@event4u/agent-config 14.15.0 → 14.17.0

package/dist/agent-src/skills/fe-design/references/design-patterns.md

@@ -171,6 +171,34 @@ Before adding any animation to a UI element, run through this decision tree:
 - **Never animate layout properties** (width, height, top, left, padding). Why: triggers browser layout recalculation on every frame; always solvable with `transform`.
 - **Always add `@media (prefers-reduced-motion: reduce)`** — gentler animation (reduced distance/opacity), NOT display:none. Why: vestibular disorders make motion UI unusable; reducing is better than removing.
 
+**4. Is the trigger the reader's position, or the reader's action?**
+
+Position-triggered motion is the interaction layer's current tell, and it is
+the one case where the decision tree above returns "no" and gets overridden
+anyway. Two shapes, both catalogued:
+
+- **Scroll-reveal on every section** (catalog M6). The reader has already
+  scrolled to the content; fading it in delays what they asked for. Animate a
+  reveal only where position carries meaning — a stepped narrative whose beats
+  must land in order, or a long-form piece using position to signal progress —
+  and then say so in the brief. A reveal applied per section is a default.
+- **A pointer-tracking spotlight** (catalog M7). The cursor is the one element
+  on the page whose position the reader already knows, so highlighting it
+  carries no information. Legitimate only where the spotlight *is* the
+  interaction: an inspection tool, a reveal mechanic, a magnifier.
+
+**5. Does the hover state spend contrast or add it?**
+
+A control that lowers its own opacity on hover (catalog M8) reads as retreating
+from the pointer, and it reduces legibility at the moment the reader is
+committing to the target. Hover is carried by brightness, background, border or
+elevation — never by removing contrast. A fade is correct only when it
+communicates a real state change, such as an item being dismissed.
+
+The six interaction states every interactive element must assert are
+[`design-review`](../../design-review/SKILL.md)'s; this entry is the motion half
+of the hover one.
+
 **4. What to animate?**
 Animate `transform` and `opacity` only. Why: these run on the GPU compositor thread, not the main thread; they never trigger layout or paint.
 `scale(0)` → `scale(1)` is wrong. Why: nothing in the real world appears from nothing. Use `scale(0.95)` + `opacity: 0` → `scale(1)` + `opacity: 1` instead.

package/dist/agent-src/skills/iconography/SKILL.md

@@ -37,12 +37,30 @@ execution:
 1. **Identify the icon need** — what does the icon communicate? Name the semantic
    intent (e.g., "download action", "warning state", "user profile") rather than
    visual description alone.
-2. **Pick the icon set** per stack and brand context. Default open sets:
-   **Lucide** (clean, Tailwind-native), **Heroicons** (Tailwind/React first-party),
-   **Phosphor** (multi-weight, flexible), **Tabler** (comprehensive, stroke-based).
-   Brand/provider marks use **lobe-icons** (`lobe-icons:openai-color`, etc.).
-   Stack consumers: `react-shadcn-ui` → Lucide; `blade-ui` → Heroicons or Lucide;
-   `tailwind-engineer` → any web-font-friendly set.
+2. **Choose the icon set — three rungs, and record which one answered.** The
+   set is *chosen*, never inherited: adopting one because a scaffold shipped it
+   is the anti-pattern [`icon-consistency`](../../rules/icon-consistency.md)
+   § What this gates names by name. Stop at the first rung that answers.
+   1. **A brand token or brand guide that names an icon set** — authoritative,
+      stop here ([`brand-source-of-truth`](../../rules/brand-source-of-truth.md)).
+   2. **The set already in use in this project** — detected at the Inspect step
+      of the Iconography floor below. One icon system per project; a second
+      visual language is the defect, not a preference.
+   3. **Neither exists → select from the open candidates by the criterion the
+      surface actually imposes, and state which criterion decided it.** The
+      candidates, unordered: **Heroicons**, **Lucide**, **Phosphor**, **Tabler**.
+
+   | Criterion the surface imposes | Candidates that satisfy it |
+   |---|---|
+   | Several stroke weights inside one UI (thin captions, bold empty states) | Phosphor (six weights) |
+   | One uniform stroke across a dense admin UI | Lucide, Tabler |
+   | First-party match to a component library the project already adopted | Heroicons (Tailwind UI), Lucide (shadcn/ui) |
+   | Widest glyph coverage for domain-specific nouns | Tabler, Phosphor |
+
+   Two criteria pointing at different candidates is a real trade-off — name it
+   and pick one; do not split the UI across both. Brand and provider marks are
+   a separate axis and use **lobe-icons** (`lobe-icons:openai-color`) whatever
+   the UI set is.
 3. **Resolve to a concrete Iconify name** in `set:name` format, e.g.
    `lucide:arrow-right`, `heroicons:user-solid`, `ph:warning-bold`,
    `tabler:download`. Verify the name exists on
@@ -54,6 +72,19 @@ execution:
 5. **Verify** — check the resolved name on `iconify.design/icon/{set}:{name}`;
    confirm the icon renders as expected before shipping.
 
