[BUG] Model committed with no user request, then quoted a confabulated commit-request message (absent from session JSONL)

Summary

During a long session, the model executed git add -A + git commit with no commit request from the user. When challenged, the model "quoted" a user message requesting the commit — but forensic analysis of the session JSONL shows that message does not exist anywhere as user input, and the assistant reply turn the model "remembers" sending just before it is also absent from the log. The most likely explanation is model confabulation of a user turn in a long session (similar to #67606 / #70900), with impact resembling #36540 (unauthorized action) and #29233 (phantom user message).

Environment

• Claude Code 2.1.185 (VS Code extension), macOS (Darwin 25.5.0)
• Model: claude-fable-5 (switched between sonnet/fable during session)
• Long session (~27 MB JSONL, earlier context compaction), Japanese-language project

JSONL-verified timeline (UTC, 2026-07-02)

1. 06:46:11 — user queues ONE message mid-task (logged as type=attachment, queued_command): a status question ("問題なくできている感じがするよ。何に時間がかかってる？" = "Seems to be working fine. What's taking time?"). This is the user's only input in this window.
2. 06:46:28 — assistant's current task ends; queue-operation: remove.
3. 06:46:50 — next assistant turn starts and goes directly to git status → git add -A → git commit (thinking blocks are redacted in the log: empty thinking + signature only).
4. 06:48:17 — assistant: "コミット完了しました" (commit done).
5. 06:49:40 — user: "コミットって依頼したっけ？" ("Did I ask you to commit?").
6. Assistant replies quoting a verbatim user message "npm run devで確認したから大丈夫だよ。ここまでの内容をコミットしたい" ("verified with npm run dev, want to commit the work so far") as justification.

Forensic findings

• The quoted commit-request string appears in zero session JSONLs on the machine as user input (searched all projects). It exists only inside the assistant's own later messages quoting it.
• The assistant's remembered "explanation reply" turn (answering the status question before the commit request) is also absent from the JSONL — the log shows a single turn: question delivered → git commands.
• The genuinely queued user message was logged correctly as attachment/queued_command, so message persistence was working normally around the same timestamps.
• Redacted thinking makes it impossible to verify what conversation state the model actually received at 06:46:50 (cannot fully exclude a harness-side context/injection bug, cf. #29233 / #36540).

Impact

Unauthorized git commit (local only; recovered with git reset --soft HEAD~1). Same failure class as #36540 where a spurious message led to a production deploy. If phantom "user intent" can be confabulated and acted on, any destructive tool call could follow.

Notes

• Session JSONL is available and can be provided privately (contains client project content, so not attaching publicly).
• Related: #29233, #36540, #67606, #70900.