@@ -40,8 +40,8 @@ A full-directory run (`gh actions-lock` with no path arguments) also prunes lock
 Locked pins are sticky: a normal run only re-resolves refs the lockfile does
 not record yet. Every locked pin, including transitive ones, is re-checked the
 way the runner checks it at job start: the repository was not renamed or
-transferred, the pinned commit still exists, and full-version tags (e.g.
-`v4.2.1`) still point at it. A failed check blocks the run.
+transferred, the pinned commit still exists, and it is still in the history of
+the tag or branch the lockfile recorded. A failed check blocks the run.
 
 Writes are all or nothing: if a run finds any error it cannot fix itself, it
 changes no workflow and no lockfile entry, not even for workflows that are
@@ -53,8 +53,20 @@ To check without writing anything, for example in CI, run:
 gh actions-lock --verify
 ```
 
-`--verify` also checks that a commit locked under a branch or partial version
-(e.g. `main`, `v4`) is still in that ref's history. `--verify-local` runs
+Every mode checks each locked commit against the lockfile entry's `ref`, which
+is looked up only as an existing tag, then branch, of exactly that name, the
+way the Actions backend resolver does. Every pin, whether an exact tag
+(`v4.2.1`), a partial version (`v4`), a branch (`main`) or a full SHA (`uses:
+owner/repo@<sha>`), must have its commit in that ref's history, so a fork
+commit can't pass as upstream. Tags can move: the Actions backend accepts an
+exact tag that moved ahead of the commit, so runs allow it and `--verify` only
+warns. A lockfile entry whose `ref` the Actions backend resolver would reject
+fails the run (exit 2), naming the entry and its line: it must be a short tag
+or branch name the backend accepts, never a SHA, a `refs/` name, revision
+syntax such as `main~1`, or a `git describe` name, and it must equal the
+`uses:` ref unless that is a full SHA. A `uses:` ref that is not such a tag or
+branch, such as `pull/1/head` or `main~1`, is never locked.
+`--verify-local` runs
 offline, never writes, and only checks that every ref has a lockfile entry,
 not that the entries are trustworthy; use `--verify` in CI for that.
 
 
@@ -2,6 +2,7 @@ package main
 
 import (
 	"bytes"
+	"cmp"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -95,6 +96,8 @@ func TestCheck_BareSHAUsesExactMajorTagAndVerifiesLocally(t *testing.T) {
 	)
 
 	reg := &httpmock.Registry{}
+
+	httpmock.NoTagsNamed(reg, "dawidd6", "action-download-artifact")
 	reg.Register(
 		httpmock.GraphQLForRepo("dawidd6", "action-download-artifact"),
 		httpmock.JSONResponse(map[string]any{
@@ -211,9 +214,11 @@ func testRepoResponse(nameWithOwner, oid, actionYAML string) map[string]any {
 	return map[string]any{
 		"nameWithOwner": nameWithOwner,
 		// commit, tag and head answer the parity query from the same fixture.
-		"commit": map[string]any{"oid": oid},
-		"tag":    map[string]any{"oid": oid},
-		"head":   map[string]any{"oid": oid},
+		"commit":  map[string]any{"oid": oid},
+		"tag":     map[string]any{"oid": oid},
+		"tagRef":  map[string]any{"oid": oid},
+		"head":    map[string]any{"oid": oid},
+		"headRef": map[string]any{"oid": oid},
 		"object": map[string]any{
 			"oid": oid,
 			"file": map[string]any{
@@ -250,7 +255,9 @@ func parityOK(req *http.Request) (*http.Response, error) {
 			"nameWithOwner": owner + "/" + body.Variables[fmt.Sprintf("name%d", i)].(string),
 			"commit":        oid,
 			"tag":           oid,
+			"tagRef":        oid,
 			"head":          oid,
+			"headRef":       oid,
 		}
 	}
 	return httpmock.JSONResponse(map[string]any{"data": data})(req)
@@ -314,26 +321,26 @@ func writeTempWorkflow(t *testing.T, body string, pins ...string) string {
 // pinString has the form "owner/repo@ref" (the v0.0.2 pin key format).
