@@ -896,6 +896,7 @@ describe('mutation lock on the orchestration entry points', () => {
 
     expect(result.success).toBe(false)
     expect(result.error).toContain('locked')
+    expect(result.errorCode).toBe('locked')
     expect(mockRecordAudit).not.toHaveBeenCalled()
   })
 
 
@@ -151,7 +151,7 @@ export async function performFullDeploy(
   // Backstop for every caller — routes may assert first to render their own 423,
   // but the copilot deploy tools call this directly.
   const lockDenial = await workflowLockDenial(workflowId)
-  if (lockDenial) return { success: false, error: lockDenial, errorCode: 'validation' }
+  if (lockDenial) return { success: false, error: lockDenial, errorCode: 'locked' }
 
   const [workflowRecord] = await db
     .select()
@@ -509,6 +509,7 @@ export interface PerformFullUndeployParams {
 export interface PerformFullUndeployResult {
   success: boolean
   error?: string
+  errorCode?: OrchestrationErrorCode
   warnings?: string[]
 }
 
@@ -526,7 +527,7 @@ export async function performFullUndeploy(
   const requestId = params.requestId ?? generateRequestId()
 
   const lockDenial = await workflowLockDenial(workflowId)
-  if (lockDenial) return { success: false, error: lockDenial }
+  if (lockDenial) return { success: false, error: lockDenial, errorCode: 'locked' }
 
   const [workflowRecord] = await db
     .select()
@@ -661,7 +662,7 @@ export async function performActivateVersion(
   const idempotencyKey = params.idempotencyKey ?? generateId()
 
   const lockDenial = await workflowLockDenial(workflowId)
-  if (lockDenial) return { success: false, error: lockDenial, errorCode: 'validation' }
+  if (lockDenial) return { success: false, error: lockDenial, errorCode: 'locked' }
 
   const [versionRow] = await db
     .select({
 
@@ -172,6 +172,7 @@ describe('backfillTableWorkflowDeployments', () => {
       scanned: 3,
       deployed: 3,
       alreadyDeployed: 0,
+      skippedLocked: 0,
     })
     expect(listCandidates.mock.calls).toEqual([
       ['', 2],
@@ -207,10 +208,59 @@ describe('backfillTableWorkflowDeployments', () => {
       scanned: 1,
       deployed: 0,
       alreadyDeployed: 1,
+      skippedLocked: 0,
     })
     expect(deploy).not.toHaveBeenCalled()
   })
 
+  it('reports and skips locked workflows while continuing the backfill', async () => {
+    const listCandidates = vi
+      .fn<TableWorkflowDeploymentStore['listCandidates']>()
+      .mockResolvedValueOnce([candidate('workflow-a'), candidate('workflow-b')])
+      .mockResolvedValueOnce([])
+      .mockResolvedValueOnce([candidate('workflow-a')])
+      .mockResolvedValueOnce([])
+    const deploymentState = new Map<string, boolean>()
+    const isDeployed = vi
+      .fn<TableWorkflowDeploymentStore['isDeployed']>()
+      .mockImplementation(async (workflowId) => deploymentState.get(workflowId) ?? false)
+    const deploy = vi.fn(async (workflow: TableWorkflowDeploymentCandidate) => {
+      if (workflow.workflowId === 'workflow-a') {
+        return {
+          success: false,
+          error: 'Workflow is locked by its containing folder',
+          errorCode: 'locked' as const,
+        }
+      }
+      deploymentState.set(workflow.workflowId, true)
+      return {
+        success: true,
+        activeDeployment: {
+          deploymentVersionId: `version-${workflow.workflowId}`,
+          version: 1,
+          deployedAt: new Date().toISOString(),
+        },
+      }
+    })
+
+    await expect(
+      backfillTableWorkflowDeployments(store({ listCandidates, isDeployed }), deploy)
+    ).resolves.toEqual({
+      scanned: 2,
+      deployed: 1,
+      alreadyDeployed: 0,
+      skippedLocked: 1,
+    })
+    expect(deploy.mock.calls.map(([workflow]) => workflow.workflowId)).toEqual([
+      'workflow-a',
+      'workflow-b',
+    ])
+    expect(listCandidates.mock.calls.slice(-2)).toEqual([
+      ['', 1],
+      ['workflow-a', 1],
+    ])
+  })
+
   it('fails fast when canonical deployment fails', async () => {
     const listCandidates = vi
       .fn<TableWorkflowDeploymentStore['listCandidates']>()
 
@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 
 /**
- * Deploys every workflow referenced by a table workflow group.
+ * Deploys every mutable workflow referenced by a table workflow group.
  *
  * The script is idempotent and resumable: it pages over only workflows that do
  * not have the full desired state, and each deployment uses a stable idempotency
@@ -52,6 +52,7 @@ export interface TableWorkflowDeploymentSummary {
   scanned: number
   deployed: number
   alreadyDeployed: number
+  skippedLocked: number
 }
 
 interface TableWorkflowDeploymentBackfillOptions {
@@ -158,6 +159,50 @@ async function getDatabase() {
   return db
 }
 
