Tool-call markup leaks into assistant text — missing namespace + spurious "court" token (Opus 4.8)

Summary

Intermittently, the assistant's tool invocation is emitted as a plain text block instead of a structured tool_use, so the tool call is never parsed or executed. The leaked text has a consistent signature:

1. It omits the function-call namespace — it renders as <invoke name="Bash"> instead of the proper namespaced form.
2. A stray literal token court is always prepended immediately before <invoke.

Because the harness does not recognize this as a tool call, the markup is stored/displayed as assistant text and the command does not run.

Environment

• Claude Code (desktop app)
• Model: claude-opus-4-8, effort xhigh
• Platform: macOS (Darwin 25.4.0)

What it looks like

A representative leaked assistant message (verbatim from the session transcript):

すみません、また記法ミスでした。正しく実行します。

court
<invoke name="Bash">
<parameter name="command">echo test</parameter>
<parameter name="description">test</parameter>
</invoke>

Evidence that this is a systematic bug, not a one-off

• Within a single session, 44 tool calls succeeded (proper tool_use blocks) but 5 leaked as text — so it is intermittent, not a total failure.
• All 5 leaked occurrences are role: assistant, type: text blocks (confirmed directly from the raw session transcript). It is the model's own tool-call output, not user input.
• The model noticed the failure and apologized/retried twice ("すみません、ツール呼び出しの記法を誤りました。正しく実行します"), yet reproduced the exact same malformed output.
• Reproduced across at least two separate sessions.

The malformation signature

• Missing namespace on <invoke …> (renders as bare <invoke name="Bash">).
• A spurious leading token court before every leaked <invoke.

The consistent extra court token suggests a serialization / token-encoding issue in the tool-call path rather than random model drift.

Expected vs actual

• Expected: Tool calls are parsed as tool_use and executed.
• Actual: The tool-call markup is emitted as assistant text; the command is never executed. (No unintended execution occurs — the command simply never runs.)

Impact

When it triggers, the agent silently fails to perform the intended action (e.g., a Bash command), and the raw internal tool-call markup is exposed to the user as if it were prose.