diff --git a/desktop/app.go b/desktop/app.go
index cd0101a1be..f4d2d34b60 100644
--- a/desktop/app.go
+++ b/desktop/app.go
@@ -6076,7 +6076,10 @@ type SkillView struct {
 	Model        string   `json:"model,omitempty"`
 	Effort       string   `json:"effort,omitempty"`
 	AllowedTools []string `json:"allowedTools,omitempty"`
-	Color        string   `json:"color,omitempty"`
+	// ReadOnly mirrors frontmatter read-only; omitted/false keeps the legacy
+	// writable default for older profiles.
+	ReadOnly bool   `json:"readOnly,omitempty"`
+	Color    string `json:"color,omitempty"`
 	// Invocation is the user-facing slash name; InvocationMode preserves the
 	// frontmatter policy used by the subagent profile editor.
 	Invocation     string `json:"invocation,omitempty"`
@@ -6456,6 +6459,7 @@ func (a *App) SkillsSettings() SkillsSettingsView {
 			Model:            s.Model,
 			Effort:           s.Effort,
 			AllowedTools:     append([]string{}, s.AllowedTools...),
+			ReadOnly:         s.ReadOnly,
 			Color:            s.Color,
 			Invocation:       "/" + s.SlashName(),
 			InvocationMode:   s.Invocation,
diff --git a/desktop/frontend/src/__tests__/settings-refresh-snapshot.test.tsx b/desktop/frontend/src/__tests__/settings-refresh-snapshot.test.tsx
index 52b46fb930..9d1372dd95 100644
--- a/desktop/frontend/src/__tests__/settings-refresh-snapshot.test.tsx
+++ b/desktop/frontend/src/__tests__/settings-refresh-snapshot.test.tsx
@@ -78,7 +78,7 @@ function baseSettings(displayMode: "standard" | "compact" = "standard"): Setting
     permissions: { mode: "ask", allow: [], ask: [], deny: [] },
     sandbox: { bash: "enforce", network: false, workspaceRoot: "", allowWrite: [], effectiveWorkspaceRoot: "/work", effectiveWriteRoots: ["/work"], shell: "auto" },
     network: { proxyMode: "auto", proxyUrl: "", noProxy: "", proxy: { type: "socks5", server: "", port: 0, username: "", password: "" } },
-    agent: { temperature: 0, maxSteps: 0, plannerMaxSteps: 0, maxSubagentDepth: 2, systemPrompt: "", coldResumePrune: true, reasoningLanguage: "auto" },
+    agent: { temperature: 0, maxSteps: 0, plannerMaxSteps: 0, maxSubagentDepth: 2, maxSubagentConcurrency: 6, maxParallelWriters: 3, systemPrompt: "", coldResumePrune: true, reasoningLanguage: "auto" },
     bot: {
       enabled: false,
       model: "",
diff --git a/desktop/frontend/src/components/SettingsPanel.tsx b/desktop/frontend/src/components/SettingsPanel.tsx
index 7a9e820452..d2f13401ff 100644
--- a/desktop/frontend/src/components/SettingsPanel.tsx
+++ b/desktop/frontend/src/components/SettingsPanel.tsx
@@ -1246,7 +1246,7 @@ function normalizeSettingsView(view: SettingsView | null | undefined): SettingsV
     noProxy: "",
     proxy: { type: "socks5", server: "", port: 0, username: "", password: "" },
   };
-  const agent = view.agent ?? { temperature: 0, maxSteps: 0, plannerMaxSteps: 0, maxSubagentDepth: 2, systemPrompt: "", coldResumePrune: true, reasoningLanguage: "auto" };
+  const agent = view.agent ?? { temperature: 0, maxSteps: 0, plannerMaxSteps: 0, maxSubagentDepth: 2, maxSubagentConcurrency: 6, maxParallelWriters: 3, systemPrompt: "", coldResumePrune: true, reasoningLanguage: "auto" };
   agent.plannerMaxSteps = Number.isFinite(agent.plannerMaxSteps) ? Math.max(0, Math.trunc(agent.plannerMaxSteps)) : 0;
   agent.maxSteps = Number.isFinite(agent.maxSteps) ? Math.max(0, Math.trunc(agent.maxSteps)) : 0;
   agent.maxSubagentDepth = Number.isFinite(agent.maxSubagentDepth) && agent.maxSubagentDepth <= 1 ? 1 : 2;
@@ -3950,8 +3950,14 @@ function ModelsSection({ s, busy, apply, backgroundApply }: ModelsSectionProps)
     : !providerIsConfigured(defaultProviderView)
       ? t("settings.modelNeedsKey", { provider: modelProviderLabel(defaultProvider, defaultProviderView, t) })
       : "";
-  const agent = s.agent ?? { temperature: 0, maxSteps: 0, plannerMaxSteps: 0, maxSubagentDepth: 2, systemPrompt: "", coldResumePrune: true, reasoningLanguage: "auto" };
+  const agent = s.agent ?? { temperature: 0, maxSteps: 0, plannerMaxSteps: 0, maxSubagentDepth: 2, maxSubagentConcurrency: 6, maxParallelWriters: 3, systemPrompt: "", coldResumePrune: true, reasoningLanguage: "auto" };
   const subagentDepth = Number.isFinite(agent.maxSubagentDepth) && agent.maxSubagentDepth <= 1 ? 1 : 2;
+  const subagentConcurrency = Number.isFinite(agent.maxSubagentConcurrency) && agent.maxSubagentConcurrency > 0
+    ? Math.max(1, Math.min(32, Math.floor(agent.maxSubagentConcurrency)))
+    : 6;
+  const parallelWriters = Number.isFinite(agent.maxParallelWriters) && agent.maxParallelWriters > 0
+    ? Math.max(1, Math.min(subagentConcurrency, Math.floor(agent.maxParallelWriters)))
+    : Math.min(3, subagentConcurrency);
 
   useEffect(() => {
     if (subtab !== "usage") return;
@@ -4077,6 +4083,38 @@ function ModelsSection({ s, busy, apply, backgroundApply }: ModelsSectionProps)
               </div>
             </SettingsField>
 
+            <SettingsField label={t("settings.subagentConcurrency")} hint={t("settings.subagentConcurrencyHint")}>
+              <input
+                className="mem-input"
+                type="number"
+                min={1}
+                max={32}
+                value={subagentConcurrency}
+                disabled={busy}
+                onChange={(e) => {
+                  const n = Number(e.target.value);
+                  if (!Number.isFinite(n)) return;
+                  void apply(() => app.SetMaxSubagentConcurrency(n));
+                }}
+              />
+            </SettingsField>
+
+            <SettingsField label={t("settings.parallelWriters")} hint={t("settings.parallelWritersHint")}>
+              <input
+                className="mem-input"
+                type="number"
+                min={1}
+                max={subagentConcurrency}
+                value={parallelWriters}
+                disabled={busy}
+                onChange={(e) => {
+                  const n = Number(e.target.value);
+                  if (!Number.isFinite(n)) return;
+                  void apply(() => app.SetMaxParallelWriters(n));
+                }}
+              />
+            </SettingsField>
+
             {modelIssue && <div className="provider-fetch-banner provider-fetch-banner--warn">{modelIssue}</div>}
           </SettingsSection>
           <SettingsSection title={t("settings.agentRuntime")} description={t("settings.agentRuntimeHint")}>
diff --git a/desktop/frontend/src/components/SubagentsPanel.tsx b/desktop/frontend/src/components/SubagentsPanel.tsx
index ae69b275e2..d743b68bbd 100644
--- a/desktop/frontend/src/components/SubagentsPanel.tsx
+++ b/desktop/frontend/src/components/SubagentsPanel.tsx
@@ -587,6 +587,7 @@ function SubagentProfileForm({
   const [selectedTools, setSelectedTools] = useState<Set<string>>(() => new Set(editingSkill?.allowedTools ?? []));
   const hasUsedCustomMode = useRef(Boolean(editingSkill?.allowedTools?.length));
   const [systemPrompt, setSystemPrompt] = useState(editingSkill?.body ?? "");
+  const [readOnly, setReadOnly] = useState(Boolean(editingSkill?.readOnly));
   const [scope, setScope] = useState<"global" | "project">(editingSkill?.scope === "project" ? "project" : "global");
   const [tryTask, setTryTask] = useState("");
   const [tryRunning, setTryRunning] = useState(false);
@@ -614,6 +615,7 @@ function SubagentProfileForm({
     model,
     effort,
     allowedTools: toolMode === "custom" ? Array.from(selectedTools) : [],
+    readOnly,
     scope,
   });
 
@@ -706,6 +708,27 @@ function SubagentProfileForm({
       {toolMode === "custom" && <ToolMultiSelect tools={tools} selected={selectedTools} onChange={setSelectedTools} />}
       {toolMode === "custom" && !toolsReady && <div className="subagents-field-error">{t("subagents.selectAtLeastOneTool")}</div>}
 
+      <label className="set-label">{t("subagents.readOnly")}</label>
+      <div className="set-seg" role="group" aria-label={t("subagents.readOnly")}>
+        <button
+          type="button"
+          className={`set-seg__btn${!readOnly ? " set-seg__btn--on" : ""}`}
+          disabled={busy}
+          onClick={() => setReadOnly(false)}
+        >
+          {t("subagents.readOnlyOff")}
+        </button>
+        <button
+          type="button"
+          className={`set-seg__btn${readOnly ? " set-seg__btn--on" : ""}`}
+          disabled={busy}
+          onClick={() => setReadOnly(true)}
+        >
+          {t("subagents.readOnlyOn")}
+        </button>
+      </div>
+      <div className="set-hint">{t("subagents.readOnlyHint")}</div>
+
       <label className="set-label">{t("subagents.systemPrompt")}</label>
       <textarea
         className="mem-textarea"
diff --git a/desktop/frontend/src/lib/bridge.ts b/desktop/frontend/src/lib/bridge.ts
index 6d8658e358..a3face4eb4 100644
--- a/desktop/frontend/src/lib/bridge.ts
+++ b/desktop/frontend/src/lib/bridge.ts
@@ -334,6 +334,8 @@ export interface AppBindings {
   SetSubagentModel(ref: string): Promise<void>;
   SetSubagentEffort(level: string): Promise<void>;
   SetMaxSubagentDepth(depth: number): Promise<void>;
+  SetMaxSubagentConcurrency(n: number): Promise<void>;
+  SetMaxParallelWriters(n: number): Promise<void>;
   SetAutoPlan(mode: string): Promise<void>;
   SetDefaultToolApprovalMode(mode: string): Promise<void>;
   SaveProvider(p: ProviderView): Promise<void>;
@@ -678,7 +680,7 @@ function bridgeBreadcrumb(method: string): string {
   if (method === "ReportCrash") return "";
   if (/^(Submit|SubmitDisplay|RunShell|Steer|Cancel|Approve|AnswerQuestion|ReplayPendingPrompts)/.test(method))
     return `turn ${method}`;
-  if (/^(SetModel|SetEffort|SetTokenMode|SetDefaultModel|SetPlannerModel|SetSubagentModel|SetSubagentEffort|SetMaxSubagentDepth)/.test(method))
+  if (/^(SetModel|SetEffort|SetTokenMode|SetDefaultModel|SetPlannerModel|SetSubagentModel|SetSubagentEffort|SetMaxSubagentDepth|SetMaxSubagentConcurrency|SetMaxParallelWriters)/.test(method))
     return `model ${method}`;
   if (/^(SetDesktop|SetCloseBehavior|SetDisplayMode|SetStatusBar|SetExpandThinking|SetAutoPlan|SetDefaultToolApprovalMode|SetReasoningLanguage)/.test(method))
     return `settings ${method}`;
@@ -1232,7 +1234,7 @@ function makeMockApp(): AppBindings {
       noProxy: "",
       proxy: { type: "socks5", server: "127.0.0.1", port: 7890, username: "", password: "" },
     },
-    agent: { temperature: 0.2, maxSteps: 0, plannerMaxSteps: 0, maxSubagentDepth: 2, systemPrompt: "You are Reasonix, a coding agent.", coldResumePrune: true, reasoningLanguage: "auto" },
+    agent: { temperature: 0.2, maxSteps: 0, plannerMaxSteps: 0, maxSubagentDepth: 2, maxSubagentConcurrency: 6, maxParallelWriters: 3, systemPrompt: "You are Reasonix, a coding agent.", coldResumePrune: true, reasoningLanguage: "auto" },
     bot: {
       enabled: !freshMock,
       model: "",
@@ -3501,6 +3503,16 @@ function makeMockApp(): AppBindings {
     async SetMaxSubagentDepth(depth: number) {
       settings.agent = { ...settings.agent, maxSubagentDepth: depth <= 1 ? 1 : 2 };
     },
+    async SetMaxSubagentConcurrency(n: number) {
+      const total = Math.max(1, Math.min(32, Math.floor(n) || 6));
+      const writers = Math.min(total, Math.max(1, settings.agent.maxParallelWriters || 3));
+      settings.agent = { ...settings.agent, maxSubagentConcurrency: total, maxParallelWriters: writers };
+    },
+    async SetMaxParallelWriters(n: number) {
+      const total = Math.max(1, Math.min(32, settings.agent.maxSubagentConcurrency || 6));
+      const writers = Math.max(1, Math.min(total, Math.floor(n) || 3));
+      settings.agent = { ...settings.agent, maxParallelWriters: writers };
+    },
     async SetAutoPlan(mode: string) {
       settings.autoPlan = mode;
     },
diff --git a/desktop/frontend/src/lib/types.ts b/desktop/frontend/src/lib/types.ts
index 7203982a1d..25faa6608c 100644
--- a/desktop/frontend/src/lib/types.ts
+++ b/desktop/frontend/src/lib/types.ts
@@ -785,6 +785,7 @@ export interface SkillView {
   model?: string;
   effort?: string;
   allowedTools?: string[];
+  readOnly?: boolean;
   color?: string;
   invocation?: string;
   invocationMode?: string;
@@ -833,6 +834,7 @@ export interface SubagentProfileInput {
   model?: string;
   effort?: string;
   allowedTools?: string[];
+  readOnly?: boolean;
   scope?: "project" | "global";
 }
 export interface PluginView {
@@ -1239,6 +1241,8 @@ export interface AgentView {
   maxSteps: number;
   plannerMaxSteps: number;
   maxSubagentDepth: number;
+  maxSubagentConcurrency: number;
+  maxParallelWriters: number;
   systemPrompt: string;
   coldResumePrune: boolean;
   reasoningLanguage: string; // "auto" | "zh" | "en"
diff --git a/desktop/frontend/src/locales/en.ts b/desktop/frontend/src/locales/en.ts
index da87120105..ef8f294bdd 100644
--- a/desktop/frontend/src/locales/en.ts
+++ b/desktop/frontend/src/locales/en.ts
@@ -1319,6 +1319,14 @@ export const en = {
   "settings.subagentDepthHint": "Controls whether a first-layer subagent may dispatch one more reviewer or worker subagent.",
   "settings.subagentDepthOne": "1 layer",
   "settings.subagentDepthTwo": "2 layers",
+  "settings.subagentConcurrency": "Subagent concurrency",
+  "settings.subagentConcurrencyHint": "Max concurrent sub-agents per session (task, fleet, profile skills). Default 6; range 1–32.",
+  "settings.parallelWriters": "Parallel writers",
+  "settings.parallelWritersHint": "Max concurrent writer sub-agents with non-overlapping write_paths. Default 3; cannot exceed total concurrency.",
+  "subagents.readOnly": "Read-only",
+  "subagents.readOnlyOn": "Read-only",
+  "subagents.readOnlyOff": "Writable",
+  "subagents.readOnlyHint": "Read-only profiles strip writer tools. Existing profiles default to writable.",
   "settings.defaultToolApprovalMode": "New session approval",
   "settings.defaultToolApprovalModeHint": "Defaults to Auto when unset. Saved globally and used only for new sessions; existing sessions keep their Ask / Auto / Yolo state.",
   "settings.defaultToolApprovalMode.ask": "Ask",
diff --git a/desktop/frontend/src/locales/zh-TW.ts b/desktop/frontend/src/locales/zh-TW.ts
index 78605bd84f..f0d6e77082 100644
--- a/desktop/frontend/src/locales/zh-TW.ts
+++ b/desktop/frontend/src/locales/zh-TW.ts
@@ -993,6 +993,14 @@ export const zhTW: Record<DictKey, string> = {
   "settings.subagentDepthHint": "控制第一層子代理能否再派發一層 reviewer 或 worker 子代理。",
   "settings.subagentDepthOne": "1 層",
   "settings.subagentDepthTwo": "2 層",
+  "settings.subagentConcurrency": "子代理並行數",
+  "settings.subagentConcurrencyHint": "每個工作階段最多同時執行的子代理數量（task / fleet / Profile Skill）。預設 6，範圍 1–32。",
+  "settings.parallelWriters": "並行寫入數",
+  "settings.parallelWritersHint": "宣告互不重疊 write_paths 時可並行的寫入子代理上限。預設 3，不得超過總並行。",
+  "subagents.readOnly": "唯讀",
+  "subagents.readOnlyOn": "唯讀",
+  "subagents.readOnlyOff": "可寫",
+  "subagents.readOnlyHint": "唯讀 Profile 會移除寫入工具。舊 Profile 預設為可寫。",
   "settings.defaultToolApprovalMode": "新會話預設審批",
   "settings.defaultToolApprovalModeHint": "未設定時預設為自動。保存在全域設定中，僅用於新建會話；已有會話會保留其詢問、自動或 Yolo 狀態。",
   "settings.defaultToolApprovalMode.ask": "詢問",
diff --git a/desktop/frontend/src/locales/zh.ts b/desktop/frontend/src/locales/zh.ts
index 79b5feb277..b74347bbc0 100644
--- a/desktop/frontend/src/locales/zh.ts
+++ b/desktop/frontend/src/locales/zh.ts
@@ -1321,6 +1321,14 @@ export const zh: Record<DictKey, string> = {
   "settings.subagentDepthHint": "控制第一层子代理能否再派发一层 reviewer 或 worker 子代理。",
   "settings.subagentDepthOne": "1 层",
   "settings.subagentDepthTwo": "2 层",
+  "settings.subagentConcurrency": "子代理并发数",
+  "settings.subagentConcurrencyHint": "每个会话最多同时运行的子代理数量（task / fleet / Profile Skill）。默认 6，范围 1–32。",
+  "settings.parallelWriters": "并行写入数",
+  "settings.parallelWritersHint": "声明了互不重叠 write_paths 时可并行的写入子代理上限。默认 3，不得超过总并发。",
+  "subagents.readOnly": "只读",
+  "subagents.readOnlyOn": "只读",
+  "subagents.readOnlyOff": "可写",
+  "subagents.readOnlyHint": "只读 Profile 会剥离写入工具。旧 Profile 缺省为可写。",
   "settings.defaultToolApprovalMode": "新会话默认审批",
   "settings.defaultToolApprovalModeHint": "未设置时默认为自动。保存在全局设置中，仅用于新建会话；已有会话会保留其询问、自动或 Yolo 状态。",
   "settings.defaultToolApprovalMode.ask": "询问",
diff --git a/desktop/settings_app.go b/desktop/settings_app.go
index 3eccdb75ba..74a67a77cf 100644
--- a/desktop/settings_app.go
+++ b/desktop/settings_app.go
@@ -128,13 +128,15 @@ type NetworkView struct {
 }
 
 type AgentView struct {
-	Temperature       float64 `json:"temperature"`
-	MaxSteps          int     `json:"maxSteps"`
-	PlannerMaxSteps   int     `json:"plannerMaxSteps"`
-	MaxSubagentDepth  int     `json:"maxSubagentDepth"`
-	SystemPrompt      string  `json:"systemPrompt"`
-	ColdResumePrune   bool    `json:"coldResumePrune"`
-	ReasoningLanguage string  `json:"reasoningLanguage"`
+	Temperature            float64 `json:"temperature"`
+	MaxSteps               int     `json:"maxSteps"`
+	PlannerMaxSteps        int     `json:"plannerMaxSteps"`
+	MaxSubagentDepth       int     `json:"maxSubagentDepth"`
+	MaxSubagentConcurrency int     `json:"maxSubagentConcurrency"`
+	MaxParallelWriters     int     `json:"maxParallelWriters"`
+	SystemPrompt           string  `json:"systemPrompt"`
+	ColdResumePrune        bool    `json:"coldResumePrune"`
+	ReasoningLanguage      string  `json:"reasoningLanguage"`
 }
 
 type BotAllowlistView struct {
@@ -802,8 +804,15 @@ func (a *App) Settings() SettingsView {
 				Ask:   []string{},
 				Deny:  []string{},
 			},
-			Sandbox:                 SandboxView{Bash: config.Default().BashMode(), AllowWrite: []string{}, EffectiveWriteRoots: []string{}, Shell: "auto", EffectiveShell: sandboxEffectiveShellView(sandbox.ResolveShell("", "", nil))},
-			Agent:                   AgentView{PlannerMaxSteps: 0, MaxSubagentDepth: agent.DefaultMaxSubagentDepth, ColdResumePrune: true, ReasoningLanguage: "auto"},
+			Sandbox: SandboxView{Bash: config.Default().BashMode(), AllowWrite: []string{}, EffectiveWriteRoots: []string{}, Shell: "auto", EffectiveShell: sandboxEffectiveShellView(sandbox.ResolveShell("", "", nil))},
+			Agent: AgentView{
+				PlannerMaxSteps:        0,
+				MaxSubagentDepth:       agent.DefaultMaxSubagentDepth,
+				MaxSubagentConcurrency: agent.DefaultMaxSubagentConcurrency,
+				MaxParallelWriters:     agent.DefaultMaxParallelWriters,
+				ColdResumePrune:        true,
+				ReasoningLanguage:      "auto",
+			},
 			Bot:                     botSettingsView(config.BotConfig{}),
 			AutoPlan:                "off",
 			DesktopLayoutStyle:      "workbench",
@@ -866,7 +875,17 @@ func (a *App) Settings() SettingsView {
 				Password: cfg.Network.Proxy.Password,
 			},
 		},
-		Agent:                   AgentView{Temperature: cfg.Agent.Temperature, MaxSteps: cfg.Agent.MaxSteps, PlannerMaxSteps: cfg.Agent.PlannerMaxSteps, MaxSubagentDepth: desktopMaxSubagentDepth(cfg.Agent.MaxSubagentDepth), SystemPrompt: cfg.Agent.SystemPrompt, ColdResumePrune: cfg.ColdResumePruneEnabled(), ReasoningLanguage: cfg.ReasoningLanguage()},
+		Agent: AgentView{
+			Temperature:            cfg.Agent.Temperature,
+			MaxSteps:               cfg.Agent.MaxSteps,
+			PlannerMaxSteps:        cfg.Agent.PlannerMaxSteps,
+			MaxSubagentDepth:       desktopMaxSubagentDepth(cfg.Agent.MaxSubagentDepth),
+			MaxSubagentConcurrency: desktopSubagentConcurrency(cfg.Agent.MaxSubagentConcurrency),
+			MaxParallelWriters:     desktopParallelWriters(cfg.Agent.MaxParallelWriters, cfg.Agent.MaxSubagentConcurrency),
+			SystemPrompt:           cfg.Agent.SystemPrompt,
+			ColdResumePrune:        cfg.ColdResumePruneEnabled(),
+			ReasoningLanguage:      cfg.ReasoningLanguage(),
+		},
 		Bot:                     botSettingsView(cfg.Bot),
 		DesktopLanguage:         cfg.DesktopLanguage(),
 		DesktopLayoutStyle:      cfg.DesktopLayoutStyle(),
@@ -1837,6 +1856,36 @@ func (a *App) SetMaxSubagentDepth(depth int) error {
 	})
 }
 
+func desktopSubagentConcurrency(n int) int {
+	total, _ := agent.NormalizeConcurrencyLimits(n, 0)
+	return total
+}
+
+func desktopParallelWriters(writers, total int) int {
+	_, w := agent.NormalizeConcurrencyLimits(total, writers)
+	return w
+}
+
+// SetMaxSubagentConcurrency sets the session-wide sub-agent concurrency cap (1–32).
+func (a *App) SetMaxSubagentConcurrency(n int) error {
+	return a.applyConfigChange(func(c *config.Config) error {
+		total, writers := agent.NormalizeConcurrencyLimits(n, c.Agent.MaxParallelWriters)
+		c.Agent.MaxSubagentConcurrency = total
+		c.Agent.MaxParallelWriters = writers
+		return nil
+	})
+}
+
+// SetMaxParallelWriters sets the concurrent writer cap (1–32, ≤ total concurrency).
