && t !~ /[^0-9a-f]/) { stop = t; return }
+        doubt = 1
+      }
+      if (lc ~ /(::|##[[])(error|warning|notice)/) n++
+    }
+    { k = split($0, part, "\r"); for (i = 1; i <= k; i++) one(part[i]) }
     END { print n + 0 }' "$1"
 }
 
 # check_wiring <ci.yml> -> one FAIL line per defect. rc 0 = every
-# `fat_driver.py self-test` runs through the fence and no `fat_driver.py run`
-# or `wait` does; 1 = a defect; 2 = unreadable, or no self-test step found.
+# `fat_driver.py self-test` line is exactly the fenced command, alone after an
+# optional `run:` (so nothing on the line masks its rc), and no
+# `fat_driver.py run` or `wait` is fenced; 1 = a defect; 2 = unreadable, or no
+# self-test step found.
 check_wiring() {
   [ -r "$1" ] || return 2
-  local bad=0 seen=0 line
+  local bad=0 seen=0 line cmd
   while IFS= read -r line; do
     seen=$((seen + 1))
-    case "$line" in
-      *"$FENCE_REL -- python3 scripts/ci/fat_driver.py self-test"*) ;;
+    cmd="$(printf '%s' "$line" | sed -E 's/^[[:space:]]*(-[[:space:]]+)?(run:[[:space:]]+)?//; s/[[:space:]]+$//')"
+    case "$cmd" in
+      "bash $FENCE_REL -- python3 scripts/ci/fat_driver.py self-test") ;;
       *)
-        printf 'FAIL: %s runs the fat_driver case table unfenced -- its planted rows raise live ::error:: annotations: %s\n' \
-          "$WORKFLOW_REL" "$(printf '%s' "$line" | sed -E 's/^[[:space:]]+//')"
+        printf 'FAIL: %s runs the fat_driver case table other than as exactly `bash %s -- python3 scripts/ci/fat_driver.py self-test` -- unfenced, its planted rows raise live ::error:: annotations; with more on the line, its rc can be masked: %s\n' \
+          "$WORKFLOW_REL" "$FENCE_REL" "$(printf '%s' "$line" | sed -E 's/^[[:space:]]+//')"
         bad=1 ;;
     esac
-  done < <(grep -E 'fat_driver\.py self-test' "$1")
+  done < <(grep -E 'fat_driver\.py[[:space:]]+self-test' "$1")
   while IFS= read -r line; do
     printf 'FAIL: %s fences a real fat_driver run -- its deadline ::error:: must stay live: %s\n' \
       "$WORKFLOW_REL" "$(printf '%s' "$line" | sed -E 's/^[[:space:]]+//')"
     bad=1
-  done < <(grep -E "$FENCE_REL.*fat_driver\\.py (run|wait)" "$1")
+  done < <(grep -E "$FENCE_REL.*fat_driver\\.py[[:space:]]+(run|wait)" "$1")
   [ "$seen" -gt 0 ] || return 2
   return "$bad"
 }
 
 self_test() {
   printf '=== case table: fence_workflow_commands.sh ===\n'
-  local tmp fails=0 rc t1 t2 t3 tk got i f good
+  local tmp fails=0 rc t1 t2 t3 tk tk2 got i f good
   tmp="$(mktemp -d)"
   trap 'rm -rf "${tmp:?}"' RETURN
   row() {  # row <label> <want> <got>
@@ -164,19 +183,29 @@ self_test() {
   got=""; i=0
   for f in '  ::error::indented' '\f::error::after a form feed' '\0302\0240::notice::after a no-break space' \
     '::Error::mixed case' '::WARNING file=a.rs:1,line=2::upper case, a colon in a property' \
-    '##[notice]the legacy form' 'progress 40%\r::error::after a carriage return'; do
+    '##[notice]the legacy form' 'progress 40%\r::error::after a carriage return' \
+    '::error::one\r::warning::two\r::notice::three, all on one line'; do
     i=$((i + 1)); printf '%b\n' "$f" > "$tmp/form$i.log"; got="$got $(live_commands "$tmp/form$i.log")"
   done
-  row 'the live counter counts each of 7 forms the runner acts on' ' 1 1 1 1 1 1 1' "$got"
+  row 'the live counter counts each of 8 forms the runner acts on' ' 1 1 1 1 1 1 1 3' "$got"
   tk=0123456789abcdef0123456789abcdef
   printf '%b\n' "::stop-commands::$tk" 'inside' '  ::0123456789ABCDEF0123456789ABCDEF:: trailing' '::error::after it' > "$tmp/end1.log"
-  printf '%b\n' "::stop-commands::$tk" "x\r::$tk::\r::error::on the resume line" > "$tmp/end2.log"
-  row 'a region ends at ::<token> in any case and place, and that line counts' '1 1' \
-    "$(live_commands "$tmp/end1.log") $(live_commands "$tmp/end2.log")"
+  printf '%b\n' "::stop-commands::$tk" "x\r::$tk::\r::error::after the resume" > "$tmp/end2.log"
+  printf '%b\n' "::stop-commands::$tk" 'x ##[0123456789ABCDEF0123456789ABCDEF] y' '::error::after a legacy resume' > "$tmp/end3.log"
+  row 'a region ends at the first line holding ::TOKEN or ##[TOKEN, in any case and place' '1 1 1' \
+    "$(live_commands "$tmp/end1.log") $(live_commands "$tmp/end2.log") $(live_commands "$tmp/end3.log")"
   printf '%b\n' "  ::stop-commands::$tk" '::error::after an indented stop' "::$tk::" > "$tmp/start1.log"
   printf '%b\n' '::stop-commands::short' '::error::after a short token' '::short::' > "$tmp/start2.log"
   row 'a region starts only at the fence form of the stop line' '1 1' \
     "$(live_commands "$tmp/start1.log") $(live_commands "$tmp/start2.log")"
+  # On the runner each of these is still stopped, or stopped again, where a
+  # fence region would start: the stop line is ignored, and the old token
+  # resumes it. The annotation after that is live.
+  tk2=fedcba9876543210fedcba9876543210
+  printf '%b\n' '  ::stop-commands::odd' "::stop-commands::$tk" '::odd::' '::error::live after an odd stop' > "$tmp/doubt1.log"
+  printf '%b\n' "::stop-commands::$tk" "x ::$tk::" "::stop-commands::$tk2" "::$tk::" '::error::live after an odd end' > "$tmp/doubt2.log"
+  row 'after a line that leaves the runner in doubt, no region starts again' '1 1' \
+    "$(live_commands "$tmp/doubt1.log") $(live_commands "$tmp/doubt2.log")"
 
