@@ -337,6 +337,11 @@ func runCheck(cmd *cobra.Command, opts *checkOptions, newResolver resolverFunc)
 
 	report := result.Report
 	valid := result.Valid
+	// A read-only run writes nothing, so a finding deferred on a write stands.
+	if opts.noFix {
+		report.RestoreDeferred()
+		valid = report.IsValid()
+	}
 
 	// Read-only modes never touch the lockfile, so surface stale entries as
 	// non-blocking info findings instead of pruning them. Fix mode reports
@@ -448,6 +453,8 @@ func runCheck(cmd *cobra.Command, opts *checkOptions, newResolver resolverFunc)
 	}
 	if planErr != nil {
 		console.StopProgress()
+		// Nothing is written, so every deferred entry stays as recorded.
+		report.RestoreDeferred()
 		unresolved := replaceOffHistoryFindings(report, record.Unresolved())
 		if opts.jsonFields != "" {
 			if err := format.WriteJSON(out, report, record, false, opts.jsonFields, cliVersion(), store.File().Version, r.Hostname()); err != nil {
@@ -473,9 +480,17 @@ func runCheck(cmd *cobra.Command, opts *checkOptions, newResolver resolverFunc)
 		return fmt.Errorf("planning pins: %w", planErr)
 	}
 
+	// Parity excused or accepted some findings on the strength of this
+	// write; any it doesn't bear out block it.
+	if err := pin.Audit(ctx, record, store, report, &pin.CommitOptions{SkipNewWorkflowEntries: noOnboardFlag(cmd)}); err != nil {
+		console.StopProgress()
+		return fmt.Errorf("checking the planned write: %w", err)
+	}
+
 	// All or nothing: a run with errors it cannot fix writes nothing.
 	if runHasBlockingErrors(report, record, opts.acceptMoved) {
 		console.StopProgress()
+		report.RestoreDeferred()
 		if opts.jsonFields != "" {
 			if err := format.WriteJSON(out, report, record, false, opts.jsonFields, cliVersion(), store.File().Version, r.Hostname()); err != nil {
 				return err
 
@@ -0,0 +1,84 @@
+package lockfile
+
+import (
+	"context"
+	"errors"
+	"maps"
+	"slices"
+
+	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
+)
+
+// errPreview reports a write attempted on a preview.
+var errPreview = errors.New("lockfile preview is never saved")
+
+// Preview returns an in-memory copy of s for computing what a write would
+// leave on disk. It never reaches the network or the file: an owner/repo
+// ID missing from s's cache gets a placeholder in the preview's own cache,
+// and Save refuses. So a preview matches the real write in its keys, refs,
+// commits, edges and workflow lists, which no ID decides, but not in its
+// IDs. Writes to the preview leave s alone.
+func (s *State) Preview() *State {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	file := s.file
+	file.Dependencies = make(map[string]parserlock.Action, len(s.file.Dependencies))
+	for k, a := range s.file.Dependencies {
+		a.Uses = slices.Clone(a.Uses)
+		file.Dependencies[k] = a
+	}
+	file.Workflows = make(map[string][]string, len(s.file.Workflows))
+	for k, w := range s.file.Workflows {
+		file.Workflows[k] = slices.Clone(w)
+	}
+	return &State{
+		file:            file,
+		originalVersion: s.originalVersion,
+		meta:            previewIDs{},
+		idCache:         maps.Clone(s.idCache),
+		hostname:        s.hostname,
+		preview:         true,
+	}
+}
+
+// GC drops entries no workflow reaches, as Save does.
+func (s *State) GC() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.pruneOrphans()
+}
+
+// Entry returns the action recorded under an on-disk key.
+func (s *State) Entry(key string) (parserlock.Action, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	a, ok := s.file.Dependencies[key]
+	return a, ok
+}
+
+// UsedBy returns the keys of the entries whose recorded `uses:` lists key,
+// sorted.
+func (s *State) UsedBy(key string) []string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var out []string
+	for k, a := range s.file.Dependencies {
+		if slices.Contains(a.Uses, key) {
+			out = append(out, k)
+		}
+	}
+	slices.Sort(out)
+	return out
+}
+
+// EntryKey is a pin's on-disk key.
