feat(fix-scripts): repair the three workflow-pin defect classes; re-pin this repo's standards callers - #615

…in this repo's standards callers

The actuation half of the pin-propagation architecture (hypatia detects
→ gitbot-fleet actuates → .git-private-farm propagates) for the three
defect classes measured this fortnight, each with a fix script, a row in
the registry, and a contract test run by rust.yml:

* fix-rust-toolchain-input.sh (WF026) — a SHA-pinned dtolnay/rust-toolchain
  step with no `toolchain:` input dies in its first step with "'toolchain'
  is a required input" and the red reads as a code failure
  (plasma-parser-writer#105, standards#439). The script gives such a step
  `toolchain: stable`, inside an existing `with:` or in a new one, and
  leaves tag-pinned and already-named steps alone.
* fix-stale-reusable-pin.sh (WF027, PIN-003, WF016) — a caller pinned at a
  reusable revision the estate has MEASURED dead is moved to the one
  replacement scripts/lib/stale-reusable-pins.tsv names for it, never to
  "newest" (standards' lock-selfcheck.sh exists because newer can be less
  usable). The table carries two windows from a walk of standards' history:
  A, 83 commits of June 2026 whose rust-ci-reusable.yml lacks the toolchain
  input; B, 545 commits reachable from main, 2026-08-19..2026-10-19, whose
  actions.lock carries an action record with its own SHA as `ref:`, which
  GitHub has rejected at Set up job ("invalid lockfile pin") since
  ~2026-10-15 for every caller of every standards reusable (hypatia#929,
  cicd-squabbler run 38846539059). If the caller's actions.lock names the
  stale SHA it follows the pin, and two dead SHAs moving to one
  replacement are merged into one record; the nested `uses:` list is never
  recomputed here, and the script says so.
* fix-lock-self-sha-refs.sh (PI006) — rewrites such a record's `ref:` to
  the tag its commit was resolved from, from scripts/lib/action-ref-tags.tsv
  (every row taken from the lock GitHub accepts, standards@75bd599) or
  `git ls-remote --tags`; a commit with no tag is reported and left, exit 1.
  Reusable-workflow records keep their SHA ref, as the accepted lock does.

scripts/tests/fix-workflow-pins.sh: 28 checks — planted defects fixed,
planted non-defects untouched, second runs byte-identical, controls with
an empty table. AGENTIC.a2ml names what an agent may and may not do with
these (never choose a replacement SHA; never recompute a closure here).

Dogfooded on this repository: the five standards callers (governance,
hypatia-scan, mirror, scorecard, secret-scanner) were pinned inside
Window B (da2c748, 571cc73) and have been dying at Set up job since
2026-10-16 (Governance run 39105727502 and every run after). They now
pin 75bd599; actions.lock holds one standards@75bd599 record whose
nested list is the union of what those five reusables use at that
commit, every third-party record copied verbatim from standards' own
lock, the seven self-SHA refs given their tags, and the three Dependabot
bumps the lock had missed (download-artifact v8.0.2, upload-artifact
v7.0.2) resynced. scripts/check-lock-sync.sh: in sync, transitively
closed. dispatch-paths.sh still passes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

…s; gitleaks ignores

Repair scripts (CodeRabbit, Codex):
* fix-rust-toolchain-input.sh inspects each step whole — from its opening
  `- ` line, so a `with:` above `uses:` is found — and only the `with:`
  mapping decides: `env.toolchain` no longer suppresses the input. A
  `with: # comment` is reused, a flow `with: { … }` gets `toolchain` as its
  first entry, and a quoted `"uses"` key is recognised.
* fix-lock-self-sha-refs.sh parses with POSIX awk (mawk is Debian's default
  awk: no match() capture array, no interval expressions) and parses before
  it loops, so a parser failure exits 2 with the lock untouched instead of
  reporting OK.
* fix-stale-reusable-pin.sh edits the lock per rewritten caller: only that
  workflow's `workflows:` edge moves; the stale dependency record is renamed
  when nothing references it any more and copied under the replacement key
  while another caller still pins the stale SHA. merge_duplicate_records
  emits a merged record's header once (the owner's fflush/first fixes, now
  asserted). Quoted `"uses"` keys are rewritten too.
* fix-script-registry.json no longer routes WF016 / orphan-pin findings to
  the table-only fixer, which cannot choose a replacement for an arbitrary
  orphan SHA and exited 0 without fixing anything.
* scripts/tests/fix-workflow-pins.sh: 19 new contracts — the review cases
  above, a partial migration where two callers share a stale SHA, the
  one-header merge, a mawk run when mawk is installed, a 39-hex key, and a
  parser failure. 47 pass under gawk and under mawk.

