@@ -111,9 +111,25 @@ jobs:
           echo "$PROMPT" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
 
-      - name: Verify jq is available
+      # Both preconditions for the context step, checked here because this step has no
+      # continue-on-error and that step does. A missing script is otherwise the quietest failure
+      # this workflow has: exit 127 swallowed into a green run, an empty context, and -- before
+      # the review step was gated on the context outcome -- a review that read an absent history
+      # as a clean first cycle. The prompt document has always had this protection, because
+      # `cat` on a missing file fails the job; the script needs it spelled out.
+      #
+      # It guards a future break of the sparse-checkout, not a present one: a renamed path, a
+      # pattern that stops matching in non-cone mode, a file moved without updating the checkout.
+      - name: Verify the context step's preconditions
         if: github.event.pull_request.user.login != 'dependabot[bot]'
-        run: jq --version
+        run: |
+          jq --version
+          script=.github-workflows/scripts/gather-review-context.sh
+          if [ ! -f "$script" ]; then
+            echo "$script is missing from the cross-repo checkout." >&2
+            echo "Check the sparse-checkout patterns against the paths in hotdata-dev/github-workflows@main." >&2
+            exit 1
+          fi
 
       # Frontloads what a week of tool-usage artifacts showed the reviewer fetching for
       # itself, one denied command at a time. Over 109 runs it averaged 19.5 Bash calls and
 
@@ -23,7 +23,13 @@
 # assume it.
 set -eo pipefail
 
-: "${PR_NUMBER:?the calling step must set PR_NUMBER}"
+# `?` and not `:?` for PR_NUMBER, so unset is an error but empty is not. tests.yml calls the
+# workflow on `push: branches: [main]` too, where there is no pull request and the number is
+# legitimately empty; the reads below then degrade into their guarded "could not read" sentences,
+# which is what the inline version did and what keeps the main-push smoke run exercising the
+# script rather than stopping on its first line. REPO comes from github.repository and is never
+# legitimately empty, so it keeps `:?`.
+: "${PR_NUMBER?the calling step must set PR_NUMBER}"
 : "${REPO:?the calling step must set REPO}"
 
 # Caps. The median PR reviewed across the org is 161 changed lines and the largest
 
@@ -196,7 +196,7 @@ run_step() {
     RUNNER_TEMP="$WORK/rt" \
     GITHUB_OUTPUT="$WORK/out.txt" \
     STUB_FIXTURES="$PWD/tests/fixtures" \
-    PR_NUMBER=172 \
+    PR_NUMBER="${PR_NUMBER-172}" \
     REPO=hotdata-dev/dlthubworker \
     STUB_JOB_LOG="${STUB_JOB_LOG:-job-log-django.txt}" \
     GH_VERSION="${GH_VERSION:-2.96}" \
@@ -557,6 +557,21 @@ reviews|prior reviews could not be read
 comments|prior inline review comments could not be read
 ENDPOINTS
 
+# An empty PR_NUMBER is a real case, not a caller bug: tests.yml calls the workflow on
+# `push: branches: [main]`, where there is no pull request. The first guard in the script was
+# written `${PR_NUMBER:?}`, which fires on empty as well as unset, so the whole script exited on
+# line 26 of every main-push smoke run -- the run stayed green because the step is
+# continue-on-error, and the smoke test silently stopped covering anything past that line.
+# The reads are expected to degrade here; what matters is that the script gets to them.
+PR_NUMBER='' run_step "no pull request number" > "$WORK/code.txt"
+expect "$(cat "$WORK/code.txt")" "0" "step exits 0 when there is no pull request number"
+if grep -q "must set PR_NUMBER" "$WORK/step.out"; then
+  echo "FAIL an empty PR_NUMBER aborts the script; a main-push smoke run covers nothing"
+  failures=$((failures + 1))
+else
+  echo "ok   an empty PR_NUMBER degrades the reads instead of aborting the script"
+fi
+
 if [ "$failures" -ne 0 ]; then
   echo "$failures test(s) failed"
   exit 1
 
@@ -162,6 +162,19 @@ check_permission "statusCheckRollup" statuses "the StatusContext half of the CI
 check_permission "/compare/" contents "the since-last-review comparison"
 check_permission "/pulls/" pull-requests "the PR reads"
 
+# A missing context script has to fail loudly somewhere, and it cannot be the context step: that
+# one is continue-on-error, so `bash <missing file>` exits 127 into a green run. The prompt
+# document gets this for free -- `cat` on a missing file fails its step -- and the script needs an
+# explicit check to match. It must sit in a step without continue-on-error, or it proves nothing.
+if ! grep -q "gather-review-context.sh is missing\|! -f \"\$script\"" "$WORKFLOW_FILE"; then
+  echo "FAIL nothing in $WORKFLOW_FILE checks that the context script arrived from the"
+  echo "     cross-repo checkout. A bad sparse-checkout pattern would exit 127 inside a"
+  echo "     continue-on-error step and leave the run green with an empty context."
+  failures=$((failures + 1))
+else
+  echo "ok   a missing context script fails the job rather than emptying the context"
+fi
+
 # The context step is continue-on-error, so everything it can fail at -- a checkout that does not
 # deliver the script, a bad path, a rename that stops matching the sparse pattern -- leaves the run
 # green with pr_context, threads and review_cycle all unset. Ungated, the review step then runs on