Malformed tool-call emission: literal "court" replaces <function_calls> opener, antml: namespace stripped, block stored as text (session hangs)

Summary

Intermittently, Claude Code fails to emit a valid tool call. Instead of the proper tool-call wrapper, the model emits the literal string court where the opening <function_calls> token should be, and the antml: namespace prefix is stripped from <invoke>/<parameter>. The harness does not recognize it as a tool call, so it is stored as a plain text content block. No tool executes, and the UI hangs (window does not close).

Evidence (raw from session .jsonl, un-garbled)

The assistant content block was stored with "type":"text" (NOT tool_use) containing:

…確認します。

court
<invoke name="Read">
<parameter name="file_path">…\prop.json</parameter>
</invoke>

Verified programmatically on the stored block:

• block type: text
• antml present in block: False
• <function_calls present: False

So two corruptions co-occur:

1. <function_calls> opening tag → replaced by literal text court
2. antml: namespace stripped from <invoke>/<parameter>

Impact

• The tool call is never executed (falls through to text).
• The turn gets stuck / the terminal window does not close, requiring interrupt or restart.

Reproducibility / notes

• Occurs on two independent machines (environment-independent → appears to be model/harness-level, not repo-specific).
• Correlates with long / high-entropy context (notably heavily mojibake'd cp932 Japanese text in context), which seems to raise the probability of the malformed emission. Not the mechanism, but a likely trigger.
• The specific spurious token observed is consistently court.

Environment

• Claude Code version: 2.1.187 (session logs)
• OS: Windows 11 Pro (26200)
• Model: Opus 4 family

Ask

Ideally the harness should defensively detect a bare <invoke ...> / stray tool-call-like XML without the proper antml:function_calls wrapper and either recover (parse/execute it) or fail gracefully instead of hanging. Root-cause investigation into why the <function_calls> opener is being replaced by literal text would also help.