diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f151cdb4..cfc79a618 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -122,6 +122,8 @@ breaking changes may land in a minor release.
 - Write each OpenCode 2.x provider-error event to `logs/<task-id>.provider-errors.log`;
   classify rate-limit and transport outages there as environment faults and quota
   failures as a blocking usage limit (#847).
+- Render OpenCode 2.x forms in the `[bmad]` transcript: a `form ask` line naming the form
+  and its questions when one parks the turn, then `form reply` or `form cancelled`.
 - Add the `subagent_transcript_dir` CLI profile field: a subagent transcript tree whose
   writes count as session activity for the idle notice (#858).
 - Name the tool call an idle Claude session is waiting on: `session-idle` carries
@@ -218,6 +220,25 @@ breaking changes may land in a minor release.
 
 ### Fixed
 
+- Count OpenCode 2.x subagent (child) session tokens, at every nesting depth, in recorded
+  usage and the budget guard's samples; a failed child walk is a `usage-capture-failed`
+  (`stage=children`) fault, never a parent-only figure. A child still running at capture
+  is journaled as `usage-child-active` (DW-540).
+- Ignore an Antigravity `Stop` sent with `fullyIdle: false` (a yield to a foreground
+  subagent) instead of completing the session while the subagent still works; the
+  relay forwards `fully_idle`, and `hook-stop-yield-ignored` journals the skip.
+- Ignore an Antigravity subagent conversation's `Stop` instead of letting its final turn end
+  complete the parent early: the new profile key `subagent_spawn_marker` identifies a child
+  by the spawn file its parent wrote, and `subagent-stop-ignored` journals each child.
+- Count an Antigravity subagent's writes as its parent's activity, so a parent blocked on a
+  long foreground subagent no longer journals a false `session-idle`: the idle notice walks
+  each child conversation the parent's `subagent_spawn_marker` files list.
+- Classify OpenCode 2.x provider 5xx errors (`provider.internal`), rejected credentials
+  (`provider.auth`) and unroutable models (`provider.no-route`) as environment faults
+  instead of charging the session as a code failure.
+- Let sandboxed Codex sessions commit under worktree isolation: grant them write access to
+  the linked worktree's gitdir and the main repo's `.git`. `validate` warns only when
+  `extra_args` drops the grant or the profile's grant misses either path.
 - Pause a tickets resume at `ticket-tree` (`binding-moved`) when an in-flight unit's ticket
   was moved with `tickets.py move` or its plan is gone, naming the old and new ref and plan,
   instead of re-dispatching a ref the tree no longer holds (DW-575).
diff --git a/docs/FEATURES.md b/docs/FEATURES.md
index 334e615a8..c5c41f966 100644
--- a/docs/FEATURES.md
+++ b/docs/FEATURES.md
@@ -169,7 +169,7 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - `bmad-loop resume` re-runs the probes; if they pass, the withheld session launches with no rollback, and otherwise the run pauses again unchanged.
   - A verify command exiting 126, 127 or `[verify] env_fault_rc` is an environment fault, not a code failure.
   - A non-completed session whose log tail matches its profile's `env_fault_patterns` pauses instead of spending a dev attempt.
-  - opencode is classified from model-free files only: the server's stdout, plus on OpenCode 2.x the adapter-written `provider-errors.log` (one line per provider-error event). Its 2.x environment-fault patterns cover the `provider.rate-limit` and `provider.transport` error types; `provider.quota` is a usage limit.
+  - opencode is classified from model-free files only: the server's stdout, plus on OpenCode 2.x the adapter-written `provider-errors.log` (one line per provider-error event). Its 2.x environment-fault patterns cover the `provider.rate-limit`, `provider.transport`, `provider.internal` (a provider 5xx), `provider.auth` and `provider.no-route` error types; `provider.quota` is a usage limit, and error types the session's own request can cause (`provider.invalid-request`, `provider.invalid-output`) stay unclassified.
   - A pattern match is overruled when the session's tracked token usage is nonzero; that session is charged like any failure.
   - A session that times out, stalls or crashes after a live usage-limit sighting pauses with a `usage limit:` reason and is never charged, whatever its token usage. A live sighting is a match for the profile's `usage_limit_patterns` or `usage_wait_patterns` from one of two sources: the visible pane of a tmux-hosted CLI such as claude, on an idle session at stall-grace expiry or when the timeout fires; or an opencode 2.x provider-error line, matched as the adapter writes it while the session runs (opencode's shipped profile lists `provider.quota` there as a blocking limit). The same line found only in the log tail stays subject to the overrule.
   - When the usage-limit line names a reset time, the pause reason ends its evidence with `; resets <time>` (ISO-8601 when the time resolves, the raw text otherwise).
@@ -358,7 +358,7 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - A stage inherits the base mode even when it switches client; `[adapter.<stage>] permission_mode` overrides it.
   - `bmad-loop resolve` sessions, where a human is present, keep the bypass flags whatever the mode.
   - `validate` reports each role's permission posture as `adapter.permission-mode`, suggesting `sandboxed` for an unsandboxed role without worktree isolation when the profile maps it. The note is advisory: a worktree is not a security boundary.
-  - Sandboxed Codex under `scm.isolation = "worktree"` is a warning: the sandbox keeps a linked worktree's gitdir read-only, so git add and commit fail.
+  - A sandboxed Codex session in a linked worktree (`scm.isolation = "worktree"`) gets exact-path write grants for that worktree's gitdir and the main repo's shared `.git`, so git add and commit work. `validate` warns only when the grant cannot ride: an `extra_args` override replaces the mode's args and drops it, or the profile's mode declares no `linked_worktree_args` or a grant missing `{gitdir}` or `{common_dir}`.
   - `tickets.store-sandbox` also warns when a sandboxed role writes a ticket store outside its cwd.
 - **Config:** `[adapter] permission_mode`, `[adapter.dev]` / `[adapter.review]` / `[adapter.triage]` / `[adapter.retro]` `permission_mode`; profile table `[permission_modes.<mode>]`
 - **Tested by:** `tests/test_policy.py`, `tests/test_profile.py`, `tests/test_runsetup.py`, `tests/test_cli.py`, `tests/test_codex_trust.py`, `tests/test_install.py`
diff --git a/docs/adapter-authoring-guide.md b/docs/adapter-authoring-guide.md
index 00e3cbc47..31b90f74e 100644
--- a/docs/adapter-authoring-guide.md
+++ b/docs/adapter-authoring-guide.md
@@ -304,34 +304,35 @@ a new `name` extends the set. The aliases `claude-code-tmux` and `opencode` reso
 
 ### `CLIProfile`
 
-| Field                              | Required | Default                                                                        | Meaning                                                                                                                                                                                                           |
-| ---------------------------------- | -------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `name`                             | ✅       | —                                                                              | Profile id: the `--cli` value, the policy `[adapter] name`, and the override key.                                                                                                                                 |
-| `binary`                           | ✅       | —                                                                              | Executable resolved on `PATH`. `validate` runs `--version` only on binary names a packaged profile declares (`adapter.binary-unrunnable`).                                                                        |
-| `[hooks]`                          | ✅       | —                                                                              | The [`HookSpec`](#hookspec-the-hooks-table) table.                                                                                                                                                                |
-| `adapter`                          |          | `generic` (`opencode-http` if `dialect=none`)                                  | Adapter kind, resolved against the live [registry](#shipping-a-new-adapter-class-out-of-tree) at run start and by `validate` (`adapter.kind`). `generic` with `dialect = "none"` is refused.                      |
-| `skill_tree`                       |          | `.claude/skills`                                                               | Project-relative tree the CLI reads skills from; `init` installs the `bmad-loop-*` skills here. Must stay inside the project.                                                                                     |
-| `prompt_template`                  |          | `{prompt}`                                                                     | Renders the canonical `/skill args` prompt. Placeholders: `{prompt}` (whole string), `{skill}` (command name, no `/`), `{args}` (the rest).                                                                       |
-| `launch_args`                      |          | `[]`                                                                           | Argv after `binary` (`["-i"]` keeps gemini/copilot interactive). Under `opencode-http` it precedes `serve`; `validate` warns on unservable shapes.                                                                |
-| `bypass_args`                      |          | `[]`                                                                           | Permission-bypass flags for unattended runs, launched under `permission_mode = "bypass"`. A policy `extra_args` replaces them; `validate` warns (`policy.bypass-dropped`) when one is dropped.                    |
-| `model_flag`                       |          | `--model`                                                                      | Flag passed with the model name when one is configured.                                                                                                                                                           |
-| `env`                              |          | `{}`                                                                           | `[env]` table of extra session environment variables. It cannot override the run's state-root pin.                                                                                                                |
-| `usage_parser`                     |          | `none`                                                                         | Transcript token parser: `claude-jsonl`, `codex-rollout`, `gemini-chat`, `copilot-events` or `none`.                                                                                                              |
-| `usage_grace_s`                    |          | `0.0`                                                                          | Seconds to keep polling the transcript for token totals after the session ends; `0` reads once. Must be ≥ 0.                                                                                                      |
-| `stop_without_result_nudges`       |          | unset                                                                          | Per-profile default for Stop-without-result nudges. An `[adapter]` / `[adapter.<stage>]` value overrides it; unset inherits `[limits] stop_without_result_nudges`. Must be ≥ 0.                                   |
-| `subagent_stop_without_transcript` |          | `false`                                                                        | When `true`, a `Stop` with no transcript path is a subagent turn-end and is ignored.                                                                                                                              |
-| `first_run_note`                   |          | `""`                                                                           | Note `init` prints about a manual first-run or auth step.                                                                                                                                                         |
-| `seed_files`                       |          | `[]`                                                                           | Project-relative gitignored files copied into each provisioned worktree. Must stay inside the project.                                                                                                            |
-| `env_fault_patterns`               |          | `[]`                                                                           | Regexes that classify a non-completed session as an environment fault. See [Environment-fault patterns](#environment-fault-patterns).                                                                             |
-| `parked_prompt_patterns`           |          | `[]`                                                                           | Regexes matched against the visible pane at each stall-grace expiry and at the timeout. See [Parked-session signals](#parked-session-signals).                                                                    |
-| `usage_limit_patterns`             |          | `[]`                                                                           | Regexes for a usage-limit line the CLI stays blocked behind until an operator acts. See [Usage-limit signals](#usage-limit-signals).                                                                              |
-| `usage_wait_patterns`              |          | `[]`                                                                           | Regexes for a usage-limit line the CLI waits out and continues from by itself. Disjoint from `usage_limit_patterns`. See [Usage-limit signals](#usage-limit-signals).                                             |
-| `auto_deny_patterns`               |          | `[]`                                                                           | Regexes for the CLI's auto-deny countdown on a permission prompt, with named groups `min` and `sec`. See [Parked-session signals](#parked-session-signals).                                                       |
-| `[workspace_trust]`                |          | unset                                                                          | The [`WorkspaceTrustSpec`](#workspacetrustspec-the-workspace_trust-table) table. Unset: nothing under `~` is read or written.                                                                                     |
-| `[parked_answers]`                 |          | unset                                                                          | The [`[parked_answers]`](#answer-keys-the-parked_answers-table) table. Unset: the TUI offers no answer keys.                                                                                                      |
-| `[permission_modes.<mode>]`        |          | unset                                                                          | Launch args for a non-bypass `[adapter] permission_mode`. See [Permission modes](#permission-modes). Unset: the profile refuses that mode.                                                                        |
-| `session_id_flag`                  |          | `""`                                                                           | Launch flag for a caller-chosen session id (claude: `--session-id`). The generic adapter appends `[flag, uuid4]` and pins attribution to that id.                                                                 |
-| `subagent_transcript_dir`          |          | derived from `usage_parser` (`{stem}/subagents` for `claude-jsonl`, else `""`) | Subagent transcript tree beside the transcript, walked recursively and stat-only; its writes count as idle-notice activity. Must contain `{stem}` (the transcript's filename stem) and stay relative; `""` = off. |
+| Field                              | Required | Default                                                                        | Meaning                                                                                                                                                                                                                                                                                                    |
+| ---------------------------------- | -------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `name`                             | ✅       | —                                                                              | Profile id: the `--cli` value, the policy `[adapter] name`, and the override key.                                                                                                                                                                                                                          |
+| `binary`                           | ✅       | —                                                                              | Executable resolved on `PATH`. `validate` runs `--version` only on binary names a packaged profile declares (`adapter.binary-unrunnable`).                                                                                                                                                                 |
+| `[hooks]`                          | ✅       | —                                                                              | The [`HookSpec`](#hookspec-the-hooks-table) table.                                                                                                                                                                                                                                                         |
+| `adapter`                          |          | `generic` (`opencode-http` if `dialect=none`)                                  | Adapter kind, resolved against the live [registry](#shipping-a-new-adapter-class-out-of-tree) at run start and by `validate` (`adapter.kind`). `generic` with `dialect = "none"` is refused.                                                                                                               |
+| `skill_tree`                       |          | `.claude/skills`                                                               | Project-relative tree the CLI reads skills from; `init` installs the `bmad-loop-*` skills here. Must stay inside the project.                                                                                                                                                                              |
+| `prompt_template`                  |          | `{prompt}`                                                                     | Renders the canonical `/skill args` prompt. Placeholders: `{prompt}` (whole string), `{skill}` (command name, no `/`), `{args}` (the rest).                                                                                                                                                                |
+| `launch_args`                      |          | `[]`                                                                           | Argv after `binary` (`["-i"]` keeps gemini/copilot interactive). Under `opencode-http` it precedes `serve`; `validate` warns on unservable shapes.                                                                                                                                                         |
+| `bypass_args`                      |          | `[]`                                                                           | Permission-bypass flags for unattended runs, launched under `permission_mode = "bypass"`. A policy `extra_args` replaces them; `validate` warns (`policy.bypass-dropped`) when one is dropped.                                                                                                             |
+| `model_flag`                       |          | `--model`                                                                      | Flag passed with the model name when one is configured.                                                                                                                                                                                                                                                    |
+| `env`                              |          | `{}`                                                                           | `[env]` table of extra session environment variables. It cannot override the run's state-root pin.                                                                                                                                                                                                         |
+| `usage_parser`                     |          | `none`                                                                         | Transcript token parser: `claude-jsonl`, `codex-rollout`, `gemini-chat`, `copilot-events` or `none`.                                                                                                                                                                                                       |
+| `usage_grace_s`                    |          | `0.0`                                                                          | Seconds to keep polling the transcript for token totals after the session ends; `0` reads once. Must be ≥ 0.                                                                                                                                                                                               |
+| `stop_without_result_nudges`       |          | unset                                                                          | Per-profile default for Stop-without-result nudges. An `[adapter]` / `[adapter.<stage>]` value overrides it; unset inherits `[limits] stop_without_result_nudges`. Must be ≥ 0.                                                                                                                            |
+| `subagent_stop_without_transcript` |          | `false`                                                                        | When `true`, a `Stop` with no transcript path is a subagent turn-end and is ignored.                                                                                                                                                                                                                       |
+| `subagent_spawn_marker`            |          | unset                                                                          | File a parent conversation writes when it spawns a child, relative to a conversation folder, with `{session_id}` as the child's id. A `Stop` whose id has this marker in a sibling folder is ignored; the children a parent's own folder lists this way have their writes counted as idle-notice activity. |
+| `first_run_note`                   |          | `""`                                                                           | Note `init` prints about a manual first-run or auth step.                                                                                                                                                                                                                                                  |
+| `seed_files`                       |          | `[]`                                                                           | Project-relative gitignored files copied into each provisioned worktree. Must stay inside the project.                                                                                                                                                                                                     |
+| `env_fault_patterns`               |          | `[]`                                                                           | Regexes that classify a non-completed session as an environment fault. See [Environment-fault patterns](#environment-fault-patterns).                                                                                                                                                                      |
+| `parked_prompt_patterns`           |          | `[]`                                                                           | Regexes matched against the visible pane at each stall-grace expiry and at the timeout. See [Parked-session signals](#parked-session-signals).                                                                                                                                                             |
+| `usage_limit_patterns`             |          | `[]`                                                                           | Regexes for a usage-limit line the CLI stays blocked behind until an operator acts. See [Usage-limit signals](#usage-limit-signals).                                                                                                                                                                       |
+| `usage_wait_patterns`              |          | `[]`                                                                           | Regexes for a usage-limit line the CLI waits out and continues from by itself. Disjoint from `usage_limit_patterns`. See [Usage-limit signals](#usage-limit-signals).                                                                                                                                      |
+| `auto_deny_patterns`               |          | `[]`                                                                           | Regexes for the CLI's auto-deny countdown on a permission prompt, with named groups `min` and `sec`. See [Parked-session signals](#parked-session-signals).                                                                                                                                                |
+| `[workspace_trust]`                |          | unset                                                                          | The [`WorkspaceTrustSpec`](#workspacetrustspec-the-workspace_trust-table) table. Unset: nothing under `~` is read or written.                                                                                                                                                                              |
+| `[parked_answers]`                 |          | unset                                                                          | The [`[parked_answers]`](#answer-keys-the-parked_answers-table) table. Unset: the TUI offers no answer keys.                                                                                                                                                                                               |
+| `[permission_modes.<mode>]`        |          | unset                                                                          | Launch args for a non-bypass `[adapter] permission_mode`. See [Permission modes](#permission-modes). Unset: the profile refuses that mode.                                                                                                                                                                 |
+| `session_id_flag`                  |          | `""`                                                                           | Launch flag for a caller-chosen session id (claude: `--session-id`). The generic adapter appends `[flag, uuid4]` and pins attribution to that id.                                                                                                                                                          |
+| `subagent_transcript_dir`          |          | derived from `usage_parser` (`{stem}/subagents` for `claude-jsonl`, else `""`) | Subagent transcript tree beside the transcript, walked recursively and stat-only; its writes count as idle-notice activity. Must contain `{stem}` (the transcript's filename stem) and stay relative; `""` = off.                                                                                          |
 
 `session_id_flag` must be one `-`-prefixed token with no whitespace or `=`, and is refused
 on hookless profiles. Set it only when the CLI's `SessionStart` payload reports the id you
@@ -340,6 +341,17 @@ passed.
 An overlay that changes `usage_parser` away from `claude-jsonl` must set
 `subagent_transcript_dir` itself; it is refused on hookless profiles.
 
+`subagent_spawn_marker` applies to a `Stop` whose transcript sits under a folder named by its
+session id; that folder's parent holds the conversation folders searched for the marker. A
+`Stop` it cannot judge (no id, no transcript path, no such folder) or a marker it cannot read
+is admitted and journaled once (`subagent-marker-unjudged`, `subagent-marker-unreadable`); a
+dropped child is journaled once per id (`subagent-stop-ignored`). The idle notice also walks
+each child the parent's folder lists (`<store root>/<childId>/`, its `*.jsonl` files only,
+stat-only) as it walks `subagent_transcript_dir`; when the parent's folder cannot be judged it
+watches no children, and a listing fault joins `subagent-scan-failed`. Like
+`subagent_transcript_dir`, it must contain its placeholder (here `{session_id}`), stay relative
+with no `..`, and is refused on hookless profiles.
+
 ### `HookSpec` (the `[hooks]` table)
 
 | Field                | Required                     | Default | Meaning                                                                                                                                                          |
@@ -430,8 +442,9 @@ is in [Environment faults](escalations-guide.md#environment-faults).
 - Patterns are a list of strings, compiled at load (an invalid regex is a profile error),
   and matched with the `regex` module under a per-pattern timeout.
 - Seeded for `claude` (connection loss and two captured provider 5xx errors) and
-  `opencode` (provider quota/rate-limit and connection on 1.x; `provider.rate-limit` and
-  `provider.transport` events on 2.x, whose `provider.quota` is a usage limit instead).
+  `opencode` (provider quota/rate-limit and connection on 1.x; `provider.rate-limit`,
+  `provider.transport`, `provider.internal`, `provider.auth` and `provider.no-route` events
+  on 2.x, whose `provider.quota` is a usage limit instead).
   Empty means inert.
 - The tail scan also covers `usage_limit_patterns` and `usage_wait_patterns` as ordinary
   pattern families, under the same token-usage overrule: a session that got past a limit
@@ -519,10 +532,25 @@ deny_guard = ['Do you want to procee[d]\?']
 default) launches `bypass_args`. Any other mode launches the args of the profile's
 `[permission_modes.<mode>]` table in their place:
 
-| Field       | Required | Meaning                                                                                                  |
-| ----------- | -------- | -------------------------------------------------------------------------------------------------------- |
-| `args`      | ✅       | Launch args that stand in for `bypass_args`. A policy `extra_args` still replaces them.                  |
-| `platforms` |          | `sys.platform` values the mapping works on (`linux`, `darwin`, `win32`). Empty or unset: every platform. |
+| Field                  | Required | Meaning                                                                                                                                    |
+| ---------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| `args`                 | ✅       | Launch args that stand in for `bypass_args`. A policy `extra_args` still replaces them.                                                    |
+| `platforms`            |          | `sys.platform` values the mapping works on (`linux`, `darwin`, `win32`). Empty or unset: every platform.                                   |
+| `linked_worktree_args` |          | Args appended after `args` when the session runs in a linked worktree, with `{gitdir}` and `{common_dir}` filled in. Empty or unset: none. |
+
+`linked_worktree_args` is for a sandbox that must be granted a linked worktree's git
+directories explicitly. When the session's cwd is in a linked worktree (as under
+`scm.isolation = "worktree"`), the generic adapter asks git for that worktree's gitdir
+(`<main>/.git/worktrees/<name>`) and the common dir (`<main>/.git`), resolves both, and
+appends the list after the mode's `args` with each `{gitdir}` / `{common_dir}` replaced by
+that path written as a TOML basic string, quotes included. In a main checkout nothing is
+appended. Under `bypass`, or when a policy `extra_args` replaces the mode's args, nothing is
+appended and git is not asked.
+
+If git cannot answer, or a path cannot be written as TOML, the session refuses to launch
+rather than start without the grant. Each entry must be a non-empty string, and at least one
+entry must use a placeholder: an arg with no path in it belongs in `args`. The config digest
+hashes the unfilled list, so a resumed run's digest does not depend on the worktree path.
 
 A profile without the table, or on an excluded platform, refuses the mode at run start and
 in `validate` (`adapter.permission-mode-unsupported`). `opencode-http` never launches
@@ -537,14 +565,22 @@ return to the agent as an error. The shipped mappings, both for `linux` and `dar
   sandbox with no unsandboxed retry. Sandboxed Bash can run git and write `.git`; network is
   denied. On Linux the Bash sandbox needs bubblewrap and socat installed, or the session
   refuses to start.
-- **codex:** a `-c` permission profile extending `:workspace` with a `.git` write grant,
-  plus `--ask-for-approval never`. Network is off. In a linked worktree the gitdir under
-  the main repo's `.git/worktrees/` stays read-only, so git add and commit fail there;
-  `validate` warns about sandboxed Codex under `scm.isolation = "worktree"`.
+- **codex:** a `-c` permission profile `bmad_loop` extending `:workspace` with a `.git`
+  write grant, plus `--ask-for-approval never`. Network is off. Its `linked_worktree_args`
+  define a child profile `bmad_loop_worktree` that extends `bmad_loop` with write grants
+  for the linked worktree's gitdir and the common dir, and select it with a later
+  `default_permissions`, so git add and commit work in a worktree checkout. `validate`
+  warns about sandboxed Codex under `scm.isolation = "worktree"` only when that grant
+  cannot ride: an `extra_args` override, or a profile whose mode declares no
+  `linked_worktree_args` or a grant that names only one of `{gitdir}` and `{common_dir}`
+  (Codex needs both to commit).
 
 The sandbox confines the session, not what bmad-loop later runs from the checkout. Both
 mappings leave `.git` writable, hooks and config included, and the orchestrator runs
-`[verify] commands` and its own git commits there unsandboxed.
+`[verify] commands` and its own git commits there unsandboxed. In a linked worktree,
+Codex's common-dir grant opens the main repo's `.git` (hooks, config, the main index and
+refs) to the session, the same exposure a sandboxed session in the main checkout already
+has through the `.git` grant.
 
