test(perfbench): pin the exit-4 oracle deferral from both sides; drop dead fixture branch

Follow-ups from a self-review of the exit-4 gating:

- Add TestIncompleteExitStillFailsWhenOracleFails: an INCOMPLETE (exit 4) run
  that did NO work must still FAIL, because deferring to the oracle still means
  the oracle is consulted. The sibling TestOracleAuthoritativeOnIncompleteExit
  applies a correct edit and would pass either way, so without this a regression
  that turned exit 4 into a blanket pass would go unnoticed.
- Broaden TestNonIncompleteExitStaysAuthoritative to a table over exit 1/3/130
  (crash/provider/interrupt), not just 1, so every named launder-risk code is
  covered.
- Tighten the NewTurnExecRunner doc: the verdict gate is the VerificationCommand
  (which runs the stamped OracleTest via go test), not OracleTest on its own.
- Drop the now-dead "if WorkspaceFixture != empty" branch: the fixtureless guard
  added earlier already guarantees it is set.

No behavior change; the 4-task glm-5.2 smoke stays 4/4.

README.md

@@ -195,7 +195,7 @@ Useful controls:
 | `Ctrl+P` / `Ctrl+N` | previous / next item in menus (arrows still work) |
 | `Shift+Tab` | cycle permission mode |
 | `Ctrl+B` | show/hide the sidebar |
-| `Ctrl+C` | cancel or exit |
+| `Ctrl+C` | cancel, exit, or return from a `/btw` conversation |
 
 Common slash commands:
 
@@ -205,6 +205,7 @@ Common slash commands:
 | `/spec`, `/plan` | draft and review a plan before building |
 | `/image` | attach an image for vision-capable models |
 | `/resume`, `/rewind` | continue or roll back local sessions |
+| `/btw [question]` | ask in an isolated fork without adding the side conversation to the main session |
 | `/loop` | repeat a prompt or custom `/command` on an interval (`/loop 5m /babysit-prs`) or self-paced |
 | `/compact`, `/context` | manage context usage |
 | `/permissions`, `/tools` | inspect available tools and policy |

internal/agent/compaction.go

@@ -56,6 +56,10 @@ type CompactionOptions struct {
 	// injected so Compact stays pure and testable; the agent loop wires it to a
 	// real provider call.
 	Summarize func(toSummarize []zeroruntime.Message) (string, error)
+	// taskState is a snapshot supplied by the running agent. Its immutable
+	// objective is always preserved; mutable fields are admitted only when its
+	// plan projection still matches the transcript.
+	taskState *taskStateSnapshot
 }
 
 // CompactionResult is the metadata-bearing result returned by CompactMessages.
@@ -220,7 +224,7 @@ func CompactMessages(messages []zeroruntime.Message, opts CompactionOptions) (Co
 
 	// Preserve structured state (active plan + loaded skills) from the elided
 	// middle verbatim, so it is not lost or paraphrased away by the prose summary.
-	content := appendPreservedState(summaryLabel+"\n"+summary, middle)
+	content := appendPreservedState(summaryLabel+"\n"+summary, middle, opts.taskState)
 
 	compacted := make([]zeroruntime.Message, 0, systemEnd+1+(len(messages)-boundary))
 	compacted = append(compacted, messages[:systemEnd]...)
@@ -326,6 +330,7 @@ type compactionState struct {
 	// OnText is deliberately NOT forwarded (compaction stays invisible to the user),
 	// but its token COST must still be counted so usage reports and budgets include it.
 	onUsage func(Usage)
+	task    *taskState
 
 	// calibrationRatio scales the raw byte/4 token estimate toward the provider's
 	// real prompt-token count. ApproxTextTokens over-counts code-heavy content by
@@ -365,13 +370,15 @@ func (state *compactionState) calibratedTokens(raw int) int {
 	return int(float64(raw) * state.calibrationRatio)
 }
 
-func newCompactionState(options Options) *compactionState {
-	return &compactionState{
+func newCompactionState(options Options, task *taskState) *compactionState {
+	state := &compactionState{
 		enabled:      options.ContextWindow > 0,
 		threshold:    compactionThreshold(options.ContextWindow),
 		preserveLast: options.CompactionPreserveLast,
 		onUsage:      options.OnUsage,
+		task:         task,
 	}
+	return state
 }
 
 // maybeCompact runs proactive compaction at the top of a turn. It returns the
@@ -418,6 +425,7 @@ func (state *compactionState) maybeCompact(
 	compacted, err := Compact(messages, CompactionOptions{
 		PreserveLast: state.preserveLast,
 		Summarize:    summarizeClosure(ctx, provider, state.onUsage),
+		taskState:    state.task.snapshotForCompaction(messages),
 	})
 	if err != nil {
 		// Summarizer failed: keep the original history. The reactive path (or a
@@ -468,6 +476,7 @@ func (state *compactionState) recover(
 	result, compactErr := Compact(messages, CompactionOptions{
 		PreserveLast: state.preserveLast,
 		Summarize:    summarizeClosure(ctx, provider, state.onUsage),
+		taskState:    state.task.snapshotForCompaction(messages),
 	})
 	if compactErr != nil {
 		// A genuine compaction attempt was made (and failed): the budget is spent

internal/agent/compaction_preserve.go

@@ -30,6 +30,10 @@ const (
 const (
 	maxRecentEdits   = 20
 	maxEditNoteBytes = 160
+	// maxTaskObjectiveBytes keeps the original objective recognizable after
+	// compaction without allowing an unusually large prompt to recreate the
+	// context pressure the compaction just removed.
+	maxTaskObjectiveBytes = 512
 )
 
 const (
@@ -76,32 +80,14 @@ func extractLatestPlan(messages []zeroruntime.Message) string {
 // ({"plan":[{content,status,...}]}) as terse status-tagged bullet lines. Returns
 // "" on malformed arguments or an empty plan.
 func formatPlanArguments(arguments string) string {
-	var parsed struct {
-		Plan []struct {
-			Content string `json:"content"`
-			Step    string `json:"step"`
-			Status  string `json:"status"`
-			Notes   string `json:"notes"`
-		} `json:"plan"`
-	}
-	if err := json.Unmarshal([]byte(strings.TrimSpace(arguments)), &parsed); err != nil {
+	plan, ok := parseTaskPlan(arguments)
+	if !ok {
 		return ""
 	}
-	lines := make([]string, 0, len(parsed.Plan))
-	for _, item := range parsed.Plan {
-		content := strings.TrimSpace(item.Content)
-		if content == "" {
-			content = strings.TrimSpace(item.Step)
-		}
-		if content == "" {
-			continue
-		}
-		status := strings.TrimSpace(item.Status)
-		if status == "" {
-			status = "pending"
-		}
-		line := "- [" + status + "] " + content
-		if notes := strings.TrimSpace(item.Notes); notes != "" {
+	lines := make([]string, 0, len(plan))
+	for _, item := range plan {
+		line := "- [" + item.Status + "] " + item.Content
+		if notes := item.Notes; notes != "" {
 			line += "\n  Notes: " + notes
 		}
 		lines = append(lines, line)
@@ -431,12 +417,25 @@ func capBody(body string) string {
 // preservedState is the JSON shape of the carried-across-compaction block.
 type preservedState struct {
 	Plan                string                 `json:"plan,omitempty"`
+	Task                *preservedTaskState    `json:"task,omitempty"`
 	RecentEdits         []preservedEdit        `json:"recent_edits,omitempty"`
 	Tools               []preservedTool        `json:"tools,omitempty"`
 	Skills              []preservedSkill       `json:"skills,omitempty"`
 	ProjectInstructions []preservedInstruction `json:"project_instructions,omitempty"`
 }
 
+type preservedTaskState struct {
+	Objective           string     `json:"objective"`
+	Status              taskStatus `json:"status,omitempty"`
+	Pending             int        `json:"pending,omitempty"`
+	InProgress          int        `json:"in_progress,omitempty"`
+	Completed           int        `json:"completed,omitempty"`
+	Failed              int        `json:"failed,omitempty"`
+	VerificationPassed  int        `json:"verification_passed,omitempty"`
+	VerificationFailed  int        `json:"verification_failed,omitempty"`
+	VerificationOutcome Outcome    `json:"verification_outcome,omitempty"`
+}
+
 type preservedEdit struct {
 	Path string `json:"path"`
 	Note string `json:"note,omitempty"`
@@ -464,8 +463,27 @@ type preservedInstruction struct {
 // may live only inside the injected summary message, which on a later compaction
 // lands in middle with no real tool calls left to extract. Fresh tool calls and
 // instruction blocks override the carried-forward copy by name/source.
-func appendPreservedState(summary string, middle []zeroruntime.Message) string {
+func appendPreservedState(summary string, middle []zeroruntime.Message, taskSnapshot *taskStateSnapshot) string {
 	priorState := parsePreservedStateBlock(latestSummaryContent(middle))
+	task := priorState.Task
+	if taskSnapshot != nil {
+		task = &preservedTaskState{
+			Objective: capTaskObjective(taskSnapshot.Objective),
+		}
+		// Plan parity corroborates only the mutable task projection. The objective
+		// comes directly from the run prompt and is immutable, so it must survive
+		// even after compaction removes the plan tool call needed for comparison.
+		if taskSnapshot.PlanParity == taskPlanParityMatch {
+			task.Status = taskSnapshot.Status
+			task.Pending = taskSnapshot.Plan.Pending
+			task.InProgress = taskSnapshot.Plan.InProgress
+			task.Completed = taskSnapshot.Plan.Completed
+			task.Failed = taskSnapshot.Plan.Failed
+			task.VerificationPassed = taskSnapshot.Verification.Passed
+			task.VerificationFailed = taskSnapshot.Verification.Failed
+			task.VerificationOutcome = taskSnapshot.Verification.LastOutcome
+		}
+	}
 
 	// Plan: a fresh update_plan in middle is authoritative; otherwise carry the
 	// plan preserved by an earlier compaction.
@@ -493,12 +511,25 @@ func appendPreservedState(summary string, middle []zeroruntime.Message) string {
 		projectInstructionEntries(middle),
 	)
 
-	if block := formatPreservedState(plan, edits, tools, skills, instructions); block != "" {
+	if block := formatPreservedState(plan, task, edits, tools, skills, instructions); block != "" {
 		summary += "\n\n" + block
 	}
 	return summary
 }
 
+func capTaskObjective(objective string) string {
+	objective = strings.TrimSpace(objective)
+	if len(objective) <= maxTaskObjectiveBytes {
+		return objective
+	}
+	const suffix = "…"
+	limit := maxTaskObjectiveBytes - len(suffix)
+	for limit > 0 && !utf8.RuneStart(objective[limit]) {
+		limit--
+	}
+	return strings.TrimSpace(objective[:limit]) + suffix
+}
+
 // mergeRecentEdits overlays fresh edits onto edits preserved by an earlier
 // compaction. Unlike mergeSkillEntries (which keeps refreshed entries in their
 // original slot), a path touched again by a fresh edit MOVES to the newest
@@ -555,11 +586,11 @@ func preservedEditsToEntries(edits []preservedEdit) []skillEntry {
 
 // formatPreservedState renders state as the labelled, single-line
 // JSON block. Returns "" when there is nothing to preserve.
-func formatPreservedState(plan string, edits, tools, skills, instructions []skillEntry) string {
-	if plan == "" && len(edits) == 0 && len(tools) == 0 && len(skills) == 0 && len(instructions) == 0 {
+func formatPreservedState(plan string, task *preservedTaskState, edits, tools, skills, instructions []skillEntry) string {
+	if plan == "" && task == nil && len(edits) == 0 && len(tools) == 0 && len(skills) == 0 && len(instructions) == 0 {
 		return ""
 	}
-	state := preservedState{Plan: plan}
+	state := preservedState{Plan: plan, Task: task}
 	for _, e := range edits {
 		state.RecentEdits = append(state.RecentEdits, preservedEdit{Path: e.name, Note: e.body})
 	}

internal/agent/compaction_preserve_test.go

@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"encoding/json"
 	"strings"
 	"testing"
 	"unicode/utf8"
@@ -59,6 +60,103 @@ func TestCompactPreservesActivePlan(t *testing.T) {
 	}
 }
 
+func TestCompactPreservesBoundedTaskContext(t *testing.T) {
+	objective := strings.Repeat("世", maxTaskObjectiveBytes)
+	task := newTaskState(objective, nil)
+	task.observe(taskStateEvent{kind: taskStateEventPlan, arguments: `{"plan":[{"content":"write code","status":"in_progress"},{"content":"add tests","status":"pending"}]}`})
+	messages := stateConversation()
+	compacted, err := Compact(messages, CompactionOptions{
+		PreserveLast: 2,
+		Summarize:    func([]zeroruntime.Message) (string, error) { return "SUMMARY", nil },
+		taskState:    task.snapshotForCompaction(messages),
+	})
+	if err != nil {
+		t.Fatalf("Compact: %v", err)
+	}
+	state := parsePreservedStateBlock(compacted[1].Content)
+	if state.Task == nil || state.Task.Status != taskStatusActive || state.Task.InProgress != 1 || state.Task.Pending != 1 {
+		t.Fatalf("unexpected compact task state: %#v", state.Task)
+	}
+	if len(state.Task.Objective) > maxTaskObjectiveBytes || !utf8.ValidString(state.Task.Objective) {
+		t.Fatalf("objective was not safely bounded: %d bytes %q", len(state.Task.Objective), state.Task.Objective)
+	}
+}
+
+func TestCompactPreservesObjectiveAfterPlanParityMismatch(t *testing.T) {
+	prior := preservedState{Task: &preservedTaskState{Objective: "stale objective", Status: taskStatusActive, Pending: 1}}
+	encoded, err := json.Marshal(prior)
+	if err != nil {
+		t.Fatal(err)
+	}
+	messages := []zeroruntime.Message{
+		{Role: zeroruntime.MessageRoleSystem, Content: "system"},
+		{Role: zeroruntime.MessageRoleUser, Content: summaryLabel + "\nold\n\n" + preservedStateLabel + "\n" + string(encoded)},
+		{Role: zeroruntime.MessageRoleAssistant, Content: "continuing"},
+		{Role: zeroruntime.MessageRoleUser, Content: "more"},
+		{Role: zeroruntime.MessageRoleAssistant, Content: "working"},
+		{Role: zeroruntime.MessageRoleUser, Content: "again"},
+		{Role: zeroruntime.MessageRoleAssistant, Content: "done"},
+	}
+	compacted, err := Compact(messages, CompactionOptions{
+		PreserveLast: 2,
+		Summarize:    func([]zeroruntime.Message) (string, error) { return "SUMMARY", nil },
+		taskState: &taskStateSnapshot{
+			Objective:  "current objective",
+			PlanParity: taskPlanParityMismatch,
+		},
+	})
+	if err != nil {
+		t.Fatalf("Compact: %v", err)
+	}
+	state := parsePreservedStateBlock(compacted[1].Content)
+	if state.Task == nil || state.Task.Objective != "current objective" {
+		t.Fatalf("immutable objective was lost on plan mismatch: %#v", state.Task)
+	}
+	if state.Task.Status != "" || state.Task.Pending != 0 {
+		t.Fatalf("uncorroborated mutable task fields survived plan mismatch: %#v", state.Task)
+	}
+}
+
+func TestTaskObjectiveSurvivesRepeatedCompactionWithoutPlanRefresh(t *testing.T) {
+	task := newTaskState("keep this objective", nil)
+	task.observe(taskStateEvent{kind: taskStateEventPlan, arguments: `{"plan":[{"content":"write code","status":"in_progress"},{"content":"add tests","status":"pending"}]}`})
+	messages := stateConversation()
+
+	first, err := Compact(messages, CompactionOptions{
+		PreserveLast: 2,
+		Summarize:    func([]zeroruntime.Message) (string, error) { return "FIRST", nil },
+		taskState:    task.snapshotForCompaction(messages),
+	})
+	if err != nil {
+		t.Fatalf("first Compact: %v", err)
+	}
+	secondInput := append(append([]zeroruntime.Message{}, first...),
+		zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "more"},
+		zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, Content: "working"},
+		zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "again"},
+		zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, Content: "done"},
+	)
+	snapshot := task.snapshotForCompaction(secondInput)
+	if snapshot.PlanParity != taskPlanParityMismatch {
+		t.Fatalf("plan call should be absent after first compaction, parity=%q", snapshot.PlanParity)
+	}
+	second, err := Compact(secondInput, CompactionOptions{
+		PreserveLast: 2,
+		Summarize:    func([]zeroruntime.Message) (string, error) { return "SECOND", nil },
+		taskState:    snapshot,
+	})
+	if err != nil {
+		t.Fatalf("second Compact: %v", err)
+	}
+	state := parsePreservedStateBlock(second[1].Content)
+	if state.Task == nil || state.Task.Objective != "keep this objective" {
+		t.Fatalf("objective lost after second compaction: %#v", state.Task)
+	}
+	if state.Task.Status != "" || state.Task.InProgress != 0 {
+		t.Fatalf("uncorroborated mutable fields survived second compaction: %#v", state.Task)
+	}
+}
+
 func TestCompactPreservesLoadedSkills(t *testing.T) {
 	summary := compactStateConversation(t, stateConversation())
 	if !strings.Contains(summary, preservedStateLabel) {
@@ -283,12 +381,10 @@ func TestExtractLatestPlanReturnsMostRecent(t *testing.T) {
 	}
 }
 
-func TestFormatPlanArgumentsAcceptsStepAlias(t *testing.T) {
+func TestFormatPlanArgumentsRejectsUnsupportedStepAlias(t *testing.T) {
 	got := formatPlanArguments(`{"plan":[{"step":"write failing test","status":"in_progress"},{"content":"keep existing shape","status":"pending"}]}`)
-	for _, want := range []string{"- [in_progress] write failing test", "- [pending] keep existing shape"} {
-		if !strings.Contains(got, want) {
-			t.Fatalf("expected %q in formatted plan, got %q", want, got)
-		}
+	if got != "" {
+		t.Fatalf("unsupported alias should reject the whole plan like update_plan, got %q", got)
 	}
 }
 

internal/agent/compaction_test.go

@@ -581,7 +581,7 @@ func TestCompactNeverProducesConsecutiveUserMessages(t *testing.T) {
 }
 
 func TestRecoverNoopDoesNotConsumeReactiveBudget(t *testing.T) {
-	st := newCompactionState(Options{ContextWindow: 1000, CompactionPreserveLast: 2})
+	st := newCompactionState(Options{ContextWindow: 1000, CompactionPreserveLast: 2}, nil)
 	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
 		{Type: zeroruntime.StreamEventText, Content: "SUMMARY"}, {Type: zeroruntime.StreamEventDone},
 	}}}
@@ -628,7 +628,7 @@ func TestRecoverNoopDoesNotConsumeReactiveBudget(t *testing.T) {
 }
 
 func TestRecoverDisabledIsNoop(t *testing.T) {
-	st := newCompactionState(Options{ContextWindow: 0})
+	st := newCompactionState(Options{ContextWindow: 0}, nil)
 	msgs := []zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "x"}}
 	called := false
 	// recover must not invoke the provider/summarize when disabled, even on a

internal/agent/completion_policy.go

@@ -39,7 +39,7 @@ func newCompletionPolicy(requireSemanticCheck bool) *completionPolicy {
 	return &completionPolicy{requireSemanticCheck: requireSemanticCheck}
 }
 
-func (policy *completionPolicy) evaluate(text string, planPending bool) completionEvaluation {
+func (policy *completionPolicy) evaluate(text string, context completionContext) completionEvaluation {
 	// A direct admission is strong local evidence and takes precedence over all
 	// weaker signals, avoiding both continuation nudges and semantic checks.
 	if reason := selfReportedIncompletion(text); reason != "" {
@@ -50,7 +50,7 @@ func (policy *completionPolicy) evaluate(text string, planPending bool) completi
 	// weak evidence because bookkeeping can be stale. Both get a bounded chance
 	// to continue, but only a persisted cue is ultimately incomplete.
 	cue := endsWithContinuationCue(text)
-	if cue || planPending {
+	if cue || context.PlanPending {
 		if policy.continueNudges < maxContinueNudges {
 			policy.continueNudges++
 			reason := "your message ended mid-step"

internal/agent/completion_policy_test.go

@@ -1,16 +1,19 @@
 package agent
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 func TestCompletionPolicyLocalEvidenceDecidesWithoutSemanticCheck(t *testing.T) {
 	policy := newCompletionPolicy(false)
 
-	complete := policy.evaluate("Done. All required checks pass.", false)
+	complete := policy.evaluate("Done. All required checks pass.", completionContext{})
 	if complete.Decision != CompletionComplete {
 		t.Fatalf("confident completion decision = %q, want %q", complete.Decision, CompletionComplete)
 	}
 
