diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index abeccaf7c..12cb8c914 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -10,6 +10,10 @@ workflows:
         - 'ocaml/setup-ocaml@e89b2ded52a6e13f50162220cf5fe47290162032'
     '.github/workflows/allowlist-preflight-reusable.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+    '.github/workflows/apply-workflow-pins.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/create-github-app-token@v3.2.0'
+        - 'actions/upload-artifact@v7.0.1'
     '.github/workflows/boj-build.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/canon-spine-lockstep.yml':
@@ -33,6 +37,8 @@ workflows:
     '.github/workflows/codeql.yml': []
     '.github/workflows/debt-measure.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+    '.github/workflows/deed-conformance.yml':
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/doc-format.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/dyadt-verify.yml':
@@ -68,11 +74,11 @@ workflows:
     '.github/workflows/labels.yml': []
     '.github/workflows/launcher-standard-lockstep.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+    '.github/workflows/lock-selfcheck.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/lockfile-drift-detect.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
-    '.github/workflows/lock-selfcheck.yml':
-        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/makefile-blocker.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/mirror-reusable.yml':
@@ -82,10 +88,19 @@ workflows:
     '.github/workflows/mirror.yml': []
     '.github/workflows/no-js-scan.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+    '.github/workflows/pages-archive.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/configure-pages@v6.0.0'
+        - 'actions/deploy-pages@v5.0.1'
+        - 'actions/upload-pages-artifact@v5.0.0'
+        - 'haskell-actions/setup@v2.12.0'
     '.github/workflows/pages.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346'
         - 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9'
+    '.github/workflows/propagate-hooks.yml':
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/readme-derive-reusable.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/readme-derive.yml': []
@@ -108,40 +123,76 @@ workflows:
         - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
     '.github/workflows/secret-scanner-reusable.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+    '.github/workflows/security-gate-pr-target.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/github-script@v9.0.0'
+        - 'hyperpolymath/a2ml-ecosystem@main'
     '.github/workflows/self-test.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+    '.github/workflows/settings-drift-detect.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
     '.github/workflows/signed-push-smoke.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1'
         - 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897'
     '.github/workflows/spark-theatre-gate.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+    '.github/workflows/tag-ruleset-canon.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/create-github-app-token@v3.2.0'
+        - 'actions/upload-artifact@v7.0.1'
 dependencies:
     'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
         ref: '55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         owner_id: 44036562
         repo_id: 215566462
+    'actions/cache@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
     'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
         ref: 'v7.0.1'
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
         owner_id: 44036562
         repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
     'actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d':
         ref: '45bfe0192ca1faeb007ade9deae92b16b8254a0d'
         commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
         owner_id: 44036562
         repo_id: 513659658
+    'actions/configure-pages@v6.0.0':
+        ref: 'v6.0.0'
+        commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
+        owner_id: 44036562
+        repo_id: 513659658
     'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1':
         ref: 'v3.2.0'
         commit: 'sha1-bcd2ba49218906704ab6c1aa796996da409d3eb1'
         owner_id: 44036562
         repo_id: 642580244
+    'actions/create-github-app-token@v3.2.0':
+        ref: 'v3.2.0'
+        commit: 'sha1-bcd2ba49218906704ab6c1aa796996da409d3eb1'
+        owner_id: 44036562
+        repo_id: 642580244
     'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346':
         ref: '368f82528645a54fb793d4d04e342629a3f51346'
         commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
         owner_id: 44036562
         repo_id: 438112499
+    'actions/deploy-pages@v5.0.1':
+        ref: 'v5.0.1'
+        commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
+        owner_id: 44036562
+        repo_id: 438112499
     'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c':
         ref: 'v8.0.1'
         commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
@@ -152,6 +203,11 @@ dependencies:
         commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
         owner_id: 44036562
         repo_id: 205262760
+    'actions/github-script@v9.0.0':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
     'actions/setup-python@v2':
         ref: 'v2'
         commit: 'sha1-e9aba2c848f5ebd159c070c61ea2c4e2b122355e'
@@ -167,6 +223,11 @@ dependencies:
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
         owner_id: 44036562
         repo_id: 192625955
+    'actions/upload-artifact@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
     'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9':
         ref: 'fc324d3547104276b827a68afc52ff2a11cc49c9'
         commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
@@ -174,6 +235,11 @@ dependencies:
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'actions/upload-pages-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
     'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897':
         ref: 'v1.3'
         commit: 'sha1-d615ca88d8e1a946734c24970d1e7a6c56f34897'
@@ -211,6 +277,16 @@ dependencies:
         commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
         owner_id: 75048950
         repo_id: 623796603
+    'haskell-actions/setup@v2.12.0':
+        ref: 'v2.12.0'
+        commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
+        owner_id: 75048950
+        repo_id: 623796603
+    'hyperpolymath/a2ml-ecosystem@main':
+        ref: 'main'
+        commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d'
+        owner_id: 6759885
+        repo_id: 1275649586
     'ocaml/setup-ocaml@e89b2ded52a6e13f50162220cf5fe47290162032':
         ref: 'v3.8.0'
         commit: 'sha1-e89b2ded52a6e13f50162220cf5fe47290162032'
diff --git a/.github/workflows/affinescript-verify.yml b/.github/workflows/affinescript-verify.yml
index 697ba099e..500bf431b 100644
--- a/.github/workflows/affinescript-verify.yml
+++ b/.github/workflows/affinescript-verify.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: AffineScript Verify
diff --git a/.github/workflows/apply-workflow-pins.yml b/.github/workflows/apply-workflow-pins.yml
index 6be0f42de..8f6785e73 100644
--- a/.github/workflows/apply-workflow-pins.yml
+++ b/.github/workflows/apply-workflow-pins.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 #
@@ -54,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
 