 Both CLIs show a one-time workspace-trust dialog in a directory they have not seen.
 `validate` reports each role's posture as `adapter.permission-mode`.
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index cdb5ca782..800a20e6c 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -631,7 +631,7 @@ Every finding's `check` is one of these ids. Severity is `ok`, `warning` or `pro
 | `policy.effort-unsupported`            | warning                | `effort` set on a profile whose adapter ignores it                                                                                                      |
 | `policy.bypass-dropped`                | warning                | an explicit `extra_args` drops the profile's `bypass_args`                                                                                              |
 | `adapter.permission-mode-unsupported`  | problem                | a role's profile cannot run its `permission_mode` on this platform                                                                                      |
-| `adapter.permission-mode`              | ok / warning           | each role's permission posture; a warning for sandboxed Codex under worktree isolation                                                                  |
+| `adapter.permission-mode`              | ok / warning           | each role's permission posture; a warning for sandboxed Codex under worktree isolation when no linked-worktree gitdir grant rides                       |
 | `adapter.launch-probe`                 | ok / warning / problem | `--probes`: each distinct `generic`-profile launch; a startup dialog is a problem, an unseen screen a warning; ok with nothing launched if no patterns  |
 | `adapter.profile`                      | problem                | a role's adapter name does not resolve to a loadable profile                                                                                            |
 | `adapter.binary`                       | ok / problem           | the profile binary is on `PATH`                                                                                                                         |
diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md
index cce0bab1e..c38aa118b 100644
--- a/docs/reference/configuration.md
+++ b/docs/reference/configuration.md
@@ -143,7 +143,7 @@ CLI client, model & permission flags (base for all stages).
 | `name` | string | unset — CLI profile — default: claude |  |  |
 | `model` | string | unset — CLI default model |  |  |
 | `effort` | string | unset — provider default |  | reasoning effort, free-form (provider/model-specific, e.g. high, max); sent by opencode-http as the model variant (on 2.x it must be one of the model's variants), ignored by the tmux CLIs |
-| `extra_args` | array of strings | unset |  | when set, replaces the CLI profile's permission-bypass flags (its bypass_args), so repeat them (e.g. claude: --permission-mode bypassPermissions) or unattended sessions may stall on permission prompts |
+| `extra_args` | array of strings | unset |  | when set, replaces the CLI profile's permission-bypass flags (its bypass_args), so repeat them (e.g. claude: --permission-mode bypassPermissions) or unattended sessions may stall on permission prompts · under a sandboxed permission_mode it also drops the mode's linked-worktree gitdir grant, so a sandboxed codex session under worktree isolation cannot commit |
 | `permission_mode` | string | `"bypass"` | `bypass` / `sandboxed` | bypass (default): launch the CLI profile's permission-bypass flags (its bypass_args) · sandboxed: launch the profile's non-blocking sandboxed flags instead — a denied action returns to the agent as an error rather than a prompt (claude and codex on linux/macOS; other profiles refuse it) · extra_args, when set, still replaces either · stages inherit it even when they switch client |
 | `cleanup_session_on_finish` | boolean | `true` |  |  |
 | `usage_grace_s` | float | unset — inherit from CLI profile (copilot ships 8s) | ≥ 0 | seconds to poll the transcript for token usage after a session ends; CLIs that flush totals on shutdown (copilot) need a grace |
diff --git a/docs/setup-guide.md b/docs/setup-guide.md
index d9764a942..1767af98a 100644
--- a/docs/setup-guide.md
+++ b/docs/setup-guide.md
@@ -434,7 +434,8 @@ What differs on 2.x:
   server's stdout on 2.x, so the adapter records each one in
   `<task-id>.provider-errors.log`, which the environment-fault classifier scans beside
   `<task-id>.server.out`. A quota failure there pauses the run as a usage limit, never
-  charged; rate limits and refused connections are environment faults.
+  charged; rate limits, refused connections, provider 5xx errors, rejected credentials
+  and unroutable models are environment faults.
 - **Going back to 1.x:** both majors keep their state in the same
   `~/.local/share/opencode/opencode.db`. A 1.x server refuses to start on a database a 2.x
   server created ("Database is not empty and has no session table"), so move that file
diff --git a/src/bmad_loop/adapters/generic.py b/src/bmad_loop/adapters/generic.py
index 5d7559189..5b1738bb6 100644
--- a/src/bmad_loop/adapters/generic.py
+++ b/src/bmad_loop/adapters/generic.py
@@ -40,7 +40,7 @@
 from datetime import datetime
 from functools import cached_property
 from pathlib import Path
-from typing import TYPE_CHECKING, Protocol, cast
+from typing import TYPE_CHECKING, Literal, Protocol, cast
 
 import regex
 
@@ -53,7 +53,7 @@
 from ..signals import REBIND_SOURCES, SessionAttribution, SignalWatcher
 from ..tokens import read_usage as tally_usage
 from ..usagereset import UsageReset, parse_reset
-from ..verify import read_frontmatter, status_of
+from ..verify import GitError, git_bytes, read_frontmatter, status_of
 from .base import (
     USAGE_LIMIT_BLOCKED,
     USAGE_LIMIT_WAIT,
@@ -162,8 +162,9 @@ class _IdleTracker:
     declares a subagent tree: the wait loop's `sample_transcript` reads
     `last_key[1]` as the parent's byte size — the #727 growth test and the scan
     offset for `_transcript_has_assistant_activity` — so a folded key would credit
-    subagent bytes as parent growth and scan from a wrong offset. The tree gets
-    its own `sub_key`, OR-ed only into the idle clock's change test.
+    subagent bytes as parent growth and scan from a wrong offset. The tree (and
+    any spawned child conversations) gets its own `sub_key`, OR-ed only into the
+    idle clock's change test.
 
     `tool_scan_failures` is the streak of `session-idle` `in_tool` reads that
     raised; it never moves the clock, only the `tool-scan-*` crumbs."""
@@ -189,6 +190,11 @@ class _IdleTracker:
     # Reset on a re-point; kept through a failed walk, so writes made during a
     # fault count as movement once the walk recovers.
     sub_key: tuple[int, int, int] | None = None
+    # Whether the last walk watched the spawned children (DW-548): their
+    # parent's conversation folder could be judged. A flip changes what the key
+    # covers, so it rebaselines `sub_key` rather than reading as movement. None
+    # = not walked on this path yet; reset on a re-point.
+    sub_children_judged: bool | None = None
     # The running streak of subagent-tree walks that raised: crumbed at its
     # transitions (`subagent-scan-failed` / `subagent-scan-recovered`). NOT reset
     # on a re-point, so a streak open across one still gets its recovery crumb.
@@ -421,6 +427,94 @@ def _is_regular_file(path: str | None) -> bool:
         return False
 
 
+def _conversation_folder(session_id: str | None, transcript_path: str | None) -> Path | None:
+    """The conversation folder a transcript sits in under a spawn-marker layout
+    (DW-548): its nearest ancestor named by the session id, or None when there
+    is no id, no transcript path, or no such ancestor — nothing to judge."""
+    if (
+        not session_id
+        or not transcript_path
+        or session_id in (".", "..")
+        or "\0" in transcript_path
+    ):
+        return None
+    return next((p for p in Path(transcript_path).parents if p.name == session_id), None)
+
+
+def _spawned_children(template: str, conversation: Path) -> list[Path]:
+    """The child conversation folders ``conversation`` lists through the spawn
+    marker its CLI writes there at each spawn (DW-548; the profile's
+    ``subagent_spawn_marker``, ``{session_id}`` read as the wildcard): each
+    child's folder is ``<store root>/<childId>/``, a sibling of
+    ``conversation``, whether or not it exists yet.
+
+    The component holding ``{session_id}`` is matched against a listing of its
+    directory; a candidate id counts only when the whole marker it fills in
+    stats, so a template with the id in a middle component holds too. The
+    conversation's own id and "."/".." never count. Stat-only, nothing is
+    opened. ``FileNotFoundError``/``NotADirectoryError`` on the listed
+    directory (no spawn yet) or on a candidate marker read as absent; every
+    other ``OSError`` propagates for the caller to crumb, so a fault never
+    reads as "no children"."""
+    parts = Path(template.format(session_id="\0")).parts
+    index = next(i for i, part in enumerate(parts) if "\0" in part)
+    head, *tail = parts[index].split("\0")
+    pattern = regex.escape(head)
+    for n, piece in enumerate(tail):
+        pattern += ("(?P<id>.+)" if n == 0 else "(?P=id)") + regex.escape(piece)
+    matcher = regex.compile(pattern)
+    try:
+        with os.scandir(conversation.joinpath(*parts[:index])) as entries:
+            names = [entry.name for entry in entries]
+    except (FileNotFoundError, NotADirectoryError):
+        return []
+    children: list[Path] = []
+    for name in sorted(names):
+        match = matcher.fullmatch(name)
+        if match is None or match["id"] in (".", "..", conversation.name):
+            continue
+        try:
+            os.stat(conversation / template.format(session_id=match["id"]))
+        except (FileNotFoundError, NotADirectoryError):
+            continue
+        children.append(conversation.parent / match["id"])
+    return children
+
+
+def _spawn_marker_verdict(
+    template: str, session_id: str | None, transcript_path: str | None
+) -> Literal["child", "own", "unjudged"]:
+    """Whether a Stop is a child conversation's, by the spawn marker its parent
+    wrote (DW-548; the profile's ``subagent_spawn_marker``).
+
+    agy runs a subagent as its own conversation: a folder named by its id,
+    beside the parent's under one store root (``brain/<id>/``), holding the
+    transcript its Stop reports. The conversation folder is the transcript's
+    nearest ancestor named by the session id; the Stop is a child's ("child")
+    when any OTHER folder under the store root holds ``template`` with the id
+    filled in, else "own". "unjudged" when there is no id, no transcript path,
+    or no ancestor named by the id: there is nowhere to look.
+
+    Stat-only, nothing is opened. ``FileNotFoundError``/``NotADirectoryError``
+    on a candidate marker read as absent; every other ``OSError`` — the store
+    root's listing included — propagates for the caller to crumb, so a fault
+    never reads as "own"."""
+    conversation = _conversation_folder(session_id, transcript_path)
+    if conversation is None or session_id is None:
+        return "unjudged"
+    marker = template.format(session_id=session_id)
+    with os.scandir(conversation.parent) as entries:
+        for entry in entries:
+            if entry.name == session_id:
+                continue
+            try:
+                os.stat(Path(entry.path, marker))
+            except (FileNotFoundError, NotADirectoryError):
+                continue
+            return "child"
+    return "own"
+
+
 def _subagent_tree_files(root: Path) -> list[tuple[Path, os.stat_result]]:
     """Every subagent transcript (``*.jsonl``) under ``root``, recursively, with
     its stat — the stat-only walk behind the idle notice's subagent fold.
@@ -510,6 +604,43 @@ def _idle_tool_slug(name: str) -> str:
     return "other"
 
 
+class LinkedWorktreeGrantError(RuntimeError):
+    """A sandboxed launch that owes a linked worktree's gitdir grant (DW-599)
+    could not resolve the paths to grant. Raised out of ``start_session``
+    rather than launching without the grant: such a session could not
+    `git add`/`commit`, and would fail its unit only after spending its turn."""
+
+
+def _linked_worktree_git_dirs(cwd: Path) -> tuple[Path, Path] | None:
+    """``(gitdir, common dir)`` of the linked worktree ``cwd`` is in, both
+    resolved; None in a main checkout, whose gitdir IS its common dir. Every
+    fault raises :class:`LinkedWorktreeGrantError`: the caller has already
+    decided a grant is owed, and a session run without it cannot commit."""
+    try:
+        answer = git_bytes(
+            cwd, "rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"
+        )
+    except GitError as e:
+        raise LinkedWorktreeGrantError(f"could not ask git for the git dirs of {cwd}: {e}") from e
+    try:
+        # fsdecode can raise on Windows (utf-8/surrogatepass refuses a lone byte).
+        stdout, stderr = os.fsdecode(answer.stdout), os.fsdecode(answer.stderr)
+    except UnicodeError as e:
+        raise LinkedWorktreeGrantError(f"could not decode the git dirs of {cwd}: {e}") from e
+    if answer.returncode != 0:
+        detail = stderr.strip() or f"git exited {answer.returncode}"
+        raise LinkedWorktreeGrantError(f"could not read the git dirs of {cwd}: {detail}")
+    # One path per line; removesuffix, not strip: every other byte is the path's.
+    lines = stdout.removesuffix("\n").split("\n")
+    if len(lines) != 2 or not all(lines):
+        raise LinkedWorktreeGrantError(f"unexpected git dirs for {cwd}: {lines!r}")
+    try:
+        git_dir, common_dir = Path(lines[0]).resolve(), Path(lines[1]).resolve()
+    except (OSError, RuntimeError) as e:
+        raise LinkedWorktreeGrantError(f"could not resolve the git dirs of {cwd}: {e}") from e
+    return None if git_dir == common_dir else (git_dir, common_dir)
+
+
 class _ResultFileMixin:
     """Result-file read-back and verdict finalization: acquire the
     skill-written result dict and fold it into the session's final
@@ -1145,7 +1276,9 @@ def _ensure_session(self) -> None:
     def interactive_argv(self, spec: SessionSpec) -> list[str]:
         extra = self.extra_args
         if extra is None:
-            extra = self.profile.bypass_args
+            # The linked-worktree grant rides with the mode args it extends, so an
+            # `extra_args` override (which replaces them) drops it too.
+            extra = (*self.profile.bypass_args, *self._linked_worktree_grant(spec.cwd))
         binary = self.binary
         if self.profile.hooks.dialect == "codex-hooks-json":
             from ..codex_trust import resolved_codex_binary
@@ -1161,6 +1294,24 @@ def interactive_argv(self, spec: SessionSpec) -> list[str]:
             argv += [self.profile.model_flag, spec.model]
         return argv
 
+    def _linked_worktree_grant(self, cwd: Path) -> tuple[str, ...]:
+        """The permission mode's ``linked_worktree_args`` filled in with the
+        gitdir and common dir of the linked worktree ``cwd`` is in (DW-599); ()
+        when the mode declares none (bypass, or a CLI whose sandbox needs no
+        grant) or ``cwd`` is a main checkout. Git is asked only when a grant
+        could be owed; a fault raises :class:`LinkedWorktreeGrantError`."""
+        if not self.profile.linked_worktree_args:
+            return ()
+        dirs = _linked_worktree_git_dirs(cwd)
+        if dirs is None:
+            return ()
+        try:
+            return self.profile.render_linked_worktree_args(*dirs)
+        except ValueError as e:
+            raise LinkedWorktreeGrantError(
+                f"cannot write the git dirs of {cwd} into {self.profile.name}'s grant: {e}"
+            ) from e
+
     def interactive_env(self, spec: SessionSpec) -> dict[str, str]:
         # The pin chokepoint (runs.pin_state_root): the profile's [env] table
         # must not be able to move a session off this process's state root —
@@ -1306,6 +1457,16 @@ def _wait_loop(
         # once for all id-less drops, under the None key (DW-507).
         foreign_hook_events = 0
         crumbed_foreign: set[str | None] = set()
+        # DW-548: admitted Stops that carried `fully_idle: false` — agy's yield
+        # to a foreground subagent, not a turn end. Crumbed once per attempt;
+        # heartbeat + timeout-fired carry the running count.
+        stop_yields_ignored = 0
+        # DW-548: child-conversation ids whose Stops are dropped (crumbed once
+        # each), and the one-shot crumbs for a Stop the spawn-marker rule could
+        # not read or could not judge — both admitted as before.
+        spawned_children: set[str] = set()
+        marker_unreadable_crumbed = False
+        marker_unjudged_crumbed = False
         # DW-507: the one-shot crumb for a lineage the first SessionStart could
         # not calibrate ("miscalibrated"/"unavailable"), so the degrade to the
         # #767 rules alone is visible in session-lifecycle.jsonl.
@@ -1453,8 +1614,8 @@ def sample_frame() -> None:
                 frame_key = tick_key
 
         # Idle detection (#680): the live transcript's (mtime_ns, size) — plus the
-        # profile's subagent transcript tree, whose writes also count as activity
-        # — sampled on the heartbeat cadence from the first tick that knows
+        # profile's subagent transcript tree and spawned child conversations, whose
+        # writes also count as activity — sampled on the heartbeat cadence from the first tick that knows
         # `transcript_path`; see `_sample_transcript_idle`. Observes only: nothing here nudges,
         # stalls or kills (#680 item 2 stays open), and `stall_deadline` is
         # neither consulted nor touched.
@@ -1482,7 +1643,7 @@ def sample_transcript(path: str, now: float) -> bool:
             same_path = idle.path == path
             prior_key = idle.last_key if same_path else None
             was_absent = idle.seen_absent if same_path else False
-            sampled = self._sample_transcript_idle(handle.task_id, path, idle, now)
+            sampled = self._sample_transcript_idle(handle.task_id, path, idle, now, session_id)
             current_key = idle.last_key
             # A same-size rewrite or truncation does not append a new record.
             # Scanning from byte zero in that case would credit an old assistant
@@ -1675,6 +1836,8 @@ def stall_exit(
                     # nonzero = a nested CLI's events were dropped (the parent's
                     # own Stop may have been read as foreign)
                     foreign_hook_events=foreign_hook_events,
+                    # nonzero = agy Stops read as subagent yields (DW-548)
+                    stop_yields_ignored=stop_yields_ignored,
                 )
                 # Every exit resolves first (a SessionStart that came before its
                 # rollout existed, then no further hook event): the exit's
@@ -1916,6 +2079,8 @@ def stall_exit(
                         "usage_sample_failures": usage_failures,
                         # hook events dropped as a nested CLI's (#767)
                         "foreign_hook_events": foreign_hook_events,
+                        # Stops ignored as subagent yields (DW-548)
+                        "stop_yields_ignored": stop_yields_ignored,
                         # the usage-limit quota wait (DW-396): present only when
                         # this session can enter one.
                         **(
@@ -2357,6 +2522,48 @@ def stall_exit(
                 # result-less completion -> false stall, and the main session's
                 # real transcript is preserved for usage tallying.
                 continue
+            spawn_marker = self.profile.subagent_spawn_marker
+            if event.event == "Stop" and spawn_marker:
+                # agy runs a subagent as a sibling conversation whose Stops reach
+                # this stream unannounced, so attribution admits them; its final
+                # `fully_idle: true` Stop would complete the parent while the
+                # parent still works (DW-548). A Stop whose id has a spawn marker
+                # in a sibling folder is the child's: dropped before it can
+                # re-point the identity or transcript. A fault or an unjudgeable
+                # Stop is admitted as before, crumbed once — never read as own.
+                if event.session_id in spawned_children:
+                    continue
+                try:
+                    verdict = _spawn_marker_verdict(
+                        spawn_marker, event.session_id, event.transcript_path
+                    )
+                except OSError as e:
+                    if not marker_unreadable_crumbed:
+                        marker_unreadable_crumbed = True
+                        self._note_lifecycle(
+                            handle.task_id,
+                            "subagent-marker-unreadable",
+                            session_id=event.session_id,
+                            error=f"{type(e).__name__}: {e}",
+                        )
+                else:
+                    if verdict == "child" and event.session_id:
+                        spawned_children.add(event.session_id)
+                        self._note_lifecycle(
+                            handle.task_id,
+                            "subagent-stop-ignored",
+                            child_session_id=event.session_id,
+                            fully_idle=event.fully_idle,
+                        )
+                        continue
+                    if verdict == "unjudged" and not marker_unjudged_crumbed:
+                        marker_unjudged_crumbed = True
+                        self._note_lifecycle(
+                            handle.task_id,
+                            "subagent-marker-unjudged",
+                            session_id=event.session_id,
+                            transcript_path=event.transcript_path,
+                        )
             session_id = event.session_id or session_id
             hook_transcript_path = event.transcript_path or hook_transcript_path
             hook_path = event.transcript_path
@@ -2408,6 +2615,22 @@ def stall_exit(
                     if quota.waiting and parked_kind in QUOTA_WAIT_BLOCKING_KINDS:
                         self._end_quota_wait(handle, quota, "latch")
                 continue
+            if event.event == "Stop" and event.fully_idle is False:
+                # agy fires Stop with `fullyIdle: false` when the parent yields
+                # to a foreground subagent (DW-548): the session's own event, so
+                # the identity/transcript tracking above took it, but no turn
+                # ended. It must not set stop_seen, drop the parked latch or
+                # complete. Not profile-gated: only a CLI that sends the key
+                # carries it.
+                stop_yields_ignored += 1
+                if stop_yields_ignored == 1:
+                    self._note_lifecycle(
+                        handle.task_id,
+                        "hook-stop-yield-ignored",
+                        session_id=event.session_id,
+                        ignored_so_far=stop_yields_ignored,
+                    )
+                continue
             if event.event == "Stop":
                 # A completed turn proves any prompt the CLI was parked on got
                 # answered: drop the parked latch before anything else (DW-348).
@@ -2578,29 +2801,66 @@ def _subagent_root(self, transcript_path: str) -> Path | None:
         return path.parent / template.format(stem=path.stem)
 
     def _sample_subagent_tree(
-        self, task_id: str, transcript_path: str, idle: _IdleTracker
+        self,
+        task_id: str,
+        transcript_path: str,
+        idle: _IdleTracker,
+        session_id: str | None = None,
     ) -> tuple[int, int, int] | None:
-        """The subagent tree's `_subagent_tree_key` this tick, or None when there
-        is no tree to watch or the walk raised. A raising walk degrades the tick
-        to parent-only (the pre-subagent behaviour) and is crumbed at the streak's
-        transitions, as the wait loop's transcript scan is:
-        `subagent-scan-failed` (`path`, `error`) at failure 1,
-        `subagent-scan-recovered` (`failures`) at the next clean walk."""
+        """The subagent activity key this tick: `_subagent_tree_key` summed over
+        every root watched — (count, total_bytes, newest_mtime_ns) — or None when
+        there is nothing to watch or a walk raised.
+
+        The roots are the declared tree (`_subagent_root`) plus, when the
+        profile sets `subagent_spawn_marker`, every child conversation folder the
+        parent's own folder lists through it (`_spawned_children`, DW-548): agy
+        writes nothing to the parent while a foreground subagent runs, only to
+        the child's sibling folder. The parent's folder is the transcript's
+        ancestor named by `session_id` (`_conversation_folder`); when it cannot
+        be judged, no children are watched this tick — never guessed. A child
+        folder is walked with the same `*.jsonl` rule as the tree, so its
+        transcript (`.system_generated/logs/transcript_full.jsonl` on agy) is
+        activity and its other files are not. A change in whether children are
+        watched rebaselines the key.
+
+        A raising walk or marker listing degrades the tick to parent-only (the
+        pre-subagent behaviour) and is crumbed at the streak's transitions, as
+        the wait loop's transcript scan is: `subagent-scan-failed` (`path` =
+        the root walked, or the parent's conversation folder for a listing
+        fault; `error`) at failure 1, `subagent-scan-recovered` (`failures`) at
+        the next clean walk."""
         root = self._subagent_root(transcript_path)
-        if root is None:
+        marker = self.profile.subagent_spawn_marker
+        conversation = _conversation_folder(session_id, transcript_path) if marker else None
+        if root is None and conversation is None:
             return None
+        if idle.sub_children_judged != (conversation is not None):
+            idle.sub_children_judged = conversation is not None
+            idle.sub_key = None
+        roots = [] if root is None else [root]
+        where = root
         try:
-            key = _subagent_tree_key(root)
+            if marker and conversation is not None:
+                where = conversation
+                roots.extend(_spawned_children(marker, conversation))
+            keys: list[tuple[int, int, int]] = []
+            for where in roots:
+                keys.append(_subagent_tree_key(where))
         except OSError as e:
             idle.sub_scan_failures += 1
             if idle.sub_scan_failures == 1:
                 self._note_lifecycle(
                     task_id,
                     "subagent-scan-failed",
-                    path=str(root),
+                    path=str(where),
                     error=f"{type(e).__name__}: {e}",
                 )
             return None
+        key = (
+            sum(k[0] for k in keys),
+            sum(k[1] for k in keys),
+            max((k[2] for k in keys), default=0),
+        )
         if idle.sub_scan_failures:
             self._note_lifecycle(
                 task_id, "subagent-scan-recovered", failures=idle.sub_scan_failures
@@ -2643,7 +2903,12 @@ def _idle_tool_label(
         return "none" if name is None else _idle_tool_slug(name)
 
     def _sample_transcript_idle(
-        self, task_id: str, transcript_path: str, idle: _IdleTracker, now: float
+        self,
+        task_id: str,
+        transcript_path: str,
+        idle: _IdleTracker,
+        now: float,
+        session_id: str | None = None,
     ) -> bool:
         """One heartbeat-cadence sample of the #680 idle detector: advance `idle`
         from the transcript's current stat key and journal the stretch boundaries.
@@ -2666,10 +2931,12 @@ def _sample_transcript_idle(
         an unwritable journal must not end a session that is, by this very
         evidence, alive.
 