+function validateCandidatePage(
+  candidates: TableWorkflowDeploymentCandidate[],
+  afterWorkflowId: string,
+  limit: number
+): string | null {
+  if (candidates.length === 0) return null
+  if (candidates.length > limit) {
+    throw new Error('Table workflow deployment store returned an oversized page')
+  }
+
+  const pageIds = new Set(candidates.map((candidate) => candidate.workflowId))
+  if (pageIds.size !== candidates.length) {
+    throw new Error('Table workflow deployment store returned duplicate workflow ids')
+  }
+
+  const lastWorkflowId = candidates.at(-1)?.workflowId
+  if (!lastWorkflowId || lastWorkflowId === afterWorkflowId) {
+    throw new Error('Table workflow deployment store returned a non-advancing page')
+  }
+  return lastWorkflowId
+}
+
+async function assertOnlyLockedCandidatesRemain(
+  store: TableWorkflowDeploymentStore,
+  lockedWorkflowIds: ReadonlySet<string>
+): Promise<void> {
+  let afterWorkflowId = ''
+  for (;;) {
+    const candidates = await store.listCandidates(afterWorkflowId, 1)
+    const lastWorkflowId = validateCandidatePage(candidates, afterWorkflowId, 1)
+    if (!lastWorkflowId) return
+
+    const unexpectedCandidate = candidates.find(
+      (candidate) => !lockedWorkflowIds.has(candidate.workflowId)
+    )
+    if (unexpectedCandidate) {
+      throw new Error(
+        `Table workflow deployment backfill left workflow ${unexpectedCandidate.workflowId} undeployed`
+      )
+    }
+    afterWorkflowId = lastWorkflowId
+  }
+}
+
 /** Ensures the table group references can be traversed without silently dropping corrupt data. */
 async function assertTableWorkflowIntegrity(): Promise<void> {
   const db = await getDatabase()
@@ -343,7 +388,7 @@ export async function deployTableWorkflow(
 }
 
 /**
- * Reaches and verifies that every table workflow has an active deployment.
+ * Reaches and verifies that every mutable table workflow has an active deployment.
  */
 export async function backfillTableWorkflowDeployments(
   store: TableWorkflowDeploymentStore,
@@ -361,24 +406,15 @@ export async function backfillTableWorkflowDeployments(
     scanned: 0,
     deployed: 0,
     alreadyDeployed: 0,
+    skippedLocked: 0,
   }
+  const lockedWorkflowIds = new Set<string>()
   let afterWorkflowId = ''
 
   for (;;) {
     const candidates = await store.listCandidates(afterWorkflowId, batchSize)
-    if (candidates.length === 0) break
-    if (candidates.length > batchSize) {
-      throw new Error('Table workflow deployment store returned an oversized page')
-    }
-
-    const pageIds = new Set(candidates.map((candidate) => candidate.workflowId))
-    if (pageIds.size !== candidates.length) {
-      throw new Error('Table workflow deployment store returned duplicate workflow ids')
-    }
-    const lastWorkflowId = candidates.at(-1)?.workflowId
-    if (!lastWorkflowId || lastWorkflowId === afterWorkflowId) {
-      throw new Error('Table workflow deployment store returned a non-advancing page')
-    }
+    const lastWorkflowId = validateCandidatePage(candidates, afterWorkflowId, batchSize)
+    if (!lastWorkflowId) break
 
     for (const candidate of candidates) {
       summary.scanned += 1
@@ -391,6 +427,16 @@ export async function backfillTableWorkflowDeployments(
         })
         const result = await deploy(candidate)
         if (!result.success) {
+          if (result.errorCode === 'locked') {
+            lockedWorkflowIds.add(candidate.workflowId)
+            summary.skippedLocked += 1
+            logger.warn('Skipping locked workflow referenced by a table workflow group', {
+              workflowId: candidate.workflowId,
+              workspaceId: candidate.workspaceId,
+              reason: result.error ?? 'Workflow is locked',
+            })
+            continue
+          }
           throw new Error(
             `Failed to deploy table workflow ${candidate.workflowId}: ${result.error ?? 'deployment returned no error'}`
           )
@@ -413,12 +459,7 @@ export async function backfillTableWorkflowDeployments(
   }
 
   await store.assertIntegrity()
-  const remaining = await store.listCandidates('', 1)
-  if (remaining.length > 0) {
-    throw new Error(
-      `Table workflow deployment backfill left workflow ${remaining[0].workflowId} undeployed`
-    )
-  }
+  await assertOnlyLockedCandidatesRemain(store, lockedWorkflowIds)
 
   return summary
 }