-	incomplete := policy.evaluate("I couldn't verify the result, so this is my best guess.", false)
+	incomplete := policy.evaluate("I couldn't verify the result, so this is my best guess.", completionContext{})
 	if incomplete.Decision != CompletionIncomplete {
 		t.Fatalf("admitted failure decision = %q, want %q", incomplete.Decision, CompletionIncomplete)
 	}
@@ -19,13 +22,13 @@ func TestCompletionPolicyLocalEvidenceDecidesWithoutSemanticCheck(t *testing.T)
 func TestCompletionPolicyPreservesBoundedPlanStallProtection(t *testing.T) {
 	policy := newCompletionPolicy(false)
 	for attempt := 0; attempt < maxContinueNudges; attempt++ {
-		got := policy.evaluate("Let me inspect the remaining configuration:", true)
+		got := policy.evaluate("Let me inspect the remaining configuration:", completionContext{PlanPending: true})
 		if got.Decision != CompletionUncertain || got.Action != completionActionContinue {
 			t.Fatalf("attempt %d = (%q, %q), want uncertain continue", attempt+1, got.Decision, got.Action)
 		}
 	}
 
-	got := policy.evaluate("Let me inspect the remaining configuration:", true)
+	got := policy.evaluate("Let me inspect the remaining configuration:", completionContext{PlanPending: true})
 	if got.Decision != CompletionIncomplete {
 		t.Fatalf("decision after nudge budget = %q, want %q", got.Decision, CompletionIncomplete)
 	}
@@ -34,13 +37,13 @@ func TestCompletionPolicyPreservesBoundedPlanStallProtection(t *testing.T) {
 func TestCompletionPolicyTreatsPendingPlanAsWeakEvidence(t *testing.T) {
 	policy := newCompletionPolicy(false)
 	for attempt := 0; attempt < maxContinueNudges; attempt++ {
-		got := policy.evaluate("All set.", true)
+		got := policy.evaluate("All set.", completionContext{PlanPending: true})
 		if got.Decision != CompletionUncertain || got.Action != completionActionContinue {
 			t.Fatalf("attempt %d = (%q, %q), want uncertain continue", attempt+1, got.Decision, got.Action)
 		}
 	}
 
-	got := policy.evaluate("All set.", true)
+	got := policy.evaluate("All set.", completionContext{PlanPending: true})
 	if got.Decision != CompletionComplete {
 		t.Fatalf("stale plan decision after nudge budget = %q, want %q", got.Decision, CompletionComplete)
 	}
@@ -49,12 +52,12 @@ func TestCompletionPolicyTreatsPendingPlanAsWeakEvidence(t *testing.T) {
 func TestCompletionPolicyAllowsExactlyOneRequiredSemanticCheck(t *testing.T) {
 	policy := newCompletionPolicy(true)
 
-	first := policy.evaluate("Implemented and tested.", false)
+	first := policy.evaluate("Implemented and tested.", completionContext{})
 	if first.Decision != CompletionUncertain || first.Action != completionActionSemanticCheck {
 		t.Fatalf("first decision = (%q, %q), want uncertain semantic check", first.Decision, first.Action)
 	}
 
-	second := policy.evaluate("PASS. The result meets the task criterion.", false)
+	second := policy.evaluate("PASS. The result meets the task criterion.", completionContext{})
 	if second.Decision != CompletionComplete {
 		t.Fatalf("post-check decision = %q, want %q", second.Decision, CompletionComplete)
 	}
@@ -62,3 +65,11 @@ func TestCompletionPolicyAllowsExactlyOneRequiredSemanticCheck(t *testing.T) {
 		t.Fatal("semantic check was requested more than once")
 	}
 }
+
+func TestAcceptanceVerificationNudgeIncludesBoundedObjective(t *testing.T) {
+	objective := "make the requested behavior observable"
+	nudge := acceptanceVerificationNudge(objective)
+	if !strings.Contains(nudge, "Task objective: "+objective) {
+		t.Fatalf("semantic check was not grounded in the objective: %q", nudge)
+	}
+}

internal/agent/guardrails.go

@@ -1,7 +1,6 @@
 package agent
 
 import (
-	"encoding/json"
 	"strconv"
 	"strings"
 
@@ -127,9 +126,8 @@ func endsWithContinuationCue(text string) bool {
 // which the update_plan tool coerces to "pending") counts as remaining, matching
 // that tool's own status normalization.
 func planStatusRemaining(status string) bool {
-	switch strings.ToLower(strings.TrimSpace(status)) {
-	case "completed", "complete", "done", "finished", "resolved", "✓", "x", "[x]",
-		"failed", "fail", "error", "errored", "blocked", "cancelled", "canceled", "abandoned", "skipped":
+	switch normalizeTaskPlanStatus(status) {
+	case "completed", "failed":
 		return false
 	default:
 		return true
@@ -307,8 +305,8 @@ func hasAnyPrefix(s string, prefixes []string) bool {
 // the bug-hunt surfaced: well-formed output treated as correct; pre-existing tests
 // passing treated as the objective being met; and a result that merely matches a
 // baseline the task asked to beat or improve. General — no task-specific content.
-func acceptanceVerificationNudge() string {
-	return "Before this task can be marked complete, " + acceptanceNudgeMarker + " — " +
+func acceptanceVerificationNudge(objective string) string {
+	nudge := "Before this task can be marked complete, " + acceptanceNudgeMarker + " — " +
 		"NOT the shape or format of your output, NOT that pre-existing tests pass, and NOT that your " +
 		"result merely matches a baseline you were asked to beat or improve. " +
 		"Re-read the original task, then run a concrete check that exercises the actual requirement: " +
@@ -316,6 +314,10 @@ func acceptanceVerificationNudge() string {
 		"thing the task asked you to produce, recover, fix, or optimize. " +
 		"If that check passes, reply PASS and cite the evidence. " +
 		"If it does not pass — or you cannot run such a check — say so plainly and keep working; do not claim success."
+	if objective = capTaskObjective(objective); objective != "" {
+		nudge += "\n\nTask objective: " + objective
+	}
+	return nudge
 }
 
 // toolFailureHintMarker is a stable substring for tests.
@@ -553,16 +555,12 @@ func (state *guardState) pendingPlanItems() bool {
 // many items are still remaining. Malformed arguments leave the prior count
 // unchanged (best-effort — the plan panel itself tolerates the same).
 func (state *guardState) observePlanUpdate(arguments string) {
-	var parsed struct {
-		Plan []struct {
-			Status string `json:"status"`
-		} `json:"plan"`
-	}
-	if json.Unmarshal([]byte(arguments), &parsed) != nil {
+	plan, ok := parseTaskPlan(arguments)
+	if !ok {
 		return
 	}
 	pending := 0
-	for _, item := range parsed.Plan {
+	for _, item := range plan {
 		if planStatusRemaining(item.Status) {
 			pending++
 		}

internal/agent/loop.go

@@ -181,10 +181,20 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 	options.runPermissions = runPermissions
 	defer runPermissions.cleanup()
 
-	messages := zeroruntime.SeedMessagesWithImages(buildSystemPrompt(options), prompt, options.Images)
+	promptParts := buildSystemPromptParts(options)
+	messages := zeroruntime.SeedMessagesWithImages(promptParts.prompt, prompt, options.Images)
 
 	guards := newGuardState()
-	compactor := newCompactionState(options)
+	task := newTaskState(prompt, options.Trace)
+	compactor := newCompactionState(options, task)
+	defer func() {
+		// A final transcript comparison is observational. It records drift but
+		// never rewrites the result or changes execution after the fact.
+		task.observePlanParity(result.Messages)
+		// Tool-result observations are intentionally coalesced; this final event
+		// guarantees their aggregate counts are present even on an early return.
+		task.emit()
+	}()
 	// The execution-profile posture controller. nil Options.Profile (every
 	// existing caller) makes every observe/decide call a no-op, keeping the
 	// loop byte-identical for unprofiled runs.
@@ -268,16 +278,14 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 		exposed, _ := partitionToolsCached(registry, permissionMode, options, loaded, toolDefCache)
 		toolPartitionSpan.End()
 
-		// Prompt-prefix fingerprint: hash the seven cacheable sub-components
-		// of this turn's request (system prompt sections, project context,
-		// skills, partitioned tool list, tool schemas) and emit one trace
-		// event. Stable across turns => cacheable. Drift in any sub-hash
-		// names the sub-component that broke the cache for this turn. The
-		// computation is pure and cheap (seven SHA-256s of small strings)
-		// and is a no-op when tracing is off.
+		// Fingerprint the exact system prompt built at run start plus this turn's
+		// provider-visible tool definitions in their emitted order. Reusing the
+		// retained prompt parts avoids rebuilding workspace context while ensuring
+		// the trace describes the same bytes carried by the request.
 		if options.Trace != nil {
-			fp := ComputePrefixFingerprint(options, exposed)
+			fp := computePrefixFingerprint(buildPromptSubstringsFromParts(promptParts, exposed))
 			options.Trace.EmitPrefixHash(trace.PrefixHash{
+				SystemPromptHash:       fp.SystemPromptHash,
 				BaseInstructionsHash:   fp.BaseInstructionsHash,
 				ConfirmationPolicyHash: fp.ConfirmationPolicyHash,
 				ProjectContextHash:     fp.ProjectContextHash,
@@ -571,7 +579,9 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			// model's final answer ONLY when the work is actually done. Default off
 			// (RequireCompletionSignal), so interactive runs stay byte-identical.
 			if options.RequireCompletionSignal {
-				evaluation := completionPolicy.evaluate(collected.Text, guards.pendingPlanItems())
+				completionContext := task.completionContext(messages, guards.pendingPlanItems())
+				evaluation := completionPolicy.evaluate(collected.Text, completionContext)
+				task.observe(taskStateEvent{kind: taskStateEventCompletion, completion: evaluation})
 				switch evaluation.Decision {
 				case CompletionIncomplete:
 					result.Incomplete = true
@@ -596,13 +606,15 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 						options.Trace.Counter(trace.CounterAcceptanceChecks, 1)
 						messages = append(messages, zeroruntime.Message{
 							Role:    zeroruntime.MessageRoleUser,
-							Content: acceptanceVerificationNudge(),
+							Content: acceptanceVerificationNudge(completionContext.Objective),
 						})
 					}
 					continue
 				case CompletionComplete:
 					// Local evidence is sufficient; proceed to final diagnostics.
 				}
+			} else {
+				task.observe(taskStateEvent{kind: taskStateEventCompletion, completion: completionEvaluation{Decision: CompletionComplete}})
 			}
 			// Finalization diagnostics gate: edits from this run may still have
 			// checks in flight — the per-turn drain waits only briefly and defers
@@ -626,6 +638,11 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 		// executing so the empty-turn counter resets and plan-tracking signals
 		// stay current.
 		guards.observeTurn(collected)
+		for _, call := range collected.ToolCalls {
+			if call.Name == planToolName {
+				task.observe(taskStateEvent{kind: taskStateEventPlan, arguments: call.Arguments})
+			}
+		}
 
 		failureHint := ""
 		// turnRequestedModel records the FIRST mid-run escalation target requested
@@ -677,6 +694,7 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			}
 			options.Trace.Counter(trace.CounterToolCalls, 1)
 			recordOutputBudgetTrace(options.Trace, toolResult)
+			task.observe(taskStateEvent{kind: taskStateEventToolResult, toolResult: toolResult})
 			if options.OnToolResult != nil {
 				options.OnToolResult(toolResult)
 			}
@@ -758,6 +776,7 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 		if options.SelfCorrect != nil && len(changedFilesThisBatch) > 0 {
 			feedback, selfCorrectOutcome := options.SelfCorrect.AfterEdit(ctx, dedupeStrings(changedFilesThisBatch))
 			posture.observeSelfCorrect(selfCorrectOutcome)
+			task.observe(taskStateEvent{kind: taskStateEventVerification, verification: selfCorrectOutcome})
 			if feedback != "" {
 				messages = append(messages, zeroruntime.Message{
 					Role:    zeroruntime.MessageRoleUser,

internal/agent/loop_test.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"reflect"
 	"runtime"
 	"strings"
 	"testing"
@@ -1258,6 +1259,46 @@ func TestRunExecutesToolCallThroughRegistry(t *testing.T) {
 	}
 }
 
+func TestRunPreservesRequestPrefixAcrossTurns(t *testing.T) {
+	root := t.TempDir()
+	writeAgentTestFile(t, filepath.Join(root, "notes.txt"), "alpha\n")
+	registry := tools.NewRegistry()
+	registry.Register(tools.NewReadFileTool(root))
+	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{
+		{
+			{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "call-1", ToolName: "read_file"},
+			{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "call-1", ArgumentsFragment: `{"path":"notes.txt"}`},
+			{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "call-1"},
+			{Type: zeroruntime.StreamEventDone},
+		},
+		{
+			{Type: zeroruntime.StreamEventText, Content: "done"},
+			{Type: zeroruntime.StreamEventDone},
+		},
+	}}
+
+	if _, err := Run(context.Background(), "read notes", provider, Options{
+		Cwd:       root,
+		Registry:  registry,
+		SessionID: "session-stable-prefix",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if len(provider.requests) != 2 {
+		t.Fatalf("provider requests = %d, want 2", len(provider.requests))
+	}
+	first, second := provider.requests[0], provider.requests[1]
+	if len(second.Messages) < len(first.Messages) || !reflect.DeepEqual(second.Messages[:len(first.Messages)], first.Messages) {
+		t.Fatalf("first request messages must be an exact prefix of the second:\nfirst=%#v\nsecond=%#v", first.Messages, second.Messages)
+	}
+	if !reflect.DeepEqual(first.Tools, second.Tools) {
+		t.Fatalf("tool definitions drifted between turns:\nfirst=%#v\nsecond=%#v", first.Tools, second.Tools)
+	}
+	if first.PromptCacheKey != "session-stable-prefix" || second.PromptCacheKey != first.PromptCacheKey {
+		t.Fatalf("prompt cache key must remain stable: first=%q second=%q", first.PromptCacheKey, second.PromptCacheKey)
+	}
+}
+
 func TestRunSanitizesMalformedToolCallArgumentsBeforeRetry(t *testing.T) {
 	root := t.TempDir()
 	registry := tools.NewRegistry()

internal/agent/prompt_fingerprint.go

@@ -11,12 +11,11 @@ import (
 	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
-// promptSubstrings are the seven cacheable sub-components of the prompt a run
-// sends to a model. Each is the literal content the sub-component would emit
-// into the system prompt or tool list, hashed so a downstream observer can
-// detect drift turn-over-turn. The substrings are produced by
-// buildPromptSubstrings and consumed by ComputePrefixFingerprint.
+// promptSubstrings are the cacheable components of the prompt a run sends to a
+// model. systemPrompt is the exact joined system-message content. The remaining
+// fields retain useful diagnostic boundaries within that prompt and tool list.
 type promptSubstrings struct {
+	systemPrompt       string
 	baseInstructions   string
 	confirmationPolicy string
 	projectContext     string
@@ -25,92 +24,55 @@ type promptSubstrings struct {
 	schema             string
 }
 
-// buildPromptSubstrings assembles the seven cacheable sub-components of the
-// prompt without joining them. The system prompt sections are produced by the
-// same private builders that buildSystemPrompt uses, so the substrings are
-// byte-identical to what would have appeared in the joined prompt. The tools
-// and schema substrings are derived from the partitioned tool list (caller-
-// provided) so this helper does not need to re-run the partition.
-//
-// This is the seam ComputePrefixFingerprint reads from. It exists as a
-// separate function (rather than returning both prompt and substrings from
-// buildSystemPrompt) so existing callers of buildSystemPrompt are unaffected
-// and the substrings helper is independently testable.
+// buildPromptSubstrings builds the prompt and retains both its exact joined
+// form and narrower diagnostic components. Callers that already built the
+// prompt should use buildPromptSubstringsFromParts to avoid repeating workspace
+// reads.
 func buildPromptSubstrings(options Options, exposed []zeroruntime.ToolDefinition) promptSubstrings {
-	core := strings.TrimSpace(options.SystemPrompt)
-	if core == "" {
-		core = strings.TrimSpace(coreSystemPrompt)
-	}
-	if core == "" {
-		core = fallbackSystemPrompt
-	}
+	return buildPromptSubstringsFromParts(buildSystemPromptParts(options), exposed)
+}
 
-	// The confirmation policy is appended unconditionally in buildSystemPrompt;
-	// the substring here is the same constant.
-	policy := strings.TrimSpace(confirmationPolicy)
-
-	// projectContext is the joined output of workspaceContext, which itself
-	// walks the AGENTS.md / ZERO.md / .zero/AGENTS.md chain. Hashing the
-	// joined string captures every guideline file's contribution and the
-	// ordering between them.
-	project := workspaceContext(options.Cwd)
-
-	// skills is the joined output of skillsContext, with each skill on its own
-	// line. The substring is the literal text the model would see.
-	skills := skillsContext(options)
-
-	// tools and schema are derived from the partitioned tool list. The list
-	// passed in is already in stable order (partitionToolsCached is the
-	// canonical stable partitioner) so concatenating in slice order is
-	// sufficient — we sort names again defensively in case a future caller
-	// hands us a list from a different partitioner.
+func buildPromptSubstringsFromParts(parts systemPromptParts, exposed []zeroruntime.ToolDefinition) promptSubstrings {
 	toolsSubstr, schemaSubstr := toolSubstrings(exposed)
 
 	return promptSubstrings{
-		baseInstructions:   core,
-		confirmationPolicy: policy,
-		projectContext:     project,
-		skills:             skills,
+		systemPrompt:       parts.prompt,
+		baseInstructions:   parts.baseInstructions,
+		confirmationPolicy: parts.confirmationPolicy,
+		projectContext:     parts.projectContext,
+		skills:             parts.skills,
 		tools:              toolsSubstr,
 		schema:             schemaSubstr,
 	}
 }
 
-// toolSubstrings extracts a stable, name-sorted digest of the partitioned tool
-// list. The tools substring is "name1\nname2\n..." (sorted) so a reordering of
-// the partition produces a different hash. The schema substring is the
-// concatenation of each tool's JSON schema in name order, so a schema change
-// is detected independently of the tool ordering.
+// toolSubstrings preserves the emitted tool order. Names and descriptions are
+// fingerprinted separately from schemas so either kind of drift is identifiable.
+// Order is part of request identity: silently sorting here would hide a provider-
+// visible reordering and could report a false cache hit.
 func toolSubstrings(exposed []zeroruntime.ToolDefinition) (toolsSubstr, schemaSubstr string) {
 	if len(exposed) == 0 {
 		return "", ""
 	}
-	names := make([]string, 0, len(exposed))
-	byName := make(map[string]zeroruntime.ToolDefinition, len(exposed))
-	for _, def := range exposed {
-		names = append(names, def.Name)
-		byName[def.Name] = def
-	}
-	sort.Strings(names)
 	var toolsSB, schemaSB strings.Builder
-	for i, name := range names {
-		if i > 0 {
-			toolsSB.WriteByte('\n')
-		}
-		toolsSB.WriteString(name)
-		def := byName[name]
+	for _, def := range exposed {
+		writeLengthPrefixed(&toolsSB, def.Name)
+		writeLengthPrefixed(&toolsSB, def.Description)
 		// Parameters is rendered to a canonical JSON string per tool. The
 		// schema-render cache in internal/agent (used by partitionToolsCached)
 		// guarantees the same render is byte-identical across turns for the
 		// same tool, so this substring is a stable hash input.
-		schemaSB.WriteString(name)
-		schemaSB.WriteByte('\n')
-		schemaSB.WriteString(canonicalSchemaString(def.Parameters))
-		schemaSB.WriteByte('\n')
+		writeLengthPrefixed(&schemaSB, def.Name)
+		writeLengthPrefixed(&schemaSB, canonicalSchemaString(def.Parameters))
 	}
 	return toolsSB.String(), schemaSB.String()
 }
 
+func writeLengthPrefixed(sb *strings.Builder, value string) {
+	fmt.Fprintf(sb, "%d:", len(value))
+	sb.WriteString(value)
+}
+
 // canonicalSchemaString renders a tool's parameter schema to a stable string.
 // tools.ToolDef.Parameters is a map[string]any in the common case; Go's
 // fmt.Sprintf("%v", m) iterates a map in random order, which would produce
@@ -227,36 +189,16 @@ func writeStable(sb *strings.Builder, v any) {
 	}
 }
 
