@@ -5,9 +5,9 @@ Machine-readable snapshot: `outputs/metrics_snapshot.json` regenerated with `mak
 > **Purpose:** One authoritative table of current pipeline metrics. If any doc disagrees
 > with this file, this file wins. Updated whenever benchmark/benchmark config changes.
 >
-> **Last updated:** 2026-09-02 (pilot pre-registration CLI check; benchmark values unchanged)
+> **Last updated:** 2026-09-05 (pilot pre-registration input boundary; benchmark values unchanged)
 
-> **Current verification note (2026-09-02):** Phase AA AA6 exposes the AARG-
+> **Current verification note (2026-09-05):** Phase AA AA6 exposes the AARG-
 > reproducibility aggregate through a repeatable CLI/make workflow, while Phase
 > AB AB5 exposes the ABAG- claim-integrity aggregate, Phase AC AC3 exposes the
 > ACDG- aggregate, Phase Y Y5 exposes the YAG- aggregate, and Phase Z Z5
@@ -100,7 +100,7 @@ Machine-readable snapshot: `outputs/metrics_snapshot.json` regenerated with `mak
 > Phase AC AC3 exposes the ACDG-
 > aggregate disconfirming-evidence gate as a repeatable CLI/make workflow. It
 > has 18 focused gate tests plus 2 CLI integration tests. Full pytest
-> collection succeeds at 12,435 tests; the live count is enforced by the
+> collection succeeds at 12,438 tests; the live count is enforced by the
 > current-state alignment test. This artifact does not establish
 > biological validation or benchmark improvement.
 
@@ -116,6 +116,12 @@ Machine-readable snapshot: `outputs/metrics_snapshot.json` regenerated with `mak
 > contract executable in the review loop; it does not authenticate signers,
 > validate assays, or establish biological evidence.
 
+> **Pilot pre-registration input-boundary note (2026-09-05):** The PRR CLI now
+> rejects malformed scalar, list, boolean, integer, and threshold field types
+> as structured input errors. This prevents permissive coercion and unhandled
+> exceptions; it does not authenticate signers or establish assay or biological
+> evidence.
+
 > **Pilot freeze-integrity note (2026-08-24):** Locked PRR- records now require
 > a deterministic SHA-256 over their canonical content. This catches edits to
 > frozen selection criteria and thresholds; it does not authenticate the
 
@@ -140,6 +140,8 @@ qualified pilot. A valid record must be locked and carry a matching
 `freeze_sha256`; an editable draft is expected to fail this check. The command
 checks record integrity only. It does not authenticate a signer, validate an
 assay, or establish biological evidence.
+Malformed field types are reported as input errors rather than being coerced
+or allowed to crash the command.
 
 ## Recalibration workflow
 
 
@@ -1,6 +1,6 @@
 # Roadmap
 
-## Current state — 2026-09-02
+## Current state — 2026-09-05
 
 Phase AB is complete as of 2026-07-26. AB5 exposes the existing CSD-, RDR-,
 EGN-, and EHP- claim-integrity artifacts through an ABAG- aggregate, CLI
@@ -204,6 +204,10 @@ On 2026-09-02, the PRR contract became reachable through the
 checks in the normal review loop, while remaining an integrity check rather
 than signer authentication, assay validation, or biological evidence.
 
+On 2026-09-05, the PRR CLI began rejecting malformed field types as structured
+input errors. This prevents permissive coercion or handler crashes at the JSON
+boundary while leaving valid locked and editable records unchanged.
+
 This file is the current milestone authority. The older
 [`50_LOOP_PLAN.md`](50_LOOP_PLAN.md) is a historical execution record, not a
 live status page. Select the next bottleneck from
 
@@ -2043,6 +2043,72 @@ def _run_pilot_preregistration_check(args: argparse.Namespace) -> int:
         print(json.dumps({"status": "error", "error": "--entry-json must be a JSON object"}))
         return 2
 
