diff --git a/.github/workflows/downstream-seam-audit.yml b/.github/workflows/downstream-seam-audit.yml
index 361754aad..654497528 100644
--- a/.github/workflows/downstream-seam-audit.yml
+++ b/.github/workflows/downstream-seam-audit.yml
@@ -11,6 +11,7 @@ on:
       - bin/agent-workflow-writing-style
       - bin/agent-workflow-seam-doctor-test.rb
       - bin/agent_doctor/**
+      - skills/pr-batch/lib/github_actor_trust.rb
       - skills/secure-github-actions/lib/**
       - downstream.yml
       - seam-presets.yml
diff --git a/bin/agent-workflow-seam-doctor b/bin/agent-workflow-seam-doctor
index 7a65faae5..b940d2e94 100755
--- a/bin/agent-workflow-seam-doctor
+++ b/bin/agent-workflow-seam-doctor
@@ -342,8 +342,12 @@ module AgentWorkflowSeamDoctor
   end
 
   def validate_trust_mapping!(trust)
-    trusted_bots = Array(trust.fetch("trusted_bots", [])).map { |login| normalized_trust_bot_login(login) }
-    metadata_bots = Array(trust.fetch("trusted_metadata_bots", [])).map { |login| normalized_trust_bot_login(login) }
+    trusted_bots = strict_trust_role_list(
+      trust.fetch("trusted_bots", []), name: "trusted_bots"
+    ).map { |login| normalized_trust_bot_login(login) }
+    metadata_bots = strict_trust_role_list(
+      trust.fetch("trusted_metadata_bots", []), name: "trusted_metadata_bots"
+    ).map { |login| normalized_trust_bot_login(login) }
     overlap = (trusted_bots & metadata_bots).sort
     return if overlap.empty?
 
@@ -352,6 +356,16 @@ module AgentWorkflowSeamDoctor
           "trusted_metadata_bots: #{overlap.join(', ')}"
   end
 
+  # This executable is intentionally installable without the skill pack, so it
+  # keeps this small validation boundary local while matching GithubActorTrust.
+  def strict_trust_role_list(value, name:)
+    values = value.is_a?(Array) ? value : [value]
+    return [] if value.nil?
+    return values if values.all? { |entry| entry.is_a?(String) && !entry.strip.empty? }
+
+    raise InitError, "#{name} must be a nonempty string or an array of nonempty strings"
+  end
+
   def normalized_trust_bot_login(login)
     login.to_s.delete_prefix("@").downcase.delete_suffix("[bot]")
   end
diff --git a/bin/agent-workflow-seam-doctor-test.rb b/bin/agent-workflow-seam-doctor-test.rb
index 264cb08ef..9febf342d 100755
--- a/bin/agent-workflow-seam-doctor-test.rb
+++ b/bin/agent-workflow-seam-doctor-test.rb
@@ -2225,6 +2225,36 @@ def test_regular_check_accepts_scalar_trust_values_for_preflight_compatibility
     end
   end
 
+  def test_regular_check_rejects_malformed_trust_role_values_before_normalization
+    malformed_cases = [
+      ["trusted_bots", { "deploy" => true }],
+      ["trusted_bots", 42],
+      ["trusted_metadata_bots", ["deploy", 42]],
+      ["trusted_metadata_bots", [""]]
+    ]
+
+    malformed_cases.each do |key, value|
+      with_repo("agent-workflow-seam-doctor-trust-role-shape") do |root|
+        write_valid_binstub_contract(root)
+        write_skill(root, "No commands here.\n")
+        trust = {
+          "trusted_users" => [],
+          "trusted_bots" => [],
+          "trusted_metadata_bots" => [],
+          "trusted_teams" => []
+        }
+        trust[key] = value
+        File.write(File.join(root, ".agents/trusted-github-actors.yml"), trust.to_yaml)
+
+        out, status = run_doctor(root)
+
+        refute status.success?, out
+        assert_includes out, "FAIL agent workflow seam has 1 issue(s)"
+        assert_includes out, "#{key} must be a nonempty string or an array of nonempty strings"
+      end
+    end
+  end
+
   def test_regular_check_rejects_overlapping_trust_bot_roles
     with_repo do |root|
       write_valid_binstub_contract(root)
diff --git a/bin/push-downstream b/bin/push-downstream
index 76a58f962..86fa3ae0d 100755
--- a/bin/push-downstream
+++ b/bin/push-downstream
@@ -12,6 +12,7 @@ require "tmpdir"
 require "yaml"
 