       # WHICH App's credentials belong in vars.APP_ID / secrets.APP_PRIVATE_KEY:
       # a DEDICATED App for this applier, explicitly NOT OikosBot. Owner ruling
@@ -70,7 +71,7 @@ jobs:
       - name: Mint an App installation token for hyperpolymath
         id: tok-user
         if: vars.APP_ID != ''
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@v3.2.0
         continue-on-error: true
         with:
           app-id: ${{ vars.APP_ID }}
@@ -80,7 +81,7 @@ jobs:
       - name: Mint an App installation token for metadatastician
         id: tok-org
         if: vars.APP_ID != ''
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@v3.2.0
         continue-on-error: true
         with:
           app-id: ${{ vars.APP_ID }}
@@ -145,7 +146,7 @@ jobs:
 
       - name: Upload the census
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: workflow-pin-census
           path: census.tsv
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index bc8eb82b4..529d95e0a 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 #
diff --git a/.github/workflows/canon-spine-lockstep.yml b/.github/workflows/canon-spine-lockstep.yml
index e1a8ab708..352dd01c3 100644
--- a/.github/workflows/canon-spine-lockstep.yml
+++ b/.github/workflows/canon-spine-lockstep.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # canon-spine-lockstep — GATE A.
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 16978f7bb..42cf9fbef 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: GitHub Pages
diff --git a/.github/workflows/changelog-reusable.yml b/.github/workflows/changelog-reusable.yml
index a95727edc..72dae03ef 100644
--- a/.github/workflows/changelog-reusable.yml
+++ b/.github/workflows/changelog-reusable.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 53dfed2f2..9fad6904f 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Changelog
diff --git a/.github/workflows/check-suite-monitor.yml b/.github/workflows/check-suite-monitor.yml
index f20b8d041..2b6e108c9 100644
--- a/.github/workflows/check-suite-monitor.yml
+++ b/.github/workflows/check-suite-monitor.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # 🟡 CHECK: Check Suite Monitor
 # This workflow is managed by gh actions-lock.
diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml
index aee3aed48..69f11b583 100644
--- a/.github/workflows/codeql-reusable.yml
+++ b/.github/workflows/codeql-reusable.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # codeql-reusable.yml — Reusable CodeQL security-analysis workflow.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 70b24201c..3829618eb 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
diff --git a/.github/workflows/debt-measure.yml b/.github/workflows/debt-measure.yml
index 7a3f80a80..175f2bb91 100644
--- a/.github/workflows/debt-measure.yml
+++ b/.github/workflows/debt-measure.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "📅 Debt measure"
 
diff --git a/.github/workflows/deed-conformance.yml b/.github/workflows/deed-conformance.yml
index 4dde837a7..c6003c84e 100644
--- a/.github/workflows/deed-conformance.yml
+++ b/.github/workflows/deed-conformance.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: deed-conformance
 