 // A synthetic commit hash is generated from the pin key for each entry.
 // The ref field in each action body matches the pin key's ref. Overrides
-// can pass "owner/repo@ref=sha1-hex" to supply an explicit commit.
+// can pass "owner/repo@ref=sha1-hex" to supply an explicit commit, and
+// "owner/repo@ref=sha1-hex=ref" to record a different ref (a full-SHA key
+// must record the tag or branch its commit came from).
 func writeTempLockfile(t *testing.T, repoDir, wfName string, pinStrings []string) {
 	t.Helper()
 	var sb strings.Builder
 	sb.WriteString("version: '" + parserlock.Version + "'\ndependencies:\n")
 	for _, raw := range pinStrings {
-		key, commit := raw, ""
-		if idx := strings.Index(raw, "="); idx >= 0 {
-			key = raw[:idx]
-			commit = raw[idx+1:]
-		}
+		key, commit, _ := strings.Cut(raw, "=")
+		commit, ref, _ := strings.Cut(commit, "=")
 		pin, ok := parserlock.ParsePin(key)
 		if !ok {
 			t.Fatalf("writeTempLockfile: invalid pin %q", key)
 		}
+		ref = cmp.Or(ref, pin.Ref)
 		if commit == "" {
 			// Generate deterministic fake commit from pin key.
 			commit = "sha1-" + strings.Repeat(string("abcdef0123456789"[len(key)%16]), 40)
 		}
-		sb.WriteString("  '" + key + "':\n    ref: '" + pin.Ref + "'\n    commit: '" + commit + "'\n    owner_id: 1\n    repo_id: 1\n")
+		sb.WriteString("  '" + key + "':\n    ref: '" + ref + "'\n    commit: '" + commit + "'\n    owner_id: 1\n    repo_id: 1\n")
 	}
 	sb.WriteString("workflows:\n  '.github/workflows/" + wfName + "':\n")
 	for _, raw := range pinStrings {
@@ -1477,3 +1484,98 @@ jobs:
 	_, _, err = runCommandWithHTTP(t, &httpmock.Registry{}, "--verify-local", workflowPath)
 	require.ErrorIs(t, err, errSilent, "an unlocked bare SHA must not pass the offline gate")
 }
+
+// TestFreshMalformedRemoteRefCannotOnboard: a remote-looking uses: value the
+// parser rejects is never skipped, in a workflow or a $/ composite, in
+// any mode or transport. Nothing is fetched or written.
+func TestFreshMalformedRemoteRefCannotOnboard(t *testing.T) {
+	for _, rejected := range []string{"actions/checkout@main:action.yml", "actions/checkout/.github/workflows/ci.yml@v4"} {
+		t.Run(rejected, func(t *testing.T) { testMalformedRemoteRefCannotOnboard(t, rejected) })
+	}
+}
+
+func testMalformedRemoteRefCannotOnboard(t *testing.T, rejected string) {
+	for _, surface := range []string{"workflow", "self composite"} {
+		for _, proxy := range []bool{false, true} {
+			for _, refresh := range []bool{false, true} {
+				t.Run(fmt.Sprintf("%s/proxy=%t/refresh=%t", surface, proxy, refresh), func(t *testing.T) {
+					if proxy {
+						t.Setenv("GH_ACTIONS_LOCK_DEPENDABOT_PROXY", "1")
+					}
+					dir := t.TempDir()
+					require.NoError(t, os.Mkdir(filepath.Join(dir, ".git"), 0o755))
+					workflowPath := filepath.Join(dir, ".github", "workflows", "ci.yml")
+					require.NoError(t, os.MkdirAll(filepath.Dir(workflowPath), 0o755))
+					use := rejected
+					var actionPath string
+					var action []byte
+					if surface == "self composite" {
+						use = "$/outer"
+						actionPath = filepath.Join(dir, "outer", "action.yml")
+						action = []byte("runs:\n  using: composite\n  steps:\n    - uses: " + rejected + "\n")
+						require.NoError(t, os.MkdirAll(filepath.Dir(actionPath), 0o755))
+						require.NoError(t, os.WriteFile(actionPath, action, 0o600))
+					}
+					workflow := []byte("on: push\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: " + use + "\n")
+					require.NoError(t, os.WriteFile(workflowPath, workflow, 0o600))
+					t.Chdir(dir)
+					transport := &requestCountingTransport{}
+					args := []string{"--no-interactive", "--no-narrow", workflowPath}
+					if refresh {
+						args = append(args, "--relock", "--accept-moved")
+					}
+
+					_, stderr, err := runCommandWithHTTP(t, transport, args...)
