diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 22f1f91..59ed290 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -5,31 +5,32 @@ version: 'v0.0.2'
 workflows:
     '.github/workflows/cflite_batch.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
-        - 'github/codeql-action@v4.38.0'
+        - 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd'
         - 'google/clusterfuzzlite@884713a6c30a92e5e8544c39945cd7cb630abcd1'
     '.github/workflows/cflite_pr.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
-        - 'github/codeql-action@v4.38.0'
+        - 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd'
         - 'google/clusterfuzzlite@884713a6c30a92e5e8544c39945cd7cb630abcd1'
     '.github/workflows/checker-scaling.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
-        - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
+        - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
     '.github/workflows/codeql.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
-        - 'github/codeql-action@v4.38.0'
+        - 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd'
     '.github/workflows/coverage.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
-        - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
+        - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
     '.github/workflows/governance.yml':
-        - 'hyperpolymath/standards@08586a12bb64b98268fe9ebf552998aa2433a3c2'
+        - 'hyperpolymath/standards@9e9513b11fff182b08cf8cd6c9c2272460636586'
     '.github/workflows/hypatia-scan.yml':
-        - 'hyperpolymath/standards@08586a12bb64b98268fe9ebf552998aa2433a3c2'
+        - 'hyperpolymath/standards@469605210e767ee94d1c7a9c13cb6a1d0a78cad1'
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
+    '.github/workflows/lock-sync-gate.yml': []
     '.github/workflows/mirror.yml':
-        - 'hyperpolymath/standards@08586a12bb64b98268fe9ebf552998aa2433a3c2'
+        - 'hyperpolymath/standards@84355587cb2a1f86e6882de83514a32db2646e7a'
     '.github/workflows/pages.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/deploy-pages@v5.0.1'
@@ -39,14 +40,14 @@ workflows:
     '.github/workflows/push-email-notify.yml':
         - 'hyperpolymath/smtp-notify-action@v0.3.0'
     '.github/workflows/scorecard.yml':
-        - 'hyperpolymath/standards@08586a12bb64b98268fe9ebf552998aa2433a3c2'
+        - 'hyperpolymath/standards@84355587cb2a1f86e6882de83514a32db2646e7a'
     '.github/workflows/secret-scanner.yml':
-        - 'hyperpolymath/standards@08586a12bb64b98268fe9ebf552998aa2433a3c2'
+        - 'hyperpolymath/standards@84355587cb2a1f86e6882de83514a32db2646e7a'
     '.github/workflows/spark-theatre-gate.yml':
-        - 'hyperpolymath/standards@08586a12bb64b98268fe9ebf552998aa2433a3c2'
+        - 'hyperpolymath/standards@84355587cb2a1f86e6882de83514a32db2646e7a'
     '.github/workflows/stack-depth.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
-        - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
+        - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
 dependencies:
     'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
         ref: 'v6.1.0'
@@ -85,13 +86,18 @@ dependencies:
         commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
         owner_id: 42048915
         repo_id: 356423100
+    'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de':
+        ref: 'v1'
+        commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
+        owner_id: 1940490
+        repo_id: 260749683
     'dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c':
         ref: 'master'
         commit: 'sha1-2c7215f132e9ebf062739d9130488b56d53c060c'
         owner_id: 1940490
         repo_id: 260749683
     'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
-        ref: 'master'
+        ref: '6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
         commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
         owner_id: 1940490
         repo_id: 260749683
@@ -105,16 +111,26 @@ dependencies:
         commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
         owner_id: 47606891
         repo_id: 331103973
+    'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd':
+        ref: 'v4.38.1'
+        commit: 'sha1-1c5b675653bb5c22dbe9b12b556ec555138e09fd'
+        owner_id: 9919
+        repo_id: 259445878
+    'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938':
+        ref: 'cdf488f595d80d6e07e03d4674febd5ab45fa938'
+        commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
+        owner_id: 9919
+        repo_id: 259445878
+    'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
+        ref: 'db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+        commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+        owner_id: 9919
+        repo_id: 259445878
     'github/codeql-action@f205ea1c3313d32999d8d6a48b4f6530d4437b38':
         ref: 'v4.37.4'
         commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38'
         owner_id: 9919
         repo_id: 259445878
-    'github/codeql-action@v4.38.0':
-        ref: 'v4.38.0'
-        commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
-        owner_id: 9919
-        repo_id: 259445878
     'google/clusterfuzzlite@884713a6c30a92e5e8544c39945cd7cb630abcd1':
         ref: '884713a6c30a92e5e8544c39945cd7cb630abcd1'
         commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1'