   fenced sh -c 'printf "::0123456789abcdef0123456789abcdef::\n::error::after a guessed resume\n"' > "$tmp/guess.out"
   row 'a resume line with another token does not end the fence' 0 "$(live_commands "$tmp/guess.out")"
@@ -195,6 +224,16 @@ self_test() {
   check_wiring "$tmp/ok.yml" > /dev/null; row 'wiring: fenced self-test, unfenced run' 0 "$?"
   printf '        run: python3 scripts/ci/fat_driver.py self-test\n%s\n' "$good" > "$tmp/bare.yml"
   check_wiring "$tmp/bare.yml" > /dev/null; row 'wiring: an unfenced self-test is RED (the #4936 state)' 1 "$?"
+  got=""; i=0
+  for f in ' || true' '; true' ' | tee x.log' ' # ok'; do
+    i=$((i + 1)); printf '        run: bash %s -- python3 scripts/ci/fat_driver.py self-test%s\n' "$FENCE_REL" "$f" > "$tmp/mask$i.yml"
+    check_wiring "$tmp/mask$i.yml" > /dev/null; got="$got $?"
+  done
+  printf '        - run: bash %s -- python3 scripts/ci/fat_driver.py  self-test\n' "$FENCE_REL" > "$tmp/mask5.yml"
+  check_wiring "$tmp/mask5.yml" > /dev/null; got="$got $?"
+  row 'wiring: more on the self-test line, or another spacing, is RED' ' 1 1 1 1 1' "$got"
+  printf '          bash %s -- python3 scripts/ci/fat_driver.py self-test  \n' "$FENCE_REL" > "$tmp/block.yml"
+  check_wiring "$tmp/block.yml" > /dev/null; row 'wiring: the fenced command alone in a run block is clean' 0 "$?"
   printf '        run: bash %s -- python3 scripts/ci/fat_driver.py self-test\n        run: bash %s -- python3 scripts/ci/fat_driver.py run --sections x\n' \
     "$FENCE_REL" "$FENCE_REL" > "$tmp/runfenced.yml"
   check_wiring "$tmp/runfenced.yml" > /dev/null; row 'wiring: a fenced real run is RED (its deadline must stay live)' 1 "$?"

From d2cc2233b84fc57abc34d342d58b5f7380b9ff88 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Sat, 10 Oct 2026 07:04:02 +0200
Subject: [PATCH 08/11] fix(ci): the build-base pin reads origin under P6; no
 cd in either P6 caller

The merge of main moved the sections' comparand fetches into
scripts/ci/pin_build_base.sh, so the P6 re-reads (operator C343 #9) those
fetches had on this branch went with them. The pin's three fetches (the
tip, the push deepen, the build base) now go through fetch_p6.sh: a read
that did not answer is read again, up to 3 reads in all; a read that
answered is never read again.

fetch_p6.sh takes a leading `-C <dir>` and hands it to git, so neither
caller cds (bashrs SEC010 on both `cd -- "$dir"` subshells).

Case tables, each new row RED under a planted mutant:
- pin_build_base: 6 P6 rows (a planted git kills the named reads), floor
  22 -> 28. 10 mutants, 10 killed: fetch() bypassing P6, -C dropped,
  fetch_p6 losing -C, each site bare, P6_READS=2, answered() never true,
  helper missing, a P6 row dropped (the floor).
- fetch_p6: 5 -C rows (a cwd that is no repo, every re-read keeps -C,
  -C with no dir is a usage answer).
- roadmap diff: the stacked merge_group deepen with its first read dead
  must read the deepen twice. A bare deepen, and both reads bare, are
  killed; dropping -C there is equivalent (callers run from REPO_ROOT).
- ratchet C16: its mutant runs from a copy, so fetch_p6.sh is placed
  beside it, and a new row asserts the mutant ran its fall-through to the
  tip. Without the copy the old C16 row stayed green on a crashed mutant;
  the new row is RED.

Refs #4936
Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/check_roadmap_diff_additive.sh  | 21 +++++++++
 scripts/ci/fetch_p6.sh                  | 32 ++++++++++++--
 scripts/ci/pin_build_base.sh            | 57 +++++++++++++++++++++++--
 scripts/lib/resolve_base.sh             |  4 +-
 scripts/tests/ratchet_semantics_test.sh |  9 ++++
 5 files changed, 113 insertions(+), 10 deletions(-)