+## Which set each stack ships with — an observation, not a pick
+
+Recorded so rung 2 above can recognise an incumbent. Finding one of these in a
+project is rung-2 evidence. Reaching for it because the stack is *new* skips
+rung 3 and is exactly the scaffold inheritance
+[`icon-consistency`](../../rules/icon-consistency.md) forbids.
+
+| Stack / consumer | Ships with |
+|---|---|
+| `react-shadcn-ui` | Lucide |
+| `blade-ui` | Heroicons (Tailwind first-party) |
+| `tailwind-engineer` | none of its own — any web-font-friendly set |
+
 ## Iconography floor (design fidelity)
 
 Before resolving any new icon, honour the project's existing icon system — the

package/dist/agent-src/skills/react-shadcn-ui/SKILL.md

@@ -122,7 +122,7 @@ Do NOT use when:
   components in the same surface.
 - **Anti-AI-slop catalog + linter.** Pull
   [`docs/guidelines/design-antipatterns.md`](../../../docs/guidelines/design-antipatterns.md)
-  before the polish step (Visual V1–V7, Layout L1–L8 are the React-component
+  before the polish step (Visual V1–V8, Layout L1–L10 are the React-component
   slop tells); the objective quality floors (WCAG contrast, focus-visible,
   reduced-motion) are validated via `accessibility-auditor`'s checklist —
   cite its verdict rather than eyeballing.

package/dist/agent-src/skills/terraform/SKILL.md

@@ -96,6 +96,35 @@ Check existing modules in the project for which registry modules are used.
 - Security groups follow least-privilege: only allow traffic between known services.
 - IAM policies use specific resource ARNs, not wildcards (except where unavoidable).
 
+### Permissive defaults and missing security blocks
+
+The failure that reaches production is almost never a pinned-version mistake;
+it is a resource that works either way and was left on its permissive default.
+Four constructs carry it. Each backstop grep is over the `.tf` tree you are
+changing, not over this repository.
+
+| Backstop grep | What a hit means | Override condition |
+|---|---|---|
+| `grep -rn '0\.0\.0\.0/0' --include='*.tf' .` | An ingress or egress rule whose CIDR is 0.0.0.0/0, i.e. open to the whole internet. On a management or database port stop and treat it as CRITICAL - the corpus row enumerates which ports those are. | A deliberately public listener - an ALB or CloudFront origin on 80/443. Nothing else. Record the reason next to the rule. |
+| `grep -rn 'publicly_accessible\|block_public_acls\|ignore_public_acls' --include='*.tf' .` | Either `publicly_accessible = true` on a database, or a bucket with no public-access block present at all. Absence is the more common hit and the grep returning nothing is the failing case. | A bucket that genuinely serves public web assets, with the policy written explicitly rather than inherited from a default. |
+| `grep -rnE '"(Action\|Resource)" *: *"\*"\|= *\["\*"\]' --include='*.tf' .` | A wildcard IAM action or resource. One compromised workload credential then reaches everything in the account. | A named, reviewed exception - `iam:PassRole` scoped by condition, or a bootstrap role. Never the default. |
+| `grep -rL 'encrypt' --include='*.tf' .` (lists files with NO encryption mention; `-L` prints names only, so no `-n`) | A storage, volume, snapshot, or database resource with no encryption block. | None for data at rest. A resource holding no data at all. |
+
+Read the surface class before the fix, not after: the mitigation text, the
+abuse case, and the negative test live in the `infrastructure` rows of
+[`threat-modeling`](../threat-modeling/SKILL.md)'s corpus, which is the single
+authority for them. Ask that skill's grounded-corpus step for the
+`infrastructure` surface class - it carries the invocation - and describe the
+change you are making, e.g. *terraform security group ingress open to
+0.0.0.0/0*. Do not copy the command here: one skill owns that interface, for
+the same reason one file owns the control text.
+
+Those rows also carry a `Decided by:` clause stating which check actually
+decides each one. For all four constructs above that clause reads NO CHECK IN
+THIS REPOSITORY - no HCL or IAM-policy parser ships here, so these greps and
+your own IaC policy scanner are the whole enforcement story. Do not write or
+imply otherwise.
+
 ## Common patterns
 
