You have two independent $session variables, each holding a different CGI::Session object. One in the outer scope, one declared with my in the subroutine.

Now you change something in the session object in the subroutine, and expect that change to get magically transferred to the outer session object as well. It won't. They are independent objects.