config-audit/docs/cc-2.1.x-gap-matrix.md

# Gap-matrise — Claude Code 2.1.114→181 vs config-audit-dekning

**Generert:** 2026-06-18 · **Metode:** workflow `config-audit-cc-gap` (12 surface-verifikatorer + syntese) · **Scope:** kun `config-audit/`

> **Dekningsstatus:** 12/12 surfaces verifisert (130 + 32 = 162 rader). Re-run `config-audit-cc-gap-rerun`
> (task `wyk5istx7`) fullførte subagents/agents, token management, slash commands. Se «Surfaces 10–12» nederst.
> Re-run fanget også versjonsfeil i draft-korpuset — se «Draft-korreksjoner».

> **Verifiseringsplikt:** Rader merket UNVERIFIED, og **særlig MCP `trust`-feltet**, må verifiseres mot offisiell
> `.mcp.json`-dokumentasjon FØR endring — agenten kan ta feil i begge retninger. Manuelt forhåndsverifisert av
> hovedkontekst: `xhigh` (settings-validator.mjs:66), manglende hook-events, 4.7-hardkoding, feature-evolution v2.1.111.

## v5.4.0 reconciliation (2026-06-19 — supersedes the v5.3.0 block + rows below)

The six M-effort candidates deferred at v5.3.0 were re-verified against HEAD (`fe686b6`) on both
axes: **code-state** (still open?) and **CC premise** (real? — primary-source where risky).
See `docs/v5.4.0-release-plan.md` for the full per-candidate evidence.

**Operator GO 2026-06-19: "Option A"** → ship #1, #5, #4. No new scanner (badge stays 13).

| # | Candidate (row) | Code-state @HEAD | CC premise | Verdict |
|---|---|---|---|---|
| 1 | PLH shadow-folder (164) | OPEN (parses only name/desc/version) | CONFIRMED ~2.1.140 | **ship-5.4** → `CA-PLH-015` |
| 5 | PLH `skills:`-array dirs (165) | OPEN (no `parsed.skills` read) | CONFIRMED ~2.1.145 `plugin validate` | **ship-5.4** → `CA-PLH-016` |
| 4 | autoMode.hard_deny structure (179) | OPEN (key known, no nested val) | CONFIRMED (primary source) | **ship-5.4** → `CA-SET-NNN` |
| 2 | acceptEdits-writes shell/build (176) | OPEN (0 matches) | CONFIRMED ~2.1.160, file-list unpinned | **defer** (needs primary-source field list) |
| 6 | nested-.claude closest-wins (139/166) | OPEN (no scanner) | CONFIRMED ~2.1.178 | **defer** (NEW scanner, badge bump → own release) |
| 3 | Read-deny hides Glob/Grep (175) | PARTIAL (`permission-rules.mjs:158-159` hint only) | **REFUTED** by primary source | **wontfix** |

**Row 175 correction (Verifiseringsplikt).** The row was framed **backwards**. The CC permissions
doc states: *"Claude makes a best-effort attempt to apply `Read` rules to all built-in tools that
read files like Grep and Glob"* — so a Read deny **already** covers Glob/Grep. A "Read-deny is
bypassable → false security" finding would be a false positive (same failure mode as the invented
MCP `trust` field). The only real Read-deny bypass is a Bash subprocess (python/node script that
opens files itself), which is documented behavior, not a config mistake. The Windows-path half (CC
normalizes `C:\…` → `/c/…` before matching) is real but narrow/low-value → rolling maintenance.

The L-priority `update-knowledge` rows (env vars, model nuance, hook-output fields, plugin/skill
doc, nested-.claude doc) remain rolling knowledge maintenance — fold in opportunistically.

## v5.3.0 reconciliation (2026-06-19 — supersedes stale rows below)

This matrix was the **v5.2.0** plan. Verified against HEAD (`9b828fa`) during the v5.3.0 Session A
audit. **Read this block first** — individual rows below predate the v5.2.0 + 8-commit work.