@@ -141,6 +157,39 @@ dependencies:
             - 'github/codeql-action@f205ea1c3313d32999d8d6a48b4f6530d4437b38'
             - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
             - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
+    'hyperpolymath/standards@469605210e767ee94d1c7a9c13cb6a1d0a78cad1':
+        ref: '469605210e767ee94d1c7a9c13cb6a1d0a78cad1'
+        commit: 'sha1-469605210e767ee94d1c7a9c13cb6a1d0a78cad1'
+        owner_id: 6759885
+        repo_id: 1116521501
+        uses:
+            - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+            - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+            - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
+            - 'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938'
+    'hyperpolymath/standards@84355587cb2a1f86e6882de83514a32db2646e7a':
+        ref: '84355587cb2a1f86e6882de83514a32db2646e7a'
+        commit: 'sha1-84355587cb2a1f86e6882de83514a32db2646e7a'
+        owner_id: 6759885
+        repo_id: 1116521501
+        uses:
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+            - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+            - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
+            - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+            - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
+            - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
+    'hyperpolymath/standards@9e9513b11fff182b08cf8cd6c9c2272460636586':
+        ref: '9e9513b11fff182b08cf8cd6c9c2272460636586'
+        commit: 'sha1-9e9513b11fff182b08cf8cd6c9c2272460636586'
+        owner_id: 6759885
+        repo_id: 1116521501
+        uses:
+            - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+            - 'editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c'
+            - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
     'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
         ref: 'v2.4.4'
         commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
diff --git a/.github/workflows/lock-sync-gate.yml b/.github/workflows/lock-sync-gate.yml
new file mode 100644
index 0000000..936c873
--- /dev/null
+++ b/.github/workflows/lock-sync-gate.yml
@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Lock Sync Gate
+
+# Fails any pull request whose .github/workflows/actions.lock has drifted from
+# the workflow YAML. That drift is not cosmetic: GitHub refuses such a run at
+# startup, creating ZERO jobs, and reports only "This run likely failed because
+# of a workflow file issue." A single grouped Dependabot bump can take out most
+# of a repository's CI that way, because Dependabot rewrites `uses:` refs in the
+# YAML and cannot touch the lockfile. Measured across 200 repositories on
+# 2026-09-22: 39 had silently dead CI from exactly this cause.
+# See hyperpolymath/standards#968.
+#
+# This workflow deliberately carries NO `uses:` of its own. It checks out by
+# calling git in a `run:` step instead of using actions/checkout, so it has no
+# lockfile entry to go stale and is structurally immune to the very failure it
+# detects. Do not add a `uses:` to this file.
+#
+# There is also no `paths:` filter, on purpose: a filtered workflow never
+# reports on pull requests that miss the filter, which deadlocks any branch
+# ruleset that requires this check.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: lock-sync-gate-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lock-sync:
+    name: actions.lock is in sync with the workflow YAML
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out without actions/checkout
+        env:
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # Authenticate the fetch. An anonymous clone works only for public
+          # repositories; this gate must also run on private ones. The header
+          # form is used rather than a token in the remote URL so the
+          # credential is never written into .git/config.
+          AUTH="AUTHORIZATION: basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 -w0)"
+          git init -q .
+          git remote add origin "https://github.com/${REPO}.git"
+          git -c http.extraheader="${AUTH}" fetch -q --depth 1 origin "${SHA}"
+          git checkout -q FETCH_HEAD
+          echo "checked out ${SHA}"
+
+      - name: Verify lockfile synchronisation
+        run: |
+          set -euo pipefail
+          test -x scripts/check-lock-sync.sh \
+            || { echo "::error::scripts/check-lock-sync.sh missing or not executable"; exit 1; }
+          ./scripts/check-lock-sync.sh
diff --git a/scripts/check-lock-sync.sh b/scripts/check-lock-sync.sh
new file mode 100755
index 0000000..85ee77d
--- /dev/null
+++ b/scripts/check-lock-sync.sh
@@ -0,0 +1,283 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# check-lock-sync.sh — verify .github/workflows/actions.lock is in sync with the
+# workflow YAML, in BOTH directions (including job-level reusable-workflow refs),
+# AND that the lockfile is TRANSITIVELY CLOSED.
+#
+# Three clauses, each of which alone is insufficient:
+#
+#   1. every `uses:` in a workflow is locked under THAT workflow's own path;
+#   2. every lockfile entry is still referenced by its workflow (no orphans);
+#   3. every ref NAMED anywhere in the lockfile resolves to a top-level
+#      `dependencies:` record — the lockfile has no dangling edges.