Workflows: hypatia-scan passes HYPATIA_SCAN_PAT by name, mirror the seven
forge keys mirror-reusable declares, secret-scanner none (WH008 ×3).

.gitleaksignore: six fingerprints of two documented placeholders (the
seambot `ghs_xxx…` test token and a deleted sustainabot setup doc's
`-----BEGIN PRIVATE KEY-----` template) that the scanner reports on every
run.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

All four matrix crates (robot-repo-automaton, shared-context, dashboard,
bots/rhodibot) are rustfmt-clean today, so the `continue-on-error: true`
that kept the check informational (hypatia RE005 on this file) only hid a
future regression. Dropped.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…teps, anchor stale-pin callers

fix-rust-toolchain-input.sh (WF026 repair):
- only a `uses:` at the step's key column is the step's action; the same
  text nested under `env:` or inside a `run: |` script that writes a fixture
  is data and is left alone (it was being "fixed" in place);
- quoted keys count: `"uses":` and `"with":` are the same keys to GitHub;
- a bare `-` on its own line opens a step, so a `with:` written under it
  and above `uses:` is seen;
- a tag ref that starts with hex digits (`@1.85.0`) is a tag, not a SHA:
  the old `[0-9a-f]+` tail took it for a pin and would have inserted
  `toolchain: stable` over the version the ref names;
- a flow-style step (`- { name: x, uses: ... }`) is UNSUPPORTED: the file
  is left untouched, the line is named on stderr and the run exits 2.
  Before this it reported "OK (every SHA-pinned dtolnay step names a
  toolchain)" for a step that names none — silent green.

fix-stale-reusable-pin.sh:
- only a YAML `uses` key at the start of a line (quoted or bare, list dash
  or not) is a caller: a commented-out caller moves nothing, in the
  workflow or in the lock;
- when the workflow still calls another reusable of the same repository at
  the stale SHA (a pin the table does not cover), the lock edge for the
  replacement is added beside the stale one instead of replacing it, so
  the lock stays consistent with the workflow.

tests: 15 new contracts in scripts/tests/fix-workflow-pins.sh (62 total),
run under gawk and, where installed, mawk. shellcheck clean.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

… lock edges, reusable sources from workflows

fix-rust-toolchain-input.sh:
- a list item opens a step only when its parent key is `steps:`; a block
  scalar outside any step (a fixture kept in `env:`, even one spelling out
  `steps:` inside) is text and is never touched;
- a flow `with: {` spread over several lines is read to its closing brace:
  a toolchain inside it counts, and without one the input becomes the
  first entry instead of a duplicate key.

fix-stale-reusable-pin.sh:
- a known-dead pin the parser cannot place as a `uses` key (a flow-style
  job `rust: { uses: ... }`) makes the file UNSUPPORTED: untouched, named
  with its line, exit 2 — before this it reported OK and left the pin;
- a nested `uses:` edge of another record still pointing at the stale SHA
  keeps the stale record (it is copied, not renamed), so a reusable that
  itself calls the stale revision keeps the record it needs.

fix-lock-self-sha-refs.sh:
- reusable-workflow sources are read from the workflows' own reusable
  `uses:` lines (plus standards and cicd-suite), so a SHA-pinned reusable
  from any repository keeps its SHA ref instead of being reported
  unresolved or rewritten to a tag.