**CLOSED in v5.2.0** (entire HIGH-priority false-positive cluster — verified in current code):
- `settings-validator.mjs` — all 11 keys + `xhigh` are in `KNOWN_KEYS`/`VALID_EFFORT_LEVELS`
  (incl. `footerLinksRegexes`, `agent`, `parentSettingsBehavior`, `sandbox`, `enforceAvailableModels`,
  `fallbackModel`, `disableBundledSkills`, `pluginSuggestionMarketplaces`, `requiredMin/MaxVersion`,
  `allowAllClaudeAiMcps`, `wheelScrollAccelerationEnabled`). All `settings.json`/`model lineup`/
  `permissions` now-wrong settings rows → CLOSED.
- `hook-validator.mjs` — 28 events incl. `MessageDisplay` + `post-session`; knowledge says 28. CLOSED.
- `mcp-config-validator.mjs` — POSIX/auto-injected env allowlisted; `trust` removed. CLOSED.
- `claude-md-linter.mjs` — HIGH@500 → MEDIUM token-cost reframe, context-window aware. CLOSED.
- DIS/CNF — parameter-aware identity (Agent(model:…)/WebFetch(domain:…) no longer collapsed). CLOSED.

**CLOSED by the 8 unreleased commits (v5.3.0 candidates):**
- disableBundledSkills recommendation (row 167) → `dfe9049`.
- permissions `'*'` deny-all + allow non-MCP glob (row 138) → `03949c6`.
- CLAUDE.md char budget on top of the reframe → `b0bf8c5` (new `CA-CML`).
- DIS forbidden-param check (rows 137/139, beyond matrix) → `d678765`.
- PLH namespace collision (search-first; **NOT** the row-129 shadow-folder check) → `c6c5f17`.
- SKL aggregate skill-listing budget (row 169) shipped in v5.2.0 (`CA-SKL-002`); `0a631e3` extracted
  the shared `context-window.mjs`.

**STILL OPEN → all DEFER to v5.4 (none are bugs/false-positives; all M-effort enhancements):**
row 129 PLH shadow-folder · row 141 acceptEdits-prompts-on-config-writes · row 140 Read-deny-hides-
Glob/Grep + Windows path · row 144 autoMode.hard_deny structure · row 130 PLH `skills:`-array ·
rows 104/131 nested `.claude` closest-wins detection. Plus the L-priority `update-knowledge` rows
(env vars, model nuance, hook-output fields, plugin/skill doc) → rolling knowledge maintenance.

**v5.3.0 ship-list = EMPTY** (operator GO 2026-06-19, "Release-only"). 3 knowledge-backing entries
(`disableBundledSkills`, 40k char-budget, forbidden-param — absent from corpus, grep-verified)
fold into the v5.3.0 docs step. See `docs/v5.3.0-release-plan.md` § "v5.3.0 scope decision".

## Executive summary

config-audits kunnskapsbase og scanner-kjent-sett er frosset ved ~v2.1.111; CC har shippet til v2.1.181 (Opus 4.8-æra). Av 130 verifiserte rader er det mest akutte en **klynge aktive false positives** — gyldig, dokumentert konfig flagges som feil i dag:

- **`settings-validator.mjs`** avviser `xhigh` og flagger `sandbox`, `fallbackModel`, `enforceAvailableModels`, `disableBundledSkills`, `pluginSuggestionMarketplaces` + 5 til som «unknown».
- **`mcp-config-validator.mjs`** flagger `${CLAUDE_PROJECT_DIR}` og POSIX `${var%pattern}` (CC fikset dette i 2.1.142). Dessuten: `trust`-feltet ser ut til å være **oppfunnet/uverifisert** — gir en medium på hver normal `.mcp.json`.
- **`disabled-in-schema-scanner.mjs`** kollapser param-kvalifiserte permission-regler (`Agent(model:opus)` deny + `Agent(model:sonnet)` allow) → feil «dead config».
- **`claude-md-linter.mjs`** gir HIGH ved 500 linjer med «significantly reduce adherence» — motsagt av CC (2.1.169 skalerer terskel etter kontekstvindu) og av pluginens egen knowledge.
- **`hook-validator.mjs`** mangler `MessageDisplay` (2.1.152) + `post-session` (2.1.169) → flagger gyldige hooks som ukjente.

