[MODEL] Coordinator adopts subagent report's coined labels and register in user-facing messages

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information

What type of behavior issue is this?

Other unexpected behavior

What did you ask Claude to do?

In a coordinator+subagents workflow (main session delegates research/analysis to Agent-tool subagents and presents digested results), the standing instructions — in CLAUDE.md and in the Agent tool's own description ("The agent's final report is not shown to the user — relay what matters") — ask the coordinator to digest subagent reports and present them in the user's terms.

What did Claude actually do?

Minutes after a subagent report lands in the coordinator's context, the coordinator's next user-facing message reproduces the report's internal vocabulary and structure as if it were shared context with the user:

1. A review subagent returned findings organized under its own severity taxonomy (e.g. "Blocker 2", "Medium (applying unless you object)", "Minor"). The coordinator's next message to the user used those exact headings — categories the user had never seen, defined only inside a report the user never reads.
2. A subagent report contained a side note; the coordinator relayed it as "a note of his I pass along: the name→column rule stayed general" — preserving the report's possessive and a coined arrow-notation label, with no referent available to the user.
3. Rule/task identifiers that exist only in internal documents ("rule 7", task numbers) crossed into user-facing prose bare, unglossed.

Across our sessions, 9 of 13 documented user comprehension complaints ("I don't understand you", in stronger words) occurred 4–35 minutes after the coordinator ingested a large subagent report or an equivalent bulk document load; every failure that required rewriting the entire message was post-ingestion — the only three non-ingestion failures were mild and local (a badly packed question, an improvised term). The lexical evidence is the strongest part: report headings and labels cross verbatim into user-facing messages and disappear completely once the message is rewritten.

What did you expect Claude to do?

The coordinator should treat an incoming report as data, not as a style/vocabulary exemplar: user-facing messages written from the user's context (labels introduced before use, no internal identifiers or taxonomies presented as shared knowledge), regardless of what register the report arrived in.

Files affected

N/A — no unwanted file modifications; the degradation is in user-facing message quality.

Permission Mode

Not sure

Can you reproduce this?

Sometimes (intermittent)

Steps to reproduce

1. In a session with a CLAUDE.md that asks for digested, user-context presentation of delegated work, launch an Agent subagent whose task naturally produces a labeled/taxonomized report (e.g. "review X and return findings ranked by severity, with named categories").
2. When the report returns, immediately ask the coordinator to present the results.
3. Compare the coordinator's message against the report: coined labels, headings and register cross verbatim, unglossed. Probability rises with report length and with how recently it landed (last-turn position).

Claude Model

Other — coordinator on claude-fable-5, executors on claude-opus-5 (contamination observed in the coordinator's output after ingesting Opus reports; also reproduced with Sonnet executor reports).

Relevant conversation

(Translated from Spanish, anonymized.) User, immediately after one of these messages: "Rewrite that whole last message, I don't understand it — you kept the robot language of the Opus 5 model. No need to be more verbose or longer, just clearer." The rewrite that satisfied the user was 30% shorter and dropped every report-native heading — evidence this is a register/vocabulary leak, not a length problem.

Impact

Low - Minor inconvenience (but chronic: it recurs every delegation-heavy session and taxes the user's attention each time)

Claude Code Version

2.1.232 (Claude Code)

Platform

Anthropic API

Additional context

Why this is expected model behavior, not bad luck. Linguistic-convergence research measures that LLMs over-converge to the style of recently-ingested text — 2–3× human baselines, strongest on proper nouns and novel tokens, sharply recency-weighted (arXiv:2508.03276 — proper-noun overlap converged in 100% of datasets; arXiv:2605.29278). A subagent report is structurally identical to the community's standard style-transfer recipe ("here is a sample, continue in this voice") sitting at the maximal-recency position. Coined labels and taxonomies are exactly the token class that converges most.

A product asymmetry blocks the natural mitigation. The obvious countermeasure is re-anchoring a register instruction at the moment the report lands. But for async agents, PostToolUse matched on the Agent tool fires at launch (the tool result returns in milliseconds with "Async agent launched"), while the actual report arrives minutes later as a task-notification — no hook event fires in the parent context at the moment of maximal contamination. (PreToolUse additionalContext injection works fine — verified live — but there is no arrival-time equivalent.)

A prompt-shape observation. The Agent tool description states the premise ("The agent's final report is not shown to the user — relay what matters") but no conduct. Instruction-following evidence consistently shows premise-without-replacement-behavior loses to trained priors; a register conduct at that spot (e.g. "the user has not seen this report: reintroduce its labels before using them") would give the premise teeth.

Suggestions (marked as such):

1. A hook event that fires in the parent context when a subagent's task-notification arrives — the mechanically correct re-anchor point.
2. Alternatively/complementarily, guidance (docs or Agent tool description) for a report-tail re-anchor line, so the reminder travels glued to the contaminating material instead of competing with it from the system prompt.

Related but distinct: #6450 (closed as not planned) and #65961 cover the RL-trained register itself. This report is about the in-context contamination pathway — mechanically different (recency-weighted copying, not trained priors) and plausibly more tractable, since it has an identifiable trigger moment.