+#
+# Clause 3 is not decoration. It is the clause that catches the failure mode that
+# clauses 1 and 2 are structurally blind to, and it was added only after that
+# blindness was measured. On hyperpolymath/cicd-squabbler, 2026-09-22:
+#
+#   commit    dangling-edge class                              result
+#   fe22bbc   workflows: -> dependencies: (ref listed, no record)   4 workflows startup_failure, jobs=0
+#   cfadcf9   dependencies: -> dependencies: (record added, its
+#             own nested uses: unrecorded)                          the same 4 still startup_failure
+#   5286aa5   none - transitively closed                            0 startup_failure, all 17 runs create jobs
+#
+# At fe22bbc AND cfadcf9 this script exited 0, `gh actions-lock --verify-local`
+# exited 0, and the Lock Sync Gate reported green - while GitHub was refusing to
+# start four workflows. Every local gate was green on a fatal commit. That is the
+# guard/consumer trap: the gate asked "is every uses: locked?" and GitHub asks
+# "is every locked ref RESOLVABLE?".
+#
+# Exit 0 only when all three clauses hold. Any violation exits 1. There is no
+# warn-only mode: a desync means GitHub refuses to start the run, so it must fail
+# the job. A `::warning::` cannot fail a job and would be a vacuous gate.
+
+set -euo pipefail
+
+WF_DIR="${1:-.github/workflows}"
+LOCK="$WF_DIR/actions.lock"
+
+# gawk is required: the parser uses 3-argument match(), a GNU extension. mawk
+# (the Debian/Ubuntu default `awk`) does not support it, and a silent parse
+# failure here would read as a clean pass - the exact failure mode this script
+# exists to prevent. Probe it rather than trusting the name.
+AWK=""
+for cand in gawk awk; do
+  if command -v "$cand" >/dev/null 2>&1 \
+     && echo x | "$cand" '{ if (match($0, /(x)/, m) && m[1] == "x") exit 0; exit 1 }' 2>/dev/null; then
+    AWK="$cand"; break
+  fi
+done
+if [ -z "$AWK" ]; then
+  echo "check-lock-sync: FATAL: no awk supporting 3-argument match() (need gawk)" >&2
+  echo "check-lock-sync: install it with: sudo apt-get install -y gawk" >&2
+  exit 1
+fi
+
+if [ ! -f "$LOCK" ]; then
+  echo "check-lock-sync: FATAL: no lockfile at $LOCK" >&2
+  exit 1
+fi
+
+shopt -s nullglob
+CANDIDATES=("$WF_DIR"/*.yml "$WF_DIR"/*.yaml)
+WORKFLOWS=()
+if [ "${#CANDIDATES[@]}" -gt 0 ]; then
+  mapfile -t WORKFLOWS < <(printf '%s\n' "${CANDIDATES[@]}" | sort -u)
+fi
+if [ "${#WORKFLOWS[@]}" -eq 0 ]; then
+  echo "check-lock-sync: FATAL: no workflow files under $WF_DIR" >&2
+  exit 1
+fi
+
+read -r -d '' PROG <<'AWK' || true
+# owner/repo[/subpath...]@ref  ->  owner/repo@ref   ("" if not an external ref)
+function norm(r,   at, path, ref, n, parts) {
+  at = 0
+  for (n = length(r); n > 0; n--) { if (substr(r, n, 1) == "@") { at = n; break } }
+  if (at == 0) return ""
+  path = substr(r, 1, at - 1); ref = substr(r, at + 1)
+  if (path == "" || ref == "") return ""
+  if (substr(path, 1, 2) == "./" || substr(path, 1, 2) == "$/") return ""   # local action
+  if (split(path, parts, "/") < 2) return ""
+  return parts[1] "/" parts[2] "@" ref
+}
+
+# Preserve the original owner/repository and ref casing in comparison keys.