diff --git a/scripts/check_roadmap_diff_additive.sh b/scripts/check_roadmap_diff_additive.sh
index 67c03af079..9ea060e614 100755
--- a/scripts/check_roadmap_diff_additive.sh
+++ b/scripts/check_roadmap_diff_additive.sh
@@ -419,6 +419,27 @@ EOF
         *"is not a merge commit nor a commit on the origin/main tip"*) printf 'ok    row %-2s stacked entry with deepening disabled (mutation): refused by name\n' "$row" ;;
         *) printf 'FAIL  row %-2s stacked entry with deepening disabled: refused for the wrong reason (rc=%s): %s\n' "$row" "$rc7" "$err7"; fails=1 ;;
     esac
+    # #4936 (P6): the same stacked entry with the deepen's first read dead (curl 92). fetch_p6.sh reads the
+    # deepen again and the base still resolves. A planted git logs every fetch read; both must be the
+    # deepen, so a deepen that is one bare read (it dies, and the by-sha fetch after it answers) is RED.
+    row=$((row + 1))
+    rm -rf "${Q:?}.clone"; git clone -q --depth=1 -b main "file://$Q" "$Q.clone" 2>/dev/null; git -C "$Q.clone" fetch -q --depth=1 origin '+queue-base:refs/remotes/origin/main' 2>/dev/null
+    S="$TD/p6-shim"; rm -rf "${S:?}"; mkdir -p "$S"
+    printf '%s\n' '#!/usr/bin/env bash' \
+        'case " $* " in *" fetch "*)' \
+        '    printf "%s\n" "$*" >> "$P6_SHIM_LOG"' \
+        '    if [ "$(wc -l < "$P6_SHIM_LOG")" -eq 1 ]; then' \
+        "        printf '%s\\n' 'error: RPC failed; curl 92 HTTP/2 stream 5 was not closed cleanly: CANCEL (err 8)' 'fatal: early EOF' >&2; exit 128" \
+        '    fi ;;' \
+        'esac' \
+        'exec "$P6_SHIM_REAL" "$@"' > "$S/git"
+    printf '%s\n' '#!/usr/bin/env bash' 'exit 0' > "$S/sleep"; chmod +x "$S/git" "$S/sleep"; : > "$S/reads"
+    got8=$( PATH="$S:$PATH" P6_SHIM_REAL="$(command -v git)" P6_SHIM_LOG="$S/reads" GITHUB_EVENT_NAME=merge_group bash -c 'cd "$2" || exit 2; . "$0" --lib-only; REPO_ROOT="$1"; resolve_base HEAD && printf "%s|%s" "$BASE_REF" "$BASE_HOW"' "$SELF" "$Q.clone" "$Q.clone" 2>/dev/null ) || true
+    reads8="$(grep -c -e '--deepen=1' "$S/reads") of $(wc -l < "$S/reads" | tr -d ' ')"
+    case "$reads8|$got8" in "2 of 2|$want6|single parent (stacked merge_group entry"*) printf 'ok    row %-2s stacked entry, the deepen read dead once (curl 92): read again under P6, base = the previous entry squash\n' "$row" ;;
+        *) printf 'FAIL  row %-2s stacked entry, deepen read dead once: wanted 2 of 2 deepen reads and base %s, got %s deepen reads, %s\n' "$row" "$want6" "$reads8" "$got8"; fails=1 ;; esac
+    rm -rf "${S:?}"
+
     rm -rf "${Q:?}" "${Q:?}.clone"
 
     # Rows 19-22: --staged, the pre-commit entry point (B4, #3047). A scratch
diff --git a/scripts/ci/fetch_p6.sh b/scripts/ci/fetch_p6.sh
index 8cb3655f16..ae335cd797 100644
--- a/scripts/ci/fetch_p6.sh
+++ b/scripts/ci/fetch_p6.sh
@@ -20,6 +20,7 @@
 # not answer" never hangs a section.
 #
 #   bash scripts/ci/fetch_p6.sh <git fetch args...>     # in place of `git fetch`
+#   bash scripts/ci/fetch_p6.sh -C <dir> <args...>      # in place of `git -C <dir> fetch`
 #   bash scripts/ci/fetch_p6.sh --check-wiring          # no bare `git fetch` in ci/sections.yml
 #   bash scripts/ci/fetch_p6.sh --self-test
 set -uo pipefail
@@ -43,13 +44,18 @@ answered() {
   grep -qiE "couldn't find remote ref|not our ref|unadvertised object|Repository not found|does not appear to be a git repository|not a git repository|Authentication failed|could not read Username|The requested URL returned error: 40[134]" "$2"
 }
 
-# p6_fetch <git fetch args...> -> git fetch, read up to P6_READS times.
+# p6_fetch [-C <dir>] <git fetch args...> -> git fetch (in <dir> when -C names one),
+# read up to P6_READS times. -C with no dir is a usage error (rc 129): an answer.
 # rc = the last read's rc. git's stderr reaches the caller's stderr.
 p6_fetch() {
-  local err n rc why
+  local err n rc why at=()
+  if [ "${1:-}" = -C ]; then
+    [ $# -ge 2 ] || { printf 'fetch_p6: -C needs a directory\n' >&2; return 129; }
+    at=(-C "$2"); shift 2
+  fi
   err="$(mktemp)" || return 2
   for ((n = 1; n <= P6_READS; n++)); do
-    LC_ALL=C git -c "http.lowSpeedLimit=$LOW_SPEED_LIMIT" -c "http.lowSpeedTime=$LOW_SPEED_TIME" \
+    LC_ALL=C git "${at[@]}" -c "http.lowSpeedLimit=$LOW_SPEED_LIMIT" -c "http.lowSpeedTime=$LOW_SPEED_TIME" \
       fetch "$@" 2> "$err"
     rc=$?
     cat "$err" >&2
@@ -137,7 +143,7 @@ SHIM
   run() {  # run <mode> <fetch args...> -> rc; reads in $tmp/<mode>/count
     local mode="$1"; shift
     mkdir -p "$tmp/$mode"
-    ( cd "$tmp/client" && SLEEP_S=7 && LC_ALL=POSIX PATH="$tmp/bin:$PATH" SHIM_DIR="$tmp/$mode" SHIM_MODE="$mode" \
+    ( cd "${RUN_CWD:-$tmp/client}" && SLEEP_S=7 && LC_ALL=POSIX PATH="$tmp/bin:$PATH" SHIM_DIR="$tmp/$mode" SHIM_MODE="$mode" \
         SHIM_REAL="$real_git" p6_fetch "$@" ) \
       > "$tmp/$mode/out" 2> "$tmp/$mode/err"
   }
@@ -200,6 +206,24 @@ SHIM
   row "real git, a missing ref: fails, read once (git's own wording is an answer)" '1 1' \
     "$([ "$rc" -ne 0 ] && echo 1 || echo 0) $(reads real)"
 
