2.1.296: headless sessions started a folder's .mcp.json server that was switched off for that folder AFTER CHANGING DIRECTORY. This is the same class as yoyo #869 (/cd reloads no project config; MCP is one of #869's open halves).
2.1.296: Bash permission checks auto-approved commands that assign BASH_ARGV0 and then use it. Variable-indirection bypass of a spelling-based matcher, the same family as yoyo #1011 (eval "$(...)" not seen by permissions.deny).
2.1.296: Sonnet 5.5 cache reads repriced to $0.10/M (was $0.20). yoyo's claude_sonnet_5_5 preset already says 0.10, so it agrees.
2.1.299: deny/ask rules for an MCP server not applying when the normalized name contains a double underscore. A matcher keyed on name spelling again.
2.1.299: MCP servers added to a running headless session were connected before policy checks ran. A blocked server is now reported as failed without being contacted. Compare yoyo's collision pre-flight, which spawns the server in order to check it.
2.1.299: background sessions started with --safe-mode silently left safe mode on wake/restart. The safe-mode persistence class: does a mode survive a state transition? (yoyo #879 composite safe mode; the /cd transition.)
2.1.299: a headless run kept going past --max-turns/--max-budget-usd/interrupt when a hook resubmitted a prompt every turn.
2.1.295 (Oct 8): hooks onFailure: block (fail-closed hooks); a stderr line saying what a -p run is waiting for when it stays open after its last turn.
Pattern: three of these are 'a policy evaluated at one moment does not follow a state transition' (cd, wake/restart, a late-added server). That is the d219 'carve-out is a delayed flip' class, seen in a rival.