@@ -645,12 +645,33 @@ jobs:
       shards: ${{ steps.plan.outputs.shards }}
       digest: ${{ steps.plan.outputs.digest }}
     steps:
+      # Depth 1, then the step below: the same history the shards fetch, because
+      # the selection diffs against the PR's merge base, the queue's base_sha or
+      # the push's before sha, and every shard re-derives this plan (#22034).
       - name: Checkout repository
         uses: actions/checkout@v7
-        with:
-          # The same history the shards check out: the selection diffs against
-          # the PR's merge base, the queue's base_sha or the push's before sha.
-          fetch-depth: 0
+
+      # The `test` job's step of the same name, verbatim (its comment says why).
+      - name: Fetch this commit's history and the base branch
+        env:
+          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          refspecs=('+refs/heads/main:refs/remotes/origin/main')
+          if [ -n "$PR_BASE_REF" ] && [ "$PR_BASE_REF" != main ]; then
+            refspecs+=("+refs/heads/$PR_BASE_REF:refs/remotes/origin/$PR_BASE_REF")
+          fi
+          head=$(git rev-parse HEAD)
+          for attempt in 1 2 3; do
+            deepen=()
+            if [ "$(git rev-parse --is-shallow-repository)" = true ]; then deepen=(--unshallow); fi
+            if git fetch --no-tags "${deepen[@]}" origin "$head" "${refspecs[@]}"; then break; fi
+            if [ "$attempt" = 3 ]; then
+              echo "::error::Could not fetch $head's history and ${refspecs[*]} after 3 attempts. The package selection reads that history, so this job stops here rather than selecting from a shallow clone."
+              exit 1
+            fi
+            sleep $((attempt * 15))
+          done
+          echo "History: $(git rev-list --count HEAD) commit(s) behind HEAD, shallow=$(git rev-parse --is-shallow-repository), no tags, refs: $(git for-each-ref --format='%(refname)' refs/remotes | tr '\n' ' ')"
 
       # Restore only: the `test` shards save this key.
       - name: Setup workspace
@@ -875,11 +896,59 @@ jobs:
         shard: ${{ fromJSON(needs.test-plan.outputs.shards || '[1, 2, 3, 4, 5, 6, 7, 8]') }}
 
     steps:
+      # Depth 1 (the default), then the step below fetches the history this job
+      # reads. NOT `fetch-depth: 0` (#22034).
       - name: Checkout repository
         uses: actions/checkout@v7
-        with:
-          # Full history so `turbo --affected` can diff against the PR base.
-          fetch-depth: 0
+
+      # ⭐ THIS COMMIT'S HISTORY AND THE BASE BRANCH, NOT EVERY REF (#22034).
+      # `fetch-depth: 0` fetched every head and every tag (`+refs/heads/*` and
+      # `+refs/tags/*`: about 1.5k heads and 17k tags). That ref set, not the
+      # depth of main, was the slow part: 473 s locally against 29-32 s for main
+      # alone, a measured p99 of 553 s on CI, and a 2026-11-03 slowdown that hit
+      # it 5.6-6.5x against about 3x for shallow fetches, cancelling 19 Test UI
+      # shards at their wall before a test ran.
+      #
+      # What this job reads, and why each is here:
+      #   - HEAD's whole ancestry. The PR's merge base, the queue's `base_sha`
+      #     and the push's `before` sha are all in it, and `git merge-base`,
+      #     `git diff` and `turbo ls --affected` need the path from HEAD to
+      #     them. Without it turbo does not fail: measured on turbo 2.11.10 in
+      #     a depth-1 clone with the base fetched, it printed "unable to detect
+      #     git range, assuming all files have changed" and selected all 131
+      #     packages. select-shard-packages.sh now deepens or fails on a shallow
+      #     clone itself; this step is the normal path.
+      #   - refs/remotes/origin/main, with history: the PR selection's
+      #     merge-base, and spec's build (scripts/build-schemas.ts), which
+      #     anchors its authorable-surface checks on `merge-base HEAD
+      #     origin/main` when that answers and falls back to the committed
+      #     anchor when it does not. A PR into another branch fetches that
+      #     branch too.
+      #   - No tags. The one tag spec's build reads it fetches itself at depth 1.
+      # `--unshallow` with HEAD's sha as the want deepens the checked-out
+      # commit, not a branch tip. Three attempts, like the checkout's own fetch,
+      # then a red step: a selection read from a shallow clone is the silent
+      # all-packages answer above, never a fallback this job may take quietly.
+      - name: Fetch this commit's history and the base branch
+        env:
+          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          refspecs=('+refs/heads/main:refs/remotes/origin/main')
+          if [ -n "$PR_BASE_REF" ] && [ "$PR_BASE_REF" != main ]; then
+            refspecs+=("+refs/heads/$PR_BASE_REF:refs/remotes/origin/$PR_BASE_REF")
+          fi
+          head=$(git rev-parse HEAD)
+          for attempt in 1 2 3; do
+            deepen=()
+            if [ "$(git rev-parse --is-shallow-repository)" = true ]; then deepen=(--unshallow); fi
+            if git fetch --no-tags "${deepen[@]}" origin "$head" "${refspecs[@]}"; then break; fi
+            if [ "$attempt" = 3 ]; then
+              echo "::error::Could not fetch $head's history and ${refspecs[*]} after 3 attempts. The package selection reads that history, so this job stops here rather than selecting from a shallow clone."
+              exit 1
+            fi
+            sleep $((attempt * 15))
+          done
+          echo "History: $(git rev-list --count HEAD) commit(s) behind HEAD, shallow=$(git rev-parse --is-shallow-repository), no tags, refs: $(git for-each-ref --format='%(refname)' refs/remotes | tr '\n' ' ')"
 