-// ComputePrefixFingerprint returns a trace.PrefixHash (a 7-field fingerprint
-// of the prompt prefix) for one turn of a run. The seven sub-hashes are
-// independent SHA-256s of the corresponding sub-component; the complete-prefix
-// hash is a SHA-256 of the canonical concatenation of the other six, so any
-// sub-component drift is observable both individually and in aggregate.
-//
-// I/O side effects: buildPromptSubstrings calls workspaceContext, which runs
-// git (gitBranchForPrompt, FindProjectGitRoot) and reads the AGENTS.md /
-// ZERO.md / .zero/AGENTS.md chain plus the repo map. The same workspace-
-// context work is performed separately by buildSystemPrompt a few lines
-// later in the request-build path, so on every traced turn the file and
-// git reads happen twice. The duplication is intentional for this PR (a
-// follow-up will pass substrings through) and is a known perf cost only on
-// the opt-in trace path.
-//
-// A stable CompletePrefixHash across turns means the four captured
-// sub-components (baseInstructions, confirmationPolicy, projectContext,
-// skills) are byte-identical. It does NOT rule out drift in the seven
-// uncaptured sections of buildSystemPrompt (modelPromptAddendum,
-// sessionRuntimeContext, approvedCommandPrefixContext, workspaceSeedContext,
-// userGuidelines, specialistDelegationContext, responseStyleContext). For
-// default Options the four captured substrings are the full prompt; for
-// non-default Options the seven uncaptured sections may contribute, and a
-// consumer correlating CompletePrefix stability with cached_input_tokens
-// must cross-check the model_switches counter (modelPromptAddendum changes
-// on a model switch) to disambiguate "no drift" from "drift in an
-// uncaptured section."
-
+// ComputePrefixFingerprint builds and fingerprints a prompt for callers that do
+// not already have one. The agent loop uses computePrefixFingerprint with the
+// prompt parts it built once at run start, ensuring tracing observes the exact
+// request content without repeating workspace I/O.
 func ComputePrefixFingerprint(options Options, exposed []zeroruntime.ToolDefinition) prefixFingerprint {
-	subs := buildPromptSubstrings(options, exposed)
+	return computePrefixFingerprint(buildPromptSubstrings(options, exposed))
+}
+
+func computePrefixFingerprint(subs promptSubstrings) prefixFingerprint {
+	systemPrompt := sha256hex(subs.systemPrompt)
 	base := sha256hex(subs.baseInstructions)
 	policy := sha256hex(subs.confirmationPolicy)
 	project := sha256hex(subs.projectContext)
@@ -264,9 +206,10 @@ func ComputePrefixFingerprint(options Options, exposed []zeroruntime.ToolDefinit
 	toolsH := sha256hex(subs.tools)
 	schema := sha256hex(subs.schema)
 	complete := sha256hex(strings.Join([]string{
-		base, policy, project, skills, toolsH, schema,
+		systemPrompt, toolsH, schema,
 	}, "|"))
 	return prefixFingerprint{
+		SystemPromptHash:       systemPrompt,
 		BaseInstructionsHash:   base,
 		ConfirmationPolicyHash: policy,
 		ProjectContextHash:     project,
@@ -282,6 +225,7 @@ func ComputePrefixFingerprint(options Options, exposed []zeroruntime.ToolDefinit
 // in loop.go) so the trace package does not need to import this one. The field
 // names match the trace.PrefixHash JSON tags 1:1.
 type prefixFingerprint struct {
+	SystemPromptHash       string
 	BaseInstructionsHash   string
 	ConfirmationPolicyHash string
 	ProjectContextHash     string

internal/agent/prompt_fingerprint_test.go

@@ -28,38 +28,28 @@ func TestComputePrefixFingerprintStableAcrossCalls(t *testing.T) {
 	}
 }
 
-// TestComputePrefixFingerprintToolsHashIsNameSetSensitive asserts the
-// name-set sensitivity of the ToolsHash. The test name used to read as
-// "reorder changes hash" but the assertion is the opposite: the hash is
-// name-set sensitive, not name-order sensitive (toolSubstrings sorts
-// names before hashing). The partitioner is expected to produce a stable
-// order, so a name-order change is not a hash signal — a name-set change
-// is. The test asserts both: permutation of the same tools produces the
-// same hash, and adding a tool produces a different hash.
-func TestComputePrefixFingerprintToolsHashIsNameSetSensitive(t *testing.T) {
+// Tool order and descriptions are provider-visible and therefore part of the
+// cacheable prefix identity.
+func TestComputePrefixFingerprintToolsHashMatchesEmittedOrderAndDescriptions(t *testing.T) {
 	opts := Options{Cwd: t.TempDir(), SystemPrompt: "core"}
 	a := []zeroruntime.ToolDefinition{
-		{Name: "read_file", Parameters: map[string]any{"schema": "schema-read"}},
-		{Name: "grep", Parameters: map[string]any{"schema": "schema-grep"}},
+		{Name: "read_file", Description: "read", Parameters: map[string]any{"schema": "schema-read"}},
+		{Name: "grep", Description: "search", Parameters: map[string]any{"schema": "schema-grep"}},
 	}
 	b := []zeroruntime.ToolDefinition{
-		{Name: "grep", Parameters: map[string]any{"schema": "schema-grep"}},
-		{Name: "read_file", Parameters: map[string]any{"schema": "schema-read"}},
+		{Name: "grep", Description: "search", Parameters: map[string]any{"schema": "schema-grep"}},
+		{Name: "read_file", Description: "read", Parameters: map[string]any{"schema": "schema-read"}},
 	}
-	// toolSubstrings sorts names internally, so the ToolsHash is identical
-	// for a permutation of the same tools. We assert that here to document
-	// the contract: name-order independence, name-set sensitivity.
 	fpA := ComputePrefixFingerprint(opts, a)
 	fpB := ComputePrefixFingerprint(opts, b)
-	if fpA.ToolsHash != fpB.ToolsHash {
-		t.Fatalf("ToolsHash must be name-set sensitive, not name-order sensitive: a=%s b=%s", fpA.ToolsHash, fpB.ToolsHash)
+	if fpA.ToolsHash == fpB.ToolsHash {
+		t.Fatalf("ToolsHash must change when emitted order changes: a=%s b=%s", fpA.ToolsHash, fpB.ToolsHash)
 	}
-	// A different tool set must produce a different ToolsHash.
-	c := append([]zeroruntime.ToolDefinition{}, a...)
-	c = append(c, zeroruntime.ToolDefinition{Name: "bash", Parameters: map[string]any{"schema": "schema-bash"}})
+	c := append([]zeroruntime.ToolDefinition(nil), a...)
+	c[0].Description = "read a file"
 	fpC := ComputePrefixFingerprint(opts, c)
 	if fpA.ToolsHash == fpC.ToolsHash {
-		t.Fatalf("ToolsHash must change when the tool set changes: a=%s c=%s", fpA.ToolsHash, fpC.ToolsHash)
+		t.Fatalf("ToolsHash must change when a description changes: a=%s c=%s", fpA.ToolsHash, fpC.ToolsHash)
 	}
 }
 
@@ -101,25 +91,35 @@ func TestComputePrefixFingerprintSystemPromptChangeChangesBaseHash(t *testing.T)
 	}
 }
 
-// TestComputePrefixFingerprintCompleteIsAggregateOfSubHashes asserts the
-// canonical-join property: CompletePrefixHash must depend on every sub-hash.
-// This is the regression catch for "did anyone reorder or drop a sub-hash
-// from the canonical join without updating CompletePrefixHash."
+// CompletePrefixHash represents the exact joined system prompt and the ordered
+// tool definitions. Narrower system-section hashes remain diagnostic only.
 func TestComputePrefixFingerprintCompleteIsAggregateOfSubHashes(t *testing.T) {
 	opts := Options{Cwd: t.TempDir(), SystemPrompt: "core"}
 	exposed := []zeroruntime.ToolDefinition{{Name: "read_file", Parameters: map[string]any{"k": "v"}}}
 	fp := ComputePrefixFingerprint(opts, exposed)
 	// Manually compute what the canonical join should be.
 	expected := sha256hex(strings.Join([]string{
-		fp.BaseInstructionsHash,
-		fp.ConfirmationPolicyHash,
-		fp.ProjectContextHash,
-		fp.SkillsHash,
+		fp.SystemPromptHash,
 		fp.ToolsHash,
 		fp.SchemaHash,
 	}, "|"))
 	if fp.CompletePrefixHash != expected {
-		t.Fatalf("CompletePrefixHash must equal sha256hex of the canonical join of the other six:\n  got:      %s\n  expected: %s", fp.CompletePrefixHash, expected)
+		t.Fatalf("CompletePrefixHash must equal sha256hex of the exact system, tools, and schema hashes:\n  got:      %s\n  expected: %s", fp.CompletePrefixHash, expected)
+	}
+}
+
+func TestComputePrefixFingerprintCoversEverySystemPromptSection(t *testing.T) {
+	base := Options{Cwd: t.TempDir(), SystemPrompt: "core", Model: "gpt-5"}
+	changed := base
+	changed.ResponseStyle = "concise"
+
+	fpBase := ComputePrefixFingerprint(base, nil)
+	fpChanged := ComputePrefixFingerprint(changed, nil)
+	if fpBase.SystemPromptHash == fpChanged.SystemPromptHash {
+		t.Fatal("SystemPromptHash must change when any rendered system section changes")
+	}
+	if fpBase.CompletePrefixHash == fpChanged.CompletePrefixHash {
+		t.Fatal("CompletePrefixHash must include the exact full system prompt")
 	}
 }
 
@@ -141,6 +141,9 @@ func TestBuildPromptSubstringsDefaultOptions(t *testing.T) {
 	if subs.baseInstructions != "test core" {
 		t.Fatalf("baseInstructions substring must equal the core system prompt: got %q want %q", subs.baseInstructions, "test core")
 	}
+	if subs.systemPrompt != buildSystemPrompt(opts) {
+		t.Fatal("systemPrompt substring must equal the exact joined system prompt")
+	}
 	if subs.confirmationPolicy == "" {
 		t.Fatalf("confirmationPolicy substring must be non-empty (the embedded policy is always present)")
 	}
@@ -151,6 +154,9 @@ func TestBuildPromptSubstringsDefaultOptions(t *testing.T) {
 	// sha256hex of the substrings, with no truncation or reformatting
 	// between the two layers.
 	fp := ComputePrefixFingerprint(opts, nil)
+	if fp.SystemPromptHash != sha256hex(subs.systemPrompt) {
+		t.Fatalf("SystemPromptHash in fingerprint must equal sha256hex of the joined prompt")
+	}
 	if fp.BaseInstructionsHash != sha256hex(subs.baseInstructions) {
 		t.Fatalf("BaseInstructionsHash in fingerprint must equal sha256hex of the substring")
 	}

internal/agent/system_prompt.go

@@ -70,6 +70,22 @@ const (
 // guidelines), and the safety confirmation policy. It is built once per run so
 // every turn shares one (cacheable) system turn.
 func buildSystemPrompt(options Options) string {
+	return buildSystemPromptParts(options).prompt
+}
+
+// systemPromptParts retains both the exact joined prompt and the diagnostic
+// sections used by prompt-prefix tracing. Building these together prevents the
+// tracing path from re-reading workspace state and guarantees that the hash is
+// computed from the same prompt bytes placed in the request.
+type systemPromptParts struct {
+	prompt             string
+	baseInstructions   string
+	confirmationPolicy string
+	projectContext     string
+	skills             string
+}
+
+func buildSystemPromptParts(options Options) systemPromptParts {
 	core := strings.TrimSpace(options.SystemPrompt)
 	if core == "" {
 		core = strings.TrimSpace(coreSystemPrompt)
@@ -97,22 +113,31 @@ func buildSystemPrompt(options Options) string {
 	if user := userGuidelines(); user != "" {
 		sections = append(sections, user)
 	}
-	if ws := workspaceContext(options.Cwd); ws != "" {
-		sections = append(sections, ws)
+	project := workspaceContext(options.Cwd)
+	if project != "" {
+		sections = append(sections, project)
 	}
 	if delegation := specialistDelegationContext(options); delegation != "" {
 		sections = append(sections, delegation)
 	}
-	if skillsBlock := skillsContext(options); skillsBlock != "" {
+	skillsBlock := skillsContext(options)
+	if skillsBlock != "" {
 		sections = append(sections, skillsBlock)
 	}
 	if style := responseStyleContext(options); style != "" {
 		sections = append(sections, style)
 	}
-	if policy := strings.TrimSpace(confirmationPolicy); policy != "" {
+	policy := strings.TrimSpace(confirmationPolicy)
+	if policy != "" {
 		sections = append(sections, policy)
 	}
-	return strings.Join(sections, "\n\n")
+	return systemPromptParts{
+		prompt:             strings.Join(sections, "\n\n"),
+		baseInstructions:   core,
+		confirmationPolicy: policy,
+		projectContext:     project,
+		skills:             skillsBlock,
+	}
 }
 
 // responseStyleContext renders the operator-selected reply style (TUI /style) as

internal/agent/task_state.go

@@ -0,0 +1,359 @@
+package agent
+
+import (
+	"encoding/json"
+	"reflect"
+	"sort"
+	"strings"
+
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/trace"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
+)
+
+type taskStatus string
+
+const (
+	taskStatusActive     taskStatus = "active"
+	taskStatusComplete   taskStatus = "complete"
+	taskStatusIncomplete taskStatus = "incomplete"
+)
+
+type taskPlanParity string
+
+const (
+	taskPlanParityUnknown  taskPlanParity = "unknown"
+	taskPlanParityMatch    taskPlanParity = "match"
+	taskPlanParityMismatch taskPlanParity = "mismatch"
+)
+
+type taskPlanItem struct {
+	Content string `json:"content"`
+	Status  string `json:"status"`
+	Notes   string `json:"notes,omitempty"`
+}
+
+type taskPlanState struct {
+	Items      []taskPlanItem `json:"items,omitempty"`
+	Pending    int            `json:"pending"`
+	InProgress int            `json:"in_progress"`
+	Completed  int            `json:"completed"`
+	Failed     int            `json:"failed"`
+}
+
+type taskToolState struct {
+	Succeeded int `json:"succeeded"`
+	Failed    int `json:"failed"`
+}
+
+type taskVerificationState struct {
+	Passed      int     `json:"passed"`
+	Failed      int     `json:"failed"`
+	LastOutcome Outcome `json:"last_outcome,omitempty"`
+}
+
+type taskStateSnapshot struct {
+	Revision           int                   `json:"revision"`
+	Objective          string                `json:"objective"`
+	Status             taskStatus            `json:"status"`
+	Plan               taskPlanState         `json:"plan"`
+	Tools              taskToolState         `json:"tools"`
+	Verification       taskVerificationState `json:"verification"`
+	ChangedFiles       []string              `json:"changed_files,omitempty"`
+	CompletionDecision CompletionDecision    `json:"completion_decision,omitempty"`
+	CompletionReason   string                `json:"completion_reason,omitempty"`
+	PlanParity         taskPlanParity        `json:"plan_parity"`
+}
+
+type taskStateEventKind int
+
+const (
+	taskStateEventPlan taskStateEventKind = iota + 1
+	taskStateEventToolResult
+	taskStateEventVerification
+	taskStateEventCompletion
+)
+
+type taskStateEvent struct {
+	kind         taskStateEventKind
+	arguments    string
+	toolResult   ToolResult
+	verification Outcome
+	completion   completionEvaluation
+}
+
+// taskState is a deterministic projection of facts the loop already observes.
+// It does not initiate work or replace the transcript; consumers must check
+// transcript parity before using its compact representation.
+type taskState struct {
+	snapshotValue taskStateSnapshot
+	changedFiles  map[string]struct{}
+	recorder      *trace.Recorder
+	planObserved  bool
+}
+
+func newTaskState(objective string, recorder *trace.Recorder) *taskState {
+	state := &taskState{
+		snapshotValue: taskStateSnapshot{
+			Objective:  strings.TrimSpace(objective),
+			Status:     taskStatusActive,
+			PlanParity: taskPlanParityUnknown,
+		},
+		changedFiles: map[string]struct{}{},
+	}
+	state.recorder = recorder
+	return state
+}
+
+func (state *taskState) observe(event taskStateEvent) bool {
+	if state == nil {
+		return false
+	}
+	changed := false
+	switch event.kind {
+	case taskStateEventPlan:
+		plan, ok := parseTaskPlan(event.arguments)
+		if !ok {
+			return false
+		}
+		state.snapshotValue.Plan = summarizeTaskPlan(plan)
+		state.planObserved = true
+		state.markActive()
+		changed = true
+	case taskStateEventToolResult:
+		state.markActive()
+		if event.toolResult.Status == tools.StatusOK {
+			state.snapshotValue.Tools.Succeeded++
+		} else {
+			state.snapshotValue.Tools.Failed++
+		}
+		for _, path := range event.toolResult.ChangedFiles {
+			path = strings.TrimSpace(path)
+			if path != "" {
+				state.changedFiles[path] = struct{}{}
+			}
+		}
+		state.snapshotValue.ChangedFiles = sortedKeys(state.changedFiles)
+		changed = true
+	case taskStateEventVerification:
+		if event.verification == OutcomeDisabled {
+			return false
+		}
+		state.markActive()
+		state.snapshotValue.Verification.LastOutcome = event.verification
+		switch event.verification {
+		case OutcomePassed:
+			state.snapshotValue.Verification.Passed++
+		case OutcomeCorrecting, OutcomeReported, OutcomeAborted:
+			state.snapshotValue.Verification.Failed++
+		}
+		changed = true
+	case taskStateEventCompletion:
+		state.snapshotValue.CompletionDecision = event.completion.Decision
+		state.snapshotValue.CompletionReason = event.completion.Reason
+		switch event.completion.Decision {
+		case CompletionComplete:
+			state.snapshotValue.Status = taskStatusComplete
+		case CompletionIncomplete:
+			state.snapshotValue.Status = taskStatusIncomplete
+		default:
+			state.snapshotValue.Status = taskStatusActive
+		}
+		changed = true
+	}
+	if changed {
+		state.snapshotValue.Revision++
+		if event.kind != taskStateEventToolResult {
+			state.emit()
+		}
+	}
+	return changed
+}
+
+func (state *taskState) markActive() {
+	state.snapshotValue.Status = taskStatusActive
+	state.snapshotValue.CompletionDecision = ""
+	state.snapshotValue.CompletionReason = ""
+}
+
+func (state *taskState) snapshot() taskStateSnapshot {
+	if state == nil {
+		return taskStateSnapshot{}
+	}
+	snapshot := state.snapshotValue
+	snapshot.Plan.Items = append([]taskPlanItem(nil), state.snapshotValue.Plan.Items...)
+	snapshot.ChangedFiles = append([]string(nil), state.snapshotValue.ChangedFiles...)
+	return snapshot
+}
+
+// observePlanParity compares only the latest plan projection with the plan tool
+// calls still present in messages. It mutates the snapshot and emits when the
+// parity value changes; objective, tool, and verification fields are not part of
+// this comparison.
+func (state *taskState) observePlanParity(messages []zeroruntime.Message) taskPlanParity {
+	if state == nil {
+		return taskPlanParityUnknown
+	}
+	transcriptPlan, found, valid := latestTaskPlan(messages)
+	tracked := state.snapshotValue.Plan.Items
+	parity := taskPlanParityMatch
+	if !valid || found != state.planObserved || (found && !reflect.DeepEqual(transcriptPlan, tracked)) {
+		parity = taskPlanParityMismatch
+	}
+	if state.snapshotValue.PlanParity != parity {
+		state.snapshotValue.PlanParity = parity
+		state.snapshotValue.Revision++
+		state.emit()
+	}
+	return parity
+}
+
+type completionContext struct {
+	Objective             string
+	PlanPending           bool
+	PlanMatchesTranscript bool
+}
+
+func (state *taskState) completionContext(messages []zeroruntime.Message, transcriptPlanPending bool) completionContext {
+	context := completionContext{PlanPending: transcriptPlanPending}
+	if state == nil {
+		return context
+	}
+	context.Objective = state.snapshotValue.Objective
+	context.PlanMatchesTranscript = state.observePlanParity(messages) == taskPlanParityMatch
+	if context.PlanMatchesTranscript {
+		context.PlanPending = state.snapshotValue.Plan.Pending+state.snapshotValue.Plan.InProgress > 0
+	}
+	return context
+}
+
+func (state *taskState) snapshotForCompaction(messages []zeroruntime.Message) *taskStateSnapshot {
+	if state == nil {
+		return nil
+	}
+	state.observePlanParity(messages)
+	snapshot := state.snapshot()
+	return &snapshot
+}
+
+func (state *taskState) emit() {
+	if state == nil || state.recorder == nil {
+		return
+	}
+	snapshot := state.snapshotValue
+	state.recorder.EmitTaskState(trace.TaskStateEvent{
+		Revision:            snapshot.Revision,
+		Status:              string(snapshot.Status),
+		PlanPending:         snapshot.Plan.Pending,
+		PlanInProgress:      snapshot.Plan.InProgress,
+		PlanCompleted:       snapshot.Plan.Completed,
+		PlanFailed:          snapshot.Plan.Failed,
+		ToolsSucceeded:      snapshot.Tools.Succeeded,
+		ToolsFailed:         snapshot.Tools.Failed,
+		VerificationPassed:  snapshot.Verification.Passed,
+		VerificationFailed:  snapshot.Verification.Failed,
+		VerificationOutcome: string(snapshot.Verification.LastOutcome),
+		ChangedFileCount:    len(snapshot.ChangedFiles),
+		CompletionDecision:  string(snapshot.CompletionDecision),
+		PlanParity:          string(snapshot.PlanParity),
+	})
+}
+
+func parseTaskPlan(arguments string) ([]taskPlanItem, bool) {
+	var object map[string]json.RawMessage
+	if json.Unmarshal([]byte(strings.TrimSpace(arguments)), &object) != nil {
+		return nil, false
+	}
+	rawPlan, ok := object["plan"]
+	if !ok || string(rawPlan) == "null" {
+		return nil, false
+	}
+	var parsed []struct {
+		ID      *string `json:"id"`
+		Content string  `json:"content"`
+		Status  string  `json:"status"`
+		Notes   string  `json:"notes"`
+	}
+	if json.Unmarshal(rawPlan, &parsed) != nil {
+		return nil, false
+	}
+	plan := make([]taskPlanItem, 0, len(parsed))
+	for _, raw := range parsed {
+		if raw.Content == "" {
+			return nil, false
+		}
+		plan = append(plan, taskPlanItem{
+			Content: raw.Content,
+			Status:  normalizeTaskPlanStatus(raw.Status),
+			Notes:   raw.Notes,
+		})
+	}
+	lastInProgress := -1
+	for index := range plan {
+		if plan[index].Status == "in_progress" {
+			if lastInProgress >= 0 {
+				plan[lastInProgress].Status = "completed"
+			}
+			lastInProgress = index
+		}
+	}
+	if len(plan) == 0 {
+		return nil, true
+	}
+	return plan, true
+}
+
+func normalizeTaskPlanStatus(status string) string {
+	switch strings.ToLower(strings.TrimSpace(status)) {
+	case "completed", "complete", "done", "finished", "resolved", "✓", "x", "[x]":
+		return "completed"
+	case "in_progress", "in-progress", "inprogress", "in progress", "active", "doing", "started", "current", "wip", "ongoing", "running":
+		return "in_progress"
+	case "failed", "fail", "error", "errored", "blocked", "cancelled", "canceled", "abandoned", "skipped":
+		return "failed"
+	default:
+		return "pending"
+	}
+}
+
+func summarizeTaskPlan(items []taskPlanItem) taskPlanState {
+	plan := taskPlanState{Items: append([]taskPlanItem(nil), items...)}
+	for _, item := range items {
+		switch item.Status {
+		case "completed":
+			plan.Completed++
+		case "in_progress":
+			plan.InProgress++
+		case "failed":
+			plan.Failed++
+		default:
+			plan.Pending++
+		}
+	}
+	return plan
+}
+
+func latestTaskPlan(messages []zeroruntime.Message) ([]taskPlanItem, bool, bool) {
+	for i := len(messages) - 1; i >= 0; i-- {
+		for j := len(messages[i].ToolCalls) - 1; j >= 0; j-- {
+			call := messages[i].ToolCalls[j]
+			if call.Name != planToolName {
+				continue
+			}
+			plan, ok := parseTaskPlan(call.Arguments)
+			return plan, true, ok
+		}
+	}
+	return nil, false, true
+}
+
+func sortedKeys(values map[string]struct{}) []string {
+	keys := make([]string, 0, len(values))
+	for value := range values {
+		keys = append(keys, value)
+	}
+	// Paths are evidence, not chronology. Stable ordering makes replay snapshots
+	// deterministic even if events originate from parallel read batches later.
+	sort.Strings(keys)
+	return keys
+}