 load File.expand_path("agent-workflow-seam-doctor", __dir__)
+require_relative "../skills/pr-batch/lib/github_actor_trust"
 require_relative "../skills/secure-github-actions/lib/secure_github_actions_scanner"
 
 module PushDownstream
@@ -596,9 +597,20 @@ module PushDownstream
   def normalize_trust_config(trust)
     trust = stringify_keys(trust || {})
     TRUST_KEYS.to_h do |key|
-      values = Array(trust[key]).map { |value| normalize_trust_value(key, value) }.reject(&:empty?)
+      raw_values =
+        case key
+        when "trusted_bots", "trusted_metadata_bots"
+          GithubActorTrust.strict_string_list(trust[key], name: key)
+        else
+          Array(trust[key])
+        end
+      values = raw_values.map { |value| normalize_trust_value(key, value) }.reject(&:empty?)
       [key, values.uniq]
     end
+  rescue GithubActorTrust::Error => e
+    # Fleet callers rescue RuntimeError per repository; preserve that public
+    # failure boundary so one malformed consumer contract cannot abort the run.
+    raise e.message.to_s
   end
 
   def normalize_trust_value(key, value)
@@ -2658,87 +2670,92 @@ if $PROGRAM_NAME == __FILE__
   end.parse!
 
   code =
-    if options[:audit]
-      if options[:root] || options[:policy_fleet]
-        warn "--audit cannot be combined with --root or --policy-fleet"
-        1
+    begin
+      if options[:audit]
+        if options[:root] || options[:policy_fleet]
+          warn "--audit cannot be combined with --root or --policy-fleet"
+          1
+        elsif options[:security_audit_fleet]
+          warn "--audit cannot be combined with --security-audit-fleet"
+          1
+        elsif options[:apply]
+          warn "--audit is read-only and cannot be combined with --apply"
+          1
+        elsif !PushDownstream.trust_config_empty?(options[:trust])
+          warn "--trusted-* flags require --root; --audit never writes to a consumer"
+          1
+        else
+          PushDownstream.run_audit(
+            options[:config],
+            options[:presets],
+            only: options[:only],
+            include_disabled: options[:include_disabled]
+          )
+        end
+      elsif options[:root]
+        if options[:policy_fleet] || options[:security_audit_fleet]
+          warn "--policy-fleet and --security-audit-fleet cannot be combined with --root"
+          1
+        else
+          PushDownstream.run_local(
+            options[:root],
+            base_branch: options[:base_branch],
+            trust: options[:trust],
+            apply: options[:apply]
+          )
+        end
       elsif options[:security_audit_fleet]
-        warn "--audit cannot be combined with --security-audit-fleet"
-        1
-      elsif options[:apply]
-        warn "--audit is read-only and cannot be combined with --apply"
-        1
-      elsif !PushDownstream.trust_config_empty?(options[:trust])
-        warn "--trusted-* flags require --root; --audit never writes to a consumer"
-        1
-      else
-        PushDownstream.run_audit(
-          options[:config],
-          options[:presets],
-          only: options[:only],
-          include_disabled: options[:include_disabled]
-        )
-      end
-    elsif options[:root]
-      if options[:policy_fleet] || options[:security_audit_fleet]
-        warn "--policy-fleet and --security-audit-fleet cannot be combined with --root"
-        1
-      else
-        PushDownstream.run_local(
-          options[:root],
-          base_branch: options[:base_branch],
-          trust: options[:trust],
-          apply: options[:apply]
-        )
-      end
-    elsif options[:security_audit_fleet]
-      if options[:apply]
-        warn "--apply cannot be combined with --security-audit-fleet"
-        1
+        if options[:apply]
+          warn "--apply cannot be combined with --security-audit-fleet"
+          1
+        elsif options[:policy_fleet]
+          warn "--policy-fleet cannot be combined with --security-audit-fleet"
+          1
+        elsif options[:include_disabled]
+          warn "--all cannot be combined with --security-audit-fleet; fleet membership is explicit"
+          1
+        elsif !PushDownstream.trust_config_empty?(options[:trust])