Resten er stort sett L-prioritets knowledge-oppdateringer (env vars, modell-lineup inkl. Fable 5, doc-nyanser) uten scanner-impact. De fleste fiksene er S-effort kjent-sett/terskel-edits; en håndfull (DIS param-bevissthet, nye PLH/permissions-checks) er M.

## Anbefalt release
**v5.2.0** — endringssettet domineres av additive kjent-sett-utvidelser, terskel/ordlyd-fikser og knowledge-oppdateringer. `--json` og `--raw` forblir byte-stabile; false-positive-fiksene *fjerner* funn, endrer ikke envelope-skjemaet. Kun MCP `trust`-demoteringen endrer eksisterende output materielt (ikke-breaking kvalitetsfiks). v6.0.0 reserveres for fremtidig humanizer/envelope-skjemaendring.

## Voyage-eskalering: **NEI**
Netto-nytt scanner-arbeid (DIS param-bevissthet, PLH shadow-folder-check, permissions deny-all/glob, disableBundledSkills-anbefaling) er en håndfull uavhengige M-poster med klare specs og eksisterende fixture-mønstre — ikke en stor/usikker greenfield-build. Vanlig TDD per scanner holder. Eskalér kun hvis permissions-param-matchingen viser seg å trenge et delt rule-parsing-refactor på tvers av conflict-detector + DIS + settings-validator.

## False positives (dagens bugs — verdict = now-wrong)

| Tittel | Fil | Fiks (kort) |
|---|---|---|
| `effortLevel: xhigh` avvist | `settings-validator.mjs` | Legg `xhigh` i `VALID_EFFORT_LEVELS`. IKKE legg til `ultracode` (slash-alias, ikke settings-verdi) |
| `sandbox`-blokk «unknown» | `settings-validator.mjs` | Legg `sandbox` i `KNOWN_KEYS` (top-level er triggeren) |
| `fallbackModel` «unknown» | `settings-validator.mjs` | Legg i `KNOWN_KEYS`; verdi er string ELLER array(≤3) — ikke single-type TYPE_CHECK |
| `enforceAvailableModels` «unknown» | `settings-validator.mjs` | Legg i `KNOWN_KEYS` (managed) |
| `disableBundledSkills` «unknown» | `settings-validator.mjs` | `KNOWN_KEYS` + boolean TYPE_CHECK |
| `pluginSuggestionMarketplaces` «unknown» | `settings-validator.mjs` | `KNOWN_KEYS` (managed, array) |
| `requiredMin/MaximumVersion` «unknown» | `settings-validator.mjs` | `KNOWN_KEYS` (managed) |
| `allowAllClaudeAiMcps` «unknown» | `settings-validator.mjs` | `KNOWN_KEYS` (managed, boolean) |
| `footerLinksRegexes` «unknown» | `settings-validator.mjs` | `KNOWN_KEYS` (array) |
| `wheelScrollAccelerationEnabled` «unknown» | `settings-validator.mjs` | `KNOWN_KEYS` + boolean |
| `parentSettingsBehavior` «unknown» | `settings-validator.mjs` | `KNOWN_KEYS` (enum first-wins\|merge) |
| MCP `${CLAUDE_PROJECT_DIR}` «unreferenced» | `mcp-config-validator.mjs` | Allowlist auto-injiserte runtime-env-vars |
| MCP POSIX `${var%pattern}` «missing env» | `mcp-config-validator.mjs` | Begrens env-sjekk til bart `${IDENTIFIER}`; skip POSIX-operatorer |
| DIS kollapser `Agent(model:…)` deny/allow | `disabled-in-schema-scanner.mjs` | Gjør identitet param-bevisst (`bareTool()` :29-33) |
| DIS kollapser `WebFetch(domain:…)` | `disabled-in-schema-scanner.mjs` | Samme rotårsak — behandle domain:/param: som distinkt |
| `claude-md-linter` HIGH@500 + «reduce adherence» | `claude-md-linter.mjs` | Skaler terskel etter kontekstvindu / fjern absolutt HIGH; reframe til cache-prefix (CPS) |
| hook `MessageDisplay` «unknown event» | `hook-validator.mjs` | Legg i `VALID_EVENTS` + knowledge |
| hook `post-session` «unknown» | `hook-validator.mjs` | Legg i `VALID_EVENTS` (kebab, ≠ SessionEnd) |
| stale «26 total» hook-count | `hook-validator.mjs:137` + `hook-events-reference.md:3` | 26 → 28 i takt med de to nye |
| ✅ MCP `trust` oppfunnet (VERIFISERT 2026-06-18: ikke i offisiell `.mcp.json`-schema) | `mcp-config-validator.mjs` | DONE — fjernet CA-MCP-001 + «Invalid trust level»; `trust` droppet fra `VALID_SERVER_FIELDS` (stray `trust` → unknown field); humanizer + 5 knowledge-filer + fixturer scrubbet. Godkjenning er dialog/settings-basert (`enableAllProjectMcpServers`/`enabledMcpjsonServers`/`disabledMcpjsonServers`), aldri et JSON-felt. |
| `feature-evolution.md`/`capabilities.md` frosset v2.1.111 | `knowledge/*` | Opus 4.8 default + Fable 5; `/simplify`→`/code-review` |