       - name: Setup workspace
         uses: ./.github/actions/setup-workspace
@@ -3817,12 +3886,38 @@ jobs:
         shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]
 
     steps:
+      # Depth 1, then the step below: the select step diffs against the base
+      # commit, which needs HEAD's ancestry and the base branch in the clone,
+      # and nothing else (#22034).
       - name: Checkout repository
         uses: actions/checkout@v7
-        with:
-          # The select step below diffs against the base commit, which needs
-          # the base's history in the clone.
-          fetch-depth: 0
+
+      # The `test` job's step of the same name, verbatim (its comment says why).
+      # Here the readers are the select step below (`git merge-base` against
+      # origin/<base ref>, then select-affected-tests.mjs's `git diff
+      # base...HEAD`) and spec's build. On a shallow clone the select step
+      # would not fail: it would warn and run the full suite.
+      - name: Fetch this commit's history and the base branch
+        env:
+          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          refspecs=('+refs/heads/main:refs/remotes/origin/main')
+          if [ -n "$PR_BASE_REF" ] && [ "$PR_BASE_REF" != main ]; then
+            refspecs+=("+refs/heads/$PR_BASE_REF:refs/remotes/origin/$PR_BASE_REF")
+          fi
+          head=$(git rev-parse HEAD)
+          for attempt in 1 2 3; do
+            deepen=()
+            if [ "$(git rev-parse --is-shallow-repository)" = true ]; then deepen=(--unshallow); fi
+            if git fetch --no-tags "${deepen[@]}" origin "$head" "${refspecs[@]}"; then break; fi
+            if [ "$attempt" = 3 ]; then
+              echo "::error::Could not fetch $head's history and ${refspecs[*]} after 3 attempts. The package selection reads that history, so this job stops here rather than selecting from a shallow clone."
+              exit 1
+            fi
+            sleep $((attempt * 15))
+          done
+          echo "History: $(git rev-list --count HEAD) commit(s) behind HEAD, shallow=$(git rev-parse --is-shallow-repository), no tags, refs: $(git for-each-ref --format='%(refname)' refs/remotes | tr '\n' ' ')"
+
 