+          warn "--trusted-* flags cannot be combined with --security-audit-fleet"
+          1
+        else
+          PushDownstream.run_security_audit_fleet(
+            options[:config],
+            fleet_name: options[:security_audit_fleet],
+            only: options[:only]
+          )
+        end
       elsif options[:policy_fleet]
-        warn "--policy-fleet cannot be combined with --security-audit-fleet"
-        1
-      elsif options[:include_disabled]
-        warn "--all cannot be combined with --security-audit-fleet; fleet membership is explicit"
-        1
-      elsif !PushDownstream.trust_config_empty?(options[:trust])
-        warn "--trusted-* flags cannot be combined with --security-audit-fleet"
-        1
-      else
-        PushDownstream.run_security_audit_fleet(
-          options[:config],
-          fleet_name: options[:security_audit_fleet],
-          only: options[:only]
-        )
-      end
-    elsif options[:policy_fleet]
-      if options[:include_disabled]
-        warn "--all cannot be combined with --policy-fleet; fleet membership is explicit"
-        1
-      elsif !PushDownstream.trust_config_empty?(options[:trust])
-        warn "--trusted-* flags require --root; policy fleets read only their registered policy values"
-        1
+        if options[:include_disabled]
+          warn "--all cannot be combined with --policy-fleet; fleet membership is explicit"
+          1
+        elsif !PushDownstream.trust_config_empty?(options[:trust])
+          warn "--trusted-* flags require --root; policy fleets read only their registered policy values"
+          1
+        else
+          PushDownstream.run_policy_fleet(
+            options[:config],
+            fleet_name: options[:policy_fleet],
+            only: options[:only],
+            apply: options[:apply]
+          )
+        end
       else
-        PushDownstream.run_policy_fleet(
+        unless PushDownstream.trust_config_empty?(options[:trust])
+          warn "--trusted-* flags require --root; use downstream.yml or seam-presets.yml trust blocks in registry mode"
+          exit 1
+        end
+
+        PushDownstream.run_registry(
           options[:config],
-          fleet_name: options[:policy_fleet],
+          options[:presets],
           only: options[:only],
+          include_disabled: options[:include_disabled],
           apply: options[:apply]
         )
       end
-    else
-      unless PushDownstream.trust_config_empty?(options[:trust])
-        warn "--trusted-* flags require --root; use downstream.yml or seam-presets.yml trust blocks in registry mode"
-        exit 1
-      end
-
-      PushDownstream.run_registry(
-        options[:config],
-        options[:presets],
-        only: options[:only],
-        include_disabled: options[:include_disabled],
-        apply: options[:apply]
-      )
+    rescue RuntimeError => e
+      warn "FAIL: #{e.message}"
+      1
     end
 
   exit code
diff --git a/bin/push-downstream-test.rb b/bin/push-downstream-test.rb
index 756373e7e..ff5bf0f19 100755
--- a/bin/push-downstream-test.rb
+++ b/bin/push-downstream-test.rb
@@ -72,6 +72,7 @@ def test_workflow_is_a_read_only_audit_without_a_publisher_surface
       "bin/agent-workflow-writing-style",
       "bin/agent-workflow-seam-doctor-test.rb",
       "bin/agent_doctor/**",
+      "skills/pr-batch/lib/github_actor_trust.rb",
       "skills/secure-github-actions/lib/**",
       "downstream.yml",
       "seam-presets.yml"
@@ -242,8 +243,7 @@ def test_registry_dry_run_reports_invalid_contract_without_aborting_valid_repos
         - repo: bad
           overrides:
             trust:
-              trusted_bots: [github-actions]
-              trusted_metadata_bots: [github-actions]
+              trusted_metadata_bots: [github-actions, 42]
     YAML
 
     with_config(yaml) do |path|
@@ -255,7 +255,7 @@ def test_registry_dry_run_reports_invalid_contract_without_aborting_valid_repos
       assert_equal 1, @registry_status
       assert_includes out, "shakacode/good"
       refute_includes out, "shakacode/bad"
-      assert_includes err, "FAIL shakacode/bad: invalid trust config"
+      assert_includes err, "FAIL shakacode/bad: trusted_metadata_bots must be a nonempty string or an array of nonempty strings"
     end
   end
 