## Quick wins (S-effort, høy verdi)
1. **`settings-validator.mjs`:** +11 gyldige nøkler i `KNOWN_KEYS` + `xhigh` i `VALID_EFFORT_LEVELS` (fix-false-positive).
2. **`hook-validator.mjs`:** +`MessageDisplay` +`post-session` til `VALID_EVENTS`; 26→28.
3. **`mcp-config-validator.mjs`:** begrens env-sjekk til bart `${IDENTIFIER}`; allowlist `CLAUDE_PROJECT_DIR`.
4. **knowledge-refresh:** `feature-evolution.md`/`capabilities.md` → Opus 4.8 default, Fable 5, `/effort xhigh`, `/simplify`→`/code-review`, lean system prompt.
5. **`hook-events-reference.md`:** dokumenter `additionalContext`, `reloadSkills`/`sessionTitle`, `args[]`-exec, `terminalSequence`, `CLAUDE_CODE_SESSION_ID`.
6. **skills:** +`disallowed-tools` i frontmatter-kjent-sett.
7. **plugins:** +`defaultEnabled`, `.claude/skills` auto-load, `claude plugin init`, root-SKILL.md, `allowAllClaudeAiMcps` i knowledge.
8. **env:** +window-env-vars i `configuration-best-practices.md`.
9. **rett draft-feil** i `docs/cc-2.1.x-changelog-delta.md` (skipLfs/HTTPS mis-filed under MCP; `Tool(param:value)` er permissions, ikke hooks).

## Større poster (M-effort)
| Tittel | Surface | Begrunnelse |
|---|---|---|
| DIS (+conflict-detector) param/domain-bevisst regel-identitet | permissions | `bareTool()`-kollaps gir ekte false positives nå som CC har param-matching (2.1.178) + domain-regler (2.1.172). conflict-detector.mjs:156 deler blindsonen |
| Skaler CLAUDE.md-lengdeterskel etter kontekstvindu | CLAUDE.md/memory | CC sluttet å flagge lange filer på 1M-modeller (2.1.169); krever modell-kontekst-deteksjon + tekst-rework + snapshot-tester |
| Ny PLH: advarsel når plugin.json-nøkkel skygger default-mappe | plugins | Speiler CCs egen 2.1.139/140-advarsel; ekte config-fallgruve |
| Nye permissions-checks: `*`-deny = deny-all; ikke-MCP-glob i allow / ukjent tool i deny | permissions | CC avviser/varsler ved startup (2.1.166) |
| feature-gap/posture: `disableBundledSkills` som token-effektivitets-lever | skills/tokens | Skjuler bundled-skill-descriptions fra system-prompt — ekte token-saver tokens-scanneren kan anbefale |
| PLH-paritet med `claude plugin validate`: valider `skills:`-array | plugins | Lav prioritet; PLH parser ikke `skills:`-arrays i dag |