+
+					assert.Error(t, err, stderr)
+					assert.Contains(t, stderr, rejected)
+					assert.Zero(t, transport.calls.Load())
+					assert.NoFileExists(t, filepath.Join(filepath.Dir(workflowPath), "actions.lock"))
+					got, readErr := os.ReadFile(workflowPath)
+					require.NoError(t, readErr)
+					assert.Equal(t, workflow, got)
+					if actionPath != "" {
+						got, readErr := os.ReadFile(actionPath)
+						require.NoError(t, readErr)
+						assert.Equal(t, action, got)
+					}
+				})
+			}
+		}
+	}
+}
+
+// TestRemoteCompositeMalformedRefBlocks: a fetched composite whose uses:
+// can't be parsed blocks the run instead of locking without that child.
+func TestRemoteCompositeMalformedRefBlocks(t *testing.T) {
+	tests := map[string]string{
+		"actions/checkout@main:action.yml":             "uses: actions/checkout@main:action.yml is not an action reference the Actions backend accepts",
+		"actions/checkout/.github/workflows/ci.yml@v4": "reusable workflows should be referenced at the top-level `jobs.<job_id>.uses` key, not within steps",
+	}
+	for use, want := range tests {
+		t.Run(use, func(t *testing.T) { testRemoteCompositeMalformedRef(t, use, want) })
+	}
+}
+
+func testRemoteCompositeMalformedRef(t *testing.T, use, want string) {
+	const sha = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
+	composite := "name: c\nruns:\n  using: composite\n  steps:\n    - uses: " + use + "\n"
+	reg := &httpmock.Registry{}
+	reg.Register(httpmock.GraphQLForRepo("octo", "composite"), httpmock.JSONResponse(map[string]any{
+		"data": map[string]any{"a0": testRepoResponse("octo/composite", sha, composite)},
+	}))
+	path := writeTempWorkflow(t, `
+name: ci
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: octo/composite@v1
+`)
+
+	_, stderr, err := runCommandWithHTTP(t, reg, "--no-narrow", "--no-interactive", path)
+	require.ErrorIs(t, err, errSilent, stderr)
+	assert.Contains(t, stderr, want)
+	assert.NoFileExists(t, filepath.Join(filepath.Dir(path), "actions.lock"))
+}
@@ -1,6 +1,7 @@
 package format
 
 import (
+	"cmp"
 	"fmt"
 	"sort"
 	"strings"
@@ -147,7 +148,7 @@ func renderTermFindingDetail(out *ui.UI, f checks.Finding, dep string) {
 		icon = out.TermRed(ui.IconError)
 	}
 	out.TermDetail("%s %s %s", icon, out.TermDim(label), dep)
-	out.TermDetail("  %s", f.Detail)
+	out.TermDetail("  %s", cmp.Or(f.TermDetail, f.Detail))
 	if f.Category == checks.UnreachablePin && !f.RefMissing && f.Dependency != nil {
 		owner, repo := f.Dependency.OwnerRepo()
 		if owner != "" {
@@ -176,10 +177,14 @@ func renderTermFindingDetail(out *ui.UI, f checks.Finding, dep string) {
 
 // findingLabel is categoryLabel with terminal-only titles for refs that
 // don't exist upstream, which share the not-pinned and unreachable-pin
-// categories in JSON.