       - name: Setup Node.js
         uses: actions/setup-node@v7
 
@@ -12,7 +12,7 @@
 # #10057 guard on a merge group is the one that matters most: an empty
 # docs-only group has to select nothing without complaint).
 #
-# Hermetic and offline: a throwaway upstream + clone (+ a shallow clone) under
+# Hermetic and offline: a throwaway upstream + clone (+ shallow clones) under
 # $TMPDIR, a fake `pnpm`/`turbo` pair on PATH that answers from control files
 # and records every call, and a stub `check-cross-package-test-inputs.mjs`
 # inside the fixture that records its argv and appends what it is told to.
@@ -172,6 +172,13 @@ git_q clone -q --depth 1 "file://$UP" "$SHALLOW" 2>/dev/null
 # removed from the script entirely.
 SHALLOW_PUSH="$FIX/shallow-push"
 git_q clone -q --depth 1 "file://$UP" "$SHALLOW_PUSH" 2>/dev/null
+# Two more, for the #22034 guard: one whose deepen cannot reach its remote (the
+# refusal), and one a full-battery event runs in (no deepen at all).
+SHALLOW_OFFLINE="$FIX/shallow-offline"
+git_q clone -q --depth 1 "file://$UP" "$SHALLOW_OFFLINE" 2>/dev/null
+git_q -C "$SHALLOW_OFFLINE" remote set-url origin "file://$FIX/no-such-upstream"
+SHALLOW_SCHEDULE="$FIX/shallow-schedule"
+git_q clone -q --depth 1 "file://$UP" "$SHALLOW_SCHEDULE" 2>/dev/null
 
 ZEROS=0000000000000000000000000000000000000000
 # Well-formed, and in no fixture repository: the "resolvable shape, absent
@@ -262,7 +269,14 @@ expect_line() {
 expect_no_line() {
   if grep -qF -- "$1" "$RT/out.txt"; then bad "does not print: $1"; else ok "does not print: $1"; fi
 }
+# expect_shallow <true|false> <clone>  -- what `--is-shallow-repository` says after the run
+expect_shallow() {
+  local got
+  got=$(git_q -C "$2" rev-parse --is-shallow-repository)
+  if [ "$got" = "$1" ]; then ok "the clone is shallow=$1 after the run"; else bad "the clone is shallow=$1 after the run" "got: $got"; fi
+}
 
+DEEPEN_LINE="This checkout is shallow: fetching HEAD's history (no tags) before choosing a diff base (#22034)."
 W_UNION='::warning::Could not union cross-package scans into the affected set; falling back to the full package list for this shard.'
 affected_call() { echo "affected argv=[ls --affected --output=json] TURBO_SCM_BASE=$1"; }
 full_call='full argv=[ls --output=json] TURBO_SCM_BASE=unset'
@@ -349,14 +363,26 @@ if git_q -C "$SHALLOW_PUSH" cat-file -e "$C0^{commit}" 2>/dev/null; then
 else
   ok 'precondition: the push shallow clone lacks C0 before the fetch case'
 fi
-run_case 'push: a before sha absent from a shallow checkout is fetched BY SHA' "$SHALLOW_PUSH" push '' '' '' "$C0"
+# #22034: the deepen of HEAD now brings the before sha in (it is HEAD's
+# parent here), so the by-sha fetch below it finds the object present. What is
+# pinned is that the run deepened, and that turbo diffed from a base the path
+# from HEAD reaches: a by-sha fetch alone left C1 grafted, and the real turbo
+# then answers "all files changed".
+run_case 'push: a shallow checkout is deepened, then diffed from the before sha (#22034)' "$SHALLOW_PUSH" push '' '' '' "$C0"
 expect_rc 0
 expect_warnings '' ''
+expect_line "$DEEPEN_LINE"
+expect_shallow false "$SHALLOW_PUSH"
 if git_q -C "$SHALLOW_PUSH" cat-file -e "$C0^{commit}" 2>/dev/null; then
   ok 'C0 is present after the run (the fetch happened)'
 else
   bad 'C0 is present after the run (the fetch happened)'
 fi
+if git_q -C "$SHALLOW_PUSH" merge-base "$C0" HEAD > /dev/null 2>&1; then
+  ok 'merge-base(C0, HEAD) answers after the run (HEAD is no longer grafted)'
+else
+  bad 'merge-base(C0, HEAD) answers after the run (HEAD is no longer grafted)'
+fi
 expect_turbo 'affected only, base = before sha' "$(affected_call "$C0")"
 expect_packages '1:a'
 
