diff --git a/core/lambda/contract_ingestor.py b/core/lambda/contract_ingestor.py
index 314e1fc..c1d0ec4 100644
--- a/core/lambda/contract_ingestor.py
+++ b/core/lambda/contract_ingestor.py
@@ -17,6 +17,7 @@ requests. The invoke policy is scoped via ABAC (consumer repo identity).
 import datetime
 import json
 import os
+import urllib.error
 import urllib.parse
 
 import boto3
@@ -154,7 +155,16 @@ def _report_error(payload):
         with urllib.request.urlopen(req, timeout=10) as resp:
             search_result = json.loads(resp.read())
         existing = search_result.get("items", [])
-    except Exception:
+    except urllib.error.HTTPError as e:
+        if e.code == 404:
+            existing = []
+        else:
+            import sys
+            print(f"WARNING: GitHub issue search failed (HTTP {e.code}): {e}", file=sys.stderr)
+            existing = []
+    except urllib.error.URLError as e:
+        import sys
+        print(f"WARNING: GitHub issue search network error: {e}", file=sys.stderr)
         existing = []
 
     body = f"""## Deploy Failure Report
diff --git a/core/local_emulators.py b/core/local_emulators.py
index b1b4956..f9284b8 100644
--- a/core/local_emulators.py
+++ b/core/local_emulators.py
@@ -371,8 +371,9 @@ class LocalLambdaStub:
                 return _FakeResponse(
                     json.dumps([{"number": 1, "title": "stub"}]).encode())
             urllib.request.urlopen = _fake_urlopen
-        except Exception:
-            pass
+        except (AttributeError, TypeError) as e:
+            import sys
+            print(f"WARNING: could not patch urlopen for local Lambda stub: {e}", file=sys.stderr)
 
         try:
             event = {
diff --git a/core/output_publisher.py b/core/output_publisher.py
index 124089b..c6bf3bd 100644
--- a/core/output_publisher.py
+++ b/core/output_publisher.py
@@ -97,8 +97,10 @@ def publish_to_ssm(outputs, environment, contract_id):
                 Overwrite=True,
             )
             results[name] = param_name
-        except Exception:
-            # Don't fail the pipeline if one output fails to publish
+        except Exception as e:
+            # Don't fail the pipeline if one output fails to publish, but log it
+            import sys
+            print(f"WARNING: SSM put_parameter failed for {name}: {e}", file=sys.stderr)
             results[name] = None
     return results
 
@@ -165,7 +167,9 @@ def post_github_comment(comment_text, token=None, repo=None, pr_number=None):
         req.add_header("Accept", "application/vnd.github+json")
         urllib.request.urlopen(req, timeout=10)
         return True
-    except Exception:
+    except Exception as e:
+        import sys
+        print(f"WARNING: GitHub PR comment failed: {e}", file=sys.stderr)
         return False
 
 
diff --git a/terraform/bootstrap/apply_iam_baseline.py b/terraform/bootstrap/apply_iam_baseline.py
index 7f410a8..90db766 100644
--- a/terraform/bootstrap/apply_iam_baseline.py
+++ b/terraform/bootstrap/apply_iam_baseline.py
@@ -75,8 +75,10 @@ def apply_managed_policy(iam, policy_doc: str) -> str:
             try:
                 iam.delete_policy_version(PolicyArn=POLICY_ARN, VersionId=default)
                 print(f"deleted old default version {default}")
+            except iam.exceptions.NoSuchEntityException:
+                pass  # already deleted
             except Exception as e:
-                print(f"could not delete old version {default}: {e}")
+                print(f"WARNING: could not delete old version {default}: {e}")
         return POLICY_ARN
     except iam.exceptions.NoSuchEntityException:
         print(f"creating managed policy {POLICY_NAME}...")
diff --git a/terraform/bootstrap/create_state_backend.py b/terraform/bootstrap/create_state_backend.py
index 24694a5..f880ebb 100644
--- a/terraform/bootstrap/create_state_backend.py
+++ b/terraform/bootstrap/create_state_backend.py
@@ -48,12 +48,16 @@ def main():
     try:
         s3.head_bucket(Bucket=STATE_BUCKET)
         print(f"s3: bucket {STATE_BUCKET} already exists")
-    except Exception:
-        kwargs = {"Bucket": STATE_BUCKET}
-        if REGION != "us-east-1":
-            kwargs["CreateBucketConfiguration"] = {"LocationConstraint": REGION}
-        s3.create_bucket(**kwargs)
-        print(f"s3: created bucket {STATE_BUCKET}")
+    except s3.exceptions.ClientError as e:
+        error_code = e.response.get("Error", {}).get("Code", "")
+        if error_code in ("404", "NoSuchBucket", "NotFound"):
+            kwargs = {"Bucket": STATE_BUCKET}
+            if REGION != "us-east-1":
+                kwargs["CreateBucketConfiguration"] = {"LocationConstraint": REGION}
+            s3.create_bucket(**kwargs)
+            print(f"s3: created bucket {STATE_BUCKET}")
+        else:
+            raise
     # Enable versioning (idempotent)
     s3.put_bucket_versioning(
         Bucket=STATE_BUCKET,