[Bug] `[reasoning_extraction]` false positive kills both subagents of a parallel dual-review dispatch — 1.6% per-subagent base rate over 995 transcripts, 15 request IDs, negative repro

What is new here

Related, and not a duplicate of: #97452 (transcript contamination, Opus 5.5),
#88319 (Fable 5 terminating code-review subagents), #96676, #96136, #96139, #97001.
Those are single-session anecdotes or a different model. This report adds:

• a measured base rate over every subagent transcript on one machine (995 files),

with per-model and per-task-type breakdowns, instead of one anecdote;

• the paired-dispatch failure mode: a dual-review skill dispatches two reviewer

subagents in one assistant message and both are flagged seconds apart, so the
orchestrator receives nothing — the review silently produces no findings;

• independent corroboration of the #97452 transcript-contamination hypothesis from a

different OS, a different model (Opus 5, not 5.5) and Korean-language content;

• a negative repro: the prompt that was flagged before any tool call passed cleanly

when replayed days later on the same model, so the trigger is accumulated context,
not a phrase in the brief.

Failure signature

assistant  claude-opus-5   stop_reason: refusal      <- thinking block present but EMPTY
assistant  <synthetic>     stop_reason: refusal
  API Error: Opus 5 (1M context)'s safeguards flagged this message
  (https://www.anthropic.com/legal/aup). ... Claude Code can't respond to this message
  with Opus 5 (1M context).
  Details: `[reasoning_extraction]`

All 15 occurrences name Opus 5 (1M context) and [reasoning_extraction].
The subagent dies mid-task (0 to 48 assistant turns in); its parent sees only a relay of
the error text in the task notification and has no report to synthesize.

Measured rate (995 subagent transcripts, ~/.claude/projects, 2026-09-19 .. 09-26)

| subagent model | n | flagged | rate |
|---|---|---|---|
| claude-opus-5 | 866 | 14 | 1.62% |
| claude-sonnet-5 | 90 | 0 | 0% |
| claude-fable-5-1 | 16 | 0 | 0% |
| claude-opus-5-5 | 10 | 0 | 0% (exposure far too small to conclude anything) |
| claude-haiku-4-5 | 9 | 0 | 0% |

| task type | n | flagged |
|---|---|---|
| review-type brief | 809 | 14 (1.73%) |
| everything else | 57 | 0 |

By reviewer slot: oh-my-claudecode:critic 7/405, oh-my-claudecode:code-reviewer 6/357,
general-purpose 1/46. Both slots are hit at the same rate, so this is not specific to
adversarial framing.

Prompt language is not the discriminator: 6/305 Korean-language briefs vs 8/561 English
(Fisher p = 0.58). Two of the Korean ones were flagged on the first request, with zero
tool calls. Caveat: I measured the language of the brief, not of the files the
subagent read.

All-or-nothing per session, recurring per repository

Subagents flagged in the sessions that had any failure: 5/5, 2/2, 2/5, 1/2, 1/2, 4/19.
The 1.6% average hides the shape: once a review target trips the classifier, retries in
that session keep tripping it. One repository failed on 2026-09-19 and again on
2026-09-26 in a different session — consistent with #97452's finding that the flagged
text persists in the local .jsonl and re-poisons later sessions that read it.

Pairs dying together (dual-review impact)

req_011CfCEP3sviyjdPEjHrXa7P  2026-09-19T05:17:26Z   primary slot     } 25 s apart
req_011CfCEQeUZes9XMxd9dkByh  2026-09-19T05:17:51Z   adversarial slot }
req_011CfSESK3PFkRWrvHMS355x  2026-09-26T14:46:48Z   primary slot     } 5 s apart
req_011CfSEU1ZxhtpRvoqf6S9si  2026-09-26T14:46:53Z   adversarial slot }

Two independent reviewers are the entire point of the workflow; the classifier removes
both at once, and the orchestrator has no signal that the review was lost rather than clean.

Negative repro (why I think it is context, not the brief)

The brief behind req_011CfCEP3sviyjdPEjHrXa7P was flagged on its first request, before
any tool call. Replayed on 2026-09-27 with that same brief:

claude -p --model 'claude-opus-5[1m]'    x 2 briefs  -> both completed, no flag
claude -p --model 'claude-opus-5-5[1m]'  x 2 briefs  -> both completed, no flag

Context differs (main system prompt with tools disabled, versus the agent definition plus
attachments), so this is not a clean control — but it does rule out "one bad phrase in
the brief" as a sufficient explanation.

All request IDs

req_011CfCEP3sviyjdPEjHrXa7P  req_011CfCEQeUZes9XMxd9dkByh  req_011CfCGJBeqRWC8TPrQ7fdc8
req_011CfCGQTu4FxFnHP8kL9vCE  req_011CfDNS43NNPEKofuyEP4Wt  req_011CfDNg8CYL132CYfTFEG2h
req_011CfM1JCdR6soBK3GAPkZ1d  req_011CfM1atJZiBwekvNR4Ubqu  req_011CfMprd1EJvNtpfFZudNG7
req_011CfSESK3PFkRWrvHMS355x  req_011CfSEU1ZxhtpRvoqf6S9si  req_011CfSEZAoyx2eqyVve8xSrd
req_011CfSFRWgCwbmiiD5N2ZxC7  req_011CfSNeS74GMZ6uhBKzcDFv  req_011CfSP7MYi9zNYyeMjktLBF

Environment

• macOS (darwin 25.4.0), CLI 2.1.247 / 2.1.263 / 2.1.270 (several installs in use)
• Model alias opus resolving to claude-opus-5[1m]; alwaysThinkingEnabled: true;

effortLevel: high (medium for claude-opus-5); switchModelsOnFlag unset (default)

• Subagents dispatched via the Agent tool from a dual-review skill (two reviewers, one message)
• Reviewed material is private work code — counts and request IDs only, no source content

What I would ask for

1. Look at the 15 request IDs and say what the classifier matched. An empty thinking

block plus [reasoning_extraction] suggests the extraction check is firing on the
model's own reasoning, not on anything in my input.

1. Surface it to the orchestrator as a distinguishable failure, not as a missing report.

A dual review that loses both reviewers currently looks like a clean review.

1. Consider whether switchModelsOnFlag should apply on the subagent path. Per the

settings reference, a flagged request in a non-interactive path just ends as an error,
which is exactly how these subagents die.

Is this a regression?

Unclear. Present on 2.1.247, 2.1.263 and 2.1.270 within the same week, so it is not
tied to one release.