+    string_fields = (
+        "record_id", "version", "frozen_at", "pipeline_version", "git_sha",
+        "primary_hypothesis", "positive_control", "negative_control",
+        "outcome_metric", "notes", "freeze_sha256",
+    )
+    for field_name in string_fields:
+        if field_name in entry_dict and not isinstance(entry_dict[field_name], str):
+            print(json.dumps({
+                "status": "error",
+                "error": f"Malformed PRR JSON: {field_name} must be a string",
+            }))
+            return 2
+    list_fields = ("selection_criteria", "amendment_reasons", "score_thresholds")
+    for field_name in list_fields:
+        if field_name in entry_dict and not isinstance(entry_dict[field_name], list):
+            print(json.dumps({
+                "status": "error",
+                "error": f"Malformed PRR JSON: {field_name} must be a list",
+            }))
+            return 2
+    for field_name in ("dry_lab_only_declaration", "is_locked"):
+        if field_name in entry_dict and not isinstance(entry_dict[field_name], bool):
+            print(json.dumps({
+                "status": "error",
+                "error": f"Malformed PRR JSON: {field_name} must be a boolean",
+            }))
+            return 2
+    for field_name in ("n_candidates_planned", "amendment_count"):
+        if field_name in entry_dict and (
+            not isinstance(entry_dict[field_name], int)
+            or isinstance(entry_dict[field_name], bool)
+        ):
+            print(json.dumps({
+                "status": "error",
+                "error": f"Malformed PRR JSON: {field_name} must be an integer",
+            }))
+            return 2
+    for threshold in entry_dict.get("score_thresholds", []):
+        if not isinstance(threshold, dict):
+            print(json.dumps({
+                "status": "error",
+                "error": "Malformed PRR JSON: score_thresholds entries must be objects",
+            }))
+            return 2
+        if not isinstance(threshold.get("score_name"), str):
+            print(json.dumps({
+                "status": "error",
+                "error": "Malformed PRR JSON: score_thresholds.score_name must be a string",
+            }))
+            return 2
+        if (
+            not isinstance(threshold.get("threshold_value"), (int, float))
+            or isinstance(threshold.get("threshold_value"), bool)
+        ):
+            print(json.dumps({
+                "status": "error",
+                "error": "Malformed PRR JSON: score_thresholds.threshold_value must be numeric",
+            }))
+            return 2
+        if not isinstance(threshold.get("direction"), str):
+            print(json.dumps({
+                "status": "error",
+                "error": "Malformed PRR JSON: score_thresholds.direction must be a string",
+            }))
+            return 2
+
     try:
         thresholds = [
             ScoreThreshold(**threshold)
 
@@ -72,3 +72,39 @@ def test_invalid_preregistration_json_returns_input_error(capsys):
     assert rc == 2
     result = json.loads(capsys.readouterr().out)
     assert result["status"] == "error"
+
+
+def test_invalid_preregistration_field_type_returns_input_error(capsys):
+    payload = _locked_payload()
+    payload["selection_criteria"] = "not-a-list"
+    rc = main([
+        "pilot-preregistration-check",
+        "--entry-json", json.dumps(payload),
+    ])
+    assert rc == 2
+    result = json.loads(capsys.readouterr().out)
+    assert "selection_criteria must be a list" in result["error"]
+
+
+def test_invalid_preregistration_threshold_type_returns_input_error(capsys):
+    payload = _locked_payload()
+    payload["score_thresholds"][0]["threshold_value"] = "0.75"
+    rc = main([
+        "pilot-preregistration-check",
+        "--entry-json", json.dumps(payload),
+    ])
+    assert rc == 2
+    result = json.loads(capsys.readouterr().out)
+    assert "threshold_value must be numeric" in result["error"]
+
+
+def test_invalid_preregistration_scalar_type_returns_input_error(capsys):
+    payload = _locked_payload()
+    payload["primary_hypothesis"] = 42
+    rc = main([
+        "pilot-preregistration-check",
+        "--entry-json", json.dumps(payload),
+    ])
+    assert rc == 2
+    result = json.loads(capsys.readouterr().out)
+    assert "primary_hypothesis must be a string" in result["error"]