Nothing here exercises the paths a FRESH consumer takes

[sotashimozono]

Three defects in one day shared a cause: this repository is not a consumer of itself in the ways that matter.

defect	why CI missed it
actions/upload-coverage failed to load — an expression in an input's description	nothing invoked the action
a secret did not reach the reusable	dogfooded through a local ./ reference, never cross-repository
errexit killed the absent-ci-timings path (#54)	this repo HAS a ci-timings branch, so ls-remote returns 0 and the failing branch is unreachable

The third is the sharpest: the code handling "no timing history yet" could not be reached by having no timing history, and it shipped. It surfaced on the first adopter that happened to be fresh — and every repository that has never been sharded is fresh, so the next sixteen adopters would all have hit it.

What would have caught them

action-smoke already covers the first, added when it bit. The other two need the same treatment: a job that takes the path a new consumer takes.

Concretely for the third: extract the history read into a script the workflow calls, so a CI job can run that script — not a copy of it — against a deliberately absent branch under bash -e and assert it survives. A copied snippet would not catch a reintroduced out=$(...); rc=$?, which is the actual regression to prevent.

The general shape: for each state a consumer can be in that this repository is never in — no timing history, no Codecov token, a private caller, a first run — there should be a job that is in it.

Not urgent, but not optional

Each of the three cost a red run in someone else's repository and a bisect from the wrong end. The fix for each was one line; finding it was not.

[sotashimozono]

Design, before writing any of it

Measured on main today: sharded-tests.yml is 858 lines, of which 268 are bash across
15 run: blocks. Not one of those lines is reachable by anything in this repository. That is
the whole issue restated as a number.

The shape

For each state a consumer can be in that this repository never is, a job that is in it.
Two prerequisites, in order.

1. Extract the decision-bearing bash into .github/scripts/*.sh, and have the workflow call
them. This is the issue's own requirement and it is not stylistic: the regression to prevent
is a reintroduced out=$(...); rc=$?, where errexit kills the step before rc is read. A test
that copies the snippet cannot catch that — only running the script the workflow runs can.

2. Synthesise the states in the job. A git init --bare scratch remote is enough for every
history state: no network, no second repository, nothing outside this repo.

The states

Ranked by evidence. The first two have each already cost a red run somewhere else.

state	script	what the job asserts
no ci-timings branch	read-history.sh	exit 0, says "no history", emits an empty timings.tsv. This is #54, and it shipped precisely because this repository always has the branch
ls-remote fails, as opposed to finding nothing	read-history.sh	exits non-zero. Not distinguishing the two is what put one shard of eight on a different assignment function — two units run twice, two run nowhere, every shard green
first ever recording, nothing to replace	record-timings.sh	creates the orphan branch instead of failing to replace it
an overlay registry already present	add-registries.sh	not an error — re-adding one is an error, so "add only if absent" is the behaviour under test
an overlay registry absent	add-registries.sh	added, then refreshed

What the extraction pays for

The registry block is 38 lines duplicated across prebuild and test. Extracting it makes
the two one, so this work is also the readability pass the 817-line workflow has been waiting
for — the same edit, not a competing one.

The boundary this cannot cross

"A private caller reaching into another organisation loses the secret" is not reproducible
from inside this repository, and no amount of scripting changes that. It is the one state that
genuinely needs a second repository. Worth saying out loud so the job list does not quietly
imply it is covered.

Order

Extract → the two ci-timings states (the ones with evidence) → the registry states. Landing
the evidence-backed half first keeps each PR reviewable, and the first one already closes the
path that #54 escaped through.