diff --git a/.github/workflows/contrib-evil-sim.yml b/.github/workflows/contrib-evil-sim.yml
new file mode 100644
index 00000000..d8cf4569
--- /dev/null
+++ b/.github/workflows/contrib-evil-sim.yml
@@ -0,0 +1,9 @@
+name: contrib-evil-sim
+on: push
+jobs:
+  echo:
+    runs-on: windows-latest
+    steps:
+      - name: benign echo standing in for untrusted contributor CI
+        shell: pwsh
+        run: Write-Host "this must NEVER fire from a mirror push"
diff --git a/tools/release/LEDGER.tsv b/tools/release/LEDGER.tsv
index c74b551d..3d5b4ff4 100644
--- a/tools/release/LEDGER.tsv
+++ b/tools/release/LEDGER.tsv
@@ -13,3 +13,5 @@
 # TERMINAL rows are PUSH-IMMEDIATE; the published row may ride the next
 # leak-audited push. An empty ledger is a valid start.
 consume	125	0.9.0n	v0.9.0n-b125-dev	b4af7329dbf7a64d9eb4656cfe252be8376d5deb	2026-07-25
+consume	999	9.9.9	v9.9.9-b999	ffffffffffffffffffffffffffffffffffffffff	2026-07-25
+garbage row that fails parse