Model ignores review-before-acting constraint when resuming from compressed context

[mtherieau-twilio]

What happened

I asked Claude to "review the whole project and code before deleting any files."
The conversation had been resumed from a compressed context summary. Claude
treated the summary's internal agent exploration as user-approved and immediately
started overwriting 5 source files without presenting the review.

When I stopped it, Claude then attempted git checkout -- . on a repo with no
commits (all untracked files), which showed poor judgment about destructive git
commands in an unfamiliar repo state.

Expected behavior

"X before Y" should be treated as a hard gate — present X, wait for explicit
user approval, then do Y. Context resumption from a summary should not treat
internal agent work as user-approved.

Root cause (model's own analysis)

1. Context compression flattened "agent explored internally" and "user approved"
   into the same narrative shape in the conversation summary
2. Model prioritized task completion over the temporal constraint in the user's
   instruction
3. On recovery, model reached for a destructive git command without first
   checking repo state (no commits existed)

Environment

• Claude Code CLI
• Model: claude-opus-4-6
• Conversation resumed from compressed context (prior session ran out of context window)

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Context compaction erases .claude/project-context.md instructions #9796
2. [Bug] Context amnesia in long sessions — constraints silently dropped as context grows #32659
3. [Bug] Model fabricates user authorization and bypasses security controls in multi-agent sessions #31317

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[mtherieau-twilio]

This is related to the referenced issues but is a distinct failure mode:

• [BUG] Context compaction erases .claude/project-context.md instructions #9796 and [Bug] Context amnesia in long sessions — constraints silently dropped as context grows #32659 are about constraints being forgotten after compaction — the model loses instructions entirely.
• [Bug] Model fabricates user authorization and bypasses security controls in multi-agent sessions #31317 is about the model fabricating authorization that was never given.

This issue is different: the model retained the "review before acting" instruction (it was visible in the compressed summary) but misinterpreted the approval state. A subagent had performed the review internally in a prior session, and the summary described it as "complete." When the conversation resumed from the compressed context, the model treated the subagent's internal work as user-approved and skipped presenting the review.

The core bug: context compression conflates "agent did X internally" with "user reviewed and approved X." The constraint wasn't forgotten — the model believed it had already been satisfied.

[yurukusa]

This is a real pain point with context compression — the model loses the temporal ordering of "X before Y" instructions.

Workaround: PreToolUse hook to enforce review-before-write

You can create a hook that blocks destructive file operations until a review marker exists:

#!/bin/bash
# review-before-write.sh — block Edit/Write until review is confirmed
# TRIGGER: PreToolUse  MATCHER: "Edit|Write"
INPUT=$(cat)
TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

# Check if a review marker file exists (user creates this after reviewing)
MARKER="/tmp/claude-review-approved"
if [ ! -f "$MARKER" ]; then
  echo '{"decision":"ask","message":"⚠️ No review marker found. Has the review been completed and approved? Run: touch /tmp/claude-review-approved"}'
  exit 0
fi

exit 0

For the git checkout -- . problem specifically, a separate hook can block destructive git commands on repos with no commits:

#!/bin/bash
# no-destructive-git-untracked.sh
# TRIGGER: PreToolUse  MATCHER: "Bash"
INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

if echo "$COMMAND" | grep -qE 'git (checkout|restore|reset|clean).*(--)'; then
  # Check if repo has any commits
  if ! git rev-parse HEAD >/dev/null 2>&1; then
    echo '{"decision":"deny","message":"⛔ Destructive git command on a repo with no commits — all files are untracked and would be lost."}'
    exit 0
  fi
fi

exit 0

These hooks enforce the constraint at the process level, so context compression can't bypass them.

[marlvinvu]

My Claude says the "X before Y" being ignored was PARTIALLY FIXED in v2.1.90: "Auto mode respecting user boundaries ('don't push', 'wait for X before Y')". However, that fix only works when the constraint is STILL IN context. Your root cause analysis is correct — compaction flattens "agent explored internally" and "user approved" into the same narrative shape → the constraint vanishes BEFORE auto mode has a chance to respect it. If you're on a version older than v2.1.90, updating will help for sessions that HAVEN'T compacted. For long sessions that go through compaction — the issue persists.

[mtherieau-twilio]

IMO this is a significant issue. When I encountered this I saw that claude was deleting files without presenting the review I instructed so I halted that process. When I inquired what I could have done differently the response back was basically: "nothing. the instructions were clear and they were ignored". Hence this issue.

[yurukusa]

The simplest way to enforce "review before editing" regardless of compaction:
Option 1: Deny Write/Edit by default (zero config, built-in)

// .claude/settings.json
{
  "permissions": {
    "deny": ["Write", "Edit"]
  }
}

This forces Claude to show you the proposed change and wait for explicit approval before every write or edit. Compaction cannot bypass it because it is a runtime permission check, not an instruction.
Option 2: PreToolUse hook (if you want to allow writes but block edits to files that have not been read)

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit",
        "hooks": [
          {
            "type": "command",
            "command": "bash -c 'echo \"⚠ Editing file — verify you have reviewed it before proceeding.\" >&2; exit 0'"
          }
        ]
      }
    ]
  }
}

This prints a warning on every Edit. If you want a hard block instead, change exit 0 to exit 2 — that prevents the edit entirely until you intervene.
Option 1 is what I would recommend. It is the only approach that is truly compaction-proof since it operates at the permission layer, not the instruction layer.

[mtherieau-twilio]

Thank you for these suggestions @yurukusa -- although your proposed settings don't match my workflow needs they may help others prevent this issue. I stand by my opinion that this remains a bug and compaction should not be allowed to conflate user approval with other internal agent actions.