## Full matrise (9/12 surfaces)

| surface | cc change | versions | verdict | action | target file | priority | effort |
|---|---|---|---|---|---|---|---|
| settings.json | effortLevel gains 'xhigh' tier | 2.1.154 | now-wrong | fix-false-positive | scanners/settings-validator.mjs | H | S |
| settings.json | sandbox.* block (+ allowAppleEvents) valid top-level key | ~2.1.77-83; 2.1.181 | now-wrong | fix-false-positive | scanners/settings-validator.mjs | H | S |
| settings.json | enforceAvailableModels managed setting | 2.1.175 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | H | S |
| settings.json | fallbackModel (string or up-to-3 array) | 2.1.166 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | H | S |
| settings.json | disableBundledSkills setting | 2.1.169 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | H | S |
| settings.json | requiredMinimumVersion / requiredMaximumVersion | 2.1.163 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | M | S |
| settings.json | allowAllClaudeAiMcps managed setting | 2.1.149 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | M | S |
| settings.json | footerLinksRegexes setting | 2.1.181 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | M | S |
| settings.json | wheelScrollAccelerationEnabled setting | 2.1.174 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | L | S |
| settings.json | pluginSuggestionMarketplaces managed setting | 2.1.152 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | M | S |
| settings.json | worktree.bgIsolation nested value | 2.1.154 | partial | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| settings.json | env CLAUDE_CLIENT_PRESENCE_FILE | 2.1.181 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| settings.json | env OTEL_RESOURCE_ATTRIBUTES labels | 2.1.161 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| settings.json | env CLAUDE_CODE_PLUGIN_PREFER_HTTPS | 2.1.141 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| settings.json | env ANTHROPIC_WORKSPACE_ID | 2.1.141 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| settings.json | env MAX_THINKING_TOKENS=0 disables thinking | 2.1.166 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| settings.json | parentSettingsBehavior / policyHelper (UNVERIFIED) | 2.1.133 | missing | new-feature-gap-check | scanners/settings-validator.mjs | L | S |
| settings.json | skillOverrides | 2.1.129 | DONE | added to KNOWN_KEYS (NOT TYPE_CHECKS — value is per-skill object off/user-invocable-only/name-only) | scanners/settings-validator.mjs | L | S |
| settings.json | ~~skillListingBudgetFraction / maxSkillDescriptionChars~~ (keys DO NOT EXIST — verified) | 2.1.105 + 2.1.32 | DONE | budget=2% ctx + cap=1536 are internal CC mechanisms, not settings keys; both enforced by the SKL scanner — `CA-SKL-001` (1,536-char cap) + `CA-SKL-002` (aggregate 2%-of-context budget, 200k-anchored estimate) | scanners/skill-listing-scanner.mjs | L | M |
| CLAUDE.md / memory | 'too long' threshold now scales with context window | 2.1.169 | now-wrong | fix-false-positive | scanners/claude-md-linter.mjs | H | M |
| CLAUDE.md / memory | --safe-mode / CLAUDE_CODE_SAFE_MODE disables customizations | 2.1.169 | missing | update-knowledge | knowledge/configuration-best-practices.md | L | S |
| CLAUDE.md / memory | plugins in .claude/skills auto-load (cascade/token accounting) | 2.1.157 | partial | new-feature-gap-check | knowledge/configuration-best-practices.md | M | M |
| CLAUDE.md / memory | nested .claude closest-wins precedence + <dir>:<name> | 2.1.178, 2.1.161 | partial | new-feature-gap-check | knowledge/configuration-best-practices.md | M | M |
| CLAUDE.md / memory | CLAUDE_MEMORY_STORES team-memory env var | 2.1.172 | missing | update-knowledge | knowledge/configuration-best-practices.md | L | S |