@@ -270,8 +270,7 @@ def test_registry_apply_continues_after_invalid_contract
         - repo: bad
           overrides:
             trust:
-              trusted_bots: [github-actions]
-              trusted_metadata_bots: [github-actions]
+              trusted_metadata_bots: [github-actions, 42]
     YAML
 
     with_config(yaml) do |path|
@@ -289,7 +288,7 @@ def test_registry_apply_continues_after_invalid_contract
 
         assert_equal 1, @registry_status
         assert_equal ["shakacode/good"], calls
-        assert_includes err, "FAIL shakacode/bad: invalid trust config"
+        assert_includes err, "FAIL shakacode/bad: trusted_metadata_bots must be a nonempty string or an array of nonempty strings"
       end
     end
   end
@@ -968,6 +967,27 @@ def test_resolve_contract_rejects_bot_metadata_overlap
     assert_match(/bot\(s\) listed in both trusted_bots and trusted_metadata_bots: github-actions/, error.message)
   end
 
+  def test_resolve_contract_rejects_malformed_bot_role_values
+    presets = {
+      "defaults" => {
+        "trust" => {
+          "trusted_bots" => ["dependabot"],
+          "trusted_metadata_bots" => ["github-actions", 42]
+        }
+      }
+    }
+    repo = {
+      repo: "rsc", base_branch: "main", preset: nil,
+      overrides: { "trust" => {} }
+    }
+
+    error = assert_raises(RuntimeError) do
+      PushDownstream.resolve_contract(repo, presets)
+    end
+
+    assert_match(/trusted_metadata_bots must be a nonempty string or an array of nonempty strings/, error.message)
+  end
+
   def test_resolve_contract_unknown_preset_raises
     error = assert_raises(RuntimeError) do
       PushDownstream.resolve_contract(
@@ -3974,6 +3994,14 @@ def test_registry_mode_rejects_cli_trust_flags
     assert_includes out, "--trusted-* flags require --root"
   end
 
+  def test_empty_trusted_bot_flag_fails_without_a_backtrace
+    out, status = run_cli("--trusted-bot", "")
+
+    refute status.success?, out
+    assert_includes out, "FAIL: trusted_bots must be a nonempty string or an array of nonempty strings"
+    refute_match(/(?:RuntimeError|Traceback|from .*push-downstream)/, out)
+  end
+
   def test_local_apply_reports_invalid_trust_config_without_backtrace
     Dir.mktmpdir("push-downstream-cli") do |root|
       FileUtils.mkdir_p(File.join(root, ".agents"))
diff --git a/skills/pr-batch/bin/github-actor-trust-test.rb b/skills/pr-batch/bin/github-actor-trust-test.rb
index 9f86955c3..f1e7a98b6 100755
--- a/skills/pr-batch/bin/github-actor-trust-test.rb
+++ b/skills/pr-batch/bin/github-actor-trust-test.rb
@@ -68,6 +68,27 @@ def test_overlapping_bot_classification_fails_closed
     assert_match(/listed in both/, error.message)
   end
 
+  def test_bot_roles_reject_malformed_values_before_normalization
+    {
+      "trusted_bots: { deploy: true }\n" => "trusted_bots",
+      "trusted_bots: 42\n" => "trusted_bots",
+      "trusted_metadata_bots: [github-actions, 42]\n" => "trusted_metadata_bots",
+      "trusted_metadata_bots: ['']\n" => "trusted_metadata_bots",
+      "trusted_bots: ['   ']\n" => "trusted_bots"
+    }.each do |yaml, role|
+      error = assert_raises(GithubActorTrust::Error) { config(yaml) }
+
+      assert_equal "#{role} must be a nonempty string or an array of nonempty strings", error.message
+    end
+  end
+
+  def test_bot_roles_preserve_legacy_scalar_string_compatibility
+    loaded = config("trusted_bots: deploy\ntrusted_metadata_bots: github-actions\n")
+
+    assert_equal Set["deploy"], loaded.fetch(:trusted_bots)
+    assert_equal Set["github-actions"], loaded.fetch(:trusted_metadata_bots)
+  end
+
   # A stray blank list item parses to nil; that must not crash out of the
   # Error contract both callers rescue on.
   def test_blank_team_entry_is_ignored_rather_than_crashing
diff --git a/skills/pr-batch/bin/integration-closeout-contract-test.rb b/skills/pr-batch/bin/integration-closeout-contract-test.rb
index 0eefca92c..7320e7241 100755
--- a/skills/pr-batch/bin/integration-closeout-contract-test.rb
+++ b/skills/pr-batch/bin/integration-closeout-contract-test.rb
@@ -159,12 +159,11 @@ def test_component_owns_the_full_closeout_interface
       assert_match(/^\#{2,3} #{Regexp.escape(heading)}$/, @component, heading)
     end
 