tests: 9 new contracts (72 total), shellcheck clean.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…rds, safe tags, YAML context for stale pins

fix-rust-toolchain-input.sh:
- a flow `with: {` closes when its brace depth returns to zero, not at the
  first `}`: an expression `${{ matrix.x }}` inside it no longer hides a
  toolchain written after it (which would have been duplicated);
- a `with:` whose value the parser does not read (`with: &anchor`,
  `with: *alias`) is UNSUPPORTED rather than shadowed by a second `with:`;
- a one-line `steps: [ { uses: ... } ]` key line carrying a SHA pin is
  UNSUPPORTED instead of reporting the file clean.

fix-lock-self-sha-refs.sh:
- a record's class is per repository@revision, read from how the
  workflows use it: a reusable call keeps its SHA ref, a composite action
  from the same repository at another revision is repaired; records no
  workflow uses fall back to the two estate sources by name;
- double-quoted record keys and refs are parsed and repaired with their
  quote style kept;
- a resolved tag carrying `&`, `|` or a quote is refused (UNRESOLVED)
  rather than written through sed into YAML.

fix-stale-reusable-pin.sh:
- a YAML-context pass marks job-level `uses:` keys, data `uses:` keys and
  block-scalar lines; only a key of a job under `jobs:` is rewritten (per
  line), the same text under `env:` or inside a `run: |` fixture is left
  byte-identical and never moves the lock; a covered pin the parser cannot
  place is still UNSUPPORTED.

tests: 11 new contracts (81 total), shellcheck clean.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…s, unspaced # stays in the ref

Codex round on 0125570.

- lib/pin-fixer-lock.sh: pin_fixer_replace <tmp> <dest> replaces a file
  the way `sed -i` does: by a rename, with <dest>'s mode and, where this
  user may set them, its owner and group. The five `mv "$tmp" ...` sites
  (the toolchain fixer's workflow, the stale-pin fixer's lock writes and
  merger, the self-SHA fixer's lock) use it; a mktemp file is 0600, and
  renamed as it was it left a 0644 workflow or lock unreadable to the
  checkout's other users.
- fix-stale-reusable-pin.sh: a table row whose replacement equals its
  stale SHA is refused at preflight; it repaired nothing yet reported every
  matching caller FIXED on every run.
- fix-lock-self-sha-refs.sh: a `uses:` value ends at a quote or whitespace,
  not at an unspaced `#`, so `.../x.yml@<sha>#patched` is no reusable call
  at <sha> keeping an action's self-SHA record from its tag.

Tests: 5 new contract cases (ls28, sp34, three mode checks at 0640), each
failing on 0125570. Suite: 221 + 91 passed under gawk and mawk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…oolchain matched in either case, keep-edge check bounded

Codex round on f25a572.

- fix-rust-toolchain-input.sh: the action is matched in either case
  (prefilter, sha_ref, the uses-key regexes), as GitHub resolves
  `Dtolnay/Rust-Toolchain` to the same action; such a step is repaired and
  keeps its spelling instead of exiting 0 unread. A step's own `uses:`
  whose value continues below the key (`uses: >-`, or the reference alone
  on the next line) is UNSUPPORTED (exit 2, untouched) instead of passed
  over as a step that names its toolchain.
- fix-stale-reusable-pin.sh: yaml_context marks the continuation of a
  job's open `uses:` value `U`; a known-dead pin there is UNSUPPORTED
  instead of skipped as scalar text and reported OK. The check that keeps
  the stale lock edge for another caller of the same repository matches the
  repository literally and the SHA to its end, so `<stale>-patched` no
  longer keeps the stale edge and record beside the replacement.
- fix-lock-self-sha-refs.sh: a site-position `uses:` with an open value
  emits `F`; the run refuses (exit 2, lock untouched) instead of reading
  the record as `unknown` and retagging a non-estate reusable's SHA ref.