internal/agent/task_state_test.go

@@ -0,0 +1,204 @@
+package agent
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/trace"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
+)
+
+func TestTaskStateReplayIsDeterministic(t *testing.T) {
+	events := []taskStateEvent{
+		{kind: taskStateEventPlan, arguments: `{"plan":[{"content":"inspect","status":"done"},{"content":"implement","status":"in progress"},{"content":"verify"}]}`},
+		{kind: taskStateEventToolResult, toolResult: ToolResult{Name: "apply_patch", Status: tools.StatusOK, ChangedFiles: []string{"a.go", "a.go", "b.go"}}},
+		{kind: taskStateEventToolResult, toolResult: ToolResult{Name: "go test", Status: tools.StatusError}},
+		{kind: taskStateEventVerification, verification: OutcomePassed},
+		{kind: taskStateEventCompletion, completion: completionEvaluation{Decision: CompletionUncertain, Reason: "pending work"}},
+	}
+
+	first := newTaskState("ship the change", nil)
+	second := newTaskState("ship the change", nil)
+	for _, event := range events {
+		first.observe(event)
+		second.observe(event)
+	}
+
+	if !reflect.DeepEqual(first.snapshot(), second.snapshot()) {
+		t.Fatalf("replaying the same events produced different snapshots:\nfirst:  %#v\nsecond: %#v", first.snapshot(), second.snapshot())
+	}
+	got := first.snapshot()
+	if got.Status != taskStatusActive || got.Plan.Pending != 1 || got.Plan.InProgress != 1 || got.Plan.Completed != 1 {
+		t.Fatalf("unexpected plan snapshot: %#v", got)
+	}
+	if got.Tools.Succeeded != 1 || got.Tools.Failed != 1 || len(got.ChangedFiles) != 2 {
+		t.Fatalf("unexpected evidence snapshot: %#v", got)
+	}
+	if got.Verification.Passed != 1 || got.Verification.Failed != 0 || got.Verification.LastOutcome != OutcomePassed {
+		t.Fatalf("unexpected verification snapshot: %#v", got.Verification)
+	}
+}
+
+func TestTaskStateCoalescesToolResultsIntoNextTraceEvent(t *testing.T) {
+	recorder := trace.NewRecorder("session", "run", "")
+	state := newTaskState("objective", recorder)
+	for range 20 {
+		state.observe(taskStateEvent{kind: taskStateEventToolResult, toolResult: ToolResult{Status: tools.StatusOK}})
+	}
+	if events := recorder.Finish().TaskStates; len(events) != 0 {
+		t.Fatalf("tool results should be coalesced, got %d trace events", len(events))
+	}
+
+	recorder = trace.NewRecorder("session", "run-2", "")
+	state = newTaskState("objective", recorder)
+	for range 20 {
+		state.observe(taskStateEvent{kind: taskStateEventToolResult, toolResult: ToolResult{Status: tools.StatusOK}})
+	}
+	state.observe(taskStateEvent{kind: taskStateEventCompletion, completion: completionEvaluation{Decision: CompletionComplete}})
+	events := recorder.Finish().TaskStates
+	if len(events) != 1 || events[0].ToolsSucceeded != 20 {
+		t.Fatalf("coalesced tool total missing from completion snapshot: %#v", events)
+	}
+}
+
+func TestRunEmitsTaskStateFromExistingLoopEvents(t *testing.T) {
+	registry := tools.NewRegistry()
+	registry.Register(tools.NewUpdatePlanTool())
+	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{
+		{
+			{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "plan-1", ToolName: planToolName},
+			{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "plan-1", ArgumentsFragment: `{"plan":[{"content":"implement","status":"completed"}]}`},
+			{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "plan-1"},
+			{Type: zeroruntime.StreamEventDone},
+		},
+		{
+			{Type: zeroruntime.StreamEventText, Content: "done"},
+			{Type: zeroruntime.StreamEventDone},
+		},
+	}}
+	recorder := trace.NewRecorder("session", "run", "")
+
+	result, err := Run(context.Background(), "implement the change", provider, Options{
+		Registry: registry,
+		Trace:    recorder,
+	})
+	if err != nil {
+		t.Fatalf("Run: %v", err)
+	}
+	if result.FinalAnswer != "done" {
+		t.Fatalf("final answer = %q, want done", result.FinalAnswer)
+	}
+	events := recorder.Finish().TaskStates
+	if len(events) < 3 {
+		t.Fatalf("expected plan, tool, completion, and parity snapshots, got %#v", events)
+	}
+	last := events[len(events)-1]
+	if last.Status != string(taskStatusComplete) || last.PlanCompleted != 1 || last.ToolsSucceeded != 1 || last.PlanParity != string(taskPlanParityMatch) {
+		t.Fatalf("unexpected final task snapshot: %#v", last)
+	}
+}
+
+func TestTaskStateSnapshotIsImmutable(t *testing.T) {
+	state := newTaskState("objective", nil)
+	state.observe(taskStateEvent{kind: taskStateEventPlan, arguments: `{"plan":[{"content":"one","status":"pending"}]}`})
+	state.observe(taskStateEvent{kind: taskStateEventToolResult, toolResult: ToolResult{Status: tools.StatusOK, ChangedFiles: []string{"one.go"}}})
+
+	snapshot := state.snapshot()
+	snapshot.Plan.Items[0].Content = "mutated"
+	snapshot.ChangedFiles[0] = "mutated.go"
+
+	fresh := state.snapshot()
+	if fresh.Plan.Items[0].Content != "one" || fresh.ChangedFiles[0] != "one.go" {
+		t.Fatalf("snapshot mutation leaked into task state: %#v", fresh)
+	}
+}
+
+func TestTaskStatePlanParityUsesLatestPlan(t *testing.T) {
+	state := newTaskState("objective", nil)
+	state.observe(taskStateEvent{kind: taskStateEventPlan, arguments: `{"plan":[{"content":"old","status":"completed"}]}`})
+	state.observe(taskStateEvent{kind: taskStateEventPlan, arguments: `{"plan":[{"content":"new","status":"in_progress"}]}`})
+
+	messages := []zeroruntime.Message{{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{
+		{Name: planToolName, Arguments: `{"plan":[{"content":"new","status":"in_progress"}]}`},
+	}}}
+	if parity := state.observePlanParity(messages); parity != taskPlanParityMatch {
+		t.Fatalf("parity = %q, want match", parity)
+	}
+
+	messages[0].ToolCalls[0].Arguments = `{"plan":[{"content":"different","status":"pending"}]}`
+	if parity := state.observePlanParity(messages); parity != taskPlanParityMismatch {
+		t.Fatalf("parity = %q, want mismatch", parity)
+	}
+}
+
+func TestTaskStateMatchesPlanToolNormalization(t *testing.T) {
+	state := newTaskState("objective", nil)
+	arguments := `{"plan":[{"content":"first","status":"in_progress"},{"content":"second","status":"in_progress"}]}`
+	state.observe(taskStateEvent{kind: taskStateEventPlan, arguments: arguments})
+
+	snapshot := state.snapshot()
+	if snapshot.Plan.Completed != 1 || snapshot.Plan.InProgress != 1 {
+		t.Fatalf("multiple active items were not normalized like the plan tool: %#v", snapshot.Plan)
+	}
+	messages := []zeroruntime.Message{{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{{Name: planToolName, Arguments: arguments}}}}
+	if parity := state.observePlanParity(messages); parity != taskPlanParityMatch {
+		t.Fatalf("normalized state should still match its transcript event, got %q", parity)
+	}
+
+	empty := newTaskState("objective", nil)
+	empty.observe(taskStateEvent{kind: taskStateEventPlan, arguments: `{"plan":[]}`})
+	emptyMessages := []zeroruntime.Message{{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{{Name: planToolName, Arguments: `{"plan":[]}`}}}}
+	if parity := empty.observePlanParity(emptyMessages); parity != taskPlanParityMatch {
+		t.Fatalf("explicit empty plan should match transcript, got %q", parity)
+	}
+}
+
+func TestTaskStateContextFallsBackWhenTranscriptDiffers(t *testing.T) {
+	state := newTaskState("objective", nil)
+	state.observe(taskStateEvent{kind: taskStateEventPlan, arguments: `{"plan":[{"content":"tracked","status":"completed"}]}`})
+	messages := []zeroruntime.Message{{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{
+		{Name: planToolName, Arguments: `{"plan":[{"content":"transcript","status":"pending"}]}`},
+	}}}
+
+	context := state.completionContext(messages, true)
+	if !context.PlanPending || context.PlanMatchesTranscript {
+		t.Fatalf("completion context must retain transcript truth on mismatch: %#v", context)
+	}
+	if context.Objective != "objective" {
+		t.Fatalf("objective lost from completion context: %#v", context)
+	}
+}
+
+func TestTaskStateCompactionSnapshotRetainsObjectiveOnPlanMismatch(t *testing.T) {
+	state := newTaskState("objective", nil)
+	state.observe(taskStateEvent{kind: taskStateEventPlan, arguments: `{"plan":[{"content":"verify","status":"pending"}]}`})
+	matching := []zeroruntime.Message{{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{
+		{Name: planToolName, Arguments: `{"plan":[{"content":"verify","status":"pending"}]}`},
+	}}}
+	if snapshot := state.snapshotForCompaction(matching); snapshot == nil || snapshot.Objective != "objective" {
+		t.Fatalf("matching transcript should produce compact state, got %#v", snapshot)
+	}
+
+	mismatching := append([]zeroruntime.Message(nil), matching...)
+	mismatching[0].ToolCalls = []zeroruntime.ToolCall{{Name: planToolName, Arguments: `{"plan":[{"content":"other","status":"pending"}]}`}}
+	if snapshot := state.snapshotForCompaction(mismatching); snapshot == nil || snapshot.Objective != "objective" || snapshot.PlanParity != taskPlanParityMismatch {
+		t.Fatalf("plan mismatch must retain immutable objective and mark mutable state uncorroborated, got %#v", snapshot)
+	}
+}
+
+func TestParseTaskPlanRejectsArgumentsTheToolWouldReject(t *testing.T) {
+	for _, arguments := range []string{
+		`{}`,
+		`{"plan":null}`,
+		`{"plan":[{"step":"alias is not accepted"}]}`,
+		`{"plan":[{"content":""}]}`,
+		`{"plan":[{"content":"valid"},{"content":""}]}`,
+		`{"plan":[{"id":4,"content":"valid"}]}`,
+	} {
+		if plan, ok := parseTaskPlan(arguments); ok {
+			t.Fatalf("parseTaskPlan(%s) = %#v, true; want rejected", arguments, plan)
+		}
+	}
+}

internal/cli/exec_sessions.go

@@ -72,8 +72,11 @@ func preflightExecSession(options execOptions) error {
 		if session == nil {
 			return execUsageError{"Zero session not found: " + options.resume}
 		}
+		if !sessions.IsResumableKind(session.SessionKind) {
+			return execUsageError{"Zero session is not resumable: " + options.resume}
+		}
 	case options.resumeLatest:
-		latest, err := store.Latest()
+		latest, err := store.LatestResumable()
 		if err != nil {
 			return err
 		}

internal/cli/exec_sessions_test.go

@@ -0,0 +1,26 @@
+package cli
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/Gitlawb/zero/internal/sessions"
+)
+
+func TestPreflightRejectsSideSessions(t *testing.T) {
+	t.Setenv("XDG_DATA_HOME", t.TempDir())
+	store := sessions.NewStore(sessions.StoreOptions{})
+	if _, err := store.Create(sessions.CreateInput{SessionID: "side", SessionKind: sessions.SessionKindSide}); err != nil {
+		t.Fatalf("create side session: %v", err)
+	}
+
+	err := preflightExecSession(execOptions{resumeLatest: true})
+	if err == nil || !strings.Contains(err.Error(), "No Zero sessions available to resume") {
+		t.Fatalf("preflightExecSession error = %v, want no resumable sessions", err)
+	}
+
+	err = preflightExecSession(execOptions{resume: "side"})
+	if err == nil || !strings.Contains(err.Error(), "Zero session is not resumable: side") {
+		t.Fatalf("explicit side-session preflight error = %v, want non-resumable rejection", err)
+	}
+}

internal/cli/sessions.go

@@ -216,10 +216,10 @@ func parseNonEmptySessionsFlag(flag string, value string) (string, error) {
 func parseSessionKindFlag(value string) (sessions.SessionKind, error) {
 	kind := sessions.SessionKind(strings.ToLower(strings.TrimSpace(value)))
 	switch kind {
-	case sessions.SessionKindFork, sessions.SessionKindChild, sessions.SessionKindSpecDraft, sessions.SessionKindSpecImpl:
+	case sessions.SessionKindFork, sessions.SessionKindChild, sessions.SessionKindSide, sessions.SessionKindSpecDraft, sessions.SessionKindSpecImpl:
 		return kind, nil
 	default:
-		return "", execUsageError{fmt.Sprintf("invalid --kind %q. Expected fork, child, spec-draft, or spec-impl.", value)}
+		return "", execUsageError{fmt.Sprintf("invalid --kind %q. Expected fork, child, side, spec-draft, or spec-impl.", value)}
 	}
 }
 
@@ -535,7 +535,7 @@ Commands:
 
 Flags:
       --json            Print JSON output
-      --kind <kind>     Filter list by fork, child, spec-draft, or spec-impl
+      --kind <kind>     Filter list by fork, child, side, spec-draft, or spec-impl
       --sequence <n>    Rewind target sequence (rewind-plan, rewind)
       --event <id>      Rewind target event id (rewind-plan, rewind)
       --exclude-target  Drop the target event (rewind-plan, rewind)

internal/cli/sessions_test.go

@@ -233,6 +233,9 @@ func TestRunSessionsListFiltersByKind(t *testing.T) {
 	}); err != nil {
 		t.Fatal(err)
 	}
+	if _, err := store.Create(sessions.CreateInput{SessionID: "side", SessionKind: sessions.SessionKindSide, Title: "BTW side"}); err != nil {
+		t.Fatal(err)
+	}
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
@@ -249,6 +252,17 @@ func TestRunSessionsListFiltersByKind(t *testing.T) {
 		t.Fatalf("filtered sessions output = %q", output)
 	}
 
+	stdout.Reset()
+	stderr.Reset()
+	exitCode = runWithDeps([]string{"sessions", "list", "--kind", "side"}, &stdout, &stderr, appDeps{
+		newSessionStore: func() *sessions.Store {
+			return store
+		},
+	})
+	if exitCode != exitSuccess || !strings.Contains(stdout.String(), "side") || strings.Contains(stdout.String(), "regular") {
+		t.Fatalf("sessions list --kind side exit=%d stdout=%q stderr=%q", exitCode, stdout.String(), stderr.String())
+	}
+
 	stdout.Reset()
 	stderr.Reset()
 	exitCode = runWithDeps([]string{"sessions", "tree", "draft", "--kind", "spec-draft"}, &stdout, &stderr, appDeps{

internal/perfbench/turn_bench.go

@@ -578,28 +578,54 @@ func WriteTurnBenchJSON(w io.Writer, result TurnBenchResult) error {
 	return encoder.Encode(result)
 }
 
+// execExitIncomplete mirrors internal/cli.exitIncomplete (the `zero exec` exit
+// code, 4) for a headless run the completion gate marked INCOMPLETE: the run
+// stopped without a completion signal (e.g. it couldn't self-verify because its
+// sandboxed shell was unavailable under --auto member), which is distinct from a
+// crash (1), usage error (2), provider failure (3), or interruption (130). It is
+// the ONLY nonzero exit an oracle-bearing task may defer to the oracle for; every
+// other nonzero exit stays authoritative. Kept as a local literal so perfbench
+// doesn't import the cli package; must stay in sync with that constant.
+const execExitIncomplete = 4
+
 // NewTurnExecRunner builds the production turn-benchmark runner: it invokes
 // headless `zero exec` with stream-json output AND `--trace <tmpfile>`, then
 // parses the emitted NDJSON trace into a *trace.TurnTrace. binary is the path to
 // the `zero` binary; extraArgs are appended to every invocation. Pass/fail is
-// decided from the stream-json run_end exit code (and the task's
-// VerificationCommand when present), exactly like NewExecRunner.
+// decided by the task's oracle when it has one. The oracle that gates the verdict
+// is the VerificationCommand (which compiles and runs the stamped OracleTest via
+// `go test`, plus any greps against the fixture); it is ground truth, so an
+// oracle-bearing task that applied the right edit but exited INCOMPLETE (exit 4,
+// its sandboxed self-verification couldn't run) still passes. Any OTHER nonzero
+// exit (crash/usage/provider/interrupt) stays authoritative and fails even an
+// oracle-bearing task. A latency-only task has no VerificationCommand, so any
+// nonzero exit is its only signal and fails it.
 func NewTurnExecRunner(binary string, extraArgs ...string) TurnRunner {
 	return func(ctx context.Context, task BenchTask, rc RunContext) TurnTaskOutcome {
+		// buildTurnExecArgs grants the write + sandboxed-shell tool set to EVERY
+		// invocation, so a task MUST run inside an isolated fixture copy — never the
+		// caller's cwd. The grant is unconditional, so the isolation can't be
+		// optional: a fixtureless task would turn an agent with write/shell tools
+		// loose in the caller's working directory (their real repo). Enforce the
+		// invariant instead of trusting it — reject a fixtureless task up front,
+		// before anything is launched, so the grant and the guard can't drift apart.
+		// Every shipped task declares a fixture, so this only fires on a malformed or
+		// newly added task, and it fails loudly rather than silently.
+		if strings.TrimSpace(task.WorkspaceFixture) == "" {
+			return TurnTaskOutcome{Err: errors.New("benchmark task has no workspaceFixture: the run grants write/shell tools and must execute in an isolated fixture copy, not the caller's cwd")}
+		}
 		// Isolate the workspace: copy the fixture into a fresh temp dir so a
 		// mutating task (edit/fix/refactor) can't dirty the shared, checked-in
-		// fixture or bleed into a later iteration of the same task. When no
-		// fixture is configured the agent runs in the caller's cwd as before.
-		if fixture := strings.TrimSpace(task.WorkspaceFixture); fixture != "" {
-			copyDir, parent, cerr := copyFixture(fixture)
-			if cerr != nil {
-				return TurnTaskOutcome{Err: fmt.Errorf("isolate fixture: %w", cerr)}
-			}
-			// Clean the whole unique parent (which owns copyDir) so the
-			// per-invocation scratch dir never leaks.
-			defer os.RemoveAll(parent)
-			task.WorkspaceFixture = copyDir
+		// fixture or bleed into a later iteration of the same task. The guard above
+		// guarantees WorkspaceFixture is set, so this always runs.
+		copyDir, parent, cerr := copyFixture(strings.TrimSpace(task.WorkspaceFixture))
+		if cerr != nil {
+			return TurnTaskOutcome{Err: fmt.Errorf("isolate fixture: %w", cerr)}
 		}
+		// Clean the whole unique parent (which owns copyDir) so the per-invocation
+		// scratch dir never leaks.
+		defer os.RemoveAll(parent)
+		task.WorkspaceFixture = copyDir
 
 		traceFile, err := os.CreateTemp("", "zero-turn-trace-*.ndjson")
 		if err != nil {
@@ -656,10 +682,23 @@ func NewTurnExecRunner(binary string, extraArgs ...string) TurnRunner {
 			}
 		}
 
