Claude Code — June 2026 Config-Review Checklist (free sample of the monthly operations layer)

june-config-review-checklist.md

Claude Code — June 2026 Config-Review Checklist (free sample of the monthly operations layer)

A 10-minute pass to run after you update Claude Code (and after any quota/billing-change announcement). Unlike a generic "be careful" list, each item below is tied to a failure mode that actually landed on the public issue tracker this month — so it tells you what specifically to re-check now, not in the abstract. This is a free sample of the operations layer of the Claude Code Safety Brief. Every month, subscribers get this checklist rebuilt around that month's new failures, plus the paste-ready hook for each. The generic version lives free in cc-safe-setup; this is the this-month version.

How to use: read the symptom, run the one-line check, and if it applies, do the fix. Most checks are read-only and take seconds.

---

• Check: add up the size of every .claude/rules/*.md that matches the file you're editing, including the always-on ~/.claude/rules/*.md. If the matching total is large (the reports cluster around tens of KB), you're at risk.

  du -ch ~/.claude/rules/*.md .claude/rules/*.md 2>/dev/null | tail -1

• Why now: matching rules share one injection budget, and when the total is exceeded the largest rules are dropped silently — no error, no log. Your most important "never touch production" rule is usually the biggest, so it's the first to fall.
• Fix: split safety rules into small files, and express the ones you must never lose as a deterministic PreToolUse hook (a hook can't be evicted by a size budget — prose can).
• Check: are you passing a name to background sub-agents whose result you need back? That switches them to the teammate path, and completion arrives as idle_notification — which the caller isn't waiting for.
• Why now: the work isn't lost, but it never reaches the caller. It persisted to ~/.claude/projects/…/<session-id>/subagents/agent-*.jsonl.
• Fix: don't pass name to a background sub-agent whose result you need. Recover any stranded result with:

  find ~/.claude/projects -path '*/subagents/agent-*.jsonl' -newermt '1 hour ago' | xargs -r ls -t

• Check: if a grep/find over ~/.claude/projects/ "finds nothing," confirm the search actually ran — each per-project folder name starts with -, which most CLI tools read as option flags, so the search silently never executes.

  grep -rl "term" -- -home-you-proj          # -- ends option parsing
  grep -rl "term" "$HOME/.claude/projects/"  # or just search everything via an absolute path

• Why now: reported this month (#71755) — three months of "my past conversations are gone" that were never gone; the leading dash turned every search into a silent false negative (worse with 2>/dev/null). This is the usual trigger for panic-deleting data that was actually fine.
• Fix: when touching these folders pass --, ./, or an absolute path (also for rm/mv), and drop 2>/dev/null so a parse error is visible instead of looking like "no matches."
• Check: after a batch of writes (especially on a Windows Cowork workspace mount), confirm no NUL bytes crept into files that report "success":

  grep -aPl '\x00' path/to/just-written/* 2>/dev/null

• Why now: the byte count can be unchanged, so wc -c and tail look fine and the corruption passes review.
• Fix: add a PostToolUse hook on Write|Edit that flags NUL bytes at write time (write-nul-corruption-detector in cc-safe-setup).
• Check: if you use /clear mid-work, trigger one destructive command you expect to be blocked and confirm it still is. A hook wired but silently not matching is worse than no hook — it gives false confidence.
• Why now: hooks that key off session state can stop matching after a session-id reset, with no error.
• Fix: make stateful hooks fail closed when state is absent, or rewrite them to be stateless.
• Check: if you run sub-agents in worktrees, confirm their commits actually land on the intended branch, not the lead's working copy. git log --oneline -5 on each branch after a sub-agent run.
• Why now: the isolation can silently disable, so edits hit the lead's copy and commits land on the wrong branch with no error — then a later rebase/force-push erases them.
• Fix: the worktree-escape-write-guard hook blocks the escape deterministically.
• Check: confirm nothing survived the update that's still billing.

  claude daemon status ; claude agents --json

  Then watch /cost for one session — a sudden jump after an update usually means a default or routing change, not your prompt.
• Why now: the June 15 programmatic-billing split was announced and then paused that day — nothing changed for now, but it remains officially announced and could return. Knowing your exposure is cheap; being surprised isn't.
• Fix: if /status shows API Usage Billing while you're on a subscription, suspect a stray ANTHROPIC_API_KEY / standalone-CLI install routing usage to API billing.

---

This checklist is rebuilt around each month's new failures and shipped with the paste-ready hook for each — done for you, kept current. Start free with the Agent Safety Brief (one verified incident a month in your inbox). When the basics aren't enough and you want the full this-month operations layer — every incident with its fix, this checklist, and the running archive in one place — that's the $5/month edition, cancel anytime. The free hooks in cc-safe-setup cover the common cases and always will.