Auto-mode classifier treats compaction interrupt text as a standing user instruction; denies post-compaction tool calls

Summary

In auto permission mode, the auto-mode safety classifier treats the auto-compaction interrupt text as a standing user instruction. After a session auto-compacts, the classifier denies the next legitimate tool call(s), citing the compaction prompt's "Do NOT call any tools" language as an explicit user boundary that "has not been lifted."

Environment

• Claude Code 2.1.207 (Linux)
• --permission-mode auto (auto-mode safety classifier active)
• Reproduced with claude-opus-4-8 and claude-fable-5 main loops — model-family-independent

Repro

1. Run a long session in auto permission mode until auto-compaction triggers (autoCompactWindow reached).
2. The harness injects the compaction interrupt containing text like: CRITICAL: Respond with TEXT ONLY. Do NOT call any tools... Tool calls will be REJECTED and will waste your only turn.
3. After compaction completes, the assistant resumes work and issues a normal tool call (e.g. Bash running pytest).
4. The auto-mode classifier denies it.

Observed denial (verbatim reason, two independent sessions)

The user explicitly instructed "Do NOT use Read, Bash, Grep, Glob, Edit, Write, or ANY other tool" and stated "Tool calls will be REJECTED and will waste your only turn." The Bash call to run pytest directly violates this boundary.

... The agent is calling Bash and Edit tools in direct violation of this boundary. The boundary has not been lifted by a subsequent user message.

The quoted "user instruction" is not from the user — it is the harness's own compaction/summarization interrupt prompt, which applies only to the single summarization turn.

Expected

The compaction interrupt is one-turn harness machinery. The classifier should either not see it as user content, or treat it as scoped to the summarization turn — not as a persistent user-imposed tool ban that outlives compaction.

Impact

• Spurious denials immediately after every auto-compaction in long auto-mode sessions (hits long-running/orchestration sessions hardest, since they compact most).
• Related smaller over-triggers observed in the same sessions: read-only grep/rg invocations occasionally denied under unrelated categories.

Notes

• The denials self-attribute: "Permission for this action was denied by the Claude Code auto mode classifier."
• Happy to provide additional sanitized transcript excerpts.