`main-estate-audit.yml` calls 26 composites at `@main` — every caller inherits floating edges that become startup_failure on a rename

[hyperpolymath]

Measured (2026-09-22, main = 3b4afaf)

• .github/workflows/main-estate-audit.yml has 26 uses: hyperpolymath/cicd-suite/actions/*@main references (e.g. :54 required-files-check, :56 code-hygiene-check, :58 manifest-check, :60 idris2-abi-check).
• Every caller pins the reusable itself by SHA, then inherits 26 floating edges. A composite renamed or removed on main turns every caller's audit into startup_failure with jobs=0, blamed on the caller (the shape measured on residual-evidence-types and hypatia this week).
• main-estate-audit.yml startup-dies from any caller: actions.lock is stale relative to its own uses: refs #9 records the sibling defect: the audit's own actions.lock is stale relative to its uses: refs.
• Step 3 Required Files Gate demands 7 files and, when red, skips 25 downstream gates including step 14, so a caller can be "green" on 1 of 26 predicates.

Acceptance criteria

1. All 26 refs pinned to a full SHA whose own gate run was green, with a # <tag or date> comment, and actions.lock transitively closed over them (a lock entry whose SHA does not resolve to itself is fatal; see hypatia #837).
2. Watched-failing → green: the @main count above is 26 today, 0 after.
3. Positive control: one caller (residual-evidence-types) dispatches the audit at the pinned SHA and the run has jobs > 0.
4. A red Required Files Gate no longer skips the other gates silently: the downstream gates run under if: always() with their own predicates, or the summary states "25 gates not evaluated".

Cross-reference: #9.

🤖 Generated with Claude Code