diff --git a/.machine_readable/Debtfile.a2ml b/.machine_readable/Debtfile.a2ml
index d1c47b490..3f2b1f244 100644
--- a/.machine_readable/Debtfile.a2ml
+++ b/.machine_readable/Debtfile.a2ml
@@ -63,8 +63,8 @@ forgotten.
 ### vendored-mirror-unpinned-actions
 - description: Unpinned `uses:` refs inside `9-archive/rhodium-standard-repositories/**` -- the vendored mirror of the RSR canon (gitlab.com/hyperpolymath/rhodium-standard-repositories). These are OTHER repositories' workflows reproduced here as templates, and this repo's own CI lock gate (.github/workflows/actions-lock-gate.yml -> .githooks/validate-actions-lock.sh) covers only the root .github tree, so `.githooks/validate-sha-pins.sh` matches that scope and skips the mirror rather than silently passing it. Re-pinning the mirror here fixes no live runner and desynchronises the copy; it is fixed upstream, or the mirror retires. MEASURED 2026-09-21 by the probe.
 - probe: n=$(git ls-files '9-archive/rhodium-standard-repositories' | grep -E '/\.github/(workflows|actions)/.*\.ya?ml$' | xargs -r grep -hE '^[[:space:]]*(-[[:space:]]*)?uses:[[:space:]]+[A-Za-z0-9]' | grep -vcE '@[0-9a-f]{40}([^0-9a-f]|$)' || true); echo "${n:-0}"
-- count: 42
-- ceiling: 42
+- count: 40
+- ceiling: 40
 - severity: low
 - policy: flag-only
 - tri: eliminate