bypassPermissions silently downgraded to Manual in daemon sessions; detach/re-attach strips bypass from an interactive session

Environment: Claude Code v2.1.217, Windows 11 Pro (build 26200), native install, elevated terminal (VS Code integrated terminal + standalone PowerShell), Max plan.

Summary: Two symptoms of what looks like the same background-session permission gate: (1) every daemon-dispatched session lands in Manual (default) mode even though its spawn args request bypass; (2) an interactive session that starts in bypassPermissions loses it permanently after a round-trip through the agent view.

Repro 1 — dispatched sessions never get bypass

1. permissions.defaultMode: "bypassPermissions" set in BOTH user (~/.claude/settings.json) and project (.claude/settings.json) settings; bypass disclaimer accepted (dialog shown and accepted; skipDangerousModePermissionPrompt: true written to user settings).
2. Dispatch a session from the agent view, or run:

claude --bg --dangerously-skip-permissions "test"

1. The daemon roster (~/.claude/daemon/roster.json) shows the worker spawned WITH the bypass flag (--permission-mode bypassPermissions, or the explicit --dangerously-skip-permissions for the --bg case), but the session transcript records "permissionMode":"default" and every edit prompts for approval ("manual mode on").

Repro 2 — interactive session loses bypass on detach

1. claude --remote-control --dangerously-skip-permissions → session starts in bypass and works with no prompts.
2. Open the agent list, open another session, then return to the first session.
3. It now shows "manual mode on", and Shift+Tab no longer offers bypass in the mode cycle.

Ruled out

• Managed-settings policy — no managed-settings.json exists on the machine.
• Stale daemon env — reproduced after 2 clean daemon restarts (claude daemon stop --any from a fresh elevated terminal, relaunch from a clean shell).
• Missing disclaimer acceptance — removed skipDangerousModePermissionPrompt, relaunched, dialog re-shown and re-accepted, key rewritten; behavior unchanged.
• Settings layering — defaultMode present at user AND project level.

Expected

Per the permission-modes and agent-view docs: with the disclaimer accepted, background sessions honor bypassPermissions from spawn flags / defaultMode, and an interactive bypass session keeps its mode across detach/re-attach.