+func EntryKey(p parserlock.Pin) string {
+	return p.Canonical().String()
+}
+
+// previewIDs stands in for the metadata resolver in a preview.
+type previewIDs struct{}
+
+func (previewIDs) RepoIDs(context.Context, string, string, string) (int64, int64, error) {
+	return 1, 1, nil
+}
@@ -0,0 +1,108 @@
+package lockfile
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/github/gh-actions-lock/internal/dep"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// noNetwork fails the test if a preview asks for repo IDs.
+type noNetwork struct{ t *testing.T }
+
+func (n noNetwork) RepoIDs(context.Context, string, string, string) (int64, int64, error) {
+	n.t.Fatal("a preview must not look up repo IDs")
+	return 0, 0, nil
+}
+
+func TestPreview(t *testing.T) {
+	a, b := strings.Repeat("a", 40), strings.Repeat("b", 40)
+	path := filepath.Join(t.TempDir(), "actions.lock")
+	body := "version: v0.0.3\nworkflows:\n  .github/workflows/ci.yml:\n    - o/root@v1\ndependencies:\n" +
+		"  o/root@v1:\n    ref: v1\n    commit: sha1-" + a + "\n    owner_id: 1\n    repo_id: 2\n    uses:\n      - o/child@v2\n" +
+		"  o/child@v2:\n    ref: v2\n    commit: sha1-" + a + "\n    owner_id: 1\n    repo_id: 3\n"
+	require.NoError(t, os.WriteFile(path, []byte(body), 0o600))
+	store, err := LoadStateAt(path, noNetwork{t})
+	require.NoError(t, err)
+	before := store.File()
+	beforeUses := append([]string(nil), before.Dependencies["o/root@v1"].Uses...)
+
+	preview := store.Preview()
+	// o/new has no cached IDs: the preview fills a placeholder offline.
+	newDep := dep.Dependency{NWO: "o/new", Ref: "v1", SHA: b}
+	rootDep := dep.Dependency{NWO: "o/root", Ref: "v1", SHA: b}
+	require.NoError(t, preview.Set(context.Background(), ".github/workflows/ci.yml",
+		[]dep.Dependency{rootDep, newDep}, nil, map[string]bool{rootDep.Key(): true, newDep.Key(): true}))
+	preview.GC()
+
+	got, ok := preview.Entry("o/root@v1")
+	require.True(t, ok)
+	assert.Equal(t, "sha1-"+b, got.Commit)
+	assert.Equal(t, []string{"o/child@v2"}, got.Uses, "writing a workflow keeps recorded edges")
+	_, ok = preview.Entry("o/child@v2")
+	assert.True(t, ok, "a recorded edge keeps its child through GC")
+	assert.Equal(t, []string{"o/root@v1"}, preview.UsedBy("o/child@v2"))
+	_, ok = preview.Entry("o/new@v1")
+	assert.True(t, ok)
+
+	after := store.File()
+	assert.Equal(t, "sha1-"+a, after.Dependencies["o/root@v1"].Commit, "the store is untouched")
+	assert.Equal(t, beforeUses, after.Dependencies["o/root@v1"].Uses)
+	assert.NotContains(t, after.Dependencies, "o/new@v1")
+	assert.ErrorIs(t, preview.Save(), errPreview)
+	raw, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, body, string(raw), "nothing reaches disk")
+}
+
+type fixedIDs struct{}
+
+func (fixedIDs) RepoIDs(context.Context, string, string, string) (int64, int64, error) {
+	return 7, 8, nil
+}
+
+// TestPreviewProjectsRealSet: a write to a preview leaves the same keys,
+// refs, commits, edges and workflow lists as the same write to the store;
+// only the owner/repo IDs it couldn't look up differ. The preview's
+// placeholder IDs never reach the store's cache.