 ### ECS service with CodeDeploy (Blue/Green)

package/dist/agent-src/skills/threat-modeling/data/reasoning.csv

@@ -8,3 +8,4 @@ public-endpoint,Rate limit + cache + minimal payload,"{""if_search_endpoint"": "
 billing,Ledger + idempotency + server-side amounts,"{""if_refunds"": ""one-way-state-machine"", ""if_webhooks_from_psp"": ""verify-signature-and-amount""}",Mutable balance column updates,CRITICAL
 secrets,Manager + redaction + scan,"{""if_third_party_keys"": ""scope-and-rotate-quarterly"", ""if_ci_pipeline"": ""masked-vars-only""}",Secrets in env committed to VCS,HIGH
 data-exposure,Allowlist serializers + contract tests,"{""if_admin_fields"": ""separate-serializer"", ""if_logs_contain_payloads"": ""logger-redaction-keys""}",Spreading model attributes into responses,MEDIUM
+infrastructure,Deny-by-default ingress + encryption on + scoped IAM,"{""if_management_or_db_port"": ""no-internet-cidr-use-bastion-or-private-link"", ""if_object_storage"": ""block-public-access-at-account-and-bucket"", ""if_iam_policy"": ""enumerate-actions-and-resource-arns""}",Permissive defaults left in place because the resource works either way,HIGH

package/dist/agent-src/skills/threat-modeling/data/surfaces.csv

@@ -8,3 +8,4 @@ Public unauthenticated endpoint,public endpoint health status unauthenticated an
 Billing / payment / balance mutation,billing payment charge refund invoice subscription balance credit,billing,money movement,Anything that changes an amount owed/paid
 Secrets / key handling,secret api-key signing key env vault kms rotation,secrets,credentials,"Storage, rotation, and logging paths"
 Data export / serializer / log channel,export serializer api-resource log audit csv download report,data-exposure,"PII, internal fields",Response shaping and log sinks
+Infrastructure / IaC resource definition,terraform iac infrastructure provisioning security group ingress egress cidr bucket storage iam role subnet vpc encryption,infrastructure,"network reachability, data at rest, cloud credentials",Any IaC change to networking storage IAM or encryption defaults

