[kvlonge]

Security_admin parser gaps from the D133 slice and the auditor's round-4 withholds.

• ALTER USER: typed trees for every documented action (credential ADD/MODIFY/REMOVE/ROTATE for key pairs, PATs and workload identities; MFA methods; delegated authorizations; policies with FORCE; tags; properties; UNSET). The name may be omitted for the current user, as Snowflake reads it.
• ALTER SHARE: ADD/REMOVE ACCOUNTS (SHARE_RESTRICTIONS on ADD only), SET with ACCOUNTS lists, SET TAG and UNSET, replacing the opaque fallback.
• SHOW GRANTS: a grantee kind with no trailing name, ROLE <instance>!<role>, APPLICATION ROLE .<role>, OF/ON <name>; IN APPLICATION PACKAGE takes an unquoted name and ends the statement (LIMIT after it is a recorded 1003).
• GRANT/REVOKE: CALLER and INHERITED CALLER qualify every privilege in the list; SERVICE ROLE keeps each part's quoting; a quoted OWNERSHIP class name keeps its quotes and case.
• Clone/replication: dynamic-table CLONE accepts WAREHOUSE = '<string>'; SHOW DATABASES/SHARES IN REPLICATION GROUP may omit the name.
• Release-channel ACCOUNTS quoting already worked on main; no change.

[kvlonge]

D94 gate for 8085c5b (merge of main bb3090a):

• make check-merge RECORDER=0: exit 0 on 8085c5b.
• Coverage diff, base main 58b3331 vs this head (parser trees identical to the merged result; later main commits touch no syntax crate), catalogue wip/syntax-catalogue ba6b946, evidence 4ed0d81: forms +8 −0, obligations +533 −0 (ddl +1, security_admin +532). Gained: alter-organization-user.set, alter-share.set / set-tag / unset-tag, show-databases-in-replication-group, show-shares-in-replication-group, show-grants.grants-of-share, show-grants.grants-on.
• Receipt scan: 458 cases base-accepted and head-rejected; Snowflake parsed 0 of them (all receipts 1003 or no receipt yet; 448 expect reject, 10 observe).