+// categories in JSON. Only a ref the lockfile recorded can no longer exist.
 func findingLabel(f checks.Finding) string {
 	switch {
-	case f.RefMissing && f.Category == checks.UnreachablePin:
+	case f.RefRefused && f.Category == checks.UnreachablePin:
+		return "Ref name refused"
+	case (f.RefMissing || f.RefGone) && f.Category == checks.UnreachablePin && f.FreshRef:
+		return "Not a tag or branch"
+	case (f.RefMissing || f.RefGone) && f.Category == checks.UnreachablePin:
 		return "Ref no longer exists"
 	case f.RefMissing:
 		return "Ref does not exist"
@@ -297,7 +302,7 @@ func renderFindingDetail(out *ui.UI, f checks.Finding, dep string) {
 		icon = out.Red(ui.IconError)
 	}
 	out.Detail("%s %s %s", icon, out.Dim(label), dep)
-	out.Detail("  %s", f.Detail)
+	out.Detail("  %s", cmp.Or(f.TermDetail, f.Detail))
 	if f.Category == checks.UnreachablePin && !f.RefMissing && f.Dependency != nil {
 		owner, repo := f.Dependency.OwnerRepo()
 		if owner != "" {
@@ -354,6 +359,9 @@ func renderWarnings(out *ui.UI, report *checks.Report, willRemediate bool) {
 				if key == "" {
 					key = f.WorkflowPath
 				}
+				// One dependency can draw warnings of different kinds (a
+				// full-SHA `uses:` and its moved recorded tag); keep each.
+				key += "\x00" + string(f.Category)
 				if wg, ok := warnMap[key]; ok {
 					wg.count++
 					wg.workflows = append(wg.workflows, f.WorkflowPath)
@@ -383,7 +391,7 @@ func renderWarnings(out *ui.UI, report *checks.Report, willRemediate bool) {
 			if !isTransitive {
 				bareSHADeps = append(bareSHADeps, key)
 			}
-		case f.Category == checks.RefMoved:
+		case f.Category == checks.RefMoved && !f.TagMoved:
 			// Moved mutable refs are sticky; --relock advances them, so
 			// there is nothing actionable to print here.
 		case f.Category.IsInconclusive() &&
@@ -425,12 +433,12 @@ func renderWarnings(out *ui.UI, report *checks.Report, willRemediate bool) {
 		wg := warnMap[key]
 		f := wg.finding
 		depKey := f.DepKey()
-		if f.Category.IsInconclusive() && f.Severity == checks.SeverityWarning {
+		if f.Category.IsInconclusive() || f.TagMoved {
 			label := depKey
 			if label == "" {
 				label = f.WorkflowPath
 			}
-			out.TermWarn("%s: %s", label, f.Detail)
+			out.TermWarn("%s: %s", label, cmp.Or(f.TermDetail, f.Detail))
 			if f.Remediation != "" {
 				out.TermDetail("↳ %s", f.Remediation)
 			}
 
@@ -2,12 +2,9 @@ package main
 
 import (
 	"fmt"
-	"os"
+	"path/filepath"
 
-	"github.com/cli/go-gh/v2/pkg/prompter"
-	"github.com/github/gh-actions-lock/internal/ui"
 	"github.com/spf13/cobra"
-	"golang.org/x/term"
 )
 
 // noInteractiveFlag reports the value of the persistent --no-interactive flag,
@@ -17,81 +14,16 @@ func noInteractiveFlag(cmd *cobra.Command) bool {
 	return v
 }
 
-// confirmer asks a yes/no question. Satisfied by *prompter.Prompter; an
-// interface so tests inject a fake without a TTY.
-type confirmer interface {
-	Confirm(prompt string, defaultValue bool) (bool, error)
-}
-
-// confirmFactory returns a confirmer and whether the session can prompt.
-// canPrompt is false in any non-interactive context (no TTY, CI), so the
-// recovery policy fails closed instead of blocking on input that never comes.