+func (a *App) SetMaxParallelWriters(n int) error {
+	return a.applyConfigChange(func(c *config.Config) error {
+		total, writers := agent.NormalizeConcurrencyLimits(c.Agent.MaxSubagentConcurrency, n)
+		c.Agent.MaxSubagentConcurrency = total
+		c.Agent.MaxParallelWriters = writers
+		return nil
+	})
+}
+
 // SetAutoPlan updates the automatic plan-first workflow setting (off|on).
 func (a *App) SetAutoPlan(mode string) error {
 	if err := a.ensureLiveControllersRuntimeMutationAllowed("auto-plan"); err != nil {
diff --git a/desktop/subagents_app.go b/desktop/subagents_app.go
index 8ba4d44dbf..3ed54419f6 100644
--- a/desktop/subagents_app.go
+++ b/desktop/subagents_app.go
@@ -38,6 +38,9 @@ type SubagentProfileInput struct {
 	Model        string   `json:"model"`
 	Effort       string   `json:"effort"`
 	AllowedTools []string `json:"allowedTools"`
+	// ReadOnly, when true, writes frontmatter read-only: true. Omitted/false
+	// keeps the legacy writable default for older profiles.
+	ReadOnly bool `json:"readOnly"`
 	// Scope is "project" or "global" (empty defaults to global on create).
 	Scope string `json:"scope"`
 }
@@ -118,6 +121,7 @@ func (a *App) CreateSubagentProfile(input SubagentProfileInput) (string, error)
 		Model:        strings.TrimSpace(input.Model),
 		Effort:       strings.TrimSpace(input.Effort),
 		AllowedTools: input.AllowedTools,
+		ReadOnly:     input.ReadOnly,
 		Color:        strings.TrimSpace(input.Color),
 		Invocation:   "manual",
 	})
@@ -196,6 +200,7 @@ func (a *App) UpdateSubagentProfile(name, scope string, input SubagentProfileInp
 		Model:        strings.TrimSpace(input.Model),
 		Effort:       strings.TrimSpace(input.Effort),
 		AllowedTools: input.AllowedTools,
+		ReadOnly:     input.ReadOnly,
 		Color:        strings.TrimSpace(input.Color),
 		Invocation:   "manual",
 	})
diff --git a/desktop/subagents_app_test.go b/desktop/subagents_app_test.go
index 08c4d91ffe..337c759a71 100644
--- a/desktop/subagents_app_test.go
+++ b/desktop/subagents_app_test.go
@@ -247,30 +247,63 @@ func TestUpdateSubagentProfileRefusesNonManualSkill(t *testing.T) {
 func TestUpdateSubagentProfileRefusesUnmanagedFrontmatter(t *testing.T) {
 	a := newTestSubagentApp(t)
 	home := os.Getenv("HOME")
-	// invocation: manual but carrying read-only — dropping it on save would
-	// turn a read-only agent writable (boot.go picks the registry from it).
-	dir := filepath.Join(home, ".reasonix", "skills", "manual-readonly")
+	// invocation: manual but carrying an unmanaged routing key — dropping it
+	// on save would silently change discovery/auto-use semantics.
+	dir := filepath.Join(home, ".reasonix", "skills", "manual-rich")
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "SKILL.md"),
-		[]byte("---\ndescription: locked down\nrunAs: subagent\ninvocation: manual\nread-only: true\n---\nbody"), 0o644); err != nil {
+		[]byte("---\ndescription: locked down\nrunAs: subagent\ninvocation: manual\ntriggers: [deploy]\n---\nbody"), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	err := a.UpdateSubagentProfile("manual-readonly", "global", SubagentProfileInput{Description: "x", SystemPrompt: "y"})
+	err := a.UpdateSubagentProfile("manual-rich", "global", SubagentProfileInput{Description: "x", SystemPrompt: "y"})
 	if err == nil {
 		t.Fatal("expected refusal for unmanaged frontmatter keys")
 	}
-	if !strings.Contains(err.Error(), "read-only") {
+	if !strings.Contains(err.Error(), "triggers") {
 		t.Fatalf("error should name the unmanaged key, got: %v", err)
 	}
 	// The file must be untouched by the refused edit.
 	raw, rerr := os.ReadFile(filepath.Join(dir, "SKILL.md"))
-	if rerr != nil || !strings.Contains(string(raw), "read-only: true") {
+	if rerr != nil || !strings.Contains(string(raw), "triggers:") {
 		t.Fatalf("refused edit must not modify the file, got: %s (%v)", raw, rerr)
 	}
 }
 
+func TestUpdateSubagentProfileRoundTripsReadOnly(t *testing.T) {
+	a := newTestSubagentApp(t)
+	path, err := a.CreateSubagentProfile(SubagentProfileInput{
+		Name: "ro-agent", Description: "readonly", SystemPrompt: "stay read only",
+		ReadOnly: true, Scope: "global",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(raw), "read-only: true") {
+		t.Fatalf("create should emit read-only frontmatter, got:\n%s", raw)
+	}
+	if err := a.UpdateSubagentProfile("ro-agent", "global", SubagentProfileInput{
+		Description: "readonly v2", SystemPrompt: "still read only", ReadOnly: true,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	raw, err = os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(raw), "read-only: true") {
+		t.Fatalf("update must preserve read-only, got:\n%s", raw)
+	}
+	if !strings.Contains(string(raw), "readonly v2") {
+		t.Fatalf("update must change description, got:\n%s", raw)
+	}
+}
+
 // TestUpdateSubagentProfileRefusesManualInlineSkill pins the runAs guard: a
 // hand-authored manual-invocation INLINE skill carries only editor-managed
 // frontmatter keys, so without an explicit runAs check the update path would
@@ -370,7 +403,7 @@ func TestTrySubagentRegistryIsReadOnly(t *testing.T) {
 			t.Errorf("try registry should strip writer tool %q; got %v", writer, reg.Names())
 		}
 	}
-	for _, meta := range []string{"task", "run_skill", "install_skill", "install_source", "parallel_tasks"} {
+	for _, meta := range []string{"task", "run_skill", "install_skill", "install_source", "parallel_tasks", "fleet"} {
 		if _, ok := reg.Get(meta); ok {
 			t.Errorf("try registry should strip meta/delegation tool %q; got %v", meta, reg.Names())
 		}
diff --git a/docs/GUIDE.md b/docs/GUIDE.md
index c9385fbfe1..3e3beb005b 100644
--- a/docs/GUIDE.md
+++ b/docs/GUIDE.md
@@ -65,6 +65,8 @@ reasoning_language = "auto"      # visible reasoning text: auto|zh|en
 # subagent_model = "deepseek-pro"     # optional default for runAs=subagent skills
 # subagent_models = { review = "deepseek-pro", security_review = "deepseek-pro" }
 # max_subagent_depth = 2              # nested delegation depth; set 1 for the old single-layer boundary
+# max_subagent_concurrency = 6        # session-wide sub-agent concurrency (task/fleet/skills)
+# max_parallel_writers = 3            # concurrent writers with non-overlapping write_paths
 auto_plan = "off"                  # user-level only; off|on; off keeps plan mode manual
 # auto_plan_classifier = "deepseek-flash"   # optional; only borderline tasks call it
 tool_result_snip_ratio = 0.6       # shorten stale tool output before summary compaction
@@ -911,6 +913,7 @@ the strict read-only entrances:
 | --- | --- |
 | `read_only_task` | Isolated read-only research child from the main session |
 | `parallel_tasks` (read-only) | Concurrent read-only research children |
+| `fleet` with `read_only: true` | Parallel profile-aware batch (forced read-only per item) |
 | `read_only_skill` | The same isolation driving an existing skill |
 | `reasonix review` (CLI) | Read-only review of a diff or branch |
 | Desktop preview/review subagents | Read-only desktop analysis surfaces |
diff --git a/docs/GUIDE.zh-CN.md b/docs/GUIDE.zh-CN.md
index 514c51e35a..b076092312 100644
--- a/docs/GUIDE.zh-CN.md
+++ b/docs/GUIDE.zh-CN.md
@@ -59,6 +59,8 @@ reasoning_language = "auto"      # 可见思考过程语言：auto|zh|en
 # subagent_model = "deepseek-pro"     # runAs=subagent skill 的默认模型
 # subagent_models = { review = "deepseek-pro", security_review = "deepseek-pro" }
 # max_subagent_depth = 2              # 子代理嵌套委派深度；设为 1 可恢复旧的单层边界
+# max_subagent_concurrency = 6        # 会话级子代理总并发（task/fleet/skills）
+# max_parallel_writers = 3            # 互不重叠 write_paths 时的并行写入上限
 auto_plan = "off"                  # 仅用户级生效；off|on；off 表示计划模式仅手动开启
 # auto_plan_classifier = "deepseek-flash"   # 可选；只在边界任务上调用
 tool_result_snip_ratio = 0.6       # 在摘要 compaction 前先缩短旧工具输出
@@ -718,6 +720,7 @@ source 也可在 Plan 中加载，后续 writer 调用仍通过 Permissions/Sand
 | --- | --- |
 | `read_only_task` | 主会话派生的隔离只读调研子会话 |
 | `parallel_tasks`（只读） | 并发只读调研子会话 |
+| `fleet` 且 `read_only: true` | 可带 Profile 的并行批量（单项强制只读） |
 | `read_only_skill` | 以既有 skill 驱动的同等隔离 |
 | `reasonix review`（CLI） | 只读评审 diff 或分支 |
 | 桌面端 preview/review 子代理 | 桌面端只读分析面 |
diff --git a/docs/SPEC.md b/docs/SPEC.md
index 5e16612f57..fbb82dc9d3 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -514,10 +514,19 @@ refused so an editor cannot silently flatten or discard rich Skill content.
 Built-in profiles support configuration overrides but have no writable file.
 
 Effective model and effort precedence is: per-profile
-`agent.subagent_models` / `agent.subagent_efforts`, profile frontmatter,
-`agent.subagent_model` / `agent.subagent_effort`, then executor/default model
-configuration. See [Subagent profiles](./SUBAGENT_PROFILES.md) for the user-facing
-command and file-format contract.
+`agent.subagent_models` / `agent.subagent_efforts`, this call's `model` /
+`effort` on `task`/`fleet`, profile frontmatter, `agent.subagent_model` /
+`agent.subagent_effort`, then executor/default model configuration.
+
+`task` accepts optional `profile` and `write_paths`. `fleet` dispatches 2–64
+profile-aware tasks under a session scheduler
+(`agent.max_subagent_concurrency`, default 6; `agent.max_parallel_writers`,
+default 3). Profile names are resolved at runtime from the Skill store and
+must never enter tool schemas or the parent system prompt. Custom and named
+built-in profile bodies are the full child system prompt (no implicit
+concise default). `parallel_tasks` remains the compatible read-only batch
+API on the same scheduler. See [Subagent profiles](./SUBAGENT_PROFILES.md)
+for the user-facing command and file-format contract.
 
 ## 4. Data Types (`internal/provider`)
 
diff --git a/docs/SUBAGENT_PROFILES.md b/docs/SUBAGENT_PROFILES.md
index 3b2887cc43..d53fbd8571 100644
--- a/docs/SUBAGENT_PROFILES.md
+++ b/docs/SUBAGENT_PROFILES.md
@@ -51,6 +51,29 @@ This is a real isolated subagent run, not prompt text inserted into the parent
 agent. The parent conversation retains the task and the child's final answer,
 not the child's full working context.
 
+The parent model can also select a profile at call time without listing profile
+names in the tool schema (prompt-cache stability):
+
+```text
+task(profile="doc-rewriter", prompt="rewrite docs/01.md", write_paths=["docs/01.md"])
+fleet(tasks=[
+  {profile="doc-rewriter", prompt="rewrite docs/01.md", write_paths=["docs/01.md"]},
+  {profile="doc-rewriter", prompt="rewrite docs/02.md", write_paths=["docs/02.md"]}
+])
+```
+
+- `profile` on `task` / `fleet` items resolves a `runAs: subagent` Skill by name
+  (explicit names may call `invocation: manual` profiles).
+- The profile body becomes the **full** child system prompt — no implicit
+  concise default is stacked on top.
+- `write_paths` declares non-overlapping write targets so parallel writers can
+  share one workspace. Writer tasks that omit `write_paths` claim the whole
+  workspace (serializing against every other writer claim). In `fleet`,
+  multiple whole-workspace claims or any path overlap fail preflight and start
+  nothing.
+- Session defaults: `agent.max_subagent_concurrency = 6`,
+  `agent.max_parallel_writers = 3` (both configurable 1–32; writers ≤ total).
+
 For scripts and other headless use, choose an explicit command:
 
 ```bash
@@ -113,6 +136,7 @@ invocation: manual
 runAs: subagent
 model: deepseek-pro
 effort: high
+read-only: true
 allowed-tools: [read_file, grep, bash]
 ---
 You are a focused code reviewer. Inspect the requested changes and return only
@@ -121,7 +145,9 @@ actionable findings, ordered by severity.
 
 `invocation: manual` prevents automatic discovery in the model's pinned Skill
 index; users can still invoke the profile explicitly. `allowed-tools` is a
-profile-level allowlist, not a way to bypass permissions.
+profile-level allowlist, not a way to bypass permissions. `read-only: true`
+forces the read-only tool registry (writer tools stripped); omitted/`false`
+keeps the legacy writable default.
 
 You may hand-author richer `runAs: subagent` Skills, including custom Skill
 paths and extra frontmatter. They can be listed and invoked, but the profile
@@ -142,9 +168,10 @@ lowest priority:
 
 1. per-profile entries in `agent.subagent_models` and
    `agent.subagent_efforts`;
-2. the profile's `model` and `effort` frontmatter;
-3. `agent.subagent_model` and `agent.subagent_effort` defaults;
-4. the configured executor/default model and its default effort.
+2. this call's `model` / `effort` arguments on `task` or `fleet`;
+3. the profile's `model` and `effort` frontmatter;
+4. `agent.subagent_model` and `agent.subagent_effort` defaults;
+5. the configured executor/default model and its default effort.
 
 For example:
 
diff --git a/docs/SUBAGENT_PROFILES.zh-CN.md b/docs/SUBAGENT_PROFILES.zh-CN.md
index 06767b9542..901d932a07 100644
--- a/docs/SUBAGENT_PROFILES.zh-CN.md
+++ b/docs/SUBAGENT_PROFILES.zh-CN.md
@@ -46,6 +46,26 @@ printf '%s\n' '检查任务，只报告可执行的问题。' | \
 这会真正启动隔离子智能体，并非把提示词文本注入父智能体。父会话只保留任务和子智能体的
 最终答案，不保留子智能体的完整工作上下文。
 
+父模型也可以在调用时选择 Profile，且不会把 Profile 名称列表写进工具 schema（保持
+prompt-cache 稳定）：
+
+```text
+task(profile="doc-rewriter", prompt="重写 docs/01.md", write_paths=["docs/01.md"])
+fleet(tasks=[
+  {profile="doc-rewriter", prompt="重写 docs/01.md", write_paths=["docs/01.md"]},
+  {profile="doc-rewriter", prompt="重写 docs/02.md", write_paths=["docs/02.md"]}
+])
+```
+
+- `task` / `fleet` 项上的 `profile` 按名称解析 `runAs: subagent` Skill（显式名称可调用
+  `invocation: manual` Profile）。
+- Profile 正文成为子智能体的**完整**系统提示词，不再隐式叠加 concise 默认提示。
+- `write_paths` 声明互不重叠的写入目标，使多个写入子智能体可共享同一工作区并行。
+  写入任务若省略 `write_paths`，则声明整个工作区（与其他写入 claim 互斥）。
+  在 `fleet` 中，多个整工作区 claim 或任何路径重叠会在预检阶段整批失败，不会启动任何任务。
+- 会话默认：`agent.max_subagent_concurrency = 6`、`agent.max_parallel_writers = 3`
+  （均可配置为 1–32，且写入上限不得超过总上限）。
+
 脚本和其他 Headless 场景应使用显式命令：
 
 ```bash
@@ -103,13 +123,15 @@ invocation: manual
 runAs: subagent
 model: deepseek-pro
 effort: high
+read-only: true
 allowed-tools: [read_file, grep, bash]
 ---
 你是专注的代码评审员。检查指定改动，只返回可执行的问题，并按严重程度排序。
 ```
 
 `invocation: manual` 表示模型不会从固定 Skill 索引中自动发现该 Profile，但用户仍可显式
-调用。`allowed-tools` 是 Profile 级工具白名单，不能绕过权限系统。
+调用。`allowed-tools` 是 Profile 级工具白名单，不能绕过权限系统。`read-only: true`
+强制使用只读工具 registry（剥离写入工具）；省略/`false` 保持旧版默认可写。
 
 也可以手写更丰富的 `runAs: subagent` Skill，例如使用自定义 Skill path 或额外 frontmatter。
 这些 Profile 可以被列出和调用，但 Profile 编辑器会拒绝编辑或删除以下内容：
@@ -126,9 +148,10 @@ allowed-tools: [read_file, grep, bash]
 有效模型和推理强度按以下优先级选择：
 
 1. `agent.subagent_models` 和 `agent.subagent_efforts` 中按 Profile 设置的覆盖；
-2. Profile frontmatter 中的 `model` 和 `effort`；
-3. `agent.subagent_model` 和 `agent.subagent_effort` 默认值；
-4. 已配置的 executor/默认模型及其默认推理强度。
+2. 本次 `task` / `fleet` 调用参数中的 `model` / `effort`；
+3. Profile frontmatter 中的 `model` 和 `effort`；
+4. `agent.subagent_model` 和 `agent.subagent_effort` 默认值；
+5. 已配置的 executor/默认模型及其默认推理强度。
 
 例如：
 
diff --git a/docs/TOOL_CONTRACT.md b/docs/TOOL_CONTRACT.md
index c19c14d9eb..4ba4c39f9f 100644
--- a/docs/TOOL_CONTRACT.md
+++ b/docs/TOOL_CONTRACT.md
@@ -68,7 +68,7 @@ dedicated `mcp_connect__<server>` identity, so an exact rule such as
 approval and returns the live tool directory. MCP tool rules remain exact;
 `mcp__github__*` is not a tool-name glob.
 
-`ask`, `explore`, `forget`, `history`, `install_skill`, `install_source`,
+`ask`, `explore`, `fleet`, `forget`, `history`, `install_skill`, `install_source`,
 `list_sessions`, `lsp_definition`, `lsp_diagnostics`, `lsp_hover`,
 `lsp_references`, `memory`, `parallel_tasks`, `read_only_skill`,
 `read_only_task`, `read_session`, `read_skill`, `remember`, `research`,
diff --git a/docs/TOOL_CONTRACT.zh-CN.md b/docs/TOOL_CONTRACT.zh-CN.md
index 8433fe0db8..240a47d9e5 100644
--- a/docs/TOOL_CONTRACT.zh-CN.md
+++ b/docs/TOOL_CONTRACT.zh-CN.md
@@ -57,7 +57,7 @@ read/diff 证据。
 会在进程启动前拦截），放行后连接并返回实时工具目录。MCP 工具名规则仍为精确匹配，
 `mcp__github__*` 不是工具名通配规则。
 
-`ask`, `explore`, `forget`, `history`, `install_skill`, `install_source`,
+`ask`, `explore`, `fleet`, `forget`, `history`, `install_skill`, `install_source`,
 `list_sessions`, `lsp_definition`, `lsp_diagnostics`, `lsp_hover`,
 `lsp_references`, `memory`, `parallel_tasks`, `read_only_skill`,
 `read_only_task`, `read_session`, `read_skill`, `remember`, `research`,
diff --git a/internal/agent/agent.go b/internal/agent/agent.go
index 4230ece57f..9c598b690e 100644
--- a/internal/agent/agent.go
+++ b/internal/agent/agent.go
@@ -352,6 +352,15 @@ type Agent struct {
 	// reach it. nil leaves those tools to degrade gracefully.
 	jobs *jobs.Manager
 
+	// writeScheduler coordinates parent-agent writes against background
+	// subagent write claims. Set on the parent executor only (subagentDepth 0);
+	// reservation is taken around Execute so late-loaded MCP/Economy tools are
+	// covered without registry wrapping. Provider-visible schemas are unchanged.
+	writeScheduler *SubagentScheduler
+	// writeWorkspaceRoot is the workspace used to normalize parent write
+	// reservations when writeScheduler is set.
+	writeWorkspaceRoot string
+
 	// workspaceLease is shared by every writer-capable agent in one Delivery
 	// session. It is acquired lazily on the first mutation and held through the
 	// final participating run/background job so verification remains isolated.
@@ -846,6 +855,14 @@ type Options struct {
 	// Jobs is the session's background-job manager (nil disables background tools).
 	Jobs *jobs.Manager
 
+	// WriteScheduler is the session-scoped subagent concurrency/write-claim
+	// controller. When set on the parent executor, write-capable tools reserve
+	// paths for the duration of Execute so background writers cannot TOCTOU
+	// race parent writes. Subagents leave this nil (or depth > 0 skips it).
+	WriteScheduler *SubagentScheduler
+	// WriteWorkspaceRoot normalizes parent write reservations.
+	WriteWorkspaceRoot string
+
 	// WorkspaceLease serializes Delivery mutations across sessions that target
 	// the same workspace. nil preserves source compatibility for direct Agent
 	// construction; boot always supplies it for Delivery sessions.
@@ -976,6 +993,8 @@ func New(prov provider.Provider, tools *tool.Registry, session *Session, opts Op
 		configWriteApprover:   configWriteApprover,
 		hooks:                 hooks,
 		jobs:                  opts.Jobs,
+		writeScheduler:        opts.WriteScheduler,
+		writeWorkspaceRoot:    strings.TrimSpace(opts.WriteWorkspaceRoot),
 		workspaceLease:        opts.WorkspaceLease,
 		evidence:              evidence.NewLedger(),
 		projectChecks:         append([]instruction.VerifyCheck(nil), opts.ProjectChecks...),
@@ -1007,6 +1026,25 @@ func usageSourceOrDefault(source, fallback string) string {
 	return fallback
 }
 
+// reserveParentWrite holds write claims for the duration of a parent-agent
+// write tool call. Returns a no-op release when reservation is not needed
+// (subagent, read-only, no scheduler, or non-write tool).
+func (a *Agent) reserveParentWrite(runTool tool.Tool, args json.RawMessage, readOnly bool) (release func(), err error) {
+	noop := func() {}
+	if a == nil || a.writeScheduler == nil || a.subagentDepth > 0 || readOnly || runTool == nil {
+		return noop, nil
+	}
+	name := runTool.Name()
+	if !parentWriteGuardTarget(name) {
+		return noop, nil
+	}
+	claim, err := parentWriteReservation(a.writeWorkspaceRoot, name, args)
+	if err != nil {
+		return noop, err
+	}
+	return a.writeScheduler.ReserveParentWrite(claim)
+}
+
 // Run appends the user input and drives the tool loop until the model returns a
 // final answer (no tool calls), the context is cancelled, or the provider errors.
 // With maxSteps <= 0 the loop is unbounded — the natural termination is the model
@@ -3046,6 +3084,31 @@ func (a *Agent) executeOne(ctx context.Context, call provider.ToolCall) toolOutc
 			}
 		}
 	}
+	// Resolve the concrete execution target before hooks. A proxy may carry a
+	// different target/name/argument set than the provider-visible call.
+	runTool := execTool
+	runArgs := execArgs
+	if resolved.Target != nil {
+		runTool = resolved.Target
+		runArgs = resolved.Args
+		if len(runArgs) == 0 {
+			runArgs = json.RawMessage(`{}`)
+		}
+	}
+	// Hold the parent claim before PreToolUse: hooks are user shell code and may
+	// mutate the same workspace. The reservation remains live through hooks,
+	// checkpointing, and the concrete Execute call, closing both hook-side and
+	// check-before-write TOCTOU windows. Dynamic Economy/MCP tools are covered
+	// here after registry lookup without schema-changing wrappers.
+	if releaseParentWrite, perr := a.reserveParentWrite(runTool, runArgs, readOnly); perr != nil {
+		return toolOutcome{
+			output:  "blocked: " + perr.Error(),
+			blocked: true,
+			errMsg:  "blocked: write path claimed by background subagent",
+		}
+	} else if releaseParentWrite != nil {
+		defer releaseParentWrite()
+	}
 	// PreToolUse hooks run after permission is granted but before the call: a
 	// gating hook (exit 2) refuses it, surfaced to the model like a gate denial.
