@@ -800,8 +800,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
-      # The `test` job's step of the same name, verbatim (its comment says why).
+      # The `test` job's step of the same name, verbatim but for its budget
+      # (its comment says why and sizes the budget).
       - name: Fetch this commit's history and the base branch
+        timeout-minutes: 8
         env:
           PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
         run: |
@@ -815,7 +817,7 @@ jobs:
             if [ "$(git rev-parse --is-shallow-repository)" = true ]; then deepen=(--unshallow); fi
             if git fetch --no-tags "${deepen[@]}" origin "$head" "${refspecs[@]}"; then break; fi
             if [ "$attempt" = 3 ]; then
-              echo "::error::Could not fetch $head's history and ${refspecs[*]} after 3 attempts. The package selection reads that history, so this job stops here rather than selecting from a shallow clone."
+              echo "::error::Could not fetch $head's history and ${refspecs[*]} after 3 attempts. This job's history readers need it, so this job stops here rather than reading from a shallow clone."
               exit 1
             fi
             sleep $((attempt * 15))
@@ -1078,7 +1080,29 @@ jobs:
       # commit, not a branch tip. Three attempts, like the checkout's own fetch,
       # then a red step: a selection read from a shallow clone is the silent
       # all-packages answer above, never a fallback this job may take quietly.
+      #
+      # FETCH BUDGET: the one line that differs between the four copies. Each
+      # job gives the fetch what its wall leaves after its measured checkout
+      # and body (the max over 2026-11-08's runs on `main` and the queue),
+      # capped at 20 minutes: `test-plan` 8 (wall 10, body 0:37),
+      # `test-ui` 14 (wall 30, body 15:29), `test` 20 (wall 60, body 24:00),
+      # `type-check-ui` 20 (wall 40, body 14:23). lint.yml's CHECKOUT BUDGET
+      # (25) is the same reading for its full-history checkouts.
+      #   - Healthy, over the 22 runs after this step landed: 277 fetches, all
+      #     green, p50 50 s, p99 72 s, max 85 s.
+      #     The smallest budget, 480 s, still holds max x 5.6 and p99 x 6.5
+      #     (the 2026-11-03 incident's slowdown of the full-ref fetch at the
+      #     median) and three attempts plus the two sleeps (300 s).
+      #   - The 2026-11-03 tail: full-history checkouts of 1063-1799 s
+      #     cancelled 19 Test UI shards at their wall. This step pulls the
+      #     whole ancestry, so its tail is assumed no shorter. 20 minutes holds
+      #     the tail's low end (1063 s), not its top. In `test-ui` neither end
+      #     fits beside the body inside the 30-minute wall, so its budget only
+      #     ends the red sooner and names the step. A red `test-plan` falls
+      #     back to all eight shards, and each fetches for itself.
+      # A fetch that hangs ends red here, named, instead of eating the wall.
       - name: Fetch this commit's history and the base branch
+        timeout-minutes: 20
         env:
           PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
         run: |
@@ -1092,7 +1116,7 @@ jobs:
             if [ "$(git rev-parse --is-shallow-repository)" = true ]; then deepen=(--unshallow); fi
             if git fetch --no-tags "${deepen[@]}" origin "$head" "${refspecs[@]}"; then break; fi
             if [ "$attempt" = 3 ]; then
-              echo "::error::Could not fetch $head's history and ${refspecs[*]} after 3 attempts. The package selection reads that history, so this job stops here rather than selecting from a shallow clone."
+              echo "::error::Could not fetch $head's history and ${refspecs[*]} after 3 attempts. This job's history readers need it, so this job stops here rather than reading from a shallow clone."
               exit 1
             fi
             sleep $((attempt * 15))
@@ -1178,7 +1202,7 @@ jobs:
       #     gives this checkout a `ref:`, where parent^1 becomes the PR's
       #     previous commit. `merge-base` is right under BOTH checkouts.
       #   - Dropping the variable and letting turbo default to `main`. Measured
-      #     in a CI-shaped clone: `fetch-depth: 0` populates
+      #     in a CI-shaped clone: the fetch step above populates
       #     `refs/remotes/origin/*`, NOT local heads, so there is no local `main`
       #     — and turbo does not error, it silently returns the ENTIRE
       #     workspace, untouched packages included. Safe, and the whole
@@ -3803,12 +3827,39 @@ jobs:
       TURBO_RUN_SUMMARY: 'true'
 
