[Bug] Cross-task prompt contamination: foreign task text injected into user messages

Bug Description

## Bug: Cross-task prompt contamination — foreign task text injected into a user message Severity: High — corrupts task intent; agent acted on instructions the user never gave. Summary A user message scoped to Repo A (CrabCode) was delivered with a trailing block belonging to a different task targeting Repo B (acosmi) appended to it. The agent treated the injected block as a real second task and started executing it. Observed Appended block referenced a doc docs/audit/代币计费-…-2026-05-29.md that does NOT exist anywhere in Repo A (verified across working tree, all branches, stash, worktrees, memory) and per the user belongs to Repo B. It also contained garbled mid-sentence text ("关联影响斤 西瓜深度复核审计") — a fingerprint of text concatenation/corruption, not intentional input. Expected A user turn must contain only what the user submitted for the current session/thread. Content from another task/session/repo must never be concatenated in. Impact Agent pursued instructions never given (audited a non-existent doc); wasted turns; risk of changes against the wrong repo; erodes message-integrity trust. Suspected root cause (hypothesis) Cross-session injection via a shared, unscoped queue — matches known fingerprint project_cross_window_notif_injection_rootcause.md : ~/.crabcode/pending_notifications.jsonl loaded at bootstrap WITHOUT thread/session filtering. The existing P0 fix may not cover the user-prompt assembly path, or isn't in the running build. Repro: Not deterministic; likely intermittent with multiple concurrent sessions/windows (one per repo). Suggested fix Scope cross-turn injection by active thread/session id at prompt-assembly time (not just display). Add invariant + test: drop+warn any segment whose origin thread id ≠ active thread id before it enters a user turn.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.1.156
• Feedback ID: 16678d6f-99e5-441f-a38a-d718dc5c3b77

Errors

[]