-		// A nonzero agent exit already decided failure; don't run verification or
-		// mark the task passed.
+		// Decide what a nonzero exit means. We defer to the oracle for exactly ONE
+		// case: an oracle-bearing task that exited INCOMPLETE (exit 4). That is the
+		// completion gate downgrading a run whose edits may be correct but that
+		// couldn't emit a completion signal (e.g. its sandboxed self-verify couldn't
+		// run under --auto member) — the oracle below (the compiled test / grep run
+		// against the actual fixture files) is ground truth, so if the edit really
+		// landed it passes, and if the run abandoned the task the oracle fails it.
+		// Every OTHER nonzero exit stays authoritative: a crash (1), usage error
+		// (2), provider failure (3), or interruption (130) is a genuine failure, so
+		// a partial edit that happens to satisfy the oracle can't launder it into a
+		// pass. A latency-only task has no oracle to defer to, so any nonzero exit
+		// fails it.
 		if outcome.VerifyErr != "" {
-			return outcome
+			if len(task.VerificationCommand) == 0 || exitCode != execExitIncomplete {
+				return outcome
+			}
+			outcome.VerifyErr = ""
 		}
 		// Stamp the compiler-backed oracle and capture the agent's final answer
 		// BEFORE running the verification command. Both write into the fixture
@@ -790,7 +829,23 @@ func stampOracleAndAnswer(task BenchTask, outBuf []byte) error {
 }
 
 func buildTurnExecArgs(task BenchTask, rc RunContext, tracePath string, extraArgs []string) []string {
-	args := []string{"exec", "--output-format", "stream-json", "--trace", tracePath}
+	// --auto member is REQUIRED, not optional: without a permission grant `zero
+	// exec` runs in its default read-only posture, which exposes no write or shell
+	// tools (no edit_file/apply_patch/write_file/exec_command/bash). The mutating
+	// task classes (edit/fix/refactor) then cannot apply any change, so every run
+	// grinds to the turn ceiling or reports a no-tool blocker, and the only tasks
+	// that "pass" are ones whose oracle grep matches the stamped answer text rather
+	// than a real edit. member-auto grants the write + sandboxed-shell tools the
+	// benchmark needs while keeping the workspace/network/destructive safeguards, so
+	// it is preferred over the broader --skip-permissions-unsafe (which also drops
+	// those guards and auto-retries blocked commands unsandboxed). Note the shell it
+	// grants is sandboxed: on a host without sandbox setup the agent's own
+	// self-verification (go test/build) can't run and the turn exits INCOMPLETE even
+	// after a correct edit — the runner treats the stamped oracle, not that exit
+	// code, as ground truth for oracle-bearing tasks (see NewTurnExecRunner), so a
+	// correct edit still passes. Each task also runs in an isolated, throwaway
+	// fixture copy, so the granted tools have nothing outside the task to harm.
+	args := []string{"exec", "--auto", "member", "--output-format", "stream-json", "--trace", tracePath}
 	if model := strings.TrimSpace(rc.Model); model != "" {
 		args = append(args, "--model", model)
 	}

internal/perfbench/turn_bench_test.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -750,6 +751,92 @@ echo '{"type":"run_end","exitCode":0}'
 	}
 }
 
+// TestOracleAuthoritativeOnIncompleteExit is the companion to the --auto member
+// switch: under member-auto the agent's shell is sandboxed, so on a host without
+// sandbox setup its self-verification (go test/build) can't run and the turn
+// exits INCOMPLETE (exit 4) even after a correct edit. For an ORACLE-bearing task
+// the runner must treat the stamped oracle — not that INCOMPLETE exit — as ground
+// truth: here the stub applies the real edit-01 rename but reports exitCode 4, and
+// the task must still pass because the fixture is correct. This defers ONLY for
+// exit 4; TestNonIncompleteExitStaysAuthoritative pins the other side.
+func TestOracleAuthoritativeOnIncompleteExit(t *testing.T) {
+	task := loadBaselineTask(t, "edit-01")
+	outcome := runTurnStub(t, task, `sed 's/const MaxRetries = 3/const RetryLimit = 3/' main.go > .zero-tmp && mv .zero-tmp main.go
+echo '{"type":"run_end","exitCode":4}'
+`)
+	if outcome.Err != nil {
+		t.Fatalf("incomplete-exit with a correct edit should pass, got harness error: %v", outcome.Err)
+	}
+	if !outcome.Passed {
+		t.Fatalf("a correct edit that exited INCOMPLETE (exit 4) must still pass its oracle: %+v", outcome)
+	}
+	if strings.TrimSpace(outcome.VerifyErr) != "" {
+		t.Fatalf("a passing oracle must clear the exit-code VerifyErr, got %q", outcome.VerifyErr)
+	}
+}
+
+// TestNonIncompleteExitStaysAuthoritative is the guard the oracle-authoritative
+// change MUST NOT weaken: only INCOMPLETE (exit 4) defers to the oracle. A crash
+// (1), provider failure (3), or interruption (130) is a genuine failure, so it
+// stays authoritative even for an oracle-bearing task — otherwise a partial edit
+// that happens to satisfy the oracle would launder a crashed or interrupted run
+// into a pass. Each case applies the CORRECT edit-01 rename (so the oracle WOULD
+// pass) but reports the failing exit code; the task must still fail, and the
+// failure must be attributed to the exit code, not the oracle.
+func TestNonIncompleteExitStaysAuthoritative(t *testing.T) {
+	for _, code := range []int{1, 3, 130} {
+		t.Run(fmt.Sprintf("exit%d", code), func(t *testing.T) {
+			task := loadBaselineTask(t, "edit-01")
+			outcome := runTurnStub(t, task, fmt.Sprintf(`sed 's/const MaxRetries = 3/const RetryLimit = 3/' main.go > .zero-tmp && mv .zero-tmp main.go
+echo '{"type":"run_end","exitCode":%d}'
+`, code))
+			if outcome.Err != nil {
+				t.Fatalf("a nonzero exit should be a task fail, not a harness error: %v", outcome.Err)
+			}
+			if outcome.Passed {
+				t.Fatalf("a run that exited %d must not pass even when the edit satisfies the oracle: %+v", code, outcome)
+			}
+			if want := fmt.Sprintf("exit code %d", code); !strings.Contains(outcome.VerifyErr, want) {
+				t.Fatalf("a non-INCOMPLETE nonzero exit must stay authoritative and surface its code, got VerifyErr=%q", outcome.VerifyErr)
+			}
+		})
+	}
+}
+
+// TestIncompleteExitStillFailsWhenOracleFails pins the OTHER half of the exit-4
+// deferral: deferring to the oracle on INCOMPLETE must still MEAN the oracle is
+// consulted, not a blanket pass. Here the stub does no real work and exits
+// INCOMPLETE (4); the edit-01 rename never happened, so the oracle fails and the
+// task fails. Without this, a regression that turned exit 4 into an unconditional
+// pass would slip through, because its sibling TestOracleAuthoritativeOnIncomplete-
+// Exit applies a CORRECT edit and would pass either way.
+func TestIncompleteExitStillFailsWhenOracleFails(t *testing.T) {
+	task := loadBaselineTask(t, "edit-01")
+	outcome := runTurnStub(t, task, `echo '{"type":"run_end","exitCode":4}'
+`)
+	assertVerifyFailed(t, "incomplete exit with no edit applied", outcome)
+}
+
+// TestNonzeroExitStillFailsLatencyOnly is the guard on the other side of that
+// change: a latency-only task has no oracle to appeal to, so the exit code is
+// the ONLY correctness signal and a nonzero exit must still fail it. Without
+// this, dropping the exit-code gate for oracle tasks could be misread as
+// dropping it everywhere.
+func TestNonzeroExitStillFailsLatencyOnly(t *testing.T) {
+	task := loadBaselineTask(t, "longproc-01")
+	outcome := runTurnStub(t, task, `echo '{"type":"run_end","exitCode":4}'
+`)
+	if outcome.Err != nil {
+		t.Fatalf("latency-only nonzero exit should be a verify fail, not a harness error: %v", outcome.Err)
+	}
+	if outcome.Passed {
+		t.Fatalf("a latency-only task that exited nonzero must not pass: %+v", outcome)
+	}
+	if strings.TrimSpace(outcome.VerifyErr) == "" {
+		t.Fatalf("a latency-only nonzero exit must surface a VerifyErr, got none: %+v", outcome)
+	}
+}
+
 // --- Satisfiable tests: the oracle PASSES the right thing (real fix applied) ---
 
 // TestStampedOraclePassesWhenRefactorHappened proves the refactor-01 oracle is
@@ -1192,6 +1279,57 @@ func TestBuildTurnExecArgsIncludesExecProfile(t *testing.T) {
 	}
 }
 
+// Every benchmark invocation MUST grant the write/shell tool set via --auto
+// member. Without a permission grant the agent runs read-only and cannot apply
+// any edit, so the mutating classes measure nothing but oracle/answer
+// contamination. member-auto is the RIGHT grant: it exposes the write +
+// sandboxed-shell tools the benchmark needs while keeping the workspace/network/
+// destructive safeguards, so the args must NOT reach for the broader
+// --skip-permissions-unsafe (which drops those guards). This is a correctness
+// contract, not a preference.
+func TestBuildTurnExecArgsGrantsWriteTools(t *testing.T) {
+	args := buildTurnExecArgs(BenchTask{ID: "t", Prompt: "edit the file"}, RunContext{Model: "m"}, "trace.ndjson", nil)
+	autoMember := false
+	for i := 0; i < len(args)-1; i++ {
+		if args[i] == "--auto" && args[i+1] == "member" {
+			autoMember = true
+			break
+		}
+	}
+	if !autoMember {
+		t.Fatalf("benchmark exec args must include --auto member so the agent can apply edits, got %v", args)
+	}
+	for _, arg := range args {
+		if arg == "--skip-permissions-unsafe" {
+			t.Fatalf("benchmark exec args must NOT use --skip-permissions-unsafe (member-auto keeps the sandbox/network guards), got %v", args)
+		}
+	}
+	if args[len(args)-1] != "edit the file" {
+		t.Fatalf("prompt must stay the last argument, got %v", args)
+	}
+}
+
+// TestTurnRunnerRejectsFixturelessTask is the other half of the write-tools
+// contract: because buildTurnExecArgs grants the write + sandboxed-shell tool
+// set to every invocation, a task with no fixture would run an agent with those
+// tools in the caller's cwd. The runner must reject such a task BEFORE launching
+// zero exec. Passing a binary path that does not exist proves the rejection is
+// pre-launch — the outcome carries the fixture error, not a spawn error — so this
+// runs on every OS (it never reaches the POSIX-only exec stub).
+func TestTurnRunnerRejectsFixturelessTask(t *testing.T) {
+	task := BenchTask{ID: "no-fixture", Prompt: "do a thing"} // no WorkspaceFixture set
+	outcome := NewTurnExecRunner(filepath.Join(t.TempDir(), "does-not-exist-zero"))(context.Background(), task, RunContext{Model: "m"})
+	if outcome.Err == nil {
+		t.Fatalf("a fixtureless task must be rejected before launch, got %+v", outcome)
+	}
+	if !strings.Contains(outcome.Err.Error(), "workspaceFixture") {
+		t.Fatalf("rejection must name the missing workspaceFixture, got: %v", outcome.Err)
+	}
+	if outcome.Passed {
+		t.Fatalf("a rejected task must not pass, got %+v", outcome)
+	}
+}
+
 // The configured profile must reach the runner's RunContext and be stamped
 // into the result, so a profile A/B report is self-describing. The boundary
 // canonicalizes (case/whitespace) so equivalent postures always carry the same

internal/providers/openai/provider_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -1375,3 +1376,61 @@ func TestOpenAIRequestPromptCacheKey(t *testing.T) {
 		}
 	}
 }
+
+func TestOpenAIRequestPreservesCacheablePrefixAcrossTurns(t *testing.T) {
+	provider, err := New(Options{Model: "gpt-test"})
+	if err != nil {
+		t.Fatalf("New returned error: %v", err)
+	}
+	tools := []zeroruntime.ToolDefinition{{
+		Name:        "read_file",
+		Description: "Read a file.",
+		Parameters: map[string]any{
+			"type": "object",
+			"properties": map[string]any{
+				"path": map[string]any{"type": "string"},
+			},
+		},
+	}}
+	firstMessages := []zeroruntime.Message{
+		{Role: zeroruntime.MessageRoleSystem, Content: "stable system prompt"},
+		{Role: zeroruntime.MessageRoleUser, Content: "first turn"},
+	}
+	secondMessages := append([]zeroruntime.Message(nil), firstMessages...)
+	secondMessages = append(secondMessages,
+		zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, Content: "first response"},
+		zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "second turn"},
+	)
+
+	marshalBody := func(messages []zeroruntime.Message) map[string]any {
+		t.Helper()
+		mapped := provider.openAIRequest(zeroruntime.CompletionRequest{
+			Messages:       messages,
+			Tools:          tools,
+			PromptCacheKey: "session-stable-prefix",
+		})
+		data, marshalErr := json.Marshal(mapped)
+		if marshalErr != nil {
+			t.Fatalf("marshal request: %v", marshalErr)
+		}
+		var body map[string]any
+		if unmarshalErr := json.Unmarshal(data, &body); unmarshalErr != nil {
+			t.Fatalf("unmarshal request: %v", unmarshalErr)
+		}
+		return body
+	}
+
+	first := marshalBody(firstMessages)
+	second := marshalBody(secondMessages)
+	firstWireMessages := first["messages"].([]any)
+	secondWireMessages := second["messages"].([]any)
+	if !reflect.DeepEqual(secondWireMessages[:len(firstWireMessages)], firstWireMessages) {
+		t.Fatalf("first wire messages must be an exact prefix of the second:\nfirst=%#v\nsecond=%#v", firstWireMessages, secondWireMessages)
+	}
+	if !reflect.DeepEqual(first["tools"], second["tools"]) {
+		t.Fatalf("wire tool definitions drifted:\nfirst=%#v\nsecond=%#v", first["tools"], second["tools"])
+	}
+	if first["prompt_cache_key"] != second["prompt_cache_key"] || first["prompt_cache_key"] != "session-stable-prefix" {
+		t.Fatalf("wire prompt cache key must remain stable: first=%#v second=%#v", first["prompt_cache_key"], second["prompt_cache_key"])
+	}
+}

internal/sessions/exec_session.go

@@ -89,7 +89,7 @@ func PrepareExec(options PrepareExecOptions) (PreparedExec, error) {
 	if resumeID != "" || options.ResumeLatest {
 		sessionID := resumeID
 		if sessionID == "" && options.ResumeLatest {
-			latest, err := store.Latest()
+			latest, err := store.LatestResumable()
 			if err != nil {
 				return PreparedExec{}, err
 			}
@@ -105,6 +105,9 @@ func PrepareExec(options PrepareExecOptions) (PreparedExec, error) {
 		if session == nil {
 			return PreparedExec{}, ExecError{"Zero session not found: " + sessionID}
 		}
+		if !IsResumableKind(session.SessionKind) {
+			return PreparedExec{}, ExecError{"Zero session is not resumable: " + sessionID}
+		}
 		contextEvents, err := readExecContextEvents(store, session.SessionID)
 		if err != nil {
 			return PreparedExec{}, err

internal/sessions/store.go

@@ -52,6 +52,7 @@ type SessionKind string
 const (
 	SessionKindFork      SessionKind = "fork"
 	SessionKindChild     SessionKind = "child"
+	SessionKindSide      SessionKind = "side"
 	SessionKindSpecDraft SessionKind = "spec-draft"
 	SessionKindSpecImpl  SessionKind = "spec-impl"
 )
@@ -125,11 +126,13 @@ type CreateInput struct {
 }
 
 type ForkInput struct {
-	SessionID string
-	Title     string
-	Cwd       string
-	ModelID   string
-	Provider  string
+	SessionID   string
+	SessionKind SessionKind
+	Title       string
+	Cwd         string
+	ModelID     string
+	Provider    string
+	Tag         string
 }
 
 type ChildInput struct {
@@ -354,10 +357,9 @@ func (store *Store) Latest() (*Metadata, error) {
 }
 
 // IsResumableKind reports whether a session kind represents a standalone,
-// user-resumable conversation rather than an agent sub-run. Regular ("") and
-// user fork sessions are resumable; child (specialist/sub-agent) and spec
-// draft/impl sessions are not — each agent task and /spec run creates one, so
-// listing them in the resume picker floods it with non-conversation entries.
+// user-resumable conversation rather than a transient or agent-owned sub-run.
+// Regular ("") and user fork sessions are resumable; side, child, and spec
+// sessions are not, so they do not flood the resume picker.
 func IsResumableKind(kind SessionKind) bool {
 	switch kind {
 	case "", SessionKindFork:
@@ -418,13 +420,21 @@ func (store *Store) Fork(parentSessionID string, input ForkInput) (Metadata, err
 	if title == "" && parent.Title != "" {
 		title = parent.Title + " (fork)"
 	}
+	kind := input.SessionKind
+	if kind == "" {
+		kind = SessionKindFork
+	}
+	if kind != SessionKindFork && kind != SessionKindSide {
+		return Metadata{}, fmt.Errorf("invalid zero fork session kind %q", kind)
+	}
 	fork, err := store.Create(CreateInput{
 		SessionID:          input.SessionID,
-		SessionKind:        SessionKindFork,
+		SessionKind:        kind,
 		Title:              title,
 		Cwd:                firstNonEmpty(input.Cwd, parent.Cwd),
 		ModelID:            firstNonEmpty(input.ModelID, parent.ModelID),
 		Provider:           firstNonEmpty(input.Provider, parent.Provider),
+		Tag:                input.Tag,
 		ParentSessionID:    parent.SessionID,
 		RootSessionID:      firstNonEmpty(parent.RootSessionID, parent.SessionID),
 		ForkedFromEventID:  last.ID,

internal/sessions/store_test.go

@@ -181,6 +181,32 @@ func TestStoreForkCopiesEventsAndLineage(t *testing.T) {
 	}
 }
 
+func TestStoreForkSupportsNonResumableSideSession(t *testing.T) {
+	store := NewStore(StoreOptions{RootDir: t.TempDir()})
+	parent, err := store.Create(CreateInput{SessionID: "parent", Title: "Parent"})
+	if err != nil {
+		t.Fatalf("Create parent: %v", err)
+	}
+	if _, err := store.AppendEvent(parent.SessionID, AppendEventInput{Type: EventMessage, Payload: map[string]string{"content": "context"}}); err != nil {
+		t.Fatalf("AppendEvent: %v", err)
+	}
+
+	side, err := store.Fork(parent.SessionID, ForkInput{
+		SessionID:   "side",
+		SessionKind: SessionKindSide,
+		Tag:         "btw",
+	})
+	if err != nil {
+		t.Fatalf("Fork side: %v", err)
+	}
+	if side.SessionKind != SessionKindSide || side.Tag != "btw" || side.ParentSessionID != parent.SessionID {
+		t.Fatalf("side metadata = %#v", side)
+	}
+	if IsResumableKind(side.SessionKind) {
+		t.Fatal("side sessions must not appear as resumable conversations")
+	}
+}
+
 func TestStoreForkSkipsUsageEvents(t *testing.T) {
 	store := NewStore(StoreOptions{RootDir: t.TempDir(), Now: fixedClock("2026-06-04T11:00:00Z")})
 	parent, err := store.Create(CreateInput{SessionID: "parent", Title: "Parent"})
@@ -381,6 +407,7 @@ func TestListAndLatestResumableExcludeSubRuns(t *testing.T) {
 	mk(SessionKindSpecImpl, "spec-impl-1")
 	newestResumable := mk("", "conversation-2") // newest standalone conversation
 	mk(SessionKindChild, "child-2")             // newer overall, but a sub-run
+	mk(SessionKindSide, "side-1")               // newer overall, but non-resumable
 
 	resumable, err := store.ListResumable()
 	if err != nil {
@@ -404,7 +431,7 @@ func TestListAndLatestResumableExcludeSubRuns(t *testing.T) {
 		if latest != nil {
 			got = latest.SessionID
 		}
-		t.Fatalf("LatestResumable = %s, want newest resumable %s (must skip the newer child)", got, newestResumable.SessionID)
+		t.Fatalf("LatestResumable = %s, want newest resumable %s (must skip newer child and side sessions)", got, newestResumable.SessionID)
 	}
 }
 