 	// Proxy tools fire hooks against the real MCP target name and arguments.
@@ -3116,17 +3179,6 @@ func (a *Agent) executeOne(ctx context.Context, call provider.ToolCall) toolOutc
 	var result string
 	var images []string
 	var err error
-	// When a proxy resolved a concrete target, execute that target (not the
-	// proxy again) so permission-approved args and evidence stay aligned.
-	runTool := execTool
-	runArgs := execArgs
-	if resolved.Target != nil {
-		runTool = resolved.Target
-		runArgs = resolved.Args
-		if len(runArgs) == 0 {
-			runArgs = json.RawMessage(`{}`)
-		}
-	}
 	// A call that was authorized under reader classification carries that
 	// basis into dispatch: the MCP execution layer re-verifies it linearizably
 	// against live trust state and refuses to promote it into a writer lane if
diff --git a/internal/agent/fleet.go b/internal/agent/fleet.go
new file mode 100644
index 0000000000..08fa74f453
--- /dev/null
+++ b/internal/agent/fleet.go
@@ -0,0 +1,345 @@
+package agent
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+
+	"reasonix/internal/event"
+	"reasonix/internal/evidence"
+	"reasonix/internal/jobs"
+)
+
+const (
+	fleetMinTasks = 2
+	fleetMaxTasks = 64
+)
+
+// FleetTool dispatches multiple profile-aware sub-agent tasks in parallel
+// under the session scheduler. Write tasks must predeclare non-overlapping
+// write_paths; preflight failure starts nothing.
+type FleetTool struct {
+	taskTool *TaskTool
+}
+
+// NewFleetTool creates a fleet dispatcher that reuses TaskTool infrastructure.
+func NewFleetTool(taskTool *TaskTool) *FleetTool {
+	return &FleetTool{taskTool: taskTool}
+}
+
+func (*FleetTool) Name() string { return "fleet" }
+
+func (*FleetTool) Description() string {
+	return "Dispatch 2–64 sub-agent tasks in parallel and aggregate results. Each item may select a profile, model, effort, tools, write_paths, or read_only. Multiple writers must declare non-overlapping write_paths; omitted write_paths claim the whole workspace, so two or more writers without paths fail preflight before any task starts. Independent failure is the default: one failure does not cancel others. Background mode returns a fleet job id collectable with wait."
+}
+
+func (*FleetTool) Schema() json.RawMessage {
+	return json.RawMessage(`{
+"type":"object",
+"properties":{
+  "tasks":{
+    "type":"array",
+    "description":"Array of 2–64 sub-tasks to run under the session scheduler.",
+    "minItems":2,
+    "maxItems":64,
+    "items":{
+      "type":"object",
+      "properties":{
+        "prompt":{"type":"string","description":"Task prompt for the sub-agent."},
+        "description":{"type":"string","description":"Optional short label shown in the job list."},
+        "profile":{"type":"string","description":"Optional runAs=subagent profile name."},
+        "write_paths":{"type":"array","items":{"type":"string"},"description":"Write targets for this item. Parallel writers must declare non-overlapping paths. Omitting write_paths claims the whole workspace; multiple whole-workspace claims (or any path overlap) fail preflight and start nothing."},
+        "read_only":{"type":"boolean","description":"Force the read-only registry even if the profile is writable."},
+        "tools":{"type":"array","items":{"type":"string"},"description":"Optional tool whitelist (intersected with profile allowed-tools)."},
+        "max_steps":{"type":"integer","description":"Optional max tool-call rounds.","minimum":1},
+        "model":{"type":"string","description":"Optional model override."},
+        "effort":{"type":"string","description":"Optional reasoning effort override."}
+      },
+      "required":["prompt"]
+    }
+  },
+  "run_in_background":{"type":"boolean","description":"Run the whole fleet asynchronously and return a job id collectable with wait. Items queue for concurrency/write slots inside the job."}
+},
+"required":["tasks"]
+}`)
+}
+
+func (*FleetTool) ReadOnly() bool { return false }
+
+type fleetTaskItem struct {
+	Prompt      string   `json:"prompt"`
+	Description string   `json:"description"`
+	Profile     string   `json:"profile"`
+	WritePaths  []string `json:"write_paths"`
+	ReadOnly    bool     `json:"read_only"`
+	Tools       []string `json:"tools"`
+	MaxSteps    int      `json:"max_steps"`
+	Model       string   `json:"model"`
+	Effort      string   `json:"effort"`
+}
+
+type fleetItemStatus string
+
+const (
+	fleetItemPending   fleetItemStatus = "pending"
+	fleetItemCompleted fleetItemStatus = "completed"
+	fleetItemFailed    fleetItemStatus = "failed"
+	fleetItemCancelled fleetItemStatus = "cancelled"
+	fleetItemSkipped   fleetItemStatus = "skipped"
+)
+
+type fleetItemResult struct {
+	index   int
+	status  fleetItemStatus
+	profile string
+	output  string
+	err     error
+	ref     string
+}
+
+func (f *FleetTool) Execute(ctx context.Context, args json.RawMessage) (string, error) {
+	if f == nil || f.taskTool == nil {
+		return "", fmt.Errorf("fleet is not configured")
+	}
+	var params struct {
+		Tasks           []fleetTaskItem `json:"tasks"`
+		RunInBackground bool            `json:"run_in_background"`
+	}
+	dec := json.NewDecoder(bytes.NewReader(args))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&params); err != nil {
+		return "", fmt.Errorf("invalid args: %w", err)
+	}
+	if n := len(params.Tasks); n < fleetMinTasks || n > fleetMaxTasks {
+		return "", fmt.Errorf("fleet requires between %d and %d tasks (got %d)", fleetMinTasks, fleetMaxTasks, n)
+	}
+
+	specs := make([]ProfileExecSpec, len(params.Tasks))
+	// Keep one claim slot per original task so preflight errors report the
+	// caller-visible task numbers even when read-only items are interleaved.
+	claims := make([]WritePathSet, len(params.Tasks))
+	for i, item := range params.Tasks {
+		if strings.TrimSpace(item.Prompt) == "" {
+			return "", fmt.Errorf("task %d: prompt is required", i+1)
+		}
+		// Fleet writers without write_paths claim the whole workspace so the
+		// preflight can detect multi-writer collisions before anything starts.
+		forceBackgroundClaim := !item.ReadOnly
+		spec, err := f.taskTool.buildTaskSpec(ctx, item.Prompt, item.Description, item.Profile, item.WritePaths, item.Tools, item.MaxSteps, item.Model, item.Effort, "", "", false, item.ReadOnly)
+		if err != nil {
+			return "", fmt.Errorf("task %d: %w", i+1, err)
+		}
+		if forceBackgroundClaim && !spec.ReadOnly && spec.WritePaths.Empty() {
+			whole, werr := WholeWorkspaceWriteClaim(f.taskTool.workspaceRoot)
+			if werr != nil {
+				return "", fmt.Errorf("task %d: %w", i+1, werr)
+			}
+			spec.WritePaths = whole
+		}
+		spec.Nested = SubagentDepth(ctx) > 0
+		spec.RunInBackground = false // fleet owns backgrounding
+		if spec.Description == "" {
+			spec.Description = fmt.Sprintf("fleet-%d", i+1)
+		}
+		specs[i] = spec
+		if !spec.ReadOnly {
+			claims[i] = spec.WritePaths
+		}
+	}
+	if err := ValidateNonOverlappingWriteClaims(claims); err != nil {
+		return "", fmt.Errorf("fleet preflight: %w", err)
+	}
+
+	if params.RunInBackground {
+		jm, ok := jobs.FromContext(ctx)
+		if !ok {
+			return "", fmt.Errorf("background execution is not available in this context")
+		}
+		parentID, parent, _, _ := CallContext(ctx)
+		nested := subSinkFor(parentID, parent)
+		parentSession := ParentSession(ctx)
+		label := fmt.Sprintf("fleet(%d)", len(specs))
+		backgroundEvidence := evidence.NewLedger()
+		job := jm.StartForSession(jobs.SessionFromContext(ctx), "fleet", label, func(jobCtx context.Context, _ io.Writer) (string, error) {
+			jobCtx = WithParentSession(jobCtx, parentSession)
+			jobCtx = evidence.WithLedger(jobCtx, backgroundEvidence)
+			defer func() { jobs.PublishEvidence(jobCtx, backgroundEvidence.Summary()) }()
+			return f.runFleet(jobCtx, nested, specs)
+		})
+		return fmt.Sprintf("Started background fleet %q (%s). Collect results with wait; you will be notified when it finishes.", job.ID, label), nil
+	}
+
+	return f.runFleet(ctx, subSink(ctx), specs)
+}
+
+func (f *FleetTool) runFleet(ctx context.Context, sink event.Sink, specs []ProfileExecSpec) (string, error) {
+	if sink == nil {
+		sink = event.Discard
+	}
+	parentID, _, _, ok := CallContext(ctx)
+	if !ok {
+		parentID = "fleet"
+	}
+
+	n := len(specs)
+	results := make([]fleetItemResult, n)
+	for i := range results {
+		results[i] = fleetItemResult{index: i, status: fleetItemPending, profile: specs[i].Profile}
+	}
+
+	var wg sync.WaitGroup
+	doneCh := make(chan fleetItemResult, n)
+
+	startOne := func(idx int) {
+		spec := specs[idx]
+		label := spec.Description
+		subID := fmt.Sprintf("%s/fleet-%d", parentID, idx+1)
+		dispatchArgs, _ := json.Marshal(map[string]any{
+			"prompt":      spec.Prompt,
+			"description": label,
+			"profile":     spec.Profile,
+		})
+		sink.Emit(event.Event{
+			Kind: event.ToolDispatch,
+			Tool: event.Tool{
+				ID: subID, ParentID: parentID, Name: "task",
+				Args: string(dispatchArgs), ReadOnly: spec.ReadOnly,
+			},
+		})
+
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			// Each fleet item runs as its own task-shaped execution so
+			// transcripts, evidence, and scheduler claims stay independent.
+			itemCtx := withCallContext(ctx, subID, subSinkFor(subID, sink), nil, false)
+			out, err := f.taskTool.RunProfileSpec(itemCtx, spec)
+			res := fleetItemResult{index: idx, profile: spec.Profile, output: out, err: err}
+			if err == nil {
+				res.status = fleetItemCompleted
+				res.ref = extractSubagentRef(out)
+				sink.Emit(event.Event{
+					Kind: event.ToolResult,
+					Tool: event.Tool{ID: subID, ParentID: parentID, Name: "task", Output: out},
+				})
+			} else {
+				if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+					res.status = fleetItemCancelled
+				} else {
+					res.status = fleetItemFailed
+				}
+				sink.Emit(event.Event{
+					Kind: event.ToolResult,
+					Tool: event.Tool{ID: subID, ParentID: parentID, Name: "task", Err: err.Error()},
+				})
+			}
+			doneCh <- res
+		}()
+	}
+
+	// Mark only genuinely unstarted items skipped. Started items always publish
+	// a terminal result, including after cancellation, so partial writer work is
+	// never misreported as a task that did not run.
+	started := 0
+	for i := range specs {
+		if ctx.Err() != nil {
+			for j := i; j < n; j++ {
+				results[j].status = fleetItemSkipped
+				results[j].err = ctx.Err()
+			}
+			break
+		}
+		startOne(i)
+		started++
+	}
+
+	completed := 0
+	cancelled := false
+	for completed < started && !cancelled {
+		select {
+		case r := <-doneCh:
+			results[r.index] = r
+			completed++
+		case <-ctx.Done():
+			cancelled = true
+		}
+	}
+	// doneCh is buffered for every item, so workers can always publish their
+	// terminal result while this goroutine waits. Once they stop, drain exactly
+	// the outstanding started items and preserve their real completed/cancelled
+	// status instead of replacing it with skipped.
+	wg.Wait()
+	for completed < started {
+		r := <-doneCh
+		results[r.index] = r
+		completed++
+	}
+	for _, r := range results {
+		if r.status == fleetItemCancelled || r.status == fleetItemSkipped {
+			cancelled = true
+			break
+		}
+	}
+	if cancelled {
+		err := ctx.Err()
+		if err == nil {
+			err = context.Canceled
+		}
+		return formatFleetAggregate(results, true), err
+	}
+	return formatFleetAggregate(results, false), nil
+}
+
+func formatFleetAggregate(results []fleetItemResult, cancelled bool) string {
+	n := len(results)
+	var b strings.Builder
+	if cancelled {
+		completed := 0
+		for _, r := range results {
+			if r.status == fleetItemCompleted {
+				completed++
+			}
+		}
+		fmt.Fprintf(&b, "Cancelled fleet after completing %d of %d tasks:\n", completed, n)
+	} else {
+		fmt.Fprintf(&b, "Completed fleet of %d tasks:\n", n)
+	}
+	for i, r := range results {
+		fmt.Fprintf(&b, "── task-%d", i+1)
+		if r.profile != "" {
+			fmt.Fprintf(&b, " profile=%s", r.profile)
+		}
+		b.WriteString(" ──\n")
+		switch r.status {
+		case fleetItemCompleted:
+			fmt.Fprintf(&b, "status: completed\n%s\n", strings.TrimSpace(r.output))
+			if r.ref != "" {
+				fmt.Fprintf(&b, "Subagent reference: %s\n", r.ref)
+			}
+		case fleetItemFailed:
+			fmt.Fprintf(&b, "status: failed\n[FAILED] %v\n", r.err)
+		case fleetItemCancelled:
+			fmt.Fprintf(&b, "status: cancelled\n[CANCELLED] %v\n", r.err)
+		case fleetItemSkipped:
+			fmt.Fprintf(&b, "status: skipped\n[SKIPPED] %v\n", r.err)
+		default:
+			fmt.Fprintf(&b, "status: pending\n")
+		}
+	}
+	return b.String()
+}
+
+func extractSubagentRef(output string) string {
+	const prefix = "Subagent reference: "
+	for _, line := range strings.Split(output, "\n") {
+		if strings.HasPrefix(line, prefix) {
+			return strings.TrimSpace(strings.TrimPrefix(line, prefix))
+		}
+	}
+	return ""
+}
diff --git a/internal/agent/fleet_test.go b/internal/agent/fleet_test.go
new file mode 100644
index 0000000000..d622f524dc
--- /dev/null
+++ b/internal/agent/fleet_test.go
@@ -0,0 +1,225 @@
+package agent
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"reasonix/internal/event"
+	"reasonix/internal/provider"
+	"reasonix/internal/tool"
+)
+
+func TestFleetSchemaStableAndBounds(t *testing.T) {
+	f := NewFleetTool(&TaskTool{})
+	schema := string(f.Schema())
+	for _, want := range []string{`"profile"`, `"write_paths"`, `"read_only"`, `"run_in_background"`} {
+		if !strings.Contains(schema, want) {
+			t.Fatalf("schema missing %s: %s", want, schema)
+		}
+	}
+	// Profile names must not be enumerated in schema (cache stability).
+	if strings.Contains(schema, "doc-rewriter") || strings.Contains(schema, "enum") {
+		t.Fatalf("schema must not embed profile names: %s", schema)
+	}
+	if f.Name() != "fleet" {
+		t.Fatalf("name = %q", f.Name())
+	}
+}
+
+func TestFleetRejectsSingleTaskAndPathConflict(t *testing.T) {
+	root := t.TempDir()
+	task := newTestTaskTool(t, &mockProvider{name: "sub"}, tool.NewRegistry(), "sys", "", "", nil).
+		WithTranscripts(mustSubagentStore(t), root, "base", "high").
+		WithScheduler(NewSubagentScheduler(6, 3))
+	f := NewFleetTool(task)
+
+	_, err := f.Execute(context.Background(), json.RawMessage(`{"tasks":[{"prompt":"only one"}]}`))
+	if err == nil || !strings.Contains(err.Error(), "between") {
+		t.Fatalf("single task error = %v", err)
+	}
+
+	args, _ := json.Marshal(map[string]any{
+		"tasks": []map[string]any{
+			{"prompt": "a", "write_paths": []string{"same.md"}},
+			{"prompt": "b", "write_paths": []string{"same.md"}},
+		},
+	})
+	_, err = f.Execute(withCallContext(context.Background(), "fleet-call", event.Discard, nil, false), args)
+	if err == nil || !strings.Contains(err.Error(), "conflict") {
+		t.Fatalf("path conflict error = %v", err)
+	}
+
+	// Read-only items must not shift the caller-visible task numbers in the
+	// preflight diagnostic.
+	args, _ = json.Marshal(map[string]any{
+		"tasks": []map[string]any{
+			{"prompt": "inspect", "read_only": true},
+			{"prompt": "writer a", "write_paths": []string{"same.md"}},
+			{"prompt": "writer b", "write_paths": []string{"same.md"}},
+		},
+	})
+	_, err = f.Execute(withCallContext(context.Background(), "fleet-call", event.Discard, nil, false), args)
+	if err == nil || !strings.Contains(err.Error(), "task 2 and task 3") {
+		t.Fatalf("mixed-task conflict error = %v, want original task numbers 2 and 3", err)
+	}
+}
+
+func TestFleetCancellationPreservesStartedItemStatus(t *testing.T) {
+	root := t.TempDir()
+	prov := &fleetCancelProvider{
+		started:  make(chan struct{}, 2),
+		observed: make(chan struct{}, 2),
+		release:  make(chan struct{}),
+	}
+	reg := tool.NewRegistry()
+	task := NewTaskTool(prov, nil, reg, 20, 0, 0, 0, 0, 0, 0, 0.0, "", "sys", nil, 0, "", "", nil).
+		WithTranscripts(mustSubagentStore(t), root, "base", "high").
+		WithScheduler(NewSubagentScheduler(2, 2))
+	f := NewFleetTool(task)
+
+	ctx, cancel := context.WithCancel(withCallContext(context.Background(), "fleet-call", event.Discard, nil, false))
+	done := make(chan struct {
+		out string
+		err error
+	}, 1)
+	go func() {
+		out, err := f.Execute(ctx, json.RawMessage(`{
+			"tasks":[
+				{"prompt":"first","write_paths":["first.md"]},
+				{"prompt":"second","write_paths":["second.md"]}
+			]
+		}`))
+		done <- struct {
+			out string
+			err error
+		}{out: out, err: err}
+	}()
+
+	// Both workers are inside the provider before cancellation. Hold their
+	// terminal results until the fleet has observed ctx.Done, then release them.
+	waitSignal := func(name string, ch <-chan struct{}) {
+		t.Helper()
+		select {
+		case <-ch:
+		case <-time.After(2 * time.Second):
+			t.Fatalf("timed out waiting for %s", name)
+		}
+	}
+	for range 2 {
+		waitSignal("provider start", prov.started)
+	}
+	cancel()
+	for range 2 {
+		waitSignal("provider cancellation", prov.observed)
+	}
+	close(prov.release)
+
+	var got struct {
+		out string
+		err error
+	}
+	select {
+	case got = <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for fleet cancellation result")
+	}
+	if !errors.Is(got.err, context.Canceled) {
+		t.Fatalf("fleet error = %v, want context.Canceled", got.err)
+	}
+	if strings.Contains(got.out, "status: skipped") {
+		t.Fatalf("started tasks must not be reported skipped after cancellation:\n%s", got.out)
+	}
+	if count := strings.Count(got.out, "status: cancelled"); count != 2 {
+		t.Fatalf("cancelled status count = %d, want 2:\n%s", count, got.out)
+	}
+}
+
+func TestFleetParallelDisjointWriters(t *testing.T) {
+	root := t.TempDir()
+	var concurrent atomic.Int32
+	var maxConcurrent atomic.Int32
+	prov := &fleetBarrierProvider{
+		onPrompt: func() {
+			cur := concurrent.Add(1)
+			for {
+				old := maxConcurrent.Load()
+				if cur <= old || maxConcurrent.CompareAndSwap(old, cur) {
+					break
+				}
+			}
+			time.Sleep(30 * time.Millisecond)
+			concurrent.Add(-1)
+		},
+	}
+	reg := tool.NewRegistry()
+	// No writer tools needed — provider finishes without tools.
+	task := NewTaskTool(prov, nil, reg, 20, 0, 0, 0, 0, 0, 0, 0.0, "", "sys", nil, 0, "", "", nil).
+		WithTranscripts(mustSubagentStore(t), root, "base", "high").
+		WithScheduler(NewSubagentScheduler(10, 10))
+	f := NewFleetTool(task)
+
+	tasks := make([]map[string]any, 0, 4)
+	for i := 0; i < 4; i++ {
+		path := filepath.Join("docs", "f"+string(rune('0'+i))+".md")
+		tasks = append(tasks, map[string]any{
+			"prompt":      "handle " + path,
+			"write_paths": []string{path},
+			"description": path,
+		})
+	}
+	args, _ := json.Marshal(map[string]any{"tasks": tasks})
+	ctx := withCallContext(context.Background(), "fleet-call", event.Discard, nil, false)
+	out, err := f.Execute(ctx, args)
+	if err != nil {
+		t.Fatalf("fleet: %v", err)
+	}
+	if !strings.Contains(out, "Completed fleet of 4") {
+		t.Fatalf("output = %s", out)
+	}
+	if maxConcurrent.Load() < 2 {
+		t.Fatalf("expected concurrent starts, max=%d", maxConcurrent.Load())
+	}
+}
+
+type fleetBarrierProvider struct {
+	onPrompt func()
+}
+
+type fleetCancelProvider struct {
+	started  chan struct{}
+	observed chan struct{}
+	release  chan struct{}
+}
+
+func (p *fleetCancelProvider) Name() string { return "fleet-cancel" }
+
+func (p *fleetCancelProvider) Stream(ctx context.Context, _ provider.Request) (<-chan provider.Chunk, error) {
+	p.started <- struct{}{}
+	<-ctx.Done()
+	p.observed <- struct{}{}
+	<-p.release
+	return nil, ctx.Err()
+}
+
+func (p *fleetBarrierProvider) Name() string { return "fleet-barrier" }
+
+func (p *fleetBarrierProvider) Stream(_ context.Context, req provider.Request) (<-chan provider.Chunk, error) {
+	if p.onPrompt != nil {
+		p.onPrompt()
+	}
+	ch := make(chan provider.Chunk, 2)
+	ch <- provider.Chunk{Type: provider.ChunkText, Text: "done"}
+	close(ch)
+	return ch, nil
+}
+
+func mustSubagentStore(t *testing.T) *SubagentStore {
+	t.Helper()
+	return NewSubagentStore(t.TempDir())
+}
diff --git a/internal/agent/parallel_tasks.go b/internal/agent/parallel_tasks.go
index ead832547b..6bccfd9387 100644
--- a/internal/agent/parallel_tasks.go
+++ b/internal/agent/parallel_tasks.go
@@ -155,6 +155,23 @@ func (p *ParallelTasksTool) Execute(ctx context.Context, args json.RawMessage) (
 		go func() {
 			defer wg.Done()
 			nested := subSinkFor(subID, sink)
+			// Session scheduler bounds total concurrency for parallel_tasks the
+			// same way as fleet (read-only slots; no write claims).
+			releaseSlot, slotErr := p.taskTool.acquireSlot(ctx, AcquireRequest{
+				Writer: false,
+				Nested: SubagentDepth(ctx) > 0,
+				Label:  label,
+			})
+			if slotErr != nil {
+				sink.Emit(event.Event{
+					Kind: event.ToolResult,
+					Tool: event.Tool{ID: subID, ParentID: parentID, Name: "task", Err: slotErr.Error()},
+				})
+				doneCh <- subResult{index: idx, err: slotErr}
+				return
+			}
+			defer releaseSlot()
+
 			modelRef, effortRef := p.taskTool.effectiveProfile(t.Model, t.Effort)
 			childDepth, depthErr := p.taskTool.nextSubagentDepth(ctx)
 			if depthErr != nil {
@@ -179,6 +196,8 @@ func (p *ParallelTasksTool) Execute(ctx context.Context, args json.RawMessage) (
 				return
 			}
 
+			// Ordinary parallel_tasks (no profile) keep the concise read-only
+			// default system prompt — profile-aware batches use fleet instead.
 			sess := NewSession(DefaultReadOnlyTaskSystemPrompt)
 			opts := p.taskTool.subagentOptions(ctx, max, pricing, ctxWin, childDepth)
 			// Same contract as runSubSession: capture the pristine task before
diff --git a/internal/agent/path_bound_tools.go b/internal/agent/path_bound_tools.go
new file mode 100644
index 0000000000..9180658db8
--- /dev/null
+++ b/internal/agent/path_bound_tools.go
@@ -0,0 +1,211 @@
+package agent
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"reasonix/internal/tool"
+	"reasonix/internal/tool/builtin"
+)
+
+// pathBoundWriter wraps a built-in write tool so each Execute stays inside a
+// declared WritePathSet. Unknown/custom/MCP writers that cannot be path-scoped
+// are dropped from the parallel-writer registry instead (see BindWritePaths).
