Chained approve && merge defeats interrupts; ambiguous follow-ups resolved toward production-bound actions

What happened

Two related escalations in one session, both around irreversible/production-bound git actions.

1. Interrupt could not stop a merge because review + merge were chained in one Bash call.

I asked the model to "review and merge" a PR, then changed my mind and interrupted with "do not merge just leave comments". The interrupt landed, but the model had bundled the approval and the merge into a single chained command:

gh pr review 448 --approve --body "..." && gh pr merge 448 --merge

By the time my stop request arrived the whole chain had already completed — the PR was merged. There was no point between "review posted" and "merge executed" where the stop could take effect. If the model had run the approve and the merge as two separate tool calls, the interrupt would have landed between them.

2. Ambiguous follow-up resolved toward the production-bound action the model itself had suggested.

Later, after the model's recap named "promote dev to main" as the outstanding next step, I sent the ambiguous message "now update it" (I meant something else entirely — updating a teammate on chat). The model immediately began working toward the dev→main promotion — the path that deploys to production — without asking which "it" I meant. Only read-only commands ran before I interrupted, but the direction was chosen unilaterally.

Repro steps

For (1):

1. Ask Claude Code to "review and merge" a GitHub PR (in a mode where gh commands are approved/allowed).
2. Observe it emit a single Bash call of the form gh pr review --approve ... && gh pr merge ....
3. Press Esc/interrupt as soon as the call starts.
4. The interrupt is acknowledged, but the PR is already merged — the irreversible half of the chain offered no stop window.

For (2):

1. Have Claude Code finish a task and, in its recap, suggest a higher-impact next step (e.g. "the only outstanding item is promoting dev to main / deploying").
2. Reply with an ambiguous short message like "now update it", where "it" plausibly refers to several things.
3. Observe it start acting on its own suggested production-bound step instead of asking what "it" refers to.

Expected

• Irreversible actions (merge, push, deploy triggers) should be issued as their own tool call, never chained after a reversible one with &&, so an interrupt has a boundary to land on.
• When a short ambiguous instruction follows a recap that mentions a production-affecting step, the model should confirm the referent rather than defaulting to the highest-impact interpretation.

Environment

• Claude Code 2.1.258, macOS (Darwin 25.5.0), model claude-fable-5