Tests: 7 new contract cases (tc23-tc25, sp35, sp36, ls29, ls30), each
failing on f25a572; controls tc26 and ls31 (the same text inside a
`run: |` script) pass on both. Suite: 230 + 91 passed under gawk and mawk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…ted before it is written

Codex round on 6dda1e0.

- fix-rust-toolchain-input.sh: anchors whose value is a SHA-pinned
  toolchain reference are noted wherever they are defined; a step's own
  `uses: *name` of one is UNSUPPORTED (exit 2, untouched) instead of
  emitted unchanged as fine. TOOLCHAIN must be a toolchain name (letters,
  digits, `.`, `_`, `-`), else exit 2 with nothing changed: a newline or
  YAML punctuation could add a key or end the value. A number YAML would
  read as a float (`1.80`) is written quoted.
- fix-lock-self-sha-refs.sh: a `uses: *name` site (block or flow) is
  classified by its anchor's value (`&name owner/repo@ref`, recorded as
  the file is read), so a reusable called through an alias keeps its SHA
  ref; an alias of no anchor read is refused (exit 2, lock untouched).
- fix-stale-reusable-pin.sh: a job's `uses: *name` whose anchor holds a
  known-dead pin is UNSUPPORTED instead of skipped and reported OK.

Tests: 6 new contract cases (tc27-tc29, sp37, ls32, ls33), each failing
on 6dda1e0. Suite: 236 + 91 passed under gawk and mawk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

… reads as non-strings are quoted

Codex round on 8e9d4cd.

- lib/yaml-anchors.awk (new): anchor_defs(line, defs), the anchors a line
  defines, read outside quoted scalars and comments, with quoted and plain
  values. The three fixers prepend it to their awk programs (POSIX awk,
  mawk-safe) instead of matching `&name` in raw text, so `&call` inside
  `NOTE: "fixture &call ..."` is text:
  - fix-lock-self-sha-refs.sh: such text no longer overwrites the real
    anchor, so `uses: *call` of a reusable keeps its SHA ref; a later real
    anchor of the same name still replaces an earlier one;
  - fix-stale-reusable-pin.sh: the alias resolves to the last anchor above
    it (block-scalar content skipped), so a quoted fixture naming a dead
    pin no longer makes a live alias UNSUPPORTED;
  - fix-rust-toolchain-input.sh: the same reader, block scalars skipped.
- fix-rust-toolchain-input.sh: a TOOLCHAIN that YAML would read as anything
  but a string, a number (`1.80`, `0x1f`) or a null or boolean spelling
  (`null`, `true`, `no`, ...), is written single-quoted; `toolchain: null`
  was an empty input and every rerun reported it FIXED.

Tests: 4 new contract cases (tc30, tc31, sp38, ls34), each failing on
8e9d4cd. Suite: 240 + 91 passed under gawk and mawk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…ted uses: list header; non-string tags quoted

Codex round on 64c887c.

- lib/yaml-anchors.awk: `&name` is an anchor only where a YAML node can
  start (line start or after list dashes, after `key: `, after `[`, `{`
  or `,` inside a flow collection, past any tag), so `&call` inside a
  plain scalar (`NOTE: fixture &call ...`) is text and no longer
  overwrites a real anchor for the self-SHA fixer.
- fix-rust-toolchain-input.sh: anchor names keep their case (`&Rust` is
  not `&rust`); an alias of no anchor read, in a file that carries a
  SHA-pinned toolchain reference, is UNSUPPORTED instead of passed over.
- fix-stale-reusable-pin.sh: the record merger takes `uses: # comment` as
  the nested list header (the first spelling, comment kept) and collects
  entries only inside a list it opened, so a merged record no longer gets a
  second `uses:` key.
- lib/pin-fixer-lock.sh: pin_fixer_yaml_nonstring, the one rule for a
  value YAML would read as a number, null or boolean; TOOLCHAIN uses it,
  and fix-lock-self-sha-refs.sh now quotes such a tag (`true`, `1`, `null`)
  written into a plain `ref:` field.