@@ -535,6 +562,9 @@ func TestPrepareExecSessionResolvesResumeAndFork(t *testing.T) {
 	if _, err := store.AppendEvent("latest", AppendEventInput{Type: EventMessage, Payload: map[string]any{"content": "previous answer"}}); err != nil {
 		t.Fatal(err)
 	}
+	if _, err := store.Create(CreateInput{SessionID: "newer-side", SessionKind: SessionKindSide}); err != nil {
+		t.Fatal(err)
+	}
 
 	prepared, err := PrepareExec(PrepareExecOptions{Store: store, ResumeLatest: true})
 	if err != nil {
@@ -546,6 +576,9 @@ func TestPrepareExecSessionResolvesResumeAndFork(t *testing.T) {
 	if got := FormatExecPrompt("continue", prepared); got == "continue" || !strings.Contains(got, "previous answer") {
 		t.Fatalf("expected session context in prompt, got %q", got)
 	}
+	if _, err := PrepareExec(PrepareExecOptions{Store: store, Resume: "newer-side"}); err == nil || !strings.Contains(err.Error(), "Zero session is not resumable: newer-side") {
+		t.Fatalf("explicit side-session resume error = %v, want non-resumable rejection", err)
+	}
 
 	forked, err := PrepareExec(PrepareExecOptions{Store: store, Fork: "latest", SessionID: "forked"})
 	if err != nil {

internal/tools/registry.go

@@ -2,6 +2,7 @@ package tools
 
 import (
 	"context"
+	"sort"
 
 	"github.com/Gitlawb/zero/internal/redaction"
 	"github.com/Gitlawb/zero/internal/sandbox"
@@ -113,6 +114,9 @@ func (registry *Registry) All() []Tool {
 	for _, tool := range registry.tools {
 		tools = append(tools, tool)
 	}
+	sort.Slice(tools, func(left, right int) bool {
+		return tools[left].Name() < tools[right].Name()
+	})
 	return tools
 }
 

internal/tools/registry_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 
@@ -72,6 +73,23 @@ func TestCoreReadOnlyToolsExposeSafeMetadata(t *testing.T) {
 	}
 }
 
+func TestRegistryAllReturnsToolsSortedByName(t *testing.T) {
+	registry := NewRegistry()
+	for _, name := range []string{"write_file", "bash", "read_file"} {
+		registry.Register(fakePlainTool{baseTool: baseTool{name: name, description: name}})
+	}
+
+	all := registry.All()
+	got := make([]string, 0, len(all))
+	for _, tool := range all {
+		got = append(got, tool.Name())
+	}
+	want := []string{"bash", "read_file", "write_file"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("Registry.All() order = %v, want %v", got, want)
+	}
+}
+
 func TestCoreNetworkToolsExposeSafetyMetadata(t *testing.T) {
 	// web_search is only registered when a backend is configured.
 	t.Setenv("ZERO_WEBSEARCH_BASE_URL", "https://search.example/api")

internal/trace/emit.go

@@ -106,6 +106,7 @@ func WriteNDJSON(w io.Writer, t *TurnTrace) error {
 	for _, p := range t.PrefixHashes {
 		if err := enc.Encode(map[string]any{
 			"type":                "prefix_hash",
+			"system_prompt":       p.SystemPromptHash,
 			"base_instructions":   p.BaseInstructionsHash,
 			"confirmation_policy": p.ConfirmationPolicyHash,
 			"project_context":     p.ProjectContextHash,
@@ -136,6 +137,27 @@ func WriteNDJSON(w io.Writer, t *TurnTrace) error {
 			return err
 		}
 	}
+	for _, event := range t.TaskStates {
+		if err := enc.Encode(map[string]any{
+			"type":                 "task_state",
+			"revision":             event.Revision,
+			"status":               event.Status,
+			"plan_pending":         event.PlanPending,
+			"plan_in_progress":     event.PlanInProgress,
+			"plan_completed":       event.PlanCompleted,
+			"plan_failed":          event.PlanFailed,
+			"tools_succeeded":      event.ToolsSucceeded,
+			"tools_failed":         event.ToolsFailed,
+			"verification_passed":  event.VerificationPassed,
+			"verification_failed":  event.VerificationFailed,
+			"verification_outcome": event.VerificationOutcome,
+			"changed_file_count":   event.ChangedFileCount,
+			"completion_decision":  event.CompletionDecision,
+			"plan_parity":          event.PlanParity,
+		}); err != nil {
+			return err
+		}
+	}
 	return nil
 }
 
@@ -205,6 +227,15 @@ func WriteText(w io.Writer, t *TurnTrace) error {
 				event.Truncated, event.Reason, event.SpillCreated)
 		}
 	}
+	if len(t.TaskStates) > 0 {
+		latest := t.TaskStates[len(t.TaskStates)-1]
+		write("task state: revision=%d status=%s plan=%d/%d/%d/%d tools=%d/%d verification=%d/%d(%s) files=%d plan_parity=%s completion=%s\n",
+			latest.Revision, latest.Status, latest.PlanPending, latest.PlanInProgress,
+			latest.PlanCompleted, latest.PlanFailed, latest.ToolsSucceeded,
+			latest.ToolsFailed, latest.VerificationPassed, latest.VerificationFailed,
+			latest.VerificationOutcome, latest.ChangedFileCount, latest.PlanParity,
+			latest.CompletionDecision)
+	}
 	return firstErr
 }
 

internal/trace/parse.go

@@ -101,13 +101,14 @@ func ReadNDJSON(r io.Reader) (*TurnTrace, error) {
 			if !sawTraceHeader {
 				return nil, errors.New("parse trace: not a valid NDJSON trace (no type:trace header)")
 			}
-			// Round-trip the seven prefix-hash fields. Missing fields are
+			// Round-trip the prefix-hash fields. Missing fields are
 			// accepted as empty strings (a partially-written trace from a
 			// crashed emitter must not fatal a parse). The decoder tolerates
-			// any shape the encoder produced and the seven keys are the
+			// any shape the encoder produced and the keys are the
 			// contract — adding a new field is non-breaking; renaming one
 			// requires a schema version bump.
 			t.PrefixHashes = append(t.PrefixHashes, PrefixHash{
+				SystemPromptHash:       stringField(obj, "system_prompt"),
 				BaseInstructionsHash:   stringField(obj, "base_instructions"),
 				ConfirmationPolicyHash: stringField(obj, "confirmation_policy"),
 				ProjectContextHash:     stringField(obj, "project_context"),
@@ -131,6 +132,26 @@ func ReadNDJSON(r io.Reader) (*TurnTrace, error) {
 				Reason:                  stringField(obj, "reason"),
 				SpillCreated:            boolField(obj, "spill_created"),
 			})
+		case "task_state":
+			if !sawTraceHeader {
+				return nil, errors.New("parse trace: not a valid NDJSON trace (no type:trace header)")
+			}
+			t.TaskStates = append(t.TaskStates, TaskStateEvent{
+				Revision:            int(parseInt64(obj["revision"])),
+				Status:              stringField(obj, "status"),
+				PlanPending:         int(parseInt64(obj["plan_pending"])),
+				PlanInProgress:      int(parseInt64(obj["plan_in_progress"])),
+				PlanCompleted:       int(parseInt64(obj["plan_completed"])),
+				PlanFailed:          int(parseInt64(obj["plan_failed"])),
+				ToolsSucceeded:      int(parseInt64(obj["tools_succeeded"])),
+				ToolsFailed:         int(parseInt64(obj["tools_failed"])),
+				VerificationPassed:  int(parseInt64(obj["verification_passed"])),
+				VerificationFailed:  int(parseInt64(obj["verification_failed"])),
+				VerificationOutcome: stringField(obj, "verification_outcome"),
+				ChangedFileCount:    int(parseInt64(obj["changed_file_count"])),
+				CompletionDecision:  stringField(obj, "completion_decision"),
+				PlanParity:          stringField(obj, "plan_parity"),
+			})
 		default:
 			// Unknown event type: tolerate (forward-compat) but only after a
 			// header has been seen.
@@ -151,8 +172,8 @@ func ReadNDJSON(r io.Reader) (*TurnTrace, error) {
 	if !sawTraceHeader {
 		return nil, errors.New("parse trace: non-empty input had no type:trace header")
 	}
-	if len(t.Spans) == 0 && len(t.Counters) == 0 && len(t.PrefixHashes) == 0 && len(t.OutputBudgets) == 0 {
-		return nil, errors.New("parse trace: header present but no spans, counters, or prefix hashes recovered (corrupt or truncated)")
+	if len(t.Spans) == 0 && len(t.Counters) == 0 && len(t.PrefixHashes) == 0 && len(t.OutputBudgets) == 0 && len(t.TaskStates) == 0 {
+		return nil, errors.New("parse trace: header present but no events recovered (corrupt or truncated)")
 	}
 	return t, nil
 }

internal/trace/recorder.go

@@ -29,6 +29,10 @@ type Recorder struct {
 	firstActionStamped  bool
 }
 
+// maxTaskStateEvents bounds trace growth in pathological long runs. Once full,
+// the latest aggregate replaces the tail so final state is never lost.
+const maxTaskStateEvents = 128
+
 // NewRecorder returns a ready recorder. sessionID correlates with the agent
 // session (Options.SessionID); runID is a per-Run sequence; profile is an
 // optional label (e.g. "cold", "warm") for benchmark runs.
@@ -203,6 +207,24 @@ func (r *Recorder) EmitOutputBudget(event OutputBudgetEvent) {
 	r.tr.OutputBudgets = append(r.tr.OutputBudgets, event)
 }
 
+// EmitTaskState records one content-free structured task snapshot. Calls retain
+// event order so revisions can be replayed alongside the tool and turn stream.
+func (r *Recorder) EmitTaskState(event TaskStateEvent) {
+	if r == nil {
+		return
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.finished {
+		return
+	}
+	if len(r.tr.TaskStates) < maxTaskStateEvents {
+		r.tr.TaskStates = append(r.tr.TaskStates, event)
+		return
+	}
+	r.tr.TaskStates[len(r.tr.TaskStates)-1] = event
+}
+
 // Finish stamps CompletedAt, derives each span's parent (by interval
 // containment) and exclusive time, and returns a snapshot of the trace. Calling
 // Finish more than once returns the same snapshot.
@@ -223,6 +245,7 @@ func (r *Recorder) Finish() *TurnTrace {
 	snap.Counters = append([]Counter(nil), r.tr.Counters...)
 	snap.PrefixHashes = append([]PrefixHash(nil), r.tr.PrefixHashes...)
 	snap.OutputBudgets = append([]OutputBudgetEvent(nil), r.tr.OutputBudgets...)
+	snap.TaskStates = append([]TaskStateEvent(nil), r.tr.TaskStates...)
 	return &snap
 }
 

internal/trace/task_state_test.go

@@ -0,0 +1,66 @@
+package trace
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func TestTaskStateTraceRoundTripContainsNoTaskContent(t *testing.T) {
+	recorder := NewRecorder("session", "run", "")
+	recorder.Start()
+	event := TaskStateEvent{
+		Revision:            4,
+		Status:              "active",
+		PlanPending:         2,
+		PlanCompleted:       1,
+		ToolsSucceeded:      3,
+		ToolsFailed:         1,
+		VerificationPassed:  1,
+		VerificationOutcome: "passed",
+		ChangedFileCount:    2,
+		PlanParity:          "match",
+	}
+	recorder.EmitTaskState(event)
+
+	var output bytes.Buffer
+	if err := WriteNDJSON(&output, recorder.Finish()); err != nil {
+		t.Fatalf("WriteNDJSON: %v", err)
+	}
+	if strings.Contains(output.String(), "secret objective") || strings.Contains(output.String(), "private.go") {
+		t.Fatalf("task content leaked into trace: %s", output.String())
+	}
+	if strings.Contains(output.String(), "objective_hash") {
+		t.Fatalf("trace contains a confirmable objective fingerprint: %s", output.String())
+	}
+	parsed, err := ReadNDJSON(strings.NewReader(output.String()))
+	if err != nil {
+		t.Fatalf("ReadNDJSON: %v", err)
+	}
+	if len(parsed.TaskStates) != 1 || parsed.TaskStates[0] != event {
+		t.Fatalf("unexpected round trip: %#v", parsed.TaskStates)
+	}
+}
+
+func TestTaskStateIsDocumentedAsOptionalTraceEvent(t *testing.T) {
+	for _, key := range OptionalEventKeys() {
+		if key == "task_state" {
+			return
+		}
+	}
+	t.Fatal("task_state missing from OptionalEventKeys")
+}
+
+func TestTaskStateTraceIsBoundedAndRetainsLatestSnapshot(t *testing.T) {
+	recorder := NewRecorder("session", "run", "")
+	for revision := 1; revision <= maxTaskStateEvents+20; revision++ {
+		recorder.EmitTaskState(TaskStateEvent{Revision: revision})
+	}
+	events := recorder.Finish().TaskStates
+	if len(events) != maxTaskStateEvents {
+		t.Fatalf("task state events = %d, want cap %d", len(events), maxTaskStateEvents)
+	}
+	if got := events[len(events)-1].Revision; got != maxTaskStateEvents+20 {
+		t.Fatalf("latest revision = %d, want %d", got, maxTaskStateEvents+20)
+	}
+}

internal/trace/trace.go

@@ -103,6 +103,27 @@ type OutputBudgetEvent struct {
 	SpillCreated            bool   `json:"spill_created"`
 }
 
+// TaskStateEvent is a content-free snapshot of the run's structured task
+// projection. Objective text, plan content, tool output, file paths, and
+// confirmable content fingerprints are deliberately excluded so tracing cannot
+// become a secret-bearing side channel.
+type TaskStateEvent struct {
+	Revision            int    `json:"revision"`
+	Status              string `json:"status"`
+	PlanPending         int    `json:"plan_pending"`
+	PlanInProgress      int    `json:"plan_in_progress"`
+	PlanCompleted       int    `json:"plan_completed"`
+	PlanFailed          int    `json:"plan_failed"`
+	ToolsSucceeded      int    `json:"tools_succeeded"`
+	ToolsFailed         int    `json:"tools_failed"`
+	VerificationPassed  int    `json:"verification_passed"`
+	VerificationFailed  int    `json:"verification_failed"`
+	VerificationOutcome string `json:"verification_outcome,omitempty"`
+	ChangedFileCount    int    `json:"changed_file_count"`
+	CompletionDecision  string `json:"completion_decision,omitempty"`
+	PlanParity          string `json:"plan_parity"`
+}
+
 // TurnTrace is the finished record for one agent.Run. It is the value
 // emitters serialize; it is not mutated after Finish returns a snapshot.
 type TurnTrace struct {
@@ -118,34 +139,19 @@ type TurnTrace struct {
 	Counters            []Counter           `json:"counters"`
 	PrefixHashes        []PrefixHash        `json:"prefix_hashes,omitempty"`
 	OutputBudgets       []OutputBudgetEvent `json:"output_budgets,omitempty"`
+	TaskStates          []TaskStateEvent    `json:"task_states,omitempty"`
 }
 
 // PrefixHash is one fingerprint of the prompt prefix emitted by an agent run.
-// The seven fields decompose the cacheable part of the request so a downstream
-// observer can detect which sub-component drifted turn-over-turn:
-// base_instructions (the embedded core system prompt), confirmation_policy,
-// project_context (AGENTS.md / ZERO.md chain), skills, tools, schema (tool
-// JSON schemas), and complete_prefix (SHA-256 of the canonical concatenation
-// of the other six). All hashes are hex-encoded SHA-256.
-//
-// Scope: the fingerprint covers 4 of 11 sections of buildSystemPrompt. The
-// seven sections NOT covered — modelPromptAddendum, sessionRuntimeContext,
-// approvedCommandPrefixContext, workspaceSeedContext, userGuidelines,
-// specialistDelegationContext, responseStyleContext — fire only for
-// non-default Options. For default Options (the common case), the four
-// captured substrings are the full prompt and the fingerprint is accurate.
-//
-// A run with a stable CompletePrefix across turns means the four captured
-// sub-components are byte-identical. A run where CompletePrefix changes
-// names the captured sub-component that drifted, but does NOT rule out
-// drift in the seven uncaptured sections. modelPromptAddendum in particular
-// changes on a model switch (a model_switches counter the trace already
-// emits), so a consumer correlating CompletePrefix stability with
-// cached_input_tokens must cross-check the model_switches counter to
-// disambiguate "no drift" from "drift in an uncaptured section." The fields
-// are emitted as a "prefix_hash" event in the NDJSON trace (see
-// WriteNDJSON).
+// SystemPromptHash covers the exact joined system-message content, including
+// every dynamic section. ToolsHash covers tool names and descriptions in their
+// emitted order; SchemaHash covers their canonical parameter schemas in that
+// same order. CompletePrefixHash combines those three provider-visible parts.
+// The remaining hashes retain narrower diagnostic boundaries so a trace can
+// identify common sources of system-prompt drift. All hashes are hex-encoded
+// SHA-256 and emitted as a "prefix_hash" NDJSON event.
 type PrefixHash struct {
+	SystemPromptHash       string `json:"system_prompt"`
 	BaseInstructionsHash   string `json:"base_instructions"`
 	ConfirmationPolicyHash string `json:"confirmation_policy"`
 	ProjectContextHash     string `json:"project_context"`
@@ -296,5 +302,6 @@ func OptionalEventKeys() []string {
 		"counter:" + CounterPrefixDrift,
 		"counter:" + CounterPostureEscalations,
 		"event:prefix_hash",
+		"task_state",
 	}
 }

internal/trace/trace_test.go

@@ -374,6 +374,7 @@ func TestReadNDJSONRoundTrip(t *testing.T) {
 	// event type. Insertion order is preserved by the parser (no sort
 	// is applied on read or write).
 	r.EmitPrefixHash(PrefixHash{
+		SystemPromptHash:       "system1",
 		BaseInstructionsHash:   "b1",
 		ConfirmationPolicyHash: "c1",
 		ProjectContextHash:     "p1",
@@ -383,6 +384,7 @@ func TestReadNDJSONRoundTrip(t *testing.T) {
 		CompletePrefixHash:     "complete1",
 	})
 	r.EmitPrefixHash(PrefixHash{
+		SystemPromptHash:       "system2",
 		BaseInstructionsHash:   "b2",
 		ConfirmationPolicyHash: "c2",
 		ProjectContextHash:     "p2",
@@ -427,10 +429,10 @@ func TestReadNDJSONRoundTrip(t *testing.T) {
 	if parsed.PrefixHashes[0].CompletePrefixHash != "complete1" || parsed.PrefixHashes[1].CompletePrefixHash != "complete2" {
 		t.Fatalf("prefix_hash insertion order lost: got %+v want [complete1, complete2]", parsed.PrefixHashes)
 	}
-	if parsed.PrefixHashes[0].BaseInstructionsHash != "b1" || parsed.PrefixHashes[0].SchemaHash != "x1" {
+	if parsed.PrefixHashes[0].SystemPromptHash != "system1" || parsed.PrefixHashes[0].BaseInstructionsHash != "b1" || parsed.PrefixHashes[0].SchemaHash != "x1" {
 		t.Fatalf("prefix_hash sub-hashes lost on first event: got %+v", parsed.PrefixHashes[0])
 	}
-	if parsed.PrefixHashes[1].BaseInstructionsHash != "b2" || parsed.PrefixHashes[1].SchemaHash != "x2" {
+	if parsed.PrefixHashes[1].SystemPromptHash != "system2" || parsed.PrefixHashes[1].BaseInstructionsHash != "b2" || parsed.PrefixHashes[1].SchemaHash != "x2" {
 		t.Fatalf("prefix_hash sub-hashes lost on second event: got %+v", parsed.PrefixHashes[1])
 	}
 }