-        The profile's subagent transcript tree (`_sample_subagent_tree`) counts
-        too: a parent blocked on a foreground subagent writes nothing to its own
-        transcript, so a tree that moved since the last clean walk is a change
-        like a parent key that moved. Its first walk on a path is a baseline. A
+        The profile's subagent transcript tree, and the child conversations a
+        `subagent_spawn_marker` lists in the folder `session_id` names
+        (`_sample_subagent_tree`), count too: a parent blocked on a foreground
+        subagent writes nothing to its own transcript, so subagent activity that
+        moved since the last clean walk is a change like a parent key that moved.
+        Its first walk on a path is a baseline. A
         walk that raises degrades the tick to parent-only, crumbed as
         `subagent-scan-failed` / `subagent-scan-recovered`; `idle.last_key` stays
         the parent's key either way.
@@ -2706,13 +2973,14 @@ def flush_active() -> None:
             idle.open_since = None
             idle.seen_absent = False
             idle.sub_key = None
+            idle.sub_children_judged = None
         key = self._transcript_activity_key(transcript_path)
         flush_active()
         if key is None:
             if idle.last_key is None:
                 idle.seen_absent = True
             return False
-        sub = self._sample_subagent_tree(task_id, transcript_path, idle)
+        sub = self._sample_subagent_tree(task_id, transcript_path, idle, session_id)
         sub_moved = sub is not None and idle.sub_key is not None and sub != idle.sub_key
         if sub is not None:
             idle.sub_key = sub
diff --git a/src/bmad_loop/adapters/opencode_http.py b/src/bmad_loop/adapters/opencode_http.py
index 4bf344ac1..e7aa346c4 100644
--- a/src/bmad_loop/adapters/opencode_http.py
+++ b/src/bmad_loop/adapters/opencode_http.py
@@ -52,10 +52,11 @@
   #48/#53 artifact-distrust invariant, unchanged.
 - **Usage is read over HTTP before teardown** (server state is sqlite, not a
   readable file tree): V1 sums assistant-message tokens, V2 reads the
-  session's own token aggregate; stashed by session id, the raw messages
-  (V2: every page, oldest first) dumped to ``tasks/<task_id>/messages.json``
-  as the transcript. Child-session (subagent) tokens are not counted — the
-  API scopes messages and usage per session.
+  session's token aggregate plus every descendant (subagent) session's;
+  stashed by session id, the raw messages (V2: every page, oldest first)
+  dumped to ``tasks/<task_id>/messages.json`` as the transcript. V1 counts no
+  child-session tokens — its API scopes messages per session. A V2 child
+  still running at capture is journaled as ``usage-child-active``.
 - ``opencode serve`` survives parent death, so teardown is
   authoritative: kill in ``run()``'s finally plus an atexit sweep. On Windows
   the binary is an npm ``.cmd`` shim, so the kill goes straight to the
@@ -1783,7 +1784,12 @@ def _capture_usage(self, handle: SessionHandle, sess: _ServerSession) -> str | N
         unwritable transcript no longer costs the usage; nor does a failed
         transcript read on a protocol whose usage is read apart from it (V2) —
         that usage is still read, without the transcript (a zero total then
-        stays untracked), and only the dump is skipped."""
+        stays untracked), and only the dump is skipped.
+
+        A read usage counts each child session as far as it has landed; the
+        children still running (a V2 background subagent) are crumbed as
+        `usage-child-active` with their ``sessions`` ids, and a failure to
+        tell is crumbed as `usage-child-active-failed` with ``error``."""
         if sess.client is None or not sess.session_id:
             return None
         messages, fault = sess.protocol.transcript(sess.client, sess.session_id)
@@ -1796,6 +1802,8 @@ def _capture_usage(self, handle: SessionHandle, sess: _ServerSession) -> str | N
             self._stash_usage(sess.session_id, usage)
         elif usage_fault is not None:
             self._note_usage_capture_failed(handle, usage_fault.stage, usage_fault.error)
+        if usage_fault is None:
+            self._note_active_children(handle, sess.protocol, sess.client, sess.session_id)
         if fault is not None:
             return None
         try:
@@ -1809,6 +1817,15 @@ def _capture_usage(self, handle: SessionHandle, sess: _ServerSession) -> str | N
     def _note_usage_capture_failed(self, handle: SessionHandle, stage: str, error: str) -> None:
         self._note_lifecycle(handle.task_id, "usage-capture-failed", stage=stage, error=error)
 
+    def _note_active_children(
+        self, handle: SessionHandle, protocol: OpencodeProtocol, client: Any, session_id: str
+    ) -> None:
+        active, fault = protocol.active_descendants(client, session_id)
+        if active is None:
+            self._note_lifecycle(handle.task_id, "usage-child-active-failed", error=fault)
+        elif active:
+            self._note_lifecycle(handle.task_id, "usage-child-active", sessions=active)
+
     def _stash_usage(self, session_id: str, usage: TokenUsage) -> None:
         """Write into the capacity-bounded `_usage` stash (see USAGE_STASH_CAP).
 
diff --git a/src/bmad_loop/adapters/opencode_protocol.py b/src/bmad_loop/adapters/opencode_protocol.py
index b4ec9f5f3..78878f834 100644
--- a/src/bmad_loop/adapters/opencode_protocol.py
+++ b/src/bmad_loop/adapters/opencode_protocol.py
@@ -187,7 +187,14 @@
   interrupt cancels is stamped ``time.completed`` with ``finish: "error"``,
   ``error: {"type": "aborted"}`` and no ``tokens``; a provider failure that
   exhausts its retries is stamped the same way with the provider's error type
-  (e.g. ``provider.transport``). Interrupt itself adds no tokens.
+  (e.g. ``provider.transport``). Interrupt itself adds no tokens. It counts
+  the session's OWN steps only: a ``subagent`` tool call runs a child session
+  (``Session.Info.parentID`` = the parent; absent on a root) with its own
+  aggregate. No children route exists — ``GET /api/session?parentID=<id>``
+  lists the direct children, paged like the messages (the cursor carries the
+  ``parentID``), and nesting is configurable (``experimental.subagent_depth``).
+  A ``background: true`` child can still be on ``/api/session/active`` after
+  its parent's turn ends (pinned 2.0.32).
 - Effort: the prompt body has no variant; the session's model ref
   ``{"id", "providerID", "variant"}`` carries it, set at create. Create
   accepts ANY variant (and any model) with a 200 and echoes it in
@@ -235,7 +242,21 @@
   /api/session/{id}/permission/{requestID}/reply {"decision":
   "once"|"always"|"reject", "message"?}`` → 204, then ``permission.replied
   {sessionID, requestID, reply}``. No ``form.*`` frame fired (the adapter's
-  ``question`` deny keeps forms away); none is rendered.
+  ``question`` deny keeps forms away).
+- Forms — pinned live against 2.0.32 (2026-10-28) by lifting that deny in a
+  probe and having the mock call the ``question`` tool. The call parks on
+  ``form.created {form: {id, sessionID, title, metadata {kind: "question",
+  tool {messageID, id}}, fields}}``, the one frame whose session id is
+  nested (``data.form.sessionID``, no top-level ``sessionID``). The tool maps
+  each question to a field ``{key: "q<n>", title: <header>, description:
+  <question>, type: "string"|"multiselect", options [{value, label,
+  description}], custom}``. The reply is ``POST /api/session/{id}/form/
+  {formID}/reply {"answer": {<key>: value}}`` → 204, then ``form.replied {id,
+  sessionID, answer}`` and the tool's ``session.tool.success``. ``DELETE
+  /api/session/{id}/form/{formID}`` → 204 and an interrupt both end it
+  ``form.cancelled {id, sessionID}``, then ``session.tool.failed`` with
+  ``error.type aborted`` ("The user dismissed this question" / "Tool
+  execution interrupted"). The adapter renders all three and never replies.
 - A provider failure surfaces ONLY as frames, each with a structured
   ``error {type, message, status?, response? {body}}``: ``session.retry.
   scheduled {attempt, at, error}`` per backoff (attempts 2..11, ~2/4/8 s then
@@ -244,13 +265,22 @@
   ``provider.rate-limit`` (``status 429``, retried 10 times, ~80–88 s); a
   quota refusal is ``provider.quota`` (``status`` 429 or 402, NOT retried —
   fails in ~0.3 s); a refused connection is ``provider.transport`` (no
-  ``status``, no ``response``; retried 10 times, ~87 s). ``error.message`` is
+  ``status``, no ``response``; retried 10 times, ~87 s). On 2.0.32 a 5xx is
+  ``provider.internal`` (retried 10 times), a 401/403 ``provider.auth``, a
+  400 ``provider.invalid-request``, a session model with no route
+  ``provider.no-route`` (no provider request; only ``session.execution.
+  failed``) and a malformed stream ``provider.invalid-output`` — none
+  retried but a stream cut before its ``finish_reason``. A hung provider
+  fires nothing unless a provider ``timeout``/``headerTimeout``/
+  ``chunkTimeout`` setting is set, then reads ``provider.transport``
+  ("Timed out waiting for response headers"/"… data"). ``error.message`` is
   the provider's own message verbatim and ``response.body`` its raw body —
   provider-written text, so the adapter copies only the bounded message, last
   on its line (:func:`format_provider_error`), never the body. The server log
   carries no line per retry; only the final give-up logs one ``level=ERROR
   message="Failed to drain Session"`` line, too late for a run killed
-  mid-retry, so it is not what the classifier reads.
+  mid-retry, so it is not what the classifier reads — and written for every
+  failed execution, whatever its cause, with no error type.
 """
 
 from __future__ import annotations
@@ -555,12 +585,22 @@ def sample_usage(self, client: Any, session_id: str) -> tuple[TokenUsage | None,
         tallied yet, ``fault`` when the sample failed. Never raises."""
         raise NotImplementedError
 
+    def active_descendants(
+        self, client: Any, session_id: str
+    ) -> tuple[list[str] | None, str | None]:
+        """``(ids, fault)``: the child sessions :meth:`usage` counted that are
+        still running at capture, so their landed tokens are a lower bound —
+        or None with ``fault`` naming why that could not be read. A protocol
+        that counts no child sessions has none. Never raises."""
+        return [], None
+
 
 @dataclass(frozen=True)
 class UsageFault:
     """Why a usage read failed, as the ``usage-capture-failed`` crumb reports it
     (DW-461): ``stage`` is ``fetch`` (the request, its status or an undecodable
-    body) or ``payload`` (a body of the wrong shape)."""
+    body), ``payload`` (a body of the wrong shape) or ``children`` (V2's
+    descendant-session walk, or a child's malformed ``Session.Info``)."""
 
     stage: str
     error: str
@@ -881,10 +921,27 @@ def _error_summary(error: Any) -> str:
     return _sum_args(text)
 
 
+def _form_asks(fields: Any) -> list[str]:
+    """``<title>: <description>`` per field of a V2 ``form.created`` form (the
+    ``question`` tool maps each question's ``header`` to ``title`` and its text
+    to ``description``) — what the form asks, without its options."""
+    if not isinstance(fields, list):
+        return []
+    asks: list[str] = []
+    for field in fields:
+        if not isinstance(field, dict):
+            continue
+        label = field.get("title") or field.get("key") or "?"
+        description = field.get("description")
+        asks.append(f"{label}: {description}" if description else str(label))
+    return asks
+
+
 # `GET /api/session/{id}/message` page size for the transcript walk: the
 # server's maximum — `limit=201` is a 400, never clamped (pinned 2.0.27).
 _V2_PAGE_LIMIT = 200
-# Bound on that walk, so a cursor that never runs dry is a fault, not a hang.
+# Bound on that walk, so a cursor that never runs dry is a fault, not a hang —
+# and on the descendant walk's `GET /api/session?parentID=` pages in total.
 _V2_MAX_PAGES = 1000
 
 
@@ -895,7 +952,8 @@ class V2Protocol(OpencodeProtocol):
     Drives the session lifecycle (config, health, create, prompt, the
     ``/api/event`` envelope and the ``session.execution.*`` turn end,
     interrupt), the poll fallback (``/api/session/active`` + assistant-message
-    proof-of-work), usage (the ``Session.Info`` aggregate) and the paginated
+    proof-of-work), usage (the ``Session.Info`` aggregates of the session and
+    its descendants) and the paginated
     transcript, the inline renderer and the provider-errors log."""
 
     major = 2
@@ -1095,7 +1153,13 @@ def frame_type(self, event: dict[str, Any]) -> Any:
 
     def frame_payload(self, event: dict[str, Any]) -> tuple[Any, Any]:
         data = event.get("data") or {}
-        return data, data.get("sessionID")
+        session_id = data.get("sessionID")
+        if session_id is None and event.get("type") == "form.created":
+            # The one frame that nests its session id: `form.created` carries
+            # the whole `Form.Info` under `data.form` (pinned 2.0.32).
+            form = data.get("form")
+            session_id = form.get("sessionID") if isinstance(form, dict) else None
+        return data, session_id
 
     def render_line(self, msg_roles: dict[Any, Any], etype: str, props: Any) -> str | None:
         """The inline-log line for one V2 frame, or None for a frame that
@@ -1126,6 +1190,24 @@ def render_line(self, msg_roles: dict[Any, Any], etype: str, props: Any) -> str
             )
         if etype == "permission.replied":
             return f"{_TOOL_COLOR}[bmad] perm reply: {props.get('reply') or '?'}{_RESET}\n"
+        if etype == "form.created":
+            # A form parks the turn until it is replied or cancelled, so this
+            # line is what explains the stall. Any other `form.*` type renders
+            # nothing (the fall-through below).
+            form = props.get("form")
+            form = form if isinstance(form, dict) else {}
+            asks = _sum_args(_form_asks(form.get("fields")))
+            return (
+                f"{_TOOL_COLOR}[bmad] form ask: {form.get('title') or '?'}"
+                f"{(' ' + asks) if asks else ''}{_RESET}\n"
+            )
+        if etype == "form.replied":
+            answer = _sum_args(props.get("answer"))
+            return f"{_TOOL_COLOR}[bmad] form reply:{(' ' + answer) if answer else ''}{_RESET}\n"
+        if etype == "form.cancelled":
+            # The payload is only `id` / `sessionID`; the reason is on the
+            # parked tool's `session.tool.failed` line that follows.
+            return f"{_TOOL_COLOR}[bmad] form cancelled{_RESET}\n"
         if etype == "session.retry.scheduled":
             detail = _error_summary(props.get("error"))
             return (
@@ -1238,13 +1320,18 @@ def usage(
         self, client: Any, session_id: str, transcript: Any
     ) -> tuple[TokenUsage | None, UsageFault | None]:
         """``GET /api/session/{id}`` → ``data.tokens``, the cumulative session
-        aggregate (never also summed per step). Reasoning bills as output; the
-        cache read/write map as in V1. Untracked (None) when that total is zero
-        and the transcript holds no completed, un-interrupted assistant message
-        — the V1 rule (:func:`_sum_usage`): an in-flight first step reports
-        zeros, and the step an interrupt cancelled is stamped completed with
-        ``error.type == "aborted"`` and no tokens. Child (subagent) sessions
-        are not counted. Never raises."""
+        aggregate (never also summed per step), plus every descendant
+        (subagent) session's aggregate (:meth:`descendants`): a 2.x session
+        counts only its own steps. Reasoning bills as output; the cache
+        read/write map as in V1. A child still running is counted as far as it
+        has landed (:meth:`active_descendants` names it). A failed walk or a
+        malformed child is a ``children`` fault, never a parent-only figure.
+        Untracked (None) when the summed total is zero and the transcript
+        holds no completed, un-interrupted assistant message — the V1 rule
+        (:func:`_sum_usage`): an in-flight first step reports zeros, and the
+        step an interrupt cancelled is stamped completed with
+        ``error.type == "aborted"`` and no tokens. (V1 still counts the parent
+        alone.) Never raises."""
         try:
             resp = client.get(f"/api/session/{session_id}")
             if resp.status_code != 200:
@@ -1254,16 +1341,20 @@ def usage(
             return None, UsageFault("fetch", f"{type(e).__name__}: {e}")
         try:
             usage = _session_tokens(body)
-            if usage.total == 0 and not _any_completed_assistant(transcript):
-                return None, None
         except (AttributeError, KeyError, TypeError, ValueError) as e:
             return None, UsageFault("payload", f"malformed session: {type(e).__name__}: {e}")
+        children, fault = self._children_tokens(client, session_id)
+        if children is None:
+            return None, UsageFault("children", fault or "")
+        usage.add(children)
+        if usage.total == 0 and not _any_completed_assistant(transcript):
+            return None, None
         return usage, None
 
     def sample_usage(self, client: Any, session_id: str) -> tuple[TokenUsage | None, str | None]:
-        """The budget guard's sample: the same ``Session.Info`` aggregate, one
-        GET a tick (never the transcript walk). A zero total is inert, not a
-        sample — nothing has been spent yet."""
+        """The budget guard's sample: the same parent-plus-descendants sum as
+        :meth:`usage`, read each tick (never the transcript walk). A zero total
+        is inert, not a sample — nothing has been spent yet."""
         try:
             resp = client.get(f"/api/session/{session_id}")
             if resp.status_code != 200:
@@ -1271,14 +1362,114 @@ def sample_usage(self, client: Any, session_id: str) -> tuple[TokenUsage | None,
             usage = _session_tokens(resp.json())
         except Exception as e:  # sampling is advisory
             return None, f"{type(e).__name__}: {e}"
+        children, fault = self._children_tokens(client, session_id)
+        if children is None:
+            return None, fault
+        usage.add(children)
         return (usage if usage.total else None), None
 
+    def descendants(self, client: Any, session_id: str) -> tuple[list[Any] | None, str | None]:
+        """``(infos, fault)``: the ``Session.Info`` of every session below
+        ``session_id``. There is no children route: ``GET /api/session?parentID=``
+        lists one level, so the walk recurses breadth-first (subagent nesting
+        is configurable), each listing paged like :meth:`transcript` — the
+        cursor carries the ``parentID``. A listed session whose ``parentID`` is
+        not the one asked for is not a child; an id already seen is skipped,
+        so a cycle ends. A failed or malformed page, a child without an id, or
+        more than ``_V2_MAX_PAGES`` pages in all is a fault — never a partial
+        tree. Never raises."""
+        found: list[Any] = []
+        seen = {session_id}
+        queue = [session_id]
+        pages = 0
+        try:
+            while queue:
+                parent = queue.pop(0)
+                params: dict[str, Any] = {"parentID": parent, "limit": _V2_PAGE_LIMIT}
+                while True:
+                    if pages == _V2_MAX_PAGES:
+                        return None, f"child sessions did not end within {_V2_MAX_PAGES} pages"
+                    pages += 1
+                    resp = client.get("/api/session", params=params)
+                    if resp.status_code != 200:
+                        return None, f"child list of {parent}: HTTP {resp.status_code}"
+                    body = resp.json()
+                    page = body.get("data")
+                    if not isinstance(page, list):
+                        return None, (
+                            f"child list of {parent} is {type(page).__name__}, not a list"
+                        )
+                    for info in page:
+                        child = info.get("id")
+                        if not isinstance(child, str) or not child:
+                            return None, f"a child of {parent} has no session id"
+                        if info.get("parentID") != parent or child in seen:
+                            continue
+                        seen.add(child)
+                        found.append(info)
+                        queue.append(child)
+                    next_cursor = (body.get("cursor") or {}).get("next")
+                    if not page or not next_cursor:
+                        break
+                    params = {"cursor": next_cursor, "limit": _V2_PAGE_LIMIT}
+        except Exception as e:  # usage is metadata, never a gate
+            return None, f"{type(e).__name__}: {e}"
+        return found, None
+
+    def _children_tokens(
+        self, client: Any, session_id: str
+    ) -> tuple[TokenUsage | None, str | None]:
+        """``(usage, fault)``: the summed aggregate of every :meth:`descendants`
+        session (a zero usage when there are none), or None with ``fault``
+        naming the failed walk or the malformed child. Never raises."""
+        infos, fault = self.descendants(client, session_id)
+        if infos is None:
+            return None, fault
+        total = TokenUsage()
+        for info in infos:
+            try:
+                total.add(_info_tokens(info))
+            except (AttributeError, KeyError, TypeError, ValueError) as e:
+                return None, f"malformed child session {info.get('id')}: {type(e).__name__}: {e}"
+        return total, None
+
+    def active_descendants(
+        self, client: Any, session_id: str
+    ) -> tuple[list[str] | None, str | None]:
+        """The descendants still listed by ``GET /api/session/active`` — a
+        ``background: true`` subagent can outlive its parent's turn. The walk
+        runs only when a session other than the parent is listed. A non-200,
+        a body without the ``data`` map or a failed walk is a fault, never
+        "none active"."""
+        try:
+            resp = client.get("/api/session/active")
+            if resp.status_code != 200:
+                return None, f"HTTP {resp.status_code}"
+            active = resp.json().get("data")
+            if not isinstance(active, dict):
+                return None, f"active map is {type(active).__name__}, not an object"
+            others = [sid for sid in active if sid != session_id]
+        except Exception as e:  # observation only
+            return None, f"{type(e).__name__}: {e}"
+        if not others:
+            return [], None
+        infos, fault = self.descendants(client, session_id)
+        if infos is None:
+            return None, fault
+        mine = {info.get("id") for info in infos}
+        return sorted(sid for sid in others if sid in mine), None
+
 
 def _session_tokens(body: Any) -> TokenUsage:
     """The ``{"data": Session.Info}`` body's ``tokens`` aggregate; raises on a
     body of the wrong shape (no ``data`` / ``tokens`` object, a non-numeric
     count) — a fault, never a zero."""
-    tokens = body["data"]["tokens"]
+    return _info_tokens(body["data"])
+
+
+def _info_tokens(info: Any) -> TokenUsage:
+    """One ``Session.Info``'s ``tokens`` aggregate; raises on a wrong shape."""
+    tokens = info["tokens"]
     if not isinstance(tokens, dict):
         raise TypeError(f"tokens is {type(tokens).__name__}, not an object")
     cache = tokens.get("cache") or {}
diff --git a/src/bmad_loop/adapters/profile.py b/src/bmad_loop/adapters/profile.py
index 463d20230..f1cd6eb79 100644
--- a/src/bmad_loop/adapters/profile.py
+++ b/src/bmad_loop/adapters/profile.py
@@ -36,10 +36,11 @@
 import string
 import sys
 import tomllib
+from collections.abc import Callable
 from dataclasses import dataclass, field, replace
 from importlib import resources
 from importlib.resources.abc import Traversable
-from pathlib import Path
+from pathlib import Path, PurePath
 
 import regex
 
@@ -161,6 +162,13 @@ class ParkedAnswersSpec:
 # The `sys.platform` values a `[permission_modes.<mode>]` table may name.
 PERMISSION_MODE_PLATFORMS = frozenset({"linux", "darwin", "win32"})
 