| hooks | MessageDisplay hook event | 2.1.152 | now-wrong | fix-false-positive | scanners/hook-validator.mjs | H | S |
| hooks | post-session lifecycle hook | 2.1.169 | now-wrong | fix-false-positive | scanners/hook-validator.mjs | M | S |
| hooks | stale '26 total' hook-event count (scanner+knowledge) | derived | now-wrong | update-knowledge | knowledge/hook-events-reference.md | M | S |
| hooks | Stop/SubagentStop return additionalContext | 2.1.163 | partial | update-knowledge | knowledge/hook-events-reference.md | M | S |
| hooks | terminalSequence hook output field | 2.1.141 | partial | update-knowledge | knowledge/hook-events-reference.md | L | S |
| hooks | Stop/SubagentStop input background_tasks/session_crons | 2.1.145 | missing | update-knowledge | knowledge/hook-events-reference.md | L | S |
| hooks | SessionStart reloadSkills / sessionTitle output | 2.1.152 | partial | update-knowledge | knowledge/hook-events-reference.md | L | S |
| hooks | hook args: string[] exec form | 2.1.139 | partial | update-knowledge | knowledge/hook-events-reference.md | M | S |
| hooks | CLAUDE_CODE_SESSION_ID hook env var | 2.1.163 | missing | update-knowledge | knowledge/hook-events-reference.md | L | S |
| mcp | ${CLAUDE_PROJECT_DIR} auto-injected, flagged unreferenced | 2.1.139 | now-wrong | fix-false-positive | scanners/mcp-config-validator.mjs | H | S |
| mcp | POSIX ${var%pattern} expansions flagged as missing env (CC fixed) | 2.1.142 | now-wrong | fix-false-positive | scanners/mcp-config-validator.mjs | H | S |
| mcp | ${VAR} resolves from shell env, not just env block | 2.1.161 | now-wrong | fix-false-positive | scanners/mcp-config-validator.mjs | M | S |
| mcp | 'trust' field invented/enforced; unverified in docs/schema | n/a | now-wrong | fix-false-positive | scanners/mcp-config-validator.mjs | M | M |
| mcp | allowAllClaudeAiMcps managed key (knowledge) | 2.1.174/2.1.149 | missing | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| mcp | managed allowed/deniedMcpServers ${VAR} predicate support | 2.1.162, 2.1.169 | partial | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| mcp | agent-frontmatter mcpServers + --strict-mcp-config/--mcp-config flags | 2.1.154, 2.1.169 | partial | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| plugins & marketplace | plugin.json defaultEnabled: false | 2.1.154 | missing | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| plugins & marketplace | plugins auto-load from .claude/skills (no marketplace) | 2.1.157, 2.1.161 | partial | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| plugins & marketplace | claude plugin init scaffolding | 2.1.157, 2.1.161 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| plugins & marketplace | pluginSuggestionMarketplaces managed key flagged unknown | 2.1.152 | now-wrong | fix-false-positive | scanners/settings-validator.mjs | H | S |
| plugins & marketplace | disableBundledSkills setting flagged unknown | 2.1.169 | now-wrong | fix-false-positive | scanners/settings-validator.mjs | H | S |
| plugins & marketplace | plugin dependency enforcement (manifest deps) | 2.1.143-145 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| plugins & marketplace | root-level SKILL.md (no skills/) surfaced as skill | 2.1.142-143 | partial | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| plugins & marketplace | warn when plugin.json key shadows default component folder | 2.1.139-140 | missing | new-feature-gap-check | scanners/plugin-health-scanner.mjs | M | M |
| plugins & marketplace | validate skills: array entries are dirs within plugin | 2.1.145 | missing | new-feature-gap-check | scanners/plugin-health-scanner.mjs | L | M |
| plugins & marketplace | nested .claude closest-wins + <dir>:<name> vs flat conflict detection | 2.1.178 | partial | update-knowledge | knowledge/claude-code-capabilities.md | M | M |