internal/tui/btw.go

@@ -0,0 +1,325 @@
+package tui
+
+import (
+	"fmt"
+	"strings"
+
+	tea "charm.land/bubbletea/v2"
+
+	"github.com/Gitlawb/zero/internal/sessions"
+	"github.com/Gitlawb/zero/internal/usage"
+)
+
+const (
+	btwSessionTag = "btw"
+	// btwRunIDGap keeps the hidden parent's current run below the first side run.
+	// A parent cannot start another user turn while its surface is hidden; the
+	// monotonic btwRunIDSeq separately prevents collisions across BTW re-entry.
+	btwRunIDGap = 1_000_000
+
+	btwContextBoundary = `You are in an isolated side conversation. The inherited session history is reference context only.
+Do not continue or complete earlier tasks, plans, tool calls, approvals, or requests. Only instructions submitted after this boundary are active.
+Answer questions and explore lightly. Do not modify workspace state unless the user explicitly asks for that mutation in this side conversation.
+Nothing from this side conversation will be merged into the main session.`
+)
+
+// btwState keeps the main surface alive while an isolated side conversation is
+// visible. The parent model continues receiving its own run messages, but its
+// transcript and session events stay hidden until the user returns.
+type btwState struct {
+	active           bool
+	parent           *model
+	sideRunIDBase    int
+	parentNeedsInput bool
+}
+
+func (m model) handleBTWCommand(question string) (model, tea.Cmd) {
+	question = strings.TrimSpace(question)
+	if m.btw.active {
+		if question != "" {
+			return m.appendSystemNotice("A BTW conversation is already active. Run /btw with no question to return to the main session."), nil
+		}
+		return m.leaveBTW()
+	}
+	if m.compactInFlight {
+		return m.appendSystemNotice("Compaction is running. Wait for it to finish before opening a BTW conversation."), nil
+	}
+	if m.exiting {
+		return m.appendSystemNotice("Zero is waiting for the current run to finish saving before exit. A BTW conversation cannot start now."), nil
+	}
+	if m.activeSession.SessionID == "" {
+		return m.appendSystemNotice("Start the main session with a prompt before opening a BTW conversation."), nil
+	}
+	if m.sessionStore == nil {
+		return m.appendSystemNotice("BTW conversation unavailable: no session store configured."), nil
+	}
+
+	fork, err := m.sessionStore.Fork(m.activeSession.SessionID, sessions.ForkInput{
+		SessionKind: sessions.SessionKindSide,
+		Title:       btwTitle(m.activeSession.Title),
+		Cwd:         m.cwd,
+		ModelID:     m.modelName,
+		Provider:    m.providerName,
+		Tag:         btwSessionTag,
+	})
+	if err != nil {
+		return m.appendSystemNotice("Could not open BTW conversation: " + err.Error()), nil
+	}
+	events, err := m.resumeEvents(fork.SessionID)
+	if err != nil {
+		return m.appendSystemNotice("Could not load BTW conversation: " + err.Error()), nil
+	}
+
+	// Foreground loops are session-scoped. Stop them only after the side session
+	// is ready, so a failed fork cannot destroy work in the main session.
+	parent := m
+	clearedLoops := 0
+	if updated, cleared := parent.clearLoopsForSessionSwitch(); cleared > 0 {
+		parent = updated
+		clearedLoops = cleared
+		parent.transcript = reduceTranscript(parent.transcript, transcriptAction{
+			kind: actionAppendSystem,
+			text: fmt.Sprintf("Stopped %d loop(s) before opening the BTW conversation.", cleared),
+		})
+	}
+	parent.btw = btwState{}
+	// A scrollback print that was already scheduled may acknowledge after the
+	// side surface is active. The hidden model does not receive that unscoped
+	// acknowledgement, so clear its print latch and rebuild on return.
+	parent.printInFlight = false
+	parent.flushQueue = nil
+
+	side := parent
+	side.activeSession = fork
+	side.sessionEvents = events
+	side.transcript = initialTranscript()
+	side.transcript = appendRow(side.transcript, rowSystem, "BTW conversation · isolated from the main session · /btw or Ctrl+C to return")
+	if clearedLoops > 0 {
+		side.transcript = appendRow(side.transcript, rowSystem, fmt.Sprintf("Stopped %d main-session loop(s) before opening this conversation.", clearedLoops))
+	}
+	side.transcript = appendTranscriptRowsDedup(side.transcript, transcriptRowsFromSessionEvents(events))
+	side.printInFlight = false
+	side.flushQueue = nil
+	side.resetFlushFrontier("· btw conversation ·")
+	side.pending = false
+	side.exiting = false
+	side.runCancel = nil
+	side.activeRunID = 0
+	side.runID = maxInt(parent.runID+btwRunIDGap, parent.btwRunIDSeq)
+	side.flushRunIDs = map[int]string{}
+	side.liveUsageCounts = map[int]int{}
+	side.usageTracker = usage.NewTracker(usage.TrackerOptions{Registry: &side.modelCatalog, Now: side.now})
+	side.lastUsage = usage.Normalized{}
+	side.lastUsageSeen = false
+	side.unpricedRequests = 0
+	side.unpricedTokens = 0
+	side.compactRequests = 0
+	side.compactFrame = 0
+	side.lastCompactResult = nil
+	side.lastCompactError = ""
+	side.turnLatencySum = 0
+	side.turnLatencyCount = 0
+	side.turnTTFTSum = 0
+	side.turnTTFTCount = 0
+	side.pendingPermission = nil
+	side.pendingAskUser = nil
+	side.pendingSpecReview = nil
+	side.queuedMessage = ""
+	side.lastPrompt = ""
+	side.lastImages = nil
+	side.lastImageLabels = nil
+	side.lastDocuments = nil
+	side.inputHistory = nil
+	side.historyIdx = 0
+	side.historyDraft = ""
+	if question == "" {
+		side.pendingImages = nil
+		side.pendingImageLabels = nil
+		side.pendingDocuments = nil
+	}
+	side.loops = nil
+	side.activeLoopID = ""
+	side.loopTicking = false
+	side.specialists.clear()
+	side.plan.clear()
+	side.planDetailGen++
+	side.streamingText = nil
+	side.streamingReasoning = ""
+	side.streamingReasoningExpanded = false
+	side.clearStreamingToolCall()
+	side.resetStreamingFade()
+	side.btw = btwState{
+		active:        true,
+		parent:        &parent,
+		sideRunIDBase: side.runID,
+	}
+
+	if question == "" {
+		return side, nil
+	}
+	return side.launchPrompt(question)
+}
+
+func (m model) leaveBTW() (model, tea.Cmd) {
+	if !m.btw.active || m.btw.parent == nil {
+		return m, nil
+	}
+	if m.pending {
+		return m.appendSystemNotice("A BTW response is still running. Press Esc twice to cancel it, or wait for it to finish before returning."), nil
+	}
+	if len(m.flushRunIDs) > 0 {
+		return m.appendSystemNotice("The cancelled BTW response is still saving its session events. Wait for it to finish before returning."), nil
+	}
+	if m.compactInFlight {
+		return m.appendSystemNotice("BTW compaction is still running. Wait for it to finish before returning."), nil
+	}
+	m, _ = m.clearLoopsForSessionSwitch()
+	parent := *m.btw.parent
+	parent.btwRunIDSeq = maxInt(parent.btwRunIDSeq, m.runID)
+	parent.btw = btwState{}
+	// A hidden parent completion may have scheduled an unscoped git-sweep result
+	// that landed on the side surface. Re-run it after restoring the parent so
+	// its FILES sidebar cannot stay permanently marked in-flight or stale.
+	parent.gitSweepInFlight = false
+	var sweepCmd tea.Cmd
+	parent, sweepCmd = parent.maybeGitSweep()
+	// The side surface owns its own spinner tick chain. If the hidden parent is
+	// still active, explicitly restart that chain after restoring it.
+	parent.spinnerTicking = false
+	var spinnerCmd tea.Cmd
+	if parent.pending || parent.compactInFlight || parent.doctorInFlight || parent.sidebarHasAgents() || parent.aimlapiOnboardAnimating() {
+		parent.spinnerTicking = true
+		spinnerCmd = parent.spinner.Tick
+	}
+	parent.transcript = reduceTranscript(parent.transcript, transcriptAction{
+		kind: actionAppendSystem,
+		text: "Returned from the isolated BTW conversation. Its messages were not added to this session.",
+	})
+	parent.resetFlushFrontier("· returned from btw ·")
+	return parent, batchCommands(sweepCmd, spinnerCmd)
+}
+
+func btwCommandUnavailable(command parsedCommand) bool {
+	arg := strings.ToLower(strings.TrimSpace(command.text))
+	switch command.kind {
+	case commandNew, commandResume, commandRetitle, commandSpec, commandLoop,
+		commandRewind, commandCompact, commandSTTModel, commandMCP:
+		return true
+	case commandModel:
+		return arg != "list" && arg != "ls"
+	case commandProvider:
+		return arg != "status"
+	case commandTurns, commandProfile:
+		return arg != "" && arg != "status"
+	case commandTheme:
+		return arg != "list"
+	case commandConfig:
+		return arg != ""
+	default:
+		return false
+	}
+}
+
+// resizeBTWParent carries terminal geometry into the hidden parent. Window-size
+// messages have no run ID, so normal BTW routing intentionally leaves them on
+// the visible side surface; copying the layout fields prevents stale wrapping
+// after the parent is restored.
+func (m model) resizeBTWParent(msg tea.WindowSizeMsg) model {
+	if !m.btw.active || m.btw.parent == nil {
+		return m
+	}
+	parent := *m.btw.parent
+	parent.width = msg.Width
+	parent.height = msg.Height
+	parent = parent.clearHover()
+	parent.lineAges = nil
+	parent.lastStreamActivity = parent.now()
+	parent.input.SetWidth(maxInt(20, chatWidth(msg.Width)-14))
+	m.btw.parent = &parent
+	return m
+}
+
+func btwTitle(parent string) string {
+	parent = strings.TrimSpace(parent)
+	if parent == "" {
+		return "BTW conversation"
+	}
+	return parent + " (BTW)"
+}
+
+// routeBTWParentMessage lets a main-session run finish while the side surface is
+// active. Side run IDs start far above the captured parent's counter, so messages
+// below that boundary unambiguously belong to the hidden parent model.
+func (m model) routeBTWParentMessage(msg tea.Msg) (model, tea.Cmd, bool) {
+	if !m.btw.active || m.btw.parent == nil {
+		return m, nil, false
+	}
+	if title, ok := msg.(sessionTitleGeneratedMsg); ok {
+		if title.sessionID != m.btw.parent.activeSession.SessionID {
+			return m, nil, false
+		}
+		return m.routeBTWMessageToParent(msg)
+	}
+	runID, ok := btwMessageRunID(msg)
+	if !ok || runID <= 0 || runID >= m.btw.sideRunIDBase {
+		return m, nil, false
+	}
+	return m.routeBTWMessageToParent(msg)
+}
+
+func (m model) routeBTWMessageToParent(msg tea.Msg) (model, tea.Cmd, bool) {
+	parentNext, cmd := m.btw.parent.updateModel(msg)
+	parent, ok := parentNext.(model)
+	if !ok {
+		return m, cmd, true
+	}
+	parent.btw = btwState{}
+	m.btw.parent = &parent
+	switch msg.(type) {
+	case permissionRequestMsg, askUserRequestMsg:
+		if !m.btw.parentNeedsInput {
+			m.btw.parentNeedsInput = true
+			m = m.appendSystemNotice("The main session needs your input. Return with /btw or Ctrl+C to respond.")
+		}
+	case agentResponseMsg:
+		m.btw.parentNeedsInput = parent.pendingPermission != nil || parent.pendingAskUser != nil
+	}
+	return m, cmd, true
+}
+
+func btwMessageRunID(msg tea.Msg) (int, bool) {
+	switch typed := msg.(type) {
+	case agentTextMsg:
+		return typed.runID, true
+	case agentReasoningMsg:
+		return typed.runID, true
+	case agentUsageMsg:
+		return typed.runID, true
+	case agentResponseMsg:
+		return typed.runID, true
+	case agentRowMsg:
+		return typed.runID, true
+	case toolCallStreamStartMsg:
+		return typed.runID, true
+	case toolCallStreamDeltaMsg:
+		return typed.runID, true
+	case planUpdateMsg:
+		return typed.runID, true
+	case specialistStartMsg:
+		return typed.runID, true
+	case specialistCompleteMsg:
+		return typed.runID, true
+	case specialistProgressMsg:
+		return typed.runID, true
+	case swarmSessionsMsg:
+		return typed.runID, true
+	case permissionRequestMsg:
+		return typed.runID, true
+	case askUserRequestMsg:
+		return typed.runID, true
+	case recapGeneratedMsg:
+		return typed.runID, true
+	default:
+		return 0, false
+	}
+}