+# The placeholders a `linked_worktree_args` entry may carry (DW-599), each
+# rendered as a TOML basic string, quotes included, of the resolved path.
+LINKED_WORKTREE_PLACEHOLDERS = ("{gitdir}", "{common_dir}")
+_LINKED_WORKTREE_PLACEHOLDER_RE = regex.compile(
+    "|".join(regex.escape(p) for p in LINKED_WORKTREE_PLACEHOLDERS)
+)
+
 
 @dataclass(frozen=True)
 class PermissionModeSpec:
@@ -170,11 +178,31 @@ class PermissionModeSpec:
     (:meth:`CLIProfile.for_permission_mode`), so ``extra_args`` replaces them
     exactly as it replaces ``bypass_args``. ``platforms`` names the
     ``sys.platform`` values the mapping is known to work on; empty = every
-    platform. Mode names, args and platforms are validated in
+    platform. ``linked_worktree_args`` (DW-599) are appended after ``args`` when
+    the session's cwd is a linked worktree, with :data:`LINKED_WORKTREE_PLACEHOLDERS`
+    filled in, for a sandbox that must be granted that worktree's gitdir and
+    common dir explicitly. Mode names, args and platforms are validated in
     :func:`_validate_profile`."""
 
     args: tuple[str, ...]
     platforms: tuple[str, ...] = ()
+    linked_worktree_args: tuple[str, ...] = ()
+
+
+def toml_basic_string(value: str) -> str:
+    """``value`` as a TOML basic string, quotes included. Raises ValueError for a
+    value TOML cannot carry: a lone surrogate (a non-UTF-8 path byte under
+    ``os.fsdecode``) has no TOML spelling."""
+    value.encode("utf-8")  # UnicodeEncodeError (a ValueError) on a lone surrogate
+    out: list[str] = []
+    for ch in value:
+        if ch in '"\\':
+            out.append("\\" + ch)
+        elif ord(ch) < 0x20 or ord(ch) == 0x7F:
+            out.append(f"\\u{ord(ch):04X}")
+        else:
+            out.append(ch)
+    return '"' + "".join(out) + '"'
 
 
 @dataclass(frozen=True)
@@ -348,6 +376,18 @@ class CLIProfile:
     # a mode absent here is refused for this CLI. APPENDED after parked_answers
     # for the same positional-compatibility reason.
     permission_modes: dict[str, PermissionModeSpec] = field(default_factory=dict)
+    # The selected mode's `linked_worktree_args` (DW-599), set beside
+    # `bypass_args` by `for_permission_mode`; empty under bypass. APPENDED after
+    # permission_modes for the same positional-compatibility reason.
+    linked_worktree_args: tuple[str, ...] = ()
+    # Template, relative to a conversation folder, of the file a parent writes
+    # when it spawns a subagent conversation ("{session_id}" = the child's id),
+    # e.g. agy's ".system_generated/subagents/{session_id}.json" (DW-548). When
+    # set, a Stop whose transcript sits in a folder named by its session id is a
+    # CHILD's, and is dropped, if any sibling folder holds that file. Stat-only;
+    # None = off. APPENDED after linked_worktree_args for the same
+    # positional-compatibility reason.
+    subagent_spawn_marker: str | None = None
 
     @property
     def hookless(self) -> bool:
@@ -384,7 +424,8 @@ def for_permission_mode(self, mode: str, platform: str = sys.platform) -> CLIPro
         (the launched argv, the config digest, :meth:`missing_bypass_tokens`)
         sees the effective permission args with no second code path. Raises
         :class:`ProfileError` when the profile has no mapping for ``mode`` or
-        the mapping excludes ``platform``."""
+        the mapping excludes ``platform``. The mode's ``linked_worktree_args``
+        ride along the same way, for the adapter to fill in per session."""
         if mode == "bypass":
             return self
         spec = self.permission_modes.get(mode)
@@ -399,7 +440,22 @@ def for_permission_mode(self, mode: str, platform: str = sys.platform) -> CLIPro
                 f"profile {self.name!r} maps permission_mode {mode!r} only on "
                 f"{', '.join(spec.platforms)}, not {platform}"
             )
-        return replace(self, bypass_args=spec.args)
+        return replace(self, bypass_args=spec.args, linked_worktree_args=spec.linked_worktree_args)
+
+    def render_linked_worktree_args(
+        self, gitdir: PurePath, common_dir: PurePath
+    ) -> tuple[str, ...]:
+        """``linked_worktree_args`` with each placeholder replaced by its path as a
+        TOML basic string. Raises ValueError for a path TOML cannot carry."""
+        values = {
+            "{gitdir}": toml_basic_string(str(gitdir)),
+            "{common_dir}": toml_basic_string(str(common_dir)),
+        }
+        # One pass, so a path that itself spells a placeholder is not rewritten.
+        return tuple(
+            _LINKED_WORKTREE_PLACEHOLDER_RE.sub(lambda m: values[m.group()], arg)
+            for arg in self.linked_worktree_args
+        )
 
     def missing_bypass_tokens(self, extra_args: tuple[str, ...] | None) -> tuple[str, ...]:
         """The permission args (``bypass_args``) a policy ``extra_args`` override
@@ -418,6 +474,19 @@ def missing_bypass_tokens(self, extra_args: tuple[str, ...] | None) -> tuple[str
         return tuple(t for t in dict.fromkeys(self.bypass_args) if t not in present)
 
 
+def _check_linked_worktree_args(
+    args: tuple[str, ...], where: str, fail: Callable[[str], ProfileError]
+) -> None:
+    """Non-empty strings, and at least one placeholder across the list: an arg
+    with no path in it belongs in the mode's ``args``."""
+    if not args:
+        return
+    if not all(isinstance(a, str) and a for a in args):
+        raise fail(f"{where} must list non-empty strings")
+    if not any(p in a for a in args for p in LINKED_WORKTREE_PLACEHOLDERS):
+        raise fail(f"{where} must use at least one of {', '.join(LINKED_WORKTREE_PLACEHOLDERS)}")
+
+
 def _validate_profile(profile: CLIProfile, source: str) -> None:
     """Enforce every value-level invariant a ``CLIProfile`` must satisfy, whatever
     built it.
@@ -613,6 +682,35 @@ def fail(msg: str) -> ProfileError:
                 "transcript path"
             )
 
+    # Same shape rules as subagent_transcript_dir, keyed on "{session_id}": the
+    # marker names one child, so a template without the id would read every
+    # Stop as a child's once any subagent was spawned.
+    marker = profile.subagent_spawn_marker
+    if marker:
+        if "\0" in marker:
+            raise fail(f"subagent_spawn_marker must not contain a NUL character: got {marker!r}")
+        try:
+            parts = list(string.Formatter().parse(marker))
+        except ValueError as e:
+            raise fail(f"subagent_spawn_marker is not a valid template: {e}: got {marker!r}")
+        fields = [(name, spec, conv) for _, name, spec, conv in parts if name is not None]
+        if not fields or any(name != "session_id" or spec or conv for name, spec, conv in fields):
+            raise fail(
+                'subagent_spawn_marker must use exactly the placeholder "{session_id}" (the '
+                "child conversation's id), with no other field, format spec or conversion: "
+                f"got {marker!r}"
+            )
+        if is_absolute_path(marker) or has_parent_ref(marker):
+            raise fail(
+                "subagent_spawn_marker must be a relative path under a conversation "
+                f"folder, with no '..': got {marker!r}"
+            )
+        if profile.hookless:
+            raise fail(
+                'hookless profiles (dialect = "none") must not set subagent_spawn_marker: '
+                "it drops a child's Stop hook, and a hookless profile has no hook events"
+            )
+
     if profile.usage_parser not in USAGE_PARSERS:
         raise fail(
             f"usage_parser must be one of {sorted(USAGE_PARSERS)}: got {profile.usage_parser!r}"
@@ -726,6 +824,11 @@ def fail(msg: str) -> ProfileError:
                 f"permission_modes.{mode}.platforms must name values from "
                 f"{sorted(PERMISSION_MODE_PLATFORMS)}: got {bad!r}"
             )
+        _check_linked_worktree_args(
+            spec.linked_worktree_args, f"permission_modes.{mode}.linked_worktree_args", fail
+        )
+    # A provider-built profile may set the resolved field directly.
+    _check_linked_worktree_args(profile.linked_worktree_args, "linked_worktree_args", fail)
 
     answers = profile.parked_answers
     if answers is not None:
@@ -844,7 +947,7 @@ def str_list(key: str) -> tuple[str, ...]:
             lists[key] = tuple(raw)
         parked_answers = ParkedAnswersSpec(**lists)
 
-    # `[permission_modes.<mode>]` tables of two string lists; mode names and
+    # `[permission_modes.<mode>]` tables of string lists; mode names and
     # values are checked in `_validate_profile`.
     modes_d = doc.get("permission_modes", {})
     if not isinstance(modes_d, dict):
@@ -853,11 +956,12 @@ def str_list(key: str) -> tuple[str, ...]:
     for mode, spec_d in modes_d.items():
         if not isinstance(spec_d, dict):
             raise fail(f"permission_modes.{mode} must be a table")
-        unknown = sorted(set(spec_d) - {"args", "platforms"})
+        mode_keys = ("args", "platforms", "linked_worktree_args")
+        unknown = sorted(set(spec_d) - set(mode_keys))
         if unknown:
             raise fail(f"permission_modes.{mode} has unknown keys: {unknown}")
         mode_lists: dict[str, tuple[str, ...]] = {}
-        for key in ("args", "platforms"):
+        for key in mode_keys:
             raw = spec_d.get(key, [])
             if not isinstance(raw, list) or not all(isinstance(x, str) for x in raw):
                 raise fail(f"permission_modes.{mode}.{key} must be a list of strings")
@@ -889,6 +993,9 @@ def str_list(key: str) -> tuple[str, ...]:
         raise fail(
             f"subagent_transcript_dir must be a string: got {type(raw_subagent_dir).__name__}"
         )
+    raw_spawn_marker = doc.get("subagent_spawn_marker")
+    if raw_spawn_marker is not None and not isinstance(raw_spawn_marker, str):
+        raise fail(f"subagent_spawn_marker must be a string: got {type(raw_spawn_marker).__name__}")
 
     profile = CLIProfile(
         name=str(doc.get("name", "")).strip(),
@@ -927,6 +1034,7 @@ def str_list(key: str) -> tuple[str, ...]:
         subagent_transcript_dir=raw_subagent_dir,
         parked_answers=parked_answers,
         permission_modes=permission_modes,
+        subagent_spawn_marker=raw_spawn_marker,
     )
     _validate_profile(profile, source)
     return profile
diff --git a/src/bmad_loop/cli.py b/src/bmad_loop/cli.py
index b00ded1d0..a29a09235 100644
--- a/src/bmad_loop/cli.py
+++ b/src/bmad_loop/cli.py
@@ -2268,11 +2268,19 @@ def _report_permission_mode(
     ``runsetup.make_adapters``. Otherwise an ok posture line
     (``adapter.permission-mode``) whose isolation coupling is advisory only: a
     bypass role with no worktree isolation is pointed at the sandboxed mode when
-    its profile maps one here. The one warning is a Codex-family role sandboxed
-    under worktree isolation, where git cannot write the linked worktree's gitdir
-    (it lives under the main repo's ``.git/worktrees/``, outside the sandbox's
-    writable roots), so the dev skill's preflight and commit fail."""
-    from .adapters.profile import ProfileError
+    its profile maps one here. A Codex-family role sandboxed under worktree
+    isolation needs the mode's ``linked_worktree_args`` grant: its sandbox keeps the
+    linked worktree's gitdir (under the main repo's ``.git/worktrees/``) and the
+    common dir read-only otherwise, so the dev skill's preflight and commit fail.
+    The role is ok when its launch carries that grant (the resolved profile
+    declares it, naming both ``{gitdir}`` and ``{common_dir}``, and
+    ``cfg.extra_args`` is None). It warns when the grant cannot ride: the resolved
+    profile declares none, or a non-None ``extra_args`` (``()`` included) replaces
+    the mode's args, and the grant with them, as
+    ``GenericAdapter.interactive_argv`` does. It also warns when the grant omits
+    either placeholder: Codex needs both paths writable to commit, while profile
+    validation accepts one, as other CLIs may need less."""
+    from .adapters.profile import LINKED_WORKTREE_PLACEHOLDERS, ProfileError
 
     mode = cfg.permission_mode
     detail: dict[str, object] = {
@@ -2283,7 +2291,7 @@ def _report_permission_mode(
         "platform": sys.platform,
     }
     try:
-        profile.for_permission_mode(mode, platform=sys.platform)
+        resolved = profile.for_permission_mode(mode, platform=sys.platform)
     except ProfileError as e:
         report.fail(
             "adapter.permission-mode-unsupported",
@@ -2303,12 +2311,47 @@ def _report_permission_mode(
                 message += '; consider adapter.permission_mode = "sandboxed"'
         report.ok("adapter.permission-mode", message, detail)
     elif isolation == "worktree" and profile.hooks.dialect == "codex-hooks-json":
+        fallback = 'use scm.isolation = "none" or permission_mode = "bypass"'
+        gitdir_ro = "the linked worktree's gitdir (under the main repo's .git/worktrees/)"
+        common_ro = "the main repo's .git"
+        read_only = f"{gitdir_ro} and {common_ro}"
+        unnamed = [
+            p
+            for p in LINKED_WORKTREE_PLACEHOLDERS
+            if not any(p in arg for arg in resolved.linked_worktree_args)
+        ]
+        if not resolved.linked_worktree_args:
+            why = f"its [permission_modes.{mode}] declares no linked_worktree_args grant"
+            fix = fallback
+        elif unnamed:
+            why = (
+                f"its [permission_modes.{mode}] linked_worktree_args grant names no "
+                f"{' or '.join(unnamed)}"
+            )
+            fix = f"grant both {{gitdir}} and {{common_dir}}, or {fallback}"
+            if unnamed == ["{common_dir}"]:
+                read_only = common_ro
+            elif unnamed == ["{gitdir}"]:
+                read_only = gitdir_ro
+        elif cfg.extra_args is not None:
+            why = (
+                "adapter.extra_args replaces the mode's args, dropping their "
+                "linked_worktree_args grant"
+            )
+            fix = f"drop extra_args, or {fallback}"
+        else:
+            report.ok(
+                "adapter.permission-mode",
+                f"{profile.name} {role}: {mode} under scm.isolation=worktree, with write "
+                "grants for the linked worktree's gitdir and the main repo's .git",
+                detail,
+            )
+            return
         report.warn(
             "adapter.permission-mode",
-            f"{profile.name} {role}: {mode} under scm.isolation=worktree — the sandbox "
-            "keeps a linked worktree's gitdir (under the main repo's .git/worktrees/) "
-            "read-only, so git add/commit fail in isolated sessions; use "
-            'scm.isolation = "none" or permission_mode = "bypass" for this role',
+            f"{profile.name} {role}: {mode} under scm.isolation=worktree — {why}, so the "
+            f"sandbox keeps {read_only} read-only and git add/commit fail in isolated "
+            f"sessions; {fix} for this role",
             detail,
         )
     else:
diff --git a/src/bmad_loop/data/bmad_loop_hook.py b/src/bmad_loop/data/bmad_loop_hook.py
index 8281153c8..c9ad5b577 100644
--- a/src/bmad_loop/data/bmad_loop_hook.py
+++ b/src/bmad_loop/data/bmad_loop_hook.py
@@ -8,7 +8,8 @@
 (claude/codex), conversation_id (cursor), or camelCase (copilot's sessionId/
 transcriptPath, agy's conversationId/transcriptPath — protojson encoding); the
 field extraction below tries each. agy alone carries no cwd, sending the
-workspacePaths list instead. Reads the hook payload
+workspacePaths list instead, and alone sends `fullyIdle`, forwarded as
+`fully_idle` only when it is a boolean. Reads the hook payload
 from stdin and writes one event file
 into the orchestrator's events directory. No-ops (exit 0) unless the session was
 spawned by bmad-loop (detected via env vars set on the tmux window), so
@@ -84,6 +85,15 @@ def _source(payload):
     return value if isinstance(value, str) else None
 
 
+def _fully_idle(payload):
+    # An agy Stop payload's `fullyIdle` (DW-548): false when the parent only
+    # yielded to a foreground subagent, true at the real turn end. Only a JSON
+    # boolean is forwarded, and the key is written only then, so every other
+    # CLI's event stays unchanged.
+    value = payload.get("fullyIdle")
+    return value if isinstance(value, bool) else None
+
+
 # How long after the launched CLI the rest of its launch chain may start
 # (DW-507): a forking default-shell starts the CLI and a node shim starts the
 # real binary at once. Limitation: anything the CLI itself starts at launch (an
@@ -423,6 +433,11 @@ def main() -> int:
         # a filter — the orchestrator decides what a "mismatch" means.
         "lineage": _lineage(event_name, ("bmad_loop_hook.py",)),
     }
+    # Only when the payload carries a boolean `fullyIdle` (agy, DW-548): a Stop
+    # with false is a subagent yield, not a turn end. Absent for every other CLI.
+    fully_idle = _fully_idle(payload)
+    if fully_idle is not None:
+        event["fully_idle"] = fully_idle
     # Only when set, so a readable payload's event is unchanged.
     if payload_error:
         event["payload_error"] = payload_error
diff --git a/src/bmad_loop/data/profiles/antigravity.toml b/src/bmad_loop/data/profiles/antigravity.toml
index ac7c98365..0fbd4f9eb 100644
--- a/src/bmad_loop/data/profiles/antigravity.toml
+++ b/src/bmad_loop/data/profiles/antigravity.toml
@@ -4,6 +4,27 @@
 # hooks, so only Stop is registered. Skills live in .agents/skills/, hooks in
 # .agents/hooks.json. Verified against agy 1.1.3.
 #
+# Stop is not always a turn end (DW-548, pinned on agy 1.4.9): a parent that
+# spawns a foreground subagent fires Stop with `fullyIdle: false` while it
+# yields, and `fullyIdle: true` once it really finishes; a child's own
+# background-command yield also sends false. `fullyIdle` is the only payload
+# field that tells them apart (`terminationReason` is NO_TOOL_CALL in both). The
+# relay forwards it as `fully_idle`, and bmad-loop ignores a Stop carrying false.
+#
+# A subagent is its own conversation, a sibling folder brain/<childId>/ beside the
+# parent's brain/<parentId>/. Its Stops fire through the same .agents/hooks.json
+# and env, so they land in the parent session's events with conversationId =
+# <childId> and transcriptPath under brain/<childId>/; with no SessionStart,
+# attribution admits them, and the child's FINAL Stop (`fullyIdle: true`, sent
+# after it hands its result back while the parent still works) would complete
+# the parent early. At spawn agy writes
+# brain/<parentId>/.system_generated/subagents/<childId>.json (in the 1.4.9 probe,
+# ~14 s before the child's first Stop), so `subagent_spawn_marker` drops a Stop
+# whose id has that marker in a sibling folder (DW-548). The same markers list
+# the parent's children for the idle notice: while a foreground subagent runs agy
+# writes nothing to brain/<parentId>/, only to brain/<childId>/, so each listed
+# child's *.jsonl writes count as the parent's activity.
+#
 # usage_parser is "none" DELIBERATELY AND PERMANENTLY — not a deferral. agy's
 # transcript (~/.gemini/antigravity-cli/brain/<conversationId>/.system_generated/
 # logs/transcript_full.jsonl, the path its Stop hook reports as `transcriptPath`)
@@ -49,6 +70,8 @@ skill_tree = ".agents/skills"
 # relay is merged in, so a worktree checkout keeps any user/plugin hook groups
 # already present instead of starting from an empty file.
 seed_files = [".agents/hooks.json"]
+# The file a parent conversation writes when it spawns a child (see above).
+subagent_spawn_marker = ".system_generated/subagents/{session_id}.json"
 
 [hooks]
 dialect = "antigravity-hooks-json"
diff --git a/src/bmad_loop/data/profiles/codex.toml b/src/bmad_loop/data/profiles/codex.toml
index ea70a8c92..9b307ec18 100644
--- a/src/bmad_loop/data/profiles/codex.toml
+++ b/src/bmad_loop/data/profiles/codex.toml
@@ -34,9 +34,16 @@ events = { SessionStart = "SessionStart", Stop = "Stop" }
 # grant instead (it replaces `--sandbox`: Codex refuses `sandbox_mode` beside
 # `default_permissions`). Network stays off. Per Codex's agent-approvals-security
 # and permissions docs; live-checked 2026-10-27 on codex-cli 0.164.0.
-# KNOWN GAP: in a linked worktree (`scm.isolation = "worktree"`) the gitdir lives
-# under the main repo's `.git/worktrees/<name>` and stays read-only (Codex grants
-# only exact paths there, no globs), so git add/commit fail in that checkout.
+# In a linked worktree (`scm.isolation = "worktree"`) `.git` is a file, and git
+# writes the worktree's gitdir (`<main>/.git/worktrees/<name>`, its index) and the
+# common dir (`<main>/.git`, objects and refs), both read-only to the sandbox.
+# `linked_worktree_args` grants the two exact paths (Codex grants no globs): the
+# adapter appends them after `args` only when the session's cwd is a linked
+# worktree, each placeholder rendered as a TOML string. A child profile extends
+# `bmad_loop` (its filesystem map merges) and a later `default_permissions` selects
+# it: a second `filesystem` table on `bmad_loop` would REPLACE the one above, and a
+# dotted per-path key cannot work since Codex splits `-c` keys on every `.`. Both
+# grants are needed. Live-checked 2026-10-28 on codex-cli 0.165.0.
 # Windows is unverified, hence the platform list.
 [permission_modes.sandboxed]
 args = [
@@ -50,3 +57,11 @@ args = [
   "never",
 ]
 platforms = ["linux", "darwin"]
+linked_worktree_args = [
+  "-c",
+  'permissions.bmad_loop_worktree.extends="bmad_loop"',
+  "-c",
+  'permissions.bmad_loop_worktree.filesystem={{gitdir}="write",{common_dir}="write"}',
+  "-c",
+  'default_permissions="bmad_loop_worktree"',
+]
diff --git a/src/bmad_loop/data/profiles/opencode.toml b/src/bmad_loop/data/profiles/opencode.toml
index dc32f5bea..291804f02 100644
--- a/src/bmad_loop/data/profiles/opencode.toml
+++ b/src/bmad_loop/data/profiles/opencode.toml
@@ -66,13 +66,35 @@ first_run_note = "run `opencode auth login` once on this machine; headless serve
 #   provider-error event=session.retry.scheduled type=provider.rate-limit status=429 attempt=2 message="Rate limit reached for requests"
 #   provider-error event=session.execution.failed type=provider.quota status=402 attempt=- message="You exceeded your current quota, please check your plan and billing details."
 #   provider-error event=session.retry.scheduled type=provider.transport status=- attempt=2 message="ConnectionRefused: Unable to connect. Is the computer able to access the url?"
-# The schema's other provider.* types (timeout, auth, no-route, …) are not seeded.
-# provider.rate-limit and provider.transport stay env faults: opencode retries
-# both. provider.quota is a usage limit instead (usage_limit_patterns below).
+# Against 2.0.32 (2026-10-28, zero tokens, the same mock provider), an HTTP 500,
+# 502 or 503 read provider.internal (retried 10 times, then failed); a 401 or
+# 403 read provider.auth, and a session model with no route (an unconfigured
+# provider, or a variant the model lacks) read provider.no-route (both failed at
+# once, never retried). The lines, as written:
+#   provider-error event=session.retry.scheduled type=provider.internal status=500 attempt=2 message="The server had an error while processing your request. Sorry about that!"
+#   provider-error event=session.execution.failed type=provider.internal status=502 attempt=- message="Provider request failed with HTTP 502"
+#   provider-error event=session.step.failed type=provider.auth status=401 attempt=- message="Incorrect API key provided: x. You can find your API key at https://platform.openai.com/account/api-keys."
+#   provider-error event=session.execution.failed type=provider.no-route status=- attempt=- message="Model unavailable: nosuch/mock-1"
+# All five are env faults: a provider outage that a later retry clears
+# (rate-limit, transport, internal), or operator configuration that charging
+# the story's attempts cannot fix (auth, no-route). provider.quota is a usage
+# limit instead (usage_limit_patterns below). Captured but deliberately NOT
+# seeded, because what the session sent can cause them: provider.invalid-request
+# (an HTTP 400) and provider.invalid-output (a malformed or truncated stream).
+# Not provoked, so not seeded: provider.timeout (2.0.32 raises it only for media
+# generation polling), content-filter, unsupported-operation, unknown and error.
+# A hung provider reads as provider.transport instead, and only under a
+# provider `timeout` / `headerTimeout` / `chunkTimeout` setting (unset, nothing
+# fires in 300 s and the session times out):
+#   provider-error event=session.retry.scheduled type=provider.transport status=- attempt=2 message="Timed out waiting for response headers"
+# The server log's `level=ERROR message="Failed to drain Session"` line is not
+# seeded either: 2.0.32 writes it for every failed execution, the
+# invalid-request and invalid-output ones included, with no error type, only
+# the provider's own message, so nothing in it tells an outage from a refusal.
 env_fault_patterns = [
   'error[.]error="AI_APICallError: [^"]{0,400}?(?i:usage limit reached|429|too many requests|rate[ _-]?limit|quota|overloaded)',
   'error[.]error="AI_APICallError: [^"]{0,400}?(?i:cannot connect to api|socket connection was closed|connection ?(error|refused|reset|timed ?out)|ECONNREFUSED|ETIMEDOUT|ENOTFOUND|EAI_AGAIN)',
-  '^provider-error event=\S+ type=provider[.](?:rate-limit|transport) ',
+  '^provider-error event=\S+ type=provider[.](?:rate-limit|transport|internal|auth|no-route) ',
 ]
 # usage_limit_patterns — BLOCKED, no auto-continue: an operator must add credit
 # or switch model. The adapter matches each provider-error line against this
diff --git a/src/bmad_loop/data/settings/core.toml b/src/bmad_loop/data/settings/core.toml
index 2db998cdc..75c411da8 100644
--- a/src/bmad_loop/data/settings/core.toml
+++ b/src/bmad_loop/data/settings/core.toml
@@ -306,7 +306,7 @@ description = "reasoning effort, free-form (provider/model-specific, e.g. high,
 [[section.field]]
 key = "extra_args"
 kind = "args"
-description = "when set, replaces the CLI profile's permission-bypass flags (its bypass_args), so repeat them (e.g. claude: --permission-mode bypassPermissions) or unattended sessions may stall on permission prompts"
+description = "when set, replaces the CLI profile's permission-bypass flags (its bypass_args), so repeat them (e.g. claude: --permission-mode bypassPermissions) or unattended sessions may stall on permission prompts · under a sandboxed permission_mode it also drops the mode's linked-worktree gitdir grant, so a sandboxed codex session under worktree isolation cannot commit"
 [[section.field]]
 key = "permission_mode"
 kind = "select"
diff --git a/src/bmad_loop/events.py b/src/bmad_loop/events.py
index d18215941..c3282df43 100644
--- a/src/bmad_loop/events.py
+++ b/src/bmad_loop/events.py
@@ -6,7 +6,7 @@
 module — and this module cannot import it back, since it ships as package DATA
 rather than as an importable module. Hence a twin rather than shared code:
 ``_LINK_REPARSE_TAGS``, ``_first_workspace``, ``_notification_type``,
-``_source``, the DW-507 lineage block (``_LAUNCH_SHIM_WINDOW_S``,
+``_source``, ``_fully_idle``, the DW-507 lineage block (``_LAUNCH_SHIM_WINDOW_S``,
 ``_proc_stat``, ``_cmdline``, ``_HOOK_SHELLS``, ``_runs_relay``,
 ``_is_hook_wrapper``, ``_lineage``), ``_is_link_like``,
 ``_write_all`` and ``_write_event`` below are byte-identical copies of the
@@ -76,6 +76,15 @@ def _source(payload):
     return value if isinstance(value, str) else None
 