+  # -C <dir> (pin_build_base.sh, resolve_base.sh): the read runs in <dir>, from a cwd that is no repo.
+  "$real_git" init -q "$tmp/client-c"
+  "$real_git" -C "$tmp/client-c" remote add origin "$tmp/remote.git"
+  mkdir -p "$tmp/elsewhere"
+  rm -rf -- "${tmp:?}/real"
+  RUN_CWD="$tmp/elsewhere" run real -C "$tmp/client-c" origin +refs/heads/main:refs/remotes/origin/main; rc=$?
+  row 'real git, -C <dir> from a cwd that is no repo: rc 0, read once' '0 1' "$rc $(reads real)"
+  row 'real git, -C <dir>: the ref lands in <dir>' 1 \
+    "$("$real_git" -C "$tmp/client-c" rev-parse -q --verify refs/remotes/origin/main >/dev/null && echo 1 || echo 0)"
+  rm -rf -- "${tmp:?}/cancel-twice"
+  RUN_CWD="$tmp/elsewhere" run cancel-twice -C "$tmp/client-c" origin main; rc=$?
+  row 'curl 92 twice under -C <dir>: rc 0 after 3 reads' '0 3' "$rc $(reads cancel-twice)"
+  row 'curl 92 twice under -C <dir>: every read keeps -C <dir> and the stall cut' 3 \
+    "$(grep -cxF -- "-C $tmp/client-c -c http.lowSpeedLimit=$LOW_SPEED_LIMIT -c http.lowSpeedTime=$LOW_SPEED_TIME fetch origin main" "$tmp/cancel-twice/args")"
+  rm -rf -- "${tmp:?}/ok"
+  run ok -C; rc=$?
+  row '-C with no dir is a usage error: rc 129, git never runs' '129 0' "$rc $(reads ok)"
+
   # Wiring: no bare `git fetch` in the sections file.
   printf '          bash %s --no-tags --depth=1 origin x\n          # git fetch in a comment is prose\n' \
     "$HELPER_REL" > "$tmp/ok.yml"
diff --git a/scripts/ci/pin_build_base.sh b/scripts/ci/pin_build_base.sh
index d27f616096..fe2bfee0c1 100755
--- a/scripts/ci/pin_build_base.sh
+++ b/scripts/ci/pin_build_base.sh
@@ -28,6 +28,15 @@
 set -euo pipefail
 
 ZERO=0000000000000000000000000000000000000000
+# #4936 (P6, operator C343 #9): every fetch below goes through fetch_p6.sh, as the sections' fetches
+# do. A read that did not answer (curl 92, curl 56, a stall) is read again, up to 3 reads in all; a
+# read that answered, an object origin does not have among them, is never read again.
+P6="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/fetch_p6.sh"
+
+fetch() { # fetch <repo dir> <git fetch args...>: git fetch in <repo dir>, read under P6
+    local dir="$1"; shift
+    bash "$P6" -C "$dir" "$@"
+}
 
 is_sha() { [[ ${1:-} =~ ^[0-9a-f]{40}$ ]] && [ "$1" != "$ZERO" ]; }
 
@@ -54,15 +63,15 @@ pin() { # pin <repo dir>: pins origin/main there for $GITHUB_EVENT_NAME
             base="$MG_BASE_SHA"; how="merge_group.base_sha"
             ;;
         *)
-            git -C "$dir" fetch -q --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main || return 1
+            fetch "$dir" -q --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main || return 1
             if [ "$ev" = push ]; then
-                git -C "$dir" fetch -q --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main || return 1
+                fetch "$dir" -q --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main || return 1
             fi
             printf 'comparand: %s pinned as origin/main (the tip; event %s)\n' "$(git -C "$dir" rev-parse 'origin/main^{commit}')" "${ev:-none}"
             return 0
             ;;
     esac
-    git -C "$dir" fetch -q --no-tags --depth=1 origin "$base" || refuse "cannot fetch the build base $base" || return 1
+    fetch "$dir" -q --no-tags --depth=1 origin "$base" || refuse "cannot fetch the build base $base" || return 1
     git -C "$dir" update-ref refs/remotes/origin/main "$base"
     [ "$(git -C "$dir" rev-parse 'origin/main^{commit}')" = "$base" ] || refuse "origin/main does not read back as $base" || return 1
     printf 'comparand: %s pinned as origin/main (%s; event %s)\n' "$base" "$how" "$ev"
@@ -176,8 +185,48 @@ self_test() {
     rc=0; run_pin "$TD/pr1" pull_request "$prh" "" || rc=$?
     row "pinning twice is idempotent" "$rc $PINNED" "0 $c0"
 
+    # #4936 P6: a planted git counts every fetch read and answers each read whose number is in
+    # SHIM_DIE ("1 3": the first and the third) as a stalled read (curl 92); a planted sleep skips the back-off. The real git does the rest.
+    local shim="$TD/shim" real_git READS
+    real_git=$(command -v git)
+    mkdir -p "$shim"
+    printf '%s\n' '#!/usr/bin/env bash' \
+        'case " $* " in *" fetch "*)' \
+        '    echo fetch >> "$SHIM_LOG"' \
+        '    case " $SHIM_DIE " in *" $(wc -l < "$SHIM_LOG" | tr -d " ") "*)' \
+        "        printf '%s\\n' 'error: RPC failed; curl 92 HTTP/2 stream 5 was not closed cleanly: CANCEL (err 8)' 'fatal: early EOF' >&2; exit 128" \
+        '    esac ;;' \
+        'esac' \
+        'exec "$SHIM_REAL" "$@"' > "$shim/git"
+    printf '%s\n' '#!/usr/bin/env bash' 'exit 0' > "$shim/sleep"
+    chmod +x "$shim/git" "$shim/sleep"
+    run_pin_p6() { # run_pin_p6 "<dead read numbers>" <dir> <event> <pr head> <mg base> -> as run_pin; READS = fetch reads git saw
+        local dies="$1" rc=0; shift
+        : > "$TD/reads.log"
+        PATH="$shim:$PATH" SHIM_REAL="$real_git" SHIM_LOG="$TD/reads.log" SHIM_DIE="$dies" run_pin "$@" || rc=$?
+        READS=$(wc -l < "$TD/reads.log" | tr -d ' ')
+        return "$rc"
+    }
+    d=$(clone_at p6mg "$m2"); rc=0; run_pin_p6 1 "$d" merge_group "" "$c2" || rc=$?
+    row "P6: merge_group's base fetch, first read dead (curl 92), is read again and pins" \
+        "$rc $PINNED $READS $(said 'read 1/3 did not answer')" "0 $c2 2 says-cause"
+    d=$(clone_at p6pr "$m"); rc=0; run_pin_p6 "1 2" "$d" pull_request "$prh" "" || rc=$?
+    row "P6: pull_request's base fetch, two reads dead, pins on the third" "$rc $PINNED $READS" "0 $c0 3"
+    d=$(clone_at p6push "$c2"); rc=0; run_pin_p6 1 "$d" push "" "" || rc=$?
+    row "P6: push's tip fetch, first read dead, is read again; the deepen still runs" \
+        "$rc $PINNED $READS $(git -C "$d" rev-parse -q --verify 'origin/main^1^{commit}' 2>/dev/null || printf none)" "0 $c2 3 $c0"
+    d=$(clone_at p6deepen "$c2"); rc=0; run_pin_p6 2 "$d" push "" "" || rc=$?
+    row "P6: push's deepen fetch, first read dead, is read again; the tip's first parent is fetched" \
+        "$rc $PINNED $READS $(git -C "$d" rev-parse -q --verify 'origin/main^1^{commit}' 2>/dev/null || printf none)" "0 $c2 3 $c0"
+    d=$(clone_at p6cap "$m2"); rc=0; run_pin_p6 "1 2 3" "$d" merge_group "" "$c2" || rc=$?
+    row "P6: three dead reads are the cap, and the pin refuses" \
+        "$rc $PINNED $READS $(said 'no answer under P6') $(said 'cannot fetch the build base')" "1 unset 3 says-cause says-cause"
+    d=$(clone_at p6answer "$m2"); rc=0; run_pin_p6 "" "$d" merge_group "" "$(printf '%040d' 7)" || rc=$?
+    row "P6: a read that answered (origin has no such base) is read once, never again" \
+        "$rc $PINNED $READS $(said 'cannot fetch the build base')" "1 unset 1 says-cause"
+
     printf 'pin_build_base self-test: %s ok, %s bad\n' "$ok" "$bad"
-    [ "$bad" -eq 0 ] && [ "$ok" -ge 22 ]
+    [ "$bad" -eq 0 ] && [ "$ok" -ge 28 ]
 }
 
