release: v5.10.0 — "Deferral & injection hygiene" (B4+B5+B6)

Three additive hardening levers extending existing scanners toward a tighter
always-loaded prefix (scanner count stays 16, agents 7, commands 21):
  - B4 (CA-TOK-006): MCP tool-schema deferral check + CLI-over-MCP lever
  - B5: hook additionalContext-injection advisory + filter-before lever
  - B6: CPS @import volatile-content scan

Version sync: plugin.json 5.10.0, README version/tests badges (1215+ -> 1257+)
+ version-history row, tokens pattern-count 7 -> 8 (README + CLAUDE.md),
CLAUDE.md test tally 1215/68 -> 1257/71 (36 -> 39 scanner files), CHANGELOG
[5.10.0]. self-audit --check-readme green; suite 1257 pass / 0 fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.10.0] - 2026-06-23
+
+### Summary
+"Deferral & injection hygiene" — three additive hardening levers that extend existing scanners
+toward a tighter always-loaded prefix. **B4** detects config that forces full MCP tool schemas into
+the always-loaded prefix (deferral defeated), with a CLI-over-MCP companion lever. **B5** adds a
+hook `additionalContext`-injection advisory plus a filter-before-Claude-reads lever. **B6** extends
+the cache-prefix scanner to follow `@import`s and flag volatile content in imported files. Scanner
+count stays **16** (all three extend existing scanners), agents **7**, commands **21**;
+`--json`/`--raw` stay byte-stable and the frozen v5.0.0 + SC-5 snapshots are untouched. **1257** tests.
+
+### Added
+- **B4 — MCP tool-schema deferral (`CA-TOK-006`; tokens patterns 7 → 8).** By default Claude Code
+  defers MCP tool schemas (names-only, ~120 tok; full schemas load on demand via tool search).
+  `CA-TOK-006` detects config-file signals that force the FULL schemas into the always-loaded prefix
+  every turn: `settings.json` `env.ENABLE_TOOL_SEARCH="false"` (high), `"ToolSearch"` in
+  `permissions.deny` (high), a configured Haiku model (medium), and per-server `.mcp.json`
+  `alwaysLoad:true` (CC v2.1.121+, high). Severity scales with the aggregate forced-upfront tokens
+  (medium-confidence reasons cap at medium). New pure engine `lib/mcp-deferral.mjs`
+  (`assessMcpDeferral`, unit-tested, no IO) shared by TOK and GAP. A feature-gap **CLI-over-MCP**
+  lever fires only as a companion to `CA-TOK-006` (prefer `gh`/`aws`/`gcloud` over MCP for common
+  operations — CLI adds zero context tokens until used).
+  - **Honest scoping (Verifiseringsplikt):** triggers on config files ONLY, never `process.env`
+    shell vars. Vertex / custom `ANTHROPIC_BASE_URL` / a runtime `/model` switch are launch state
+    (would flap snapshots machine-dependently), so they are DISCLOSED in every finding, not
+    triggered. Mechanism verified 2026-06-23 against code.claude.com/docs (`context-window.md`,
+    `mcp.md#configure-tool-search` + `#exempt-a-server-from-deferral`, `costs.md`); the
+    prefix-cache-invalidation claim was NOT-CONFIRMED in docs and is not asserted.
+- **B5 — hook `additionalContext`-injection advisory + filter-before lever.** HKV emits an info
+  advisory when a hook injects unfiltered command output into `additionalContext` (it enters context
+  every turn the hook fires). A feature-gap **filter-before-Claude-reads** companion lever cites the
+  documented `filter-test-output.sh` pattern (filter at the hook, not after Claude reads).
+- **B6 — CPS `@import` volatile scan.** The cache-prefix scanner now follows `@import`s (one hop) and
+  flags volatile content in the imported file that breaks the cached prefix — a new medium finding
+  ("Volatile content in @imported file breaks cached prefix"), keyed on the resolved file with
+  evidence "imported by <file> (@<path> at line N)". Scoped to one hop (the IMP scanner owns deep
+  chains); resolved files that are themselves discovered CLAUDE.md are skipped (own iteration).
+
+### Notes
+- Scanner count unchanged at **16** — B4/B5/B6 all extend existing scanners (TOK / HKV + GAP / CPS).
+  `--json`/`--raw` output remains byte-stable; frozen v5.0.0 + SC-5 snapshots untouched.
+
 ## [5.9.0] - 2026-06-23
 
 ### Summary