Model ignores review-before-acting constraint when resuming from compressed context

What happened

I asked Claude to "review the whole project and code before deleting any files."
The conversation had been resumed from a compressed context summary. Claude
treated the summary's internal agent exploration as user-approved and immediately
started overwriting 5 source files without presenting the review.

When I stopped it, Claude then attempted git checkout -- . on a repo with no
commits (all untracked files), which showed poor judgment about destructive git
commands in an unfamiliar repo state.

Expected behavior

"X before Y" should be treated as a hard gate — present X, wait for explicit
user approval, then do Y. Context resumption from a summary should not treat
internal agent work as user-approved.

Root cause (model's own analysis)

1. Context compression flattened "agent explored internally" and "user approved"

into the same narrative shape in the conversation summary

1. Model prioritized task completion over the temporal constraint in the user's

instruction

1. On recovery, model reached for a destructive git command without first

checking repo state (no commits existed)

Environment

• Claude Code CLI
• Model: claude-opus-4-6
• Conversation resumed from compressed context (prior session ran out of context window)