[hipvlady]

Great review. If you use this program every day, there is one thing you should know. CLAUDE.md is doing a lot of the most important work here, and it's the most fragile piece of the stack. A rule like "always re-read X before editing" is written as a piece of prose, and prose is subject to context. It's either one compaction or one subagent that appears from quietly disappearing, and there's no warning when this happens. The subagent case is the clear one: a subagent gets a new window, doesn't have the parent's CLAUDE.md discipline, and acts on the assumption that the rule was meant to stop something. The only thing that can reliably enforce the rules is settings.json permissions.deny, which the runtime checks before the model picks a tool. This means that you can't use cat or grep to bypass it. Everything left in prose is a strong default, not a guarantee. It's good to know which of your rules are which.