+type pathBoundWriter struct {
+	inner   tool.Tool
+	claims  WritePathSet
+	workDir string
+}
+
+func (w pathBoundWriter) Name() string            { return w.inner.Name() }
+func (w pathBoundWriter) Description() string     { return w.inner.Description() }
+func (w pathBoundWriter) Schema() json.RawMessage { return w.inner.Schema() }
+func (w pathBoundWriter) ReadOnly() bool          { return w.inner.ReadOnly() }
+func (w pathBoundWriter) PlanModeSafe() bool {
+	if p, ok := w.inner.(interface{ PlanModeSafe() bool }); ok {
+		return p.PlanModeSafe()
+	}
+	return false
+}
+
+func (w pathBoundWriter) Execute(ctx context.Context, args json.RawMessage) (string, error) {
+	paths, err := extractWritePathsFromArgs(w.inner.Name(), w.workDir, args)
+	if err != nil {
+		return "", err
+	}
+	for _, p := range paths {
+		if !w.claims.AllowsPath(p) {
+			return "", fmt.Errorf("write path %q is outside this subagent's declared write_paths", p)
+		}
+	}
+	return w.inner.Execute(ctx, args)
+}
+
+// pathBoundWriterNames are built-in tools whose arguments expose file paths we
+// can enforce against write_paths claims.
+var pathBoundWriterNames = map[string]bool{
+	"write_file":    true,
+	"edit_file":     true,
+	"multi_edit":    true,
+	"move_file":     true,
+	"notebook_edit": true,
+	"delete_range":  true,
+	"delete_symbol": true,
+}
+
+// BindWritePaths returns a copy of reg where built-in writers are re-bound to
+// the claim and non-path-scoped writer tools (MCP/custom) are dropped.
+// Bash is kept only when keepBash is true AND its OS sandbox WriteRoots can be
+// re-bound to the claim roots; otherwise bash is removed.
+func BindWritePaths(reg *tool.Registry, claims WritePathSet, workDir string, keepBash bool) (bound *tool.Registry, removed []string) {
+	bound = tool.NewRegistry()
+	if reg == nil {
+		return bound, nil
+	}
+	if claims.Empty() {
+		for _, name := range reg.Names() {
+			if tl, ok := reg.Get(name); ok {
+				bound.Add(tl)
+			}
+		}
+		return bound, nil
+	}
+	roots := claims.Roots()
+	for _, name := range reg.Names() {
+		tl, ok := reg.Get(name)
+		if !ok {
+			continue
+		}
+		if name == "bash" {
+			if !keepBash {
+				removed = append(removed, name)
+				continue
+			}
+			rebound, ok := rebindBashToClaimRoots(tl, roots)
+			if !ok {
+				removed = append(removed, name)
+				continue
+			}
+			bound.Add(rebound)
+			continue
+		}
+		if tl.ReadOnly() {
+			bound.Add(tl)
+			continue
+		}
+		if pathBoundWriterNames[name] {
+			bound.Add(pathBoundWriter{inner: tl, claims: claims, workDir: workDir})
+			continue
+		}
+		// MCP / custom writers cannot be path-scoped reliably.
+		removed = append(removed, name)
+	}
+	return bound, removed
+}
+
+// rebindBashToClaimRoots rebinds a bash tool (or foregroundOnlyBash wrapper)
+// so OS sandbox WriteRoots equal the claim roots.
+func rebindBashToClaimRoots(tl tool.Tool, roots []string) (tool.Tool, bool) {
+	if len(roots) == 0 {
+		return nil, false
+	}
+	if fb, ok := tl.(foregroundOnlyBash); ok {
+		rebound, ok := builtin.RebindBashWriteRoots(fb.inner, roots)
+		if !ok {
+			return nil, false
+		}
+		return foregroundOnlyBash{inner: rebound}, true
+	}
+	return builtin.RebindBashWriteRoots(tl, roots)
+}
+
+// parentWriteGuardTarget reports tools whose parent-side execution can mutate
+// workspace files and must reserve write claims for the duration of Execute.
+// Meta/delegation tools (task, fleet, run_skill, …) are excluded so the parent
+// can still schedule while background writers run.
+func parentWriteGuardTarget(name string) bool {
+	if pathBoundWriterNames[name] || name == "bash" {
+		return true
+	}
+	return strings.HasPrefix(name, tool.MCPNamePrefix)
+}
+
+// parentWriteReservation builds the WritePathSet a parent tool must hold while
+// executing. Path-aware built-ins reserve concrete targets; bash/MCP reserve
+// the whole workspace (targets cannot be judged reliably).
+func parentWriteReservation(workDir, toolName string, args json.RawMessage) (WritePathSet, error) {
+	if pathBoundWriterNames[toolName] {
+		paths, err := extractWritePathsFromArgs(toolName, workDir, args)
+		if err != nil {
+			return WritePathSet{}, fmt.Errorf("could not parse %s path for write reservation: %w", toolName, err)
+		}
+		// NormalizeWritePaths accepts relative paths against the workspace.
+		// Absolute paths already inside the workspace also work.
+		raw := make([]string, 0, len(paths))
+		for _, p := range paths {
+			raw = append(raw, resolveMaybeRelative(workDir, p))
+		}
+		set, err := NormalizeWritePaths(workDir, raw)
+		if err != nil {
+			// Outside workspace: still take a whole-workspace reservation so we
+			// cannot race background writers while writing managed paths outside
+			// roots (config write approval path).
+			whole, werr := WholeWorkspaceWriteClaim(workDir)
+			if werr != nil {
+				return WritePathSet{}, err
+			}
+			return whole, nil
+		}
+		return set, nil
+	}
+	// Bash and MCP/custom writers.
+	return WholeWorkspaceWriteClaim(workDir)
+}
+
+func extractWritePathsFromArgs(toolName, workDir string, args json.RawMessage) ([]string, error) {
+	switch toolName {
+	case "move_file":
+		var p struct {
+			SourcePath      string `json:"source_path"`
+			DestinationPath string `json:"destination_path"`
+		}
+		if err := json.Unmarshal(args, &p); err != nil {
+			return nil, fmt.Errorf("invalid args: %w", err)
+		}
+		if strings.TrimSpace(p.SourcePath) == "" || strings.TrimSpace(p.DestinationPath) == "" {
+			return nil, fmt.Errorf("source_path and destination_path are required")
+		}
+		return []string{
+			resolveMaybeRelative(workDir, p.SourcePath),
+			resolveMaybeRelative(workDir, p.DestinationPath),
+		}, nil
+	default:
+		var p struct {
+			Path string `json:"path"`
+		}
+		if err := json.Unmarshal(args, &p); err != nil {
+			return nil, fmt.Errorf("invalid args: %w", err)
+		}
+		if strings.TrimSpace(p.Path) == "" {
+			return nil, fmt.Errorf("path is required")
+		}
+		return []string{resolveMaybeRelative(workDir, p.Path)}, nil
+	}
+}
+
+func resolveMaybeRelative(workDir, path string) string {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return path
+	}
+	if filepath.IsAbs(path) {
+		return path
+	}
+	if strings.TrimSpace(workDir) == "" {
+		return path
+	}
+	return filepath.Join(workDir, path)
+}
diff --git a/internal/agent/path_bound_tools_test.go b/internal/agent/path_bound_tools_test.go
new file mode 100644
index 0000000000..03c8502469
--- /dev/null
+++ b/internal/agent/path_bound_tools_test.go
@@ -0,0 +1,295 @@
+package agent
+
+import (
+	"context"
+	"encoding/json"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"reasonix/internal/event"
+	"reasonix/internal/provider"
+	"reasonix/internal/sandbox"
+	"reasonix/internal/tool"
+	"reasonix/internal/tool/builtin"
+)
+
+func TestBindWritePathsRebindsBashWriteRoots(t *testing.T) {
+	root := t.TempDir()
+	claim, err := NormalizeWritePaths(root, []string{"docs"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	reg := tool.NewRegistry()
+	reg.Add(builtin.ConfineBash(sandbox.Spec{
+		Mode:       "enforce",
+		WriteRoots: []string{root},
+	}, builtin.SessionDataGuard{}))
+	reg.Add(foregroundOnlyBash{inner: mustGet(t, reg, "bash")})
+
+	bound, removed := BindWritePaths(reg, claim, root, true)
+	if len(removed) != 0 {
+		t.Fatalf("removed = %v, want none", removed)
+	}
+	if _, ok := bound.Get("bash"); !ok {
+		t.Fatal("bash should be kept when sandbox can rebind")
+	}
+
+	_, removed = BindWritePaths(reg, claim, root, false)
+	if len(removed) != 1 || removed[0] != "bash" {
+		t.Fatalf("removed = %v, want [bash]", removed)
+	}
+}
+
+func TestParentWriteReservationBlocksOverlappingSubagentAcquire(t *testing.T) {
+	root := t.TempDir()
+	sched := NewSubagentScheduler(4, 2)
+	claim, err := parentWriteReservation(root, "write_file", mustJSON(t, map[string]string{
+		"path":    filepath.Join(root, "a.md"),
+		"content": "x",
+	}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	release, err := sched.ReserveParentWrite(claim)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Nested acquire must fail-fast while parent holds the path.
+	subClaim, err := NormalizeWritePaths(root, []string{"a.md"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = sched.Acquire(context.Background(), AcquireRequest{
+		Writer: true, WritePaths: subClaim, Nested: true,
+	})
+	if err == nil {
+		t.Fatal("subagent should not acquire path held by parent reservation")
+	}
+	release()
+
+	// After release, acquire succeeds.
+	rel2, err := sched.Acquire(context.Background(), AcquireRequest{
+		Writer: true, WritePaths: subClaim,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	rel2()
+}
+
+// TestParentWriteReservationClosesTOCTOU proves a parent reservation held for
+// the whole Execute window prevents a concurrent subagent from claiming the
+// same path after a check-but-before-write window would have opened.
+func TestParentWriteReservationClosesTOCTOU(t *testing.T) {
+	root := t.TempDir()
+	sched := NewSubagentScheduler(4, 2)
+	path := filepath.Join(root, "race.md")
+	args := mustJSON(t, map[string]string{"path": path, "content": "parent"})
+
+	parentStarted := make(chan struct{})
+	releaseParent := make(chan struct{})
+	parentDone := make(chan struct{})
+
+	go func() {
+		defer close(parentDone)
+		claim, err := parentWriteReservation(root, "write_file", args)
+		if err != nil {
+			t.Errorf("parent reservation: %v", err)
+			close(parentStarted)
+			return
+		}
+		release, err := sched.ReserveParentWrite(claim)
+		if err != nil {
+			t.Errorf("ReserveParentWrite: %v", err)
+			close(parentStarted)
+			return
+		}
+		// Signal that the parent write has "started" (reservation held).
+		close(parentStarted)
+		// Hold the reservation while a concurrent subagent tries to claim.
+		<-releaseParent
+		release()
+	}()
+
+	<-parentStarted
+
+	subClaim, err := NormalizeWritePaths(root, []string{"race.md"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Non-nested would queue; Nested fail-fast proves conflict under reservation.
+	_, err = sched.Acquire(context.Background(), AcquireRequest{
+		Writer: true, WritePaths: subClaim, Nested: true,
+	})
+	if err == nil {
+		t.Fatal("expected TOCTOU-safe rejection while parent write holds reservation")
+	}
+	if !strings.Contains(err.Error(), "parent write") && !strings.Contains(err.Error(), "conflict") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	close(releaseParent)
+	<-parentDone
+}
+
+func TestAgentReservesParentWriteBeforePreToolUse(t *testing.T) {
+	root := t.TempDir()
+	sched := NewSubagentScheduler(4, 2)
+	claim, err := NormalizeWritePaths(root, []string{"hook-race.md"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	hooks := &parentClaimProbeHooks{scheduler: sched, claim: claim}
+	writer := &recordingWriter{name: "write_file"}
+	reg := tool.NewRegistry()
+	reg.Add(writer)
+	a := New(nil, reg, NewSession(""), Options{
+		Hooks:              hooks,
+		WriteScheduler:     sched,
+		WriteWorkspaceRoot: root,
+	}, event.Discard)
+
+	out := a.executeOne(context.Background(), provider.ToolCall{
+		ID:        "write-1",
+		Name:      "write_file",
+		Arguments: string(mustJSON(t, map[string]string{"path": "hook-race.md", "content": "parent"})),
+	})
+	if out.errMsg != "" {
+		t.Fatalf("executeOne failed: %+v", out)
+	}
+	if hooks.acquireErr == nil {
+		t.Fatal("PreToolUse hook observed no parent claim; reservation must precede hooks")
+	}
+	if writer.calls != 1 {
+		t.Fatalf("writer calls = %d, want 1", writer.calls)
+	}
+	if n := len(sched.ActiveWriterClaims()); n != 0 {
+		t.Fatalf("claims after Execute = %d, want 0", n)
+	}
+}
+
+func TestParentWriteReservationBashClaimsWholeWorkspace(t *testing.T) {
+	root := t.TempDir()
+	claim, err := parentWriteReservation(root, "bash", json.RawMessage(`{"command":"echo hi"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !claim.WholeWorkspace {
+		t.Fatalf("bash reservation must claim whole workspace, got %+v", claim)
+	}
+	mcp, err := parentWriteReservation(root, "mcp__srv__write", json.RawMessage(`{}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !mcp.WholeWorkspace {
+		t.Fatalf("MCP writer reservation must claim whole workspace")
+	}
+}
+
+func TestAgentReserveParentWriteSkipsSubagentDepth(t *testing.T) {
+	root := t.TempDir()
+	sched := NewSubagentScheduler(4, 2)
+	a := &Agent{
+		writeScheduler:     sched,
+		writeWorkspaceRoot: root,
+		subagentDepth:      1,
+	}
+	inner := &recordingWriter{name: "write_file"}
+	release, err := a.reserveParentWrite(inner, mustJSON(t, map[string]string{
+		"path": filepath.Join(root, "a.md"), "content": "x",
+	}), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	release()
+	// No parent claim should remain — subagent depth skips reservation.
+	if n := len(sched.ActiveWriterClaims()); n != 0 {
+		t.Fatalf("claims = %d, want 0", n)
+	}
+}
+
+func TestAgentReserveParentWriteHoldsClaim(t *testing.T) {
+	root := t.TempDir()
+	sched := NewSubagentScheduler(4, 2)
+	a := &Agent{
+		writeScheduler:     sched,
+		writeWorkspaceRoot: root,
+		subagentDepth:      0,
+	}
+	inner := &recordingWriter{name: "write_file"}
+	release, err := a.reserveParentWrite(inner, mustJSON(t, map[string]string{
+		"path": filepath.Join(root, "a.md"), "content": "x",
+	}), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := len(sched.ActiveWriterClaims()); n != 1 {
+		t.Fatalf("claims = %d, want 1", n)
+	}
+	release()
+	if n := len(sched.ActiveWriterClaims()); n != 0 {
+		t.Fatalf("claims after release = %d", n)
+	}
+}
+
+func mustGet(t *testing.T, reg *tool.Registry, name string) tool.Tool {
+	t.Helper()
+	tl, ok := reg.Get(name)
+	if !ok {
+		t.Fatalf("missing %s", name)
+	}
+	return tl
+}
+
+func mustJSON(t *testing.T, v any) json.RawMessage {
+	t.Helper()
+	b, err := json.Marshal(v)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+type recordingWriter struct {
+	name     string
+	readOnly bool
+	calls    int
+}
+
+type parentClaimProbeHooks struct {
+	scheduler  *SubagentScheduler
+	claim      WritePathSet
+	acquireErr error
+}
+
+func (h *parentClaimProbeHooks) PreToolUse(context.Context, string, json.RawMessage) (bool, string) {
+	release, err := h.scheduler.Acquire(context.Background(), AcquireRequest{
+		Writer: true, WritePaths: h.claim, Nested: true,
+	})
+	h.acquireErr = err
+	if err == nil {
+		release()
+	}
+	return false, ""
+}
+func (*parentClaimProbeHooks) PostToolUse(context.Context, string, json.RawMessage, string) {}
+func (*parentClaimProbeHooks) PostToolUseFailure(context.Context, string, json.RawMessage, string, error) {
+}
+func (*parentClaimProbeHooks) PostLLMCall(_ context.Context, reasoning string, _ int) string {
+	return reasoning
+}
+func (*parentClaimProbeHooks) HasPostLLMCall() bool                      { return false }
+func (*parentClaimProbeHooks) SubagentStop(context.Context, string)      {}
+func (*parentClaimProbeHooks) PreCompact(context.Context, string) string { return "" }
+
+func (r *recordingWriter) Name() string        { return r.name }
+func (r *recordingWriter) Description() string { return r.name }
+func (r *recordingWriter) Schema() json.RawMessage {
+	return json.RawMessage(`{"type":"object","properties":{"path":{"type":"string"},"content":{"type":"string"}},"required":["path","content"]}`)
+}
+func (r *recordingWriter) ReadOnly() bool { return r.readOnly }
+func (r *recordingWriter) Execute(context.Context, json.RawMessage) (string, error) {
+	r.calls++
+	return "ok", nil
+}
diff --git a/internal/agent/profile_spec.go b/internal/agent/profile_spec.go
new file mode 100644
index 0000000000..beb7bd4aae
--- /dev/null
+++ b/internal/agent/profile_spec.go
@@ -0,0 +1,194 @@
+package agent
+
+import (
+	"fmt"
+	"strings"
+
+	"reasonix/internal/tool"
+)
+
+// ProfileDefinition is the resolved, runtime-facing shape of a runAs=subagent
+// skill used by task/fleet/run_skill. Profile names are resolved at call time
+// from the Skill store and must never be written into tool schemas or the
+// parent system prompt (prompt-cache stability).
+type ProfileDefinition struct {
+	Name         string
+	Body         string
+	AllowedTools []string
+	Model        string
+	Effort       string
+	ReadOnly     bool
+	// Invocation is "auto" or "manual". Explicit profile= on task/fleet may
+	// call manual profiles; automatic discovery still respects the index.
+	Invocation string
+	// NamedBuiltin is true for the built-in explore/research/review/
+	// security-review profiles. Their body is still the full system prompt
+	// (no implicit concise default), matching custom profiles.
+	NamedBuiltin bool
+}
+
+// ProfileLookup resolves a profile by exact skill name. Implementations read
+// from the live Skill store; a nil lookup means profile= is unavailable.
+type ProfileLookup func(name string) (ProfileDefinition, bool)
+
+// ProfileExecSpec is the unified execution specification shared by task,
+// fleet items, and run_skill profile runs. Call sites build a spec, then hand
+// it to TaskTool.RunProfileSpec so runners cannot drift.
+type ProfileExecSpec struct {
+	// Kind is the transcript kind: "task", "skill", or "fleet".
+	Kind string
+	// Name is the transcript / display name (profile name or "task").
+	Name string
+	// Profile is the optional profile skill name (empty for ordinary task).
+	Profile string
+	// Prompt is the user task text for the child agent.
+	Prompt string
+	// Description is an optional short UI label.
+	Description string
+	// SystemPrompt is the full child system prompt. When UseProfilePrompt is
+	// true this is exactly the profile body (no DefaultTaskSystemPrompt).
+	SystemPrompt string
+	// UseProfilePrompt marks custom/named-builtin profile system prompts so
+	// hosts do not append the ordinary concise task default.
+	UseProfilePrompt bool
+	// ReadOnly forces the read-only registry even when the profile can write.
+	ReadOnly bool
+	// CallTools is the optional per-call tools whitelist.
+	CallTools []string
+	// ProfileTools is the profile frontmatter allowed-tools list.
+	ProfileTools []string
+	// Model/Effort are the already-resolved effective values for this run
+	// (after config override → call params → frontmatter → global → parent).
+	Model  string
+	Effort string
+	// WritePaths is the normalized write claim (empty for read-only).
+	WritePaths WritePathSet
+	// MaxSteps is the optional per-call step budget (0 = default).
+	MaxSteps int
+	// ContinueFrom / ForkFrom are transcript continuation refs (writer path).
+	ContinueFrom string
+	ForkFrom     string
+	// RunInBackground starts a jobs.Manager background job.
+	RunInBackground bool
+	// Nested marks nested sub-agent acquires (fail-fast on concurrency limits).
+	Nested bool
+}
+
+// ResolveProfileDefinition looks up a profile and enforces the runAs=subagent
+// contract. Explicit names may invoke invocation=manual profiles.
+func ResolveProfileDefinition(lookup ProfileLookup, name string) (ProfileDefinition, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return ProfileDefinition{}, fmt.Errorf("profile name is required")
+	}
+	if lookup == nil {
+		return ProfileDefinition{}, fmt.Errorf("profile resolution is not configured in this session")
+	}
+	def, ok := lookup(name)
+	if !ok {
+		return ProfileDefinition{}, fmt.Errorf("unknown profile %q", name)
+	}
+	if strings.TrimSpace(def.Name) == "" {
+		def.Name = name
+	}
+	return def, nil
+}
+
+// IntersectToolLists returns the intersection of profile tools and call tools.
+// Call parameters may only narrow permissions, never expand them.
+//
+// Rules:
+//   - both empty → nil (meaning "all tools allowed by the registry builder")
+//   - profile empty, call set → call list
+//   - call empty, profile set → profile list
+//   - both set → expand patterns against parent, then intersect; empty
+//     intersection is an error
+func IntersectToolLists(parent *tool.Registry, profileTools, callTools []string) ([]string, error) {
+	profileTools = cleanToolList(profileTools)
+	callTools = cleanToolList(callTools)
+	if len(profileTools) == 0 {
+		return callTools, nil
+	}
+	if len(callTools) == 0 {
+		return profileTools, nil
+	}
+	// Imported profiles support wildcard tool names. Resolve both sides against
+	// the same live registry before comparing them so a profile pattern can be
+	// narrowed by a concrete call tool (and vice versa).
+	if parent != nil {
+		profileTools = expandToolPatterns(parent, profileTools)
+		callTools = expandToolPatterns(parent, callTools)
+	}
+	allowed := map[string]bool{}
+	for _, t := range profileTools {
+		allowed[t] = true
+	}
+	var out []string
+	seen := map[string]bool{}
+	for _, t := range callTools {
+		if !allowed[t] || seen[t] {
+			continue
+		}
+		seen[t] = true
+		out = append(out, t)
+	}
+	if len(out) == 0 {
+		return nil, fmt.Errorf("tools intersection is empty: call tools are not within the profile allowlist")
+	}
+	return out, nil
+}
+
+// ResolveModelEffort applies the fixed priority:
+// profile persistent config → call params → profile frontmatter → global
+// subagent default. Empty results leave identity resolution to the parent.
+func ResolveModelEffort(configModel, configEffort, callModel, callEffort, profileModel, profileEffort, globalModel, globalEffort string) (model, effort string) {
+	model = firstNonBlank(
+		strings.TrimSpace(configModel),
+		strings.TrimSpace(callModel),
+		strings.TrimSpace(profileModel),
+		strings.TrimSpace(globalModel),
+	)
+	effort = firstNonBlank(
+		strings.TrimSpace(configEffort),
+		strings.TrimSpace(callEffort),
+		strings.TrimSpace(profileEffort),
+		strings.TrimSpace(globalEffort),
+	)
+	return model, effort
+}
+
+func firstNonBlank(values ...string) string {
+	for _, v := range values {
+		if strings.TrimSpace(v) != "" {
+			return strings.TrimSpace(v)
+		}
+	}
+	return ""
+}
+
+func cleanToolList(names []string) []string {
+	if len(names) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(names))
+	seen := map[string]bool{}
+	for _, n := range names {
+		n = strings.TrimSpace(n)
+		if n == "" || seen[n] {
+			continue
+		}
+		seen[n] = true
+		out = append(out, n)
+	}
+	return out
+}
+
+// NamedBuiltinProfile reports whether name is a built-in named subagent profile.
