Permission prompts fire inconsistently even when the exact command matches an existing permissions.allow pattern

On Windows, using Claude Code in a project with .claude/settings.json permissions.allow already listing exact-match rules (including full-string prefix matches with a cd "<project>" && prefix, e.g. Bash(cd "C:\Users\...\<project>" && py *)), the same-shaped command still intermittently triggers an "Allow Claude to run..." confirmation dialog — sometimes it passes silently, sometimes the exact same command shape requires confirmation again on the very next call.

MCP tools already listed in the allow list (e.g. mcp__playwright__browser_navigate) show the same inconsistency — sometimes silent, sometimes prompted.

I also tried changing permissions.defaultMode from "auto" to "bypassPermissions" by editing .claude/settings.json directly, then immediately testing within the same running session — permission prompts still appeared, so the change had no observable effect (possibly requires a session restart to take effect, but this is unconfirmed).

This has reportedly persisted across multiple sessions over several days in the same project, forcing the user to stay at the computer to manually approve confirmations even for read-only operations (curl hitting a public data API, running a local Python script to process already-downloaded files, Playwright browser navigation).

Environment: Windows 10, Claude Code (Sonnet 5)