Internal accuracy pass against v2.1.220 — no missing upstream features, but broken example code, disagreeing counts, and metadata drift.
Functional fixes: pre-commit.sh now exits 2 so it actually blocks; dependency-check.sh reads file_path from stdin JSON instead of $1; database-mcp.json uses ${DATABASE_URL}; broken fences repaired; three command templates had invalid skill names.
Factual corrections: /fork and /subtask unswapped and /subtask added; /fewer-permission-prompts; permissions.defaultMode; dontAsk/auto unreversed; 31 hook events verified name-by-name; subagent depth 3; skill precedence enterprise > project > personal; /output-style removed not deprecated; permissionDecision gained defer.
Follow-up review fixed defects the pass left behind: zh/vi headers claiming 31 events above 25-name lists, a surviving hardcoded DB credential in the MCP README examples, an unbalanced fence swallowing a metadata footer, and non-canonical tool names. All four translated CATALOG summary tables were recounted so their arithmetic holds.
Full detail in CHANGELOG.md under v2.1.220-r2.
- Backfill CHANGELOG.md with v2.4.0 entry summarizing the
v2.1.112 → v2.1.119 sync work
- Refresh SECURITY.md footer (Last Updated April 27, 2026;
Next Review April 2027)
- Fix model ID in 09-advanced-features/config-examples.json:
claude-opus-4 → claude-opus-4-7 (3 occurrences) for
consistency with documented model IDs
- Remove RELEASE_NOTES.md stub that duplicated and contradicted
CHANGELOG.md
