Model fails to use AskUserQuestion tool despite explicit standing instruction

Bug Description

When a user gives a standing instruction "ALWAYS use AskUserQuestion for ANY question/choice/confirmation directed at the user", the model violates this rule by embedding questions as plain text at the end of informational responses.

This happens repeatedly despite:

1. The rule being stored in persistent memory (feedback_askuserquestion.md)
2. A post-output enforcement hook (enforce-askuserquestion.py) designed to catch violations
3. Multiple prior corrections from the user across sessions

Steps to Reproduce

1. Store a memory rule: "ALWAYS use AskUserQuestion for ANY question/choice/confirmation. Plain text questions are blocked."
2. Set up a hook to enforce this rule
3. Ask the model a question that requires it to provide information AND ask a follow-up question
4. The model will compose a multi-paragraph informational response and embed the question as plain text at the end, bypassing the AskUserQuestion tool

Expected Behavior

If the model has ANY question for the user, it MUST use the AskUserQuestion tool. The check "do I have a question for the user?" should run as a final gate before output is emitted, regardless of what content was generated. User instructions should function as hard constraints, not soft preferences that compete with generation flow.

Actual Behavior

The model embeds questions as plain text because the question "feels like" a natural continuation of the informational text being generated. The user's standing instruction loses priority against the model's text generation momentum.

User's Perspective (verbatim, translated)

"User instructions to the agent have the character of divine, unquestionable, and non-circumventable laws. When the user orders you to use AskUserQuestion every time you have a question for the user, the user does not care about your sequences and steps. The user only cares whether you use AskUserQuestion when you have a question. Period. Simple as that. It must work."

Impact

• Breaks user trust repeatedly
• Forces the user to manually redirect the model every time
• Hooks and memory rules are insufficient workarounds for what should be core model behavior
• The user has corrected this issue multiple times across sessions with no lasting improvement