[Model behavior] Mis-described a security-relevant gap as 'pre-existing' without checking the code

The model stated that an origin fetch ignoring bucket policies was a pre-existing limitation of the storage emulation. It had not checked. The storage service does enforce bucket policies for non-owner callers; the new code path bypassed that enforcement. The claim was made from assumption, not from the code.

Model: Claude Opus 5.5 (claude-opus-5-5[1m]), Claude Code CLI, one long working session on 2026-10-02.
Context: maintainer of an open-source cloud-service emulator; the work is pull-request review and fixes under a written procedure loaded into every session (project instruction file + persistent memory). No personal data, repository names, PR numbers or handles are included.

Raised with Claude Code.