package/dist/agent-src/skills/threat-modeling/data/threats.csv

@@ -14,3 +14,8 @@ billing,Race condition on balance / double-spend,CWE-362,Parallel requests redee
 billing,Price/amount tampering,CWE-602,Client-supplied price or currency trusted at checkout,Recompute amounts server-side from catalog; signed cart or server-held cart only,Test: tampered client amount → server total unchanged,CRITICAL
 secrets,Secret leakage via logs / errors / VCS,"CWE-532, ATT&CK T1552","Key appears in exception payload, debug log, or committed .env",Centralized secret manager; logger redaction list; pre-commit secret scan; scoped short-lived tokens,Test: forced exception on auth path → no credential substring in log sink,HIGH
 data-exposure,Over-broad serializer / API resource,"CWE-213, OWASP API3","Serializer returns internal fields (cost, flags, foreign tenant refs) the UI ignores but attackers read",Explicit field allowlist per resource; separate admin vs public serializers; contract test on response shape,Test: schema-diff response against documented contract → no undocumented fields,MEDIUM
+infrastructure,Unrestricted ingress to a management or database port,"CWE-1327, ATT&CK T1190",Attacker reaches SSH/RDP or a database engine straight from the internet because a security-group or firewall rule allows 0.0.0.0/0,"Deny-by-default ingress; management and database ports reachable only via bastion, VPN, or private link; CIDR scoped to known ranges; never 0.0.0.0/0 on 22/3389/3306/5432/6379/27017","Test: a rule with cidr_blocks 0.0.0.0/0 on a management or database port is rejected. Decided by: NO CHECK IN THIS REPOSITORY - nothing here parses HCL or cloud config; the deciding check is the consumer's own IaC policy scanner",CRITICAL
+infrastructure,Object storage public by default,"CWE-732, OWASP A05",Bucket or container created without a block-public-access setting so any object URL is world-readable,Block public access at account AND bucket level; explicit policy allowlist instead of a public ACL; serve objects via signed URLs or a CDN origin identity,"Test: storage created with no explicit public-access block is rejected; anonymous GET of a stored object returns 403. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own IaC policy scanner or a cloud posture tool",HIGH
+infrastructure,Missing encryption at rest or in transit,"CWE-311, CWE-319",Volume snapshot bucket or database instance created with no encryption block; endpoint accepts a plaintext connection,Encryption block mandatory on every storage and database resource; customer-managed key where the data class requires it; TLS-only bucket policy and listener; reject plaintext listeners,"Test: a storage or database resource with no encryption block is rejected; a plaintext connection to the endpoint is refused. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own IaC policy scanner",HIGH
+infrastructure,Wildcard IAM action or resource,"CWE-269, ATT&CK T1078.004",A role policy grants Action * or Resource * so one compromised workload credential reaches every service and object in the account,Enumerate actions and resource ARNs; one role per workload; permission boundary or service control policy on privileged roles; no wildcard outside a named reviewed exception,"Test: a policy document containing Action ""*"" or Resource ""*"" is rejected or carries a named exception. Decided by: NO CHECK IN THIS REPOSITORY - nothing here parses IAM policy documents; the deciding check is the consumer's own IaC policy scanner",CRITICAL
+infrastructure,Credential in an IaC or vars file instead of a secret manager,"CWE-798, ATT&CK T1552.001",Password token or key written as a literal into a .tf .tfvars or .yaml file and committed,Secret-manager reference or runtime-injected env var; never a literal in IaC or vars files; treat the state file as sensitive and store it encrypted with restricted access,"Test: a literal credential in a tracked IaC or vars file fails the build. Decided by: check_secret_leak (src/scripts/check_secret_leak.ts) inside THIS repository - it has no extension allowlist so .tf and .yaml are in scope; for a CONSUMER the deciding check is the gitleaks workflow the package ships as a template that the consumer must copy",HIGH

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "14.15.0"
+agent_config_version: "14.17.0"
 
