[skip ci] Reconcile and guard locked dependency metadata

.github/workflows/ci.yml

@@ -37,6 +37,10 @@ jobs:
         with:
           key: ${{ matrix.toolchain }}
 
+      - name: Check locked dependency metadata
+        run: |
+          cargo update --workspace --locked
+
       - name: Check formatting
         run: cargo fmt --all -- --check
 

Taskfile.yml

@@ -1,6 +1,11 @@
 version: '3'
 
 tasks:
+  ci:lock:
+    desc: Resolve owning dependency metadata without permitting lockfile changes
+    cmds:
+      - cargo update --workspace --locked
+
   ci:workflows:
     desc: Check workflow expression scopes using an explicitly installed actionlint 1.7.12
     requires:

docs/work/137/03-lock-metadata.json

@@ -0,0 +1,24 @@
+{
+  "schema_version": "egohygiene.ci-lock-metadata-observation/v1",
+  "observations": [
+    {
+      "owner": "flow",
+      "toolchain": "1.85.0",
+      "command": [
+        "+1.85.0",
+        "update",
+        "--workspace",
+        "--locked",
+        "--offline"
+      ],
+      "exit": 0,
+      "lock_sha256": "b7a16689cb7ec533bb4a50bf14e1035a2bf5d123e0491f5f63d6cb675891c1ac",
+      "lock_unchanged": true,
+      "scope": "dependency metadata resolution only; no build scripts, compiler, linter or tests"
+    }
+  ],
+  "builds_run": false,
+  "tests_run": false,
+  "clippy_run": false,
+  "hosted_ci_dispatched": false
+}

docs/work/137/03-lock-metadata.md

@@ -0,0 +1,27 @@
+# Flow #137 checkpoint 3 — flow, November 13, 2026
+
+Cargo 1.85.0 retains the existing lock byte-for-byte. The new guard makes that metadata check explicit before compilation.
+
+The maintainer selected the lock/format checkpoints, authorizing generated-source
+maintenance. `cargo update --workspace` refreshed the owning metadata; registry
+index metadata was read, with no package build scripts, product compiler or tests.
+The subsequent explicit-toolchain `update --workspace --locked --offline` exited
+successfully with the exact lock SHA-256 unchanged. The adjoining JSON records
+that narrow observation. It is not all-target compilation, native qualification,
+a security-policy result or proof that every locked dependency supports the MSRV.
+
+`task ci:lock` and the existing CI lanes now enforce `--locked` metadata resolution;
+Optiflow also checks its separate fuzz workspace. CI does not remove `--locked`
+to pass or regenerate its expectations. A cold local index needs a separately
+allowed metadata preparation step before adding `--offline`; the CI alias can
+read registry metadata to avoid treating a missing cold cache as a source defect.
+
+No Cargo manifest requirements, feature or MSRV policy changes here. All five
+owning lockfiles were inspected/resolved across the suite; clean files were not
+rewritten gratuitously. The separate Identity workspace is outside this product
+checkpoint. Tooling was installed into a task-private directory solely for
+Cargo metadata generation and the following formatting source edits.
+
+Tests/builds, Clippy and native/hosted execution remain deferred. Before closing
+checkpoint 3, run the selected locked compiler/build/conformance lanes when
+authorized; this metadata result alone cannot establish a green Actions suite.