@@ -538,9 +564,11 @@ if git_q -C "$SHALLOW" cat-file -e "$C0^{commit}" 2>/dev/null; then
 else
   ok 'precondition: the shallow clone lacks C0 before the fetch case'
 fi
-run_case 'merge_group: a base_sha absent from a shallow checkout is fetched BY SHA' "$SHALLOW" merge_group '' '' "$C0"
+run_case 'merge_group: a shallow checkout is deepened, then diffed from the base_sha (#22034)' "$SHALLOW" merge_group '' '' "$C0"
 expect_rc 0
 expect_warnings '' ''
+expect_line "$DEEPEN_LINE"
+expect_shallow false "$SHALLOW"
 if git_q -C "$SHALLOW" cat-file -e "$C0^{commit}" 2>/dev/null; then
   ok 'C0 is present after the run (the fetch happened)'
 else
@@ -586,14 +614,48 @@ expect_packages '1:a'
 expect_line "Affected-set diff base: $C1  (the merge group's base_sha)"
 expect_no_line "this push's before sha"
 
+# ── a shallow checkout (#22034) ─────────────────────────────────────────────
+# The jobs check out at depth 1 and fetch HEAD's history in their own step; the
+# script's deepen is the guard for a caller without that step. A deepen that
+# cannot reach the remote is a red step that never reaches `turbo`, on every
+# diffing event: on a shallow clone the full-list fallback would be turbo's
+# own silent "all files changed", read as a decision.
+for ev in pull_request merge_group push; do
+  reset_controls
+  case "$ev" in
+    pull_request) run_case "$ev: a shallow checkout whose deepen fails refuses, red, before turbo" "$SHALLOW_OFFLINE" "$ev" main "$C0" '' ;;
+    merge_group) run_case "$ev: a shallow checkout whose deepen fails refuses, red, before turbo" "$SHALLOW_OFFLINE" "$ev" '' '' "$C0" ;;
+    push) run_case "$ev: a shallow checkout whose deepen fails refuses, red, before turbo" "$SHALLOW_OFFLINE" "$ev" '' '' '' "$C0" ;;
+  esac
+  expect_rc 1
+  expect_line "$DEEPEN_LINE"
+  expect_line '::error::This checkout is shallow and HEAD'"'"'s history could not be fetched'
+  expect_warnings '' ''
+  expect_turbo 'never called' ''
+  expect_union 'not invoked' ''
+  if [ -e "$RT/turbo-ls.json" ]; then bad 'no turbo-ls.json is written'; else ok 'no turbo-ls.json is written'; fi
+  expect_shallow true "$SHALLOW_OFFLINE"
+done
+
+# The full battery reads no history, so a shallow checkout is left as it is.
+reset_controls
+run_case 'schedule: a shallow checkout is not deepened -- the FULL list reads no history' "$SHALLOW_SCHEDULE" schedule '' '' '' ''
+expect_rc 0
+expect_warnings '' ''
+expect_no_line "$DEEPEN_LINE"
+expect_shallow true "$SHALLOW_SCHEDULE"
+expect_turbo 'full only' "$full_call"
+expect_packages '3:a,b,c'
+
 # ── Verdict ─────────────────────────────────────────────────────────────────
 # #4690: a battery that ran nothing is a failure, never a pass.
 # The floor RATCHETS: it was 20/80 when this battery covered three events, and
 # it is raised here to what push's own diff base and the two full-battery
 # events actually register (#16467). It is a floor, never a target -- a run
 # below it means cases stopped running, and the remedy is to find which,
-# never to lower the number.
-if [ "$cases" -lt 32 ] || [ "$checks" -lt 158 ]; then
+# never to lower the number. Raised again for the shallow-checkout guard
+# (#22034): 32/158 -> 36/193.
+if [ "$cases" -lt 36 ] || [ "$checks" -lt 193 ]; then
   echo "SELFTEST FAILED: only $cases case(s) / $checks check(s) ran -- the battery is short"
   exit 1
 fi
 
@@ -13,9 +13,10 @@
 # Environment in, `$RUNNER_TEMP/turbo-ls.json` out (a `turbo ls --output=json`
 # payload, ready for partition-test-shards.mjs), `::warning::` lines out for
 # every fallback. Exit 0 on every decided outcome -- a fallback to the full
-# list is a decision, not a failure; exit 2 on a usage error; and a failing
-# `turbo ls` exits with turbo's own status, exactly as it did under `bash -e`
-# when this text lived inline in ci.yml (see below).
+# list is a decision, not a failure; exit 2 on a usage error; exit 1 when the
+# checkout is shallow and HEAD's history cannot be fetched (#22034, below); and
+# a failing `turbo ls` exits with turbo's own status, exactly as it did under
+# `bash -e` when this text lived inline in ci.yml (see below).
 #
 # ## What decides the set, per event (#16453)
 #
@@ -99,13 +100,40 @@ PUSH_BEFORE_SHA="${OS_SHARD_PUSH_BEFORE_SHA:-}"
 # zeroes, and this value decides whether a run tests the workspace or a diff.
 ZERO_SHA='0000000000000000000000000000000000000000'
 