+func NamedBuiltinProfile(name string) bool {
+	switch strings.TrimSpace(name) {
+	case "explore", "research", "review", "security-review", "security_review":
+		return true
+	default:
+		return false
+	}
+}
diff --git a/internal/agent/profile_spec_test.go b/internal/agent/profile_spec_test.go
new file mode 100644
index 0000000000..73db9d78b6
--- /dev/null
+++ b/internal/agent/profile_spec_test.go
@@ -0,0 +1,115 @@
+package agent
+
+import (
+	"testing"
+
+	"reasonix/internal/tool"
+)
+
+func TestIntersectToolLists(t *testing.T) {
+	got, err := IntersectToolLists(nil, []string{"read_file", "bash"}, []string{"bash", "write_file"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || got[0] != "bash" {
+		t.Fatalf("got %v, want [bash]", got)
+	}
+	if _, err := IntersectToolLists(nil, []string{"read_file"}, []string{"write_file"}); err == nil {
+		t.Fatal("empty intersection should error")
+	}
+	got, err = IntersectToolLists(nil, nil, []string{"bash"})
+	if err != nil || len(got) != 1 || got[0] != "bash" {
+		t.Fatalf("profile empty → call list: %v %v", got, err)
+	}
+	got, err = IntersectToolLists(nil, []string{"bash"}, nil)
+	if err != nil || len(got) != 1 || got[0] != "bash" {
+		t.Fatalf("call empty → profile list: %v %v", got, err)
+	}
+}
+
+func TestIntersectToolListsExpandsPatternsAgainstLiveRegistry(t *testing.T) {
+	reg := tool.NewRegistry()
+	reg.Add(fakeTool{name: "mcp__github__search", readOnly: true})
+	reg.Add(fakeTool{name: "mcp__slack__search", readOnly: true})
+
+	tests := []struct {
+		name         string
+		profileTools []string
+		callTools    []string
+	}{
+		{
+			name:         "profile pattern call literal",
+			profileTools: []string{"mcp__*__search"},
+			callTools:    []string{"mcp__github__search"},
+		},
+		{
+			name:         "profile literal call pattern",
+			profileTools: []string{"mcp__github__search"},
+			callTools:    []string{"mcp__*__search"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := IntersectToolLists(reg, tt.profileTools, tt.callTools)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(got) != 1 || got[0] != "mcp__github__search" {
+				t.Fatalf("got %v, want [mcp__github__search]", got)
+			}
+		})
+	}
+}
+
+func TestResolveModelEffortPrecedence(t *testing.T) {
+	// config override wins over call params.
+	m, e := ResolveModelEffort("cfg-m", "cfg-e", "call-m", "call-e", "prof-m", "prof-e", "glob-m", "glob-e")
+	if m != "cfg-m" || e != "cfg-e" {
+		t.Fatalf("got %s/%s", m, e)
+	}
+	// call wins over frontmatter when no config.
+	m, e = ResolveModelEffort("", "", "call-m", "call-e", "prof-m", "prof-e", "glob-m", "glob-e")
+	if m != "call-m" || e != "call-e" {
+		t.Fatalf("got %s/%s", m, e)
+	}
+	// frontmatter over global.
+	m, e = ResolveModelEffort("", "", "", "", "prof-m", "prof-e", "glob-m", "glob-e")
+	if m != "prof-m" || e != "prof-e" {
+		t.Fatalf("got %s/%s", m, e)
+	}
+	// global fallback.
+	m, e = ResolveModelEffort("", "", "", "", "", "", "glob-m", "glob-e")
+	if m != "glob-m" || e != "glob-e" {
+		t.Fatalf("got %s/%s", m, e)
+	}
+}
+
+func TestResolveProfileDefinition(t *testing.T) {
+	lookup := func(name string) (ProfileDefinition, bool) {
+		if name != "doc-rewriter" {
+			return ProfileDefinition{}, false
+		}
+		return ProfileDefinition{Name: "doc-rewriter", Body: "rewrite docs", ReadOnly: false}, true
+	}
+	if _, err := ResolveProfileDefinition(lookup, "missing"); err == nil {
+		t.Fatal("expected unknown profile error")
+	}
+	if _, err := ResolveProfileDefinition(nil, "doc-rewriter"); err == nil {
+		t.Fatal("expected unconfigured error")
+	}
+	def, err := ResolveProfileDefinition(lookup, "doc-rewriter")
+	if err != nil || def.Body != "rewrite docs" {
+		t.Fatalf("got %+v %v", def, err)
+	}
+}
+
+func TestNamedBuiltinProfile(t *testing.T) {
+	for _, name := range []string{"explore", "research", "review", "security-review", "security_review"} {
+		if !NamedBuiltinProfile(name) {
+			t.Fatalf("%s should be named builtin", name)
+		}
+	}
+	if NamedBuiltinProfile("doc-rewriter") {
+		t.Fatal("custom profile is not named builtin")
+	}
+}
diff --git a/internal/agent/scheduler.go b/internal/agent/scheduler.go
new file mode 100644
index 0000000000..b75cdb5ce7
--- /dev/null
+++ b/internal/agent/scheduler.go
@@ -0,0 +1,309 @@
+package agent
+
+import (
+	"context"
+	"fmt"
+	"sync"
+)
+
+// SubagentSlotStatus is the queue lifecycle shown for background task/fleet
+// items that share the session scheduler.
+type SubagentSlotStatus string
+
+const (
+	SubagentSlotQueued  SubagentSlotStatus = "queued"
+	SubagentSlotRunning SubagentSlotStatus = "running"
+	SubagentSlotDone    SubagentSlotStatus = "done"
+	SubagentSlotFailed  SubagentSlotStatus = "failed"
+)
+
+// AcquireRequest describes a sub-agent slot request against the session pool.
+type AcquireRequest struct {
+	// Writer is true for writer-capable runs (task without read_only, profile
+	// that is not read-only, fleet items that can write).
+	Writer bool
+	// WritePaths is the claim held while the slot is active. Empty for
+	// read-only work. Whole-workspace claims count as writers and serialize
+	// against every other writer.
+	WritePaths WritePathSet
+	// Nested fails immediately when no capacity is free instead of queueing.
+	// Nested sub-agents must not block waiting for a parent-held slot.
+	Nested bool
+	// Label is optional diagnostics text.
+	Label string
+}
+
+// SubagentScheduler is a session-scoped concurrency controller shared by task,
+// fleet, parallel_tasks, profile skills, and nested sub-agents.
+type SubagentScheduler struct {
+	mu sync.Mutex
+
+	maxTotal   int
+	maxWriters int
+
+	activeTotal   int
+	activeWriters int
+	activeClaims  []WritePathSet
+	// parentClaims are write paths held by the parent agent during a write-tool
+	// Execute. They block overlapping subagent claims without consuming a
+	// subagent concurrency slot (parent is not a subagent).
+	parentClaims []WritePathSet
+
+	// waiters are FIFO waiters for non-nested acquires.
+	waiters []*schedulerWaiter
+}
+
+type schedulerWaiter struct {
+	req    AcquireRequest
+	ready  chan struct{}
+	failed error
+}
+
+// NewSubagentScheduler builds a scheduler with the given limits (normalized).
+func NewSubagentScheduler(maxTotal, maxWriters int) *SubagentScheduler {
+	maxTotal, maxWriters = NormalizeConcurrencyLimits(maxTotal, maxWriters)
+	return &SubagentScheduler{maxTotal: maxTotal, maxWriters: maxWriters}
+}
+
+// Limits returns the effective total/writer caps.
+func (s *SubagentScheduler) Limits() (total, writers int) {
+	if s == nil {
+		return DefaultMaxSubagentConcurrency, DefaultMaxParallelWriters
+	}
+	return s.maxTotal, s.maxWriters
+}
+
+// Acquire reserves a concurrency slot (and optional write claim). Nested
+// requests fail immediately when capacity is exhausted. Non-nested requests
+// queue until capacity is free or ctx is cancelled.
+//
+// The returned release function must be called exactly once when the sub-agent
+// finishes. release is safe to call even if Acquire returns an error (no-op).
+func (s *SubagentScheduler) Acquire(ctx context.Context, req AcquireRequest) (release func(), err error) {
+	noop := func() {}
+	if s == nil {
+		return noop, nil
+	}
+	if ctx == nil {
+		ctx = context.Background()
+	}
+
+	s.mu.Lock()
+	if ok, reason := s.canStartLocked(req); ok {
+		s.activateLocked(req)
+		s.mu.Unlock()
+		return s.makeRelease(req), nil
+	} else if req.Nested {
+		s.mu.Unlock()
+		return noop, fmt.Errorf("subagent concurrency limit reached (%s); nested subagents fail fast to avoid parent/child slot deadlock", reason)
+	}
+
+	w := &schedulerWaiter{req: req, ready: make(chan struct{})}
+	s.waiters = append(s.waiters, w)
+	s.mu.Unlock()
+
+	select {
+	case <-w.ready:
+		if w.failed != nil {
+			return noop, w.failed
+		}
+		return s.makeRelease(req), nil
+	case <-ctx.Done():
+		s.mu.Lock()
+		s.removeWaiterLocked(w)
+		s.mu.Unlock()
+		// If we were activated between cancel and remove, release.
+		select {
+		case <-w.ready:
+			if w.failed == nil {
+				s.makeRelease(req)()
+			}
+		default:
+		}
+		return noop, ctx.Err()
+	}
+}
+
+// TryClaimWritePaths checks whether paths conflict with active claims without
+// taking a concurrency slot. Used for diagnostics; prefer ReserveParentWrite
+// for parent agent writes so the check is not TOCTOU with subagent Acquire.
+func (s *SubagentScheduler) TryClaimWritePaths(paths WritePathSet) error {
+	if s == nil || paths.Empty() {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.conflictLocked(paths)
+}
+
+// ReserveParentWrite holds paths against overlapping subagent claims for the
+// duration of a parent write-tool Execute. It does not consume subagent
+// concurrency slots. On conflict it fails immediately (parent cannot queue
+// behind background jobs mid-tool-call). release must be called once when the
+// write finishes so queued subagents can proceed.
+func (s *SubagentScheduler) ReserveParentWrite(paths WritePathSet) (release func(), err error) {
+	noop := func() {}
+	if s == nil || paths.Empty() {
+		return noop, nil
+	}
+	s.mu.Lock()
+	if err := s.conflictLocked(paths); err != nil {
+		s.mu.Unlock()
+		return noop, err
+	}
+	s.parentClaims = append(s.parentClaims, paths)
+	s.mu.Unlock()
+
+	var once sync.Once
+	return func() {
+		once.Do(func() {
+			s.mu.Lock()
+			s.parentClaims = removeClaim(s.parentClaims, paths)
+			s.pumpWaitersLocked()
+			s.mu.Unlock()
+		})
+	}, nil
+}
+
+// ActiveWriterClaims returns a snapshot of subagent + parent write claims.
+func (s *SubagentScheduler) ActiveWriterClaims() []WritePathSet {
+	if s == nil {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	out := make([]WritePathSet, 0, len(s.activeClaims)+len(s.parentClaims))
+	out = append(out, s.activeClaims...)
+	out = append(out, s.parentClaims...)
+	return out
+}
+
+func (s *SubagentScheduler) conflictLocked(paths WritePathSet) error {
+	if paths.Empty() {
+		return nil
+	}
+	for _, active := range s.activeClaims {
+		if active.Overlaps(paths) {
+			return fmt.Errorf("write path is claimed by a running background subagent; wait for it to finish before writing the same path")
+		}
+	}
+	for _, active := range s.parentClaims {
+		if active.Overlaps(paths) {
+			return fmt.Errorf("write path is claimed by another parent write in progress")
+		}
+	}
+	return nil
+}
+
+func (s *SubagentScheduler) makeRelease(req AcquireRequest) func() {
+	var once sync.Once
+	return func() {
+		once.Do(func() {
+			s.mu.Lock()
+			s.deactivateLocked(req)
+			s.pumpWaitersLocked()
+			s.mu.Unlock()
+		})
+	}
+}
+
+func (s *SubagentScheduler) canStartLocked(req AcquireRequest) (bool, string) {
+	if s.activeTotal >= s.maxTotal {
+		return false, fmt.Sprintf("total concurrency %d/%d", s.activeTotal, s.maxTotal)
+	}
+	if !req.Writer {
+		return true, ""
+	}
+	if s.activeWriters >= s.maxWriters {
+		return false, fmt.Sprintf("writer concurrency %d/%d", s.activeWriters, s.maxWriters)
+	}
+	for _, active := range s.activeClaims {
+		if active.Overlaps(req.WritePaths) {
+			return false, "write path conflict with a running subagent"
+		}
+	}
+	for _, active := range s.parentClaims {
+		if active.Overlaps(req.WritePaths) {
+			return false, "write path conflict with a parent write in progress"
+		}
+	}
+	return true, ""
+}
+
+func (s *SubagentScheduler) activateLocked(req AcquireRequest) {
+	s.activeTotal++
+	if req.Writer {
+		s.activeWriters++
+		if !req.WritePaths.Empty() {
+			s.activeClaims = append(s.activeClaims, req.WritePaths)
+		}
+	}
+}
+
+func (s *SubagentScheduler) deactivateLocked(req AcquireRequest) {
+	if s.activeTotal > 0 {
+		s.activeTotal--
+	}
+	if req.Writer {
+		if s.activeWriters > 0 {
+			s.activeWriters--
+		}
+		if !req.WritePaths.Empty() {
+			s.activeClaims = removeClaim(s.activeClaims, req.WritePaths)
+		}
+	}
+}
+
+func (s *SubagentScheduler) pumpWaitersLocked() {
+	if len(s.waiters) == 0 {
+		return
+	}
+	remaining := s.waiters[:0]
+	for _, w := range s.waiters {
+		if ok, _ := s.canStartLocked(w.req); ok {
+			s.activateLocked(w.req)
+			close(w.ready)
+			continue
+		}
+		remaining = append(remaining, w)
+	}
+	s.waiters = remaining
+}
+
+func (s *SubagentScheduler) removeWaiterLocked(target *schedulerWaiter) {
+	if len(s.waiters) == 0 {
+		return
+	}
+	out := s.waiters[:0]
+	for _, w := range s.waiters {
+		if w == target {
+			continue
+		}
+		out = append(out, w)
+	}
+	s.waiters = out
+}
+
+func removeClaim(claims []WritePathSet, target WritePathSet) []WritePathSet {
+	for i, c := range claims {
+		if writeClaimEqual(c, target) {
+			return append(claims[:i], claims[i+1:]...)
+		}
+	}
+	return claims
+}
+
+func writeClaimEqual(a, b WritePathSet) bool {
+	if a.WholeWorkspace != b.WholeWorkspace || a.WorkspaceRoot != b.WorkspaceRoot {
+		return false
+	}
+	if len(a.Paths) != len(b.Paths) {
+		return false
+	}
+	for i := range a.Paths {
+		if a.Paths[i] != b.Paths[i] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/agent/scheduler_test.go b/internal/agent/scheduler_test.go
new file mode 100644
index 0000000000..9b9dbd7e10
--- /dev/null
+++ b/internal/agent/scheduler_test.go
@@ -0,0 +1,115 @@
+package agent
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestSchedulerTotalConcurrencyQueues(t *testing.T) {
+	s := NewSubagentScheduler(2, 2)
+	root := t.TempDir()
+	var started atomic.Int32
+	var max atomic.Int32
+	var wg sync.WaitGroup
+	barrier := make(chan struct{})
+
+	for i := 0; i < 4; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			release, err := s.Acquire(context.Background(), AcquireRequest{Writer: false})
+			if err != nil {
+				t.Errorf("acquire: %v", err)
+				return
+			}
+			cur := started.Add(1)
+			for {
+				old := max.Load()
+				if cur <= old || max.CompareAndSwap(old, cur) {
+					break
+				}
+			}
+			<-barrier
+			started.Add(-1)
+			release()
+		}()
+	}
+
+	// Wait until at least 2 are running, then release them.
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if max.Load() >= 2 {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	if got := max.Load(); got > 2 {
+		t.Fatalf("max concurrent = %d, want <= 2", got)
+	}
+	close(barrier)
+	wg.Wait()
+	_ = root
+}
+
+func TestSchedulerNestedFailsFast(t *testing.T) {
+	s := NewSubagentScheduler(1, 1)
+	release, err := s.Acquire(context.Background(), AcquireRequest{Writer: false})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer release()
+	_, err = s.Acquire(context.Background(), AcquireRequest{Writer: false, Nested: true})
+	if err == nil {
+		t.Fatal("nested acquire should fail fast at limit")
+	}
+}
+
+func TestSchedulerWriterPathConflictQueues(t *testing.T) {
+	s := NewSubagentScheduler(4, 2)
+	root := t.TempDir()
+	claim, err := NormalizeWritePaths(root, []string{"a.md"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	release, err := s.Acquire(context.Background(), AcquireRequest{Writer: true, WritePaths: claim})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	// Same path cannot start while the first claim is held — with Nested it fails.
+	_, err = s.Acquire(ctx, AcquireRequest{Writer: true, WritePaths: claim, Nested: true})
+	if err == nil {
+		t.Fatal("expected path conflict for nested acquire")
+	}
+	release()
+
+	// After release, same path is free.
+	release2, err := s.Acquire(context.Background(), AcquireRequest{Writer: true, WritePaths: claim})
+	if err != nil {
+		t.Fatal(err)
+	}
+	release2()
+}
+
+func TestSchedulerTryClaimWritePaths(t *testing.T) {
+	s := NewSubagentScheduler(4, 2)
+	root := t.TempDir()
+	claim, _ := NormalizeWritePaths(root, []string{"a.md"})
+	release, err := s.Acquire(context.Background(), AcquireRequest{Writer: true, WritePaths: claim})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer release()
+	if err := s.TryClaimWritePaths(claim); err == nil {
+		t.Fatal("parent should see active claim")
+	}
+	other, _ := NormalizeWritePaths(root, []string{"b.md"})
+	if err := s.TryClaimWritePaths(other); err != nil {
+		t.Fatalf("disjoint claim should be free: %v", err)
+	}
+}
diff --git a/internal/agent/subagent_registry_test.go b/internal/agent/subagent_registry_test.go
index b9bd6173d2..0d9a21f99e 100644
--- a/internal/agent/subagent_registry_test.go
+++ b/internal/agent/subagent_registry_test.go
@@ -37,6 +37,7 @@ func TestSubagentToolRegistryFiltersUnavailableToolsAndWrapsBash(t *testing.T) {
 		"task",
 		"read_only_task",
 		"parallel_tasks",
+		"fleet",
 		"run_skill",
 		"read_only_skill",
 		"read_skill",
@@ -64,6 +65,7 @@ func TestSubagentToolRegistryFiltersUnavailableToolsAndWrapsBash(t *testing.T) {
 		"task",
 		"read_only_task",
 		"parallel_tasks",
+		"fleet",
 		"run_skill",
 		"read_only_skill",
 		"install_skill",
@@ -213,6 +215,7 @@ func TestTaskToolBuildSubRegUsesSubagentToolRegistry(t *testing.T) {
 	parent.Add(subagentRegistryTool{name: "read_only_task"})
 	parent.Add(subagentRegistryTool{name: "read_only_skill", readOnly: true})
 	parent.Add(subagentRegistryTool{name: "parallel_tasks"})
+	parent.Add(subagentRegistryTool{name: "fleet"})
 	parent.Add(subagentRegistryTool{name: "wait"})
 	parent.Add(subagentRegistryTool{
 		name:   "bash",
@@ -226,14 +229,14 @@ func TestTaskToolBuildSubRegUsesSubagentToolRegistry(t *testing.T) {
 			t.Fatalf("first-layer subagent registry should expose %q; got %v", exposed, firstLayer.Names())
 		}
 	}
-	for _, hidden := range []string{"parallel_tasks", "wait"} {
+	for _, hidden := range []string{"parallel_tasks", "fleet", "wait"} {
 		if _, ok := firstLayer.Get(hidden); ok {
 			t.Fatalf("first-layer subagent registry should hide %q; got %v", hidden, firstLayer.Names())
 		}
 	}
 
 	sub := task.buildSubReg(nil, 2)
-	for _, hidden := range []string{"task", "read_only_task", "read_only_skill", "parallel_tasks", "wait"} {
+	for _, hidden := range []string{"task", "read_only_task", "read_only_skill", "parallel_tasks", "fleet", "wait"} {
 		if _, ok := sub.Get(hidden); ok {
 			t.Fatalf("depth-limited subagent registry should hide %q; got %v", hidden, sub.Names())
 		}
diff --git a/internal/agent/task.go b/internal/agent/task.go
index 1c1a656dc3..d54fe9deef 100644
--- a/internal/agent/task.go
+++ b/internal/agent/task.go
@@ -60,6 +60,7 @@ var subagentRecursiveTools = []string{
 
 var subagentAlwaysHiddenTools = []string{
 	"parallel_tasks",
+	"fleet",
 	"install_skill",
 	"install_source",
 }
@@ -76,13 +77,10 @@ var readOnlySubagentWorkflowTools = []string{
 
 const subagentToolBoundarySummary = "Recursive agent/skill tools are exposed only while max_subagent_depth leaves another delegation layer; unsupported background job tools (parallel_tasks, wait, bash_output, kill_shell) are excluded; bash is exposed as foreground-only inside subagents."
 
-// maxConcurrentBackgroundTasks bounds writer-capable background sub-agents per
-// session. They all mutate the same workspace (there is no worktree isolation),
-// so a wide fan-out risks conflicting concurrent writes — and feeds the failure
-// cascade where every "needs attention" notice tempts the model into spawning
-// yet more repair tasks. Further sub-tasks can run in the foreground, or start
-// once a running job is collected with wait.
-const maxConcurrentBackgroundTasks = 3
+// maxConcurrentBackgroundTasks is the legacy writer-background fallback used
+// only when a TaskTool has no session scheduler (tests). Production boots
+// inject MaxParallelWriters via SubagentScheduler.
+const maxConcurrentBackgroundTasks = DefaultMaxParallelWriters
 
 // AlwaysHiddenSubagentTools returns the tool names excluded from every
 // subagent's registry regardless of an explicit allowlist or delegation
@@ -233,6 +231,19 @@ type TaskTool struct {
 	maxSubagentDepth    int
 	deliveryProfile     bool
 	workspaceLease      *workspacelease.Owner
+	// scheduler is the session-scoped concurrency + write-claim controller.
+	// nil falls back to the legacy jobs.ReserveStart cap for background tasks.
+	scheduler *SubagentScheduler
+	// profileLookup resolves profile= names from the live Skill store without
+	// embedding the name list in the tool schema (cache stability).
+	profileLookup ProfileLookup
+	// profileConfigModel/Effort look up persistent per-profile overrides
+	// (agent.subagent_models / subagent_efforts).
+	profileConfigModel  func(profile string) string
+	profileConfigEffort func(profile string) string
+	// bashSandboxEnforced reports whether OS sandbox can honour write roots
+	// for bash inside path-bound writer sub-agents.
+	bashSandboxEnforced func() bool
 }
 
 // NewTaskTool wires a task tool to the parent agent's environment so its
@@ -308,10 +319,46 @@ func (t *TaskTool) WithWorkspaceLease(owner *workspacelease.Owner) *TaskTool {
 	return t
 }
 
+// WithScheduler attaches the session-scoped concurrency and write-claim
+// controller used by task, fleet, parallel_tasks, and profile skill runners.
+func (t *TaskTool) WithScheduler(s *SubagentScheduler) *TaskTool {
+	t.scheduler = s
+	return t
+}
+
+// Scheduler returns the attached session scheduler (may be nil in unit tests).
+func (t *TaskTool) Scheduler() *SubagentScheduler {
+	if t == nil {
+		return nil
+	}
+	return t.scheduler
+}
+
+// WithProfileLookup enables task/fleet profile= resolution from the Skill store.
+func (t *TaskTool) WithProfileLookup(lookup ProfileLookup) *TaskTool {
+	t.profileLookup = lookup
+	return t
+}
+
+// WithProfileConfigResolvers supplies persistent per-profile model/effort
+// overrides (agent.subagent_models / subagent_efforts).
+func (t *TaskTool) WithProfileConfigResolvers(model, effort func(profile string) string) *TaskTool {
+	t.profileConfigModel = model
+	t.profileConfigEffort = effort
+	return t
+}
+
+// WithBashSandboxEnforced tells path-bound writer runs whether bash can keep
+// the same write roots under the OS sandbox.
+func (t *TaskTool) WithBashSandboxEnforced(fn func() bool) *TaskTool {
+	t.bashSandboxEnforced = fn
+	return t
+}
+
 func (t *TaskTool) Name() string { return "task" }
 
 func (t *TaskTool) Description() string {
-	return "Spawn a sub-agent for a focused sub-task. The sub-agent runs in its own session with the same provider and a filtered tool list (defaults to every parent tool, then applies the subagent boundary: " + subagentToolBoundarySummary + "). Only its final answer is returned. Use this to (a) keep long exploration sequences out of the parent's context budget, or (b) delegate self-contained work like 'find every place that calls X and summarise the patterns'."