 case "${1:-}" in
diff --git a/scripts/lib/resolve_base.sh b/scripts/lib/resolve_base.sh
index cb31fee8b4..d955594dfe 100644
--- a/scripts/lib/resolve_base.sh
+++ b/scripts/lib/resolve_base.sh
@@ -79,8 +79,8 @@ resolve_base() {
             if ! git -C "$REPO_ROOT" cat-file -e "$p1^{commit}" 2>/dev/null; then
                 # Read up to 3 times under P6 (#4936). `>&2 2>/dev/null` applies left to right: the helper's
                 # status lines (its stdout) go to stderr, never into a caller's $(...); git's own stderr is dropped.
-                ( CDPATH='' cd -- "$REPO_ROOT" && bash "$_RESOLVE_BASE_P6" -q --deepen=1 origin ) >&2 2>/dev/null \
-                    || ( CDPATH='' cd -- "$REPO_ROOT" && bash "$_RESOLVE_BASE_P6" -q origin "$p1" ) >&2 2>/dev/null || true
+                bash "$_RESOLVE_BASE_P6" -C "$REPO_ROOT" -q --deepen=1 origin >&2 2>/dev/null \
+                    || bash "$_RESOLVE_BASE_P6" -C "$REPO_ROOT" -q origin "$p1" >&2 2>/dev/null || true
             fi
             if git -C "$REPO_ROOT" cat-file -e "$p1^{commit}" 2>/dev/null; then
                 BASE_REF="$p1"; BASE_HOW="single parent (stacked merge_group entry: the previous entry's squash, fetched by deepening the shallow checkout)"; return 0
diff --git a/scripts/tests/ratchet_semantics_test.sh b/scripts/tests/ratchet_semantics_test.sh
index 89a0d09f41..1cfd8eac5e 100755
--- a/scripts/tests/ratchet_semantics_test.sh
+++ b/scripts/tests/ratchet_semantics_test.sh
@@ -598,8 +598,17 @@ run_complexity() {
   else
     bad "C16 the mutation could not be derived: no '# PIN-BUILD-BASE-MUTATION-POINT' line in scripts/ci/pin_build_base.sh"
   fi
+  # #4936: the pin reads origin through fetch_p6.sh beside it, so the mutant gets the same neighbour.
+  # Without it the mutant dies on the missing helper and C16 would pass on a crash, not on the
+  # fall-through to the tip that it names; the mutant's own line proves which one ran.
+  cp "$ROOT/scripts/ci/fetch_p6.sh" "$WORK/fetch_p6.sh" || die "C16: cannot place fetch_p6.sh beside the mutant"
   cx_rerun_clone "$CC5" 1 "$M" || die "C16: the clone is not the re-run shape (HEAD=M, origin/main=B2, no merge-base)"
   out=$(cx_pin "$CC5" "$X" "$WORK/pin-mutant.sh"); rc=$?
+  if [ "$rc" -eq 0 ] && grep -q "^comparand: $B2 pinned as origin/main (the tip; event pull_request)$" <<<"$out"; then
+    ok "C16 the mutant pin ran its fall-through: origin/main = B2, the tip"
+  else
+    bad "C16 the mutant pin did not fall through to the tip (rc=$rc)"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
   out=$(cx_run "$CC5" check_complexity_ratchet.sh "${TIP_ENV[@]}"); rc=$?
   if [ "$rc" -eq 1 ] && grep -qE "^  comparand   TIP +${B2:0:7}" <<<"$out" \
      && grep -q 'RED    NEW      src/lib.rs::cognitive_only' <<<"$out"; then

From 7b77d5182a3f6abf3d2fb3aa5cfedc50611be440 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Sat, 10 Oct 2026 07:15:59 +0200
Subject: [PATCH 09/11] fix(ci): the pin and P6 self-tests read from a cwd no
 fetch can reach

A fetch that loses its -C runs in the caller's cwd. Run from a checkout,
a depth fetch there writes .git/shallow into the shared common dir and
every worktree of that clone stops working. A mutant that dropped -C did
exactly that.

pin_build_base.sh --self-test now cds into its own temp dir and sets
git's ceiling to that dir's parent (git never stops at the dir it starts
in). fetch_p6.sh's table ceilings at its temp dir, and its -C rows start
from a dir under it. A fetch without -C then reads "not a git
repository" instead of reaching a checkout.

New rows, each failable:
- pin: the table's cwd is no repository; the ceiling is TD's parent.
  Floor 28 -> 30.
- fetch_p6: the cwd the -C reads start from is no repository.

