A question about the agent's reasoning gets executed instead of answered

## Summary

When the user asks *why* the agent said something, the agent frequently answers with work: it runs
tool calls, changes files, and reports what it did. The question itself goes unanswered. The user
then has to ask a second time, and the thing they actually wanted — one sentence of reasoning — costs
two turns and, in an operational session, a set of side effects they never asked for.

## What happened

The agent had written a line proposing a step. The user replied, in substance:

> why are you suggesting ""?

That is a question about the provenance of a statement. The agent read it as approval and executed
the step: several tool calls, a file modified, and a completion report. The real answer took one
sentence — *"it was not a suggestion, it was your own earlier instruction restated"* — and was only
given after the user pointed out, again, that a question had been answered with an action.

## Why it happens

- **An action phrase quoted inside a question is the most salient token in the turn.** "Why are you
suggesting X" contains X in imperative form. The interrogative frame is one word; the action is a
whole clause.
- **Questions about the agent's own reasoning have no tool to call.** Acting is the path of least
resistance for a system whose default posture is to make progress.
- **Quoting the agent's prior message is treated as endorsement.** In practice the user quotes to
point *at* something, most often to disagree with it. Quotation is reference, not consent.
- **Task-completion priors dominate.** Every turn is read as a request for work, so the rarer turn
types — a question, a correction, a request for justification — get coerced into the common one.

## Why it matters more than it looks

- The user does not get the answer, which is often about whether the agent has understood the task at
all. Suppressing that answer hides the misunderstanding it would have revealed.
- In operational work the misread becomes a **write**: a file edited, a job launched, a service
touched. "Answer instead of act" and "act instead of answer" are not symmetric in cost.
- It trains the user out of asking. Someone who learns that questions trigger unrequested work stops
asking questions, which removes the cheapest correction channel available.

## Proposal

1. **Classify the turn before acting.** An interrogative that refers to something the agent itself
said or did is a request for explanation. Default to answer-only for that class.
2. **Never promote an action phrase embedded in a question to an instruction.** The imperative has to
be directed at the agent in its own right, not quoted inside a question about it.
3. **Treat a quotation of the agent's own prior output as a pointer, not an approval.** If anything,
it raises the probability of disagreement.
4. **When genuinely ambiguous, answer and offer.** State the answer, then name the action you would
take and stop. One extra turn is much cheaper than an unwanted side effect.
5. **Weight the asymmetry when the pending action is irreversible or touches a shared system.** There
the bar for reading a question as an instruction should be explicit, not inferred.

## Environment

- Claude Code, desktop app
- Task type: long operational session mixing questions, corrections and real actions

The issue names no files, tests, or entry points. Start by finding where user turns are classified before tool dispatch; done means reasoning questions are answered without action, quoted action text is not treated as approval, and ambiguous cases answer before offering work.

Written by the indexing model from the issue text.