+func TestPreviewProjectsRealSet(t *testing.T) {
+	a, b := strings.Repeat("a", 40), strings.Repeat("b", 40)
+	path := filepath.Join(t.TempDir(), "actions.lock")
+	body := "version: v0.0.3\nworkflows:\n  .github/workflows/ci.yml:\n    - o/root@v1\n  .github/workflows/other.yml:\n    - o/keep@v1\ndependencies:\n" +
+		"  o/root@v1:\n    ref: v1\n    commit: sha1-" + a + "\n    owner_id: 1\n    repo_id: 2\n    uses:\n      - o/child@v2\n" +
+		"  o/child@v2:\n    ref: v2\n    commit: sha1-" + a + "\n    owner_id: 1\n    repo_id: 3\n" +
+		"  o/keep@v1:\n    ref: v1\n    commit: sha1-" + a + "\n    owner_id: 1\n    repo_id: 4\n" +
+		"  o/orphan@v1:\n    ref: v1\n    commit: sha1-" + a + "\n    owner_id: 1\n    repo_id: 5\n"
+	require.NoError(t, os.WriteFile(path, []byte(body), 0o600))
+	store, err := LoadStateAt(path, fixedIDs{})
+	require.NoError(t, err)
+	preview := store.Preview()
+
+	deps := []dep.Dependency{{NWO: "o/root", Ref: "v1", SHA: b}, {NWO: "o/new", Ref: "v1", SHA: b}}
+	direct := map[string]bool{deps[0].Key(): true, deps[1].Key(): true}
+	ctx := context.Background()
+	require.NoError(t, preview.Set(ctx, ".github/workflows/ci.yml", deps, nil, direct))
+	preview.GC()
+	assert.Zero(t, store.RecordedRepoID("o", "new"), "a preview never fills the store's ID cache")
+
+	require.NoError(t, store.Set(ctx, ".github/workflows/ci.yml", deps, nil, direct))
+	store.GC()
+	project := func(s *State) (map[string][3]string, map[string][]string) {
+		f := s.File()
+		out := map[string][3]string{}
+		for k, a := range f.Dependencies {
+			out[k] = [3]string{a.Ref, a.Commit, strings.Join(a.Uses, ",")}
+		}
+		return out, f.Workflows
+	}
+	wantDeps, wantWorkflows := project(store)
+	gotDeps, gotWorkflows := project(preview)
+	assert.Equal(t, wantDeps, gotDeps)
+	assert.Equal(t, wantWorkflows, gotWorkflows)
+	assert.NotContains(t, gotDeps, "o/orphan@v1", "GC drops what no workflow reaches, as Save does")
+}
@@ -47,6 +47,8 @@ type State struct {
 	idCache         map[string][2]int64
 	idSF            singleflight.Group
 	hostname        string
+	// preview marks a copy from Preview, which Save refuses.
+	preview bool
 }
 
 // ErrCorruptLockfile reports that a lockfile exists on disk but its contents
@@ -674,6 +676,9 @@ func (s *State) Set(ctx context.Context, workflowKey string, deps []dep.Dependen
 // entries (pins referenced by no workflow). When the in-memory file is empty
 // after GC, the on-disk file is removed.
 func (s *State) Save() error {
+	if s.preview {
+		return errPreview
+	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.pruneOrphans()
 
@@ -0,0 +1,140 @@
+package pin
+
+import (
+	"context"
+	"strings"
+
+	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
+	"github.com/github/gh-actions-lock/internal/lockfile"
+	"github.com/github/gh-actions-lock/internal/pipeline/checks"
+)
+
+// Audit holds each finding parity deferred (checks.Deferred) to the write
+// rec plans. It applies the write of every workflow still due to be
+// written to a preview of store, with the code Commit and Save use, and a
+// deferred finding holds only if its entry then is gone, or records a
+// commit this run verified, or, for a full-SHA key, a new ref for the same
+// commit. Otherwise the finding goes back on its workflow, which is then no
+// longer written, so Audit runs again without that workflow's write: a
+// finding that held only because of it goes back too. It stops once a pass
+// blocks no further workflow.
