For every clone, we run a preflight request against the code host to check if the repo is cloneable. The sole purpose is better error messages. We don't do the same for updates.

To me that tells that one of the two is doing it wrong. Either fetches are missing this, or clones are doing this extraneously without good reason.

It would be great if we could get away without that extra call, because it would make clones faster (the IsCloneable check according to Grafana dashboards isn't super quick, ~2.5s on a random instance I inspected) , and it would be one method less that we need to maintain and worry about in the process of cloning/fetching repos.