fix(context-budget): classify lean-prompt selection by the lean_prompt capability

[kyle-sexton]

No related issue: Claude Haiku 5.5 release follow-up for the context-budget lean-prompt lever.

Summary

The simple-system-prompt lever restated which models already default to the lean system prompt, and that restatement misclassified claude-haiku-5-5 as full. No docs page covers it, so the lever now points at a probe record instead of restating the selector.

Fix

• docs/upstream/claude-code-lean-prompt-selector.md (new): a probed-behavior record per the upstream-drift convention, with a rerunnable binary check, the Claude Code 2.1.296 observation in our words, as-of 2026-10-10 and a recheck trigger.
• levers.json: conditions keeps our decision (explain an already-default zero; advice does not branch on model) and points at that record. The selector order and legacy model list are gone. recheckTrigger defers to the record's trigger.
• levers.test.sh: asserts the pointer, and that conditions names no model id, family or Claude Code version. The asserts that pinned the restated list are removed.
• Fragment: context-budget (patch).

Verification

• The probe's commands, run against the installed 2.1.296 binary, print the selector and list claude-haiku-5-5 with lean_prompt and claude-haiku-4-5 without.
• levers.test.sh and measure.test.sh (131) pass. scripts/check-changelog-fragments.sh --check passes. markdownlint on the record: 0 issues.

Related

• Refs: multi-agent: paired model-routing eval for retrieval, review and mechanical-edit roles #6901 (routing eval, same release sweep).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T09:09:30.995607Z	67aad3a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Review in progress

• Gather context (PR diff, changed files)
• Understand request (CI code-review lane via /review:code-review)
• Review changed files for correctness/maintainability
• Post findings

View job run

[claude]

Claude finished @kyle-sexton's task in 40s —— View job

---

Security review

• Gather context (PR diff, changed files)
• Run /review:security-review per custom instructions
• Post findings

Skip gate applied — no security-relevant surface.

This PR touches only:

• .changes/context-budget/fix-context-budget-haiku-5-5-lean-prompt-d0cab383.md — new changelog fragment (prose only)
• plugins/context-budget/skills/audit/reference/levers.json — expands the conditions prose for the simple-system-prompt lever to describe the lean_prompt capability check ahead of the legacy substring list, and bumps verified/recheckTrigger
• plugins/context-budget/skills/audit/scripts/levers.test.sh — adds one new assertion that the conditions text names lean_prompt and claude-haiku-5-5; the existing legacy-list assertion is unchanged/kept

None of this is executable logic with an attacker-reachable input: the JSON edit is descriptive reference text consumed by a documentation audit, and the test-script change only adds a stricter string-match assertion (strictly additive, no removed check). There is no injection surface, no auth/access-control logic, no secret/token handling, and no CI workflow or permissions change.

Instruction-surface check: the diff doesn't delete, narrow, or soften any standing instruction, rule, allowlist, or guardrail — the conditions field edit and the new test assertion are both purely additive (the prior legacy-list language and assertion are retained verbatim alongside the new text).

No security findings to report.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 976126acbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-security-review has reviewed this pull request through 8bca267; a later push is reviewed from there.

[claude]

Claude finished @kyle-sexton's task in 26s —— View job

---

Security review (incremental)

• Gather context (incremental diff since 976126a)
• Run /review:security-review per custom instructions, scoped to the one file changed since the last review
• Post findings

Scope: this lane last reviewed 976126acbba3e3b13f15536c5a3d7ab427fe40d5. Since then, the only change is in .changes/context-budget/fix-context-budget-haiku-5-5-lean-prompt-d0cab383.md (per .claude-lane/incremental.diff):

-Describe the `simple-system-prompt` lever's lean-prompt selection by the `lean_prompt` capability first (Claude Code 2.1.296), so Haiku 5.5 sessions classify as already-lean and Haiku 4.5 stays full.
+### Fixed
+
+- Describe the `simple-system-prompt` lever's lean-prompt selection by the `lean_prompt` capability first (Claude Code 2.1.296), so Haiku 5.5 sessions classify as already-lean and Haiku 4.5 stays full.