Tests: 5 new contract cases; tc32, sp39, ls35 and ls36 fail on 64c887c,
tc33 guards the stricter anchor reader. Suite: 245 + 91 passed under gawk
and mawk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…flock falls back to a mkdir lock

merge_duplicate_records read only block-style nested `uses:` lists. A
record spelled `uses: []` kept that line as a header field and then got a
second, block `uses:` key when a duplicate's entries were folded in; a
flow list on the duplicate was dropped with the duplicate. One-line flow
lists now merge like block lists, and a merged record has one `uses:` key
(a lone flow list nothing was merged into is kept as written). A
duplicated record whose `uses:` the merger cannot read (multi-line flow,
alias, scalar) is not folded: it is named UNSUPPORTED and the run exits 2.

pin_fixer_lock proceeded unlocked when flock was missing. It now takes an
atomic mkdir lock on the same key instead, removed by the holder's EXIT
trap; a held one is waited for, reported with its recorded pid, and the
fixer exits 2 having changed nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…ues, unread aliases and transitive records refused; timestamp tags quoted

- merge_duplicate_records keyed records by their spelling, so
  `Fixture/Repo@<sha>` renamed beside `fixture/repo@<sha>` left two
  records for one dependency. Keys and nested entries now compare as
  GitHub resolves them (repository and commit ID case-folded; a tag is
  a name), the first spelling kept.
- fix-rust-toolchain-input: a `with:` whose value is written on the
  next line as a flow mapping or alias (`{ components: rustfmt }`,
  `*inputs`) was taken for a block mapping and given a block child —
  invalid YAML, exit 0. The first child must now be a block mapping key;
  anything else is reported UNSUPPORTED, file untouched.
- fix-stale-reusable-pin: the anchor reader is line-local, so `&call`
  after another item of a flow sequence begun on an earlier line went
  unseen and `uses: *call` passed as OK. An alias it cannot resolve, in a
  file holding a known-dead pin, is now reported UNSUPPORTED (exit 2).
- pin_fixer_yaml_nonstring also recognises timestamps (`2026-10-20`),
  signed and dotted numbers, base 60, .inf/.nan, `~` and the empty
  value, so such a tag or TOOLCHAIN is written quoted.
- fix-lock-self-sha-refs treated every record no workflow here uses as
  an action and could rewrite a nested reusable's legitimate SHA ref.
  Only a workflow site proves an action now; any other record (bar the
  two estate reusable sources) is UNRESOLVED and left as is. Lock-only
  test fixtures gain the step that makes their record an action.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

… passed as OK

The fixers knew a `uses:` value could carry an anchor (`uses: &rust
...`) but not a tag: `uses: !!str dtolnay/rust-toolchain@<sha>` and
`uses: !!str <reusable>@<dead>` matched no site, so both fixers reported
the file clean while the pin stood (found while answering hypatia#931,
whose WF026/WF027 and pin readers now see such values).

- fix-rust-toolchain-input / fix-stale-reusable-pin: node properties —
  an anchor or a tag, either order, repeated — are read before the value
  (USES_SITE_RE, USES_OPEN_RE, ANCHOR_RE, and the quote masks, so a
  quoted value after a tag is still the `uses` value). Such a value is
  reported UNSUPPORTED, exit 2, file untouched, as an anchored one was.
- fix-lock-self-sha-refs: a step whose value carries a tag still proves
  its record an action, so the classification no longer depends on the
  spelling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…w-step inputs prove no action; `- # comment` opens a step

- fix-lock-self-sha-refs: a record key with spaces after its colon — a
  carriage return included, in a lock with CRLF endings — was no record,
  so a self-SHA action ref passed as OK. Trailing whitespace is now no
  part of the key; the rewrite keeps the line's ending.
- fix-stale-reusable-pin: on a CRLF lock every pass reads `$`-anchored
  lines and found no record, so the merger dropped every dependency
  record. The lock is now edited as LF and written back with CRLF; the
  result matches its LF twin line for line.
- fix-lock-self-sha-refs: in a flow `steps: [...]` any `uses` beneath
  the sequence counted as an action site, so an input
  (`with: { uses: foo/bar/...@<sha> }`) could prove a nested reusable an
  action and have its legitimate SHA ref rewritten. Only the `uses` of a
  mapping that is itself an item of the steps sequence counts.
- fix-rust-toolchain-input: a step opened by `- # install Rust` took the
  comment for its first key, so its `uses:` failed the key-column check
  and the step was refused. A dash followed only by a comment is a bare
  opener.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…chor values decoded; merger keys tolerate trailing spaces