 
+def _fully_idle(payload):
+    # An agy Stop payload's `fullyIdle` (DW-548): false when the parent only
+    # yielded to a foreground subagent, true at the real turn end. Only a JSON
+    # boolean is forwarded, and the key is written only then, so every other
+    # CLI's event stays unchanged.
+    value = payload.get("fullyIdle")
+    return value if isinstance(value, bool) else None
+
+
 # How long after the launched CLI the rest of its launch chain may start
 # (DW-507): a forking default-shell starts the CLI and a node shim starts the
 # real binary at once. Limitation: anything the CLI itself starts at launch (an
@@ -376,7 +385,8 @@ def shape_event(
     :func:`_lineage`); :func:`relay` computes it, since it reads this process's
     own parent chain rather than anything in the payload. ``payload_error`` is
     :func:`_read_payload`'s tag, written only when set so a readable payload's
-    event is unchanged."""
+    event is unchanged; ``fully_idle`` (DW-548) likewise appears only when the
+    payload carries a boolean ``fullyIdle``."""
     event = {
         "ts": ts,
         "event": event_name,
@@ -405,6 +415,11 @@ def shape_event(
         # a filter — the orchestrator decides what a "mismatch" means.
         "lineage": lineage,
     }
+    # Only when the payload carries a boolean `fullyIdle` (agy, DW-548): a Stop
+    # with false is a subagent yield, not a turn end. Absent for every other CLI.
+    fully_idle = _fully_idle(payload)
+    if fully_idle is not None:
+        event["fully_idle"] = fully_idle
     if payload_error:
         event["payload_error"] = payload_error
     return event
diff --git a/src/bmad_loop/runsetup.py b/src/bmad_loop/runsetup.py
index 7e17c21fc..3dc3e8d5f 100644
--- a/src/bmad_loop/runsetup.py
+++ b/src/bmad_loop/runsetup.py
@@ -168,7 +168,9 @@ def config_digest(
       what flags and environment**. That rule, not a hand-picked list, is what
       keeps this complete: walk ``GenericAdapter.interactive_argv`` and
       ``interactive_env`` and every token there traces back to one of
-      ``binary`` / ``launch_args`` / ``bypass_args`` / ``model_flag`` /
+      ``binary`` / ``launch_args`` / ``bypass_args`` / ``linked_worktree_args``
+      (hashed as the UNFILLED template, placeholders and all, so a resumed run's
+      digest does not depend on its worktree's path) / ``model_flag`` /
       ``prompt_template`` / ``env`` on the *resolved* profile, or to
       ``extra_args`` on the resolved adapter — plus ``session_id_flag``, which
       ``build_command`` appends (with a minted id) to the launched argv only.
@@ -440,6 +442,10 @@ def config_digest(
         # pin also records which mapping those args came from.
         if cfg.permission_mode != "bypass":
             launch[role]["permission_mode"] = cfg.permission_mode
+        # Argv tokens `interactive_argv` appends after the mode's args in a linked
+        # worktree (DW-599), placeholders unfilled; same byte-identity rule.
+        if prof.linked_worktree_args:
+            launch[role]["linked_worktree_args"] = list(prof.linked_worktree_args)
     payload = {
         "verify_commands": list(policy.verify.commands),
         "plugins_enabled": sorted(policy.plugins.enabled),
diff --git a/src/bmad_loop/signals.py b/src/bmad_loop/signals.py
index 6a9e9bad7..e7340f747 100644
--- a/src/bmad_loop/signals.py
+++ b/src/bmad_loop/signals.py
@@ -53,6 +53,11 @@ class HookEvent:
     # older vendored relay that predates the field, and for a non-string value.
     # APPENDED with a default, like the fields above.
     payload_error: str | None = None
+    # agy's Stop `fullyIdle` (DW-548), forwarded by the relay only as a boolean:
+    # False marks a yield to a foreground subagent, not a turn end. None for every
+    # other CLI, on an older vendored relay that predates the field, and for a
+    # non-boolean value. APPENDED with a default, like the fields above.
+    fully_idle: bool | None = None
 
 
 # The relays' lineage tags (DW-507, events._lineage). Anything else parses as None.
@@ -84,6 +89,7 @@ def _parse_event(entry: Path) -> HookEvent | None:
     source = data.get("source")
     lineage = data.get("lineage")
     payload_error = data.get("payload_error")
+    fully_idle = data.get("fully_idle")
     # Payload values are forwarded from the CLI unvalidated, so a non-string one
     # reads as absent rather than reaching attribution's set arithmetic (#767).
     return HookEvent(
@@ -97,6 +103,7 @@ def _parse_event(entry: Path) -> HookEvent | None:
         source=source if isinstance(source, str) else None,
         lineage=lineage if isinstance(lineage, str) and lineage in LINEAGE_TAGS else None,
         payload_error=payload_error if isinstance(payload_error, str) else None,
+        fully_idle=fully_idle if isinstance(fully_idle, bool) else None,
     )
 
 
diff --git a/tests/test_cli.py b/tests/test_cli.py
index 78d12926c..8437c7786 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -73,6 +73,7 @@
 from bmad_loop import probe as probe_mod
 from bmad_loop import runs, runsetup, verify
 from bmad_loop.adapters import multiplexer as mux_mod
+from bmad_loop.adapters.profile import CLIProfile
 from bmad_loop.adapters.psmux_backend import PsmuxMultiplexer
 from bmad_loop.plugins import GrantSet
 from bmad_loop.plugins.store import load_grants
@@ -13409,7 +13410,14 @@ def test_validate_text_mode_prints_the_permission_posture(project, capsys, monke
     assert "claude dev: bypass, unsandboxed (scm.isolation=none)" in capsys.readouterr().out
 
 
-def _posture(monkeypatch, platform: str, profile: str, mode: str, isolation: str = "none"):
+def _posture(
+    monkeypatch,
+    platform: str,
+    profile: str | CLIProfile,
+    mode: str,
+    isolation: str = "none",
+    extra_args: tuple[str, ...] | None = None,
+):
     from bmad_loop.adapters.profile import get_profile
     from bmad_loop.checks import ValidationReport
 
@@ -13418,8 +13426,8 @@ def _posture(monkeypatch, platform: str, profile: str, mode: str, isolation: str
     cli._report_permission_mode(
         report,
         "dev",
-        types.SimpleNamespace(permission_mode=mode),
-        get_profile(profile),
+        types.SimpleNamespace(permission_mode=mode, extra_args=extra_args),
+        get_profile(profile) if isinstance(profile, str) else profile,
         isolation,
     )
     monkeypatch.undo()
@@ -13469,17 +13477,118 @@ def test_store_sandboxed_roles_names_the_non_bypass_launch_roles(tmp_path):
     assert cli._store_sandboxed_roles(policy_mod.load(policy), cli.worksource.SOURCE_TICKETS) == ()
 
 
-def test_permission_posture_warns_sandboxed_codex_under_worktree_isolation(monkeypatch):
-    """Codex's sandbox keeps a linked worktree's gitdir read-only, so git
-    add/commit fail there: a warning, not the ok line. Claude's sandbox passes in
-    a linked worktree and keeps the ok line."""
+def test_permission_posture_sandboxed_codex_under_worktree_isolation_carries_the_grant(
+    monkeypatch,
+):
+    """Codex's sandboxed mode declares `linked_worktree_args`, which grant a linked
+    worktree's gitdir and the main repo's .git, so a sandboxed Codex role under
+    worktree isolation can commit: the ok line, naming the grant. Claude's sandbox
+    needs no grant and keeps its plain ok line.
+
+    ABLATION: warn unconditionally in the codex-hooks-json arm and this reddens."""
     (codex,) = _posture(monkeypatch, "linux", "codex", "sandboxed", isolation="worktree")
-    assert (codex.check, codex.severity) == ("adapter.permission-mode", "warning")
-    assert ".git/worktrees/" in codex.message
+    assert (codex.check, codex.severity) == ("adapter.permission-mode", "ok")
+    assert codex.message == (
+        "codex dev: sandboxed under scm.isolation=worktree, with write grants for the "
+        "linked worktree's gitdir and the main repo's .git"
+    )
+    assert codex.detail == {
+        "role": "dev",
+        "profile": "codex",
+        "mode": "sandboxed",
+        "isolation": "worktree",
+        "platform": "linux",
+    }
     (claude,) = _posture(monkeypatch, "linux", "claude", "sandboxed", isolation="worktree")
-    assert claude.severity == "ok"
+    assert (claude.severity, claude.message) == ("ok", "claude dev: sandboxed")
     (codex_main,) = _posture(monkeypatch, "linux", "codex", "sandboxed")
-    assert codex_main.severity == "ok"
+    assert (codex_main.severity, codex_main.message) == ("ok", "codex dev: sandboxed")
+
+
+@pytest.mark.parametrize("extra_args", [("--custom",), ()], ids=["override", "empty"])
+def test_permission_posture_warns_when_extra_args_drops_the_worktree_grant(monkeypatch, extra_args):
+    """A non-None `extra_args` (an empty one included) replaces the mode's args,
+    and the linked-worktree grant rides with them: git add/commit fail again."""
+    (finding,) = _posture(
+        monkeypatch, "linux", "codex", "sandboxed", isolation="worktree", extra_args=extra_args
+    )
+    assert (finding.check, finding.severity) == ("adapter.permission-mode", "warning")
+    assert "adapter.extra_args replaces the mode's args" in finding.message
+    assert ".git/worktrees/" in finding.message
+    assert finding.message.endswith(
+        'drop extra_args, or use scm.isolation = "none" or permission_mode = "bypass" '
+        "for this role"
+    )
+    # Without worktree isolation the same override needs no grant.
+    (main,) = _posture(monkeypatch, "linux", "codex", "sandboxed", extra_args=extra_args)
+    assert main.severity == "ok"
+
+
+def test_permission_posture_warns_a_codex_mode_without_a_worktree_grant(monkeypatch):
+    """A Codex-family profile (a user overlay, say) whose sandboxed mode declares no
+    `linked_worktree_args` cannot open the linked worktree's gitdir: a warning."""
+    from bmad_loop.adapters.profile import get_profile
+
+    codex = get_profile("codex")
+    bare = dataclasses.replace(
+        codex,
+        permission_modes={
+            "sandboxed": dataclasses.replace(
+                codex.permission_modes["sandboxed"], linked_worktree_args=()
+            )
+        },
+    )
+    (finding,) = _posture(monkeypatch, "linux", bare, "sandboxed", isolation="worktree")
+    assert (finding.check, finding.severity) == ("adapter.permission-mode", "warning")
+    assert "declares no linked_worktree_args grant" in finding.message
+    assert ".git/worktrees/" in finding.message
+    assert "drop extra_args" not in finding.message
+
+
+@pytest.mark.parametrize(
+    ("grant", "unnamed", "read_only"),
+    [
+        (
+            ("-c", "filesystem={{gitdir}=1}"),
+            "{common_dir}",
+            "sandbox keeps the main repo's .git read-only",
+        ),
+        (
+            ("-c", "filesystem={{common_dir}=1}"),
+            "{gitdir}",
+            "sandbox keeps the linked worktree's gitdir (under the main repo's "
+            ".git/worktrees/) read-only",
+        ),
+    ],
+    ids=["gitdir-only", "common-dir-only"],
+)
+def test_permission_posture_warns_a_codex_grant_missing_a_placeholder(
+    monkeypatch, grant, unnamed, read_only
+):
+    """Codex commits in a linked worktree only with both the gitdir and the common
+    dir writable, and profile validation accepts a grant naming just one: a warning
+    naming the missing placeholder and the path left read-only, not the ok line.
+
+    ABLATION: drop the `unnamed` arm and both rows report ok."""
+    from bmad_loop.adapters.profile import get_profile
+
+    codex = get_profile("codex")
+    partial = dataclasses.replace(
+        codex,
+        permission_modes={
+            "sandboxed": dataclasses.replace(
+                codex.permission_modes["sandboxed"], linked_worktree_args=grant
+            )
+        },
+    )
+    (finding,) = _posture(monkeypatch, "linux", partial, "sandboxed", isolation="worktree")
+    assert (finding.check, finding.severity) == ("adapter.permission-mode", "warning")
+    assert f"linked_worktree_args grant names no {unnamed}," in finding.message
+    assert read_only in finding.message
+    assert finding.message.endswith(
+        'grant both {gitdir} and {common_dir}, or use scm.isolation = "none" or '
+        'permission_mode = "bypass" for this role'
+    )
 
 
 def _stub_launch_probe(monkeypatch, *results):
diff --git a/tests/test_env_fault_patterns.py b/tests/test_env_fault_patterns.py
index 9f5f96e4f..772c1954d 100644
--- a/tests/test_env_fault_patterns.py
+++ b/tests/test_env_fault_patterns.py
@@ -126,6 +126,36 @@
         "provider-error event=session.execution.failed type=provider.transport status=- "
         'attempt=- message="ConnectionRefused: Unable to connect. Is the computer able to '
         'access the url?"',
+        # Captured the same way from 2.0.32 (2026-10-28): the mock provider
+        # answering HTTP 500 / 503 / 502 (provider.internal, retried), 401 / 403
+        # (provider.auth, not retried), and a session model with no route —
+        # an unconfigured provider, an unknown variant (provider.no-route,
+        # failed before any provider request).
+        "provider-error event=session.retry.scheduled type=provider.internal status=500 "
+        'attempt=2 message="The server had an error while processing your request. Sorry '
+        'about that!"',
+        "provider-error event=session.step.failed type=provider.internal status=500 "
+        'attempt=- message="The server had an error while processing your request. Sorry '
+        'about that!"',
+        "provider-error event=session.retry.scheduled type=provider.internal status=503 "
+        'attempt=2 message="The engine is currently overloaded, please try again later."',
+        "provider-error event=session.execution.failed type=provider.internal status=502 "
+        'attempt=- message="Provider request failed with HTTP 502"',
+        "provider-error event=session.step.failed type=provider.auth status=401 attempt=- "
+        'message="Incorrect API key provided: x. You can find your API key at '
+        'https://platform.openai.com/account/api-keys."',
+        "provider-error event=session.execution.failed type=provider.auth status=403 "
+        'attempt=- message="Your organization does not have access to this model."',
+        "provider-error event=session.execution.failed type=provider.no-route status=- "
+        'attempt=- message="Model unavailable: nosuch/mock-1"',
+        "provider-error event=session.execution.failed type=provider.no-route status=- "
+        'attempt=- message="Variant unavailable for mock/mock-1: bogus"',
+        # A hung provider under a `headerTimeout` / `chunkTimeout` setting reads
+        # provider.transport, not provider.timeout (unset, nothing fires at all).
+        "provider-error event=session.retry.scheduled type=provider.transport status=- "
+        'attempt=2 message="Timed out waiting for response headers"',
+        "provider-error event=session.step.failed type=provider.transport status=200 "
+        'attempt=- message="Timed out waiting for response data"',
     ),
 ]
 # OpenCode 2.x's quota refusals, captured as OPENCODE_REAL's 2.x lines were (a
@@ -162,6 +192,20 @@
     "type": "provider.transport",
     "message": "ConnectionRefused: Unable to connect. Is the computer able to access the url?",
 }
+_INTERNAL_500_MESSAGE = "The server had an error while processing your request. Sorry about that!"
+_INTERNAL_500_ERROR = {
+    "type": "provider.internal",
+    "message": _INTERNAL_500_MESSAGE,
+    "status": 500,
+    "response": {
+        "body": f'{{"error": {{"message": "{_INTERNAL_500_MESSAGE}", "type": "server_error", '
+        '"param": null, "code": null}}'
+    },
+}
+_AUTH_401_MESSAGE = (
+    "Incorrect API key provided: x. You can find your API key at "
+    "https://platform.openai.com/account/api-keys."
+)
 OPENCODE_V2_CAPTURED_FRAMES = [
     (
         "session.retry.scheduled",
@@ -194,6 +238,126 @@
         },
     ),
     ("session.execution.failed", {"sessionID": "ses_4", "error": _TRANSPORT_ERROR}),
+    (
+        "session.retry.scheduled",
+        {
+            "sessionID": "ses_5",
+            "assistantMessageID": "msg_5",
+            "attempt": 2,
+            "at": 1793222564524,
+            "error": _INTERNAL_500_ERROR,
+        },
+    ),
+    (
+        "session.step.failed",
+        {"sessionID": "ses_5", "assistantMessageID": "msg_5", "error": _INTERNAL_500_ERROR},
+    ),
+    (
+        "session.retry.scheduled",
+        {
+            "sessionID": "ses_6",
+            "assistantMessageID": "msg_6",
+            "attempt": 2,
+            "at": 1793222564313,
+            "error": {
+                "type": "provider.internal",
+                "message": "The engine is currently overloaded, please try again later.",
+                "status": 503,
+                "response": {
+                    "body": '{"error": {"message": "The engine is currently overloaded, please '
+                    'try again later.", "type": "server_error", "param": null, "code": null}}'
+                },
+            },
+        },
+    ),
+    (
+        "session.execution.failed",
+        {
+            "sessionID": "ses_7",
+            "error": {
+                "type": "provider.internal",
+                "message": "Provider request failed with HTTP 502",
+                "status": 502,
+                "response": {
+                    "body": "<html>\r\n<head><title>502 Bad Gateway</title></head>\r\n<body>\r\n"
+                    "<center><h1>502 Bad Gateway</h1></center>\r\n</body>\r\n</html>\r\n"
+                },
+            },
+        },
+    ),
+    (
+        "session.step.failed",
+        {
+            "sessionID": "ses_8",
+            "assistantMessageID": "msg_8",
+            "error": {
+                "type": "provider.auth",
+                "message": _AUTH_401_MESSAGE,
+                "status": 401,
+                "response": {
+                    "body": f'{{"error": {{"message": "{_AUTH_401_MESSAGE}", "type": '
+                    '"invalid_request_error", "param": null, "code": "invalid_api_key"}}'
+                },
+            },
+        },
+    ),
+    (
+        "session.execution.failed",
+        {
+            "sessionID": "ses_9",
+            "error": {
+                "type": "provider.auth",
+                "message": "Your organization does not have access to this model.",
+                "status": 403,
+                "response": {
+                    "body": '{"error": {"message": "Your organization does not have access to '
+                    'this model.", "type": "permission_error", "param": null, "code": null}}'
+                },
+            },
+        },
+    ),
+    (
+        "session.execution.failed",
+        {
+            "sessionID": "ses_10",
+            "error": {"type": "provider.no-route", "message": "Model unavailable: nosuch/mock-1"},
+        },
+    ),
+    (
+        "session.execution.failed",
+        {
+            "sessionID": "ses_11",
+            "error": {
+                "type": "provider.no-route",
+                "message": "Variant unavailable for mock/mock-1: bogus",
+            },
+        },
+    ),
+    (
+        "session.retry.scheduled",
+        {
+            "sessionID": "ses_15",
+            "assistantMessageID": "msg_15",
+            "attempt": 2,
+            "at": 1793222868765,
+            "error": {
+                "type": "provider.transport",
+                "message": "Timed out waiting for response headers",
+            },
+        },
+    ),
+    (
+        "session.step.failed",
+        {
+            "sessionID": "ses_16",
+            "assistantMessageID": "msg_16",
+            "error": {
+                "type": "provider.transport",
+                "message": "Timed out waiting for response data",
+                "status": 200,
+            },
+        },
+    ),
     (
         "session.execution.failed",
         {
@@ -225,6 +389,66 @@
 OPENCODE_V2_REAL = [
     line for line in OPENCODE_REAL + OPENCODE_USAGE_REAL if line.startswith("provider-error ")
 ]
+# Captured from 2.0.32 with the seeded lines above, and deliberately NOT seeded:
+# what the session sent can cause both types — an HTTP 400
+# (provider.invalid-request) and a malformed or truncated stream
+# (provider.invalid-output; opencode retries the truncated one). Charging the
+# story an attempt is the right call for them, so no opencode field may match.
+OPENCODE_V2_UNSEEDED_CAPTURED_FRAMES = [
+    (
+        "session.step.failed",
+        {
+            "sessionID": "ses_12",
+            "assistantMessageID": "msg_12",
+            "error": {
+                "type": "provider.invalid-request",
+                "message": "Invalid value for 'temperature': expected a number.",
+                "status": 400,
+                "response": {
+                    "body": '{"error": {"message": "Invalid value for \'temperature\': expected '
+                    'a number.", "type": "invalid_request_error", "param": "temperature", '
+                    '"code": null}}'
+                },
+            },
+        },
+    ),
+    (
+        "session.execution.failed",
+        {
+            "sessionID": "ses_13",
+            "error": {
+                "type": "provider.invalid-output",
+                "message": "Invalid mock/openai-compatible-chat stream event",
+                "status": 200,
+                "response": {
+                    "body": '{"id": "c1", "object": "chat.completion.chunk", "choices": ['
+                },
+            },
+        },
+    ),
+    (
+        "session.retry.scheduled",
+        {
+            "sessionID": "ses_14",
+            "assistantMessageID": "msg_14",
+            "attempt": 2,
+            "at": 1793222564535,
+            "error": {
+                "type": "provider.invalid-output",
+                "message": "OpenAI Chat stream ended without finish_reason",
+                "status": 200,
+            },
+        },
+    ),
+]
+OPENCODE_V2_UNSEEDED_REAL = [
+    "provider-error event=session.step.failed type=provider.invalid-request status=400 "
+    "attempt=- message=\"Invalid value for 'temperature': expected a number.\"",
+    "provider-error event=session.execution.failed type=provider.invalid-output status=200 "
+    'attempt=- message="Invalid mock/openai-compatible-chat stream event"',
+    "provider-error event=session.retry.scheduled type=provider.invalid-output status=200 "
+    'attempt=2 message="OpenAI Chat stream ended without finish_reason"',
+]
 
