[ShixiangWang]

What this fixes

Run 42367209708's cran-shape-check (windows-latest, release) leg (job 128387751863) closed with

[ FAIL 10 | WARN 7 | SKIP 28 | PASS 8127 ]

and that ten-failure set is exactly three defects. Each is repaired here.

(i) R_ENIRON is not a variable — the isolation set neutralized nothing

tests/testthat/test-catalog-currency.R (the F2 fallback unit) and tools/ci/run-covr-extras.R both spelled the neutralizer R_ENIRON, a typo for R_ENVIRON. No variable was suppressed at all, so a runner-injected Renviron handed the spawned child the real library set, digest came along, the probe answered TRUE, and the byte-identity fallback never executed.

An empty-string R_LIBS_SITE cannot evict a Renviron file's R_LIBS_SITE either — a file setting beats the shell's empty string — so the pickup has to be suppressed by name. The set now carries R_ENVIRON and R_ENVIRON_USER, and the F2 spawn rides --vanilla.

Both directions of the unit stay live: digest leaking into the farm reddens the probe assertion; a broken fallback reddens the byte comparison.

(ii) .github reads under R CMD check — six blind test_path("../..") reads

tests/testthat/test-ci-shard-map.R read .github/workflows/*.yml through testthat::test_path("../.."). .Rbuildignore:16 is ^\.github$, so the tarball ships no .github, the parent of the check directory has no workflows/, and every one of those reads died on cannot open the connection.

Reads now route through a new .ci_repo_file / .ci_workflow pair built on .ms_src, which skips on an explicit repository-ness gate when neither a checkout nor an installed copy is locatable — never reading blind, per test-docs-sync.R doctrine. The skip text ends in the sanctioned (R CMD check context) marker.

Every .github read in the file is now routed, including the covr-ledger unit at :473, whose argument is file.path("..", "..", ".github", "workflows", "scheduled.yml") — reached from tools/ci/, so the ../../ self-cancels back to the repo root. That unit also sits behind .ci_require_checkout(), so it is only reachable in a checkout context.

(iii) cran-shape-check ran the full test phase on a depth-1 clone

The CRAN-shape monolith runs the full test phase (the PR fanout runs --no-tests), so test-kernel-bit-identity.R's era-gate law resolves PROVENANCE.tsv's banked commit 9c36a77b4d953581680a71d647d81ca54fce6410 with git cat-file -t <sha>^{commit} right there. The default depth-1 checkout makes that ancestor unreachable → rc 128, "Not a valid object name".

No exemption is owed: history is the fix. The job's checkout now takes fetch-depth: 0. test-ci-shard-map.R additionally asserts the law from the job window so a future depth-1 regression reddens locally first.

Local gate evidence (this tree, direct command output)

Gate	Result
test-ci-shard-map.R	pass=212 fail=0 error=0 skip=0 warn=0
test-catalog-currency.R	pass=289 fail=0 error=0 skip=1 warn=0 (sanctioned: no system SHA-256 tool)
test-kernel-bit-identity.R	pass=504 fail=0 error=0 skip=0 warn=0
tools/check-layout-sim.R	SIM-VERDICT: PASS files=92 FAIL=0 SKIP=167 UNAUTHORIZED_SKIP=0 PASS=4569 WARN=1

UNAUTHORIZED_SKIP=0 with the new .ci_repo_file skip present in the run is the load-bearing proof that the added skip is lawful rather than a vacuous green.

Defect → failure mapping

Windows failure	Defect
6 × test-ci-shard-map.R cannot open the connection	(ii)
2 × test-kernel-bit-identity.R rc 128 era-commit	(iii)
2 × test-catalog-currency.R probe=TRUE leak	(i)

Known collateral (stated, not hidden)

The covr-ledger unit at :473 now skips wholesale when no checkout is locatable. Under R CMD check that loses only its in-check coverage of the tools/ci/run-covr-extras.R prefix assertions — those still run in every checkout context, including the covr lane itself.

Test plan

• cran-shape-check (windows-latest, release) green on the next scheduled run
• cran-shape-check (ubuntu-latest, release) completes inside its 90-minute budget (it has been cancelled in every modern run)
• site job green (Rscript path already repaired by fix(ci): locate Rscript under R.home("bin") in the scheduled site legs #88)
• pkgdown site uploads and https://wanglabcsu.github.io/msuiter/ serves

Closes #74. Closes #76.