Refusal-fallback retry re-executes already-executed background Agent dispatches (duplicate sub-agents)

Version: Claude Code 2.1.220 (Windows 11, VS Code extension)

Summary: When an assistant turn containing serial Agent tool dispatches is interrupted by a model_refusal_fallback event (API safety refusal → fallback model retry), the harness retracts the turn's messages — including Agent tool-use blocks whose spawns already executed — but does not terminate the spawned background agents. The retried turn on the fallback model has no visibility into the orphaned spawns and re-dispatches them, producing duplicate agents running concurrently, including two code-writing agents sharing one git worktree.

Observed sequence (from session transcript, 2026-08-02 UTC):

1. Assistant turn (claude-fable-5) serially dispatches agents 1–5 of a planned 9 (22:59:28–23:00:14Z; spawn acks received).
2. 23:00:15Z: system event model_refusal_fallback (trigger refusal, category cyber, fallback claude-opus-4-8) retracts 12 message uuids — including all five Agent tool-use blocks and their tool-results. The five agents keep running.
3. 23:00:27Z: fallback model resumes with no record of any dispatch and re-dispatches all nine rows.
4. Result: five twin pairs (fresh tool-use ids, independently re-authored prompts). Twin completion notifications arrive under task-ids the post-retraction conversation cannot match. Two pairs shared a git worktree each and interleaved edits for 15–40 minutes (both happened to self-detect and reconcile — outcome was luck, not containment).

Expected: either (a) retraction terminates in-flight spawns from retracted tool calls, or (b) the retried turn is given a record of surviving spawns (e.g., tool-results for already-acknowledged dispatches are preserved), or at minimum (c) orphaned agents' completion notifications are flagged as originating from retracted tool calls.

Impact: duplicate compute/token spend; duplicate deliverable files; concurrent uncoordinated writers in a single git worktree (data-corruption risk); completion notifications that the session cannot attribute.

Repro sketch: hard to trigger deterministically (needs a safety-refusal mid-dispatch-turn), but any mechanism that retries an assistant turn after Agent tool calls have executed should reproduce the orphan-plus-redispatch pattern.