diff --git a/docs/cc-upgrade-2.1.181-decision-matrix.md b/docs/cc-upgrade-2.1.181-decision-matrix.md
index 0adeca6..747027d 100644
--- a/docs/cc-upgrade-2.1.181-decision-matrix.md
+++ b/docs/cc-upgrade-2.1.181-decision-matrix.md
@@ -241,6 +241,40 @@ CLAUDE.md-warning disposition (below). Shipped as **v5.5.0** — see `CHANGELOG.
 - **Final gates.** `claude plugin validate` passes (one accepted advisory warning); full `node --test`
   green. Test count rises by the 2 new version-consistency/changelog-entry tests.
 
+## S20 resolution (T3 / CC-04 — 2026-06-19, operator-gated)
+
+- **CC-04 — VERIFIED clean (no code change).** Research agents degrade cleanly under
+  `--strict-mcp-config`. Verified semantics (CC `cli-reference.md` + `sub-agents.md`, v2.1.153):
+  the flag uses only servers from `--mcp-config` and ignores all other MCP config — with no
+  `--mcp-config`, every MCP server is absent. When a granted MCP tool's server is absent, Claude
+  Code **skips it with a warning and the subagent launches normally with its remaining tools** —
+  absent grants are dropped, not a spawn error. Voyage declares no frontmatter `mcpServers` (only
+  `mcp__server__tool` grants in `tools:`), so the frontmatter-server-blocking path does not even
+  apply; the grants simply go unresolved. Of the five MCP-granting agents, four (`docs-researcher`,
+  `community-researcher`, `security-researcher`, `contrarian-researcher`) keep a native
+  `WebSearch`/`WebFetch` fallback and degrade by losing MCP *enhancement* only — exactly what the
+  graceful-degradation rule (`trekresearch.md:522`, `research-orchestrator.md:226` — "If MCP tools
+  are unavailable (Tavily, Gemini, MS Learn), proceed with available tools and note the limitation")
+  already prescribes.
+- **`gemini-bridge` is the one no-native-fallback case — degrades to a no-op, not a failure.** Its
+  `tools:` grants are `mcp__gemini-mcp__*` only; under `--strict-mcp-config` it would spawn with no
+  usable tools (the "zero granted tools" sub-case is **UNVERIFIED** in official docs, but the
+  skip-with-warning rule means it does not hard-fail the pipeline). It is conditionally gated
+  (`--local` skips it; standard effort triggers it only on architectural/triangulation questions;
+  only high-effort forces it always-on) and the degradation rule already names Gemini, so a
+  tool-less spawn is wasteful but covered. **Forward pointer (optional hardening, not done):** a
+  future session could gate the `gemini-bridge` spawn on gemini-server availability to avoid the
+  empty no-op under high-effort, and/or pin the "four-keep-fallback, gemini-bridge-is-MCP-only"
+  invariant in `agent-frontmatter.test.mjs` so a future `tools:` edit cannot silently break this
+  degradation analysis. No current gap forces either.
+- **Verification log.** Q1/Q2 confirmed via `claude-code-guide` against `code.claude.com/docs`
+  (`cli-reference.md` line 110; `sub-agents.md` §Scope MCP servers to a subagent, lines 412–420;
+  changelog v2.1.153). Static analysis of the five agents' `tools:` arrays + the two
+  graceful-degradation rules. No live `claude -p --strict-mcp-config` run this session — harness-level
+  spawn behavior is documented authoritatively, consistent with the "one quick test" sizing.
+- **CC-31 half of T3** remains **VERIFIED aligned** (see §verified findings) — no change. **T3 is now
+  fully evaluated.**
+
 ## Sequencing
 
 ```
@@ -270,7 +304,7 @@ Incremental (W3):   CC-11/CC-14/CC-15 as small, independently-shippable hardenin
 
 - **T1 (CC-26):** orchestrator-sub-agent spawns the planning swarm vs. inline baseline — wall-time, quality, token cost, depth-cap behavior. Harness: extend `scripts/q3-cache-prefix-experiment.mjs` pattern. — **S7: feasibility half RUN** (depth-2 works, no degradation, cap moot, proliferation-classifier risk found); **perf half DESIGNED, NOT run** (full bake-off + cheaper synthesis-agent PoC specified in `docs/T1-cc26-delegated-orchestration.md` §5/§6).
 - **T2 (CC-27):** reimplement `/trekreview`'s reviewer swarm as a Workflow; compare control, cost, and output fidelity vs. prose orchestration. — **S8: feasibility RUN** (probe: core ports natively, schemas retire JSON fragility, small fan-out classifier-clean); **fidelity/control/cost bake-off DESIGNED, NOT run** (`docs/T2-cc27-workflow-substrate.md` §5/§6).
-- **T3 (CC-04/CC-31):** research-agent MCP degradation under `--strict-mcp-config`; worktree parallel-wave behavior under tightened bg-isolation.
+- **T3 (CC-04/CC-31):** research-agent MCP degradation under `--strict-mcp-config`; worktree parallel-wave behavior under tightened bg-isolation. — **S20: CC-04 VERIFIED clean** (agents degrade cleanly — 4/5 keep a WebSearch/WebFetch fallback, `gemini-bridge` no-ops but does not hard-fail; see §S20 resolution); **CC-31 VERIFIED aligned** (see §verified findings). T3 fully evaluated.
 
 ---