+function ck(r,   at, s) {
+  at = 0
+  for (s = length(r); s > 0; s--) { if (substr(r, s, 1) == "@") { at = s; break } }
+  if (at == 0) return r
+  return substr(r, 1, at - 1) substr(r, at)
+}
+
+# ---------- pass 1: the lockfile ----------
+FILENAME == lockfile {
+  if ($0 ~ /^workflows:[[:space:]]*$/)    { inwf = 1; indep = 0; next }
+  if ($0 ~ /^dependencies:[[:space:]]*$/) { inwf = 0; indep = 1; next }
+  if ($0 ~ /^[a-z_]+:/)                   { inwf = 0; indep = 0; next }
+
+  # --- the dependencies: section, for clause 3 ---
+  if (indep) {
+    # "    'owner/repo@ref':"  -- a top-level dependency record
+    if (match($0, /^    '([^']+)':/, m)) {
+      depkey = m[1]
+      haverec[ck(depkey)] = 1; disp[ck(depkey)] = depkey
+      next
+    }
+    # "            - 'owner/repo@ref'"  -- a nested uses: of that record
+    if (match($0, /^            - '([^']+)'/, m) && depkey != "") {
+      r = ck(m[1]); disp[r] = m[1]
+      want[r] = 1
+      wantsrc[r] = wantsrc[r] " dependencies:" depkey
+      next
+    }
+    next
+  }
+
+  if (!inwf) next
+
+  # "    '.github/workflows/x.yml':"  or  "... : []"
+  if (match($0, /^    '([^']+)':/, m)) {
+    cur = m[1]
+    seen_path[cur] = 1
+    next
+  }
+  if (match($0, /^        - '([^']+)'[[:space:]]*$/, m) && cur != "") {
+    lr = ck(m[1]); disp[lr] = m[1]; lock[cur, lr] = 1
+    lockcount[cur]++
+    want[lr] = 1
+    wantsrc[lr] = wantsrc[lr] " " cur
+    next
+  }
+  next
+}
+
+# ---------- pass 2: the workflow YAML ----------
+FNR == 1 { wf = FILENAME }
+{
+  line = $0
+  sub(/[[:space:]]+#.*$/, "", line)              # strip trailing comment
+  if (match(line, /^[[:space:]]*-?[[:space:]]*uses:[[:space:]]*(.+)$/, m)) {
+    raw = m[1]
+    gsub(/^["']|["']$/, "", raw)
+    gsub(/[[:space:]]+$/, "", raw)
+    if (raw ~ /^\$\//) next                       # local action
+    n = norm(raw)
+    if (n != "") {
+      uses[wf, ck(n)] = 1
+      useslist[wf] = useslist[wf] " " n
+    }
+  }
+}
+
+END {
+  bad = 0
+  for (i = 1; i < ARGC; i++) {
+    wf = ARGV[i]
+    if (wf == lockfile) continue
+    key = wf
+    sub(/.*\//, "", key)
+    key = ".github/workflows/" key          # the lockfile always uses this canonical path
+
+    # --- clause 1: every uses: reference must be locked under THIS path ---
+    nu = split(useslist[wf], u, " ")
+    delete uniq; missing = ""
+    for (j = 1; j <= nu; j++) {
+      if (u[j] == "" || (u[j] in uniq)) continue
+      uniq[u[j]] = 1
+      if (!((key SUBSEP ck(u[j])) in lock)) missing = missing " " u[j]
+    }
+    if (missing != "") {
+      if (!(key in seen_path))
+        printf "FAIL %s\n     not onboarded: no lockfile entry for this path\n     unlocked uses refs:%s\n", key, missing
+      else
+        printf "FAIL %s\n     uses refs missing from the lockfile:%s\n", key, missing
+      bad = 1
+    }
+
+    # --- clause 2: every lock entry must be referenced by this workflow ---
+    orphan = ""
+    for (k in lock) {
+      split(k, kp, SUBSEP)
+      if (kp[1] != key) continue
+      if (!((wf SUBSEP kp[2]) in uses)) orphan = orphan " " (kp[2] in disp ? disp[kp[2]] : kp[2])
+    }
+    if (orphan != "") {
+      printf "FAIL %s\n     stale lockfile entries, no uses: references them:%s\n", key, orphan
+      bad = 1
+    }
+  }
+
+  # --- lockfile entries for workflow files that no longer exist ---
+  for (p in seen_path) {
+    found = 0
+    for (i = 1; i < ARGC; i++) {
+      q = ARGV[i]; if (q == lockfile) continue
+      sub(/.*\//, "", q); q = ".github/workflows/" q
+      if (q == p) { found = 1; break }
+    }
+    if (!found) { printf "FAIL %s\n     lockfile entry for a workflow file that does not exist\n", p; bad = 1 }
+  }
+
+  # --- clause 4: COVERAGE. Every workflow FILE must have a key in the lockfile,
+  #     including one with no uses: at all - the value is then an empty list.
+  #     MEASURED 2026-09-22, single-variable flip on two independent repos:
+  #     hyperpolymath/verisimdb's lock-sync-gate.yml was startup_failure 7 times
+  #     running with ZERO uses: refs, and adding
+  #         '.github/workflows/lock-sync-gate.yml': []
+  #     flipped it to success; reproduced on hyperpolymath/blocky-writer, 2 of 2.
