The Resolution Desk team runs a Customer Support Resolution Agent on the Claude Agent SDK, calling the MCP tools get_customer, lookup_order, process_refund and escalate_to_human. To stop refunds being issued against unverified orders, they added a line to the project CLAUDE.md stating that process_refund must be called only after a successful lookup_order in the same session. Across the next 5,000 sessions, telemetry records 62 sessions in which process_refund was called with no preceding lookup_order call. Which statement best explains that residual failure rate?
- ACLAUDE.md is prompt based guidance that shifts the probability of a behaviour rather than controlling it, so compliance is statistical; a prerequisite that must hold every time needs a PreToolUse hook that inspects the call and blocks it. Correct
- BCLAUDE.md is loaded once at session start, so its text is evicted from the context window as the conversation grows and the constraint stops applying part way through longer disputes.
- CTool call ordering is enforced by the MCP server that publishes the tools, so the 62 sessions indicate that the server lost its per session state and stopped rejecting the out of order calls.
- DThe rule sits at the wrong level of the CLAUDE.md hierarchy, and moving it from the project file to a user level file would make the same wording binding on every session the team runs.
Why A is correct: Correct: instructions in context influence sampling and cannot bound it, whereas a PreToolUse hook runs outside the model and can deny the call deterministically before it reaches the tool.
Why B is wrong: Tempting because attention dilution over long conversations is a real effect, but the failure does not depend on eviction: the instruction is advisory even while fully present in context, so restoring it would not make the ordering binding.
Why C is wrong: Tempting because MCP servers do hold connection state, but the protocol exposes independent tools with no cross tool ordering semantics, so there is no server side sequencing rule that could have lapsed.
Why D is wrong: Tempting because the hierarchy is real and does change which sessions see a file, but scope is not enforcement: the same sentence read from any level remains guidance the model may decline to follow.