Assistant response ends with a leaked fragment that predicts the user's next message

Bug description

An assistant response ended with a stray fragment of text that appears to be a leaked prediction of the user's next turn. The fragment was rendered in the UI as if it were part of the assistant's message (shown as an indented/code-block line at the very end of the response).

The leaked fragment was:

な os korenagai simasu

This looks like a garbled romaji rendering of a short Japanese reply the user might plausibly have sent next (e.g. "直しお願いします"). It was not part of the intended response content.

The user reports this has happened more than once in long-running sessions.

Evidence

Confirmed via the local session transcript (.jsonl): the first occurrence of the fragment is inside an assistant-role message, not a user message.

• Session ID: a61cf6e8-5fc3-43e5-a14c-2bf116e9792a
• Message ID: msg_011CeaBBym5dqVk77fzCtyUo (first occurrence at 2026-08-31T04:13:14.607Z)
• Request ID: req_011CeaBBtankni5Xj7tTEYPt
• Model: claude-fable-5
• Claude Code version: 2.1.247
• Entrypoint: claude-desktop (Windows 11, project on WSL UNC path)
• Session context size at the time: ~760k cached input tokens (very long session)

Expected behavior

The response should end at the end of the assistant's own turn; predicted user-turn fragments should never be emitted into the visible response.

Additional confusion caused

When the assistant later inspected its own conversation history, the leaked fragment appeared attached to the user's message in the conversation view, which led the assistant to incorrectly deny authorship twice until the raw transcript was checked. So the turn-attribution of the leaked text also seems inconsistent between the transcript (assistant role) and the rendered/served conversation view.