Mutants, run with cwd in a planted empty repo and TMPDIR inside it, so
the ceilings are load-bearing: 16 killed, 0 survived, both controls
green (pin 30 ok; fetch_p6 PASS). New ones: cd dropped, ceiling
dropped, ceiling at TD, cwd row dropped, fetch_p6 ceiling dropped. The
planted repo held no ref, no remote and no shallow file after each run.

bashrs: no finding code rises in either file vs the previous commit.

Refs #4936
Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/ci/fetch_p6.sh       |  4 ++++
 scripts/ci/pin_build_base.sh | 12 +++++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/scripts/ci/fetch_p6.sh b/scripts/ci/fetch_p6.sh
index ae335cd797..5e93af28ea 100644
--- a/scripts/ci/fetch_p6.sh
+++ b/scripts/ci/fetch_p6.sh
@@ -103,6 +103,8 @@ self_test() {
   local tmp fails=0 rc real_git
   tmp="$(mktemp -d)" || return 1
   trap 'rm -rf "${tmp:?}"' RETURN
+  # #4936: git finds no repository above tmp, so a read that lost its -C never reaches a checkout.
+  export GIT_CEILING_DIRECTORIES="$tmp"
   real_git="$(command -v git)"
   row() {  # row <label> <want> <got>
     if [ "$2" = "$3" ]; then
@@ -210,6 +212,8 @@ SHIM
   "$real_git" init -q "$tmp/client-c"
   "$real_git" -C "$tmp/client-c" remote add origin "$tmp/remote.git"
   mkdir -p "$tmp/elsewhere"
+  row 'the cwd those reads start from is no repo, even when tmp sits inside a checkout' none \
+    "$(if "$real_git" -C "$tmp/elsewhere" rev-parse --git-dir >/dev/null 2>&1; then echo repo; else echo none; fi)"
   rm -rf -- "${tmp:?}/real"
   RUN_CWD="$tmp/elsewhere" run real -C "$tmp/client-c" origin +refs/heads/main:refs/remotes/origin/main; rc=$?
   row 'real git, -C <dir> from a cwd that is no repo: rc 0, read once' '0 1' "$rc $(reads real)"
diff --git a/scripts/ci/pin_build_base.sh b/scripts/ci/pin_build_base.sh
index fe2bfee0c1..92cf6ff85f 100755
--- a/scripts/ci/pin_build_base.sh
+++ b/scripts/ci/pin_build_base.sh
@@ -86,6 +86,11 @@ self_test() {
     local lib="$here/scripts/lib_baseline_ratchet.sh"
     [ -f "$lib" ] || { printf 'FAIL  self-test: %s is missing\n' "$lib"; return 1; }
     TD=$(mktemp -d); trap 'rm -rf "${TD:?}"' EXIT
+    # #4936: the table runs in TD, and git finds no repository above it. A fetch that lost its -C (a
+    # mutant, a slip) then reads "not a git repository" here, never the caller's checkout.
+    # The ceiling is TD's parent: git never stops at the directory it starts in.
+    cd -- "$TD" || return 1
+    export GIT_CEILING_DIRECTORIES="${TD%/*}"
     local o="$TD/origin.git" w="$TD/w" u="file://$TD/origin.git"
     local c0 prh m c2 grh m2 ok=0 bad=0
     g() { git -C "$w" -c user.name=st -c user.email=st@example.invalid -c commit.gpgsign=false "$@"; }
@@ -225,8 +230,13 @@ self_test() {
     row "P6: a read that answered (origin has no such base) is read once, never again" \
         "$rc $PINNED $READS $(said 'cannot fetch the build base')" "1 unset 1 says-cause"
 
+    row "the table runs in a cwd that is no repository, so a fetch without -C reaches no checkout" \
+        "$(if git rev-parse --git-dir >/dev/null 2>&1; then printf repo; else printf none; fi)" none
+    row "git looks no higher than TD, even if TD sits inside a checkout" \
+        "${GIT_CEILING_DIRECTORIES:-unset}" "${TD%/*}"
+
     printf 'pin_build_base self-test: %s ok, %s bad\n' "$ok" "$bad"
-    [ "$bad" -eq 0 ] && [ "$ok" -ge 28 ]
+    [ "$bad" -eq 0 ] && [ "$ok" -ge 30 ]
 }
 
 case "${1:-}" in

From 36e691c80aab3df8deac8f19d0ca24ab4700c276 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Sat, 10 Oct 2026 07:52:43 +0200
Subject: [PATCH 10/11] fix(p6): `fetch_p6.sh -C ''` fetched into the cwd's
 repo, and the roadmap P6 row could not see a lost -C (#4936)

- fetch_p6.sh: `-C` with an empty dir is now a usage error (rc 129), the
  same as `-C` with no dir. `git -C ""` keeps the cwd, so a caller whose
  dir variable was empty would have fetched into whatever repo the cwd is.
  A new row covers it. The planted git now exits 99 on an unknown
  SHIM_MODE (it exited 0), and a row proves that.
- check_roadmap_diff_additive.sh: the P6 stacked-entry row now runs from
  a cwd outside REPO_ROOT, under a ceiling, and checks that cwd is no
  repo. check_ont_ratchet.sh calls resolve_base without a cd. A
  resolve_base read that lost its -C "$REPO_ROOT" is now RED; on the
  previous head the row passed, so that mutant was not equivalent.