 # Claude Code surfaces provider failures behind its own "API Error" prefix, and
 # claude.toml reproduces each message's first sentence WHOLE (as a prefix match —
@@ -337,14 +561,16 @@
     'provider-error event=session.step.failed type=aborted status=- attempt=- message="Step interrupted"',
     "provider-error event=session.execution.failed type=permission.rejected status=- "
     'attempt=- message="provider.quota rate-limit"',
-    "provider-error event=session.retry.scheduled type=provider.auth status=401 attempt=2 "
-    'message="quota exceeded; rate-limit; transport down"',
-    "provider-error event=session.execution.failed type=provider.no-route status=- "
+    "provider-error event=session.retry.scheduled type=provider.invalid-request status=400 "
+    'attempt=2 message="quota exceeded; rate-limit; transport down; auth; no-route"',
+    "provider-error event=session.execution.failed type=provider.content-filter status=- "
     'attempt=- message="Variant unavailable for mock/mock-1: rate-limit"',
     # A type that only STARTS like a seeded one (the pattern needs the whole
     # token), and the sanitized remains of a hostile `type` value.
     "provider-error event=session.execution.failed type=provider.quota-exceeded status=- "
     'attempt=- message=""',
+    "provider-error event=session.execution.failed type=provider.authorization status=403 "
+    'attempt=- message=""',
     "provider-error event=session.execution.failed type=provider.unknown_type_provider.quota "
     'status=- attempt=- message=""',
     # A message that forges a whole line: escaped, so it stays mid-line.
@@ -1024,8 +1250,24 @@ def test_v2_corpus_lines_are_what_the_adapter_writes() -> None:
     so the corpus is the real thing, not a plausible-looking string."""
     written = [format_provider_error(event, data) for event, data in OPENCODE_V2_CAPTURED_FRAMES]
     assert written == OPENCODE_V2_REAL
-    for line in written:
-        assert "response" not in line and "insufficient_quota" not in line  # body dropped
+    for (_, data), line in zip(OPENCODE_V2_CAPTURED_FRAMES, written):
+        body = data["error"].get("response", {}).get("body")
+        assert body is None or body not in line  # body dropped
+        assert "response=" not in line and "insufficient_quota" not in line
+    unseeded = [
+        format_provider_error(event, data) for event, data in OPENCODE_V2_UNSEEDED_CAPTURED_FRAMES
+    ]
+    assert unseeded == OPENCODE_V2_UNSEEDED_REAL
+
+
+@pytest.mark.parametrize("line", OPENCODE_V2_UNSEEDED_REAL)
+def test_v2_unseeded_provider_error_types_stay_unclassified(line: str) -> None:
+    """The captured 2.x types the session itself can cause — an invalid request,
+    an invalid provider output — are charged as a code failure, not read as an
+    environment fault or a usage limit. Unlike the bait above, these are REAL
+    adapter lines for real provider refusals: a widened type alternation (or a
+    type-agnostic `type=provider[.]\\S+`) reddens here first."""
+    assert not _matches("opencode", line), f"opencode classifies an unseeded type: {line[:120]}"
 
 
 @pytest.mark.parametrize(
diff --git a/tests/test_events.py b/tests/test_events.py
index 62b8a4b91..b1f051808 100644
--- a/tests/test_events.py
+++ b/tests/test_events.py
@@ -39,6 +39,7 @@
     "_first_workspace",
     "_notification_type",
     "_source",
+    "_fully_idle",
     # DW-507's lineage block: the tag both relays stamp on every event.
     "_LAUNCH_SHIM_WINDOW_S",
     "_proc_stat",
@@ -264,6 +265,50 @@ def test_both_relay_twins_forward_the_session_start_source(
     assert from_relay["source"] == expected
 
 
+@pytest.mark.parametrize(
+    ("payload", "expected"),
+    [
+        ({"fullyIdle": False}, False),
+        ({"fullyIdle": True}, True),
+        # only a JSON boolean is forwarded; anything else writes no key at all
+        ({"fullyIdle": "false"}, None),
+        ({"fullyIdle": 0}, None),
+        ({"fullyIdle": None}, None),
+        ({}, None),
+    ],
+)
+def test_both_relay_twins_forward_a_boolean_fully_idle(tmp_path, monkeypatch, payload, expected):
+    """DW-548: agy's Stop `fullyIdle` reaches the event file from BOTH writers as
+    `fully_idle`, and only as a boolean. Without one the key is ABSENT, not null,
+    so every other CLI's event stays exactly what it was.
+
+    Ablation: drop the `fully_idle` write from either writer and the boolean
+    rows fail on that side; write it unconditionally and the absent rows fail."""
+    hook_run, relay_run = tmp_path / "hook", tmp_path / "relay"
+    proc = subprocess.run(
+        [sys.executable, str(HOOK), "Stop"],
+        input=json.dumps(payload),
+        env={
+            "PATH": os.environ.get("PATH", ""),
+            **({"SYSTEMROOT": os.environ.get("SYSTEMROOT", "")} if os.name == "nt" else {}),
+            "BMAD_LOOP_RUN_DIR": str(hook_run),
+            "BMAD_LOOP_TASK_ID": "1-1-a-dev-1",
+        },
+        capture_output=True,
+        text=True,
+        timeout=30,
+    )
+    assert proc.returncode == 0, proc.stderr
+    assert _relay("Stop", payload, monkeypatch, relay_run, task_id="1-1-a-dev-1") == 0
+    from_hook = json.loads(next((hook_run / "events").glob("*.json")).read_text())
+    from_relay = json.loads(next((relay_run / "events").glob("*.json")).read_text())
+    for event in (from_hook, from_relay):
+        if expected is None:
+            assert "fully_idle" not in event
+        else:
+            assert event["fully_idle"] is expected
+
+
 # ---------------------------------------------------------- lineage (DW-507)
 
 # A fake process table for `events._lineage`: pid -> (ppid, starttime ticks,
diff --git a/tests/test_generic_tmux.py b/tests/test_generic_tmux.py
index c4c687c6b..8aa5f8c36 100644
--- a/tests/test_generic_tmux.py
+++ b/tests/test_generic_tmux.py
@@ -24,7 +24,7 @@
 
 import pytest
 import regex
-from conftest import REAL_MUX_HANG_CEILING_S, json_recursion_payload, real_mux_e2e
+from conftest import REAL_MUX_HANG_CEILING_S, git, json_recursion_payload, real_mux_e2e
 
 from bmad_loop import devcontract, runs
 from bmad_loop.adapters import base as adapter_base
@@ -41,12 +41,18 @@
 )
 from bmad_loop.adapters.generic import GenericDevAdapter, GenericTmuxAdapter
 from bmad_loop.adapters.multiplexer import MultiplexerError
-from bmad_loop.adapters.profile import PARKED_EVENTS, PermissionModeSpec, get_profile
+from bmad_loop.adapters.profile import (
+    PARKED_EVENTS,
+    PermissionModeSpec,
+    get_profile,
+    toml_basic_string,
+)
 from bmad_loop.bmadconfig import ProjectPaths
 from bmad_loop.journal import TASK_CYCLE_ARTIFACTS, Journal
 from bmad_loop.model import TokenUsage
 from bmad_loop.policy import LimitsPolicy, NotifyPolicy, Policy
 from bmad_loop.signals import HookEvent
+from bmad_loop.verify import GitTimeoutError
 
 # A bump the filesystem can actually record. NTFS stores ~100ns ticks (FAT, 2s),
 # so a 1ns increment rounds away on Windows and the rewritten marker never reads
@@ -469,6 +475,102 @@ def test_a_sandboxed_profile_launches_its_mode_args_in_the_bypass_slot(tmp_path)
     assert shlex.split(cmd)[prompt_at + 2] == settings
 
 
+def _grant_adapter(tmp_path, profile_name="codex", mode="sandboxed", extra_args=None):
+    adapter = make_adapter(tmp_path, profile_name=profile_name, extra_args=extra_args)
+    adapter.profile = get_profile(profile_name).for_permission_mode(mode, platform="linux")
+    return adapter
+
+
+def _linked_worktree(project) -> Path:
+    wt = project.project.parent / "wt"
+    git(project.project, "worktree", "add", "-q", "--detach", str(wt), "HEAD")
+    (wt / "nested").mkdir()  # a nested project's sessions run below the worktree root
+    return wt
+
+
+def test_sandboxed_codex_in_a_linked_worktree_is_granted_its_gitdir_and_common_dir(
+    tmp_path, project
+):
+    """DW-599: Codex's sandbox keeps a linked worktree's gitdir and the shared
+    common dir read-only, so the sandboxed launch appends the mode's
+    `linked_worktree_args` with both exact paths, after the mode args (its later
+    `default_permissions` must win) and before the model flag.
+
+    ABLATION: return () from `_linked_worktree_grant` and this reddens."""
+    wt = _linked_worktree(project)
+    adapter = _grant_adapter(tmp_path)
+    mode_args = list(adapter.profile.bypass_args)
+    gitdir = toml_basic_string(str((project.project / ".git" / "worktrees" / "wt").resolve()))
+    common = toml_basic_string(str((project.project / ".git").resolve()))
+    grant = [
+        "-c",
+        'permissions.bmad_loop_worktree.extends="bmad_loop"',
+        "-c",
+        f'permissions.bmad_loop_worktree.filesystem={{{gitdir}="write",{common}="write"}}',
+        "-c",
+        'default_permissions="bmad_loop_worktree"',
+    ]
+    for cwd in (wt, wt / "nested"):
+        argv = adapter.interactive_argv(dataclasses.replace(make_spec(tmp_path), cwd=cwd))
+        start = argv.index(mode_args[0])
+        assert argv[start:] == [*mode_args, *grant, "--model", "sonnet"]
+
+
+def test_no_linked_worktree_grant_in_a_main_checkout(tmp_path, project):
+    adapter = _grant_adapter(tmp_path)
+    argv = adapter.interactive_argv(dataclasses.replace(make_spec(tmp_path), cwd=project.project))
+    assert argv[-4:-2] == ["--ask-for-approval", "never"]  # the mode args end the slot
+    assert not any("bmad_loop_worktree" in a for a in argv)
+
+
+@pytest.mark.parametrize(
+    ("profile_name", "mode", "extra_args"),
+    [
+        ("codex", "bypass", None),
+        ("claude", "sandboxed", None),  # a sandbox that needs no grant declares none
+        ("codex", "sandboxed", ("--custom",)),  # extra_args replaces the mode args, grant too
+    ],
+    ids=["bypass", "non-codex", "extra-args"],
+)
+def test_no_linked_worktree_grant_without_a_declaring_mode(
+    tmp_path, project, monkeypatch, profile_name, mode, extra_args
+):
+    """No grant, and git is not even asked: a broken git must not fail a launch
+    that owes no grant."""
+    wt = _linked_worktree(project)
+
+    def no_git(*_a, **_k):
+        raise AssertionError("git asked for a launch that owes no grant")
+
+    monkeypatch.setattr(generic, "git_bytes", no_git)
+    adapter = _grant_adapter(tmp_path, profile_name, mode, extra_args)
+    argv = adapter.interactive_argv(dataclasses.replace(make_spec(tmp_path), cwd=wt))
+    assert not any("bmad_loop_worktree" in a for a in argv)
+
+
+def test_a_linked_worktree_grant_fault_refuses_the_launch(tmp_path, monkeypatch):
+    """A git fault while resolving the paths raises rather than launching a
+    session that could not commit. Covers a cwd git disowns (rc != 0) and a git
+    that raises (timeout / spawn failure).
+
+    ABLATION: return None from `_linked_worktree_git_dirs` on a fault and both
+    cases launch."""
+    adapter = _grant_adapter(tmp_path)
+    plain = tmp_path / "not-a-repo"
+    plain.mkdir()
+    spec = dataclasses.replace(make_spec(tmp_path), cwd=plain)
+    monkeypatch.setenv("GIT_CEILING_DIRECTORIES", str(tmp_path))
+    with pytest.raises(generic.LinkedWorktreeGrantError, match="could not read the git dirs"):
+        adapter.build_command(spec)
+
+    def hung(*_a, **_k):
+        raise GitTimeoutError("git timed out")
+
+    monkeypatch.setattr(generic, "git_bytes", hung)
+    with pytest.raises(generic.LinkedWorktreeGrantError, match="git timed out"):
+        adapter.interactive_argv(spec)
+
+
 def test_read_result_variants(tmp_path):
     adapter = make_adapter(tmp_path)
     task_dir = adapter.tasks_dir / "t1"
@@ -1930,6 +2032,269 @@ def flush_terminal_spec(call_n):
     assert result.session_id == "main-sess"  # the subagent's toolu_ id is never recorded
 
 
+def _agy_stop(session_id, transcript_path, fully_idle):
+    return HookEvent(
+        ts=1,
+        event="Stop",
+        task_id="3-1-dev-1",
+        session_id=session_id,
+        transcript_path=transcript_path,
+        path=Path("x"),
+        fully_idle=fully_idle,
+    )
+
+
+def test_wait_for_completion_skips_a_fully_idle_false_yield_stop(tmp_path):
+    """DW-548 (pinned on agy 1.4.9): a parent that spawns a foreground subagent
+    fires Stop with `fullyIdle: false` while it yields, then Stop with
+    `fullyIdle: true` when it really finishes. The yield is no turn end. The
+    terminal spec is already on disk here, so a yield read as a turn end would
+    complete on the first event; the session must complete on the FINAL Stop,
+    and the yield is journaled once with its count.
+
+    Ablation, performed: delete the `fully_idle is False` branch in the wait
+    loop and this fails — the result completes on the yield, with its transcript."""
+    adapter, impl = make_dev_adapter(tmp_path, profile_name="antigravity")
+    (impl / "spec-3-1-foo.md").write_text(
+        "---\nstatus: done\n---\n\n## Auto Run Result\n\nStatus: done\n"
+    )
+    adapter.watcher = _ScriptedWatcher(
+        [
+            _agy_stop("agy-parent", "/yield.jsonl", False),
+            _agy_stop("agy-parent", "/yield.jsonl", False),
+            _agy_stop("agy-parent", "/final.jsonl", True),
+        ]
+    )
+
+    result = adapter.wait_for_completion(_dev_handle(), _dev_spec(tmp_path))
+
+    assert result.status == "completed"
+    assert result.session_id == "agy-parent"
+    assert result.transcript_path == "/final.jsonl"
+    assert adapter.watcher.calls == 3  # completion waited for the final Stop
+    yields = [e for e in _lifecycle_lines(adapter) if e["event"] == "hook-stop-yield-ignored"]
+    assert yields == [
+        {
+            "ts": yields[0]["ts"],
+            "event": "hook-stop-yield-ignored",
+            "session_id": "agy-parent",
+            "ignored_so_far": 1,
+        }
+    ]
+
+
+def test_a_lone_fully_idle_false_stop_never_completes(tmp_path, monkeypatch):
+    """DW-548: a yield Stop with no final Stop after it leaves the session
+    running, so it takes the timeout path with no stop seen, and the yield count
+    is on the `timeout-fired` crumb where an operator looks.
+
+    Ablation, performed: delete the `fully_idle is False` branch and this fails
+    — the yield sets stop_seen, and the result-less Stop ends the dev session as
+    stalled instead of timing out."""
+    adapter, clock = _timeout_clock_adapter(tmp_path, monkeypatch)
+    adapter._stall_grace_s = 0.0
+
+    def advance(call_n):
+        if call_n > 1:
+            clock["mono"] += 1000.0
+
+    adapter.watcher = _ScriptedWatcher(
+        [_agy_stop("agy-parent", None, False)],
+        on_call=advance,
+    )
+    result = adapter.wait_for_completion(_dev_handle(), _short_spec(tmp_path, timeout_s=100.0))
+
+    assert result.status == "timeout"
+    assert result.stop_seen is False
+    assert result.session_id == "agy-parent"  # the session's own event: tracked
+    (fired,) = _lifecycle_events(adapter, "timeout-fired")
+    assert fired["stop_yields_ignored"] == 1
+
+
+_AGY_MARKER = ".system_generated/subagents/{session_id}.json"
+
+
+def _agy_brain(tmp_path, parent="agy-parent", child="agy-child"):
+    """A brain store as agy 1.4.9 lays it out: one folder per conversation, the
+    parent's holding the spawn marker it wrote for the child. Returns the two
+    transcript paths (strings, as a hook reports them)."""
+    brain = tmp_path / "brain"
+    transcripts = []
+    for conv in (parent, child):
+        logs = brain / conv / ".system_generated" / "logs"
+        logs.mkdir(parents=True)
+        (logs / "transcript_full.jsonl").write_text("")
+        transcripts.append(str(logs / "transcript_full.jsonl"))
+    marker = brain / parent / _AGY_MARKER.format(session_id=child)
+    marker.parent.mkdir(parents=True)
+    marker.write_text("{}")
+    return transcripts[0], transcripts[1]
+
+
+def test_spawn_marker_verdict_reads_a_sibling_marker_as_a_child(tmp_path):
+    parent_t, child_t = _agy_brain(tmp_path)
+    assert generic._spawn_marker_verdict(_AGY_MARKER, "agy-child", child_t) == "child"
+    assert generic._spawn_marker_verdict(_AGY_MARKER, "agy-parent", parent_t) == "own"
+
+
+def test_spawn_marker_verdict_ignores_a_marker_in_the_conversations_own_folder(tmp_path):
+    """Only a SIBLING folder's marker names a child: a conversation never spawns
+    itself, so its own folder is skipped."""
+    parent_t, _ = _agy_brain(tmp_path)
+    own = tmp_path / "brain" / "agy-parent" / _AGY_MARKER.format(session_id="agy-parent")
+    own.write_text("{}")
+    assert generic._spawn_marker_verdict(_AGY_MARKER, "agy-parent", parent_t) == "own"
+
+
+@pytest.mark.parametrize(
+    ("session_id", "transcript"),
+    [
+        (None, "brain/agy-child/t.jsonl"),
+        ("", "brain/agy-child/t.jsonl"),
+        ("agy-child", None),
+        ("agy-child", ""),
+        ("agy-child", "brain/elsewhere/t.jsonl"),  # no ancestor named by the id
+        ("..", "brain/../t.jsonl"),
+        ("agy-child", "brain/agy-child/t\0.jsonl"),
+    ],
+)
+def test_spawn_marker_verdict_is_unjudged_without_a_conversation_folder(
+    tmp_path, session_id, transcript
+):
+    _agy_brain(tmp_path)
+    if transcript:
+        transcript = str(tmp_path / transcript)
+    assert generic._spawn_marker_verdict(_AGY_MARKER, session_id, transcript) == "unjudged"
+
+
+def test_spawn_marker_verdict_propagates_a_store_read_fault(tmp_path, monkeypatch):
+    """A fault listing the store or statting a marker propagates for the caller
+    to crumb; only an absent marker reads as absent."""
+    parent_t, _ = _agy_brain(tmp_path)
+
+    def denied(path):
+        raise PermissionError(13, "Permission denied", str(path))
+
+    monkeypatch.setattr(generic.os, "scandir", denied)
+    with pytest.raises(PermissionError):
+        generic._spawn_marker_verdict(_AGY_MARKER, "agy-parent", parent_t)
+    monkeypatch.undo()
+    monkeypatch.setattr(generic.os, "stat", denied)
+    with pytest.raises(PermissionError):
+        generic._spawn_marker_verdict(_AGY_MARKER, "agy-parent", parent_t)
+
+
+def _agy_child_run(tmp_path, adapter, impl):
+    """parent yield -> child yield -> child final -> parent final, with the
+    terminal spec already on disk: whichever Stop is first read as a turn end
+    completes the session."""
+    parent_t, child_t = _agy_brain(tmp_path)
+    (impl / "spec-3-1-foo.md").write_text(
+        "---\nstatus: done\n---\n\n## Auto Run Result\n\nStatus: done\n"
+    )
+    adapter.watcher = _ScriptedWatcher(
+        [
+            _agy_stop("agy-parent", parent_t, False),
+            _agy_stop("agy-child", child_t, False),
+            _agy_stop("agy-child", child_t, True),
+            _agy_stop("agy-parent", parent_t, True),
+        ]
+    )
+    return parent_t, child_t
+
+
+def test_wait_for_completion_drops_a_spawned_child_conversations_stop(tmp_path):
+    """DW-548 (pinned on agy 1.4.9): a subagent is a sibling conversation whose
+    Stops reach the parent's stream unannounced. Its final `fully_idle: true`
+    Stop must not complete the parent: the session completes on the PARENT's
+    final Stop, with the parent's id and transcript, and the child is journaled
+    once however many of its Stops arrive.
+
+    Ablation, performed: delete the spawn-marker branch in the wait loop and
+    this fails — the result completes on the child's final Stop, with its id."""
+    adapter, impl = make_dev_adapter(tmp_path, profile_name="antigravity")
+    assert adapter.profile.subagent_spawn_marker == _AGY_MARKER
+    parent_t, _ = _agy_child_run(tmp_path, adapter, impl)
+
+    result = adapter.wait_for_completion(_dev_handle(), _dev_spec(tmp_path))
+
+    assert result.status == "completed"
+    assert result.session_id == "agy-parent"
+    assert result.transcript_path == parent_t
+    assert adapter.watcher.calls == 4
+    ignored = _lifecycle_events(adapter, "subagent-stop-ignored")
+    assert ignored == [
+        {
+            "ts": ignored[0]["ts"],
+            "event": "subagent-stop-ignored",
+            "child_session_id": "agy-child",
+            "fully_idle": False,
+        }
+    ]
+    assert _lifecycle_events(adapter, "subagent-marker-unjudged") == []
+    assert _lifecycle_events(adapter, "subagent-marker-unreadable") == []
+
+
+def test_wait_for_completion_without_a_spawn_marker_is_unchanged(tmp_path):
+    """Gating: a profile without the key reads the child's final Stop as the
+    turn end, exactly as before — the rule must not leak to other CLIs."""
+    adapter, impl = make_dev_adapter(tmp_path, profile_name="antigravity")
+    adapter.profile = dataclasses.replace(adapter.profile, subagent_spawn_marker=None)
+    _, child_t = _agy_child_run(tmp_path, adapter, impl)
+
+    result = adapter.wait_for_completion(_dev_handle(), _dev_spec(tmp_path))
+
+    assert result.status == "completed"
+    assert result.session_id == "agy-child"
+    assert result.transcript_path == child_t
+    assert adapter.watcher.calls == 3
+    assert _lifecycle_events(adapter, "subagent-stop-ignored") == []
+
+
+def test_an_unjudged_stop_is_admitted_and_crumbed_once(tmp_path):
+    """A Stop the rule cannot judge (no folder named by its id) is admitted as
+    before, never silently read as own: the crumb fires once per attempt."""
+    adapter, impl = make_dev_adapter(tmp_path, profile_name="antigravity")
+    (impl / "spec-3-1-foo.md").write_text(
+        "---\nstatus: done\n---\n\n## Auto Run Result\n\nStatus: done\n"
+    )
+    adapter.watcher = _ScriptedWatcher(
+        [_agy_stop("agy-parent", "/yield.jsonl", False), _agy_stop("agy-parent", None, True)]
+    )
+
+    result = adapter.wait_for_completion(_dev_handle(), _dev_spec(tmp_path))
+
+    assert result.status == "completed"
+    assert adapter.watcher.calls == 2
+    (crumb,) = _lifecycle_events(adapter, "subagent-marker-unjudged")
+    assert crumb["session_id"] == "agy-parent"
+    assert crumb["transcript_path"] == "/yield.jsonl"
+
+
+def test_an_unreadable_marker_store_admits_the_stop_and_crumbs_once(tmp_path, monkeypatch):
+    """A store read fault admits the Stop as before (failing toward acceptance)
+    and is journaled once with the error — never folded into "not a child"."""
+    adapter, impl = make_dev_adapter(tmp_path, profile_name="antigravity")
+    _, child_t = _agy_child_run(tmp_path, adapter, impl)
+    real_scandir = os.scandir
+
+    def denied(path):
+        if Path(path).name == "brain":
+            raise PermissionError(13, "Permission denied", str(path))
+        return real_scandir(path)
+
+    monkeypatch.setattr(generic.os, "scandir", denied)
+    result = adapter.wait_for_completion(_dev_handle(), _dev_spec(tmp_path))
+
+    assert result.status == "completed"
+    assert result.session_id == "agy-child"  # admitted: the fault judged nothing
+    assert result.transcript_path == child_t
+    (crumb,) = _lifecycle_events(adapter, "subagent-marker-unreadable")
+    assert crumb["session_id"] == "agy-parent"
+    assert crumb["error"].startswith("PermissionError")
+    assert _lifecycle_events(adapter, "subagent-stop-ignored") == []
+
+
 def test_wait_for_completion_ignores_foreign_identified_lifecycle_events(tmp_path):
     """A nested CLI inherits the relay environment and writes into the parent's
     stream (#767). Its announced SessionStart marks its id foreign, so neither
@@ -2348,7 +2713,9 @@ def flush_terminal_spec(call_n):
 
