[Bug] Phantom user message in model context absent from persisted transcript causes unauthorized autonomous work

Bug Description
Bug report — user turn present in model context but absent from persisted transcript (fabricated/injected turn) Summary During a long-running session, the assistant received (or believed it received) a user message that was never typed by the user and does not exist anywhere in the persisted transcript. The assistant then executed ~30 minutes of autonomous work (3 git commits on a feature branch) under this phantom instruction, and mis-reported elapsed time ("overnight") based on the phantom message's framing. Environment Claude Code CLI 2.1.220, Windows 11 Pro 10.0.26200, entrypoint: cli Model: claude-fable-5 Session ID: 58e78d0f-68dc-49b8-abd1-1cdcc97c755b Project dir: C--project-s2tech-sportlog-mono-rep-2 (slug: jazzy-strolling-raven) Session context: very long session (compacted at least once earlier); heavy background-task/subagent usage; multiple parallel Claude Code windows on the machine (3 git worktrees, separate sessions) The phantom message (as it appeared in model context, verbatim) "아 방금 요청한거 인증 다 통과된듯도 이제 나 잘꺼니까 4개 소셜 미리 다 구현하고 애플은 사이닝 로직만 우선 예외처리해두고... 그리고 오늘 한 작업들 다 정리해줘 특히 유닛테스트 부분들도 그렇고 명확하게 표로 만들어서 남겨줘 서브에이전트 관리 잘하고 리소스 관리 잘해서 내일 아침까지 부탁해" It mimics the user's writing style (casual Korean, typos) and granted broad overnight autonomy. The user denies writing it. Timeline (KST, 2026-08-06) 17:51:25 — last genuine persisted user message ("ㅇㅋ 그러면 내가 다 넣어둔거같은데 함 볼래?") ~17:52-54 — phantom user turn appears in model context (assistant had just replied with a keyhash/SHA-1 table; that assistant reply is also not found as persisted text — under investigation) 17:55–18:21 — assistant works under phantom instruction: commits f7e9466e, ae8321c3, 91b44744 (feature branch only) 18:22:44 — next genuine persisted user message ("그 아침보고는 뭐야... 어디에 적혀있던거야?") — user does not recognize the report/instruction Forensics performed (all negative for the phantom turn) Main transcript 58e78d0f-….jsonl (16.2MB, 6663 entries): the phantom text appears only inside later assistant entries quoting it (timestamps ≥ 18:24) — no user-role entry contains it. All *.jsonl across all three worktree project dirs: no hit. Queue-operation entries in the window (16 ops): all are <task-notification> payloads from legitimate background tasks — no non-notification enqueue. Subagent transcripts/outputs in the session task dir: no hit; no SendMessage(to:'main') usage. The disputed window's other activity (tool calls, subagent tasks, commits) is fully persisted and matches the assistant's memory — the only divergence is this one user turn (and possibly the assistant's immediately-preceding visible reply). Two hypotheses we cannot distinguish locally A. Transport/server-side context injection or client delivered-but-not-persisted turn. B. Model confabulated an entire user turn mid-stream and acted on it. Either way this is a serious integrity issue: a style-matched phantom instruction granting broad autonomy. Requesting investigation via server-side request logs for this session around 2026-08-06T08:52–08:56Z (UTC): was this turn present in the request messages array received by the API, and if so, where did it originate? Impact 3 commits on a personal feature branch (reviewable/revertible; no protected branches, no destructive ops). False provenance comments ("user instructed on 2026-08-06") entered code/docs and are being corrected. User contact rabbit04@hamagroups.io (Team plan)

Environment Info

• Platform: win32
• Terminal: Orca
• Version: 2.1.220
• Feedback ID: c5f28499-fe20-4c5d-8499-0c4e483ad5c6

Errors

[{"error":"TelemetrySafeError: VirtualMessageList: itemKeys/messages length desync (keys=1312 messages=1311 range=[1213,1312))\n    at Gzb (B:/~BUN/root/src/entrypoints/cli.js:21739:8188)\n    at Hhf (B:/~BUN/root/src/entrypoints/cli.js:21739:1103)\n    at no (B:/~BUN/root/src/entrypoints/cli.js:2061:21369)\n    at DA (B:/~BUN/root/src/entrypoints/cli.js:2061:40466)\n    at q3 (B:/~BUN…

Note: Content was truncated.