Refs #4936
Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/check_roadmap_diff_additive.sh |  8 +++++---
 scripts/ci/fetch_p6.sh                 | 11 +++++++++--
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/scripts/check_roadmap_diff_additive.sh b/scripts/check_roadmap_diff_additive.sh
index 9ea060e614..9da8100118 100755
--- a/scripts/check_roadmap_diff_additive.sh
+++ b/scripts/check_roadmap_diff_additive.sh
@@ -422,6 +422,8 @@ EOF
     # #4936 (P6): the same stacked entry with the deepen's first read dead (curl 92). fetch_p6.sh reads the
     # deepen again and the base still resolves. A planted git logs every fetch read; both must be the
     # deepen, so a deepen that is one bare read (it dies, and the by-sha fetch after it answers) is RED.
+    # It runs from a cwd outside REPO_ROOT (the shim's own dir), as check_ont_ratchet.sh may (it never cds),
+    # and git finds no repository above that cwd: a read that lost its -C "$REPO_ROOT" fails, the row is RED.
     row=$((row + 1))
     rm -rf "${Q:?}.clone"; git clone -q --depth=1 -b main "file://$Q" "$Q.clone" 2>/dev/null; git -C "$Q.clone" fetch -q --depth=1 origin '+queue-base:refs/remotes/origin/main' 2>/dev/null
     S="$TD/p6-shim"; rm -rf "${S:?}"; mkdir -p "$S"
@@ -434,10 +436,10 @@ EOF
         'esac' \
         'exec "$P6_SHIM_REAL" "$@"' > "$S/git"
     printf '%s\n' '#!/usr/bin/env bash' 'exit 0' > "$S/sleep"; chmod +x "$S/git" "$S/sleep"; : > "$S/reads"
-    got8=$( PATH="$S:$PATH" P6_SHIM_REAL="$(command -v git)" P6_SHIM_LOG="$S/reads" GITHUB_EVENT_NAME=merge_group bash -c 'cd "$2" || exit 2; . "$0" --lib-only; REPO_ROOT="$1"; resolve_base HEAD && printf "%s|%s" "$BASE_REF" "$BASE_HOW"' "$SELF" "$Q.clone" "$Q.clone" 2>/dev/null ) || true
+    got8=$( PATH="$S:$PATH" P6_SHIM_REAL="$(command -v git)" P6_SHIM_LOG="$S/reads" GITHUB_EVENT_NAME=merge_group GIT_CEILING_DIRECTORIES="$TD" bash -c 'cd "$2" || exit 2; if git rev-parse --git-dir >/dev/null 2>&1; then printf "cwd is a repo|"; else printf "no repo|"; fi; . "$0" --lib-only; REPO_ROOT="$1"; resolve_base HEAD && printf "%s|%s" "$BASE_REF" "$BASE_HOW"' "$SELF" "$Q.clone" "$S" 2>/dev/null ) || true
     reads8="$(grep -c -e '--deepen=1' "$S/reads") of $(wc -l < "$S/reads" | tr -d ' ')"
-    case "$reads8|$got8" in "2 of 2|$want6|single parent (stacked merge_group entry"*) printf 'ok    row %-2s stacked entry, the deepen read dead once (curl 92): read again under P6, base = the previous entry squash\n' "$row" ;;
-        *) printf 'FAIL  row %-2s stacked entry, deepen read dead once: wanted 2 of 2 deepen reads and base %s, got %s deepen reads, %s\n' "$row" "$want6" "$reads8" "$got8"; fails=1 ;; esac
+    case "$reads8|$got8" in "2 of 2|no repo|$want6|single parent (stacked merge_group entry"*) printf 'ok    row %-2s stacked entry, the deepen read dead once (curl 92), from a cwd that is no repo: read again under P6 in REPO_ROOT, base = the previous entry squash\n' "$row" ;;
+        *) printf 'FAIL  row %-2s stacked entry, deepen read dead once: wanted 2 of 2 deepen reads, a cwd that is no repo and base %s; got %s deepen reads, %s\n' "$row" "$want6" "$reads8" "$got8"; fails=1 ;; esac
     rm -rf "${S:?}"
 
     rm -rf "${Q:?}" "${Q:?}.clone"
diff --git a/scripts/ci/fetch_p6.sh b/scripts/ci/fetch_p6.sh
index 5e93af28ea..73c2f38ff3 100644
--- a/scripts/ci/fetch_p6.sh
+++ b/scripts/ci/fetch_p6.sh
@@ -45,12 +45,13 @@ answered() {
 }
 
 # p6_fetch [-C <dir>] <git fetch args...> -> git fetch (in <dir> when -C names one),
-# read up to P6_READS times. -C with no dir is a usage error (rc 129): an answer.
+# read up to P6_READS times. -C with no dir, or an empty one, is a usage error (rc 129): an
+# answer. `git -C ""` keeps the cwd, so a caller's unset dir would read in whatever repo the cwd is.
 # rc = the last read's rc. git's stderr reaches the caller's stderr.
 p6_fetch() {
   local err n rc why at=()
   if [ "${1:-}" = -C ]; then
-    [ $# -ge 2 ] || { printf 'fetch_p6: -C needs a directory\n' >&2; return 129; }
+    if [ -z "${2:-}" ]; then printf 'fetch_p6: -C needs a directory\n' >&2; return 129; fi
     at=(-C "$2"); shift 2
   fi
   err="$(mktemp)" || return 2
@@ -135,6 +136,7 @@ case "$SHIM_MODE" in
   norepo) printf '%s\n' 'fatal: not a git repository (or any of the parent directories): .git' >&2; exit 128 ;;
   usage) printf '%s\n' 'usage: git fetch [<options>] [<repository> [<refspec>...]]' >&2; exit 129 ;;
   real) exec "$SHIM_REAL" "$@" ;;
+  *) printf 'shim: unknown SHIM_MODE %s\n' "$SHIM_MODE" >&2; exit 99 ;;
 esac
 SHIM
   # A planted sleep: records how long each re-read would wait, returns at once.
@@ -227,6 +229,11 @@ SHIM
   rm -rf -- "${tmp:?}/ok"
   run ok -C; rc=$?
   row '-C with no dir is a usage error: rc 129, git never runs' '129 0' "$rc $(reads ok)"
+  run ok -C '' origin main; rc=$?
+  row '-C with an empty dir is a usage error too (git -C "" keeps the cwd): rc 129, git never runs' '129 0' \
+    "$rc $(reads ok)"
+  run no-such-mode origin main; rc=$?
+  row 'a misspelled SHIM_MODE fails its row: the planted git exits 99, never 0' 99 "$rc"
 
   # Wiring: no bare `git fetch` in the sections file.
   printf '          bash %s --no-tags --depth=1 origin x\n          # git fetch in a comment is prose\n' \

From ca7d665c2077486df1f0bbb76b58eee4f1e05886 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Sat, 10 Oct 2026 08:28:54 +0200
Subject: [PATCH 11/11] fix(roadmap): the P6 by-sha read's -C was never reached
 by a row (#4936)

A non-author review of 36e691c80a measured that no self-test row reached
the by-sha read in resolve_base.sh's stacked merge_group path. The P6 row
answers on its second deepen read, so the `||` fallback never runs. A by-sha
read that lost its -C "$REPO_ROOT", or that skipped P6, stayed green.

