diff --git a/.gitea/workflows/harness-replays.yml b/.gitea/workflows/harness-replays.yml
index 9186f673..b5741923 100644
--- a/.gitea/workflows/harness-replays.yml
+++ b/.gitea/workflows/harness-replays.yml
@@ -68,7 +68,35 @@ jobs:
       run: ${{ steps.decide.outputs.run }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Fetch base branch tip for diff
+        continue-on-error: true
+        run: |
+          # With the default fetch-depth: 1, actions/checkout only fetches the
+          # PR head commit. The base commit is NOT in the local history, so
+          # `git diff "$BASE" "$GITHUB_SHA"` fails. Fetch the base branch at
+          # depth 1 — the base commit is the immediate parent of the PR head
+          # on the base branch, so depth=1 is sufficient.
+          #
+          # Network: Gitea Actions runner (5.78.80.188) cannot reach the git
+          # remote over HTTPS (confirmed: git fetch times out at ~15s). The runner
+          # is on the same host as Gitea, but the container network namespace
+          # cannot reach the Gitea HTTPS endpoint.
+          #
+          # Fallback: if the base commit does not exist locally, skip the diff
+          # and set run=true (always run harness). This is safe: PRs where the
+          # base is unavailable still run the harness (correct), PRs where the
+          # base IS available get the correct path-based diff.
+          #
+          # Timeout: 20s. If the fetch completes, great. If it times out, the
+          # step exits non-zero and we fall through to run=true.
+          if timeout 20 git fetch origin "${{ github.event.pull_request.base.ref }}" --depth=1; then
+            echo "::notice::base branch fetched successfully"
+          else
+            echo "::warning::git fetch origin ${{ github.event.pull_request.base.ref }} --depth=1 timed out"
+            echo "::warning::Skipping diff — detect-changes will run the harness unconditionally."
+          fi
       - id: decide
+        continue-on-error: true
         run: |
           # workflow_dispatch: always run (manual trigger)
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
@@ -95,7 +123,13 @@ jobs:
           fi
 
           # GitHub Actions and Gitea Actions both expose github.sha for HEAD.
-          DIFF=$(git diff --name-only "$BASE" "${{ github.sha }}" 2>/dev/null)
+          # git diff exits 1 when BASE is not in local history (e.g. shallow
+          # checkout where the base commit was never fetched). Capture and
+          # swallow that exit code — the empty diff means "run everything".
+          # The runner network cannot reach the git remote (confirmed: git fetch
+          # times out at ~15s), so a failed fetch is expected and we always fall
+          # through to the unconditional run=true below.
+          DIFF=$(git diff --name-only "$BASE" "${{ github.sha }}" 2>/dev/null) || true
           echo "debug=diff-base=$BASE diff-files=$DIFF" >> "$GITHUB_OUTPUT"
 
           if echo "$DIFF" | grep -qE '^workspace-server/|^canvas/|^tests/harness/|^.gitea/workflows/harness-replays\.yml$'; then