-type confirmFactory func() (confirmer, bool)
-
-// confirmFactoryHook is the confirm factory commands use to build the
-// corrupt-lockfile recovery policy. Production points at defaultConfirmFactory
-// (real terminal). Tests override it to drive the interactive delete-and-
-// recreate path without a TTY; the command tests run serially (t.Chdir) so a
-// package-level override with cleanup is safe.
-var confirmFactoryHook confirmFactory = defaultConfirmFactory
-
-// defaultConfirmFactory binds to the real terminal and renders to stderr so
-// `--json` stdout stays clean. It reports canPrompt only when both stdin and
-// stderr are TTYs and CI is unset — a CI runner with a stray TTY must never
-// be prompted.
-func defaultConfirmFactory() (confirmer, bool) {
-	if !term.IsTerminal(int(os.Stdin.Fd())) || !term.IsTerminal(int(os.Stderr.Fd())) || ciEnabled() {
-		return nil, false
-	}
-	return prompter.New(os.Stdin, os.Stderr, os.Stderr), true
-}
-
-// ciEnabled mirrors the CI convention used by internal/ui: most providers set
-// CI=true. A truthy CI value means no interactive prompts.
-func ciEnabled() bool {
-	v := os.Getenv("CI")
-	return v != "" && v != "0" && v != "false"
-}
-
-// lockRecovery decides what to do when the on-disk lockfile can't be parsed.
-// It returns (true, nil) when the lockfile was removed and loading should be
-// retried (the empty-lockfile path then recreates it), or a non-nil error to
-// abort the run (exit 2). It never silently accepts an unreadable lockfile.
+// lockRecovery decides what to do when the on-disk lockfile's contents can't
+// be used. It returns (true, nil) when loading should be retried, or a
+// non-nil error to abort the run (exit 2).
 type lockRecovery func(lockPath string, parseErr error) (recovered bool, err error)
 
-// newLockRecovery builds the recovery policy. allowDelete is false for
-// read-only or relock commands that cannot rebuild a deleted lockfile
-// (`check --no-fix`, `update`); those always fail with a clear pointer. When
-// allowDelete is true (`check` fix mode), an interactive session is offered a
-// delete-and-recreate; non-interactive sessions (CI, --no-interactive) fail.
-func newLockRecovery(noInteractive bool, console *ui.UI, newConfirm confirmFactory, allowDelete bool) lockRecovery {
+// newLockRecovery builds the recovery policy: always fail, naming the
+// problem. A bad entry usually means a hand edit, and deleting the lockfile
+// or fixing it automatically would lose the pins it records.
+func newLockRecovery() lockRecovery {
 	return func(lockPath string, parseErr error) (bool, error) {
-		if !allowDelete {
-			return false, fmt.Errorf("%w; run `gh actions-lock` to rebuild it, or delete it by hand", parseErr)
-		}
-		var (
-			confirm   confirmer
-			canPrompt bool
-		)
-		if newConfirm != nil {
-			confirm, canPrompt = newConfirm()
-		}
-		if noInteractive || !canPrompt {
-			return false, fmt.Errorf("%w; delete it and re-run to recreate it, or fix it by hand", parseErr)
-		}
-		// Release the terminal so the prompt renders cleanly over any spinner.
-		console.StopProgress()
-		ok, err := confirm.Confirm(fmt.Sprintf("Lockfile %s is unreadable (%v). Delete and recreate it?", lockPath, parseErr), false)
-		if err != nil {
-			return false, err
-		}
-		if !ok {
-			return false, fmt.Errorf("%w; left in place", parseErr)
-		}
-		if err := os.Remove(lockPath); err != nil {
-			return false, fmt.Errorf("deleting unreadable lockfile %s: %w", lockPath, err)
-		}
-		console.TermNeutral("Deleted unreadable lockfile %s; it will be recreated.", lockPath)
-		return true, nil
+		return false, fmt.Errorf("%w; if you edited %s by hand, restore it from version control", parseErr, filepath.Base(lockPath))
 	}
 }