diff --git a/.claude/memory/decisions.md b/.claude/memory/decisions.md
index 6914473..f77d609 100644
--- a/.claude/memory/decisions.md
+++ b/.claude/memory/decisions.md
@@ -1307,3 +1307,4 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate).
 - **Alternatives rejected**: vendor all 22 (bugs + duplicates + 17×~100 tok descriptions); distil only (loses the two deep workflows whose value is their full text); second inline curl loop (duplication; helper instead); `VENDOR_BASE_URL` gated by a companion var (file:// prefix check suffices); grouped toggle pack (per-name like emil).
 - **Caveats**: vendored prompts change upstream with no diff, pin = review point; GSAP-first content vs [[BDR-005]] `motion` default, site-motion states the allowance; LOW hardening open: `re.match` `$` accepts a trailing newline, `source`/`path`/`sha` lock fields not charset-checked; `make link` + `bash lib/profile.sh apply full` after merge (user); sub-agent leftovers `/tmp/mengto-verify` (user removes).
 - **Reference**: commits 2a1ad17 (helper + vendoring), ba14b5e (site-motion); contracts `.claude/tasks/contracts/2026-09-27-{mengto-vendor,site-motion-skill}-0002.md`; gates MET, verifiers CONFORME after 3 re-dispatches (frontmatter shape, refresh convention, security env override + traversal), security PASS ×2, `make test` 36 suites green minus 2 pre-existing T16a. Links [[BDR-103]] [[BDR-102]] [[LRN-141]] [[LRN-174]] [[EVAL-033]].
+- **Amendment 2026-09-28**: the two LOW caveats closed on user ask (415b44e): `re.fullmatch` guard, `commit`/`source`/`path` validated before URL construction, 4 more hermetic cases (12). Security PASS, verifier CONFORME 9/9.
diff --git a/.claude/memory/journal.md b/.claude/memory/journal.md
index 4a7167b..be4c3bf 100644
--- a/.claude/memory/journal.md
+++ b/.claude/memory/journal.md
@@ -531,3 +531,4 @@ rules:
 
 ## 2026-09-28
 - Case 7 (MengTo motion pack), user go "l'hybride" → [[BDR-104]]: `lib/vendor-skills.sh` shared helper (agent-skills moved onto it), 5 scroll skills vendored at a965851 (2a1ad17), `skills/site-motion` personal skill + routing (ba14b5e). Two analyzers read 22 skills first; 17 skipped (bugs, duplicates, covered, Codex/Xcode machinery). Gates MET, verifiers CONFORME after 3 re-dispatches (frontmatter shape, update-all refresh convention, security env override + traversal), security PASS ×2, `make test` 36 suites green minus 2 pre-existing T16a, shellcheck clean. [[LRN-174]] [[EVAL-033]]. feature/mengto-site-motion UNMERGED. Open for the user: `make link` + `bash lib/profile.sh apply full`, `rm -rf /tmp/mengto-verify`, LOW hardening (regex trailing newline, source/path/sha charset).
+- User: "fais les deux low, et après on merge". Hardening by fresh executor (415b44e): fullmatch guard + lock field validation, 12-case suite; verifier CONFORME 9/9, security PASS 0 findings, full make test 36 suites green minus 2 pre-existing T16a. Merge of feature/mengto-site-motion into develop follows.
diff --git a/.claude/tasks/TODO.md b/.claude/tasks/TODO.md
index fe36570..b1295d4 100644
--- a/.claude/tasks/TODO.md
+++ b/.claude/tasks/TODO.md
@@ -15,8 +15,8 @@ executors in parallel, gates replayed (gates.sh → fresh verifier → security)
       make test 36 suites green minus 2 pre-existing T16a, CHANGELOG, BDR-104 LRN-174
       EVAL-033. UNMERGED — human gate. After merge: `make link` + `bash lib/profile.sh
       apply full`; user removes `/tmp/mengto-verify`.
-Follow-up LOW (security): `SAFE` regex `$` accepts a trailing newline (use `\Z`);
-`source`/`path`/`commit` lock fields not charset-checked in lib/vendor-skills.sh.
+- [x] M4 415b44e LOW hardening on user ask: `re.fullmatch` guard, `commit`/`source`/`path`
+      validated, 12-case suite; verifier CONFORME, security PASS.
 Skipped on purpose (analysis 2026-09-27): cinematic-gsap-lenis (reduced-motion bug),
 cinematic-scroll-storytelling (50 % duplicate), build-awwwards-quality-sites (0 code),
 animation-systems, gsap, threejs (⊂ ui-ux-pro-max threejs.csv), cobejs, matterjs,