Plan mode indicator shows on, but Edit/Write still execute — no bypass involved, no defaultMode set

Environment

• Claude Code version: 2.1.119
• OS: macOS, Darwin 24.0.0 (arm64)
• Install path: ~/.local/share/claude/versions/2.1.119
• Launch: plain claude (no CLI flags, no shell alias, no CLAUDE_* env vars that force a mode)

Behavior

Plan mode indicator reads green plan mode on in the status line. Despite this, the main loop continues to execute Edit / Write tool calls — the permission system does not block them, no approval prompt is shown, and the ExitPlanMode / AskUserQuestion artifact UIs render as plain text rather than their approval/picker surfaces.

A screenshot confirmed: a code diff (red/green) was visibly applied in the terminal while the plan-mode indicator was active.

Not related to #40623

The session has never entered bypassPermissions mode during its lifetime. The known bug where switching from bypass → plan leaves bypass silently active does not apply here.

Settings / environment ruled out

~/.claude/settings.json relevant keys:

• No permissions.defaultMode set (we previously had it set to an auto-accept value, then to "default", then removed entirely — behavior persisted until full removal, but the bug has recurred in a later session even with the key absent from the start).
• "skipAutoPermissionPrompt": true (the "don't re-ask about setting auto as default" flag) — benign, unrelated.
• "skipDangerousModePermissionPrompt": true was present; has been removed this session. Bug reproduces with or without it.

Other vectors ruled out:

• No hooks manipulate permission modes.
• No --permission-mode or --dangerously-skip-permissions flag in use.
• No shell alias for claude.
• No CLAUDE_PERMISSION_MODE / CLAUDE_AUTO_APPROVE env var set.

Reproduction

1. Launch claude in a project directory.
2. Enter plan mode via Shift+Tab. Indicator turns green, reads plan mode on.
3. Ask Claude to perform an edit (e.g. "add a line to README.md").
4. Observed: the Edit tool call executes. No approval prompt. No plan artifact. No AskUserQuestion picker.

Happens across multiple projects and fresh sessions.

Additional notes

• Multiple concurrent claude processes running on the machine (5 terminals). Unclear if mode state leaks between sessions.
• When permissions.defaultMode had previously been set, changing its value to "default" did NOT restore normal behavior — only removing the key entirely did. That sticky behavior may be related.

Requested

• Confirmation that plan mode is expected to gate Edit/Write/Bash even when skipDangerousModePermissionPrompt is set and when defaultMode has ever been configured historically.
• Clarification of exactly which settings / history states can cause plan mode to silently not enforce while the indicator reads green.
• Fix for the sticky behavior and the indicator-vs-actual-state mismatch.