From 772296c860beac6398100c7c5eaa2120b06edf2c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 19 Oct 2026 16:41:19 +0000
Subject: [PATCH 1/2] ci(scratch): one-off actions.lock regeneration for the
 lock-repair branch (not for merge)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
---
 .github/workflows/zz-one-off-lock-regen.yml | 46 +++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/zz-one-off-lock-regen.yml

diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml
new file mode 100644
index 00000000..4597603a
--- /dev/null
+++ b/.github/workflows/zz-one-off-lock-regen.yml
@@ -0,0 +1,46 @@
+# SPDX-License-Identifier: MPL-2.0
+# ONE-OFF, scratch branch only, deleted after use. Regenerates main's
+# actions.lock with the estate repair order (regen_lock in
+# standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own
+# check against the result, and prints the lock base64-encoded. It has no
+# `uses:` steps, so it needs no lock entry to start. It writes nothing back:
+# the lock reaches the repository in a reviewed PR.
+name: one-off actions.lock regeneration
+on:
+  push:
+    branches: [claude/new-session-th4e9w-lockregen]
+permissions:
+  contents: read
+jobs:
+  regen:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPO: ${{ github.repository }}
+      STANDARDS_REGEN_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7
+      STANDARDS_GATE_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7
+    steps:
+      - name: Regenerate the repair branch's actions.lock and check it with the gate
+        run: |
+          set -uo pipefail
+          git clone --quiet --branch claude/new-session-th4e9w-lock-repair "https://github.com/$REPO.git" pb
+          git -C pb log --oneline -1
+          git clone --quiet https://github.com/hyperpolymath/standards.git std
+          git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA"
+          git -C std worktree add --quiet --detach ../std-gate "$STANDARDS_GATE_SHA"
+          sudo apt-get install -y -qq gawk >/dev/null
+          gh extension install github/gh-actions-lock --pin v0.2.0
+          gh actions-lock --version
+          export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts"
+          source std-regen/scripts/regen-dependabot-locks.sh
+          outcome="$(regen_lock "$PWD/pb")"
+          echo "OUTCOME=$outcome"
+          git -C pb status --porcelain
+          echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)"
+          (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \
+            bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?"
+          echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)"
+          echo "LOCK-BEGIN"
+          base64 -w0 pb/.github/workflows/actions.lock; echo
+          echo "LOCK-END"

From 6ebf24381d8f325b627a0331a028f85dcdcbfd20 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 19 Oct 2026 16:46:00 +0000
Subject: [PATCH 2/2] ci(scratch): repair chain only, print the diff (not for
 merge)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
---
 .github/workflows/zz-one-off-lock-regen.yml | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml
index 4597603a..9b8867d0 100644
--- a/.github/workflows/zz-one-off-lock-regen.yml
+++ b/.github/workflows/zz-one-off-lock-regen.yml
@@ -32,15 +32,17 @@ jobs:
           sudo apt-get install -y -qq gawk >/dev/null
           gh extension install github/gh-actions-lock --pin v0.2.0
           gh actions-lock --version
-          export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts"
-          source std-regen/scripts/regen-dependabot-locks.sh
-          outcome="$(regen_lock "$PWD/pb")"
-          echo "OUTCOME=$outcome"
+          # The repair chain without a gh actions-lock fix-mode pass (it drops
+          # records it cannot re-resolve).
+          export GH_BIN=gh
+          for s in relock-sha-keys complete-job-refs close-lock prune-stale check-lock-sync; do
+            (cd pb && bash ../std-regen/scripts/$s.sh .github/workflows; echo "$s RC=$?")
+          done
           git -C pb status --porcelain
           echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)"
           (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \
             bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?"
           echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)"
-          echo "LOCK-BEGIN"
-          base64 -w0 pb/.github/workflows/actions.lock; echo
-          echo "LOCK-END"
+          echo "DIFF-BEGIN"
+          git -C pb diff -- .github/workflows/actions.lock
+          echo "DIFF-END"