Skip gate applied — no security-relevant surface. This adds a ### Fixed section heading to an already-reviewed changelog fragment and reflows the same sentence underneath it. It is prose-only: no executable logic, no attacker-reachable input, no injection surface, no auth/access-control logic, no secret/token handling, and no CI workflow or permissions change.

Instruction-surface check: this file is a changelog fragment, not CLAUDE.md/AGENTS.md/a rules file/a skill or agent body/a hook allowlist, so the instruction-exception-register lens doesn't apply here. The edit doesn't delete, narrow, or soften any standing instruction.

Every other file in this PR (plugins/context-budget/skills/audit/reference/levers.json, plugins/context-budget/skills/audit/scripts/levers.test.sh) was already reviewed at 976126a and is unchanged since.

No security findings to report.

[claude]

Claude finished @kyle-sexton's task in 4m 11s —— View job

---

Code review complete

• Gather context (PR diff, changed files)
• Invoke /review:code-review and follow its instructions
• Review changed files for correctness/maintainability
• Post findings as inline PR comments

Ran the /review:code-review CI lane over the 3 changed files (levers.json, levers.test.sh, the changelog fragment). One finding posted inline, verified adversarially via a review:lane-verifier subagent before posting:

• plugins/context-budget/skills/audit/reference/levers.json:177 — the new conditions clause restates a volatile upstream specific (the binary's lean_prompt capability selector order, the 2.1.296 version, and per-model behavior for claude-haiku-5-5 / claude-haiku-4-5) directly in the lever body, rather than pointing to a live source. This is a direct violation of this repo's own .claude/rules/skill-bodies-state-current-rules.md, which applies here (plugins/*/skills/** matches this path) and requires volatile upstream specifics to live in a links-only drift record (pointer + as-of date + recheck trigger), never restated — "the upstream text itself is never stored" per docs/conventions/upstream-drift/README.md. The only citation is the generic env-vars page with no anchor/probe for this claim, and the new assertion in levers.test.sh:155-156 locks in the restatement by requiring the literal strings in conditions. Full detail and a suggested fix are in the inline comment.

No other correctness or maintainability issues found in scope for this lane (the changelog fragment and the kept/updated test assertions otherwise look correct; this PR does not touch security-relevant surface, per the earlier security-lane pass on this head).

[github-actions]

claude-review has reviewed this pull request through 8bca267; a later push is reviewed from there.

[claude]

Claude finished @kyle-sexton's task in 1m 17s —— View job

---

Security review (incremental)

• Gather context (incremental diff since ccc9af4514b7105b731bae222d68ce41f6cafd9c)
• Run /review:security-review per custom instructions
• Post findings

Scope: this lane last reviewed ccc9af4514b7105b731bae222d68ce41f6cafd9c. Since then, HEAD moved to 67aad3a6cbe7b9b0a2245844bdac35d6218e9713, which changes the same 4 files already listed for this PR:

• .changes/context-budget/fix-context-budget-haiku-5-5-lean-prompt-d0cab383.md — changelog prose reworded to describe the fix as "points at a probe record" instead of restating the selector
• docs/upstream/claude-code-lean-prompt-selector.md (new) — a probed-behavior record per the upstream-drift convention: a rerunnable grep/perl probe over the locally installed claude binary, plus the dated observation and recheck trigger
• plugins/context-budget/skills/audit/reference/levers.json — the simple-system-prompt lever's conditions field is rewritten to point at the new probe record (by URL) instead of restating the selector order/version/per-model specifics inline; recheckTrigger now defers to the record's trigger
• plugins/context-budget/skills/audit/scripts/levers.test.sh — assertions updated to require the pointer (docs/upstream/claude-code-lean-prompt-selector.md) and to reject the literal restated strings (lean_prompt, claude-opus-4-0, 2.1.29) inside conditions

Skip gate applied — no security-relevant surface. All four changes are prose/reference-data/test-assertion edits:

• The new probe script in docs/upstream/claude-code-lean-prompt-selector.md is documentation for a human to run manually against their own locally installed binary ($(command -v claude)); it isn't invoked by any CI job, hook, or application code in this diff, takes no attacker-controlled input, and only reads (grep/perl) the binary it resolves locally — no command injection, no network calls, no credential handling.
• levers.json's conditions/recheckTrigger edits are descriptive reference text consumed by a documentation audit skill, not executable logic.
• levers.test.sh's change only tightens regex assertions over that same descriptive string — no new attacker-reachable input path.
• The changelog fragment edit is prose only.

