Cross-filed because comment permissions on this token are issues:create-only (commenting on #994 and #968 returns 403 Resource not accessible by integration, verified) — please fold into those threads.

From metadatastician/chronicles-of-slavia #100 closure (PR #113, merged 75a6983)

Record on the consumer side: docs/reports/ci/issue-100-closure-2026-09-28.adoc.

For the class notes of #994 — four determinations, four root mechanisms

Method note for every future "red on PR head" reading (estate-wide): Arena-session PR branches have every run die at startup with Actor is not allowed to trigger Actions workflows — content-independent (annotation on run 36407881271; identical pattern on arena/01a0e227 ahead of #111; same tree green on main after merge). Arena PR-head runs are not measurable; measure main runs after merge.

For #968 — mechanism confirmation + the loop that keeps reopening it

1. Enforcement is native, runner-side, and total: Using locked action versions from the workflow's lockfile (verbatim runner line). Violations don't just fail a gate — every workflow in the repo dies at startup_failure with zero jobs, including the gates that verify the lock. Diagnosis order for whole-repo startup-death days: check actions.lock sync first.
2. Measured recurrence: slavia's Phase C — E2E verification + gateway↔gnosis seam tests #98-era cure held until Wave 7: Nix-mirror retirement (hesiod-dns-map…iseriser) #112 — a routine Dependabot group bump rewrote three uses: and never touched the lock (Dependabot structurally cannot). Result: exactly 6 violations, CodeQL/E2E/OikosBot at zero jobs, both lock gates red — and auto-merge completed anyway (lock gates are not in the required set per dependabot-automerge.yml: secret-scanner, codeql, hypatia-scan, openssf-compliance, build/test). A red lock gate does not stop merges in this estate.
3. Oracle fragility: check-lock-sync.sh depends on gawk's 3-arg match(); on non-gawk-awk systems the verifier itself misbehaves. (Slavia's session had to build gawk 4.1.0 from source to trust the verdict.) Worth documenting the dependency loudly or shipping a POSIX fallback.
4. Cure isn't complete without a recovery path in-repo: slavia Wave 8: Nix-mirror retirement (januskey…laniakea) #113 vendored scripts/update-actions-lock.sh (byte-identical standards@a2ff696 — the gates' remediation text pointed at a file consumers don't have) and moved github-actions to open-pull-requests-limit: 0 (GitHub-endorsed security-only switch; template precedent: same pattern ships for cargo), revisit condition written in-config: restore routine bumps when a heal-on-Dependabot path exists → tracked at github-actions Dependabot updates desync actions.lock in consumers (startup deaths), and the actions.lock doc link in the lock header is dead rsr-template-repo#205 (also reports the dead gh.io/actions-lockfile doc URL in the lock header — 404s).