+func Audit(ctx context.Context, rec *Record, store *lockfile.State, report *checks.Report, copts *CommitOptions) error {
+	deferred := false
+	for _, wr := range report.Workflows {
+		deferred = deferred || len(wr.Deferred) > 0
+	}
+	if !deferred {
+		return nil
+	}
+	byPath := make(map[string]*checks.WorkflowReport, len(report.Workflows))
+	for i := range report.Workflows {
+		byPath[report.Workflows[i].Path] = &report.Workflows[i]
+	}
+	for {
+		var writers []WorkflowPlan
+		for _, wp := range committedWorkflows(rec, store, copts) {
+			if wr, ok := byPath[wp.Path]; !ok || !wr.SkipCommit && !wr.BlockingResolverError {
+				writers = append(writers, wp)
+			}
+		}
+		preview := store.Preview()
+		if err := updateLockfile(ctx, rec, writers, preview); err != nil {
+			return err
+		}
+		preview.GC()
+		verified := carryVerified(preview, report.Verified, writers)
+		blocked := false
+		for i := range report.Workflows {
+			wr := &report.Workflows[i]
+			for j, d := range wr.Deferred {
+				if d.Restored || written(preview, verified, d) {
+					continue
+				}
+				adviseHolder(preview, &wr.Deferred[j])
+				was := wr.SkipCommit
+				wr.Restore(j)
+				blocked = blocked || wr.SkipCommit && !was
+			}
+		}
+		if !blocked {
+			return nil
+		}
+	}
+}
+
+// carryVerified extends verified through the writers' planned `uses:`
+// rewrites. Narrowing, reverse lookup and re-recording each rewrite a use
+// only to a ref they checked names the same commit, so the commit the
+// preview writes under the new key is verified there if it was verified
+// under the old one. Other commits verified under the old key, and sibling
+// refs merely at the same commit, gain nothing.
+func carryVerified(preview *lockfile.State, verified map[string]bool, writers []WorkflowPlan) map[string]bool {
+	out := make(map[string]bool, len(verified))
+	for k := range verified {
+		out[k] = true
+	}
+	for _, wp := range writers {
+		for oldUses, newUses := range wp.Rewrites {
+			oldKey, ok := usesKey(oldUses)
+			newKey, ok2 := usesKey(newUses)
+			if !ok || !ok2 || oldKey == newKey {
+				continue
+			}
+			a, ok := preview.Entry(newKey)
+			if !ok {
+				continue
+			}
+			_, sha, _ := strings.Cut(a.Commit, "-")
+			if verified[checks.VerifiedKey(oldKey, sha)] {
+				out[checks.VerifiedKey(newKey, sha)] = true
+			}
+		}
+	}
+	return out
+}
+
+// usesKey is the on-disk key of a `uses:` value.
+func usesKey(uses string) (string, bool) {
+	ref := parserlock.ParseActionRef(uses)
+	if ref == nil {
+		return "", false
+	}
+	p, ok := parserlock.ParsePin(ref.Owner + "/" + ref.Repo + "@" + ref.Ref)
+	if !ok {
+		return "", false
+	}
+	return lockfile.EntryKey(p), true
+}
+
+// adviseHolder points an unreachable pin's advice at the entry that kept
+// it: the write the override planned left it to that entry's recorded
+// edge, so rerunning the override can't help.
+func adviseHolder(preview *lockfile.State, d *checks.Deferred) {
+	f := &d.Finding
+	if f.Category != checks.UnreachablePin || f.RefMissing || f.Dependency == nil {
+		return
+	}
+	holders := preview.UsedBy(d.Key)
+	if len(holders) == 0 {
+		return
+	}
+	if p, ok := parserlock.ParsePin(holders[0]); ok {
+		f.Remediation = checks.UnreachableRemediation(p.NWO+"@"+p.Ref, f.Dependency.NWO)
+	}
+}
+
+// written reports whether the previewed write replaces or removes d's entry.
+func written(preview *lockfile.State, verified map[string]bool, d checks.Deferred) bool {
+	a, ok := preview.Entry(d.Key)
+	if !ok {
+		return true
+	}
+	_, sha, _ := strings.Cut(a.Commit, "-")
+	if !strings.EqualFold(sha, d.Commit) {
+		return verified[checks.VerifiedKey(d.Key, sha)]
+	}
+	// Planning re-records a full-SHA key's ref only once that ref names the
+	// commit (RefNamesCommit), so a new ref is a repair.
+	pin, ok := parserlock.ParsePin(d.Key)
+	return ok && parserlock.IsFullSha(pin.Ref) && a.Ref != d.Ref
+}