     steps:
+      # Depth 1, then the step below: this job reads HEAD's ancestry and the
+      # base branch, and no tag or other head (#22034).
       - name: Checkout repository
         uses: actions/checkout@v7
-        with:
-          # The affected scope below asks turbo for the packages changed since
-          # the base commit, which needs the base's history in the clone.
-          fetch-depth: 0
+
+      # The `test` job's step of the same name, verbatim but for its budget
+      # (its comment says why and sizes the budget). Here the readers are check:lockfile-integrity
+      # (`git merge-base origin/<base> HEAD`), check:i18n-drift (the merge base
+      # with origin/<base> or origin/main), the affected type-check scope
+      # (`turbo --filter=...[BASE]`) and spec's build. On a shallow clone the
+      # lockfile alarm finds no merge base and stays green, and the drift check
+      # exits red.
+      - name: Fetch this commit's history and the base branch
+        timeout-minutes: 20
+        env:
+          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          refspecs=('+refs/heads/main:refs/remotes/origin/main')
+          if [ -n "$PR_BASE_REF" ] && [ "$PR_BASE_REF" != main ]; then
+            refspecs+=("+refs/heads/$PR_BASE_REF:refs/remotes/origin/$PR_BASE_REF")
+          fi
+          head=$(git rev-parse HEAD)
+          for attempt in 1 2 3; do
+            deepen=()
+            if [ "$(git rev-parse --is-shallow-repository)" = true ]; then deepen=(--unshallow); fi
+            if git fetch --no-tags "${deepen[@]}" origin "$head" "${refspecs[@]}"; then break; fi
+            if [ "$attempt" = 3 ]; then
+              echo "::error::Could not fetch $head's history and ${refspecs[*]} after 3 attempts. This job's history readers need it, so this job stops here rather than reading from a shallow clone."
+              exit 1
+            fi
+            sleep $((attempt * 15))
+          done
+          echo "History: $(git rev-list --count HEAD) commit(s) behind HEAD, shallow=$(git rev-parse --is-shallow-repository), no tags, refs: $(git for-each-ref --format='%(refname)' refs/remotes | tr '\n' ' ')"
 
       - name: Setup Node.js
         uses: actions/setup-node@v7
@@ -3865,9 +3916,9 @@ jobs:
       # request's `pnpm-lock.yaml` may not give any package a second physical
       # copy. The script's header has the mechanism and its boundary.
       #
-      # It lives here because this job already checks out with
-      # `fetch-depth: 0`, so `origin/<base>` and the merge base are in the
-      # clone, and because it runs on every change to `pnpm-lock.yaml` (the
+      # It lives here because this job's fetch step already brings HEAD's
+      # ancestry and `origin/<base>`, so the merge base is in the clone, and
+      # because it runs on every change to `pnpm-lock.yaml` (the
       # `ui` filter lists it). Before the install on purpose: the gate reads
       # two text files with Node builtins only, which Lint UI's pre-install
       # import graph check holds. `pull_request` only, because the gate's
@@ -4108,12 +4159,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
-      # The `test` job's step of the same name, verbatim (its comment says why).
+      # The `test` job's step of the same name, verbatim but for its budget
+      # (its comment says why and sizes the budget).
       # Here the readers are the select step below (`git merge-base` against
       # origin/<base ref>, then select-affected-tests.mjs's `git diff
       # base...HEAD`) and spec's build. On a shallow clone the select step
       # would not fail: it would warn and run the full suite.
       - name: Fetch this commit's history and the base branch
+        timeout-minutes: 14
         env:
           PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
         run: |
@@ -4127,7 +4180,7 @@ jobs:
             if [ "$(git rev-parse --is-shallow-repository)" = true ]; then deepen=(--unshallow); fi
             if git fetch --no-tags "${deepen[@]}" origin "$head" "${refspecs[@]}"; then break; fi
             if [ "$attempt" = 3 ]; then
-              echo "::error::Could not fetch $head's history and ${refspecs[*]} after 3 attempts. The package selection reads that history, so this job stops here rather than selecting from a shallow clone."
+              echo "::error::Could not fetch $head's history and ${refspecs[*]} after 3 attempts. This job's history readers need it, so this job stops here rather than reading from a shallow clone."
               exit 1
             fi
             sleep $((attempt * 15))
 
