- schemaSafetyFromDecl: drop the now-unreachable nil return; the tier fill always produces a complete block for a declared Schema - validateDispatchDecl: panic when ConfirmFirst is set without Risk — it orders a confirmation that does not exist, and for declared-Schema writes an empty Risk would silently publish the read safety tier - RFC: document the boundary that write commands must declare Risk Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>