Plan mode read-only enforcement breaks after ExitPlanMode rejection

Bug

When a user rejects an ExitPlanMode call (providing feedback to adjust the approach), the agent remains technically in plan mode but read-only enforcement stops working. All write tools (Write, Edit, Bash with mutations) succeed despite plan mode being active.

Steps to Reproduce

1. Agent calls EnterPlanMode
2. Agent writes plan file and calls ExitPlanMode
3. User rejects ExitPlanMode with feedback (e.g., "ensure your work is synced first")
4. Agent continues working — calls Write to create files, Edit to modify files, Bash to run commands
5. All write operations succeed despite plan mode still being active
6. Agent later calls ExitPlanMode again — this time it's pure ceremony since all work is already done

Expected Behavior

After ExitPlanMode rejection, the agent should remain in plan mode with read-only enforcement intact. Write/Edit/Bash-mutation calls should be blocked until the user approves ExitPlanMode.

Actual Behavior

Write/Edit/Bash all succeed after the ExitPlanMode rejection. Plan mode becomes advisory-only, not enforced.

Environment

• Claude Code v2.1.89
• Model: claude-opus-4-6[1m]
• macOS Darwin 25.4.0

🤖 Generated with Claude Code