Claudecode

An agent writes revision 41, an engineer writes revision 42, and conditional recovery refuses to overwrite the engineer's repair

Claude Code rollback must not erase the next engineer's fix

A saved snapshot can undo the agent’s change and somebody else’s repair. Make recovery conditional on the revision the agent wrote.

One Claude Code MCP call fans out to paid workers while a shared cost capability blocks work beyond the 25 dollar limit

One Claude Code MCP call spent the whole agent budget

The Claude Code run had a $25 limit and made one MCP call. Hidden fan-out behind the server produced a $286.40 bill.

A Claude Code incident replay forks into a faithful path using captured MCP evidence and a misleading path that calls today's live tools

Your Claude Code incident replay used today's tool output

The same prompt and repository commit produced a clean replay because an MCP tool returned newer evidence. The team had rerun the task, not reproduced the incident.

Claude Code plans against resource version 41, but a state-bound write gate blocks execution after the resource changes to version 42

Claude Code approved one state. Its MCP write changed another

A reviewer approved a Claude Code change against resource version 41. By execution time, version 42 existed, but the MCP write replaced it anyway.

An allowed Claude Code CI retry passes through build and release systems before a fresh capability gate blocks production deployment

Claude Code had no deploy permission. Its MCP tool deployed anyway

A permitted CI retry reached production through an artifact event and a more powerful release service. Tool permissions missed the effect that mattered.

Claude Code's audit trail put the effect before the approval

Clock skew made an approved Claude Code run look unauthorized. Wall-clock timestamps cannot prove the order of a production agent’s approval, dispatch, commit, and revocation.

A Claude Code transcript passes through five independent evidence checks for identity, authority, durable effect, observation, and cleanup before a reviewer accepts the run

A Claude Code audit trail needs proof beyond the transcript

A Claude Code transcript can describe an MCP action without proving who was authorized, what committed, whether an independent read saw it, or what rollback left behind.

A Claude Code MCP write waits in a retry queue beyond its approval expiry, keeps the same operation ID, and is blocked by an execution-time authority check

Claude Code queued an approved MCP write. It ran after permission expired

A stable operation ID can stop duplicate MCP writes while still allowing an action after its approval expires. Recheck authority where the effect occurs.

A Claude Code MCP write passes through an acknowledgement gate, durable commit check, and independent read before a durability receipt is issued

Claude Code got a success receipt before the write was durable

An MCP tool can return success after accepting a write but before durable storage. Define acknowledgement levels, verify the committed version, and give Claude Code a durability receipt.

Cover of Claude Code for Legacy Modernization by Thomas De Vos

Claude Code for Legacy Modernization is available as an ebook and paperback

My evidence-first guide to modernizing critical systems with Claude Code is now available as a 597-page paperback and an ebook on Amazon UK.