Tool calls become malformed (stray token + missing antml: namespace) late in long sessions — Opus 4.8

Summary

In the later portion of a long session, the assistant (model Opus 4.8, claude-opus-4-8) repeatedly emitted malformed tool calls that the harness could not execute. Tool calls earlier in the same session were well-formed; the degradation set in only as the context grew large.

Failure shapes

Two distinct corruptions, often together:

1. A stray literal token prepended immediately before the invocation block (e.g. the word count on its own line before <invoke ...>).
2. The <invoke> and <parameter> tags written without the required antml: namespace prefix (i.e. <invoke> / <parameter> instead of the namespaced form).

Result

Each malformed call ended in one of two ways:

• The harness returned Your tool call was malformed and could not be parsed. Please retry., or
• The harness rendered the raw XML block to the user as plain text instead of invoking the tool.

Either way the tool did not run, and the call had to be re-issued.

Frequency / scope

• 8+ occurrences in a single session, across multiple tools (Read, Edit, Bash).
• Recurred even after the assistant explicitly acknowledged the format and stated it would correct it — i.e. it kept drifting back into the malformed form on subsequent calls.

Apparent correlation

• Only appeared late in a very long session with a large accumulated transcript and heavy repeated injection of system-reminder / hook messages between turns.
• Early-session tool calls in the same session were correct, suggesting tool-call serialization stability degrades as context length / injected-message volume grows.

Environment

• Claude Code CLI
• Model: Opus 4.8 (claude-opus-4-8, 1M context)
• Platform: macOS (darwin)

Expected behavior

Tool-call serialization should remain stable regardless of context length; malformed invocations (missing namespace, stray leading tokens) should not be emitted.

Reproducibility

Not deterministic. Correlates with long context length plus a high volume of injected system messages across many turns; hard to trigger on a short session.