diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 00f340a..6eaf347 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -2,6 +2,9 @@ name: PR Checks
 on:
   pull_request:
     types: [opened, reopened, synchronize, edited]
+permissions:
+  pull-requests: write
+  contents: read
 jobs:
   validate:
     runs-on: ubuntu-latest
diff --git a/src/services/agent.ts b/src/services/agent.ts
index de10ae7..bb88305 100644
--- a/src/services/agent.ts
+++ b/src/services/agent.ts
@@ -91,10 +91,11 @@ export class AutonomousAgent {
 
       console.log(`\n📬 [${new Date().toLocaleTimeString()}] Found ${newMentions.length} new mention(s)!\n`);
 
-      // Process each mention
-      for (const mention of newMentions) {
-        await this.processMention(mention);
-        this.processedMentions.add(mention.post.id);
+      // Process mentions oldest-first (API returns newest-first, so reverse)
+      // This ensures Set insertion order matches chronological order for proper pruning
+      for (let i = newMentions.length - 1; i >= 0; i--) {
+        await this.processMention(newMentions[i]);
+        this.processedMentions.add(newMentions[i].post.id);
       }
 
       // Prune oldest entries to prevent unbounded memory growth
@@ -102,7 +103,11 @@ export class AutonomousAgent {
         const excess = this.processedMentions.size - AutonomousAgent.MAX_PROCESSED_MENTIONS;
         const iter = this.processedMentions.values();
         for (let i = 0; i < excess; i++) {
-          this.processedMentions.delete(iter.next().value as string);
+          const { value, done } = iter.next();
+          if (done) {
+            break;
+          }
+          this.processedMentions.delete(value);
         }
       }
     } catch (error) {
diff --git a/src/services/xapi.ts b/src/services/xapi.ts
index ab6c4b5..3507c24 100644
--- a/src/services/xapi.ts
+++ b/src/services/xapi.ts
@@ -91,6 +91,11 @@ export class XAPIClient {
         return null;
       }
 
+      if (!Array.isArray(response.data)) {
+        console.warn('Unexpected response shape from X API (thread): data is not an array');
+        return null;
+      }
+
       return this.parseThread(response.data);
     } catch (error) {
       console.error('Error fetching thread:', error);