What Survives Compaction

1. Why the instruction was lost:

The instruction was only ever a chat message — it never existed as a file on disk. Auto-compaction works by summarizing older parts of the conversation to free up space in the context window as it fills. A spoken, in-chat instruction is exactly the kind of content compaction summarizes (and potentially drops nuance from, or omits entirely if it wasn't judged important relative to everything else being compacted). Once that turn is gone or reduced to a lossy summary, there is no durable record telling a later turn that legacy_gateway.py is frozen — so when Claude later has a reason to touch it, nothing in its current context stops it.

2. Would a CLAUDE.md placement have helped — and where, exactly?

Yes, but the two locations behave differently, and the difference matters here:

• repo/CLAUDE.md (project root): this file is explicitly re-read from disk and re-injected into context after compaction runs. It's treated as durable, foundational context that's worth restoring every time. Putting the instruction here would have survived the compaction event in this scenario.
• repo/services/payments/CLAUDE.md (nested, in a subdirectory): this is not automatically re-injected after compaction. It's loaded on demand, the next time Claude reads a file that lives under services/payments/. If compaction happens and then Claude's next actions don't happen to trigger a fresh read of that directory before the edit, the nested file's content isn't back in context at the moment the risky edit happens — so even having written the rule down in the nested file doesn't fully guarantee it survives this particular sequence of events, though it's still much better than a chat-only instruction, since the next file read in that directory would reload it.

So: root CLAUDE.md is the more reliable of the two file-based options for something that must hold for the entire session regardless of what triggers reload it. The nested file is good for detail that's only relevant when Claude is actively working in that subtree, but isn't as bulletproof against this specific compaction-timing failure.

3. A more robust fix:

Two complementary fixes, not just "say it again":

• Write it to repo/CLAUDE.md (or, if it should apply to every session going forward rather than just this one, that's exactly the durable-instruction case CLAUDE.md exists for) so it survives compaction and every future session automatically, without relying on the engineer remembering to repeat themselves.
• For something this consequential — a compliance freeze, where a wrong edit has real legal/audit exposure — add a PreToolUse hook that blocks any Edit/Write tool call whose path matches legacy_gateway.py outright, returning a deny decision deterministically. This is the right escalation because the instruction isn't really a stylistic preference the agent should weigh — it's a hard constraint that must hold regardless of how convincingly a later prompt argues for touching that file (e.g., "I need to fix a bug in legacy_gateway.py" from a future engineer who doesn't know about the freeze). CLAUDE.md is advisory context that shapes behavior; a hook is enforced by the client regardless of what Claude decides, which is the guarantee a compliance freeze actually needs. "Reminding Claude again" in chat only resets the clock until the next compaction or long session repeats the exact same failure.