 def test_wait_for_completion_keeps_identified_stop_for_stop_only_profile(tmp_path):
     """A Stop-only profile (no SessionStart) never binds, so attribution admits
-    every event and its established identified-Stop completion stays intact."""
+    every event and its established identified-Stop completion stays intact. The
+    transcript sits under no folder named by the id, so the spawn-marker rule
+    (DW-548) cannot judge it: admitted, with that one crumb."""
     adapter, impl = make_dev_adapter(tmp_path, profile_name="antigravity")
     (impl / "spec-3-1-foo.md").write_text(
         "---\nstatus: done\n---\n\n## Auto Run Result\n\nStatus: done\n"
@@ -2362,7 +2729,7 @@ def test_wait_for_completion_keeps_identified_stop_for_stop_only_profile(tmp_pat
     assert result.status == "completed"
     assert result.session_id == "stop-only-session"
     assert result.transcript_path == "/legacy.jsonl"
-    assert _lifecycle_lines(adapter) == []
+    assert [e["event"] for e in _lifecycle_lines(adapter)] == ["subagent-marker-unjudged"]
 
 
 CODEX_SESSION = "019a2b3c-4d5e-7f60-8a9b-0c1d2e3f4a5b"
@@ -3997,6 +4364,7 @@ def advance(call_n):
         "probe_failures": 0,
         "usage_sample_failures": 0,
         "foreign_hook_events": 0,  # no nested CLI's events were dropped (#767)
+        "stop_yields_ignored": 0,  # no Stop was a subagent yield (DW-548)
     }
     assert [w["remaining_s"] for w in writes] == [100.0, 59.0]  # tick 2 was throttled
     hb = json.loads((adapter.tasks_dir / "3-1-dev-1" / "heartbeat.json").read_text())
@@ -11215,6 +11583,212 @@ def script(call_n):
     assert [e["kind"] for e in adapter.journal.entries] == ["session-idle", "session-active"]
 
 
+# DW-548: agy runs a foreground subagent as a SIBLING conversation and writes
+# nothing to the parent's folder meanwhile; the children the parent lists
+# through its spawn marker are walked like the subagent tree.
+
+
+def _agy_idle_run(tmp_path, monkeypatch, *, session_ids=("agy-parent",), on_call=None):
+    """An antigravity idle adapter over `_agy_brain`'s store, named by the
+    parent's `fullyIdle: false` yield Stops, one per tick from tick 1 with the
+    ids in `session_ids` (agy's only id-bearing event), with the pane
+    repainting from tick 2. The child's transcript grows
+    from tick 2 unless `on_call` replaces that; the loop ends on tick 7.
+    Returns (adapter, heartbeats, brain)."""
+    adapter, _, log, _t, clock, heartbeats = _idle_adapter(
+        tmp_path, monkeypatch, profile_name="antigravity"
+    )
+    assert adapter.profile.subagent_transcript_root == ""  # children only
+    parent_t, child_t = _agy_brain(tmp_path)
+
+    def script(call_n):
+        if call_n >= 2:
+            clock["t"] += generic.HEARTBEAT_INTERVAL_S
+            _grow(log, "\r⠋".encode())
+            if on_call is None:
+                _grow(Path(child_t), b'{"step_index":1}\n')
+        if on_call is not None:
+            on_call(call_n)
+        if call_n == 7:
+            clock["t"] += 10_000.0
+
+    stops = [_agy_stop(sid, parent_t, False) for sid in session_ids]
+    adapter.watcher = _ScriptedWatcher(stops, on_call=script)
+    return adapter, heartbeats, tmp_path / "brain"
+
+
+def test_spawned_child_activity_keeps_a_silent_agy_parent_active(tmp_path, monkeypatch):
+    """The parent's transcript sits still while the child it listed through the
+    spawn marker keeps writing: the idle clock reads the child's writes, so no
+    stretch opens.
+
+    ABLATION, performed: drop the `_spawned_children` roots from
+    `_sample_subagent_tree` and a `session-idle` opens."""
+    adapter, heartbeats, _ = _agy_idle_run(tmp_path, monkeypatch)
+    spec = dataclasses.replace(_dev_spec(tmp_path), timeout_s=5000.0)
+    result = adapter.wait_for_completion(_dev_handle(), spec)
+    assert result.status == "timeout"
+    assert adapter.journal.entries == []
+    assert all(hb["transcript_idle_s"] == 0.0 for hb in heartbeats[1:])
+    crumbs = [ln["event"] for ln in _lifecycle_lines(adapter, "3-1-dev-1")]
+    assert not [c for c in crumbs if c.startswith("subagent-scan-")]
+
+
+@pytest.mark.parametrize("case", ["no-marker-key", "no-marker-file", "unjudged"])
+def test_spawned_child_is_not_watched_without_a_listing(tmp_path, monkeypatch, case):
+    """The same growing child is no activity when the parent does not list it:
+    a profile without `subagent_spawn_marker` (unchanged behaviour), a parent
+    folder holding no marker, or a Stop whose id names no ancestor folder of its
+    transcript (the parent's folder cannot be judged, so no child is guessed).
+    The silent parent opens its stretch at the grace crossing."""
+    adapter, _, brain = _agy_idle_run(
+        tmp_path, monkeypatch, session_ids=("elsewhere" if case == "unjudged" else "agy-parent",)
+    )
+    if case == "no-marker-key":
+        adapter.profile = dataclasses.replace(adapter.profile, subagent_spawn_marker=None)
+    elif case == "no-marker-file":
+        (brain / "agy-parent" / _AGY_MARKER.format(session_id="agy-child")).unlink()
+    spec = dataclasses.replace(_dev_spec(tmp_path), timeout_s=5000.0)
+    adapter.wait_for_completion(_dev_handle(), spec)
+    entries = adapter.journal.entries
+    assert [e["kind"] for e in entries] == ["session-idle"]
+    assert entries[0]["since_ts"] == 5000.0
+    crumbs = [ln["event"] for ln in _lifecycle_lines(adapter, "3-1-dev-1")]
+    assert not [c for c in crumbs if c.startswith("subagent-scan-")]
+
+
+def test_spawned_child_appearing_mid_run_closes_the_stretch(tmp_path, monkeypatch):
+    """No child is listed when the parent goes quiet, so the stretch opens at
+    the grace crossing; the spawn then writes the marker and the child's
+    transcript, which reads as movement from the empty children's (0, 0, 0):
+    one `session-active` carrying the stretch's full length.
+
+    ABLATION: drop `or sub_moved` and the `session-active` is missing."""
+    marker = tmp_path / "brain" / "agy-parent" / _AGY_MARKER.format(session_id="agy-child")
+    child_dir = tmp_path / "brain" / "agy-child"
+    stash = tmp_path / "stash"
+
+    def script(call_n):
+        if call_n == 1:  # the store before the spawn: the parent alone
+            stash.mkdir()
+            marker.rename(stash / "marker.json")
+            child_dir.rename(stash / "agy-child")
+        if call_n == 5:  # heartbeat 5: 120 s
+            (stash / "marker.json").rename(marker)
+            (stash / "agy-child").rename(child_dir)
+        if call_n > 5:
+            _grow(child_dir / ".system_generated/logs/transcript_full.jsonl", b"{}\n")
+
+    adapter, _, _ = _agy_idle_run(tmp_path, monkeypatch, on_call=script)
+    spec = dataclasses.replace(_dev_spec(tmp_path), timeout_s=5000.0)
+    adapter.wait_for_completion(_dev_handle(), spec)
+    entries = adapter.journal.entries
+    assert [e["kind"] for e in entries] == ["session-idle", "session-active"]
+    assert entries[0]["since_ts"] == 5000.0
+    assert entries[1]["idle_s"] == 120.0
+
+
+def test_children_coming_into_view_rebaseline_the_subagent_key(tmp_path, monkeypatch):
+    """A profile declaring both a tree and a spawn marker, named first by an
+    id-less Stop (the parent's folder cannot be judged: the tree alone is
+    watched) and then by the parent's id: the static children now in view
+    change what the key covers, which is a baseline, not movement, so the
+    stretch still opens from the naming.
+
+    ABLATION: drop the `sub_children_judged` rebaseline and the newly watched
+    children read as movement on tick 2, moving `since_ts`."""
+    adapter, _, _ = _agy_idle_run(
+        tmp_path, monkeypatch, session_ids=(None, "agy-parent"), on_call=lambda n: None
+    )
+    adapter.profile = dataclasses.replace(
+        adapter.profile, subagent_transcript_dir="{stem}/subagents"
+    )
+    parent_t = tmp_path / "brain/agy-parent/.system_generated/logs/transcript_full.jsonl"
+    _subagent_file(parent_t, "agent-a.jsonl")
+    spec = dataclasses.replace(_dev_spec(tmp_path), timeout_s=5000.0)
+    adapter.wait_for_completion(_dev_handle(), spec)
+    entries = adapter.journal.entries
+    assert [e["kind"] for e in entries] == ["session-idle"]
+    assert entries[0]["since_ts"] == 5000.0
+
+
+def test_spawn_marker_listing_fault_is_crumbed_and_degrades_to_the_parent(tmp_path, monkeypatch):
+    """A marker listing that raises is never "no children": it joins the
+    `subagent-scan-failed` streak (`path` = the parent's conversation folder),
+    and the tick degrades to the parent alone, so the silent parent still opens
+    its stretch on time although the child writes.
+
+    ABLATION: swallow the fault into `[]` and the crumb is never written."""
+    calls: list[Path] = []
+
+    def denied(template, conversation):
+        calls.append(conversation)
+        raise PermissionError(13, "Permission denied")
+
+    monkeypatch.setattr(generic, "_spawned_children", denied)
+    adapter, _, brain = _agy_idle_run(tmp_path, monkeypatch)
+    spec = dataclasses.replace(_dev_spec(tmp_path), timeout_s=5000.0)
+    adapter.wait_for_completion(_dev_handle(), spec)
+    assert len(calls) > 3
+    entries = adapter.journal.entries
+    assert [e["kind"] for e in entries] == ["session-idle"]
+    assert entries[0]["since_ts"] == 5000.0
+    (failed,) = _lifecycle_events(adapter, "subagent-scan-failed")
+    assert failed["path"] == str(brain / "agy-parent")
+    assert failed["error"] == "PermissionError: [Errno 13] Permission denied"
+    assert _lifecycle_events(adapter, "subagent-scan-recovered") == []
+
+
+# `_spawned_children` directly: the marker listing's match/skip/raise rules.
+
+
+def test_spawned_children_lists_each_marked_sibling(tmp_path):
+    """A listed child's folder is named whether or not it exists yet; the
+    parent's own id, names the template does not match, and an empty listing
+    directory's absence are not children."""
+    _agy_brain(tmp_path)
+    brain = tmp_path / "brain"
+    parent = brain / "agy-parent"
+    subagents = parent / ".system_generated" / "subagents"
+    (subagents / "agy-late.json").write_text("{}")  # spawned, folder not yet written
+    (subagents / "agy-parent.json").write_text("{}")  # its own id never counts
+    (subagents / "notes.txt").write_text("x")
+    assert generic._spawned_children(_AGY_MARKER, parent) == [
+        brain / "agy-child",
+        brain / "agy-late",
+    ]
+    assert generic._spawned_children(_AGY_MARKER, brain / "agy-child") == []
+
+
+def test_spawned_children_matches_the_id_in_a_middle_component(tmp_path):
+    """The id may sit in a directory component: a candidate counts only when
+    the whole filled-in marker stats, and literal braces stay literal."""
+    template = "kids/{session_id}/{{spawned}}.json"
+    conversation = tmp_path / "store" / "p"
+    (conversation / "kids" / "c1").mkdir(parents=True)
+    (conversation / "kids" / "c1" / "{spawned}.json").write_text("{}")
+    (conversation / "kids" / "c2").mkdir()  # no marker inside: not a child
+    assert generic._spawned_children(template, conversation) == [tmp_path / "store" / "c1"]
+
+
+def test_spawned_children_propagates_a_listing_or_stat_fault(tmp_path, monkeypatch):
+    """Only an absent listing directory or marker reads as absent; every other
+    fault propagates for the caller to crumb."""
+    _agy_brain(tmp_path)
+    parent = tmp_path / "brain" / "agy-parent"
+
+    def denied(path):
+        raise PermissionError(13, "Permission denied", str(path))
+
+    monkeypatch.setattr(generic.os, "scandir", denied)
+    with pytest.raises(PermissionError):
+        generic._spawned_children(_AGY_MARKER, parent)
+    monkeypatch.undo()
+    monkeypatch.setattr(generic.os, "stat", denied)
+    with pytest.raises(PermissionError):
+        generic._spawned_children(_AGY_MARKER, parent)
+
+
 # `_subagent_tree_key` directly: the stat-only walk's skip/raise rules.
 
 
diff --git a/tests/test_hook_script.py b/tests/test_hook_script.py
index 800458368..f3fd7aba3 100644
--- a/tests/test_hook_script.py
+++ b/tests/test_hook_script.py
@@ -60,6 +60,7 @@ def test_writes_event_file(tmp_path):
     assert event["task_id"] == "1-1-a-dev-1"
     assert event["session_id"] == "abc-123"
     assert event["transcript_path"].endswith("abc-123.jsonl")
+    assert "fully_idle" not in event  # DW-548: absent unless the CLI sends one
     assert not list((tmp_path / "events").glob("*.tmp"))
 
 
@@ -107,6 +108,7 @@ def test_antigravity_payload(tmp_path):
     assert event["session_id"] == "agy-3"
     assert event["transcript_path"].endswith("transcript.jsonl")
     assert event["cwd"] == "/ws"
+    assert event["fully_idle"] is True  # DW-548: forwarded as a boolean
 
 
 def test_workspace_paths_ignored_when_unusable(tmp_path):
diff --git a/tests/test_opencode_http.py b/tests/test_opencode_http.py
index 5d0f5a97f..b9ce5967b 100644
--- a/tests/test_opencode_http.py
+++ b/tests/test_opencode_http.py
@@ -444,6 +444,8 @@ def _get_v2(self):
             self._message_page(parse_qs(urlsplit(self.path).query))
         elif path == f"/api/session/{SESSION_ID}":
             self._json(200, {"data": session_info()})
+        elif path == "/api/session":
+            self._json(200, {"data": [], "cursor": {"previous": None, "next": None}})
         elif path in ("/api/model", "/api/model/default"):
             query = parse_qs(urlsplit(self.path).query)
             directory = (query.get("location[directory]") or [""])[0]
@@ -4563,6 +4565,24 @@ def test_v2_dispatch_filters_child_sessions_and_maps_execution_events(tmp_path):
         assert sess.events.get_nowait() == queued, etype
 
 
+def test_v2_dispatch_renders_form_created_of_this_session_only(tmp_path):
+    """`form.created` names its session only inside the nested form: it must
+    pass the session filter into both sinks for our session, and a child
+    session's form must still be filtered out."""
+    adapter, sess, log_path, event_path = _sess_with_sinks(tmp_path)
+    sess.protocol = V2Protocol()
+    fields = [{"key": "q0", "title": "Database", "description": "Which one?"}]
+    for sid in ("ses_child", "ses_test"):
+        form = {"id": "frm_1", "sessionID": sid, "title": "Questions", "fields": fields}
+        adapter._dispatch_sse(sess, _v2_frame("form.created", form=form))
+    adapter._dispatch_sse(sess, _v2_frame("form.cancelled", id="frm_1", sessionID="ses_test"))
+    log = _log_text(log_path)
+    assert log.count("[bmad] form ask:") == 1
+    assert '[bmad] form ask: Questions ["Database: Which one?"]\n' in log
+    assert "[bmad] form cancelled\n" in log
+    assert [r["type"] for r in read_jsonl(event_path)] == ["form.created", "form.cancelled"]
+
+
 def test_v2_html_health_reports_protocol_mismatch(tmp_path, v2_fake):
     """`--version` said 2.x but `/api/info` answers the web-UI HTML shell: the
     give-up error names the mismatch on the 2.x health endpoint."""
@@ -4601,12 +4621,18 @@ def test_v2_session_env_and_config_are_the_v2_dialect(tmp_path, monkeypatch):
 class _V2RouteClient:
     """A V2 control client answering GETs off a per-route script (the path
     before any query): an int is a bare status code, an Exception is raised,
+    a callable is called with the params and its result read the same way,
     anything else is a 200 whose JSON body is that value. A route's last entry
-    repeats; an unscripted route is a 404. Every GET is recorded with its
-    params."""
+    repeats; an unscripted route is a 404, except the child list and the
+    active map, which default to a server with no subagents and nothing
+    running. Every GET is recorded with its params."""
 
     def __init__(self, **routes):
-        self.routes = {path: list(answers) for path, answers in routes.items()}
+        self.routes = {
+            _V2_LIST: [_v2_children()],
+            _V2_ACTIVE: [{"data": {}}],
+            **{path: list(answers) for path, answers in routes.items()},
+        }
         self.gets: list[tuple[str, dict | None]] = []
         self.posts: list[str] = []
 
@@ -4614,6 +4640,8 @@ def get(self, path, params=None):
         self.gets.append((path, params))
         answers = self.routes.get(path) or [404]
         answer = answers.pop(0) if len(answers) > 1 else answers[0]
+        if callable(answer):
+            answer = answer(params)
         if isinstance(answer, Exception):
             raise answer
 
@@ -4643,6 +4671,7 @@ def close(self):
 _V2_ACTIVE = "/api/session/active"
 _V2_MESSAGES = f"/api/session/{_V2_SID}/message"
 _V2_INFO = f"/api/session/{_V2_SID}"
+_V2_LIST = "/api/session"
 
 
 def _v2_info(**tokens) -> dict:
@@ -4651,6 +4680,33 @@ def _v2_info(**tokens) -> dict:
     return {"data": {"id": _V2_SID, "tokens": full}}
 
