diff --git a/.machine_readable/Debtfile.a2ml b/.machine_readable/Debtfile.a2ml
index 3f2b1f24..cbf5061e 100644
--- a/.machine_readable/Debtfile.a2ml
+++ b/.machine_readable/Debtfile.a2ml
@@ -48,6 +48,16 @@ forgotten.
 
 ## Hygiene
 
+### shell-scripts-missing-spdx
+- description: Shell scripts under scripts/ without an SPDX-License-Identifier in the first three lines
+- probe: n=0; for f in $(git ls-files 'scripts/*.sh'); do head -3 "$f" | grep -q 'SPDX-License-Identifier' || n=$((n+1)); done; echo "$n"
+- count: 0
+- ceiling: 1
+- severity: medium
+- policy: remediable
+- tri: eliminate
+- accepted-until: 2026-10-01
+
 ### todo-fixme-markers
 - description: Files carrying a TODO or FIXME marker. Advisory — a marker is a note to self, not a defect Re-baselined 2026-09-22 (round 2, issue #953): fossilized at 77, measured 80. Probe corrected 2026-10-06: `*.ncl.in` templates are excluded, because their `TODO` fields are placeholders by design (copy, then fill in every TODO), not notes to self; measured 84.
 - probe: git grep -I -l -E '\b(TODO|FIXME)\b' -- . ':(exclude).machine_readable/Debtfile.a2ml' ':(exclude)docs/DEBTFILE-SPEC.adoc' ':(exclude)*.ncl.in' | wc -l
@@ -61,10 +71,10 @@ forgotten.
 ## Vendored mirrors
 
 ### vendored-mirror-unpinned-actions
-- description: Unpinned `uses:` refs inside `9-archive/rhodium-standard-repositories/**` -- the vendored mirror of the RSR canon (gitlab.com/hyperpolymath/rhodium-standard-repositories). These are OTHER repositories' workflows reproduced here as templates, and this repo's own CI lock gate (.github/workflows/actions-lock-gate.yml -> .githooks/validate-actions-lock.sh) covers only the root .github tree, so `.githooks/validate-sha-pins.sh` matches that scope and skips the mirror rather than silently passing it. Re-pinning the mirror here fixes no live runner and desynchronises the copy; it is fixed upstream, or the mirror retires. MEASURED 2026-09-21 by the probe.
-- probe: n=$(git ls-files '9-archive/rhodium-standard-repositories' | grep -E '/\.github/(workflows|actions)/.*\.ya?ml$' | xargs -r grep -hE '^[[:space:]]*(-[[:space:]]*)?uses:[[:space:]]+[A-Za-z0-9]' | grep -vcE '@[0-9a-f]{40}([^0-9a-f]|$)' || true); echo "${n:-0}"
-- count: 40
-- ceiling: 40
+- description: Unpinned `uses:` refs inside `rhodium-standard-repositories/**` -- the vendored mirror of the RSR canon (gitlab.com/hyperpolymath/rhodium-standard-repositories). These are OTHER repositories' workflows reproduced here as templates, and this repo's own CI lock gate (.github/workflows/actions-lock-gate.yml -> .githooks/validate-actions-lock.sh) covers only the root .github tree, so `.githooks/validate-sha-pins.sh` matches that scope and skips the mirror rather than silently passing it. Re-pinning the mirror here fixes no live runner and desynchronises the copy; it is fixed upstream, or the mirror retires. MEASURED 2026-09-21 by the probe.
+- probe: n=$(git ls-files 'rhodium-standard-repositories' | grep -E '/\.github/(workflows|actions)/.*\.ya?ml$' | xargs -r grep -hE '^[[:space:]]*(-[[:space:]]*)?uses:[[:space:]]+[A-Za-z0-9]' | grep -vcE '@[0-9a-f]{40}([^0-9a-f]|$)' || true); echo "${n:-0}"
+- count: 42
+- ceiling: 42
 - severity: low
 - policy: flag-only
 - tri: eliminate