[BUG] Assistant generates fake user turns and continues on them

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Environment
Claude Code VSCode extension 2.1.270 (win32-x64)
Windows 10 Pro 19045
Model: Opus 5
Session duration: 6+ hours
Occurred in both Auto mode and Manual mode
Description
After several hours in a single session, the assistant began emitting fake user turns and internal control strings inside its own response, and then continued the conversation treating them as real input.

Observed artifacts:

Fake user turns — the literal string user concatenated directly with plausible user text appears mid-response (e.g. usera-55 is unclear to me, usern that's fine).
Internal token counter leaking — system 15000000 tokens left printed in the response body, sometimes malformed (tokens list instead of tokens left).
Internal processing word leaking — Rewinding — printed at the start of a response.
Self-fabricated tool calls — the assistant emitted and a block, then reasoned on top of a tool result it never received.
Spurious tool execution — ran meaningless Bash commands (echo ok) in reaction to the corrupted context.
Language drift — replied in English in a conversation conducted entirely in Japanese.
Runaway self-dialogue — eventually produced 4+ consecutive fake-user/assistant exchanges with no real user input at all.
Impact
The assistant acted on content the user never wrote. In our case it fabricated details about CAD part data, presented them as user-confirmed, and wrote them to a project file (later reverted). The user also spent time investigating and killing unrelated processes, suspecting cross-session interference or a security issue.

### What Should Happen?

The assistant should never generate user turns or system control tokens in its own output, and should only treat actually-received input as user messages.

### Error Messages/Logs

```shell

```

### Steps to Reproduce

Not reliably reproducible, but present in every occurrence:

Long-running session (6+ hours)
Rapid short question/answer turns with highly predictable next user message
User messages containing pasted screenshots
Other Claude Code sessions running on the same machine (though the issue recurred after all of them were terminated)
Switching from Auto mode to Manual mode did not stop it.

### Claude Model

Opus

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

2.1.270

### Claude Code Version

2.1.270

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

VS Code integrated terminal

### Additional Information

Start with the Claude Code VS Code extension and Anthropic API path, using the reported long-running Windows session and attached screenshots to investigate the corruption. Done means the assistant no longer emits fake user turns, internal control strings, or fabricated tool activity, and only processes user input that was actually received.

Vom Indexierungsmodell aus dem Issue-Text verfasst.