-    # Temporary headroom: main sat within 32 bytes of the combined cap and within
-    # 500 bytes of the skill cap, so every PR that added a sentence failed here
-    # (#772). Shrink these again once the #392 extraction work lands.
+    # Temporary headroom: main exceeded the prior combined cap after later
+    # scoped growth. Keep a small buffer until the #392 extraction work lands.
     assert_operator @workflow.bytesize, :<, 210_000
     assert_operator @skill.bytesize, :<, 70_000
-    assert_operator @component.bytesize + @workflow.bytesize + @skill.bytesize, :<, 450_000
+    assert_operator @component.bytesize + @workflow.bytesize + @skill.bytesize, :<, 455_000
     assert_includes @component, "worker-execution-handoff v1"
     assert_includes @component, "one replayable target ledger and human-first handoff"
     assert_includes @component, "current-head closeout gates"
diff --git a/skills/pr-batch/bin/pr-security-preflight b/skills/pr-batch/bin/pr-security-preflight
index 70d702b5c..b71f963e5 100755
--- a/skills/pr-batch/bin/pr-security-preflight
+++ b/skills/pr-batch/bin/pr-security-preflight
@@ -1181,7 +1181,8 @@ end
 def load_trust_config(path:, global:, contents:)
   GithubActorTrust.load(path:, global:, contents:)
 rescue GithubActorTrust::Error => e
-  abort e.message
+  prefix = "Invalid trust config #{path}:"
+  abort(e.message.start_with?(prefix) ? e.message : "#{prefix} #{e.message}")
 end
 
 def bot_login_in_set?(login, trusted_set)
diff --git a/skills/pr-batch/bin/pr-security-preflight-test.rb b/skills/pr-batch/bin/pr-security-preflight-test.rb
index 251e44a76..b22e0de43 100755
--- a/skills/pr-batch/bin/pr-security-preflight-test.rb
+++ b/skills/pr-batch/bin/pr-security-preflight-test.rb
@@ -1798,6 +1798,26 @@ def test_trust_config_rejects_bot_overlap
     end
   end
 
+  def test_trust_config_rejects_malformed_bot_roles_before_normalization
+    with_fake_gh("warning-issue") do |env, trust_config_path, _log_path|
+      File.write(trust_config_path, <<~YAML)
+        trusted_users: []
+        trusted_bots:
+          - coderabbitai
+        trusted_metadata_bots:
+          - github-actions
+          - 42
+        trusted_teams: []
+      YAML
+
+      out, status = run_script(env, "--repo", "owner/repo", "--trust-config", trust_config_path, "123")
+
+      refute status.success?, out
+      assert_equal 1, status.exitstatus
+      assert_includes out, "Invalid trust config #{trust_config_path}: trusted_metadata_bots must be a nonempty string or an array of nonempty strings"
+    end
+  end
+
   def test_trust_config_rejects_non_mapping_yaml
     with_fake_gh("warning-issue") do |env, trust_config_path, _log_path|
       File.write(trust_config_path, "[]\n")
@@ -8117,7 +8137,7 @@ def test_human_login_matching_bot_base_name_is_not_trusted_as_bot
     end
   end
 
