[BUG] Tool loaded. system notification is indistinguishable from user input and triggers false plan approval

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Body:
When ToolSearch successfully loads a deferred tool schema, it emits a Tool loaded. notification that appears in the conversation as if it were a user message. The phrase Tool loaded. is also the conventional user signal for approving a plan in plan mode.
Because the notification is visually identical to user input, the assistant misread the automatic system message as plan approval and proceeded to implement code changes while still in plan mode — without the user ever authorising execution.

What Should Happen?

System notifications should be clearly distinguishable from user messages and should never be treated as user authorisation.

Error Messages/Logs

Steps to Reproduce

Steps to reproduce:

1. Enter plan mode on a task that requires loading a deferred tool (e.g. ExitPlanMode via ToolSearch).
2. The assistant calls ToolSearch to fetch the schema.
3. The system emits Tool loaded. as a notification.
4. The assistant interprets this as user approval and exits plan mode / begins implementation without actual user input.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

4.6

Platform

Anthropic API

Operating System

Other

Terminal/Shell

Other

Additional Information

_No response_