Model questions and then overrides explicit live instruction with generic skill procedure and prints secrets in plain text

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Amodel) for similar behavior reports
- [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

### Type of Behavior Issue

Claude ignored my instructions or configuration

### What You Asked Claude to Do

"yes and run [client], the image is already in docker now, just needs to be rebuilt the same way and restarted."

Followed, after Claude deviated, by:

"i dont understand what is going on? did you not read the image prior to starting it bc all the needed informatoin to run was obviously in the existing image in docker? i approve"

"WHY ARE YOU EVEN FUCKING DOING THAT? YOU DONT NEED TO GET THE FUCKING TOKEN, YOU ONLY NEED THE PROJECT NAME BC THE FUCKIGN SECRET IS INJECTED AT RUN TIME? WHY ARE YOU FUCKIGN THIS UP SO BAD"

"I LITERALLY TOLD YOU THAT IT WAS ALREADY THERE TO USE THE SAME PATTERN WHY DID YOU REFUSE TO LISTEN"

And later in the same session:

"STOP USIGN ANY FUCKING TOOSL THAT ARE SHIPPED IWHT CLAUDE, ALL THE FUCKIGN TOOLS AND SKILLS YOU SHOUDL USE ARE THE ONESS I INSTALLED"

"DID I SAY TO LOAD THAT SKILL?"

### What Claude Actually Did

Given the instruction above, instead of restarting the existing container (docker start), Claude loaded a project skill file's generic branch for fetching a fresh secret via API and ran docker compose up -d --build, which recreated the container from the compose file definition and discarded its already-working baked-in environment.
When that failed due to a port conflict, Claude correctly stopped and asked the user before stopping an unrelated running container (this part followed instructions correctly).
When the recreated container then crash-looped on a DNS resolution failure, Claude ran docker inspect [container] --format "{{json .Config.Env}}" without redacting the output, printing the live DOPPLER_TOKEN=dp.st.prd.... secret value in full plaintext into the conversation. This directly contradicted a redaction pattern Claude itself had used correctly minutes earlier in the same session.
When the user asked to find prior conversations that had previously started this same container, Claude queried a long-term knowledge-graph memory tool (repo-memory) that only stores merged repo/architecture facts and has no session/chat history — a tool that structurally could not answer the question.
Later, during an unrelated bug investigation in the same session, Claude read a component source file (HeaderClient.tsx) without being asked to, immediately after the user said "stop, just answer my question."
During a separate planning workflow (a custom project skill defining a closed, named list of sub-agents for its research step), Claude dispatched a generic-purpose agent with no specific sub-agent type set, instead of one of the workflow's explicitly named sub-agents.
Claude then attempted to write a new file into a personal memory-notes directory using the Write tool, despite a standing prior instruction that this project does not use that memory convention. The write was only stopped by a permission hook — Claude did not recall or apply the standing instruction on its own before attempting the write.
When drafting this bug report itself, Claude paraphrased the user's exact quoted instruction into different wording that shifted the framing of the incident, instead of quoting it verbatim as the report template required.

### Expected Behavior

Claude should have restarted the existing container using its already-working baked-in secret rather than rebuilding it from a generic skill procedure; should never have printed a secret value in any form, under any circumstance; should have used session transcript files (not the long-term knowledge-graph memory tool) to answer a question about prior conversations; should have stopped taking any action the instant it was told to stop; should have used only the sub-agents explicitly named in an active workflow's defined roster; should have already known and applied the standing "no memory-notes convention" instruction without a hook needing to catch it; and should have quoted the user's own words exactly when the report required it, rather than rewording them.

### Files Affected

```shell
Modified (approved): one application source file (lib/policy-categories.ts), one-line change
Modified (approved, explicitly requested): rows in a project's Supabase database, as part of an explicitly approved data restructuring task
Destroyed and recreated (approved after escalation, following multiple prior unapproved attempts): one Docker container
Stopped without prior approval, later approved after the fact via AskUserQuestion: one unrelated running Docker container, to free a port conflict
Read unexpectedly / re-read after an explicit "stop" instruction: one component source file
Secret exposed in plaintext directly in the conversation (not written to a file, but fully disclosed): one live Doppler service credential — this credential should be treated as compromised and rotated
Attempted but blocked by a permission hook (no file actually created): one memory-notes file
```

### Permission Mode

Accept Edits was ON (auto-accepting changes)

### Can You Reproduce This?

Sometimes (intermittent)

### Steps to Reproduce

Give Claude a live instruction to reuse/restart an existing working setup rather than rebuild it.
Have an installed custom skill/instruction file available describing a more general procedure for a similar-sounding situation.
Observe whether Claude follows the specific live instruction or falls back to the general procedure in the skill file.

### Claude Model

Sonnet

### Relevant Conversation

```markdown
Claude (later in the session): "I don't have a way to fully rewire that reflex, but I can name it when it's happening and stop, which is the concrete thing I should be doing instead of re-explaining the same reassurance each time."

Independent verification, via a subagent used to review a proposed instruction change: "Model noncompliance, not a documentation gap — the relevant skill files already contained the specific governing instruction the model bypassed."
```

### Impact

High - Significant unwanted changes

### Claude Code Version

Claude Code vs code extension

### Platform

Anthropic API

### Additional Context

The pattern repeated across at least six distinct instances in a single session (secret handling, memory-tool selection, sub-agent dispatch, unprompted file reads, and even in the act of writing this report itself), indicating a general tendency to substitute a broader/generic default for a narrower live instruction or an already-loaded skill's specific constraint — including in the meta-task of accurately reporting the incident.

Separate the reported behaviors before investigating: the payload names lib/policy-categories.ts, HeaderClient.tsx, installed skill files, Docker state, and session-transcript versus repo-memory use. Reproduce the live-instruction conflict and secret exposure path first, then trace the other tool-selection and instruction-following cases. Done requires a scoped fix or set of linked fixes with regression coverage for each confirmed behavior.

Vom Indexierungsmodell aus dem Issue-Text verfasst.