diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 00f340a..6eaf347 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -2,6 +2,9 @@ name: PR Checks
 on:
   pull_request:
     types: [opened, reopened, synchronize, edited]
+permissions:
+  pull-requests: write
+  contents: read
 jobs:
   validate:
     runs-on: ubuntu-latest
diff --git a/package-lock.json b/package-lock.json
index 9358015..ced4e7f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -396,6 +396,7 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -600,6 +601,7 @@
       "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.7.tgz",
       "integrity": "sha512-l7qMiNee7t82bH3SeyUCt9UF15EVmaBvsppY2zQtrbIhl/yzBTny+YUxsVjSjQ6gaqaeVtZmGocom8TzBlA4Yw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=16.9.0"
       }
@@ -1170,6 +1172,7 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
       "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
diff --git a/src/services/agent.ts b/src/services/agent.ts
index de10ae7..7fe5a96 100644
--- a/src/services/agent.ts
+++ b/src/services/agent.ts
@@ -91,10 +91,11 @@ export class AutonomousAgent {
 
       console.log(`\n📬 [${new Date().toLocaleTimeString()}] Found ${newMentions.length} new mention(s)!\n`);
 
-      // Process each mention
-      for (const mention of newMentions) {
-        await this.processMention(mention);
-        this.processedMentions.add(mention.post.id);
+      // Process mentions oldest-first so Set insertion order matches chronological order
+      // (API returns newest-first, so we reverse to get oldest-first)
+      for (let i = newMentions.length - 1; i >= 0; i--) {
+        await this.processMention(newMentions[i]);
+        this.processedMentions.add(newMentions[i].post.id);
       }
 
       // Prune oldest entries to prevent unbounded memory growth
@@ -102,7 +103,11 @@ export class AutonomousAgent {
         const excess = this.processedMentions.size - AutonomousAgent.MAX_PROCESSED_MENTIONS;
         const iter = this.processedMentions.values();
         for (let i = 0; i < excess; i++) {
-          this.processedMentions.delete(iter.next().value as string);
+          const { value, done } = iter.next();
+          if (done) {
+            break;
+          }
+          this.processedMentions.delete(value);
         }
       }
     } catch (error) {
diff --git a/src/services/xapi.ts b/src/services/xapi.ts
index ab6c4b5..3507c24 100644
--- a/src/services/xapi.ts
+++ b/src/services/xapi.ts
@@ -91,6 +91,11 @@ export class XAPIClient {
         return null;
       }
 
+      if (!Array.isArray(response.data)) {
+        console.warn('Unexpected response shape from X API (thread): data is not an array');
+        return null;
+      }
+
       return this.parseThread(response.data);
     } catch (error) {
       console.error('Error fetching thread:', error);