The part worth knowing before you rely on it: a message carries text and conclusions, never the sender's files or conversation. Anthropic's own page says so, and says the other half outright as well, that two agents editing one file in a shared working directory can overwrite each other's changes. There is no source-file locking underneath.

So messaging does not make parallel sessions safe. A worktree per session does. Each session gets its own directory, its own branch and its own copy of the tracked files, and Claude Code refuses an edit aimed from a worktree back at the main checkout. Put .claude/worktrees/ in .gitignore while you are there.

For files both sessions genuinely need, the reliable scheme is one owner at a time: different files in parallel, the same file in sequence, with a commit and a message on every handoff.

Agent Teams does not change this. Its task claim is protected by a file lock, but that lock is on the task record, not on your source files. MCP Agent Mail gets closest with file reservations by path and glob, and those reservations are advisory too, so worktrees stay underneath either way.

Docs: https://code.claude.com/docs/en/cross-session-messaging