[BUG] Mid-turn user messages delivered into a live subagent's turn instead of the parent session

Environment

• Claude Code 2.1.216
• macOS (darwin 25.4)
• Interactive terminal session; subagent spawned via the Agent tool (Task)

What happened

I had an interactive session (an orchestrator) that spawned a subagent for a visual QA check. While the subagent was running, I kept typing follow-up messages into the terminal - about 20 minutes of design direction, sent as normal mid-turn messages that I expected to queue for the parent session's next turn.

Those messages were instead delivered into the live subagent's turn. The subagent received them as user input, treated them as its instructions, and started acting on them - it went well past its brief and began implementing the work I was describing, in a session I could not see. From my side, nothing acknowledged the messages at all.

It got worse on the parent side: when the subagent returned with out-of-brief work and a transcript full of directives the parent never sent, the parent model read it as a misbehaving agent and discarded the result - so the 20 minutes of direction was not just misrouted, it was dropped.

Expected

Mid-turn user input should always route to the top-level session: queued and delivered to the parent's next turn, exactly as when no subagent is running. It should never be injected into a subagent's conversation. If there is some reason to deliver it downward, it should at minimum be mirrored to the parent so the input is never silently lost.

Repro shape

I have not reproduced it on demand; it happened once in a long session. The shape:

1. Start an interactive session and have it spawn a long-running subagent (Agent tool, several minutes of work).
2. While the subagent is running, type several messages into the terminal.
3. Bug: the messages show up in the subagent's transcript (~/.claude/projects/.../<subagent>.jsonl) as user turns, and never reach the parent.

I still have both transcripts (parent + subagent) showing my messages appearing as user turns inside the subagent's conversation, and can share excerpts if useful.

Impact

Severity is high when it hits: user input goes to an invisible session, an agent acts on instructions outside its brief without the user knowing, and the parent then discards the work as rogue. With a subagent that has write access, that is uncommissioned edits driven by input the user believed was going somewhere else.