 # --- Project identity ---
 project:

package/dist/cli-delegate/cmd_conformance.js

@@ -807,20 +807,22 @@ var PHRASES = [
   // "never auto-merge" each returned ["pr-merge"] — a prompt saying DO NOT
   // MERGE authorized a merge. The noun-sense lookahead was never a negator.
   //
-  // The lookBEHIND is line-scoped by `[^.!?\n]` on purpose, the same scoping
-  // `turn_end_gate_hook.ts` uses for its own negation exclusion (`:330`) and
-  // its negated-claim window (`:490-493`). A sentence boundary ends a
-  // negation's reach: "Do not push. Merge PR #12." is two instructions, and a
-  // guard that let the first suppress the second would silently stop
-  // authorizing merges the user DID order — the failure mode that is worse
-  // than the defect, because nothing happens and nothing says why.
-  //
-  // Reusing that vocabulary rather than inventing a third is deliberate: two
+  // The inline negative lookBEHIND that used to live in this pattern was
+  // REMOVED on 2026-09-03, and its own comment is why. It warned that "two
   // negation vocabularies in one tree drift, and the drift is invisible until
-  // a prompt lands in the gap between them.
+  // a prompt lands in the gap between them" — and by then they had drifted:
+  // `negatedBefore` became clause-scanned in both directions while this
+  // lookbehind stayed a blind 30-character window with no forward half. The
+  // prompt that landed in the gap is `"nicht pushen, aber mergen"`, which the
+  // lookbehind refused (13 characters, inside its window, across a contrast
+  // cue it could not see) while the clause scan correctly authorizes it.
+  //
+  // Every phrase match already passes through `negatedBefore` at the call
+  // site, so the guard is not weakened by the removal — it is applied once,
+  // by the one vocabulary this file's comment asked for.
   {
     op: "pr-merge",
-    re: /(?<!\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b[^.!?\n]{0,30})\b(merge|merg(e|en|st|t)|zusammenf(ü|ue)hren|reinmergen)\b(?!\s*[- ]?(conflict|konflikt|commit|base|queue|state|status))/i
+    re: /\b(merge|merg(e|en|st|t)|zusammenf(ü|ue)hren|reinmergen)\b(?!\s*[- ]?(conflict|konflikt|commit|base|queue|state|status))/i
   },
   // A tag is an ACTION here — bare "Tag" is the German word for day, and
   // "Version" is an ordinary noun. Both authorized a BLOCK op before this.
@@ -942,13 +944,16 @@ function isInterrogative(prose) {
   if (!t) {
     return false;
   }
-  const hasImperative = /\b(mach|mache|bitte|leg|lege|erstell|erstelle|f(ü|ue)hr|f(ü|ue)hre|setz|setze|starte|los|jetzt|go ahead|do it|ja[,.]?\s|ok[,.]?\s)\b/i.test(
+  if (/\?\s*$/.test(t)) {
+    return true;
+  }
+  const hasImperative = /\b(mach|mache|bitte|leg|lege|erstell|erstelle|f(ü|ue)hr|f(ü|ue)hre|setz|setze|starte|los|jetzt|now|asap|go ahead|do it|ja[,.]?\s|ok[,.]?\s)\b/i.test(
     t
   );
   if (hasImperative) {
     return false;
   }
-  return /\?\s*$/.test(t) || /^(was|wie|warum|wieso|weshalb|wann|wer|welche[rs]?|wo|ist|sind|kann|kannst|k(ö|oe)nnen|soll|sollen|darf|d(ü|ue)rfen|why|what|how|when|which|who|is|are|can|could|should|does|do)\b/i.test(
+  return /^(was|wie|warum|wieso|weshalb|wann|wer|welche[rs]?|wo|ist|sind|kann|kannst|k(ö|oe)nnen|soll|sollen|darf|d(ü|ue)rfen|why|what|how|when|which|who|is|are|can|could|should|does|do)\b/i.test(
     t
   );
 }
@@ -995,13 +1000,18 @@ function splitFences(prompt) {
 function _commandLines(fence) {
   return fence.split("\n").map((l) => l.trim()).filter((l) => l.length > 0).filter((l) => !/^(remote:|error:|hint:|fatal:|warning:|To |!\s|\s*\^)/i.test(l)).map((l) => l.replace(/^[$>#]\s*/, "")).filter((l) => /^(git|gh|npm|pnpm|yarn|task)\b/.test(l));
 }
+function _errText(err) {
+  const t = err instanceof Error ? err.message : String(err);
+  return t.replace(/\s+/g, " ").trim().slice(0, 200);
+}
+var PR_NUMBER_MAX = 2147483647;
 function extractMergeTargets(prompt) {