- pin-fixer-lock: a run with flock locked `pin-fixer-<key>.lock` and one
  without locked `pin-fixer-<key>.lock.d`, so a host and a minimal
  container sharing a checkout could both enter. Every fixer now holds
  the directory sentinel; one with flock takes the flock first as well.
- lib/yaml-anchors.awk: a double-quoted anchor value kept its escapes
  raw, so `&call "\x68yperpolymath/..."` (YAML reads it as the dead
  reusable) resolved to text no reference regex matched and both fixers
  passed the alias as OK. Escapes are decoded as YAML reads them (ASCII
  as itself, anything else to a byte no reference holds); the toolchain
  fixer's prefilter lets a file holding such an escape through.
- merge_duplicate_records: a record key with trailing spaces after its
  colon was no record, so the record and its fields could vanish from
  the rewritten lock. Keys and nested entries are read without trailing
  whitespace.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…ds kept or refused; column-0 flow calls never passed as data

- lib/yaml-anchors.awk: yaml_decode_dq decodes a line's double-quoted
  scalars as YAML reads them (an escaped quote to a byte no reference
  holds, so the scalars a reader sees are unchanged).
- fix-rust-toolchain-input.sh: a step's `uses: "\x64tolnay/..."` is the
  SHA-pinned toolchain step it spells, and gets its input; detection reads
  the decoded line.
- fix-stale-reusable-pin.sh:
  - a dead reusable spelled with escapes in a double-quoted `uses:` value,
    or given as a quoted value continued below its key, is UNSUPPORTED
    (exit 2), never OK;
  - inside a flow collection opened above, a `uses:` key line the
    indentation reads as data is left unplaced, so the fallback reports it:
    `jobs: {` / `rust: {` / `uses:` all in column 0 is a call. The indented
    KYAML form is still rewritten;
  - merger: a record written as a flow mapping on its key line, or any
    other unread line at record indentation, is kept as written in its
    place. The merge is refused when that record's dependency is listed
    again, or when a folded-away duplicate holds a line with no rule.
    `workflows:` after `dependencies:` ends the section and is written
    after the records;
  - a `workflows:` key with trailing whitespace is that workflow's entry.
- fix-lock-self-sha-refs.sh: a self-SHA record written as a flow mapping
  on its key line has its ref rewritten inside the braces; one spread over
  several lines is UNRESOLVED unless its SHA ref is one to keep.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8

…ry reader; flow-mapping stale records renamed; WF016 overclaim corrected

- A doubled quote inside a single-quoted scalar ('it''s }}') is a quote,
  not the scalar's end, in every quote walk of the three fixers. The stale-
  pin fixer's flow-depth tracker no longer closes a column-0 flow job on
  braces inside such a string and passes its dead call as data.
- fix-rust-toolchain-input.sh: any backslash lets a file past the
  prefilter, so `"dtolnay\/rust-toolchain@<sha>"` reaches the decoder.
- fix-lock-self-sha-refs.sh: workflow lines are read YAML-decoded, so a
  step's `uses: "\x66oo/bar@<sha>"` proves the action its record names.
- fix-stale-reusable-pin.sh: a stale dependency record written as a flow
  mapping on its key line is renamed with its caller (key, ref, commit).
- AGENTIC.a2ml and the fixer's header no longer claim WF016: its orphan
  SHAs have no replacement recorded in stale-reusable-pins.tsv, so routing
  WF016 to this fixer would end in a clean run with the pin untouched. A
  contract test now checks that every rule AGENTIC assigns to a pin fixer
  is the registry's route to it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8