diff --git a/src/selfTest.ts b/src/selfTest.ts
index ecc474c..c0a1a97 100644
--- a/src/selfTest.ts
+++ b/src/selfTest.ts
@@ -129,8 +129,10 @@ export async function runSelfTest(): Promise<void> {
   const dryRunAuditCommandText = dryRunAuditCommands.join("\n");
   for (const expected of [
     "git status --short --branch",
-    "git fetch --dry-run",
+    "git fetch upstream --tags --prune",
+    "git fetch origin --prune",
     "git diff --name-only",
+    "git merge-tree",
   ]) {
     if (!dryRunAuditCommandText.includes(expected)) {
       throw new Error(
@@ -139,15 +141,15 @@ export async function runSelfTest(): Promise<void> {
     }
   }
   for (const forbidden of [
-    "git merge",
-    "git push",
-    "docker build",
-    "kubectl",
-    "deploy",
+    { label: "git merge", regex: /(^|\n)\s*git\s+merge(?:\s|$)/ },
+    { label: "git push", regex: /(^|\n)\s*git\s+push(?:\s|$)/ },
+    { label: "docker build", regex: /(^|\n)\s*docker\s+build(?:\s|$)/ },
+    { label: "kubectl", regex: /(^|\n)\s*kubectl(?:\s|$)/ },
+    { label: "deploy", regex: /(^|\n)\s*deploy(?:\s|$)/ },
   ]) {
-    if (dryRunAuditCommandText.includes(forbidden)) {
+    if (forbidden.regex.test(dryRunAuditCommandText)) {
       throw new Error(
-        `NapCat upstream audit dry-run command is not read-only: ${forbidden}`,
+        `NapCat upstream audit dry-run command is not read-only: ${forbidden.label}`,
       );
     }
   }
diff --git a/src/tools/napcatAutomation.ts b/src/tools/napcatAutomation.ts
index 9325242..f4cc538 100644
--- a/src/tools/napcatAutomation.ts
+++ b/src/tools/napcatAutomation.ts
@@ -254,8 +254,13 @@ export function buildNapcatUpstreamAudit(
       readOnly: true,
     },
     {
-      command: 'git fetch --dry-run upstream --tags',
-      description: 'Check whether upstream release refs are reachable without updating refs.',
+      command: 'git fetch upstream --tags --prune',
+      description: 'Refresh upstream release refs before file-level audit collection.',
+      readOnly: true,
+    },
+    {
+      command: 'git fetch origin --prune',
+      description: 'Refresh fork refs before comparing KT patch and upstream ranges.',
       readOnly: true,
     },
     {
@@ -270,6 +275,12 @@ export function buildNapcatUpstreamAudit(
       description: 'List KT fork patch files for deterministic overlap checks.',
       readOnly: true,
     },
+    {
+      command:
+        'git merge-tree "${FORK_BRANCH:-HEAD}" "${UPSTREAM_RELEASE_REF:-upstream/main}"',
+      description: 'Probe the dry merge shape without updating the worktree or refs.',
+      readOnly: true,
+    },
   ];
 
   return {