+	return "Spawn a sub-agent for a focused sub-task. Optional profile selects a runAs=subagent Skill whose body becomes the full system prompt (no implicit concise default). Optional write_paths declare non-overlapping write targets so background writers may run in parallel; omitting write_paths on a writer claims the whole workspace and serializes writers. The sub-agent runs in its own session with a filtered tool list (defaults to every parent tool, then applies the subagent boundary: " + subagentToolBoundarySummary + "). Only its final answer is returned."
 }
 
 func (t *TaskTool) Schema() json.RawMessage {
@@ -320,11 +367,13 @@ func (t *TaskTool) Schema() json.RawMessage {
 "properties":{
   "prompt":{"type":"string","description":"What the sub-agent should accomplish. Be specific about the deliverable — the sub-agent does not see this conversation."},
   "description":{"type":"string","description":"Short label for the sub-task (3-7 words). Surfaced in the dispatch line so the user sees what's running."},
-  "tools":{"type":"array","items":{"type":"string"},"description":"Optional tool whitelist. ` + subagentToolBoundarySummary + `"},
+  "profile":{"type":"string","description":"Optional runAs=subagent profile name. Resolved at runtime from the Skill store; explicit names may invoke invocation=manual profiles. The profile body becomes the full system prompt."},
+  "write_paths":{"type":"array","items":{"type":"string"},"description":"Optional workspace-relative or absolute file/directory paths this writer may modify. Globs and workspace escapes are rejected. Writers without write_paths claim the whole workspace (serializing against every other writer claim). Non-overlapping paths allow parallel writers up to max_parallel_writers. In fleet, multiple whole-workspace claims fail preflight before any task starts."},
+  "tools":{"type":"array","items":{"type":"string"},"description":"Optional tool whitelist. When profile sets allowed-tools, this list is intersected (call args cannot expand profile permissions). ` + subagentToolBoundarySummary + `"},
   "max_steps":{"type":"integer","description":"Optional cap on tool-call rounds. Defaults to half the parent's cap (min 5).","minimum":1},
   "run_in_background":{"type":"boolean","description":"Run the sub-agent asynchronously: returns a job id immediately and keeps working across turns. Collect its final answer with wait, and you'll be notified when it finishes. Use for long, independent sub-tasks you don't need to block on right now."},
-  "model":{"type":"string","description":"Optional model override for the sub-agent (a configured provider/model name)."},
-  "effort":{"type":"string","description":"Optional reasoning effort for the sub-agent (e.g. high, max)."},
+  "model":{"type":"string","description":"Optional model override for the sub-agent (a configured provider/model name). Precedence: persistent profile config, this argument, profile frontmatter, global subagent default, parent model."},
+  "effort":{"type":"string","description":"Optional reasoning effort for the sub-agent (e.g. high, max). Same precedence as model."},
   "continue_from":{"type":"string","description":"Continue a prior compatible subagent transcript in the current conversation context. Pass only the 'sa_...' value from the prior result's 'Subagent reference: ...' line. If the ref belongs to an ancestor conversation, the framework continues a current-conversation copy."}
 },
 "required":["prompt"]
@@ -336,16 +385,37 @@ func (t *TaskTool) Schema() json.RawMessage {
 // running two sub-agents at once and letting their writes race.
 func (t *TaskTool) ReadOnly() bool { return false }
 
-// ResolveProfile extracts model/effort from task args and applies config defaults.
+// ResolveProfile extracts model/effort from task args (and optional profile
+// overrides) for dispatch-line display. Runtime execution re-resolves with the
+// full precedence chain.
 func (t *TaskTool) ResolveProfile(args json.RawMessage) *event.Profile {
 	var p struct {
-		Model  string `json:"model"`
-		Effort string `json:"effort"`
+		Model   string `json:"model"`
+		Effort  string `json:"effort"`
+		Profile string `json:"profile"`
 	}
 	if err := json.Unmarshal(args, &p); err != nil {
 		return nil
 	}
-	model, effort := t.effectiveProfile(p.Model, p.Effort)
+	profileModel, profileEffort := "", ""
+	configModel, configEffort := "", ""
+	if name := strings.TrimSpace(p.Profile); name != "" {
+		if def, err := ResolveProfileDefinition(t.profileLookup, name); err == nil {
+			profileModel, profileEffort = def.Model, def.Effort
+		}
+		if t.profileConfigModel != nil {
+			configModel = t.profileConfigModel(name)
+		}
+		if t.profileConfigEffort != nil {
+			configEffort = t.profileConfigEffort(name)
+		}
+	}
+	model, effort := ResolveModelEffort(
+		configModel, configEffort,
+		p.Model, p.Effort,
+		profileModel, profileEffort,
+		t.subagentModel, t.subagentEffort,
+	)
 	if model == "" && effort == "" {
 		return nil
 	}
@@ -417,6 +487,18 @@ func (r *ReadOnlyTaskTool) Execute(ctx context.Context, args json.RawMessage) (s
 		return "", fmt.Errorf("prompt is required")
 	}
 
+	// Ordinary read_only_task keeps the concise default system prompt and does
+	// not accept profile/write_paths (use fleet with read_only for those).
+	releaseSlot, err := r.task.acquireSlot(ctx, AcquireRequest{
+		Writer: false,
+		Nested: SubagentDepth(ctx) > 0,
+		Label:  firstNonEmpty(p.Description, "read_only_task"),
+	})
+	if err != nil {
+		return "", err
+	}
+	defer releaseSlot()
+
 	maxSteps := r.task.childMaxSteps(p.MaxSteps)
 
 	childDepth, err := r.task.nextSubagentDepth(ctx)
@@ -476,6 +558,8 @@ func (t *TaskTool) Execute(ctx context.Context, args json.RawMessage) (string, e
 	var p struct {
 		Prompt          string   `json:"prompt"`
 		Description     string   `json:"description"`
+		Profile         string   `json:"profile"`
+		WritePaths      []string `json:"write_paths"`
 		Tools           []string `json:"tools"`
 		MaxSteps        int      `json:"max_steps"`
 		RunInBackground bool     `json:"run_in_background"`
@@ -487,20 +571,155 @@ func (t *TaskTool) Execute(ctx context.Context, args json.RawMessage) (string, e
 	if err := json.Unmarshal(args, &p); err != nil {
 		return "", fmt.Errorf("invalid args: %w", err)
 	}
-	if p.Prompt == "" {
+	if strings.TrimSpace(p.Prompt) == "" {
 		return "", fmt.Errorf("prompt is required")
 	}
 
-	maxSteps := t.childMaxSteps(p.MaxSteps)
+	spec, err := t.buildTaskSpec(ctx, p.Prompt, p.Description, p.Profile, p.WritePaths, p.Tools, p.MaxSteps, p.Model, p.Effort, p.ContinueFrom, p.ForkFrom, p.RunInBackground, false)
+	if err != nil {
+		return "", err
+	}
+	return t.RunProfileSpec(ctx, spec)
+}
+
+// buildTaskSpec resolves profile, tools, model/effort, and write claims for a
+// single task/fleet item. forceReadOnly forces the read-only registry.
+func (t *TaskTool) buildTaskSpec(ctx context.Context, prompt, description, profile string, writePaths, tools []string, maxSteps int, model, effort, continueFrom, forkFrom string, background, forceReadOnly bool) (ProfileExecSpec, error) {
+	spec := ProfileExecSpec{
+		Kind:            "task",
+		Name:            "task",
+		Prompt:          prompt,
+		Description:     description,
+		CallTools:       tools,
+		MaxSteps:        maxSteps,
+		ContinueFrom:    strings.TrimSpace(continueFrom),
+		ForkFrom:        strings.TrimSpace(forkFrom),
+		RunInBackground: background,
+		Nested:          SubagentDepth(ctx) > 0,
+		SystemPrompt:    t.sysPrompt,
+	}
+	profile = strings.TrimSpace(profile)
+	readOnly := forceReadOnly
+	var profileTools []string
+	var profileModel, profileEffort string
+	if profile != "" {
+		def, err := ResolveProfileDefinition(t.profileLookup, profile)
+		if err != nil {
+			return ProfileExecSpec{}, err
+		}
+		spec.Profile = def.Name
+		spec.Name = def.Name
+		spec.Kind = "skill"
+		spec.SystemPrompt = def.Body
+		spec.UseProfilePrompt = true
+		profileTools = def.AllowedTools
+		profileModel, profileEffort = def.Model, def.Effort
+		if def.ReadOnly {
+			readOnly = true
+		}
+	}
+	spec.ReadOnly = readOnly
+	spec.ProfileTools = profileTools
 
+	configModel, configEffort := "", ""
+	if profile != "" {
+		if t.profileConfigModel != nil {
+			configModel = t.profileConfigModel(profile)
+		}
+		if t.profileConfigEffort != nil {
+			configEffort = t.profileConfigEffort(profile)
+		}
+	}
+	spec.Model, spec.Effort = ResolveModelEffort(
+		configModel, configEffort,
+		model, effort,
+		profileModel, profileEffort,
+		t.subagentModel, t.subagentEffort,
+	)
+
+	if !readOnly {
+		// Every writer carries a claim. Omitting write_paths conservatively claims
+		// the whole workspace, including foreground task calls, so they cannot
+		// bypass an already-running background/fleet writer claim. Direct legacy
+		// TaskTool constructions without a workspace/scheduler keep their old
+		// no-claim behavior; production boot always configures both.
+		requireClaim := t.scheduler != nil || strings.TrimSpace(t.workspaceRoot) != "" || background || len(writePaths) > 0
+		claims, err := t.resolveWriterClaims(writePaths, requireClaim)
+		if err != nil {
+			return ProfileExecSpec{}, err
+		}
+		spec.WritePaths = claims
+		if requireClaim && claims.Empty() {
+			return ProfileExecSpec{}, fmt.Errorf("writer claim resolved empty")
+		}
+	} else if len(writePaths) > 0 {
+		return ProfileExecSpec{}, fmt.Errorf("write_paths is not valid for read-only tasks")
+	}
+	return spec, nil
+}
+
+func (t *TaskTool) resolveWriterClaims(writePaths []string, requireClaim bool) (WritePathSet, error) {
+	if len(writePaths) > 0 {
+		return NormalizeWritePaths(t.workspaceRoot, writePaths)
+	}
+	if !requireClaim {
+		return WritePathSet{}, nil
+	}
+	return WholeWorkspaceWriteClaim(t.workspaceRoot)
+}
+
+// RunProfileSpec executes a unified profile/task specification. Shared by task,
+// fleet items, and boot-wired skill runners so prompt, tools, claims, and
+// scheduling cannot drift across entry points.
+func (t *TaskTool) RunProfileSpec(ctx context.Context, spec ProfileExecSpec) (string, error) {
+	if t == nil {
+		return "", fmt.Errorf("task tool is not configured")
+	}
+	if strings.TrimSpace(spec.Prompt) == "" {
+		return "", fmt.Errorf("prompt is required")
+	}
+	if strings.TrimSpace(spec.SystemPrompt) == "" {
+		if spec.UseProfilePrompt {
+			return "", fmt.Errorf("profile system prompt is empty")
+		}
+		spec.SystemPrompt = t.sysPrompt
+	}
+
+	maxSteps := t.childMaxSteps(spec.MaxSteps)
 	childDepth, err := t.nextSubagentDepth(ctx)
 	if err != nil {
 		return "", err
 	}
-	subReg := t.buildSubReg(p.Tools, childDepth)
-	modelRef, effortRef := t.effectiveProfile(p.Model, p.Effort)
+
+	toolNames, err := IntersectToolLists(t.parentReg, spec.ProfileTools, spec.CallTools)
+	if err != nil {
+		return "", err
+	}
+	var subReg *tool.Registry
+	if spec.ReadOnly {
+		subReg = ReadOnlySubagentToolRegistryForDepth(t.parentReg, toolNames, childDepth, t.maxDepth())
+		if subReg.Len() == 0 {
+			return "", fmt.Errorf("no read-only tools available for this sub-agent")
+		}
+	} else {
+		subReg = t.buildSubReg(toolNames, childDepth)
+		// Explicit paths are an execution boundary and rebind/drop tools that
+		// cannot honor it. A synthesized whole-workspace claim is a scheduling
+		// boundary for omitted write_paths; it preserves the legacy registry and
+		// the parent session's existing sandbox/permission boundaries.
+		if !spec.WritePaths.Empty() && !spec.WritePaths.WholeWorkspace {
+			keepBash := t.bashCanEnforceWriteRoots()
+			bound, removed := BindWritePaths(subReg, spec.WritePaths, t.workspaceRoot, keepBash)
+			subReg = bound
+			if len(removed) > 0 && subReg.Len() == 0 {
+				return "", fmt.Errorf("no path-bound write tools available after dropping unbound writers: %s", strings.Join(removed, ", "))
+			}
+		}
+	}
+
+	modelRef, effortRef := spec.Model, spec.Effort
 	parentID, parent, _, _ := CallContext(ctx)
-	run, err := t.prepareTranscriptRun(subReg, modelRef, effortRef, ParentSession(ctx), parentID, p.ContinueFrom, p.ForkFrom)
+	run, err := t.prepareTranscriptRunWithPrompt(subReg, modelRef, effortRef, ParentSession(ctx), parentID, spec.ContinueFrom, spec.ForkFrom, spec.SystemPrompt, spec.Kind, spec.Name)
 	if err != nil {
 		return "", err
 	}
@@ -510,39 +729,67 @@ func (t *TaskTool) Execute(ctx context.Context, args json.RawMessage) (string, e
 		return "", fmt.Errorf("sub-agent profile: %w", err)
 	}
 
-	// Background: register a job that runs the sub-agent under the manager's
-	// session context (so it survives this turn) and return immediately. The
-	// sub-agent's tool activity still streams, nested under this call, because the
-	// nested sink captures the parent ID + stream now (not from the job ctx).
-	if p.RunInBackground {
+	isWriter := !spec.ReadOnly
+	acquireReq := AcquireRequest{
+		Writer:     isWriter,
+		WritePaths: spec.WritePaths,
+		Nested:     spec.Nested,
+		Label:      firstNonEmpty(spec.Description, spec.Name, "task"),
+	}
+	// Defensive fallback for callers that manually construct a background spec
+	// instead of going through buildTaskSpec.
+	if isWriter && spec.WritePaths.Empty() && spec.RunInBackground {
+		whole, werr := WholeWorkspaceWriteClaim(t.workspaceRoot)
+		if werr != nil {
+			run.Release()
+			return "", werr
+		}
+		acquireReq.WritePaths = whole
+		spec.WritePaths = whole
+	}
+
+	runSession := func(runCtx context.Context, sink event.Sink) (string, error) {
+		if spec.ReadOnly {
+			return t.runReadOnlySubSession(runCtx, spec.Prompt, subReg, sink, maxSteps, prov, pricing, ctxWin, run.Session, childDepth)
+		}
+		return t.runSubSession(runCtx, spec.Prompt, subReg, sink, maxSteps, prov, pricing, ctxWin, run.Session, childDepth)
+	}
+
+	if spec.RunInBackground {
 		jm, ok := jobs.FromContext(ctx)
 		if !ok {
-			if run != nil {
-				run.Release()
-			}
+			run.Release()
 			return "", fmt.Errorf("background execution is not available in this context")
 		}
-		releaseStart, running, ok := jm.ReserveStartForSession(jobs.SessionFromContext(ctx), "task", maxConcurrentBackgroundTasks)
-		if !ok {
-			if run != nil {
+		// Legacy hard-cap remains only when no scheduler is attached. With a
+		// scheduler, return the job immediately and queue for a slot inside the
+		// job so the parent turn is not blocked at concurrency limits.
+		var releaseStart func()
+		if t.scheduler == nil {
+			var running int
+			var okReserve bool
+			releaseStart, running, okReserve = jm.ReserveStartForSession(jobs.SessionFromContext(ctx), "task", maxConcurrentBackgroundTasks)
+			if !okReserve {
 				run.Release()
+				return "", fmt.Errorf("%d background tasks are already running for this session (limit %d); collect their results with wait — or run this sub-task in the foreground — before starting more", running, maxConcurrentBackgroundTasks)
 			}
-			return "", fmt.Errorf("%d background tasks are already running for this session (limit %d); collect their results with wait — or run this sub-task in the foreground — before starting more", running, maxConcurrentBackgroundTasks)
+			defer releaseStart()
+		} else {
+			releaseStart = func() {}
 		}
-		defer releaseStart()
 		nested := subSinkFor(parentID, parent)
-		label := p.Description
-		if label == "" {
-			label = "task"
-		}
+		label := firstNonEmpty(spec.Description, spec.Name, "task")
 		if t.transcripts != nil && run != nil && run.Ref != "" {
 			if err := t.transcripts.MarkRunning(run); err != nil {
+				releaseStart()
 				run.Release()
 				return "", err
 			}
 		}
 		parentSession := ParentSession(ctx)
 		backgroundEvidence := evidence.NewLedger()
+		// Capture acquire request by value for the job goroutine.
+		slotReq := acquireReq
 		job := jm.StartForSession(jobs.SessionFromContext(ctx), "task", label, func(jobCtx context.Context, _ io.Writer) (result string, err error) {
 			jobCtx = WithParentSession(jobCtx, parentSession)
 			jobCtx = evidence.WithLedger(jobCtx, backgroundEvidence)
@@ -555,7 +802,14 @@ func (t *TaskTool) Execute(ctx context.Context, args json.RawMessage) (string, e
 					err = errors.Join(panicErr, t.transcripts.SaveFailed(run))
 				}
 			}()
-			answer, err := t.runSubSession(jobCtx, p.Prompt, subReg, nested, maxSteps, prov, pricing, ctxWin, run.Session, childDepth)
+			// Queue for a concurrency/write slot here — not before Start —
+			// so the parent tool call returns a job id immediately.
+			releaseSlot, slotErr := t.acquireSlot(jobCtx, slotReq)
+			if slotErr != nil {
+				return FormatSubagentRunResult("", run, true), errors.Join(slotErr, t.transcripts.SaveFailed(run))
+			}
+			defer releaseSlot()
+			answer, err := runSession(jobCtx, nested)
 			if err != nil {
 				return FormatSubagentRunResult("", run, true), errors.Join(err, t.transcripts.SaveFailed(run))
 			}
@@ -565,15 +819,25 @@ func (t *TaskTool) Execute(ctx context.Context, args json.RawMessage) (string, e
 			return FormatSubagentRunResult(answer, run, false), nil
 		})
 		releaseStart()
+		queuedNote := ""
+		if t.scheduler != nil {
+			queuedNote = " It may wait in the session queue until a concurrency/write slot is free."
+		}
 		if run != nil && run.Ref != "" {
-			return fmt.Sprintf("Started background task %q (%s).\n%s\nIt runs across turns; collect its final answer with wait (or wait will return it once done), and you'll be notified when it finishes.", job.ID, label, FormatSubagentReference(run)), nil
+			return fmt.Sprintf("Started background task %q (%s).%s\n%s\nIt runs across turns; collect its final answer with wait (or wait will return it once done), and you'll be notified when it finishes.", job.ID, label, queuedNote, FormatSubagentReference(run)), nil
 		}
-		return fmt.Sprintf("Started background task %q (%s). It runs across turns; collect its final answer with wait (or wait will return it once done), and you'll be notified when it finishes.", job.ID, label), nil
+		return fmt.Sprintf("Started background task %q (%s).%s It runs across turns; collect its final answer with wait (or wait will return it once done), and you'll be notified when it finishes.", job.ID, label, queuedNote), nil
 	}
 
-	// Foreground: run synchronously, nesting events under this call.
+	// Foreground: acquire a slot (queue if needed), then run synchronously.
+	releaseSlot, err := t.acquireSlot(ctx, acquireReq)
+	if err != nil {
+		run.Release()
+		return "", err
+	}
+	defer releaseSlot()
 	defer run.Release()
-	answer, err := t.runSubSession(ctx, p.Prompt, subReg, subSink(ctx), maxSteps, prov, pricing, ctxWin, run.Session, childDepth)
+	answer, err := runSession(ctx, subSink(ctx))
 	if err != nil {
 		return "", errors.Join(err, t.transcripts.SaveFailed(run))
 	}
@@ -586,36 +850,54 @@ func (t *TaskTool) Execute(ctx context.Context, args json.RawMessage) (string, e
 	return GuardSubagentHostDecisionText(answer), nil
 }
 
-func (t *TaskTool) prepareTranscriptRun(subReg *tool.Registry, modelRef, effortRef, parentSession, parentID, continueFrom, legacyForkFrom string) (*SubagentRun, error) {
+func (t *TaskTool) acquireSlot(ctx context.Context, req AcquireRequest) (func(), error) {
+	noop := func() {}
+	if t.scheduler == nil {
+		return noop, nil
+	}
+	return t.scheduler.Acquire(ctx, req)
+}
+
+func (t *TaskTool) bashCanEnforceWriteRoots() bool {
+	if t != nil && t.bashSandboxEnforced != nil {
+		return t.bashSandboxEnforced()
+	}
+	return false
+}
+
+func (t *TaskTool) prepareTranscriptRunWithPrompt(subReg *tool.Registry, modelRef, effortRef, parentSession, parentID, continueFrom, legacyForkFrom, systemPrompt, kind, name string) (*SubagentRun, error) {
 	continueFrom = strings.TrimSpace(continueFrom)
 	legacyForkFrom = strings.TrimSpace(legacyForkFrom)
 	parentSession = strings.TrimSpace(parentSession)
 	if continueFrom != "" && legacyForkFrom != "" {
 		return nil, fmt.Errorf("continue_from and fork_from are mutually exclusive; pass only continue_from")
 	}
-	// A task tool wired without a transcript store is a caller bug: fail loudly
-	// instead of silently dropping persistence (contract pinned since #3586).
 	if t.transcripts == nil {
 		return nil, fmt.Errorf("subagent transcript store is required")
 	}
-	// Headless runs (e.g. `reasonix run`) never mint a session path, so there is
-	// no parent session to own a transcript. Run the sub-agent ephemerally —
-	// exactly as before persisted transcripts existed — instead of failing the
-	// call. Continuation/fork need a persisted owner, so they error here.
+	if systemPrompt == "" {
+		systemPrompt = t.sysPrompt
+	}
+	if kind == "" {
+		kind = "task"
+	}
+	if name == "" {
+		name = "task"
+	}
 	if parentSession == "" {
 		if continueFrom != "" || legacyForkFrom != "" {
 			return nil, fmt.Errorf("subagent continuation requires a persisted session; none is active in this run")
 		}
-		return EphemeralSubagentRun(t.sysPrompt), nil
+		return EphemeralSubagentRun(systemPrompt), nil
 	}
 	identityModel, identityEffort := t.effectiveIdentity(modelRef, effortRef)
 	spec := SubagentSpec{
-		Kind:             "task",
-		Name:             "task",
+		Kind:             kind,
+		Name:             name,
 		WorkspaceRoot:    t.workspaceRoot,
 		ParentSession:    parentSession,
 		ParentToolCallID: parentID,
-		SystemPrompt:     t.sysPrompt,
+		SystemPrompt:     systemPrompt,
 		Registry:         subReg,
 		Model:            identityModel,
 		Effort:           identityEffort,
diff --git a/internal/agent/task_background_queue_test.go b/internal/agent/task_background_queue_test.go
new file mode 100644
index 0000000000..d24ce05651
--- /dev/null
+++ b/internal/agent/task_background_queue_test.go
@@ -0,0 +1,85 @@
+package agent
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"reasonix/internal/event"
+	"reasonix/internal/jobs"
+	"reasonix/internal/provider"
+	"reasonix/internal/tool"
+)
+
+// TestBackgroundTaskReturnsBeforeSlotFrees ensures run_in_background returns a
+// job id even when the session concurrency pool is full, instead of blocking
+// the parent tool call on Acquire.
+func TestBackgroundTaskReturnsBeforeSlotFrees(t *testing.T) {
+	root := t.TempDir()
+	sched := NewSubagentScheduler(1, 1)
+	// Hold the only slot.