@@ -22,7 +23,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: validator self-test
diff --git a/.github/workflows/doc-format.yml b/.github/workflows/doc-format.yml
index ed5947014..892363c66 100644
--- a/.github/workflows/doc-format.yml
+++ b/.github/workflows/doc-format.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Documentation Format Enforcement
diff --git a/.github/workflows/dyadt-verify.yml b/.github/workflows/dyadt-verify.yml
index c3889ce18..7c95b9454 100644
--- a/.github/workflows/dyadt-verify.yml
+++ b/.github/workflows/dyadt-verify.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # dyadt-verify — DYADT dogfood. Verify this repo's CLAIMS.a2ml against primary
diff --git a/.github/workflows/echidna-verify.yml b/.github/workflows/echidna-verify.yml
index 2b369975a..dad3ff380 100644
--- a/.github/workflows/echidna-verify.yml
+++ b/.github/workflows/echidna-verify.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # ECHIDNA proof verification — formal verification of Agda and Idris2 proofs.
diff --git a/.github/workflows/elixir-ci-reusable.yml b/.github/workflows/elixir-ci-reusable.yml
index de04c11ce..320e7d5ab 100644
--- a/.github/workflows/elixir-ci-reusable.yml
+++ b/.github/workflows/elixir-ci-reusable.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # elixir-ci-reusable.yml — Reusable Elixir CI bundle (RSR).
diff --git a/.github/workflows/elixir-ci.yml b/.github/workflows/elixir-ci.yml
index 3d5d9a92a..c80decacd 100644
--- a/.github/workflows/elixir-ci.yml
+++ b/.github/workflows/elixir-ci.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Elixir CI
diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml
index fd811e79e..a9e9081ab 100644
--- a/.github/workflows/governance-reusable.yml
+++ b/.github/workflows/governance-reusable.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Governance checks for hyperpolymath repositories — Reusable Workflow
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 401cbafc1..c2945c45e 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Governance
diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml
index 27f2e7e1a..90c1ae6df 100644
--- a/.github/workflows/hypatia-scan-reusable.yml
+++ b/.github/workflows/hypatia-scan-reusable.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Hypatia Neurosymbolic CI/CD Security Scan — Reusable Workflow
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 171a1c28f..8686b8c29 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Hypatia Security Scan
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index 16343c8b6..d886ec84f 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Instant Forge Sync - Triggers propagation to all forges on push/release
diff --git a/.github/workflows/k9-contractile.yml b/.github/workflows/k9-contractile.yml
index 1580f0cba..c1bed4195 100644
--- a/.github/workflows/k9-contractile.yml
+++ b/.github/workflows/k9-contractile.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml
index e61baef93..3e7474854 100644
--- a/.github/workflows/label-triage.yml
+++ b/.github/workflows/label-triage.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Label Triage
 
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index c536afb97..a4208d7f1 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Labels
 
diff --git a/.github/workflows/launcher-standard-lockstep.yml b/.github/workflows/launcher-standard-lockstep.yml
index 58b058190..21fdc3617 100644
--- a/.github/workflows/launcher-standard-lockstep.yml
+++ b/.github/workflows/launcher-standard-lockstep.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: launcher-standard lock-step
diff --git a/.github/workflows/lockfile-drift-detect.yml b/.github/workflows/lockfile-drift-detect.yml
index 782c98dea..16745f217 100644
--- a/.github/workflows/lockfile-drift-detect.yml
+++ b/.github/workflows/lockfile-drift-detect.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 #
diff --git a/.github/workflows/makefile-blocker.yml b/.github/workflows/makefile-blocker.yml
index 37d9cfbc5..11b1a1558 100644
--- a/.github/workflows/makefile-blocker.yml
+++ b/.github/workflows/makefile-blocker.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Makefile Blocker
diff --git a/.github/workflows/mirror-reusable.yml b/.github/workflows/mirror-reusable.yml
index 34176e2af..545501872 100644
--- a/.github/workflows/mirror-reusable.yml
+++ b/.github/workflows/mirror-reusable.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # mirror-reusable.yml — Reusable git-forge mirror bundle.
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 926238463..5440e4683 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Mirror to Git Forges
diff --git a/.github/workflows/no-js-scan.yml b/.github/workflows/no-js-scan.yml
index 3a6dc62a6..18ccf0ec2 100644
--- a/.github/workflows/no-js-scan.yml
+++ b/.github/workflows/no-js-scan.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: No-JS Scan (warn-first)
diff --git a/.github/workflows/pages-archive.yml b/.github/workflows/pages-archive.yml
index 16978f7bb..acb633587 100644
--- a/.github/workflows/pages-archive.yml
+++ b/.github/workflows/pages-archive.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: GitHub Pages
@@ -23,22 +24,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
 
