[BUG] Plan Mode: Claude executes edits when "Exited Plan Mode" system reminder appears without user approval

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

  When Plan Mode is triggered, Claude received two conflicting system reminders in the same message:
  1. <system-reminder>Plan mode is active...</system-reminder>
  2. <system-reminder>## Exited Plan Mode - You have exited plan mode. You can now make edits...</system-reminder>

  Claude interpreted the "Exited Plan Mode" message as authorization to proceed with edits, even though the user never explicitly approved exiting Plan Mode. Claude then executed Edit tool calls directly without writing a plan file first or waiting for user confirmation.

What Should Happen?

1. Plan Mode should only exit when the user explicitly approves/confirms
2. The "Exited Plan Mode" system reminder should only appear AFTER user confirmation
3. Claude should not receive conflicting "active" and "exited" messages simultaneously
4. If both messages appear, Claude should treat Plan Mode as still active and ask for clarification

Error Messages/Logs

Steps to Reproduce

1. Start a conversation with Claude Code
2. Request a task that triggers Plan Mode (e.g., updating a command file)
3. Observe that both "Plan mode is active" and "Exited Plan Mode" system reminders appear in the same response
4. Claude proceeds to execute Edit tools without user approval

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.0.69

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

The root cause appears to be either:

• A race condition where Plan Mode exit is triggered automatically without user input
• System reminders being sent in incorrect order/timing
• Missing gate between "plan mode active" state and "edit allowed" state