| skills | disallowed-tools skill/command frontmatter | 2.1.152 | partial | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| skills | disableBundledSkills token-efficiency lever | 2.1.169 | missing | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| skills | nested .claude/skills load + <dir>:<name> disambiguation | 2.1.178, 2.1.181 | partial | update-knowledge | knowledge/claude-code-capabilities.md | M | M |
| skills | \$ escape syntax in command bodies | 2.1.178 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| skills | skillListingBudgetFraction / maxSkillDescriptionChars (below floor) | 2.1.105 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | M |
| permissions | Tool(param:value) rules — DIS collapses to bare tool | 2.1.178 | now-wrong | fix-false-positive | scanners/disabled-in-schema-scanner.mjs | H | M |
| permissions | glob in deny tool-name; '*' deny-all; allow non-MCP glob rejected | 2.1.166 | missing | new-feature-gap-check | scanners/conflict-detector.mjs | M | M |
| permissions | WebFetch(domain:*) / mid-pattern wildcards — DIS false positive | 2.1.172 | now-wrong | fix-false-positive | scanners/disabled-in-schema-scanner.mjs | H | M |
| permissions | Read deny hides Glob/Grep; Windows backslash/case path rules | 2.1.162 | missing | new-feature-gap-check | scanners/settings-validator.mjs | L | M |
| permissions | acceptEdits prompts on shell-startup/build-tool config writes | 2.1.160 | missing | new-feature-gap-check | scanners/settings-validator.mjs | M | M |
| permissions | sandbox.allowAppleEvents — sandbox block flagged unknown | 2.1.181 | now-wrong | fix-false-positive | scanners/settings-validator.mjs | H | S |
| permissions | parentSettingsBehavior admin-tier key flagged unknown | 2.1.133 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | M | S |
| permissions | autoMode.hard_deny sub-key (no structure validation) | 2.1.136 | partial | extend-scanner-known-set | scanners/settings-validator.mjs | M | M |
| model lineup | effortLevel missing 'xhigh' (Opus 4.8) | 2.1.154 | now-wrong | fix-false-positive | scanners/settings-validator.mjs | H | S |
| model lineup | Claude Fable 5 introduced (Mythos-class) | 2.1.170 | partial | update-knowledge | knowledge/configuration-best-practices.md | M | M |
| model lineup | auto mode on Bedrock/Vertex/Foundry for Opus 4.7/4.8 | 2.1.158 | partial | new-feature-gap-check | knowledge/configuration-best-practices.md | L | M |
| model lineup | enforceAvailableModels flagged unknown | 2.1.175 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | H | S |
| model lineup | fallbackModel flagged unknown | 2.1.166 | now-wrong | extend-scanner-known-set | scanners/settings-validator.mjs | H | S |
| feature evolution / staleness | Opus 4.8 new default (timeline frozen v2.1.111) | 2.1.154 | missing | update-knowledge | knowledge/feature-evolution.md | H | S |
| feature evolution / staleness | /effort xhigh new top tier | 2.1.154 | missing | update-knowledge | knowledge/feature-evolution.md | M | S |
| feature evolution / staleness | Claude Fable 5 new model family | 2.1.170 | missing | update-knowledge | knowledge/feature-evolution.md | H | S |
| feature evolution / staleness | lean system prompt now default for 4.8+ | 2.1.154 | partial | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| feature evolution / staleness | /simplify renamed to /code-review (stale bundled-skill list) | 2.1.147, 2.1.152 | now-wrong | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| feature evolution / staleness | window settings keys absent from capability register | 2.1.143-181 | missing | update-knowledge | knowledge/claude-code-capabilities.md | M | M |
| feature evolution / staleness | window hook events absent from timeline | 2.1.139-178 | missing | update-knowledge | knowledge/feature-evolution.md | M | M |

