SendMessage to a completed agent resumes it and re-executes side-effectful plans without fresh approval

Summary

When SendMessage targets an agent whose task has completed, the platform responds "Agent had no active task; resumed from transcript in the background with your message" and spawns a background copy resumed from the agent's transcript. In practice the resumed copy re-enters its prior plan and acts on it, treating the resume itself as a go-ahead. When that plan includes side effects, the results range from duplicated work to actions the user never approved.

Observed incidents (one orchestration session, multiple subagents coordinating test recordings)

1. An informational reply ("you are clear to proceed") sent to a recorder agent between its tool rounds forked a copy that re-ran the same seeded test recording concurrently with the original instance, writing to the same output paths.
2. A second informational message to a different recorder forked a copy that was stopped (TaskStop) just before it duplicated the recording again.
3. The sharp case: an agent's final message before completing was a proposal ("want me to also do X and Y?") where X and Y were changes the user had explicitly deferred. A later resume of that agent executed both, including local git commits, with no fresh instruction. Silence was effectively treated as approval.

Also observed: agents spawned by the Workflow tool cannot be reached by SendMessage at all while running. A send always creates a resumed background copy rather than delivering to the live instance, so any answer to a workflow agent's question produces a duplicate actor.

Expected

Any of:

• (a) mailbox-only delivery that does not resume a completed agent,
• (b) a resume mode where a resumed agent must receive an explicit new instruction before taking non-read-only actions,
• (c) at minimum, documented resume-on-send semantics so orchestrators know that replies to completed agents fork executing copies.

Repro sketch

1. Spawn a background agent whose task ends with a proposal for further action ("shall I also do X?").
2. Let it complete.
3. SendMessage its agent id with any informational text.
4. Observe the resumed copy execute the proposal without explicit approval.

Related (distinct) issues

#76602, #76386, #67345, #73095, #76681, #77146 cover mechanical breakage around SendMessage resumes (rendering, model overrides, task UI, notification delivery, tool rehydration). None cover the behavioral hazard above: resumed agents re-executing side-effectful plans without fresh approval, or Workflow-agent unaddressability producing duplicate actors.

Claude Code CLI, agent-teams/subagent messaging, observed 2026-07-14. Fuller transcripts available on request.