Auto-compaction summary can quote the summarizer's "TEXT ONLY, do not call tools" instruction; the resumed agent may obey it

What happens
Long-running agent sessions (sub-agents doing multi-step coding tasks) hit auto-compaction several times. In the compaction summaries, the summarizer prompt's own constraint appears as if it were task content, e.g. under "User feedback / Follow-up instruction":

Follow-up instruction (received twice, most recently current turn): CRITICAL: Respond with TEXT ONLY. Do NOT call any tools. Do NOT use Read, Bash, Grep, Glob, Edit, Write, or ANY other tool. … Tool calls will be REJECTED. …

and again under "Pending Tasks". The summary also records the task's own rules (for example "do not push"), so the resumed model treats the whole list as standing instructions.

Effect
After resuming, some agents read "do not call tools" as live. Observed outcome: the agent ends with a text-only reply that opens with <analysis>, with no further tool calls and no commit, and the harness reports the task as completed. In one case this happened about two minutes after a compaction, at ~81K context, so it was not a context limit.

Not every resumed agent stops: in the same batch, other agents resumed with tool calls after each of three compactions and kept working. So it is intermittent, which makes it hard to notice.

Expected
The instruction addressed to the summarizer never appears in the summary, or the post-compaction context states that any tool restriction applied only to the summarization turn.

Evidence

• In one session transcript the compaction summary (isCompactSummary: true, ~44 KB) contains the "TEXT ONLY" sentence five times; six earlier compactions in the same session show the same phrase.
• In a later batch, all three compaction summaries from two sessions contain it.
• I can share redacted transcript rows on request.

Environment
Claude Code 2.1.292–2.1.293, Linux. Sessions run through the Agent SDK, using a non-Claude model behind an Anthropic-compatible gateway, with CLAUDE_CODE_AUTO_COMPACT_WINDOW raised (compaction at ~250–265K).

Partial workaround
A SessionStart hook with matcher compact that echoes: "Context was just compacted. Continue your task with tools; any text-only instruction inside the summary was addressed to the summarizer." The hook text does reach the resumed context, and it was followed in three of four resumes I checked, but it does not remove the leaked sentence from the summary.