_(L-prioritets «covered/none» runtime/UI-rader utelatt for lesbarhet; full liste i workflow-output `tasks/wgxug2xfs.output`.)_

## Surfaces 10–12 (re-run `wyk5istx7`, 12/12 komplett)

Mest actionable nye funn:

| surface | cc change | versions | verdict | action | target file | priority | effort |
|---|---|---|---|---|---|---|---|
| token management | `disableBundledSkills` flagges «unknown» (token-lever) | 2.1.169 | ✅ DONE (Batch 1) — i `KNOWN_KEYS`+`TYPE_CHECKS` | fix-false-positive | scanners/settings-validator.mjs | H | S |
| token management | `disableBundledSkills` kan ANBEFALES (skjuler bundled-skill-desc fra system-prompt) | 2.1.169 | missing | new-feature-gap-check | knowledge/prompt-cache-patterns.md | M | S |
| token management | `prompt-cache-patterns.md` (rendøpt fra `opus-4.7-patterns.md`); modell-nøytral mekanisme-tekst + ett Opus 4.8-anker | 2.1.154, 2.1.170 | ✅ DONE 2026-06-18 | update-knowledge | knowledge/prompt-cache-patterns.md | H | M |
| token management | CC truncerer skill-listing ved budsjett-overflow; config-audit kan varsle før | 2.1.178 | partial | new-scanner | knowledge/prompt-cache-patterns.md | M | M |
| token management | `skillListingBudgetFraction`/`maxSkillDescriptionChars` (UVERIFISERT, under gulv) | ~2.1.105 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| slash commands | **`/config key=value`** — in-session-anvendelse av settings-anbefalinger (kan refereres i fix/feature-gap-tekst) | 2.1.181 | missing | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| slash commands | `/simplify` → `/code-review` (stale bundled-skill-liste) | 2.1.147 | now-wrong | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| slash commands | `/goal`, `/reload-skills` ikke i bundled-command-inventar | 2.1.139, 2.1.152 | missing | update-knowledge | knowledge/claude-code-capabilities.md | L | S |
| subagents/agents | settings `agent`-felt (kjør main-thread som named subagent) ikke i kjent-sett | 2.1.157 | missing | extend-scanner-known-set | knowledge/claude-code-capabilities.md | M | S |
| subagents/agents | nested subagents (5-nivå), closest-`.claude`-precedence | 2.1.172, 2.1.178 | missing | update-knowledge | knowledge/claude-code-capabilities.md | M | S |
| subagents/agents | `availableModels`/`enforceAvailableModels` begrenser agent-`model:` | 2.1.172 | partial | update-knowledge | knowledge/claude-code-capabilities.md | M | M |
| subagents/agents | `defaultEnabled: false` i plugin.json (gater bundled agents/skills/commands) | 2.1.154 | missing | extend-scanner-known-set | knowledge/claude-code-capabilities.md | M | S |

_(Resten av de 32 radene er `none`/`covered` CLI/UI-runtime uten config-surface — full liste i `tasks/wyk5istx7.output`.)_

## Draft-korreksjoner (re-run fanget versjonsfeil i `cc-2.1.x-changelog-delta.md`)
Draftet (og dermed noen rader i første kjøring) hadde feil versjon på fire punkter — matrisen over er korrekt kilde:
- settings `agent`-felt: **2.1.157** (ikke 2.1.154)
- agent-spawn i auto-mode: **2.1.178** (ikke 2.1.143)
- `subagent_type` case/separator-insensitiv: **2.1.140** (ikke 2.1.157)
- `SubagentStop` `additionalContext`: **2.1.165** (ikke 2.1.163)

Disse korrigeres når knowledge-filene oppdateres (Batch 3). `docs/cc-2.1.x-changelog-delta.md` er nå superseded av denne matrisen.