@@ -1170,13 +1170,17 @@ describe('the gate is wired to run', () => {
     expect(step, 'the check runs before dependencies are installed').toBeGreaterThan(install);
   });
 
-  it('gives that job a full-history checkout, or the merge base does not exist', () => {
-    // actions/checkout defaults to depth 1. Without this the gate cannot resolve
-    // a base — and by design that is a red build, not a silent pass, so losing
-    // this line breaks CI loudly. The pin is here so the reason survives.
+  it("fetches HEAD's history and the base branch before it runs, or the merge base does not exist", () => {
+    // actions/checkout defaults to depth 1, and the job keeps that default: the
+    // fetch step after it brings HEAD's ancestry and origin/<base> (objectstack#22034).
+    // Without it the gate cannot resolve a base — and by design that is a red
+    // build, not a silent pass, so losing the step breaks CI loudly. The pin is
+    // here so the reason survives.
+    const fetch = job.indexOf("- name: Fetch this commit's history and the base branch");
     const step = job.indexOf(`run: ${uiRun('check:i18n-drift')}`);
     expect(step, '`type-check-ui` does not run `pnpm --dir ui run check:i18n-drift`').toBeGreaterThan(-1);
-    expect(job.slice(0, step)).toContain('fetch-depth: 0');
+    expect(fetch, '`type-check-ui` has no step fetching HEAD\'s history and the base branch').toBeGreaterThan(-1);
+    expect(fetch, 'the history is fetched after the check runs').toBeLessThan(step);
   });
 
   it('is not hidden from the locale packs by ci.yml path filters', () => {
 
@@ -218,14 +218,17 @@ describe('the gate is wired into the root CI (objectstack#26717)', () => {
     expect(step()).toContain("if: github.event_name == 'pull_request'");
   });
 
-  it('checks out deep enough to have a merge base', () => {
-    // A shallow clone has no merge base, and the script exits 2 rather than
-    // guess one: a reading that never measured the change.
+  it('fetches deep enough to have a merge base', () => {
+    // A shallow clone has no merge base, and the script refuses rather than
+    // guess one: a reading that never measured the change. The checkout stays
+    // at depth 1; the fetch step after it brings HEAD's ancestry and
+    // origin/<base> (objectstack#22034).
     const block = withoutComments(jobBlock(rootCi(), JOB));
     const checkout = block.indexOf('uses: actions/checkout@');
+    const fetch = block.indexOf("- name: Fetch this commit's history and the base branch");
     expect(checkout).toBeGreaterThan(-1);
-    expect(block.indexOf('fetch-depth: 0', checkout)).toBeGreaterThan(checkout);
-    expect(block.indexOf('fetch-depth: 0', checkout)).toBeLessThan(block.indexOf(`- name: ${STEP_NAME}`));
+    expect(fetch).toBeGreaterThan(checkout);
+    expect(fetch).toBeLessThan(block.indexOf(`- name: ${STEP_NAME}`));
   });
 
   it('⛔ stays an alarm in a required job: continue-on-error, before the install', () => {
 
@@ -26,6 +26,8 @@ import {
   trackedFiles,
 } from '../select-affected-tests.mjs';
 import { shardTotal } from '../../../scripts/ci-shard-matrix.mjs';
+import { parse as parseYaml } from 'yaml';
+
 import { jobBlock, rootCi, triggerBlock, UI_JOBS, uiRun, withoutComments } from './helpers/root-ci';
 