-  def test_blank_trusted_bot_entry_does_not_trust_human_canonical_node
+  def test_blank_trusted_bot_entry_fails_closed_before_participant_processing
     with_fake_gh("human-bot-basename-participant") do |env, trust_config_path, log_path|
       File.write(trust_config_path, <<~YAML)
         trusted_users: []
@@ -8138,11 +8158,9 @@ def test_blank_trusted_bot_entry_does_not_trust_human_canonical_node
       )
 
       refute status.success?, out
-      assert_equal 2, status.exitstatus
-      assert_includes out, "SECURITY_PREFLIGHT_BLOCKED"
-      assert_includes out, "Copilot: no visible comment/review/commit/reaction trail"
-      assert_includes out, "not in trusted actor allowlist"
-      assert_equal 1, canonical_bot_query_call_count(log_path)
+      assert_equal 1, status.exitstatus
+      assert_includes out, "Invalid trust config #{trust_config_path}: trusted_bots must be a nonempty string or an array of nonempty strings"
+      assert_equal 0, canonical_bot_query_call_count(log_path)
     end
   end
 
diff --git a/skills/pr-batch/bin/stale-assignment-sweep b/skills/pr-batch/bin/stale-assignment-sweep
index b12d14fa5..626e1c8f3 100755
--- a/skills/pr-batch/bin/stale-assignment-sweep
+++ b/skills/pr-batch/bin/stale-assignment-sweep
@@ -16,6 +16,7 @@ require "tempfile"
 require "time"
 require "timeout"
 require "yaml"
+require_relative "../lib/github_actor_trust"
 require_relative "../lib/github_comment_envelope"
 
 module StaleAssignmentSweep
@@ -266,7 +267,12 @@ module StaleAssignmentSweep
       raise Error, "expected a YAML mapping at the top level" unless data.is_a?(Hash) || data.nil?
 
       data ||= {}
-      @trusted_bots = Array(data["trusted_bots"]).map { |login| normalized_bot_login(login) }
+      @trusted_bots = GithubActorTrust.strict_string_list(data["trusted_bots"], name: "trusted_bots")
+                                      .map { |login| normalized_bot_login(login) }
+      # Validate the shared metadata-bot role shape too, even though this sweep
+      # only consults `trusted_bots`; malformed trust files should fail closed at
+      # every seam that consumes the shared config.
+      GithubActorTrust.strict_string_list(data["trusted_metadata_bots"], name: "trusted_metadata_bots")
       # `trusted_users` (humans) is intentionally not read here: the sweep treats
       # humans as sweepable, so `automation_login?` only consults `trusted_bots`
       # and the `[bot]` suffix. Parsing it would be a dead field.
diff --git a/skills/pr-batch/bin/stale-assignment-sweep-test.rb b/skills/pr-batch/bin/stale-assignment-sweep-test.rb
index 8213823a1..839a2de2d 100755
--- a/skills/pr-batch/bin/stale-assignment-sweep-test.rb
+++ b/skills/pr-batch/bin/stale-assignment-sweep-test.rb
@@ -309,6 +309,16 @@ def test_unresolved_automation_set_fails_closed_with_no_mutations
     refute_includes log, "DELETE"
   end
 
+  def test_malformed_trust_config_fails_closed_with_no_mutations
+    result, log = run_cli(apply: true, trust_file: "invalid-trust.yml")
+
+    assert result.fetch(:status).success?, result.fetch(:stderr)
+    assert_includes result.fetch(:stdout), "UNRESOLVED"
+    assert_includes result.fetch(:stdout), "fail-closed: automation set unresolved"
+    refute_includes log, "/comments"
+    refute_includes log, "DELETE"
+  end
+
   # --- Fix E: closed/merged items are skipped ---------------------------
 
   def test_item_closed_between_listing_and_apply_is_not_swept
@@ -779,6 +789,17 @@ def write_trust_config(dir)
           - maintainer1
       YAML
     )
+    File.write(
+      File.join(dir, "invalid-trust.yml"),
+      <<~YAML
+        trusted_bots:
+          - app-runner
+        trusted_metadata_bots:
+          - 42
+        trusted_users:
+          - maintainer1
+      YAML
+    )
   end
 
   def write_fake_gh(dir)
diff --git a/skills/pr-batch/bin/target-membership-guard b/skills/pr-batch/bin/target-membership-guard
index 2cd5d8f76..ff864c962 100755
--- a/skills/pr-batch/bin/target-membership-guard
+++ b/skills/pr-batch/bin/target-membership-guard
@@ -192,8 +192,15 @@ unless raw_input.valid_encoding?
 end
 
