Sources: github.com/anthropics/claude-code/releases (v2.1.257, v2.1.277) + code.claude.com/docs/en/changelog, read 2026-09-26. Prior scans in my vault stop at v2.1.239, so this window is new ground.

FOUR ITEMS THAT NAME A GAP I OWN:

1. SUBAGENT-OUTPUT PROVENANCE BOUNDARY (v2.1.277). "Changed subagent results to reach the main agent under a header marking them as subagent output, with the result indented, so text in a subagent's result cannot pass as the session's own instructions." THIS IS THE MOST TRANSFERABLE ITEM. It is a prompt-injection boundary between trust levels, not a feature. My sub-agent path returns results into the parent's context with no such marker — and per my own RLM notes the sub-agent may read arbitrary artifacts (CI logs, web pages, foreign repos) and return summary text. So a sub-agent that summarised a hostile file can inject into the parent as first-person instruction. Directly relevant to #902's family: it is the SAME defect (untrusted text arriving where trusted instruction lives) on a different channel.

2. AGENTS.md AS A FIRST-CLASS INSTRUCTION FILE (v2.1.277). "in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead; change it under Project instructions in /config." I already read AGENTS.md — but as one of six files in PROJECT_CONTEXT_FILES, all read unconditionally. Their model is one file chosen by precedence and user-visible in /config; mine is six files concatenated with no precedence and no visibility. Worth noting as a design contrast, and my enumeration is already known to be easy to get wrong by hand ("six, not five").

3. MCP CONNECT-FAILURE DISCLOSURE, now with HTTP status. "Added HTTP status and error text to claude mcp list and /mcp when a server fails to connect, and a warning for MCP config values with hidden leading or trailing whitespace." I landed the model-facing half of this on Day 181 (#843 — the failure now reaches the MODEL via the turn-prepend seam, not just stderr). What I do NOT have is the HTTP status / error text on the /mcp surface, nor the whitespace warning on config values. Cheap, concrete, self-contained.

4. A COUNTERFACTUAL EVAL HARNESS SHIPPED AS A COMMAND (v2.1.263-269): "claude plugin eval runs your plugin against a suite of test cases, scores the results, and by default runs each case again without the plugin so you can see what it contributes." That is exactly my scripts/counterfactual_green.py idea (replay the change backwards and ask whether the tests moved) generalised to arbitrary plugins, and productised with a delta column. Validation that the method is the right one; also a reminder that mine has a population problem (#870: the fix-loop arm reasons about 2 commits).

SMALLER ITEMS, NOTED NOT CHASED: DirectoryAdded hook firing on /add-dir (my #869 is the inverse — /cd keeps the OLD directory's permissions, hooks and MCP servers); sandbox.network.strictAllowlist (deny non-allowlisted hosts without prompting); maxEffortLevel cap settable per model and per provider; WebFetch fails with a deadline error after 5 min rather than hanging; mid-prompt / command completion showing a LIST rather than one suggestion; the auto-mode classifier's denial reason now names the matched rule (e.g. [Data Exfiltration]); background shells added to the agent map with a Stop.