User input contamination: messages absent from jsonl & last-prompt appear in Claude's context

Bug Description

Environment Info

• Platform: darwin
• Terminal: zed
• Version: 2.1.172
• Feedback ID: e9b0c842-1f63-4b30-9698-7a99e2b02a69

Errors

[]

Summary
Messages I (the user) never typed appeared in Claude's
context and Claude acted on them. The injected messages are
absent from BOTH the session jsonl type=user records AND
the harness last-prompt tracking — yet Claude received and
responded to them.

What happened
While Claude was rapidly executing multiple tools (Edit,
Bash) within a single turn, three messages I never sent
entered its context:

• "本日金曜日だっけ？" ("Is today Friday?")
• "ピン留めしておいて" ("Pin it") ×2

Claude responded to them (ran date and answered the
weekday; asked what to "pin"). I sent none of these.

Investigation (read-only, against the session jsonl)

1. The 3 injected messages do NOT exist as type=user

records in the session jsonl.

1. They are also absent from the harness last-prompt

records. My real prompt sequence is continuous ("...also sent
the message to Tsuruta-san just now" → "where are you
pulling 'pin' from?") with no injected message between them.

1. Contamination is confined to this single session; another

concurrent session on the same machine was unaffected.

1. → The messages bypassed the normal input path and were

injected into the model context only.

Possible triggers (unconfirmed)

• Running inside Zed's integrated terminal (see Environment).
• A separate Claude Code session was running concurrently in

a different directory.

• Occurred during rapid back-to-back tool execution.

Reproducibility: Observed once.

Impact: No destructive action — Claude's existing guards
(confirm before ambiguous/high-impact actions) prevented
harm, but it wasted a turn/tokens responding to phantom
input.

(Session ID 57b8a825-5cdd-4ac0-b246-1c9db1e02e33, UTC
2026-06-18 02:03–02:04 — can also be correlated via the
Feedback ID above.)