There is no injection surface, no auth/access-control logic, no secret/token handling, and no CI workflow or permissions change in this increment.

Instruction-surface check: none of these files is CLAUDE.md/AGENTS.md/a rules file/a skill or agent body/a hook allowlist in the sense the instruction-exception-register lens targets — levers.json is reference data for the context-budget audit skill, and this increment's edit to it is additive-in-intent (replacing a restated specific with a pointer), not a removed guardrail or softened control. No standing instruction, allowlist, or permission check is deleted, narrowed, or softened by this increment.

Every other file in this PR was already reviewed at ccc9af4514b7105b731bae222d68ce41f6cafd9c and carried no findings.

No security findings to report.
(branch)

[claude]

Claude finished @kyle-sexton's task in 2m 56s —— View job

---

Code review in progress

• Gather context (PR diff, changed files)
• Invoke /review:code-review and follow its instructions
• Review changed files for correctness/maintainability
• Adversarially verify candidate finding(s)
• Post findings as inline PR comments

Reviewed the latest commit (67aad3a), which fixes the earlier restated-selector finding by adding docs/upstream/claude-code-lean-prompt-selector.md. Verifying one remaining candidate finding before posting.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 67aad3a6cb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 2m 41s —— View job

---

Code review complete

• Gather context (incremental diff since 67aad3a)
• Invoke /review:code-review and follow its instructions
• Review changed files for correctness/maintainability
• Adversarially verify candidate finding(s)
• Post findings as inline PR comments

Scope: this lane last reviewed 67aad3a6cbe7b9b0a2245844bdac35d6218e9713. Since then, HEAD moved to 3fc9e497e959677f4cc19e934c626f576565d78a, touching the same 3 files per .claude-lane/incremental.diff:

• docs/upstream/claude-code-lean-prompt-selector.md — the probe's executable step now resolves the claude binary with perl -MCwd -e 'print Cwd::abs_path(shift)' instead of readlink -f.
• plugins/context-budget/skills/audit/reference/levers.json — the conditions clause for simple-system-prompt drops the inline `claude-haiku-5-5` included mention, leaving only the decision and the pointer to the probe record.
• plugins/context-budget/skills/audit/scripts/levers.test.sh — the restatement guard is broadened from three literal strings (lean_prompt, claude-opus-4-0, 2.1.29) to a general pattern rejecting any claude-<family>-<digit>, opus-<digit>, haiku, sonnet, or 2.1.<digit> token in conditions.

This commit addresses both review comments from the prior round on 67aad3a:

1. Codex's P1 on levers.test.sh:155-156: the old guard only blocked the specific strings that happened to be in the diff at that point, so it would have passed a different restated model outcome. The new regex (/lean_prompt|claude-[a-z]+-\d|opus-\d|haiku|sonnet|\b2\.1\.\d/i) rejects model-family/version tokens generically. I checked it by hand against the live conditions string in levers.json#L177 — the only digits/letters that could trip the pattern now are inside the probe-record URL (claude-code-lean-prompt-selector.md, claude-code-plugins) and the date 2026-10-10, and neither matches (claude-[a-z]+-\d needs a digit directly after a letter run following claude-, which neither substring has; 2026-10-10 uses hyphens, not the literal dots the 2\.1\.\d pattern requires). So the guard is both stricter and still green.
2. Codex's P2 on the probe doc: readlink -f isn't portable to BSD/macOS readlink. Cwd::abs_path resolves symlinks the same way realpath(3)/readlink -f does and ships with core Perl, so the probe stays rerunnable cross-platform.

The levers.json restatement finding from the first round (mine, Codex's, and kyle-sexton's) is resolved the same way as the first fix, carried one step further — claude-haiku-5-5 no longer appears in conditions at all, not even as the one example that survived that first pass.

