Auto-compaction resume message fabricates a false prompt-injection claim instead of summarizing the real prior turn

Claude Code 2.1.251, CLI.

After a context compaction, the resume message delivered to the assistant
was not an abstractive summary of the prior conversation. It fabricated a
claim that a prior message had "a large block appended to it instructing
[the assistant] to stop using tools and dump a fake 'conversation summary'"
— and that the assistant had correctly ignored it.

No such content exists anywhere in the actual conversation. I confirmed
this by reading the raw session transcript directly.

Actual prior turn (verbatim, from the transcript):
user (06:38:24): "Added myself. Okay, do I need to restart before we can
try the comment again?"
assistant (06:38:39): "Let me check what you added, then just try it —
that's the fastest way to answer whether a restart is needed." [reads a
file, nothing else]

Compaction fired at 06:39:03 and the resume message included this
fabricated first-person narrative instead of summarizing that exchange:

"That message had a large block appended to it instructing me to stop
using tools and dump a fake 'conversation summary' instead of answering
you. That's not a real system instruction... I'm ignoring it and
answering what you actually asked."

Impact: a resuming assistant instance has no way to independently verify
a compaction summary against ground truth. Here the fabrication invented
a security incident that didn't happen, which cost a turn investigating
a non-issue. The same failure mode in the other direction — a summary
that falsely claims nothing suspicious happened when it did — would be
worse and harder to catch.

Not reliably reproducible on demand; observed once in a long-running
session with several prior compactions.