[harness] Agent tool surface: no per-call tool restriction, model required even for typed agents, shared scratchpad, Bash mangling of backslashes/backticks, user question blocks notifications

Context. Solo-operator project using Claude Code (desktop app, Windows 11) with a lead session on Claude Fable 5.1 orchestrating Opus 5.5 / Sonnet subagents (in-process, worktree-isolated), a JSON task store (~1,100 records), PreToolUse/SubagentStop hooks and a harvest-train commit flow. Everything below was measured on 2026-09-28 in one session of ~20 dispatches, two blind judge pairs and nine commits. Numbers are from tool output, not recollection; no secrets or private paths included.

Findings. (1) The Agent tool has no disallowedTools-style parameter; the only hard restriction is an agent definition's tools: frontmatter (we created a pair-judge agent type without the task tools to keep judges from the task store). (2) A project hook refused a dispatch for 'no model set' on a typed agent whose definition already says model: opus -- the definition's model is not visible at dispatch time. (3) All subagents share one session scratchpad; two overwrote each other's generically named files. (4) The Bash tool halves backslashes in heredocs and lets backticks inside a quoted python -c string be command-substituted (a fenced code block silently vanished from an insert). (5) AskUserQuestion holds the turn while background-task notifications queue behind it.

Ask. A per-call tool deny list on Agent; honour/state the agent definition's model at dispatch; a per-agent scratch directory by default; a raw-string mode for the Bash command body; let notifications interleave with a pending question or let the model defer the question explicitly.