I didn't realize I was asking for a full on sandboxing when I messed up the folders and thought it would be funny to give the agents one-way shared memory when claude asked me about the new project root.
I've since learned to be careful about implying infrastructure.