   const out = /* @__PURE__ */ new Set();
-  const re = /(?:#|\bpr[- ]?|\bpull[- ]request\s+#?)(\d{1,7})\b/giu;
+  const re = /(?:#|\bpr[- ]?|\bpull[- ]request\s+#?)(\d{1,10})\b/giu;
   let m;
   while ((m = re.exec(prompt)) !== null) {
     const n = Number.parseInt(m[1], 10);
-    if (Number.isSafeInteger(n) && n > 0) {
+    if (Number.isSafeInteger(n) && n > 0 && n <= PR_NUMBER_MAX) {
       out.add(n);
     }
   }
@@ -1045,27 +1055,109 @@ function foldGrants(prior, prompt, authorized, session_id, now) {
   ];
 }
 var NEGATION_WORD = /\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b/i;
-function negatedBefore(text, index, matched = "") {
+var CONTRAST_CUE = /\b(aber|sondern|jedoch|but|however|instead)\b/gi;
+var ABBREVIATION_BEFORE_DOT = /(?:^|[\s("'\u2018\u201c])(?:[a-z]|z\.b|bzw|ca|usw|d\.h|u\.a|evtl|ggf|inkl|max|min|nr|abb|e\.g|i\.e|etc|vs|approx|fig|no|st|dr|prof)\.$/i;
+function isSentenceBoundary(text, at) {
+  const mark = text[at];
+  if (mark !== ".") {
+    return true;
+  }
+  if (/\d/.test(text[at - 1] ?? "") && /\d/.test(text[at + 1] ?? "")) {
+    return false;
+  }
+  return !ABBREVIATION_BEFORE_DOT.test(text.slice(0, at + 1));
+}
+function sentenceBounds(text, index) {
   let start = 0;
-  for (const mark of [".", "!", "?", "\n"]) {
-    const at = text.lastIndexOf(mark, index - 1);
-    if (at + 1 > start) {
-      start = at + 1;
+  for (let i = index - 1; i >= 0; i -= 1) {
+    const c = text[i];
+    if ((c === "." || c === "!" || c === "?" || c === "\n") && isSentenceBoundary(text, i)) {
+      start = i + 1;
+      break;
     }
   }
-  const before = text.slice(Math.max(start, index - 30), index);
-  return NEGATION_WORD.test(before) || NEGATION_WORD.test(matched);
+  let end = text.length;
+  for (let i = index; i < text.length; i += 1) {
+    const c = text[i];
+    if ((c === "." || c === "!" || c === "?" || c === "\n") && isSentenceBoundary(text, i)) {
+      end = i;
+      break;
+    }
+  }
+  return { start, end };
+}
+function _sentences(text) {
+  const out = [];
+  let from = 0;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    if ((c === "." || c === "!" || c === "?" || c === "\n") && isSentenceBoundary(text, i)) {
+      out.push(text.slice(from, i + 1));
+      from = i + 1;
+    }
+  }
+  if (from < text.length) {
+    out.push(text.slice(from));
+  }
+  return out.filter((t) => t.trim() !== "");
+}
+function clauseStart(text, from, to) {
+  let start = from;
+  const seg = text.slice(from, to);
+  for (let i = seg.length - 1; i >= 0; i -= 1) {
+    const c = seg[i];
+    if (c === "," || c === ";" || c === ":") {
+      start = from + i + 1;
+      break;
+    }
+  }
+  CONTRAST_CUE.lastIndex = 0;
+  let m;
+  while ((m = CONTRAST_CUE.exec(seg)) !== null) {
+    const after = from + m.index + m[0].length;
+    if (after > start) {
+      start = after;
+    }
+  }
+  return start;
+}
+function clauseEnd(text, from, to) {
+  const seg = text.slice(from, to);
+  let end = to;
+  const punct = seg.search(/[,;:]/);
+  if (punct !== -1) {
+    end = from + punct;
+  }
+  CONTRAST_CUE.lastIndex = 0;
+  const m = CONTRAST_CUE.exec(seg);
+  if (m !== null && from + m.index < end) {
+    end = from + m.index;
+  }
+  return end;
+}
+function negatedBefore(text, index, matched = "") {
+  const { start, end } = sentenceBounds(text, index);
+  const before = text.slice(clauseStart(text, start, index), index);
+  const afterFrom = index + matched.length;
+  const after = afterFrom < end ? text.slice(afterFrom, clauseEnd(text, afterFrom, end)) : "";
+  return NEGATION_WORD.test(before) || NEGATION_WORD.test(matched) || NEGATION_WORD.test(after);
 }
 function classifyAuthorization(prompt) {
   const { prose, fences } = splitFences(prompt);
   const authorized = /* @__PURE__ */ new Set();
   const evidence = {};
   const instruction = prose.split("\n").filter((l) => !OUTPUT_LINE.test(l)).join("\n");