+  #     `gh actions-lock` already emits this empty-list form for other zero-uses:
+  #     workflows (labels.yml), so it is the generator's own convention, not ours.
+  #     Clauses 1-3 CANNOT catch this: they ask "is every uses: locked?", and a
+  #     workflow with no uses: satisfies them vacuously while GitHub still refuses
+  #     to start it. 13 repos passed clauses 1-3 with exactly this gap.
+  nunlisted = 0; unlisted = ""
+  for (i = 1; i < ARGC; i++) {
+    q = ARGV[i]; if (q == lockfile) continue
+    sub(/.*\//, "", q); q = ".github/workflows/" q
+    if (q in seen_path) continue
+    nunlisted++; unlisted = unlisted "\n       " q
+  }
+  if (nunlisted > 0) {
+    printf "FAIL actions.lock: UNLISTED WORKFLOWS\n"
+    printf "     %d workflow file(s) have no key in the lockfile. GitHub refuses such a\n", nunlisted
+    printf "     run at startup (jobs=0) even when the workflow has no uses: at all.\n"
+    printf "     The entry for a zero-uses: workflow is an empty list:%s\n", unlisted
+    bad = 1
+  }
+
+  # --- clause 3: TRANSITIVE CLOSURE. Every ref named anywhere in the lockfile
+  #     must resolve to a top-level dependencies: record. A dangling edge makes
+  #     GitHub refuse the run at startup with jobs=0. ---
+  ndang = 0; dang = ""
+  for (r in want) {
+    if (r !~ /^[^\/]+\/[^\/@]+@/) continue      # not an OWNER/REPO@REF pin; not ours to resolve
+    if (r in haverec) continue
+    ndang++
+    dang = dang sprintf("\n       %s\n           named by:%s", (r in disp ? disp[r] : r), wantsrc[r])
+  }
+  if (ndang > 0) {
+    printf "FAIL actions.lock: DANGLING EDGES\n"
+    printf "     %d ref(s) are named in the lockfile but have no top-level dependencies: record.%s\n", ndang, dang
+    bad = 1
+  }
+
+  # --- a dependencies: record nothing names is dead weight, not fatal: report only ---
+  nunref = 0
+  for (d in haverec) if (!(d in want)) nunref++
+
+  if (bad) {
+    print ""
+    print "actions.lock is OUT OF SYNC with the workflow YAML, or is not transitively closed."
+    print "GitHub refuses such a run at startup: zero jobs are created and the run"
+    print "reports \"This run likely failed because of a workflow file issue.\""
+    print ""
+    print "Fix, in this order:"
+    print "  1. `gh actions-lock --no-migrate-local-actions`, then review the diff. It does"
+    print "     NOT handle job-level reusable-workflow refs and it can de-pin bare SHAs to"
+    print "     floating tags - both must be corrected by hand."
+    print "  2. For any DANGLING EDGES above, add a top-level `dependencies:` record for each"
+    print "     ref. A leaf record may legally omit the nested `uses:` key entirely, so adding"
+    print "     leaves introduces no new dangling edges and closure terminates in one pass."
+    print "     Keys are sorted with LC_ALL=C collation (ASCII '-' 0x2d sorts before '@' 0x40)."
+    print "  3. Nested `uses:` entries must be bare OWNER/REPO@REF. A subpath pin such as"
+    print "     github/codeql-action/upload-sarif@<sha> is REJECTED by the schema; collapse it"
+    print "     to github/codeql-action@<sha>."
+    print "  4. For any UNLISTED WORKFLOWS above, add the path as a lockfile key. A workflow"
+    print "     with no uses: takes an empty list:  \x27.github/workflows/x.yml\x27: []"
+    print "     `gh actions-lock` has been observed to OMIT such a workflow entirely; that"
+    print "     omission is itself the defect, so re-running the tool may not add it."
+    exit 1
+  }
+  printf "actions.lock is in sync and transitively closed:\n"
+  printf "  * every uses: is locked under its own workflow path (job-level reusable refs included)\n"
+  printf "  * every lockfile entry is still referenced\n"
+  printf "  * every ref named in the lockfile resolves to a dependencies: record (0 dangling edges)\n"
+  printf "  * every workflow file has a lockfile key (zero-uses: workflows included)\n"
+  if (nunref > 0)
+    printf "  note: %d dependencies: record(s) are unreferenced - harmless, but prunable.\n", nunref
+}
+AWK
+
+"$AWK" -v lockfile="$LOCK" "$PROG" "$LOCK" "${WORKFLOWS[@]}"