       - name: Checkout casket-ssg
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
 
       - name: Setup GHCup
-        uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0
+        uses: haskell-actions/setup@v2.12.0
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
 
       - name: Cache Cabal
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cabal/packages
@@ -82,10 +83,10 @@ jobs:
           cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
 
       - name: Setup Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        uses: actions/configure-pages@v6.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v3
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: '_site'
 
@@ -99,4 +100,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+        uses: actions/deploy-pages@v5.0.1
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 11d401c85..0ab5e0431 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: GitHub Pages (Ddraig SSG)
diff --git a/.github/workflows/propagate-hooks.yml b/.github/workflows/propagate-hooks.yml
index f2c7662cd..91656da3b 100644
--- a/.github/workflows/propagate-hooks.yml
+++ b/.github/workflows/propagate-hooks.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # ⚙️ AUTO: Propagate Hook Updates
 # This workflow is managed by gh actions-lock.
@@ -49,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout standards repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
 
@@ -172,7 +173,7 @@ jobs:
 
     steps:
       - name: Checkout standards repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Determine source and target
         id: config
@@ -191,7 +192,7 @@ jobs:
           echo "target_name=$TARGET_NAME" >> $GITHUB_OUTPUT
 
       - name: Checkout target repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           repository: ${{ matrix.repo }}
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/readme-derive-reusable.yml b/.github/workflows/readme-derive-reusable.yml
index 95b6b2e54..5df5361cd 100644
--- a/.github/workflows/readme-derive-reusable.yml
+++ b/.github/workflows/readme-derive-reusable.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # README single-source derivation — Reusable Workflow (ADR-004)
diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml
index ba51d78ed..c0a326b37 100644
--- a/.github/workflows/readme-derive.yml
+++ b/.github/workflows/readme-derive.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: README Derive
diff --git a/.github/workflows/registry-verify.yml b/.github/workflows/registry-verify.yml
index 8d112cb21..63bd57bde 100644
--- a/.github/workflows/registry-verify.yml
+++ b/.github/workflows/registry-verify.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # registry-verify — fail the build if the spec registry or the DERIVED
diff --git a/.github/workflows/rust-ci-reusable.yml b/.github/workflows/rust-ci-reusable.yml
index ec2c1d407..002922860 100644
--- a/.github/workflows/rust-ci-reusable.yml
+++ b/.github/workflows/rust-ci-reusable.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # rust-ci-reusable.yml — Reusable Rust CI bundle (RSR).
diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
index be6e8af65..4ee284168 100644
--- a/.github/workflows/scorecard-enforcer.yml
+++ b/.github/workflows/scorecard-enforcer.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores
diff --git a/.github/workflows/secret-scanner-reusable.yml b/.github/workflows/secret-scanner-reusable.yml
index 18240884d..dae222508 100644
--- a/.github/workflows/secret-scanner-reusable.yml
+++ b/.github/workflows/secret-scanner-reusable.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # secret-scanner-reusable.yml — Reusable secret-scanner bundle.
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index c5ba2cc24..628be9684 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Secret Scanner
diff --git a/.github/workflows/security-gate-pr-target.yml b/.github/workflows/security-gate-pr-target.yml
index c9c5e17ba..ac35c2fd3 100644
--- a/.github/workflows/security-gate-pr-target.yml
+++ b/.github/workflows/security-gate-pr-target.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # 🔴 GATE: Security Gate for Fork Pull Requests
 # This workflow is managed by gh actions-lock.
@@ -23,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout base repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           # Explicitly checkout the base branch, not the PR branch
           ref: ${{ github.base_ref }}
@@ -88,7 +89,7 @@ jobs:
       - name: Security Scan - Secrets Detection
         if: steps.fork-check.outputs.is_fork == 'true' && steps.pr-checkout.outputs.pr_checked_out == 'true'
         id: secrets-scan
-        uses: hyperpolymath/a2ml-ecosystem/secrets-check-action@f7a40a4d5cc82b2e73f861119baa6818d77a448d # main
+        uses: hyperpolymath/a2ml-ecosystem/secrets-check-action@main
         with:
           path: '.'
           strict: 'true'
@@ -178,7 +179,7 @@ jobs:
 
