diff --git a/src/selfTest.ts b/src/selfTest.ts
index 382f570..be6012c 100644
--- a/src/selfTest.ts
+++ b/src/selfTest.ts
@@ -73,6 +73,16 @@ export async function runSelfTest(): Promise<void> {
   if (!napcatAuditSchemaSmoke.success) {
     throw new Error("NapCat upstream audit schema self-check failed");
   }
+  const napcatAuditExtraPropertySmoke = upstreamAuditOutputSchema.safeParse({
+    classification: "manual-review",
+    reasonCodes: ["HOT_ZONE_CHANGED"],
+    recommendedAction: "request-human-review",
+    summary: "Login hot-zone changed.",
+    unexpectedField: "Codex output schema rejects this.",
+  });
+  if (napcatAuditExtraPropertySmoke.success) {
+    throw new Error("NapCat upstream audit schema strict self-check failed");
+  }
   if (!napcatAutomationReasonCodes.includes("HOT_ZONE_CHANGED")) {
     throw new Error("NapCat reason-code list self-check failed");
   }
diff --git a/src/tools/napcatAutomation.types.ts b/src/tools/napcatAutomation.types.ts
index 77022ac..1a513df 100644
--- a/src/tools/napcatAutomation.types.ts
+++ b/src/tools/napcatAutomation.types.ts
@@ -26,7 +26,7 @@ export const upstreamAuditOutputSchema = z.object({
     'block',
   ]),
   summary: z.string().min(1),
-});
+}).strict();
 
 export type NapcatAutomationClassification =
   (typeof napcatAutomationClassifications)[number];