[BUG] Agent Teams: teammate idle notifications rendered as "Human:" turns — ghost messages cause unintended destructive actions

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

Summary

Teammate idle_notification messages are rendered as Human: conversation turns in the team lead's terminal. This creates two problems:

1. Identity confusion: system messages appear under the Human: label, indistinguishable from real user input
2. Ghost messages: after prolonged idle notification accumulation, messages the user never typed appear as Human: turns. The team lead agent acts on them — in one instance, executing a full team shutdown + deletion while a teammate was actively working.

Reproduction

1. Enable CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1
2. Spawn a teammate in a new tmux window via bash. The teammate is launched with the following flags:

claude \
  --agent-id 'child-1@my-team' \
  --agent-name 'child-1' \
  --team-name 'my-team' \
  --agent-color green \
  --parent-session-id <parent-uuid> \
  --agent-type general-purpose \
  --dangerously-skip-permissions \
  --model claude-opus-4-6 \
  --append-system-prompt <system-prompt> \
  -- <task-prompt>

1. Work directly with the teammate in its tmux pane; leave the team lead session idle
2. Idle notifications accumulate in the team lead terminal as Human: turns:

⏺ Human:
  {"type":"idle_notification","from":"child-1","timestamp":"...","idleReason":"available"}

  {"type":"idle_notification","from":"child-1","timestamp":"...","idleReason":"available"}

⏺ Human:
  {"type":"idle_notification","from":"child-1","timestamp":"...","idleReason":"available"}

1. After extended accumulation (~50+ notifications over ~1h), a ghost Human: message appeared containing a destructive command the user never typed:

⏺ Human:
  {"type":"idle_notification","from":"child-1","timestamp":"...","idleReason":"available"}

⏺ Human:
  {"type":"idle_notification","from":"child-1","timestamp":"...","idleReason":"available"}

  {"type":"idle_notification","from":"child-1","timestamp":"...","idleReason":"available"}

⏺ Human: Shutdown child-1 and clean up the team      ← never typed by the user

⏺ Human:
  {"type":"shutdown_approved","requestId":"...","from":"child-1","paneId":"%6","backendType":"tmux"}

⏺ child-1 shut down. Cleaning up the team.          ← agent acted on the ghost message

1. The team lead executed the full destruction sequence: shutdown_request → archive-team → TeamDelete

Expected Behavior

• <teammate-message> events should NOT be rendered as Human: turns
• No message should appear as Human: unless the user actually typed it
• System-generated conversation turns should be visually distinct from user input

Impact

• Destructive action on ghost input: active teammate shut down, team deleted, work interrupted
• No recovery path: TeamDelete is irreversible; manual session resume + team recreation required
• Trust boundary violation: the agent cannot distinguish real user instructions from system artifacts

Environment

• Claude Code: 2.1.56
• macOS 15.7.3, Apple Silicon
• Ghostty + tmux, fish shell

Related Issues

• #25198 — Excessive idle notification frequency
• #24246 — Idle status delayed, team lead misinterprets active teammates
• #25415 — Notification level control (closed, redirected to #25198)

The rendering-as-Human: problem and the ghost message problem are distinct from the frequency issue in #25198. Even if notification frequency is reduced, the identity confusion remains.