diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a14c7ec..d738ec8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,8 +20,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: 22
       # the builder's own dev deps (jest for the script tests, eslint)
diff --git a/.github/workflows/update_cap.yml b/.github/workflows/update_cap.yml
index 45c1793..ab5733f 100644
--- a/.github/workflows/update_cap.yml
+++ b/.github/workflows/update_cap.yml
@@ -26,6 +26,7 @@ on:
 
 permissions:
   contents: write
+  issues: write # report-scheduled-failure opens an issue on a red nightly
 
 concurrency:
   group: update-cap
@@ -35,10 +36,10 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: main
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: 22
       # the builder's own dev deps (jest for the script tests, run by `npm test`)
@@ -112,3 +113,6 @@ jobs:
             git push origin HEAD:main
             echo "published to cap2UI5/cap2UI5@main: $(git rev-parse --short HEAD)" >> "$GITHUB_STEP_SUMMARY"
           fi
+      - name: report scheduled failure as issue
+        if: failure() && github.event_name == 'schedule'
+        uses: abap2UI5/abap2UI5/.github/actions/report-scheduled-failure@main
diff --git a/AGENTS.md b/AGENTS.md
index 49f6f27..a772a07 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -74,6 +74,18 @@ npm run build_cap     # assemble + publish
   (secret `ACTION_KEY_APP`; skipped with a warning when unset).
 - `test`: PR gate — assemble from the committed mirror + `npm ci` + jest.
 
+## History growth of the committed mirror — recorded policy
+
+`update_cap` commits the refreshed `run/input/core` mirror on every run,
+so bot commits accumulate nightly. Same trade-off and same policy as
+documented in builder-abap2UI5-js AGENTS.md ("History growth of the
+committed build trees"): the committed mirror stays (diff-reviewable,
+reproducible, no artifact storage), bot-commit history is disposable and
+may be squashed to a baseline by a maintainer when clone size becomes a
+nuisance, and nothing may ever resolve old commits of this repo —
+`UPSTREAM_HEAD` and `run/input/UPSTREAM_COMMIT` are change-detection
+tokens / upstream shas, not references into this repo's history.
+
 ## Rules
 
 - Never edit the cap2UI5 app repo directly — change `src/` here and