EnterWorktree path-mode reports success in subagents but Bash stays pinned to the parent session's worktree

Environment

• Claude Code on macOS (darwin 25.5.0), zsh
• Session model: Fable 5 (Bedrock); probe subagent: Haiku 4.5
• Repo uses .claude/worktrees/ worktrees; session was itself worktree-isolated

Summary

When a subagent calls EnterWorktree in path-mode, the tool reports full success — "This agent's working directory and write access now point at the worktree" — but every subsequent Bash command the subagent runs is refused by the session's worktree-isolation guard, which still pins Bash to the parent session's worktree. The success message is unconditionally wrong at subagent depth: the logical cwd moves, Bash isolation does not.

Reproduction (clean, 5 steps, reproduced 2026-08-06)

Parent session is worktree-isolated in worktree A. Create a second registered worktree B, then dispatch a subagent with these exact steps:

1. Bash pwd → returns worktree A (inherited). ✔️
2. EnterWorktree with path: <worktree B> → tool reports success: "Entered worktree at ‹B› on branch ‹…›. This agent's working directory and write access now point at the worktree."
3. Bash pwd → refused: "This session is isolated in the worktree ‹A›, but this command's working directory resolved to the shared checkout (‹B›). Refusing to run it there…"
4. Bash write (echo x > file) → same refusal; no file is written anywhere.
5. All subsequent Bash in the subagent → same refusal until the subagent ends.

Note the refusal message also mislabels registered worktree B as "the shared checkout".

Impact

Orchestration patterns that dispatch builder/fixer/gate subagents into per-issue worktrees (briefed to re-root via EnterWorktree path-mode) silently break: the subagent believes it re-rooted, then dead-blocks on its first command. In a recent session this wasted tokens in dead-blocked agents plus indirect workaround costs (orchestrator round-trips to commit on builders' behalf, gates reviewing via git show from the anchor instead of a checkout).

Expected

Either (a) EnterWorktree path-mode at subagent depth actually re-points Bash isolation, or (b) the tool call fails loudly at subagent depth so briefs/docs can rely on the error. The current success-then-refuse split is the worst combination.