       - name: Post Security Scan Comment
         if: steps.fork-check.outputs.is_fork == 'true'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v9.0.0
         with:
           script: |
             const prNumber = context.issue.number;
@@ -210,7 +211,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
@@ -227,7 +228,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Generate Summary
         run: |
diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml
index 77a863c71..527d135ec 100644
--- a/.github/workflows/self-test.yml
+++ b/.github/workflows/self-test.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # self-test — run this repo's own test suite.
diff --git a/.github/workflows/settings-drift-detect.yml b/.github/workflows/settings-drift-detect.yml
index 4f2d8d47a..d08c92b9b 100644
--- a/.github/workflows/settings-drift-detect.yml
+++ b/.github/workflows/settings-drift-detect.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 #
@@ -58,7 +59,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@v7.0.1
 
       - name: Scan estate for settings drift
         id: scan
@@ -89,7 +90,7 @@ jobs:
 
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: settings-drift
           path: drift.tsv
diff --git a/.github/workflows/signed-push-smoke.yml b/.github/workflows/signed-push-smoke.yml
index 675ae0655..00782a22f 100644
--- a/.github/workflows/signed-push-smoke.yml
+++ b/.github/workflows/signed-push-smoke.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # End-to-end check for the signed-push composite action: pushes a throwaway commit
@@ -52,7 +53,7 @@ jobs:
           git commit -m "test(signed-push): verified-commit smoke [run ${GITHUB_RUN_ID}]"
 
       - name: Push the local commit as Verified (via the App)
-        uses: ./.github/actions/signed-push
+        uses: $/.github/actions/signed-push
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml
index 88908f21c..6b5ab2a28 100644
--- a/.github/workflows/spark-theatre-gate.yml
+++ b/.github/workflows/spark-theatre-gate.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: SPARK Theatre Gate
diff --git a/.github/workflows/tag-ruleset-canon.yml b/.github/workflows/tag-ruleset-canon.yml
index fc4190178..6dcce234e 100644
--- a/.github/workflows/tag-ruleset-canon.yml
+++ b/.github/workflows/tag-ruleset-canon.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Converge every non-archived estate repository on the canonical immutable-tags
 # ruleset. This workflow exists because the 2026-09-11 damage (372 repositories
@@ -41,7 +42,7 @@ jobs:
   converge:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
 
       # WHICH App's credentials belong in vars.APP_ID / secrets.APP_PRIVATE_KEY:
       # a DEDICATED App for this applier -- explicitly NOT OikosBot. Owner ruling
@@ -61,7 +62,7 @@ jobs:
       - name: Mint an App installation token for hyperpolymath
         id: tok-user
         if: vars.APP_ID != ''
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@v3.2.0
         continue-on-error: true
         with:
           app-id: ${{ vars.APP_ID }}
@@ -71,7 +72,7 @@ jobs:
       - name: Mint an App installation token for metadatastician
         id: tok-org
         if: vars.APP_ID != ''
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@v3.2.0
         continue-on-error: true
         with:
           app-id: ${{ vars.APP_ID }}
@@ -160,7 +161,7 @@ jobs:
 
       - name: Publish the report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: tag-ruleset-canon-report
           path: canon-*.tsv