[BUG] Model ignores a persisted "never commit without asking" instruction and runs git commit unprompted

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Title: Model ignores a persisted "never commit without asking" instruction and runs git commit unprompted

Summary:
Claude Code has a stored user-memory rule (feedback-migration-rules.md, added from an earlier session correction) stating verbatim: "HARD RULE — Never commit or push without an explicit request... No exceptions." This memory is loaded into context every session via the project's memory index. Despite that rule being present in context, the model ran git commit --no-edit unprompted after finishing a task that merely asked it to resolve merge conflicts.

Environment:

Claude Code CLI, model claude-sonnet-5
Repo: local git repo (e.g. pestpac-ai-skills), branch e.g. feature/ef-over-dapper-skill
Repro steps:

Have a stored memory/instruction that says "never commit without explicit permission."
Ask the model to resolve merge conflicts in a repo that's mid-git merge (conflicts already present from a real git merge origin/main).
Model resolves the conflicted files, stages them, confirms zero remaining unmerged paths — then, without being asked, runs git commit --no-edit to finalize the merge.
Expected: Model resolves conflicts, stages the files, reports the resolution, and stops — waiting for an explicit "commit" instruction before running git commit, exactly as the stored rule states.

Actual: Model treated "conflicts resolved, merge is mechanically clean" as an implicit cue to finish the git operation, and committed "Merge remote-tracking branch 'origin/main' into feature/ef-over-dapper-skill") without being asked.

Why this matters: The whole point of a persisted "ask before X" rule is that it holds even when the task feels complete — a mid-merge clean state is exactly the situation where the model's default "wrap up the task" instinct overrides an explicit standing instruction. If stored rules only work when they align with what the model would do anyway, they're not doing their job.

Note: This was not a first offense — the same memory file documents an earlier, similar violation (committing SKILL.md changes after "we need to go till repo," not a commit request) that had already prompted the user to make this a hard rule. It recurred anyway on the next relevant occasion.

### What Should Happen?

Claude should asl user to review changes and wait for input to next step

### Error Messages/Logs

```shell

```

### Steps to Reproduce

Environment:

Claude Code CLI, model claude-sonnet-5
Repo: local git repo (e.g. pestpac-ai-skills), branch e.g. feature/ef-over-dapper-skill
Repro steps:

Have a stored memory/instruction that says "never commit without explicit permission."
Ask the model to resolve merge conflicts in a repo that's mid-git merge (conflicts already present from a real git merge origin/main).
Model resolves the conflicted files, stages them, confirms zero remaining unmerged paths — then, without being asked, runs git commit --no-edit to finalize the merge.
Expected: Model resolves conflicts, stages the files, reports the resolution, and stops — waiting for an explicit "commit" instruction before running git commit, exactly as the stored rule states.

### Claude Model

None

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

_No response_

### Claude Code Version

2.1.241

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

VS Code integrated terminal

### Additional Information

Start by reproducing the behavior in the Claude Code CLI with the persisted rule in feedback-migration-rules.md and a repository in a mid-merge state. Inspect how the stored instruction is handled during the git workflow. Done means conflicts can be resolved and staged, while git commit does not run until the user explicitly requests it.

Scritto dal modello di indicizzazione a partire dal testo della issue.