+	holdRelease, err := sched.Acquire(context.Background(), AcquireRequest{Writer: false})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	started := make(chan struct{})
+	prov := &blockingProvider{started: started}
+	jm := jobs.NewManager(event.Discard)
+	ctx := jobs.WithManager(withCallContext(context.Background(), "bg", event.Discard, nil, false), jm)
+	ctx = WithParentSession(ctx, "sess-bg")
+
+	task := NewTaskTool(prov, nil, tool.NewRegistry(), 20, 0, 0, 0, 0, 0, 0, 0.0, "", "sys", nil, 0, "", "", nil).
+		WithTranscripts(mustSubagentStore(t), root, "base", "high").
+		WithScheduler(sched)
+
+	done := make(chan string, 1)
+	go func() {
+		out, err := task.Execute(ctx, json.RawMessage(`{"prompt":"work","run_in_background":true,"description":"queued"}`))
+		if err != nil {
+			done <- "err:" + err.Error()
+			return
+		}
+		done <- out
+	}()
+
+	select {
+	case out := <-done:
+		if !strings.Contains(out, "Started background task") {
+			t.Fatalf("want immediate job start, got %q", out)
+		}
+		if !strings.Contains(out, "queue") {
+			t.Fatalf("want queue note in background start message, got %q", out)
+		}
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("background task blocked on concurrency slot instead of returning a job id")
+	}
+
+	// Free the slot so the background job can finish (and not leak).
+	holdRelease()
+	select {
+	case <-started:
+	case <-time.After(2 * time.Second):
+		t.Fatal("background job never acquired slot / started provider")
+	}
+	// Drain job manager briefly.
+	time.Sleep(50 * time.Millisecond)
+}
+
+type blockingProvider struct {
+	started chan struct{}
+	once    sync.Once
+}
+
+func (p *blockingProvider) Name() string { return "blocking" }
+
+func (p *blockingProvider) Stream(_ context.Context, _ provider.Request) (<-chan provider.Chunk, error) {
+	p.once.Do(func() { close(p.started) })
+	ch := make(chan provider.Chunk, 1)
+	ch <- provider.Chunk{Type: provider.ChunkText, Text: "done"}
+	close(ch)
+	return ch, nil
+}
diff --git a/internal/agent/task_profile_test.go b/internal/agent/task_profile_test.go
new file mode 100644
index 0000000000..ebea562159
--- /dev/null
+++ b/internal/agent/task_profile_test.go
@@ -0,0 +1,129 @@
+package agent
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"reasonix/internal/event"
+	"reasonix/internal/provider"
+	"reasonix/internal/tool"
+)
+
+func TestTaskSchemaIncludesProfileAndWritePaths(t *testing.T) {
+	task := NewTaskTool(&mockProvider{name: "sub"}, nil, tool.NewRegistry(), 20, 0, 0, 0, 0, 0, 0, 0.0, "", "sys", nil, 0, "", "", nil)
+	schema := string(task.Schema())
+	for _, want := range []string{`"profile"`, `"write_paths"`} {
+		if !strings.Contains(schema, want) {
+			t.Fatalf("schema missing %s", want)
+		}
+	}
+	// No dynamic profile enum.
+	if strings.Contains(schema, `"enum"`) {
+		t.Fatalf("profile names must not be enum'd in schema: %s", schema)
+	}
+}
+
+func TestTaskWriterWithoutPathsClaimsWholeWorkspace(t *testing.T) {
+	root := t.TempDir()
+	task := NewTaskTool(&mockProvider{name: "sub"}, nil, tool.NewRegistry(), 20, 0, 0, 0, 0, 0, 0, 0.0, "", "sys", nil, 0, "", "", nil).
+		WithTranscripts(mustSubagentStore(t), root, "base", "high").
+		WithScheduler(NewSubagentScheduler(6, 3))
+
+	spec, err := task.buildTaskSpec(context.Background(), "rewrite docs", "", "", nil, nil, 0, "", "", "", "", false, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !spec.WritePaths.WholeWorkspace || spec.WritePaths.WorkspaceRoot == "" {
+		t.Fatalf("writer without write_paths must claim the workspace, got %+v", spec.WritePaths)
+	}
+}
+
+func TestTaskUnknownProfileRejected(t *testing.T) {
+	root := t.TempDir()
+	task := NewTaskTool(&mockProvider{name: "sub"}, nil, tool.NewRegistry(), 20, 0, 0, 0, 0, 0, 0, 0.0, "", "sys", nil, 0, "", "", nil).
+		WithTranscripts(mustSubagentStore(t), root, "base", "high").
+		WithProfileLookup(func(string) (ProfileDefinition, bool) { return ProfileDefinition{}, false })
+	_, err := task.Execute(withCallContext(context.Background(), "c", event.Discard, nil, false),
+		json.RawMessage(`{"prompt":"x","profile":"nope"}`))
+	if err == nil || !strings.Contains(err.Error(), "unknown profile") {
+		t.Fatalf("err = %v", err)
+	}
+}
+
+func TestTaskProfileUsesBodyAsSystemPrompt(t *testing.T) {
+	root := t.TempDir()
+	var sawSystem string
+	prov := &captureSystemProvider{onReq: func(sys string) { sawSystem = sys }}
+	task := NewTaskTool(prov, nil, tool.NewRegistry(), 20, 0, 0, 0, 0, 0, 0, 0.0, "", DefaultTaskSystemPrompt, nil, 0, "", "", nil).
+		WithTranscripts(mustSubagentStore(t), root, "base", "high").
+		WithProfileLookup(func(name string) (ProfileDefinition, bool) {
+			if name != "doc-rewriter" {
+				return ProfileDefinition{}, false
+			}
+			return ProfileDefinition{Name: name, Body: "You rewrite docs carefully."}, true
+		})
+	_, err := task.Execute(withCallContext(context.Background(), "c", event.Discard, nil, false),
+		json.RawMessage(`{"prompt":"rewrite a.md","profile":"doc-rewriter"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(sawSystem, "You rewrite docs carefully.") {
+		t.Fatalf("system prompt = %q, want profile body", sawSystem)
+	}
+	if strings.Contains(sawSystem, "concise and self-contained") {
+		t.Fatalf("profile must not stack DefaultTaskSystemPrompt concise text: %q", sawSystem)
+	}
+}
+
+func TestTaskToolsIntersectionCannotExpand(t *testing.T) {
+	root := t.TempDir()
+	task := NewTaskTool(&mockProvider{name: "sub"}, nil, tool.NewRegistry(), 20, 0, 0, 0, 0, 0, 0, 0.0, "", "sys", nil, 0, "", "", nil).
+		WithTranscripts(mustSubagentStore(t), root, "base", "high").
+		WithProfileLookup(func(name string) (ProfileDefinition, bool) {
+			return ProfileDefinition{Name: name, Body: "body", AllowedTools: []string{"read_file"}}, true
+		})
+	_, err := task.Execute(withCallContext(context.Background(), "c", event.Discard, nil, false),
+		json.RawMessage(`{"prompt":"x","profile":"p","tools":["write_file"]}`))
+	if err == nil || !strings.Contains(err.Error(), "intersection") {
+		t.Fatalf("err = %v", err)
+	}
+}
+
+func TestTaskResolveProfilePrecedence(t *testing.T) {
+	task := NewTaskTool(&mockProvider{name: "sub"}, nil, tool.NewRegistry(), 20, 0, 0, 0, 0, 0, 0, 0.0, "", "sys", nil, 0, "global-m", "global-e", nil).
+		WithProfileLookup(func(name string) (ProfileDefinition, bool) {
+			return ProfileDefinition{Name: name, Body: "b", Model: "front-m", Effort: "front-e"}, true
+		}).
+		WithProfileConfigResolvers(
+			func(string) string { return "cfg-m" },
+			func(string) string { return "cfg-e" },
+		)
+	pr := task.ResolveProfile(json.RawMessage(`{"profile":"p","model":"call-m","effort":"call-e"}`))
+	if pr == nil || pr.Model != "cfg-m" || pr.Effort != "cfg-e" {
+		t.Fatalf("profile = %+v", pr)
+	}
+}
+
+// captureSystemProvider records the system prompt of the first request.
+type captureSystemProvider struct {
+	onReq func(system string)
+}
+
+func (p *captureSystemProvider) Name() string { return "capture-sys" }
+
+func (p *captureSystemProvider) Stream(_ context.Context, req provider.Request) (<-chan provider.Chunk, error) {
+	if p.onReq != nil {
+		for _, m := range req.Messages {
+			if m.Role == provider.RoleSystem {
+				p.onReq(m.Content)
+				break
+			}
+		}
+	}
+	ch := make(chan provider.Chunk, 1)
+	ch <- provider.Chunk{Type: provider.ChunkText, Text: "ok"}
+	close(ch)
+	return ch, nil
+}
diff --git a/internal/agent/write_claims.go b/internal/agent/write_claims.go
new file mode 100644
index 0000000000..1b333a3b55
--- /dev/null
+++ b/internal/agent/write_claims.go
@@ -0,0 +1,270 @@
+package agent
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+)
+
+// DefaultMaxSubagentConcurrency is the session-wide sub-agent concurrency
+// default (task, fleet items, profile skills, nested children).
+const DefaultMaxSubagentConcurrency = 6
+
+// DefaultMaxParallelWriters is the default cap on concurrent writer-capable
+// sub-agents that declare non-overlapping write_paths.
+const DefaultMaxParallelWriters = 3
+
+// MaxSubagentConcurrencyLimit is the upper bound for both concurrency knobs.
+const MaxSubagentConcurrencyLimit = 32
+
+// WritePathSet is a normalized claim over workspace paths a sub-agent may write.
+// WholeWorkspace is true when a writer-capable task omitted write_paths and
+// therefore claims the entire workspace (forcing writer serialization).
+type WritePathSet struct {
+	// Paths are absolute, cleaned, and symlink-resolved when possible.
+	Paths []string
+	// WholeWorkspace claims the entire workspace root.
+	WholeWorkspace bool
+	// WorkspaceRoot is the absolute workspace root used for WholeWorkspace claims.
+	WorkspaceRoot string
+}
+
+// Empty reports whether the set claims nothing (read-only work).
+func (s WritePathSet) Empty() bool {
+	return !s.WholeWorkspace && len(s.Paths) == 0
+}
+
+// NormalizeConcurrencyLimits clamps total/writer limits into the public range
+// 1–32 and ensures writers never exceed total. Zero inputs become defaults so
+// old configs stay at 6/3 without migration.
+func NormalizeConcurrencyLimits(total, writers int) (int, int) {
+	if total <= 0 {
+		total = DefaultMaxSubagentConcurrency
+	}
+	if writers <= 0 {
+		writers = DefaultMaxParallelWriters
+	}
+	if total > MaxSubagentConcurrencyLimit {
+		total = MaxSubagentConcurrencyLimit
+	}
+	if writers > MaxSubagentConcurrencyLimit {
+		writers = MaxSubagentConcurrencyLimit
+	}
+	if writers > total {
+		writers = total
+	}
+	return total, writers
+}
+
+// NormalizeWritePaths validates and normalizes declared write_paths against a
+// workspace root. It rejects globs, empty entries, workspace-escape paths, and
+// symlink escapes. An empty raw list yields an empty set (read-only / no claim).
+func NormalizeWritePaths(workspaceRoot string, raw []string) (WritePathSet, error) {
+	root, err := normalizeExistingRoot(workspaceRoot)
+	if err != nil {
+		return WritePathSet{}, err
+	}
+	if len(raw) == 0 {
+		return WritePathSet{}, nil
+	}
+	out := WritePathSet{WorkspaceRoot: root}
+	seen := map[string]bool{}
+	for i, entry := range raw {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			return WritePathSet{}, fmt.Errorf("write_paths[%d]: path is required", i)
+		}
+		if strings.ContainsAny(entry, "*?[") {
+			return WritePathSet{}, fmt.Errorf("write_paths[%d]: globs are not allowed (%q)", i, entry)
+		}
+		abs, err := resolveWriteClaimPath(root, entry)
+		if err != nil {
+			return WritePathSet{}, fmt.Errorf("write_paths[%d]: %w", i, err)
+		}
+		if !pathWithinFold(root, abs) {
+			return WritePathSet{}, fmt.Errorf("write_paths[%d]: path %q is outside the workspace", i, entry)
+		}
+		key := foldPathKey(abs)
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+		out.Paths = append(out.Paths, abs)
+	}
+	return out, nil
+}
+
+// WholeWorkspaceWriteClaim claims the entire workspace for a writer that did
+// not declare write_paths. Such tasks may only run serially among writers.
+func WholeWorkspaceWriteClaim(workspaceRoot string) (WritePathSet, error) {
+	root, err := normalizeExistingRoot(workspaceRoot)
+	if err != nil {
+		return WritePathSet{}, err
+	}
+	return WritePathSet{WholeWorkspace: true, WorkspaceRoot: root}, nil
+}
+
+// Overlaps reports whether two write claims conflict (identical, parent/child,
+// or case-equivalent on case-insensitive filesystems).
+func (s WritePathSet) Overlaps(other WritePathSet) bool {
+	if s.Empty() || other.Empty() {
+		return false
+	}
+	if s.WholeWorkspace || other.WholeWorkspace {
+		// Whole-workspace claims collide with every other writer claim that
+		// shares the same workspace root (or has an empty root).
+		if s.WorkspaceRoot == "" || other.WorkspaceRoot == "" {
+			return true
+		}
+		return pathWithinFold(s.WorkspaceRoot, other.WorkspaceRoot) ||
+			pathWithinFold(other.WorkspaceRoot, s.WorkspaceRoot)
+	}
+	for _, a := range s.Paths {
+		for _, b := range other.Paths {
+			if pathWithinFold(a, b) || pathWithinFold(b, a) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// ValidateNonOverlappingWriteClaims fails if any pair of claims overlaps.
+// Used by fleet preflight so no task starts when path division is invalid.
+func ValidateNonOverlappingWriteClaims(claims []WritePathSet) error {
+	for i := 0; i < len(claims); i++ {
+		if claims[i].Empty() {
+			continue
+		}
+		for j := i + 1; j < len(claims); j++ {
+			if claims[j].Empty() {
+				continue
+			}
+			if claims[i].Overlaps(claims[j]) {
+				return fmt.Errorf("write path conflict between task %d and task %d", i+1, j+1)
+			}
+		}
+	}
+	return nil
+}
+
+// AllowsPath reports whether target is inside this claim (for re-bound writers).
+func (s WritePathSet) AllowsPath(target string) bool {
+	if s.Empty() {
+		return false
+	}
+	abs, err := realPathForClaim(target)
+	if err != nil {
+		return false
+	}
+	if s.WholeWorkspace {
+		if s.WorkspaceRoot == "" {
+			return true
+		}
+		return pathWithinFold(s.WorkspaceRoot, abs)
+	}
+	for _, root := range s.Paths {
+		if pathWithinFold(root, abs) {
+			return true
+		}
+	}
+	return false
+}
+
+// Roots returns the concrete root list used to re-confine built-in writers and
+// bash sandbox WriteRoots. Whole-workspace claims return the workspace root.
+func (s WritePathSet) Roots() []string {
+	if s.WholeWorkspace {
+		if s.WorkspaceRoot == "" {
+			return nil
+		}
+		return []string{s.WorkspaceRoot}
+	}
+	return append([]string(nil), s.Paths...)
+}
+
+func normalizeExistingRoot(root string) (string, error) {
+	root = strings.TrimSpace(root)
+	if root == "" {
+		return "", fmt.Errorf("workspace root is required for write_paths")
+	}
+	abs, err := filepath.Abs(root)
+	if err != nil {
+		return "", fmt.Errorf("resolve workspace root: %w", err)
+	}
+	abs = filepath.Clean(abs)
+	real, err := filepath.EvalSymlinks(abs)
+	if err != nil {
+		// Workspace may not exist yet in some tests; keep cleaned abs.
+		return abs, nil
+	}
+	return real, nil
+}
+
+func resolveWriteClaimPath(workspaceRoot, raw string) (string, error) {
+	path := raw
+	if !filepath.IsAbs(path) {
+		path = filepath.Join(workspaceRoot, path)
+	}
+	return realPathForClaim(path)
+}
+
+// realPathForClaim mirrors the write-tool realPath helper: resolve the deepest
+// existing ancestor so a not-yet-created file claim still cannot escape via a
+// symlinked parent.
+func realPathForClaim(path string) (string, error) {
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return "", err
+	}
+	abs = filepath.Clean(abs)
+	tail := ""
+	cur := abs
+	for {
+		if real, err := filepath.EvalSymlinks(cur); err == nil {
+			return filepath.Join(real, tail), nil
+		}
+		parent := filepath.Dir(cur)
+		if parent == cur {
+			return abs, nil
+		}
+		// Reject intermediate symlink escapes when parent exists as a symlink
+		// that leaves the tree — EvalSymlinks failed on cur but may succeed on
+		// parent; loop continues.
+		info, err := os.Lstat(cur)
+		if err == nil && info.Mode()&os.ModeSymlink != 0 {
+			// Symlink that does not resolve — treat as escape risk.
+			return "", fmt.Errorf("cannot resolve symlink path %q", path)
+		}
+		tail = filepath.Join(filepath.Base(cur), tail)
+		cur = parent
+	}
+}
+
+func pathWithinFold(root, path string) bool {
+	if root == "" || path == "" {
+		return false
+	}
+	if foldPaths() {
+		root = strings.ToLower(root)
+		path = strings.ToLower(path)
+	}
+	rel, err := filepath.Rel(root, path)
+	if err != nil {
+		return false
+	}
+	return rel == "." || (rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)))
+}
+
+func foldPathKey(path string) string {
+	if foldPaths() {
+		return strings.ToLower(path)
+	}
+	return path
+}
+
+func foldPaths() bool {
+	return runtime.GOOS == "windows" || runtime.GOOS == "darwin"
+}
diff --git a/internal/agent/write_claims_test.go b/internal/agent/write_claims_test.go
new file mode 100644
index 0000000000..c6e7350135
--- /dev/null
+++ b/internal/agent/write_claims_test.go
@@ -0,0 +1,123 @@
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+)
+
+func TestNormalizeConcurrencyLimitsDefaults(t *testing.T) {
+	total, writers := NormalizeConcurrencyLimits(0, 0)
+	if total != DefaultMaxSubagentConcurrency || writers != DefaultMaxParallelWriters {
+		t.Fatalf("got %d/%d, want %d/%d", total, writers, DefaultMaxSubagentConcurrency, DefaultMaxParallelWriters)
+	}
+	total, writers = NormalizeConcurrencyLimits(10, 10)
+	if total != 10 || writers != 10 {
+		t.Fatalf("got %d/%d, want 10/10", total, writers)
+	}
+	total, writers = NormalizeConcurrencyLimits(4, 10)
+	if total != 4 || writers != 4 {
+		t.Fatalf("writers must not exceed total: got %d/%d", total, writers)
+	}
+	total, writers = NormalizeConcurrencyLimits(100, 50)
+	if total != MaxSubagentConcurrencyLimit || writers != MaxSubagentConcurrencyLimit {
+		t.Fatalf("clamp: got %d/%d", total, writers)
+	}
+}
+
+func TestNormalizeWritePathsRejectsGlobsAndEscape(t *testing.T) {
+	root := t.TempDir()
+	if _, err := NormalizeWritePaths(root, []string{"docs/*.md"}); err == nil {
+		t.Fatal("expected glob rejection")
+	}
+	outside := filepath.Join(filepath.Dir(root), "outside.txt")
+	if _, err := NormalizeWritePaths(root, []string{outside}); err == nil {
+		t.Fatal("expected workspace escape rejection")
+	}
+	// Relative file is fine even if it does not exist yet.
+	got, err := NormalizeWritePaths(root, []string{"docs/01.md"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Paths) != 1 {
+		t.Fatalf("paths = %v", got.Paths)
+	}
+	if !filepath.IsAbs(got.Paths[0]) {
+		t.Fatalf("expected absolute path, got %q", got.Paths[0])
+	}
+}
+
+func TestWritePathOverlapParentChildAndCase(t *testing.T) {
+	root := t.TempDir()
+	a, err := NormalizeWritePaths(root, []string{"docs"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := NormalizeWritePaths(root, []string{"docs/01.md"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !a.Overlaps(b) {
+		t.Fatal("parent/child must overlap")
+	}
+	c, err := NormalizeWritePaths(root, []string{"other.md"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a.Overlaps(c) {
+		t.Fatal("disjoint paths must not overlap")
+	}
+	if runtime.GOOS == "darwin" || runtime.GOOS == "windows" {
+		// Case-variant of the same relative path should collide.
+		upper := filepath.Join(root, "Docs")
+		_ = os.MkdirAll(upper, 0o755)
+		d, err := NormalizeWritePaths(root, []string{"Docs"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		e, err := NormalizeWritePaths(root, []string{"docs"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !d.Overlaps(e) {
+			t.Fatal("case-equivalent paths must overlap on this platform")
+		}
+	}
+	whole, err := WholeWorkspaceWriteClaim(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !whole.Overlaps(c) {
+		t.Fatal("whole workspace must overlap any path claim")
+	}
+}
+
+func TestValidateNonOverlappingWriteClaims(t *testing.T) {
+	root := t.TempDir()
+	a, _ := NormalizeWritePaths(root, []string{"a.md"})
+	b, _ := NormalizeWritePaths(root, []string{"b.md"})
+	if err := ValidateNonOverlappingWriteClaims([]WritePathSet{a, b}); err != nil {
+		t.Fatal(err)
+	}
+	c, _ := NormalizeWritePaths(root, []string{"a.md"})
+	if err := ValidateNonOverlappingWriteClaims([]WritePathSet{a, c}); err == nil {
+		t.Fatal("expected conflict")
+	}
+}
+
+func TestWritePathSetAllowsPath(t *testing.T) {
+	root := t.TempDir()
+	claim, err := NormalizeWritePaths(root, []string{"docs"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	inside := filepath.Join(root, "docs", "x.md")
+	if !claim.AllowsPath(inside) {
+		t.Fatalf("should allow %s", inside)
+	}
+	outside := filepath.Join(root, "other.md")
+	if claim.AllowsPath(outside) {
+		t.Fatalf("should reject %s", outside)
+	}
+}
diff --git a/internal/boot/boot.go b/internal/boot/boot.go
index 1035533a15..1d94cb944d 100644
--- a/internal/boot/boot.go
+++ b/internal/boot/boot.go
@@ -771,6 +771,45 @@ func Build(ctx context.Context, opts Options) (*control.Controller, error) {
 	taskModel := firstNonEmpty(cfg.Agent.SubagentModels["task"], cfg.Agent.SubagentModel)
 	taskEffort := firstNonEmpty(cfg.Agent.SubagentEfforts["task"], cfg.Agent.SubagentEffort)
 	maxSubagentDepth := agent.NormalizeMaxSubagentDepth(cfg.Agent.MaxSubagentDepth)
+	maxSubagentConcurrency, maxParallelWriters := agent.NormalizeConcurrencyLimits(
+		cfg.Agent.MaxSubagentConcurrency, cfg.Agent.MaxParallelWriters,
+	)
+	subagentScheduler := agent.NewSubagentScheduler(maxSubagentConcurrency, maxParallelWriters)
+	profileLookup := func(name string) (agent.ProfileDefinition, bool) {
+		sk, ok := skillStore.Read(name)
+		if !ok || sk.RunAs != skill.RunSubagent {
+			return agent.ProfileDefinition{}, false
+		}
+		return agent.ProfileDefinition{
+			Name:         sk.Name,
+			Body:         sk.Body,
+			AllowedTools: sk.AllowedTools,
+			Model:        sk.Model,
+			Effort:       sk.Effort,
+			ReadOnly:     sk.ReadOnly,
+			Invocation:   sk.Invocation,
+			NamedBuiltin: agent.NamedBuiltinProfile(sk.Name),
+		}, true
+	}
+	profileConfigModel := func(profile string) string {
+		for _, key := range SubagentModelKeys(profile) {
+			if m := strings.TrimSpace(cfg.Agent.SubagentModels[key]); m != "" {
+				return m
+			}
+		}
+		return ""
+	}
+	profileConfigEffort := func(profile string) string {
+		for _, key := range SubagentModelKeys(profile) {
+			if e := strings.TrimSpace(cfg.Agent.SubagentEfforts[key]); e != "" {
+				return e
+			}
+		}
+		return ""
+	}
+	bashSandboxEnforced := func() bool {
+		return bashSpec.Enforce()
+	}
 	taskToolAdded := false
 	readOnlyTaskToolAdded := false
 	var taskTool *agent.TaskTool
@@ -784,7 +823,11 @@ func Build(ctx context.Context, opts Options) (*control.Controller, error) {
 			WithTranscriptIdentityResolver(subagentIdentity).