 /**
@@ -727,3 +729,53 @@ describe("the root ci.yml's Test UI job wires the selector fail-open (objectui#1
     expect(run).toContain(`pnpm --dir ui exec vitest run --shard=\${{ matrix.shard }}/${shards} --reporter=default --reporter=github-actions "\${filters[@]}"`);
   });
 });
+
+// objectstack#22034: the four root ci.yml jobs that read git history check out
+// at depth 1 and fetch only HEAD's ancestry and the base branch, in one step
+// that is the same in all four. `fetch-depth: 0` fetched every head and every
+// tag; a checkout that grows it back passes every other gate and silently
+// undoes the measurement the fetch step's budget was sized from.
+describe("the root ci.yml's history readers check out at depth 1, then fetch (objectstack#22034)", () => {
+  type Step = { name?: string; uses?: string; with?: Record<string, unknown>; 'timeout-minutes'?: number; run?: string; env?: Record<string, string> };
+  const jobs = (parseYaml(rootCi()) as { jobs: Record<string, { 'timeout-minutes'?: number; steps: Step[] }> }).jobs;
+  const FETCH = "Fetch this commit's history and the base branch";
+  // Each job's first step that reads history: the fetch must come before it.
+  const FIRST_READER: Record<string, string> = {
+    'test-plan': "Plan this run's Test Core shards",
+    test: "Compute this shard's package set",
+    [UI_JOBS.test]: 'Select the tests this change affects',
+    [UI_JOBS.typeCheck]: 'check:lockfile-integrity — compare this pull request\'s lockfile with its merge base',
+  };
+
+  for (const [job, reader] of Object.entries(FIRST_READER)) {
+    it(`${job}: depth-1 checkout, the fetch step next, then the first reader`, () => {
+      const steps = jobs[job]?.steps ?? [];
+      expect(steps.length, `ci.yml has no job ${job}`).toBeGreaterThan(0);
+      const checkout = steps.findIndex((s) => s.uses?.startsWith('actions/checkout@'));
+      expect(checkout, `${job} has no actions/checkout step`).toBeGreaterThan(-1);
+      expect(steps[checkout].with?.['fetch-depth'], `${job}'s checkout sets fetch-depth`).toBeUndefined();
+      expect(steps[checkout + 1]?.name, `${job}: the step after the checkout is not the fetch`).toBe(FETCH);
+      const first = steps.findIndex((s) => s.name === reader);
+      expect(first, `${job} has no step named ${reader}`).toBeGreaterThan(checkout + 1);
+      // Each job sizes its own budget inside its wall (the `test` job's FETCH
+      // BUDGET comment): never under the healthy floor, never the whole wall.
+      const budget = steps[checkout + 1]['timeout-minutes'];
+      const wall = jobs[job]['timeout-minutes'];
+      expect(typeof budget, `${job}'s fetch step has no timeout-minutes`).toBe('number');
+      expect(budget).toBeGreaterThanOrEqual(8);
+      expect(typeof wall, `${job} has no job wall`).toBe('number');
+      expect(budget!).toBeLessThan(wall!);
+    });
+  }
+
+  it('the fetch step is one step, the same in all four jobs but for its budget', () => {
+    const copies = Object.keys(FIRST_READER).map((job) => {
+      const copy: Step = { ...jobs[job].steps.find((s) => s.name === FETCH) };
+      delete copy['timeout-minutes'];
+      return copy;
+    });
+    expect(copies[0]).toHaveProperty('run');
+    for (const copy of copies) expect(copy).toEqual(copies[0]);
+    expect(copies[0]?.run).toContain('git fetch --no-tags "${deepen[@]}" origin "$head" "${refspecs[@]}"');
+  });
+});
@@ -839,7 +839,7 @@ if (invokedDirectly) {
             '  answer it confidently. Name a commit that exists in this clone, or pass none and\n' +
             '  let the merge base with the target branch be found.\n'
           : base.shallow
-            ? '  This clone is SHALLOW. In CI, give the checkout `fetch-depth: 0`; locally,\n' +
+            ? '  This clone is SHALLOW. In CI, fetch HEAD\'s history and the base branch after the checkout; locally,\n' +
               '  run `git fetch --no-tags origin main` (or `git fetch --unshallow`).\n'
             : '  Fetch the base branch (`git fetch --no-tags origin main`) and re-run.\n') +
         '  This is a failure, not a skip: a diff gate with no diff would pass while\n' +