 
+def _v2_child(session_id: str, parent_id: str, **tokens) -> dict:
+    """A listed child `Session.Info`: `parentID` names its parent."""
+    return {**_v2_info(**tokens)["data"], "id": session_id, "parentID": parent_id}
+
+
+def _v2_children(*infos, next_cursor=None) -> dict:
+    """One `GET /api/session` page."""
+    return {"data": list(infos), "cursor": {"previous": None, "next": next_cursor}}
+
+
+def _v2_tree(tree: dict):
+    """A child-list answer off ``{parent id: [page, ...]}``: the first page by
+    ``parentID``, a later one by ``cursor`` (``"<parent id>#<n>"``, the page
+    index); a page is a child list body, a status code or an Exception, and a
+    parent not in the tree has no children."""
+
+    def answer(params):
+        params = params or {}
+        if "cursor" in params:
+            parent, _, index = params["cursor"].partition("#")
+            return tree[parent][int(index)]
+        pages = tree.get(params.get("parentID"))
+        return pages[0] if pages else _v2_children()
+
+    return answer
+
+
 def _v2_assistant(completed: int | None, **extra) -> dict:
     return {
         "id": "msg_a",
@@ -4891,7 +4947,225 @@ def test_v2_sample_usage_separates_faults_from_inert(tmp_path):
     assert weighted is None and fault and fault.startswith("KeyError")
     sess.client = _V2RouteClient(**{_V2_INFO: [_v2_info(input=3, output=1)]})
     assert adapter._sample_weighted_usage(sess, spec) == (4, None)
-    assert [path for path, _ in sess.client.gets] == [_V2_INFO]  # never the walk
+    # never the transcript walk: the aggregate plus the (empty) child list
+    assert [path for path, _ in sess.client.gets] == [_V2_INFO, _V2_LIST]
+
+
+# A parent with two children over two list pages, a grandchild under the first,
+# and two entries the walk must not count: a session naming another parent (a
+# server ignoring the filter) and the parent itself listed under the grandchild
+# (a cycle).
+_V2_TREE = {
+    _V2_SID: [
+        _v2_children(_v2_child("ses_a", _V2_SID, input=20, output=2), next_cursor=f"{_V2_SID}#1"),
+        _v2_children(
+            _v2_child("ses_b", _V2_SID, input=300, reasoning=30),
+            _v2_child("ses_stray", "ses_elsewhere", input=9999),
+            next_cursor=f"{_V2_SID}#2",
+        ),
+        _v2_children(),
+    ],
+    "ses_a": [
+        _v2_children(_v2_child("ses_a1", "ses_a", input=4000, cache={"read": 7, "write": 0}))
+    ],
+    "ses_a1": [_v2_children(_v2_child(_V2_SID, "ses_a1", input=50000))],
+}
+
+
+def test_v2_usage_sums_every_descendant_session(tmp_path):
+    """DW-540: a 2.x session counts only its own steps, so recorded usage is
+    the parent's aggregate plus every descendant's — the children list paged on
+    its cursor, the walk recursing to the grandchild, a stray or cyclic entry
+    never counted. Through `_capture_usage` the sum is what is stashed.
+
+    ABLATION: make `V2Protocol.descendants` answer `([], None)` and this
+    reddens (the parent alone, 100/10)."""
+    adapter = make_adapter(tmp_path)
+    (adapter.tasks_dir / "t-cap").mkdir(parents=True)
+    sess = _v2_sess(_V2_SID)
+    sess.client = _V2RouteClient(
+        **{
+            _V2_MESSAGES: [_v2_page(_v2_assistant(9))],
+            _V2_INFO: [_v2_info(input=100, output=10)],
+            _V2_LIST: [_v2_tree(_V2_TREE)],
+        }
+    )
+    handle = SessionHandle(task_id="t-cap", native_id=_V2_SID)
+
+    assert adapter._capture_usage(handle, sess) is not None
+
+    assert adapter.read_usage(SessionResult(status="completed", session_id=_V2_SID)) == (
+        TokenUsage(input_tokens=4420, output_tokens=42, cache_read_tokens=7)
+    )
+    lists = [params for path, params in sess.client.gets if path == _V2_LIST]
+    assert lists[:3] == [
+        {"parentID": _V2_SID, "limit": 200},
+        {"cursor": f"{_V2_SID}#1", "limit": 200},  # the cursor carries the parentID
+        {"cursor": f"{_V2_SID}#2", "limit": 200},
+    ]
+    assert {"parentID": "ses_a1", "limit": 200} in lists
+    assert {"parentID": "ses_stray", "limit": 200} not in lists
+    assert _lifecycle_lines(adapter, "t-cap") == []
+
+
+def test_v2_sample_usage_counts_children_while_the_parent_reads_zero():
+    """Mid-turn, a parent blocked on a foreground subagent reads all zeros
+    while its child spends: the budget sample is the child's, not inert.
+
+    ABLATION: make `V2Protocol.descendants` answer `([], None)` and the sample
+    reads `(None, None)`."""
+    client = _V2RouteClient(
+        **{
+            _V2_INFO: [_v2_info()],
+            _V2_LIST: [_v2_tree({_V2_SID: [_v2_children(_v2_child("ses_a", _V2_SID, input=7))]})],
+        }
+    )
+    assert V2Protocol().sample_usage(client, _V2_SID) == (TokenUsage(input_tokens=7), None)
+
+
+@pytest.mark.parametrize(
+    "tree, error",
+    [
+        pytest.param({_V2_SID: [503]}, f"child list of {_V2_SID}: HTTP 503", id="child-list"),
+        pytest.param(
+            {**_V2_TREE, "ses_a": [RuntimeError("boom")]},
+            "RuntimeError: boom",
+            id="grandchild-list",
+        ),
+        pytest.param(
+            {_V2_SID: [{"data": "x"}]},
+            f"child list of {_V2_SID} is str, not a list",
+            id="malformed",
+        ),
+        pytest.param(
+            {_V2_SID: [_v2_children({"parentID": _V2_SID})]},
+            f"a child of {_V2_SID} has no session id",
+            id="no-id",
+        ),
+        pytest.param(
+            {_V2_SID: [_v2_children({**_v2_child("ses_a", _V2_SID), "tokens": "n/a"})]},
+            "malformed child session ses_a: TypeError",
+            id="child-tokens",
+        ),
+        pytest.param(
+            {_V2_SID: [_v2_children(next_cursor=f"{_V2_SID}#1"), _v2_children(next_cursor="x")]},
+            None,
+            id="empty-page-ends",
+        ),
+        pytest.param(
+            {_V2_SID: [_v2_children(_v2_child("ses_a", _V2_SID), next_cursor=f"{_V2_SID}#0")]},
+            "child sessions did not end within 1000 pages",
+            id="runaway-cursor",
+        ),
+    ],
+)
+def test_v2_child_walk_fault_is_never_a_parent_only_figure(tmp_path, tree, error):
+    """DW-461 for the descendant walk: a child list failing at any depth, a
+    malformed page, an id-less child, a child's malformed aggregate or a
+    cursor that never runs dry stashes nothing and is crumbed
+    `stage=children` — the parent's own 100 tokens never stand in for the
+    tree. (An empty page ends a listing even with a `next`.)"""
+    adapter = make_adapter(tmp_path)
+    (adapter.tasks_dir / "t-cap").mkdir(parents=True)
+    sess = _v2_sess(_V2_SID)
+    sess.client = _V2RouteClient(
+        **{
+            _V2_MESSAGES: [_v2_page(_v2_assistant(9))],
+            _V2_INFO: [_v2_info(input=100)],
+            _V2_LIST: [_v2_tree(tree)],
+        }
+    )
+    handle = SessionHandle(task_id="t-cap", native_id=_V2_SID)
+
+    assert adapter._capture_usage(handle, sess) is not None
+
+    usage = adapter.read_usage(SessionResult(status="completed", session_id=_V2_SID))
+    if error is None:
+        assert usage == TokenUsage(input_tokens=100) and _capture_crumbs(adapter) == []
+        return
+    assert usage is None
+    (crumb,) = _capture_crumbs(adapter)
+    assert crumb["stage"] == "children" and crumb["error"].startswith(error)
+    sess.client.routes[_V2_INFO] = [_v2_info(input=100)]
+    sample, fault = V2Protocol().sample_usage(sess.client, _V2_SID)
+    assert sample is None and fault and fault.startswith(error)
+
+
+def _child_active_crumbs(adapter):
+    return [
+        ln
+        for ln in _lifecycle_lines(adapter, "t-cap")
+        if ln["event"].startswith("usage-child-active")
+    ]
+
+
+def test_v2_capture_journals_a_still_active_background_child(tmp_path):
+    """A `background: true` subagent can outlive its parent's turn: capture
+    counts what it has landed and journals `usage-child-active` naming it —
+    never a session outside the tree, never the parent itself.
+
+    ABLATION: drop the `_note_active_children` call in `_capture_usage` and
+    the crumb is gone."""
+    adapter = make_adapter(tmp_path)
+    (adapter.tasks_dir / "t-cap").mkdir(parents=True)
+    sess = _v2_sess(_V2_SID)
+    running = {"type": "running"}
+    sess.client = _V2RouteClient(
+        **{
+            _V2_MESSAGES: [_v2_page(_v2_assistant(9))],
+            _V2_INFO: [_v2_info(input=100)],
+            _V2_LIST: [_v2_tree(_V2_TREE)],
+            _V2_ACTIVE: [{"data": {_V2_SID: running, "ses_a1": running, "ses_other": running}}],
+        }
+    )
+    handle = SessionHandle(task_id="t-cap", native_id=_V2_SID)
+
+    assert adapter._capture_usage(handle, sess) is not None
+
+    usage = adapter.read_usage(SessionResult(status="completed", session_id=_V2_SID))
+    assert usage is not None and usage.input_tokens == 4420
+    (crumb,) = _child_active_crumbs(adapter)
+    assert crumb["event"] == "usage-child-active" and crumb["sessions"] == ["ses_a1"]
+
+
+@pytest.mark.parametrize(
+    "active, error",
+    [
+        (500, "HTTP 500"),
+        (RuntimeError("gone"), "RuntimeError: gone"),
+        ({"data": []}, "active map is list, not an object"),
+        ({"data": {"ses_a": {"type": "running"}}}, f"child list of {_V2_SID}: HTTP 502"),
+    ],
+    ids=["non-200", "transport", "malformed", "walk"],
+)
+def test_v2_capture_crumbs_an_unread_active_map(tmp_path, active, error):
+    """Not knowing whether a child is still running is crumbed
+    (`usage-child-active-failed`), never read as "none active"; the usage
+    itself, read fine, is still stashed. The walk case fails only the second
+    walk, the one the active check makes.
+
+    ABLATION: answer `([], None)` on a non-200 in `active_descendants` and the
+    non-200 case reddens."""
+    adapter = make_adapter(tmp_path)
+    (adapter.tasks_dir / "t-cap").mkdir(parents=True)
+    sess = _v2_sess(_V2_SID)
+    sess.client = _V2RouteClient(
+        **{
+            _V2_MESSAGES: [_v2_page(_v2_assistant(9))],
+            _V2_INFO: [_v2_info(input=100)],
+            _V2_LIST: [_v2_children(), 502],
+            _V2_ACTIVE: [active],
+        }
+    )
+    handle = SessionHandle(task_id="t-cap", native_id=_V2_SID)
+
+    assert adapter._capture_usage(handle, sess) is not None
+
+    assert adapter.read_usage(SessionResult(status="completed", session_id=_V2_SID)) == (
+        TokenUsage(input_tokens=100)
+    )
+    (crumb,) = _child_active_crumbs(adapter)
+    assert crumb["event"] == "usage-child-active-failed" and crumb["error"] == error
 
 
 def test_v2_transcript_walks_all_pages(tmp_path, v2_fake, monkeypatch):
diff --git a/tests/test_opencode_protocol.py b/tests/test_opencode_protocol.py
index 9b819e515..da73414b6 100644
--- a/tests/test_opencode_protocol.py
+++ b/tests/test_opencode_protocol.py
@@ -623,6 +623,104 @@ def test_v2_tool_name_joined_from_input_started():
     ]
 
 
+# The live 2.0.32 `form.created` payload of a two-question `question` call
+# (module docstring, "Forms").
+_FORM_CREATED = {
+    "form": {
+        "id": "frm_1",
+        "sessionID": "ses_1",
+        "title": "Questions",
+        "metadata": {"kind": "question", "tool": {"messageID": "msg_a", "id": "call_q1"}},
+        "fields": [
+            {
+                "key": "q0",
+                "title": "Database",
+                "description": "Which database should the service use?",
+                "type": "string",
+                "options": [
+                    {"value": "Postgres", "label": "Postgres", "description": "Relational"},
+                    {"value": "SQLite", "label": "SQLite", "description": "Embedded file"},
+                ],
+                "custom": True,
+            },
+            {
+                "key": "q1",
+                "title": "Extras",
+                "description": "Which extras?",
+                "type": "multiselect",
+                "options": [{"value": "Cache", "label": "Cache", "description": "Redis"}],
+                "custom": True,
+            },
+        ],
+    }
+}
+
+
+def test_v2_render_form_ask_reply_and_cancel():
+    """A form parks the turn until answered, so its ask names the form and
+    each question (never the options), and its reply or cancel gets one line —
+    the live 2.0.32 shapes: `form.created` nests the whole form, `form.replied`
+    carries `answer`, `form.cancelled` only `id` / `sessionID`."""
+    lines = _render(
+        [
+            ("form.created", _FORM_CREATED),
+            (
+                "form.replied",
+                {"id": "frm_1", "sessionID": "ses_1", "answer": {"q0": "SQLite", "q1": ["Cache"]}},
+            ),
+            ("form.created", _FORM_CREATED),
+            ("form.cancelled", {"id": "frm_1", "sessionID": "ses_1"}),
+        ]
+    )
+    ask = (
+        f'{_G}[bmad] form ask: Questions ["Database: Which database should the service '
+        f'use?", "Extras: Which extras?"]{_R}\n'
+    )
+    assert lines == [
+        ask,
+        f'{_G}[bmad] form reply: {{"q0": "SQLite", "q1": ["Cache"]}}{_R}\n',
+        ask,
+        f"{_G}[bmad] form cancelled{_R}\n",
+    ]
+    assert not any("Embedded file" in line for line in lines)
+
+
+def test_v2_render_unknown_or_malformed_form_frames_do_not_crash():
+    """Only the three pinned `form.*` types render: an unseen subtype is
+    silent, and a `form.created` whose form or fields are not the pinned shape
+    still names what it can instead of raising into the reader."""
+    lines = _render(
+        [
+            ("form.updated", {"id": "frm_1", "sessionID": "ses_1", "form": "x"}),
+            ("form.list", {}),
+            ("form.created", {"form": "not-a-dict"}),
+            ("form.created", {"form": {"title": "T", "fields": ["x", {"key": "k"}]}}),
+            ("form.replied", {"id": "frm_1"}),
+        ]
+    )
+    assert lines == [
+        f"{_G}[bmad] form ask: ?{_R}\n",
+        f'{_G}[bmad] form ask: T ["k"]{_R}\n',
+        f"{_G}[bmad] form reply:{_R}\n",
+    ]
+
+
+def test_v2_form_created_names_its_nested_session():
+    """`form.created` is the one V2 frame with no top-level `sessionID` (it
+    nests the form, session id included): the envelope reads it from there, or
+    the session filter drops the very line that explains a parked turn. Other
+    frames are not read from a nested `form`."""
+    v2 = V2Protocol()
+    frame = {"id": "evt_1", "type": "form.created", "data": _FORM_CREATED}
+    assert v2.frame_payload(frame) == (_FORM_CREATED, "ses_1")
+    assert v2.frame_payload({"type": "form.created", "data": {"form": "x"}}) == (
+        {"form": "x"},
+        None,
+    )
+    other = {"type": "form.updated", "data": {"form": {"sessionID": "ses_1"}}}
+    assert v2.frame_payload(other)[1] is None
+
+
 def test_v2_trace_skips_deltas(tmp_path):
     """V2 trace records keep V1's `{seq, type, properties, ts}` shape with the
     frame's `data` as `properties`, and skip the per-token streams (the text
diff --git a/tests/test_profile.py b/tests/test_profile.py
index 1a2ef9efb..da3122471 100644
--- a/tests/test_profile.py
+++ b/tests/test_profile.py
@@ -1,8 +1,9 @@
 import dataclasses
 import json
 import re
+import tomllib
 from importlib import resources
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 
 import pytest
 from conftest import fault_read_text
@@ -597,6 +598,14 @@ def test_permission_modes_table_parses_into_its_spec(tmp_path):
         ),
         ('\n[permission_modes.sandboxed]\nargs = "--x"\n', "args must be a list"),
         ("\n[permission_modes]\nsandboxed = 1\n", "sandboxed must be a table"),
+        (
+            _PERMISSION_MODES_TABLE + 'linked_worktree_args = "{gitdir}"\n',
+            "linked_worktree_args must be a list",
+        ),
+        (
+            _PERMISSION_MODES_TABLE + 'linked_worktree_args = ["--grant", "/fixed"]\n',
+            "must use at least one of",
+        ),
     ],
 )
 def test_malformed_permission_modes_is_a_profile_error(tmp_path, table, match):
@@ -616,6 +625,38 @@ def test_for_permission_mode_resolves_the_mode_into_bypass_args(tmp_path):
     assert sandboxed.missing_bypass_tokens(("--yes",)) == ("--sandbox", '{"a": 1}')
 
 
+def test_for_permission_mode_carries_the_linked_worktree_args(tmp_path):
+    """DW-599: the mode's grant template rides onto the resolved profile beside
+    its args; bypass (and a mode that declares none) carries none."""
+    body = MINIMAL_PROFILE + _PERMISSION_MODES_TABLE + 'linked_worktree_args = ["-g={gitdir}"]\n'
+    prof = _mode_profiles(tmp_path, body)["mycli"]
+    assert prof.permission_modes["sandboxed"].linked_worktree_args == ("-g={gitdir}",)
+    assert prof.linked_worktree_args == ()
+    assert prof.for_permission_mode("sandboxed", platform="linux").linked_worktree_args == (
+        "-g={gitdir}",
+    )
+    assert (
+        get_profile("claude").for_permission_mode("sandboxed", "linux").linked_worktree_args == ()
+    )
+
+
+def test_render_linked_worktree_args_writes_each_path_as_one_toml_string():
+    """Each placeholder becomes a TOML basic string, so a path holding a quote,
+    a backslash or a control character cannot break out of the value Codex
+    parses; one substitution pass, so a path spelling a placeholder stays put; a
+    path TOML cannot carry (a lone surrogate) raises."""
+    prof = dataclasses.replace(
+        get_profile("claude"), linked_worktree_args=("{gitdir}={common_dir}", "plain")
+    )
+    gitdir = PurePosixPath('/a"b\\c\td/{common_dir}')  # Posix: the bytes are the point
+    rendered = prof.render_linked_worktree_args(gitdir, PurePosixPath("/r"))
+    assert rendered == ('"/a\\"b\\\\c\\u0009d/{common_dir}"="/r"', "plain")
+    key = rendered[0].partition("=")[0]
+    assert tomllib.loads(f"k = {key}")["k"] == str(gitdir)
+    with pytest.raises(ValueError):
+        prof.render_linked_worktree_args(PurePosixPath("/a\udcff"), PurePosixPath("/r"))
+
+
 def test_for_permission_mode_refuses_an_excluded_platform(tmp_path):
     prof = _mode_profiles(tmp_path, MINIMAL_PROFILE + _PERMISSION_MODES_TABLE)["mycli"]
     with pytest.raises(ProfileError, match="only on linux, darwin, not win32"):
@@ -641,6 +682,10 @@ def test_shipped_sandboxed_mappings_parse_and_resolve():
     }
     codex = get_profile("codex").for_permission_mode("sandboxed", platform="darwin")
     assert codex.bypass_args[-2:] == ("--ask-for-approval", "never")
+    # DW-599: a child of the mode's permission profile with the two exact paths,
+    # selected by a `default_permissions` placed after the mode's own
+    assert codex.linked_worktree_args[-1] == 'default_permissions="bmad_loop_worktree"'
+    assert any("{gitdir}" in a and "{common_dir}" in a for a in codex.linked_worktree_args)
     assert "--dangerously-bypass-approvals-and-sandbox" not in codex.bypass_args
     for name in ("claude", "codex"):
         with pytest.raises(ProfileError, match="not win32"):
@@ -1009,6 +1054,58 @@ def test_hookless_profile_cannot_set_a_subagent_transcript_dir(tmp_path):
         load_profiles(tmp_path)
 
 
+def test_subagent_spawn_marker_defaults_off_and_agy_ships_one(tmp_path):
+    """Unset is off; the packaged agy profile names its spawn file (DW-548)."""
+    profiles_dir = tmp_path / ".bmad-loop" / "profiles"
+    profiles_dir.mkdir(parents=True)
+    (profiles_dir / "mycli.toml").write_text(MINIMAL_PROFILE)
+    profiles = load_profiles(tmp_path)
+    assert profiles["mycli"].subagent_spawn_marker is None
+    assert profiles["claude"].subagent_spawn_marker is None
+    assert (
+        profiles["antigravity"].subagent_spawn_marker
+        == ".system_generated/subagents/{session_id}.json"
+    )
+
+
+@pytest.mark.parametrize(
+    ("value", "match"),
+    [
+        # shape: never `str()`-coerced into a path template
+        ("5", "subagent_spawn_marker must be a string"),
+        # value: relative, under a conversation folder
+        ('"/abs/{session_id}.json"', "relative path"),
+        ('"../{session_id}.json"', "relative path"),
+        ('"x/../{session_id}.json"', "relative path"),
+        # value: exactly the {session_id} placeholder, so the marker names one child
+        ('"subagents/child.json"', "{session_id}"),
+        ('"{stem}.json"', "{session_id}"),
+        ('"{session_id!r}.json"', "{session_id}"),
+        ('"{session_id"', "not a valid template"),
+        ('"{session_id}\\u0000.json"', "NUL"),
+    ],
+)
+def test_malformed_subagent_spawn_marker_is_a_profile_error(tmp_path, value, match):
+    profiles_dir = tmp_path / ".bmad-loop" / "profiles"
+    profiles_dir.mkdir(parents=True)
+    (profiles_dir / "bad.toml").write_text(
+        MINIMAL_PROFILE.replace("[hooks]", f"subagent_spawn_marker = {value}\n[hooks]")
+    )
+    with pytest.raises(ProfileError, match=re.escape(match)):
+        load_profiles(tmp_path)
+
+
+def test_hookless_profile_cannot_set_a_subagent_spawn_marker(tmp_path):
+    """The marker drops a child's Stop hook, and a hookless profile has none."""
+    profiles_dir = tmp_path / ".bmad-loop" / "profiles"
+    profiles_dir.mkdir(parents=True)
+    (profiles_dir / "bad.toml").write_text(
+        HOOKLESS_PROFILE.replace("[hooks]", 'subagent_spawn_marker = "{session_id}.json"\n[hooks]')
+    )
+    with pytest.raises(ProfileError, match="must not set subagent_spawn_marker"):
+        load_profiles(tmp_path)
+
+
 def test_claude_subagent_root_matches_the_tally_anchor(tmp_path):
     """The idle notice watches the same tree tokens.tally sums for claude."""
     transcript = tmp_path / "x.jsonl"
@@ -1754,6 +1851,12 @@ def test_profile_scan_failure_degrades(profile_scan):
             {"permission_modes": {"sandboxed": PermissionModeSpec(("--x",), ("haiku",))}},
             "platforms must name",
         ),
+        # the DW-599 linked-worktree grant: per mode and on the resolved field
+        (
+            {"permission_modes": {"sandboxed": PermissionModeSpec(("--x",), (), ("--y",))}},
+            "must use at least one of",
+        ),
+        ({"linked_worktree_args": ("{gitdir}", "")}, "non-empty strings"),
         # the remaining value-level knobs
         ({"usage_parser": "magic"}, "usage_parser"),
         ({"usage_grace_s": -1.0}, "usage_grace_s"),
diff --git a/tests/test_runsetup.py b/tests/test_runsetup.py
index f71df7ede..bd3a11a63 100644
--- a/tests/test_runsetup.py
+++ b/tests/test_runsetup.py
@@ -426,6 +426,24 @@ def test_sandboxed_permission_mode_moves_the_digest_and_hashes_its_args(pinned):
     assert _digest(pinned, sandboxed) != before
 
 
+def test_linked_worktree_args_are_hashed_only_when_declared(pinned):
+    """DW-599: the grant template adds argv tokens in a linked worktree, so it is
+    pinned; a mode that declares none hashes no key (its digest is unchanged)."""
+    sandboxed = _with_adapter_key('permission_mode = "sandboxed"')
+    (pinned / PROFILE_REL).write_text(PROFILE + _SANDBOX_TABLE, encoding="utf-8")
+    without = _digest(pinned, sandboxed)
+    grant = 'linked_worktree_args = ["-g", "{gitdir}"]\n'
+    (pinned / PROFILE_REL).write_text(PROFILE + _SANDBOX_TABLE + grant, encoding="utf-8")
+    declared = _digest(pinned, sandboxed)
+    assert declared != without
+    (pinned / PROFILE_REL).write_text(
+        PROFILE + _SANDBOX_TABLE + grant.replace('"-g"', '"-G"'), encoding="utf-8"
+    )
+    assert _digest(pinned, sandboxed) not in (without, declared)
+    # bypass never resolves the mode, so the declared template is not launched
+    assert _digest(pinned, POLICY) == _PRE_PERMISSION_MODE_DIGEST
+
+
 def test_digest_raises_on_an_unmapped_permission_mode(pinned):
     """The same rule as an unknown profile: the launch refuses the mode, so the
     digest must not hash a launch surface that never runs."""
diff --git a/tests/test_signals.py b/tests/test_signals.py
index 77fab6879..d5e8ef2f6 100644
--- a/tests/test_signals.py
+++ b/tests/test_signals.py
@@ -100,6 +100,28 @@ def test_parse_event_keeps_string_payload_error_only(tmp_path, extra, expected):
     assert event.payload_error == expected
 
 
+@pytest.mark.parametrize(
+    ("extra", "expected"),
+    [
+        ({"fully_idle": True}, True),
+        ({"fully_idle": False}, False),
+        ({"fully_idle": "false"}, None),  # a non-boolean is dropped, not coerced
+        ({"fully_idle": 0}, None),  # 0 is falsy, but not False: still dropped
+        ({}, None),  # every CLI but agy (or an older relay) carries no key
+    ],
+)
+def test_parse_event_keeps_boolean_fully_idle_only(tmp_path, extra, expected):
+    """DW-548: agy's forwarded `fullyIdle` lands on the HookEvent only as a bool,
+    so the wait loop's `is False` yield test never matches a stray value.
+
+    Ablation: drop the `isinstance(fully_idle, bool)` check and the "false"/0
+    rows fail."""
+    watcher = SignalWatcher(tmp_path / "events")
+    write_event(watcher.events_dir, 1, "t1", "Stop", **extra)
+    (event,) = watcher.poll()
+    assert event.fully_idle is expected
+
+
 @pytest.mark.parametrize("value", [["A", "B"], {"id": "A"}, 3], ids=["list", "dict", "int"])
 def test_parse_event_drops_a_non_string_session_id(tmp_path, value):
     """#767: a non-string id reads as absent, so attribution never hashes it —