+# ── A SHALLOW CHECKOUT IS DEEPENED FIRST, OR THE STEP FAILS (#22034) ───────
+# The jobs that run this script check out at depth 1 and fetch HEAD's history
+# and the base branch in their own step ("Fetch this commit's history and the
+# base branch" in ci.yml), instead of `fetch-depth: 0`'s every head and tag.
+# This is the guard for the day that step is missing. On a shallow clone the
+# readers below do not fail, they answer wrong: with the base present but the
+# path from HEAD to it cut by the graft, `turbo ls --affected` printed "unable
+# to detect git range, assuming all files have changed" and selected every
+# package, exit 0 (measured on turbo 2.11.10, a depth-1 merge ref, 131
+# packages), and the pull_request merge-base takes the full-list fallback.
+#
+# So every event that diffs deepens HEAD here, by its sha, without tags. A
+# deepen that fails exits 1 with an `::error::`, not the full-list fallback:
+# on a shallow clone that fallback would be the same wrong answer, read as a
+# decision. The full-battery events read no history and are left alone.
+case "$EVENT_NAME" in
+  pull_request | merge_group | push)
+    if [ "$(git rev-parse --is-shallow-repository)" = true ]; then
+      echo "This checkout is shallow: fetching HEAD's history (no tags) before choosing a diff base (#22034)."
+      if ! git fetch --no-tags --quiet --unshallow origin "$(git rev-parse HEAD)"; then
+        echo "::error::This checkout is shallow and HEAD's history could not be fetched, so no diff base can be trusted here: on a shallow clone \`turbo ls --affected\` selects every package without failing. Refusing to select (#22034)."
+        exit 1
+      fi
+    fi
+    ;;
+esac
+
 SCM_BASE=''
 if [ "$EVENT_NAME" = "pull_request" ]; then
   if [ -z "$BASE_REF" ]; then
     echo "::warning::This pull_request event carries no base branch, so the affected-set diff base cannot be computed."
   else
-    # `fetch-depth: 0` above already makes this resolve — the fetch is
-    # the guard for the day that changes, not the normal path.
+    # The job's own fetch step already makes this resolve (#22034) — the
+    # fetch is the guard for the day that changes, not the normal path.
     #
     # `git cat-file -e` rather than the more idiomatic strict
     # `git rev-parse --verify` spelling. That is history rather than
@@ -151,8 +179,9 @@ if [ "$EVENT_NAME" = "merge_group" ]; then
   if [ -z "$MERGE_GROUP_BASE_SHA" ]; then
     echo "::warning::This merge_group event carries no base_sha, so the affected-set diff base cannot be computed."
   else
-    # The checkout's `fetch-depth: 0` already makes this resolve -- the fetch
-    # is the guard for the day that changes, exactly as it is above. Fetched
+    # HEAD's history (the job's fetch step, or the deepen above) already
+    # holds it -- the fetch is the guard for the day that changes, exactly as
+    # it is above. Fetched
     # by sha, not by ref: a merge group's base is a commit, and the queue
     # branch it sits on is transient.
     if ! git cat-file -e "$MERGE_GROUP_BASE_SHA^{commit}" 2>/dev/null; then
@@ -184,7 +213,7 @@ if [ "$EVENT_NAME" = "push" ]; then
   elif [ "$PUSH_BEFORE_SHA" = "$ZERO_SHA" ]; then
     echo "::warning::This push event's before sha is all zeroes -- the branch's first push, or a force-push that rewrote history -- so there is no previous commit to diff from."
   else
-    # `fetch-depth: 0` already makes this resolve; the fetch is the guard for
+    # HEAD's history already holds it (#22034); the fetch is the guard for
     # the day that changes. By sha, as on merge_group: after a force-push the
     # previous tip may be unreachable from any ref.
     if ! git cat-file -e "$PUSH_BEFORE_SHA^{commit}" 2>/dev/null; then