[noahgift]

Refs #4936
keep-open: B cuts section-fetch drops but cannot clear them; the stalls on the egress path continue until the network is fixed, and #4936 closes only after a post-merge x86-main log shows both mechanisms engaged.

Re-cut of #5051 onto main at 9e77499, a new branch with no merge from main. #5051 left the merge queue on a conflict with #5029, which fixed the same case-table annotation symptom (part A of #4936) with scripts/ci/fixture_quiet.sh. This branch takes #5029's fix and carries part B only: every section git fetch reads up to 3 times. The fence wrapper from #5051 is not in this branch.

The patch is the one #5051 carried, minus the fence script and its two ci.yml lines. In ci.yml this branch adds only the two fetch_p6.sh lines (--self-test, --check-wiring), after main's fixture_quiet.sh --self-test.

What it does

• scripts/ci/fetch_p6.sh: reads a fetch again when it does not answer (a timeout or a transport error), up to 3 reads. A fetch that answers with an error, such as a missing ref or a 401, is never read again: that answer is the verdict. -C with an empty or missing dir is a usage error (rc 129).
• fetch_p6.sh --check-wiring is RED on any git fetch in ci/sections.yml that does not go through the helper. It finds 7 fetches, all through the helper.
• scripts/ci/pin_build_base.sh and scripts/lib/resolve_base.sh read through the helper with -C kept. Their rows run from a cwd that is no repo, so a read that lost its -C is RED.
• check_roadmap_diff_additive.sh and ratchet_semantics_test.sh get rows for the stacked merge_group path's deepen and by-sha reads.

Case tables on 66a8c28

Table	Rows	Result
fetch_p6.sh --self-test	48	48 ok
fetch_p6.sh --check-wiring	7 fetches	PASS
pin_build_base.sh --self-test	30	30 ok
check_roadmap_diff_additive.sh --self-test	27	27 ok
fixture_quiet.sh --self-test (main's, unchanged)	14	14 ok

Planted falsifiers for the P6 half (from #5051, same blobs)

These ran against the real scripts as CI calls them. A planted git on PATH points at a real file:// remote, with the real 10 s backoff. M-off sets P6_READS=1. M-review reverts the first-round review fixes.

Row	Planted input	Want	On a5e3f09 (same P6 blobs)	M-off	M-review
B1	curl 92 CANCEL twice, then an answer: rc	0	0 (30 s: 10 + 20 backoff)	128, RED	0
B2	the same: reads	3	3	1, RED	3
B3	the same: main fetched	yes	yes	no, RED	yes
B4	curl 56 on every read: rc (step stays red)	128	128	128	128
B5	the same: reads, never a 4th	3	3	1, RED	3
B6	the same: one status line per read that did not answer	3	3	0, RED	3
B7	missing ref (an answer): rc	non-zero	non-zero	non-zero	non-zero
B8	the same: reads, an answer is never re-read	1	1	1	1
B9	401 with no credentials to offer (an answer): rc / reads	128 / 1	128 / 1	128 / 1	128 / 3, RED
B10	resolve_base sourced by a relative path, REPO_ROOT another tree: the stacked entry is deepened	yes	yes	yes	no (refused), RED
B11	the same, and the caller cds elsewhere between sourcing and the call	yes	yes	yes	no (refused), RED
B12	the same, under a CDPATH holding a decoy scripts/lib	yes	yes	yes	no (refused), RED

Two non-author reviews ran on this head. One killed 3 bare-fetch mutants, the other 7 of 7 mutants. Their non-blocking notes, left for later work:

• A fetch split across two lines evades the wiring regex.
• The wiring check covers ci/sections.yml only.
• lowSpeed does not cut a connection that hangs before it connects.

A wiring check for fixture_quiet.sh (never on fat_driver.py run/wait, always on the self-test) is #5063.

🤖 Generated with Claude Code

[noahgift]

Supersedes #5051.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5066 head=66a8c284e0d158c8f946e3a273c9cb4d78c2419a verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.