 begin
-  input = JSON.parse(raw_input)
-rescue JSON::ParserError
+  input = JSON.parse(raw_input, allow_duplicate_key: true)
+rescue JSON::ParserError => e
+  if e.message.match?(/\A(?:(?:incomplete|invalid) surrogate pair|unpaired trailing surrogate)\b/i)
+    emit_unknown(
+      "input contains invalid Unicode scalar data",
+      next_action: "replace invalid Unicode scalar data and replay the guard"
+    )
+  end
+
   emit_unknown(
     "input is not valid JSON",
     next_action: "provide one target-membership-request v1 object and replay the guard"
diff --git a/skills/pr-batch/bin/target-membership-guard-test.rb b/skills/pr-batch/bin/target-membership-guard-test.rb
index 6d2bde100..7685fddfb 100755
--- a/skills/pr-batch/bin/target-membership-guard-test.rb
+++ b/skills/pr-batch/bin/target-membership-guard-test.rb
@@ -200,6 +200,20 @@ def test_invalid_unicode_scalar_in_decoded_object_key_fails_closed
     assert_equal "input contains invalid Unicode scalar data", result.fetch("reason")
   end
 
+  def test_malformed_ascii_json_that_mentions_surrogate_keeps_the_json_diagnostic
+    ["surrogate", "{surrogate:1}", '{"x":surrogate}'].each do |input|
+      result, stderr, status = invoke_raw(input)
+
+      assert_equal 2, status.exitstatus, stderr
+      assert_equal "UNKNOWN", result.fetch("status")
+      assert_equal false, result.fetch("control_allowed")
+      assert_equal false, result.fetch("evidence_delivery_allowed")
+      assert_equal "input is not valid JSON", result.fetch("reason")
+      assert_equal "provide one target-membership-request v1 object and replay the guard",
+                   result.fetch("next_action")
+    end
+  end
+
   def test_blocks_control_for_a_foreign_target_as_evidence_only
     result, stderr, status = invoke("target" => "shakacode/hichee#9992")
 
diff --git a/skills/pr-batch/lib/github_actor_trust.rb b/skills/pr-batch/lib/github_actor_trust.rb
index 2ef416acf..892639375 100644
--- a/skills/pr-batch/lib/github_actor_trust.rb
+++ b/skills/pr-batch/lib/github_actor_trust.rb
@@ -310,8 +310,10 @@ def load(path:, global:, contents: nil)
   end
 
   def build_config(data, contents:, path:, global:)
-    trusted_bots = Array(data["trusted_bots"]).to_set { |login| normalized_bot_login(login) }
-    trusted_metadata_bots = Array(data["trusted_metadata_bots"]).to_set { |login| normalized_bot_login(login) }
+    trusted_bots = strict_string_list(data["trusted_bots"], name: "trusted_bots")
+                   .to_set { |login| normalized_bot_login(login) }
+    trusted_metadata_bots = strict_string_list(data["trusted_metadata_bots"], name: "trusted_metadata_bots")
+                            .to_set { |login| normalized_bot_login(login) }
     trusted_metadata_bots.merge(packaged_metadata_bots - trusted_bots)
     overlapping_bots = trusted_bots & trusted_metadata_bots
     if overlapping_bots.any?
@@ -329,6 +331,31 @@ def build_config(data, contents:, path:, global:)
     }
   end
 
+  # Bot roles are a compatibility boundary: legacy scalar strings and lists are
+  # both supported, but values must be meaningful strings before any caller
+  # normalizes them. Otherwise YAML types such as hashes can be stringified into
+  # a surprising allowlist entry or silently disappear during normalization.
+  def strict_string_list(value, name:)
+    case value
+    when nil
+      []
+    when String
+      validate_role_string!(value, name:)
+      [value]
+    when Array
+      value.each { |entry| validate_role_string!(entry, name:) }
+      value
+    else
+      raise Error, "#{name} must be a nonempty string or an array of nonempty strings"
+    end
+  end
+
+  def validate_role_string!(value, name:)
+    return if value.is_a?(String) && !value.strip.empty?
+
+    raise Error, "#{name} must be a nonempty string or an array of nonempty strings"
+  end
+
   def normalized_teams(values, require_owner:)
     Array(values).filter_map { |value| normalized_team_entry(value, require_owner:) }
   end