-  for (const { op, re } of isInterrogative(instruction) ? [] : PHRASES) {
-    const m = re.exec(instruction);
-    if (m && !negatedBefore(instruction, m.index, m[0])) {
-      authorized.add(op);
-      evidence[op] = `prose: "${m[0]}"`;
+  for (const { op, re } of PHRASES) {
+    for (const sentence of _sentences(instruction)) {
+      if (isInterrogative(sentence)) {
+        continue;
+      }
+      const m = re.exec(sentence);
+      if (m && !negatedBefore(sentence, m.index, m[0])) {
+        authorized.add(op);
+        evidence[op] = `prose: "${m[0]}"`;
+        break;
+      }
     }
   }
   for (const fence of fences) {
@@ -1143,7 +1235,11 @@ function consumeGrantTarget(consumer_root, session_id, target) {
   if (touched) {
     try {
       atomic_write_json(file, decoded);
-    } catch {
+    } catch (err) {
+      process.stderr.write(
+        `git-authorization: grant-consumption write failed (${_errText(err)}) \u2014 the target stays UNSPENT, so one further merge of a PR the user named will still be authorized. Authorization outcome unchanged.
+`
+      );
     }
   }
 }
@@ -1236,7 +1332,11 @@ function run2(stdin_text, options) {
   };
   try {
     atomic_write_json(path2.join(options.consumer_root, ledgerFileFor(session)), ledger);
-  } catch {
+  } catch (err) {
+    process.stderr.write(
+      `git-authorization: session-ledger write failed (${_errText(err)}) \u2014 the gate degrades to "no ledger" for this session, which denies the irreversible subset and warns on the rest. Authorization outcome unchanged.
+`
+    );
   }
   return EXIT_ALLOW2;
 }
@@ -1300,6 +1400,24 @@ var DESTRUCTIVE_MARKERS = [
   { label: "a route or endpoint was removed", re: /^-.*\b(Route::(get|post|put|patch|delete)|@(Get|Post|Put|Patch|Delete)Mapping|app\.(get|post|put|patch|delete)\s*\()/m },
   { label: "a whole file was deleted", re: /^deleted file mode /m }
 ];
+var SCHEMA_REMOVAL_BODY = /\b(dropColumn|dropTable|dropIfExists|removeColumn|drop_column|drop_table|DROP\s+(TABLE|COLUMN|INDEX|CONSTRAINT)|TRUNCATE\s+TABLE)\b/i;
+var RENAME_METADATA = /^rename (?:from|to) /m;
+function fileBlocks(patch) {
+  return patch.split(/^(?=diff --git )/m).filter((b) => b.startsWith("diff --git "));
+}
+function renamedSchemaRemoval(patch) {
+  for (const block of fileBlocks(patch)) {
+    if (!RENAME_METADATA.test(block)) {
+      continue;
+    }
+    for (const line of block.split("\n")) {
+      if (line.startsWith("-") && !line.startsWith("---") && SCHEMA_REMOVAL_BODY.test(line)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 var MAJOR_BUMP = /^-\s*"version"\s*:\s*"(\d+)\.[^"]*"[\s\S]{0,200}?^\+\s*"version"\s*:\s*"(\d+)\./m;
 function classifyDiff(patch) {
   if (patch.trim() === "") {
@@ -1311,6 +1429,9 @@ function classifyDiff(patch) {
       markers.push(label);
     }
   }
+  if (renamedSchemaRemoval(patch)) {
+    markers.push("a renamed file drops a column or table");
+  }
   const bump = MAJOR_BUMP.exec(patch);
   if (bump && bump[1] !== bump[2]) {
     markers.push(`major version bump ${bump[1]}.x to ${bump[2]}.x`);
@@ -1732,12 +1853,16 @@ function commandOp(command) {
   return found;
 }
 function mergeTargetOf(command) {
-  const gh = /\bgh\s+pr\s+merge\s+(?:-{1,2}\S+\s+)*?(\d{1,7})\b/i.exec(command);
+  const gh = /\bgh\s+pr\s+merge\s+(?:-{1,2}\S+\s+)*?(\d{1,10})\b/i.exec(command);
   if (gh) {
-    return Number.parseInt(gh[1], 10);
+    return _boundedTarget(gh[1]);
   }
-  const api = /\/pulls\/(\d{1,7})\/merge\b/i.exec(command);
-  return api ? Number.parseInt(api[1], 10) : null;
+  const api = /\/pulls\/(\d{1,10})\/merge\b/i.exec(command);
+  return api ? _boundedTarget(api[1]) : null;
+}
+function _boundedTarget(digits) {
+  const n = Number.parseInt(digits, 10);
+  return Number.isSafeInteger(n) && n > 0 && n <= PR_NUMBER_MAX ? n : null;
 }
 function grantCovers(grants, op, target) {
   if (op !== "pr-merge" || target === null) {