No new findings on this increment. Every other file in this PR was already reviewed at 67aad3a6cb and carried no outstanding findings.
· branch

[claude]

Claude finished @kyle-sexton's task in 41s —— View job

---

Security review (incremental)

• Gather context (incremental diff since 67aad3a6cb)
• Run /review:security-review per custom instructions
• Post findings

Scope: this lane last reviewed 67aad3a6cbe7b9b0a2245844bdac35d6218e9713. Since then, HEAD moved to 3fc9e497e959677f4cc19e934c626f576565d78a, touching the three files named in the lane header:

• docs/upstream/claude-code-lean-prompt-selector.md — swaps readlink -f for perl -MCwd -e 'print Cwd::abs_path(shift)' to resolve the installed claude binary portably (fixes the macOS-readlink finding from Codex's prior pass)
• plugins/context-budget/skills/audit/reference/levers.json — drops the , \claude-haiku-5-5` included,clause fromconditions`, removing the last model-specific restatement
• plugins/context-budget/skills/audit/scripts/levers.test.sh — broadens the anti-restatement guard regex from lean_prompt|claude-opus-4-0|2\.1\.29 to lean_prompt|claude-[a-z]+-\d|opus-\d|haiku|sonnet|\b2\.1\.\d (fixes the too-narrow-guard finding from Codex's prior pass)

Skip gate applied — no security-relevant surface.

• The probe-record edit swaps one local path-resolution command for another; both only resolve the path of the locally installed claude binary via command -v claude (no attacker-controlled input), and the script is documentation for a human to run manually, not something invoked by CI, a hook, or application code. No injection surface is introduced or changed.
• The levers.json edit removes text (a model-name clause) from a JSON string value consumed by a documentation-audit skill; it is prose-only and additive-in-the-restatement-rule-compliance sense (it deletes a restated specific, matching this repo's skill-bodies-state-current-rules.md intent rather than violating it).
• The levers.test.sh edit widens a regex assertion to reject more model-specific patterns than before — it tightens the check, it does not loosen or remove one.

Instruction-surface check: none of these three files is CLAUDE.md/AGENTS.md/a rules file/a hook allowlist in the sense the instruction-exception-register lens targets. levers.json is reference data for the context-budget audit skill, not a skill body itself, and its edit removes a restated specific rather than a guardrail. The levers.test.sh regex change strictly broadens what it flags — no standing check is deleted, narrowed, or softened.

No security findings to report.

[claude]

Claude finished @kyle-sexton's task in 50s —— View job

---

Security review (incremental)

• Gather context (incremental diff since 3fc9e497e9)
• Run /review:security-review per custom instructions
• Post findings

Scope: this lane last reviewed 3fc9e497e959677f4cc19e934c626f576565d78a. Since then, HEAD moved to 880768e69111bb591754cb8c5f6486e25155c191, and the only change is in plugins/context-budget/skills/audit/scripts/levers.test.sh (per .claude-lane/incremental.diff):

-  if (/lean_prompt|claude-[a-z]+-\d|opus-\d|haiku|sonnet|\b2\.1\.\d/i.test(cond)) {
+  if (/lean_prompt|claude-[a-z]+-\d|opus-\d|haiku|sonnet|2\.1\.\d/i.test(cond)) {

This drops the \b word boundary in front of the 2\.1\.\d alternative inside the anti-restatement guard. levers.test.sh:154

Skip gate applied — no security-relevant surface.

• This is a one-character-class edit to a regex inside a node -e snippet embedded in a CI contract test (levers.test.sh). It runs only against this repo's own levers.json reference string (lean.conditions), never against attacker-controlled or external input.
• Effect is purely a widening of what the guard flags as a restated version number (dropping the \b means a 2.1.<digit> substring now also trips the guard when immediately preceded by a word character, e.g. a letter), which makes the anti-restatement check stricter, not weaker — it cannot let a previously-rejected conditions string pass.
• No execution path, no injection surface, no auth/access-control logic, no secret/token handling, and no CI workflow or permissions change.

Instruction-surface check: levers.test.sh is a test script, not CLAUDE.md/AGENTS.md/a rules file/a skill or agent body/a hook allowlist in the sense the instruction-exception-register lens targets, and this edit broadens an assertion rather than deleting, narrowing, or softening one — so the register lens does not apply here.