internal/tui/btw_test.go

@@ -0,0 +1,430 @@
+package tui
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	tea "charm.land/bubbletea/v2"
+
+	"github.com/Gitlawb/zero/internal/sessions"
+)
+
+func newBTWTestModel(t *testing.T) model {
+	t.Helper()
+	store := sessions.NewStore(sessions.StoreOptions{RootDir: t.TempDir()})
+	parent, err := store.Create(sessions.CreateInput{
+		SessionID: "main-session",
+		Title:     "Main task",
+		Cwd:       "/repo",
+		ModelID:   "test-model",
+		Provider:  "test-provider",
+	})
+	if err != nil {
+		t.Fatalf("create parent session: %v", err)
+	}
+	for _, payload := range []map[string]any{
+		{"role": "user", "content": "implement the main task"},
+		{"role": "assistant", "content": "working on it"},
+	} {
+		if _, err := store.AppendEvent(parent.SessionID, sessions.AppendEventInput{Type: sessions.EventMessage, Payload: payload}); err != nil {
+			t.Fatalf("append parent event: %v", err)
+		}
+	}
+	loaded, err := store.Get(parent.SessionID)
+	if err != nil || loaded == nil {
+		t.Fatalf("load parent session: session=%#v err=%v", loaded, err)
+	}
+	events, err := store.ReadEvents(parent.SessionID)
+	if err != nil {
+		t.Fatalf("read parent events: %v", err)
+	}
+	m := newModel(context.Background(), Options{
+		Cwd:          "/repo",
+		ModelName:    "test-model",
+		ProviderName: "test-provider",
+		SessionStore: store,
+	})
+	m.activeSession = *loaded
+	m.sessionEvents = events
+	m.transcript = appendTranscriptRowsDedup(initialTranscript(), transcriptRowsFromSessionEvents(events))
+	return m
+}
+
+func TestBTWCommandParsesInlineQuestion(t *testing.T) {
+	got := parseCommand("/btw double-check the approach")
+	if got.kind != commandBTW || got.text != "double-check the approach" {
+		t.Fatalf("parseCommand(/btw ...) = %#v", got)
+	}
+}
+
+func TestBTWCreatesIsolatedForkAndReturnsWithoutMerge(t *testing.T) {
+	m := newBTWTestModel(t)
+	parentID := m.activeSession.SessionID
+	parentEventCount := len(m.sessionEvents)
+
+	side, cmd := m.handleBTWCommand("")
+	if cmd != nil {
+		t.Fatal("bare /btw should not start an agent run")
+	}
+	if !side.btw.active || side.btw.parent == nil {
+		t.Fatal("expected active BTW state with saved parent")
+	}
+	if side.activeSession.SessionKind != sessions.SessionKindSide || side.activeSession.ParentSessionID != parentID {
+		t.Fatalf("side metadata = %#v", side.activeSession)
+	}
+	if side.activeSession.Tag != btwSessionTag {
+		t.Fatalf("side tag = %q, want %q", side.activeSession.Tag, btwSessionTag)
+	}
+	if len(side.sessionEvents) <= parentEventCount {
+		t.Fatalf("side should contain copied context plus fork marker: got %d events", len(side.sessionEvents))
+	}
+	if !strings.Contains(side.sessionPrompt("question"), btwContextBoundary) {
+		t.Fatal("side prompt is missing the inherited-context boundary")
+	}
+
+	updated, err := side.appendSessionEvent(sessions.EventMessage, map[string]any{
+		"role": "assistant", "content": "side-only answer",
+	})
+	if err != nil {
+		t.Fatalf("append side event: %v", err)
+	}
+	returned, _ := updated.leaveBTW()
+	if returned.activeSession.SessionID != parentID {
+		t.Fatalf("returned session = %q, want %q", returned.activeSession.SessionID, parentID)
+	}
+	if len(returned.sessionEvents) != parentEventCount {
+		t.Fatalf("side events merged into parent: got %d events, want %d", len(returned.sessionEvents), parentEventCount)
+	}
+	parentEvents, err := returned.sessionStore.ReadEvents(parentID)
+	if err != nil {
+		t.Fatalf("read parent after return: %v", err)
+	}
+	for _, event := range parentEvents {
+		if strings.Contains(string(event.Payload), "side-only answer") {
+			t.Fatal("side-only event was persisted into the parent session")
+		}
+	}
+}
+
+func TestBTWCanOpenWhileParentRunContinues(t *testing.T) {
+	m := newBTWTestModel(t)
+	m.pending = true
+	m.runID = 7
+	m.activeRunID = 7
+
+	side, _ := m.handleBTWCommand("")
+	if side.pending || side.activeRunID != 0 {
+		t.Fatalf("side inherited parent run state: pending=%v activeRunID=%d", side.pending, side.activeRunID)
+	}
+	if side.btw.parent == nil || !side.btw.parent.pending || side.btw.parent.activeRunID != 7 {
+		t.Fatalf("parent run was not preserved: %#v", side.btw.parent)
+	}
+
+	routed, _, ok := side.routeBTWParentMessage(agentTextMsg{runID: 7, delta: "main progress"})
+	if !ok {
+		t.Fatal("parent run message was not routed")
+	}
+	if strings.Contains(routed.streamingTextString(), "main progress") {
+		t.Fatal("parent streaming output leaked into the side transcript")
+	}
+	if routed.btw.parent == nil || !strings.Contains(routed.btw.parent.streamingTextString(), "main progress") {
+		t.Fatal("parent streaming output was not retained on the hidden parent")
+	}
+}
+
+func TestBTWInlineQuestionStartsSideRun(t *testing.T) {
+	m := newBTWTestModel(t)
+	m.provider = &fakeProvider{}
+
+	side, cmd := m.handleBTWCommand("double-check this assumption")
+	if cmd == nil || !side.pending {
+		t.Fatalf("inline /btw question did not start a run: pending=%v cmd=%v", side.pending, cmd)
+	}
+	if side.lastPrompt != "double-check this assumption" {
+		t.Fatalf("side last prompt = %q", side.lastPrompt)
+	}
+	if side.btw.parent == nil || side.btw.parent.pending {
+		t.Fatal("idle parent should remain idle while the side run starts")
+	}
+	parentEvents, err := side.sessionStore.ReadEvents(side.btw.parent.activeSession.SessionID)
+	if err != nil {
+		t.Fatalf("read parent events: %v", err)
+	}
+	for _, event := range parentEvents {
+		if strings.Contains(string(event.Payload), "double-check this assumption") {
+			t.Fatal("inline side question was written into the parent session")
+		}
+	}
+}
+
+func TestBTWRejectsBeforeMainSessionStarts(t *testing.T) {
+	m := newModel(context.Background(), Options{SessionStore: sessions.NewStore(sessions.StoreOptions{RootDir: t.TempDir()})})
+	got, cmd := m.handleBTWCommand("")
+	if cmd != nil {
+		t.Fatal("pre-session /btw should not start work")
+	}
+	if got.btw.active || !transcriptContains(got.transcript, "Start the main session") {
+		t.Fatalf("unexpected pre-session /btw result: active=%v transcript=%#v", got.btw.active, got.transcript)
+	}
+}
+
+func TestBTWBlocksCommandsThatWouldReplaceItsSession(t *testing.T) {
+	m := newBTWTestModel(t)
+	side, _ := m.handleBTWCommand("")
+	updated, _ := side.dispatchCommand(parseCommand("/new"))
+	got := updated.(model)
+	if !got.btw.active || got.activeSession.SessionKind != sessions.SessionKindSide {
+		t.Fatalf("/new replaced the active BTW session: active=%v metadata=%#v", got.btw.active, got.activeSession)
+	}
+	if !transcriptContains(got.transcript, "unavailable in a BTW conversation") {
+		t.Fatalf("missing blocked-command guidance: %#v", got.transcript)
+	}
+}
+
+func TestBTWBlocksPersistentConfigurationCommands(t *testing.T) {
+	for _, input := range []string{
+		"/model other",
+		"/provider add",
+		"/turns 100",
+		"/profile fast",
+		"/theme dark",
+		"/config recaps off",
+		"/stt-model",
+		"/mcp",
+		"/rewind",
+		"/compact",
+	} {
+		t.Run(input, func(t *testing.T) {
+			m := newBTWTestModel(t)
+			side, _ := m.handleBTWCommand("")
+			updated, _ := side.dispatchCommand(parseCommand(input))
+			got := updated.(model)
+			if !got.btw.active || got.activeSession.SessionKind != sessions.SessionKindSide {
+				t.Fatalf("%s escaped the active BTW session: active=%v metadata=%#v", input, got.btw.active, got.activeSession)
+			}
+			if !transcriptContains(got.transcript, "unavailable in a BTW conversation") {
+				t.Fatalf("%s missing blocked-command guidance: %#v", input, got.transcript)
+			}
+		})
+	}
+}
+
+func TestBTWAllowsReadOnlyConfigurationCommands(t *testing.T) {
+	for _, input := range []string{
+		"/model list",
+		"/provider status",
+		"/turns",
+		"/profile status",
+		"/theme list",
+		"/config",
+	} {
+		t.Run(input, func(t *testing.T) {
+			m := newBTWTestModel(t)
+			side, _ := m.handleBTWCommand("")
+			updated, _ := side.dispatchCommand(parseCommand(input))
+			got := updated.(model)
+			if transcriptContains(got.transcript, "unavailable in a BTW conversation") {
+				t.Fatalf("%s was blocked even though it is read-only", input)
+			}
+		})
+	}
+}
+
+func TestBTWExitBlockedWhileParentRunActive(t *testing.T) {
+	m := newBTWTestModel(t)
+	m.pending = true
+	m.activeRunID = 7
+	side, _ := m.handleBTWCommand("")
+
+	updated, cmd := side.dispatchCommand(parseCommand("/exit"))
+	got := updated.(model)
+	if cmd != nil || got.exiting || !got.btw.active {
+		t.Fatalf("/exit escaped BTW while parent was active: cmd=%v exiting=%v active=%v", cmd, got.exiting, got.btw.active)
+	}
+	if got.btw.parent == nil || !got.btw.parent.pending {
+		t.Fatalf("hidden parent run was not preserved: %#v", got.btw.parent)
+	}
+	if !transcriptContains(got.transcript, "main session is still running") {
+		t.Fatalf("missing active-parent exit guidance: %#v", got.transcript)
+	}
+}
+
+func TestBTWReturnRestartsParentSpinner(t *testing.T) {
+	for _, reducedMotion := range []bool{false, true} {
+		t.Run(map[bool]string{false: "animated", true: "reduced-motion"}[reducedMotion], func(t *testing.T) {
+			m := newBTWTestModel(t)
+			m.reducedMotion = reducedMotion
+			m.pending = true
+			m.spinnerTicking = true
+			side, _ := m.handleBTWCommand("")
+			side.spinnerTicking = false
+
+			returned, cmd := side.leaveBTW()
+			if !returned.pending || !returned.spinnerTicking {
+				t.Fatalf("parent spinner was not restarted: pending=%v ticking=%v", returned.pending, returned.spinnerTicking)
+			}
+			if cmd == nil {
+				t.Fatal("returning to an active parent did not schedule a spinner tick")
+			}
+		})
+	}
+}
+
+func TestBTWCancelledRunFlushesBeforeReturnAndRunIDsStayUnique(t *testing.T) {
+	m := newBTWTestModel(t)
+	m.provider = &fakeProvider{}
+
+	side1, _ := m.handleBTWCommand("first side question")
+	firstRunID := side1.activeRunID
+	side1.cancelRun()
+	blocked, _ := side1.leaveBTW()
+	if !blocked.btw.active || !transcriptContains(blocked.transcript, "still saving its session events") {
+		t.Fatal("BTW returned before the cancelled side run finished flushing")
+	}
+
+	flushedModel, _ := side1.updateModel(agentResponseMsg{runID: firstRunID})
+	flushed := flushedModel.(model)
+	if len(flushed.flushRunIDs) != 0 {
+		t.Fatalf("cancelled side run did not drain: %#v", flushed.flushRunIDs)
+	}
+	parent, _ := flushed.leaveBTW()
+	side2, _ := parent.handleBTWCommand("second side question")
+	if side2.activeRunID == firstRunID {
+		t.Fatalf("BTW run ID was reused across re-entry: %d", firstRunID)
+	}
+
+	updated, _ := side2.updateModel(agentResponseMsg{
+		runID: firstRunID,
+		rows:  []transcriptRow{{kind: rowAssistant, text: "answer to the FIRST question"}},
+	})
+	got := updated.(model)
+	if !got.pending || transcriptContains(got.transcript, "answer to the FIRST question") {
+		t.Fatal("a stale side response hijacked the next BTW run")
+	}
+}
+
+func TestBTWRejectsExplicitResumeOfSideSession(t *testing.T) {
+	m := newBTWTestModel(t)
+	side, _ := m.handleBTWCommand("")
+
+	if _, err := m.resolveResumeSession(side.activeSession.SessionID); err == nil || !strings.Contains(err.Error(), "not resumable") {
+		t.Fatalf("explicit side-session resume error = %v, want non-resumable rejection", err)
+	}
+}
+
+func TestBTWCannotStartDuringDeferredExit(t *testing.T) {
+	m := newBTWTestModel(t)
+	m.exiting = true
+
+	got, cmd := m.handleBTWCommand("should not run")
+	if cmd != nil || got.btw.active {
+		t.Fatalf("BTW started during deferred exit: active=%v cmd=%v", got.btw.active, cmd)
+	}
+	if !transcriptContains(got.transcript, "cannot start now") {
+		t.Fatalf("missing deferred-exit guidance: %#v", got.transcript)
+	}
+}
+
+func TestBTWStatusAndHelpStayVisible(t *testing.T) {
+	m := newBTWTestModel(t)
+	side, _ := m.handleBTWCommand("")
+
+	if status := plainRender(t, side.statusLine(100)); !strings.Contains(status, "BTW") {
+		t.Fatalf("status line has no persistent BTW indicator: %q", status)
+	}
+	groups := side.buildKeybindingGroups()
+	if got := groups[0].bindings[3].desc; !strings.Contains(got, "return to the main session") {
+		t.Fatalf("BTW Ctrl+C help = %q", got)
+	}
+}
+
+func TestBTWResizeUpdatesHiddenParent(t *testing.T) {
+	m := newBTWTestModel(t)
+	m.width = 80
+	m.height = 24
+	side, _ := m.handleBTWCommand("")
+
+	updated, _ := side.updateModel(tea.WindowSizeMsg{Width: 120, Height: 50})
+	got := updated.(model)
+	if got.btw.parent == nil || got.btw.parent.width != 120 || got.btw.parent.height != 50 {
+		t.Fatalf("hidden parent kept stale geometry: %#v", got.btw.parent)
+	}
+	returned, _ := got.leaveBTW()
+	if returned.width != 120 || returned.height != 50 {
+		t.Fatalf("restored parent geometry = %dx%d, want 120x50", returned.width, returned.height)
+	}
+}
+
+func TestBTWUsesIndependentUsageTracker(t *testing.T) {
+	m := newBTWTestModel(t)
+	parentTracker := m.usageTracker
+	side, _ := m.handleBTWCommand("")
+	if side.usageTracker == nil || side.usageTracker == parentTracker {
+		t.Fatal("BTW conversation shared the main session usage tracker")
+	}
+	returned, _ := side.leaveBTW()
+	if returned.usageTracker != parentTracker {
+		t.Fatal("returning from BTW did not restore the main session usage tracker")
+	}
+}
+
+func TestBTWFailedForkKeepsMainSessionLoops(t *testing.T) {
+	badRoot := filepath.Join(t.TempDir(), "sessions")
+	if err := os.WriteFile(badRoot, []byte("not a directory"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	m := newModel(context.Background(), Options{SessionStore: sessions.NewStore(sessions.StoreOptions{RootDir: badRoot})})
+	m.activeSession = sessions.Metadata{SessionID: "main-session"}
+	m.loops = []*loopState{{id: "loop-1"}}
+
+	got, _ := m.handleBTWCommand("")
+	if len(got.loops) != 1 || got.loops[0].id != "loop-1" {
+		t.Fatalf("failed BTW fork cleared main-session loops: %#v", got.loops)
+	}
+	if !transcriptContains(got.transcript, "Could not open BTW conversation") {
+		t.Fatalf("missing fork failure notice: %#v", got.transcript)
+	}
+}
+
+func TestBTWCommandReturnsToParentSession(t *testing.T) {
+	m := newBTWTestModel(t)
+	parentID := m.activeSession.SessionID
+	side, _ := m.handleBTWCommand("")
+
+	updated, cmd := side.dispatchCommand(parseCommand("/btw"))
+	returned := updated.(model)
+	if cmd != nil {
+		t.Fatal("returning from an idle BTW conversation should not start work")
+	}
+	if returned.btw.active || returned.btw.parent != nil {
+		t.Fatalf("BTW state remained active after /btw: %#v", returned.btw)
+	}
+	if returned.activeSession.SessionID != parentID {
+		t.Fatalf("returned session = %q, want parent %q", returned.activeSession.SessionID, parentID)
+	}
+}
+
+func TestBTWCtrlCDuringRunDoesNotClearDraft(t *testing.T) {
+	m := newBTWTestModel(t)
+	side, _ := m.handleBTWCommand("")
+	side.pending = true
+	side.input.SetValue("keep this draft")
+
+	updated, cmd := side.handleCtrlC()
+	got := updated.(model)
+	if cmd != nil {
+		t.Fatal("Ctrl+C should not start a command while a BTW response is running")
+	}
+	if !got.btw.active {
+		t.Fatal("Ctrl+C returned from BTW while its response was still running")
+	}
+	if got.composerValue() != "keep this draft" {
+		t.Fatalf("Ctrl+C cleared the in-flight BTW draft: %q", got.composerValue())
+	}
+	if !transcriptContains(got.transcript, "BTW response is still running") {
+		t.Fatalf("missing in-flight return guidance: %#v", got.transcript)
+	}
+}

internal/tui/commands.go

@@ -47,6 +47,7 @@ const (
 	commandCopy
 	commandExport
 	commandNew
+	commandBTW
 	commandSkills
 	commandLoop
 	commandVoice
@@ -192,6 +193,13 @@ var commandDefinitions = []commandDefinition{
 		description: "Start a fresh session; the current one stays resumable via /resume.",
 		kind:        commandNew,
 	},
+	{
+		name:        "/btw",
+		usage:       "/btw [question]",
+		group:       commandGroupSession,
+		description: "Open an isolated side conversation; run /btw again to return.",
+		kind:        commandBTW,
+	},
 	{
 		name:        "/search",
 		aliases:     []string{"/find"},
@@ -253,7 +261,6 @@ var commandDefinitions = []commandDefinition{
 	},
 	{
 		name:        "/rewind",
-		aliases:     []string{"/undo"},
 		usage:       "/rewind [latest|<sequence>]",
 		group:       commandGroupSession,
 		description: "Restore workspace files to a checkpoint and truncate the session.",

internal/tui/commands_test.go

@@ -985,31 +985,6 @@ func TestParseBackgroundTerminalCommands(t *testing.T) {
 	}
 }
 
-// /undo is an alias for /rewind (issue #698): previously it fell through to
-// commandUnknown.
-func TestUndoAliasesRewind(t *testing.T) {
-	rewind, ok := resolveCommand("/rewind")
-	if !ok {
-		t.Fatal("expected /rewind to resolve")
-	}
-	alias, ok := resolveCommand("/undo")
-	if !ok || alias.kind != rewind.kind {
-		t.Fatalf("expected /undo to alias /rewind, got ok=%v command=%#v", ok, alias)
-	}
-	// End-to-end: a typed /undo dispatches to the rewind handler with args intact,
-	// for both the "latest" and numeric-<sequence> forms of the /rewind contract.
-	if parsed := parseCommand("/undo latest"); parsed.kind != commandRewind || parsed.text != "latest" {
-		t.Fatalf("parseCommand(%q) = %#v, want commandRewind with text=latest", "/undo latest", parsed)
-	}
-	if parsed := parseCommand("/undo 123"); parsed.kind != commandRewind || parsed.text != "123" {
-		t.Fatalf("parseCommand(%q) = %#v, want commandRewind with text=123", "/undo 123", parsed)
-	}
-	// Guard: without the alias it would be commandUnknown.
-	if parsed := parseCommand("/undo"); parsed.kind == commandUnknown {
-		t.Fatal("/undo resolved to commandUnknown — the alias is not wired")
-	}
-}
-
 func TestCommandSelectionRequiresInputFromUsage(t *testing.T) {
 	cases := []struct {
 		name string

internal/tui/keybinding_help.go

@@ -31,6 +31,10 @@ type keybindingGroup struct {
 // Sourced from the real key cases in model.go (Update) — not invented. When a
 // binding is added/changed there, update this method too.
 func (m model) buildKeybindingGroups() []keybindingGroup {
+	ctrlCDescription := "cancel the run, then quit"
+	if m.btw.active {
+		ctrlCDescription = "return to the main session when the BTW run is idle"
+	}
 	return []keybindingGroup{
 		{
 			title: "Chat",
@@ -38,7 +42,7 @@ func (m model) buildKeybindingGroups() []keybindingGroup {
 				{"Enter", "send the message"},
 				{"Shift+Enter / Alt+Enter", "insert a newline (multi-line compose)"},
 				{"Esc (\u00d72)", "cancel the run / dismiss a popup / clear the input"},
-				{"Ctrl+C", "cancel the run, then quit"},
+				{"Ctrl+C", ctrlCDescription},
 				{"Ctrl+X then letter", "common slash commands (m=/model, p=/provider, r=/resume, \u2026)"},
 				{"Ctrl+X ?", "list every Ctrl+X slash shortcut"},
 				{"?", "show this help (on an empty input)"},

internal/tui/model.go

@@ -103,6 +103,11 @@ type model struct {
 	doctorFrame          int
 	activeSession        sessions.Metadata
 	sessionEvents        []sessions.Event
+	btw                  btwState
+	// btwRunIDSeq is the highest run ID issued by any completed or abandoned BTW
+	// surface. It survives returning to the parent so a late message from an old
+	// side run can never match a run in a later BTW conversation.
+	btwRunIDSeq int
 	// titledSessions records session ids for which a model-generated title has
 	// already been attempted this process, so a finished turn re-fires the title
 	// generator at most once per session (even before its async result lands).
@@ -1029,6 +1034,14 @@ func (m model) shutdownLSPManager() {
 }
 
 func (m model) handleCtrlC() (tea.Model, tea.Cmd) {
+	if m.btw.active {
+		if !m.pending && m.composerValue() != "" && m.noBlockingModal() && !m.transcriptDetailed && !m.subchat.active {
+			m.clearComposer()
+			m.clearSuggestions()
+			return m, nil
+		}
+		return m.leaveBTW()
+	}
 	if !m.pending && m.composerValue() != "" && m.noBlockingModal() && !m.transcriptDetailed && !m.subchat.active {
 		m.clearComposer()
 		m.clearSuggestions()
@@ -1108,6 +1121,12 @@ func batchCommands(cmds ...tea.Cmd) tea.Cmd {
 }
 
 func (m model) updateModel(msg tea.Msg) (tea.Model, tea.Cmd) {
+	if size, ok := msg.(tea.WindowSizeMsg); ok {
+		m = m.resizeBTWParent(size)
+	}
+	if next, cmd, routed := m.routeBTWParentMessage(msg); routed {
+		return next, cmd
+	}
 	switch msg := msg.(type) {
 	case composerBlinkMsg:
 		switch {
@@ -4114,6 +4133,21 @@ func (m model) handleSubmit() (tea.Model, tea.Cmd) {
 // dispatchCommand runs a parsed slash/prompt command after submit/leader
 // preamble (history, composer clear, leave-prompt disarm) has already run.
 func (m model) dispatchCommand(command parsedCommand) (tea.Model, tea.Cmd) {
+	if m.btw.active && command.kind == commandExit && m.btw.parent != nil &&
+		(m.btw.parent.pending || m.btw.parent.compactInFlight || len(m.btw.parent.flushRunIDs) > 0) {
+		m.transcript = reduceTranscript(m.transcript, transcriptAction{
+			kind: actionAppendSystem,
+			text: "The main session is still running. Return to it first with /btw or Ctrl+C before exiting.",
+		})
+		return m, nil
+	}
+	if m.btw.active && btwCommandUnavailable(command) {
+		m.transcript = reduceTranscript(m.transcript, transcriptAction{
+			kind: actionAppendSystem,
+			text: command.name + " is unavailable in a BTW conversation. Return to the main session first with /btw or Ctrl+C.",
+		})
+		return m, nil
+	}
 	switch command.kind {
 	case commandEmpty:
 		return m, nil
@@ -4152,6 +4186,8 @@ func (m model) dispatchCommand(command parsedCommand) (tea.Model, tea.Cmd) {
 			return m, nil
 		}
 		return m.startNewSession(), nil
+	case commandBTW:
+		return m.handleBTWCommand(command.text)
 	case commandLoop:
 		return m.handleLoopCommand(command.text)
 	case commandExit:

internal/tui/session.go

@@ -246,11 +246,15 @@ func (m model) sessionPrompt(prompt string) string {
 	if m.activeSession.SessionID == "" || len(m.sessionEvents) == 0 {
 		return prompt
 	}
-	return sessions.FormatExecPrompt(prompt, sessions.PreparedExec{
+	formatted := sessions.FormatExecPrompt(prompt, sessions.PreparedExec{
 		Mode:          sessions.ModeResume,
 		Session:       m.activeSession,
 		ContextEvents: append([]sessions.Event{}, m.sessionEvents...),
 	})
+	if m.activeSession.SessionKind == sessions.SessionKindSide {
+		return btwContextBoundary + "\n\n" + formatted
+	}
+	return formatted
 }
 
 func (m model) resolveResumeSession(args string) (*sessions.Metadata, error) {
@@ -276,6 +280,9 @@ func (m model) resolveResumeSession(args string) (*sessions.Metadata, error) {
 	if session == nil {
 		return nil, fmt.Errorf("zero session not found: %s", args)
 	}
+	if !sessions.IsResumableKind(session.SessionKind) {
+		return nil, fmt.Errorf("zero session is not resumable: %s", args)
+	}
 	return session, nil
 }
 

internal/tui/view.go

@@ -195,17 +195,21 @@ func (m model) statusLine(width int) string {
 	// in its mode colour. This was previously only on the easy-to-miss composer
 	// rule; the persistent footer is where users look for "will it run commands?".
 	modeText, modeStyle := m.modeLabel()
-	left := prefix + zeroTheme.accent.Render("●") + " " + modeStyle.Render(modeText)
+	btwChip := ""
+	if m.btw.active {
+		btwChip = zeroTheme.amber.Render("BTW") + zeroTheme.muted.Render(" · ")
+	}
+	left := prefix + btwChip + zeroTheme.accent.Render("●") + " " + modeStyle.Render(modeText)
 
 	if tier == tierTiny {
 		if m.exitConfirmActive {
-			return fitStyledLine(prefix+zeroTheme.amber.Render("●")+" "+zeroTheme.amber.Render(ctrlCExitConfirmText), width)
+			return fitStyledLine(prefix+btwChip+zeroTheme.amber.Render("●")+" "+zeroTheme.amber.Render(ctrlCExitConfirmText), width)
 		}
 		if m.cancelConfirmActive {
-			return fitStyledLine(prefix+zeroTheme.amber.Render("●")+" "+zeroTheme.amber.Render(escCancelConfirmText), width)
+			return fitStyledLine(prefix+btwChip+zeroTheme.amber.Render("●")+" "+zeroTheme.amber.Render(escCancelConfirmText), width)
 		}
 		if dictation := m.dictationStatusChip(); dictation != "" {
-			return fitStyledLine(prefix+dictation, width)
+			return fitStyledLine(prefix+btwChip+dictation, width)
 		}
 		return fitStyledLine(left, width)
 	}
@@ -215,16 +219,16 @@ func (m model) statusLine(width int) string {
 		left += zeroTheme.muted.Render(" · ") + zeroTheme.accent.Render(string(m.reasoningEffort))
 	}
 	if m.exitConfirmActive {
-		left = prefix + zeroTheme.amber.Render("●") + " " + zeroTheme.amber.Render(ctrlCExitConfirmText)
+		left = prefix + btwChip + zeroTheme.amber.Render("●") + " " + zeroTheme.amber.Render(ctrlCExitConfirmText)
 	} else if m.cancelConfirmActive {
-		left = prefix + zeroTheme.amber.Render("●") + " " + zeroTheme.amber.Render(escCancelConfirmText)
+		left = prefix + btwChip + zeroTheme.amber.Render("●") + " " + zeroTheme.amber.Render(escCancelConfirmText)
 	} else if m.dictation.downloading && m.dictation.downloadStatus != "" {
 		// A model download in progress takes over the left chip with a live percentage.
-		left = prefix + zeroTheme.accent.Render("⬇ ") + zeroTheme.muted.Render(m.dictation.downloadStatus)
+		left = prefix + btwChip + zeroTheme.accent.Render("⬇ ") + zeroTheme.muted.Render(m.dictation.downloadStatus)
 	} else if dictation := m.dictationStatusChip(); dictation != "" && m.dictation.active() {
 		// An active recording/transcription takes over the left chip — it is the
 		// most time-sensitive thing on screen (the mic is live).
-		left = prefix + dictation
+		left = prefix + btwChip + dictation
 	} else {
 		if voice := m.voiceModeIndicator(); voice != "" {
 			left += zeroTheme.muted.Render(" · ") + voice