 			WithMaxSubagentDepth(maxSubagentDepth).
 			WithDeliveryProfile(tokenDelivery).
-			WithWorkspaceLease(workspaceLease)
+			WithWorkspaceLease(workspaceLease).
+			WithScheduler(subagentScheduler).
+			WithProfileLookup(profileLookup).
+			WithProfileConfigResolvers(profileConfigModel, profileConfigEffort).
+			WithBashSandboxEnforced(bashSandboxEnforced)
 	}
 	addTaskTool := func() string {
 		if taskToolAdded {
@@ -794,8 +837,11 @@ func Build(ctx context.Context, opts Options) (*control.Controller, error) {
 		if taskTool == nil {
 			taskTool = newTaskTool()
 		}
+		// Fixed registration order for prompt-cache stability: task →
+		// parallel_tasks → fleet. Profile names never enter tool schemas.
 		reg.Add(taskTool)
 		reg.Add(agent.NewParallelTasksTool(taskTool, reg))
+		reg.Add(agent.NewFleetTool(taskTool))
 		return "enabled task."
 	}
 	addReadOnlyTaskTool := func() string {
@@ -887,6 +933,15 @@ func Build(ctx context.Context, opts Options) (*control.Controller, error) {
 		if strings.TrimSpace(runOpts.ContinueFrom) != "" || strings.TrimSpace(runOpts.ForkFrom) != "" {
 			return "", fmt.Errorf("read_only_skill does not support continue_from/fork_from")
 		}
+		releaseSlot, err := subagentScheduler.Acquire(sctx, agent.AcquireRequest{
+			Writer: false,
+			Nested: agent.SubagentDepth(sctx) > 0,
+			Label:  sk.Name,
+		})
+		if err != nil {
+			return "", err
+		}
+		defer releaseSlot()
 		sk = skill.WithCodeGraphTools(sk, skill.CodeGraphReadTools(reg))
 		prov, price, ctxWin := execProv, entry.Price, entry.ContextWindow
 		modelRef := subagentModelRef(cfg, sk)
@@ -916,7 +971,12 @@ func Build(ctx context.Context, opts Options) (*control.Controller, error) {
 				steps = 5
 			}
 		}
-		sysPrompt := agent.DefaultReadOnlyTaskSystemPrompt + "\n\nSkill instructions:\n" + sk.Body
+		// Custom and named built-in profiles fully control their system prompt
+		// (no implicit concise/DefaultReadOnlyTaskSystemPrompt overlay).
+		sysPrompt := strings.TrimSpace(sk.Body)
+		if sysPrompt == "" {
+			sysPrompt = agent.DefaultReadOnlyTaskSystemPrompt
+		}
 		runOptions := subagentSkillOptions(sctx, steps, price, ctxWin, childDepth)
 		// Delivery risk gates consume typed reports; outside Delivery a casual
 		// /review run may finish with prose only.
@@ -932,6 +992,25 @@ func Build(ctx context.Context, opts Options) (*control.Controller, error) {
 	// per-skill model, and resumable transcripts when the parent session supports
 	// them. Its tool activity nests under the invoking call, like `task`.
 	skillRunner := func(sctx context.Context, sk skill.Skill, task string, runOpts skill.SubagentRunOptions) (string, error) {
+		// Writer skills without write_paths claim the whole workspace so they
+		// cannot race fleet/task writers that declared disjoint paths.
+		acq := agent.AcquireRequest{
+			Writer: !sk.ReadOnly,
+			Nested: agent.SubagentDepth(sctx) > 0,
+			Label:  sk.Name,
+		}
+		if !sk.ReadOnly {
+			whole, werr := agent.WholeWorkspaceWriteClaim(root)
+			if werr != nil {
+				return "", fmt.Errorf("subagent skill %q write claim: %w", sk.Name, werr)
+			}
+			acq.WritePaths = whole
+		}
+		releaseSlot, err := subagentScheduler.Acquire(sctx, acq)
+		if err != nil {
+			return "", err
+		}
+		defer releaseSlot()
 		sk = skill.WithCodeGraphTools(sk, skill.CodeGraphReadTools(reg))
 		prov, price, ctxWin := execProv, entry.Price, entry.ContextWindow
 		modelRef := subagentModelRef(cfg, sk)
@@ -1386,13 +1465,17 @@ func Build(ctx context.Context, opts Options) (*control.Controller, error) {
 
 	execSess := agent.NewSession(sysPrompt)
 	executor := agent.New(execProv, reg, execSess, agent.Options{
-		MaxSteps:                 maxSteps,
-		MaxStepsKey:              opts.MaxStepsKey,
-		Temperature:              cfg.Agent.Temperature,
-		Pricing:                  entry.Price,
-		Gate:                     headlessGate,
-		Hooks:                    hookRunner,
-		Jobs:                     jm,
+		MaxSteps:    maxSteps,
+		MaxStepsKey: opts.MaxStepsKey,
+		Temperature: cfg.Agent.Temperature,
+		Pricing:     entry.Price,
+		Gate:        headlessGate,
+		Hooks:       hookRunner,
+		Jobs:        jm,
+		// Parent write reservation at the executor entry covers all writers
+		// (including late Economy/MCP adds) without wrapping tool schemas.
+		WriteScheduler:           subagentScheduler,
+		WriteWorkspaceRoot:       root,
 		ProjectChecks:            projectChecks,
 		DeliveryProfile:          tokenDelivery,
 		WorkspaceLease:           workspaceLease,
diff --git a/internal/boot/boot_test.go b/internal/boot/boot_test.go
index 254601d065..44b262507c 100644
--- a/internal/boot/boot_test.go
+++ b/internal/boot/boot_test.go
@@ -1812,6 +1812,7 @@ func defaultFullBootToolNames() []string {
 		"delete_symbol",
 		"edit_file",
 		"explore",
+		"fleet",
 		"forget",
 		"glob",
 		"grep",
@@ -2267,7 +2268,7 @@ model = "x"
 		t.Fatalf("read_only_task child bash schema should not advertise run_in_background")
 	}
 	for _, forbidden := range []string{
-		"connect_tool_source", "task", "parallel_tasks",
+		"connect_tool_source", "task", "parallel_tasks", "fleet",
 		"install_source", "run_skill", "install_skill", "remember", "forget",
 		"write_file", "edit_file", "multi_edit", "move_file", "complete_step",
 	} {
@@ -2349,7 +2350,7 @@ READ ONLY SKILL BODY`)
 		t.Fatalf("read_only_skill child bash schema should not advertise run_in_background")
 	}
 	for _, forbidden := range []string{
-		"connect_tool_source", "task", "read_only_task", "parallel_tasks",
+		"connect_tool_source", "task", "read_only_task", "parallel_tasks", "fleet",
 		"install_source", "run_skill", "install_skill", "remember", "forget",
 		"write_file", "edit_file", "multi_edit", "move_file", "complete_step",
 	} {
diff --git a/internal/cli/subagent.go b/internal/cli/subagent.go
index fdff4ce944..a26236c1a8 100644
--- a/internal/cli/subagent.go
+++ b/internal/cli/subagent.go
@@ -186,7 +186,7 @@ func subagentCreateCommand(args []string) int {
 		fmt.Fprintln(os.Stderr, "subagent create:", err)
 		return 1
 	}
-	content := renderCLIProfile(name, values.description.value, prompt, values.model.value, values.effort.value, parseToolList(values.tools.value), values.color.value)
+	content := renderCLIProfile(name, values.description.value, prompt, values.model.value, values.effort.value, parseToolList(values.tools.value), values.color.value, false)
 	path, err := store.CreateWithContent(name, scope, content)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "subagent create:", err)
@@ -263,7 +263,7 @@ func subagentEditCommand(args []string) int {
 		fmt.Fprintln(os.Stderr, "subagent edit: description and prompt cannot be empty")
 		return 2
 	}
-	content := renderCLIProfile(sk.Name, description, body, model, effort, tools, color)
+	content := renderCLIProfile(sk.Name, description, body, model, effort, tools, color, sk.ReadOnly)
 	if err := store.UpdateContent(sk.Name, sk.Scope, content); err != nil {
 		fmt.Fprintln(os.Stderr, "subagent edit:", err)
 		return 1
@@ -536,7 +536,7 @@ func parseToolList(raw string) []string {
 	return tools
 }
 
-func renderCLIProfile(name, description, prompt, model, effort string, tools []string, color string) string {
+func renderCLIProfile(name, description, prompt, model, effort string, tools []string, color string, readOnly bool) string {
 	return skill.RenderSkillFile(skill.SkillFileOptions{
 		Name:         strings.TrimSpace(name),
 		Description:  strings.TrimSpace(description),
@@ -545,6 +545,7 @@ func renderCLIProfile(name, description, prompt, model, effort string, tools []s
 		Model:        strings.TrimSpace(model),
 		Effort:       strings.TrimSpace(effort),
 		AllowedTools: tools,
+		ReadOnly:     readOnly,
 		Color:        strings.TrimSpace(color),
 		Invocation:   "manual",
 	})
diff --git a/internal/cli/subagent_test.go b/internal/cli/subagent_test.go
index 0cdaa785b7..273e8a2388 100644
--- a/internal/cli/subagent_test.go
+++ b/internal/cli/subagent_test.go
@@ -145,7 +145,9 @@ func TestSubagentProfileCLIRejectsBuiltinCollisionAndRichSkillEdit(t *testing.T)
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(path, []byte("---\ndescription: rich\nrunAs: subagent\ninvocation: manual\nread-only: true\n---\nbody"), 0o644); err != nil {
+	// read-only is now a managed profile field; use a still-unmanaged key so
+	// the editor refuse path remains covered.
+	if err := os.WriteFile(path, []byte("---\ndescription: rich\nrunAs: subagent\ninvocation: manual\ntriggers: [deploy]\n---\nbody"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	errOut = captureStderr(t, func() {
@@ -156,6 +158,27 @@ func TestSubagentProfileCLIRejectsBuiltinCollisionAndRichSkillEdit(t *testing.T)
 	if !strings.Contains(errOut, "does not manage") {
 		t.Fatalf("rich edit output = %q", errOut)
 	}
+	// Positive: managed read-only frontmatter is editable and round-trips.
+	roPath := filepath.Join(project, ".reasonix", "skills", "readonly-agent", skill.SkillFile)
+	if err := os.MkdirAll(filepath.Dir(roPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(roPath, []byte("---\ndescription: ro\nrunAs: subagent\ninvocation: manual\nread-only: true\n---\nbody\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if rc := subagentCommand([]string{"edit", "readonly-agent", "--description", "read only agent"}); rc != 0 {
+		t.Fatalf("managed read-only edit rc = %d", rc)
+	}
+	raw, err := os.ReadFile(roPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(raw), "read-only: true") {
+		t.Fatalf("edit must preserve read-only frontmatter, got:\n%s", raw)
+	}
+	if !strings.Contains(string(raw), "read only agent") {
+		t.Fatalf("edit must update description, got:\n%s", raw)
+	}
 }
 
 func TestSubagentProfileCLIRejectsReservedAndCustomCommandNames(t *testing.T) {
diff --git a/internal/config/config.go b/internal/config/config.go
index ef8af0f36e..8b0d5a0a84 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -1048,6 +1048,14 @@ type AgentConfig struct {
 	SubagentEffort      string            `toml:"subagent_effort"`
 	SubagentEfforts     map[string]string `toml:"subagent_efforts"`
 	MaxSubagentDepth    int               `toml:"max_subagent_depth"`
+	// MaxSubagentConcurrency bounds how many sub-agents (task, fleet items,
+	// profile skills, nested children) may run at once in one session.
+	// 0 means the default (6). Values outside 1–32 are clamped on load.
+	MaxSubagentConcurrency int `toml:"max_subagent_concurrency"`
+	// MaxParallelWriters bounds concurrent writer-capable sub-agents that
+	// declare non-overlapping write_paths. 0 means the default (3). Must not
+	// exceed MaxSubagentConcurrency after normalization.
+	MaxParallelWriters int `toml:"max_parallel_writers"`
 	// OutputStyle selects a persona/tone block folded into the system prompt at
 	// startup (a built-in like "explanatory"/"learning"/"concise", or a custom
 	// .reasonix/output-styles/<name>.md). Empty = the unmodified prompt.
@@ -1566,14 +1574,16 @@ func Default() *Config {
 			SystemPrompt: DefaultSystemPrompt,
 			// Normal interactive execution has no configurable total round cap. It
 			// is bounded by adaptive progress guards and context compaction instead.
-			MaxSteps:            0,
-			PlannerMaxSteps:     0,
-			AutoPlan:            "off",
-			SoftCompactRatio:    0.5,
-			ToolResultSnipRatio: 0.6,
-			CompactRatio:        0.8,
-			CompactForceRatio:   0.9,
-			MaxSubagentDepth:    2,
+			MaxSteps:               0,
+			PlannerMaxSteps:        0,
+			AutoPlan:               "off",
+			SoftCompactRatio:       0.5,
+			ToolResultSnipRatio:    0.6,
+			CompactRatio:           0.8,
+			CompactForceRatio:      0.9,
+			MaxSubagentDepth:       2,
+			MaxSubagentConcurrency: 6,
+			MaxParallelWriters:     3,
 		},
 		// Mode "ask" with no rules keeps `reasonix run` autonomous (no TTY → ask
 		// resolves to allow) while `reasonix` prompts before writers. Users add
diff --git a/internal/config/render.go b/internal/config/render.go
index 6a2bf5bdd3..1a154aee8a 100644
--- a/internal/config/render.go
+++ b/internal/config/render.go
@@ -277,6 +277,16 @@ func RenderTOMLForScope(c *Config, scope RenderScope) string {
 	} else {
 		b.WriteString("# max_subagent_depth = 2   # nested subagent delegation depth; set 1 to disable nested delegation\n")
 	}
+	if c.Agent.MaxSubagentConcurrency != defaults.Agent.MaxSubagentConcurrency {
+		fmt.Fprintf(&b, "max_subagent_concurrency = %d   # session-wide sub-agent concurrency (task/fleet/skills)\n", c.Agent.MaxSubagentConcurrency)
+	} else {
+		b.WriteString("# max_subagent_concurrency = 6   # session-wide sub-agent concurrency (task/fleet/skills)\n")
+	}
+	if c.Agent.MaxParallelWriters != defaults.Agent.MaxParallelWriters {
+		fmt.Fprintf(&b, "max_parallel_writers = %d   # concurrent writers with non-overlapping write_paths\n", c.Agent.MaxParallelWriters)
+	} else {
+		b.WriteString("# max_parallel_writers = 3   # concurrent writers with non-overlapping write_paths\n")
+	}
 	if c.Agent.OutputStyle != "" {
 		fmt.Fprintf(&b, "output_style = %q   # persona/tone folded into the prompt\n", c.Agent.OutputStyle)
 	} else {
diff --git a/internal/doctor/skill_health.go b/internal/doctor/skill_health.go
index 673e0c6f14..82ffa97f0f 100644
--- a/internal/doctor/skill_health.go
+++ b/internal/doctor/skill_health.go
@@ -128,6 +128,7 @@ func isBuiltinOrMetaTool(name string) bool {
 	switch name {
 	case "bash", "read_file", "write_file", "edit_file", "grep", "glob", "ls",
 		"todo_write", "complete_step", "ask", "task", "read_only_task",
+		"parallel_tasks", "fleet",
 		"run_skill", "read_skill", "read_only_skill", "explore", "research",
 		"review", "security_review", "web_fetch", "multi_edit", "move_file",
 		"code_index", "wait", "bash_output", "kill_shell":
diff --git a/internal/skill/profile.go b/internal/skill/profile.go
index f691aed11e..e7d2b94a8c 100644
--- a/internal/skill/profile.go
+++ b/internal/skill/profile.go
@@ -45,7 +45,7 @@ func ValidateSubagentProfileName(name string, occupied []string) error {
 // profile editors can round-trip without changing execution semantics.
 var subagentProfileManagedKeys = map[string]bool{
 	"name": true, "description": true, "color": true, "invocation": true,
-	"runas": true, "model": true, "effort": true, "allowed-tools": true,
+	"runas": true, "model": true, "effort": true, "read-only": true, "allowed-tools": true,
 }
 
 // ValidateEditableSubagentProfile verifies that a loaded skill is a manual
diff --git a/internal/skill/tools.go b/internal/skill/tools.go
index df88418dae..992c00ff29 100644
--- a/internal/skill/tools.go
+++ b/internal/skill/tools.go
@@ -558,7 +558,11 @@ type SkillFileOptions struct {
 	Model        string // subagent-only; ignored when RunAs != RunSubagent
 	Effort       string // subagent-only; ignored when RunAs != RunSubagent
 	AllowedTools []string
-	Color        string // optional display tag; emitted regardless of RunAs
+	// ReadOnly, when true, emits frontmatter read-only: true so the profile
+	// runs against the read-only registry. Omitted/false keeps the legacy
+	// writable default for older profiles.
+	ReadOnly bool
+	Color    string // optional display tag; emitted regardless of RunAs
 	// Invocation, when "manual", keeps the written skill out of the pinned
 	// Skills index (see index.go) — invocable by name only, never
 	// model-discovered. Anything else (including empty) is the default "auto".
@@ -579,12 +583,13 @@ type skillFileFrontmatter struct {
 	RunAs        string   `yaml:"runAs,omitempty"`
 	Model        string   `yaml:"model,omitempty"`
 	Effort       string   `yaml:"effort,omitempty"`
+	ReadOnly     *bool    `yaml:"read-only,omitempty"`
 	AllowedTools []string `yaml:"allowed-tools,omitempty,flow"`
 }
 
 // RenderSkillFile assembles a skill file's frontmatter + body. Subagent-only
-// fields (model, effort, allowed-tools) are emitted only when RunAs=subagent;
-// color and invocation are independent of RunAs.
+// fields (model, effort, allowed-tools, read-only) are emitted only when
+// RunAs=subagent; color and invocation are independent of RunAs.
 func RenderSkillFile(opts SkillFileOptions) string {
 	fm := skillFileFrontmatter{
 		Name:        opts.Name,
@@ -598,6 +603,10 @@ func RenderSkillFile(opts SkillFileOptions) string {
 		fm.RunAs = string(RunSubagent)
 		fm.Model = strings.TrimSpace(opts.Model)
 		fm.Effort = strings.TrimSpace(opts.Effort)
+		if opts.ReadOnly {
+			v := true
+			fm.ReadOnly = &v
+		}
 		for _, t := range opts.AllowedTools {
 			if t = strings.TrimSpace(t); t != "" {
 				fm.AllowedTools = append(fm.AllowedTools, t)
diff --git a/internal/tool/builtin/confine.go b/internal/tool/builtin/confine.go
index a24aeee24a..382b328ab7 100644
--- a/internal/tool/builtin/confine.go
+++ b/internal/tool/builtin/confine.go
@@ -32,6 +32,32 @@ func ConfineBash(spec sandbox.Spec, guard SessionDataGuard, timeout ...time.Dura
 	return b
 }
 
+// RebindBashWriteRoots returns a copy of bash with its complete write surface
+// narrowed to roots. ok is false when tl is not a confined bash tool, when the
+// sandbox is not enforcing (cannot honour narrower roots), or when roots is empty.
+// Callers that wrap bash (e.g. foreground-only subagent wrappers) must unwrap
+// before calling and re-wrap the result.
+func RebindBashWriteRoots(tl tool.Tool, roots []string) (tool.Tool, bool) {
+	b, ok := tl.(bash)
+	if !ok || !b.sb.Enforce() {
+		return nil, false
+	}
+	rs := realRoots(roots)
+	if len(rs) == 0 {
+		return nil, false
+	}
+	spec := b.sb
+	spec.WriteRoots = rs
+	// Sub-agent claims are strict capability boundaries. Do not add the normal
+	// build-cache and temporary-directory allowances outside the claimed roots.
+	spec.MinimalWrites = true
+	// Do not inherit a wider AppContainer write lane from the parent workspace
+	// confinement — the claim roots are the only allowed write surface.
+	spec.AppContainerWriteRoots = append([]string(nil), rs...)
+	b.sb = spec
+	return b, true
+}
+
 // ConfineWebFetch returns the web_fetch built-in bound to Reasonix proxy
 // settings while preserving its SSRF-guarded dialer.
 func ConfineWebFetch(proxySpec netclient.ProxySpec) tool.Tool {
diff --git a/internal/tool/builtin/confine_test.go b/internal/tool/builtin/confine_test.go
index 53bd79cad7..f10567ee77 100644
--- a/internal/tool/builtin/confine_test.go
+++ b/internal/tool/builtin/confine_test.go
@@ -3,6 +3,7 @@ package builtin
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -41,6 +42,66 @@ func TestConfineUnconfinedWhenNoRoots(t *testing.T) {
 	}
 }
 
+func TestRebindBashWriteRootsUsesMinimalWriteSurface(t *testing.T) {
+	root := t.TempDir()
+	claim := filepath.Join(root, "claimed")
+	tool, ok := RebindBashWriteRoots(ConfineBash(sandbox.Spec{
+		Mode:       "enforce",
+		WriteRoots: []string{root},
+	}, SessionDataGuard{}), []string{claim})
+	if !ok {
+		t.Fatal("expected confined bash to be rebound")
+	}
+	rebound, ok := tool.(bash)
+	if !ok {
+		t.Fatalf("rebound tool type = %T, want bash", tool)
+	}
+	if !rebound.sb.MinimalWrites {
+		t.Fatal("rebound bash must disable write allowances outside claim roots")
+	}
+	want := realRoots([]string{claim})
+	if len(rebound.sb.WriteRoots) != 1 || rebound.sb.WriteRoots[0] != want[0] {
+		t.Fatalf("write roots = %v, want %v", rebound.sb.WriteRoots, want)
+	}
+	if len(rebound.sb.AppContainerWriteRoots) != 1 || rebound.sb.AppContainerWriteRoots[0] != want[0] {
+		t.Fatalf("app-container write roots = %v, want %v", rebound.sb.AppContainerWriteRoots, want)
+	}
+}
+
+func TestReboundBashCannotWriteOutsideClaim(t *testing.T) {
+	if !sandbox.Available() {
+		t.Skip("OS sandbox unavailable")
+	}
+	root := t.TempDir()
+	claim := filepath.Join(root, "claimed")
+	if err := os.MkdirAll(claim, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	rebound, ok := RebindBashWriteRoots(ConfineBash(sandbox.Spec{
+		Mode:       "enforce",
+		WriteRoots: []string{root},
+	}, SessionDataGuard{}), []string{claim})
+	if !ok {
+		t.Fatal("expected confined bash to be rebound")
+	}
+
+	inside := filepath.Join(claim, "inside.txt")
+	args, _ := json.Marshal(map[string]string{"command": fmt.Sprintf("printf inside > %q", inside)})
+	if _, err := rebound.Execute(context.Background(), args); err != nil {
+		t.Fatalf("write inside claim failed: %v", err)
+	}
+	if _, err := os.Stat(inside); err != nil {
+		t.Fatalf("write inside claim did not land: %v", err)
+	}
+
+	outside := filepath.Join(t.TempDir(), "escaped.txt")
+	args, _ = json.Marshal(map[string]string{"command": fmt.Sprintf("printf escaped > %q", outside)})
+	_, _ = rebound.Execute(context.Background(), args)
+	if _, err := os.Stat(outside); !os.IsNotExist(err) {
+		t.Fatalf("rebound bash wrote outside claim, stat err=%v", err)
+	}
+}
+
 func TestConfineInsideAndOutside(t *testing.T) {
 	root := t.TempDir()
 	roots := realRoots([]string{root})
diff --git a/reasonix.example.toml b/reasonix.example.toml
index 57c0b2f983..e2e1677af6 100644
--- a/reasonix.example.toml
+++ b/reasonix.example.toml
@@ -40,6 +40,8 @@ compact_force_ratio = 0.9   # force compacting at this high-water mark
 # planner_model = "deepseek-pro"   # optional: enable two-model collaboration
 # subagent_model = "deepseek-pro"   # optional default for runAs=subagent skills
 # subagent_models = { review = "deepseek-pro", security_review = "deepseek-pro" }   # per-skill overrides
+# max_subagent_concurrency = 6   # session-wide sub-agent concurrency (task/fleet/skills)
+# max_parallel_writers = 3       # concurrent writers with non-overlapping write_paths
 # output_style = "explanatory"   # persona/tone folded into the prompt: explanatory | learning | concise,
 #                                  or a custom .reasonix/output-styles/<name>.md ; empty = default