Every other file in this PR (.changes/context-budget/fix-context-budget-haiku-5-5-lean-prompt-d0cab383.md, docs/upstream/claude-code-lean-prompt-selector.md, plugins/context-budget/skills/audit/reference/levers.json) was already reviewed at 3fc9e497e9 and carried no findings.

No security findings to report.
· branch

[claude]

Claude finished @kyle-sexton's task in 3m 1s —— View job

---

Code review complete

• Gather context (incremental diff since 3fc9e497e9)
• Invoke /review:code-review and follow its instructions
• Review changed lines in levers.test.sh for correctness/maintainability
• Post findings as an inline PR comment

Scope: this lane last reviewed 3fc9e497e959677f4cc19e934c626f576565d78a. Since then, HEAD moved to 880768e69111bb591754cb8c5f6486e25155c191, touching one line in plugins/context-budget/skills/audit/scripts/levers.test.sh (per .claude-lane/incremental.diff): the anti-restatement guard's regex drops the \b before 2\.1\.\d.

One finding posted inline at levers.test.sh:154:

• The commit message says the \b was dropped because "the portability gate flags" it, but scripts/shell-portability-tokens.txt:30-32 documents the designated remedy for exactly this case — a per-site portability-ok: <reason> comment — precisely because the gate's bare \b/\s/\w… token list is a deliberate over-flag that can't distinguish a real grep/sed pattern from \b inside an embedded other-language literal (the token file even cites instruction-scan.sh's node-adjacent EREs as the live example of this exact false-positive shape). Here the \b sits inside a JS RegExp passed to node -e (not a grep/sed pattern), where \b is portable ECMAScript syntax and the GNU/BSD concern the gate exists for doesn't apply at all.
  • Beyond being the wrong remedy for the lint, the edit also changes the guard's actual matching semantics: \b2\.1\.\d only matched a version-looking token at a word boundary; without it, the bare 2\.1\.\d now also matches mid-token (e.g. 12.1.5, 42.1.9), which could make the test fail later on legitimate conditions prose that happens to contain an unrelated digit sequence.
  • Suggested fix: restore \b2\.1\.\d and add a portability-ok: <reason> comment instead of editing the regex.

No other findings in this increment — the rest of the file (and the other 3 files in this PR) was already reviewed at 3fc9e497e9 and is unchanged since.
· branch

[claude]

Claude finished @kyle-sexton's task in 35s —— View job

---

Security review (incremental)

• Gather context (incremental diff since 880768e69111bb591754cb8c5f6486e25155c191)
• Run /review:security-review per custom instructions, scoped to plugins/context-budget/skills/audit/scripts/levers.test.sh
• Post findings

Scope: this lane last reviewed 880768e69111bb591754cb8c5f6486e25155c191. Since then, HEAD moved to 8bca2677e927dee3053153b68065bd8911176065, and the only change is in plugins/context-budget/skills/audit/scripts/levers.test.sh:154 (per .claude-lane/incremental.diff):

-  if (/lean_prompt|claude-[a-z]+-\d|opus-\d|haiku|sonnet|2\.1\.\d/i.test(cond)) {
+  if (/lean_prompt|claude-[a-z]+-\d|opus-\d|haiku|sonnet|\b2\.1\.\d/i.test(cond)) { // portability-ok: JS RegExp, not grep or sed

This restores the \b word-boundary anchor that the previous commit (880768e) dropped, and resolves the shell-portability-gate false positive the way scripts/shell-portability-tokens.txt documents — a per-site portability-ok: comment — instead of weakening the regex's matching semantics. This addresses the finding posted on 880768e.

Skip gate applied — no security-relevant surface.

• This is a one-line comment addition plus restoring a regex anchor inside a node -e snippet embedded in a CI contract test (levers.test.sh). It evaluates only against this repo's own levers.json reference string (lean.conditions) — never attacker-controlled or external input.
• The anti-restatement guard's matching behavior tightens back to word-boundary-only matching for the 2.1.<digit> alternative (undoing the prior increment's accidental loosening), so this is a strict narrowing of a false-positive surface, not a new one.
• No execution path, no injection surface, no auth/access-control logic, no secret/token handling, and no CI workflow or permissions change.