New row: the same stacked entry with all 3 deepen reads dead and the by-sha
read dead once. It starts from a cwd that is no repo (the planted git's own
dir, under a ceiling at the table's temp dir), in the same way as the row
above. It needs 3 deepen reads, then 2 by-sha reads, and the previous
entry's squash as the base:
- a by-sha read without -C runs in no repo, so the base does not resolve: RED;
- a by-sha read that skips P6 is never read again: RED.

The comment on the row above is narrowed: it covers the deepen read only.

Self-test: 26 -> 27 rows. Mutants of resolve_base.sh under the self-test
(13, each did what it names): the by-sha read's -C dropped, and the by-sha
read made a bare fetch, are now killed by the new row.

Refs #4936
Agent: aprender-4936
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/check_roadmap_diff_additive.sh | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/scripts/check_roadmap_diff_additive.sh b/scripts/check_roadmap_diff_additive.sh
index 9da8100118..0434184309 100755
--- a/scripts/check_roadmap_diff_additive.sh
+++ b/scripts/check_roadmap_diff_additive.sh
@@ -423,7 +423,8 @@ EOF
     # deepen again and the base still resolves. A planted git logs every fetch read; both must be the
     # deepen, so a deepen that is one bare read (it dies, and the by-sha fetch after it answers) is RED.
     # It runs from a cwd outside REPO_ROOT (the shim's own dir), as check_ont_ratchet.sh may (it never cds),
-    # and git finds no repository above that cwd: a read that lost its -C "$REPO_ROOT" fails, the row is RED.
+    # and git finds no repository above that cwd: a deepen read that lost its -C "$REPO_ROOT" fails, the row is
+    # RED. The deepen answers on its second read, so the by-sha read never runs here; the next row covers it.
     row=$((row + 1))
     rm -rf "${Q:?}.clone"; git clone -q --depth=1 -b main "file://$Q" "$Q.clone" 2>/dev/null; git -C "$Q.clone" fetch -q --depth=1 origin '+queue-base:refs/remotes/origin/main' 2>/dev/null
     S="$TD/p6-shim"; rm -rf "${S:?}"; mkdir -p "$S"
@@ -440,6 +441,26 @@ EOF
     reads8="$(grep -c -e '--deepen=1' "$S/reads") of $(wc -l < "$S/reads" | tr -d ' ')"
     case "$reads8|$got8" in "2 of 2|no repo|$want6|single parent (stacked merge_group entry"*) printf 'ok    row %-2s stacked entry, the deepen read dead once (curl 92), from a cwd that is no repo: read again under P6 in REPO_ROOT, base = the previous entry squash\n' "$row" ;;
         *) printf 'FAIL  row %-2s stacked entry, deepen read dead once: wanted 2 of 2 deepen reads, a cwd that is no repo and base %s; got %s deepen reads, %s\n' "$row" "$want6" "$reads8" "$got8"; fails=1 ;; esac
+    # #4936 (P6): the same entry with all 3 deepen reads dead, then the by-sha read dead once. P6 reads the by-sha
+    # fetch again and the base still resolves. Same cwd and ceiling as the row above: a by-sha read that lost its
+    # -C "$REPO_ROOT" runs in no repo, and one that skips P6 is never read again; either way the row is RED.
+    # Wanted: 3 deepen reads, then 2 by-sha reads.
+    row=$((row + 1))
+    rm -rf "${Q:?}.clone"; git clone -q --depth=1 -b main "file://$Q" "$Q.clone" 2>/dev/null; git -C "$Q.clone" fetch -q --depth=1 origin '+queue-base:refs/remotes/origin/main' 2>/dev/null
+    printf '%s\n' '#!/usr/bin/env bash' \
+        'case " $* " in *" fetch "*)' \
+        '    printf "%s\n" "$*" >> "$P6_SHIM_LOG"' \
+        '    dead=; case " $* " in *" --deepen=1 "*) dead=1 ;; *) [ "$(grep -vc -e --deepen=1 "$P6_SHIM_LOG")" -eq 1 ] && dead=1 ;; esac' \
+        '    if [ -n "$dead" ]; then' \
+        "        printf '%s\\n' 'error: RPC failed; curl 92 HTTP/2 stream 5 was not closed cleanly: CANCEL (err 8)' 'fatal: early EOF' >&2; exit 128" \
+        '    fi ;;' \
+        'esac' \
+        'exec "$P6_SHIM_REAL" "$@"' > "$S/git"
+    : > "$S/reads"
+    got9=$( PATH="$S:$PATH" P6_SHIM_REAL="$(command -v git)" P6_SHIM_LOG="$S/reads" GITHUB_EVENT_NAME=merge_group GIT_CEILING_DIRECTORIES="$TD" bash -c 'cd "$2" || exit 2; if git rev-parse --git-dir >/dev/null 2>&1; then printf "cwd is a repo|"; else printf "no repo|"; fi; . "$0" --lib-only; REPO_ROOT="$1"; resolve_base HEAD && printf "%s|%s" "$BASE_REF" "$BASE_HOW"' "$SELF" "$Q.clone" "$S" 2>/dev/null ) || true
+    reads9="$(grep -c -e '--deepen=1' "$S/reads") of $(wc -l < "$S/reads" | tr -d ' ')"
+    case "$reads9|$got9" in "3 of 5|no repo|$want6|single parent (stacked merge_group entry"*) printf 'ok    row %-2s stacked entry, all 3 deepen reads dead and the by-sha read dead once, from a cwd that is no repo: by-sha read again under P6 in REPO_ROOT, base = the previous entry squash\n' "$row" ;;
+        *) printf 'FAIL  row %-2s stacked entry, all 3 deepen reads dead and the by-sha read dead once: wanted 3 of 5 deepen reads, a cwd that is no repo and base %s; got %s deepen reads, %s\n' "$row" "$want6" "$reads9" "$got9"; fails=1 ;; esac
     rm -rf "${S:?}"
 
     rm -rf "${Q:?}" "${Q:?}.clone"