Instruction-surface check: levers.test.sh is a test script, not CLAUDE.md/AGENTS.md/a rules file/a skill or agent body/a hook allowlist in the sense the instruction-exception-register lens targets. The edit restores a guardrail to its stricter prior state and adds a documentation comment — it does not delete, narrow, or soften any standing instruction.

Every other file in this PR (.changes/context-budget/fix-context-budget-haiku-5-5-lean-prompt-d0cab383.md, docs/upstream/claude-code-lean-prompt-selector.md, plugins/context-budget/skills/audit/reference/levers.json) was already reviewed at 880768e69111bb591754cb8c5f6486e25155c191 and carried no findings.

No security findings to report.
· branch

[claude]

Claude finished @kyle-sexton's task in 2m 43s —— View job

---

Code review complete

• Gather context (incremental diff since 880768e69111bb591754cb8c5f6486e25155c191)
• Invoke /review:code-review and follow its instructions
• Review the changed line in levers.test.sh for correctness/maintainability
• Verify the fix against the portability-gate convention and the test suite
• Post findings

Scope: this lane last reviewed 880768e69111bb591754cb8c5f6486e25155c191. Since then, HEAD moved to 8bca2677e927dee3053153b68065bd8911176065, touching one line in plugins/context-budget/skills/audit/scripts/levers.test.sh (per .claude-lane/incremental.diff):

-  if (/lean_prompt|claude-[a-z]+-\d|opus-\d|haiku|sonnet|2\.1\.\d/i.test(cond)) {
+  if (/lean_prompt|claude-[a-z]+-\d|opus-\d|haiku|sonnet|\b2\.1\.\d/i.test(cond)) { // portability-ok: JS RegExp, not grep or sed

This is exactly the fix requested in my prior comment on 880768e (levers.test.sh:154):

1. Word-boundary semantics restored. \b2\.1\.\d only matches a version-looking token at a word boundary (preceded by start-of-string, whitespace, or punctuation like -). Without \b, the bare 2\.1\.\d would also match mid-token substrings such as 12.1.5 or 42.1.9, which could false-positive this anti-restatement guard on legitimate future conditions prose containing an unrelated digit run. Restoring it is correct and matches the guard's intended scope.
2. Correct escape for the portability-lint false positive. scripts/shell-portability-tokens.txt:30-52 documents that the gate deliberately over-flags bare \b/\s/\w… tokens (it can't distinguish a real grep/sed pattern from \b inside an embedded other-language literal) and names the designated remedy as a per-site portability-ok: <reason> comment, checked by is_annotated() in scripts/lib/shell-portability-scan.awk:90 (l ~ /portability-ok:/) — a plain substring match, so any comment syntax works as long as it's valid in the line's actual host language. Here the \b sits inside a RegExp literal passed to node -e (JavaScript, not a grep/sed pattern), so a // comment is the right choice — this matches the existing precedent in plugins/harness-ops/hooks/hook-failure-audit.sh:431-432, which uses jq-native # comments for the same escape inside an embedded jq program. // would be invalid as a leading comment token in jq/shell but is exactly right for embedded JS, so the marker is both recognized by the gate and syntactically valid in context.

I verified by hand that the current simple-system-prompt.conditions string in levers.json#L177 stays clean against the restored regex: it contains no lean_prompt/haiku/sonnet/opus-<digit>/claude-<letters>-<digit> token, and its only digit runs (2026-10-10) use hyphens, not the dotted 2.1.<digit> shape the \b2\.1\.\d alternative requires — so the guard stays green. (I was not able to execute levers.test.sh or scripts/check-shell-portability.sh directly in this sandbox — both shell invocations were denied — so this is a manual static trace rather than a run; the author's own verification notes in prior comments state both already pass.)

No new findings on this increment. Every other file in this PR (.changes/context-budget/fix-context-budget-haiku-5-5-lean-prompt-d0cab383.md, docs/upstream/claude-code-lean-prompt-selector.md, plugins/context-budget/skills/audit/reference/levers.json) was already reviewed at 880768e69111bb591754cb8c5f6486e25155c191 and carried no outstanding findings as of that review.
· branch