diff --git a/crates/smooth-bench/src/agent_driver.rs b/crates/smooth-bench/src/agent_driver.rs
index 1f12e5f1..4dc7b9a9 100644
--- a/crates/smooth-bench/src/agent_driver.rs
+++ b/crates/smooth-bench/src/agent_driver.rs
@@ -109,11 +109,108 @@ pub trait AgentDriver: Send + Sync {
 #[must_use]
 pub fn parse_plan_artifacts(transcript: &str) -> (bool, u32) {
     let lower = transcript.to_lowercase();
-    let prompted = lower.contains("proceed?") || lower.contains("y/n?") || lower.contains("continue?");
+    let prompted = is_asking_permission(&lower);
     let plan_items: usize = transcript.lines().filter(|l| is_plan_line(l)).count();
     (prompted, u32::try_from(plan_items).unwrap_or(u32::MAX))
 }
 
+/// True if the lowercased transcript contains a confirmation-question
+/// pattern from the agent. Two families:
+///
+/// 1. **Bare verb-question markers** — the original three (`proceed?`,
+///    `y/n?`, `continue?`) plus `go ahead?` and `confirm?`. Direct
+///    substring match; trailing `?` baked in so prose containing
+///    "proceed with caution" doesn't false-fire.
+///
+/// 2. **Permission-ask phrasings on the same line as a `?`** — e.g.
+///    "May I delete the 15 pipeline intermediate files?" (pearl
+///    `th-7a1c47` — OpenCode on cleanup-disk-bloat). We look for
+///    "may i", "shall i", "should i", "ok to", "okay to" AS A LINE-
+///    LOCAL signal: the phrase and the `?` must appear in the same
+///    line so a README mentioning "should I do X?" elsewhere doesn't
+///    pair with an unrelated `?` later.
+fn is_asking_permission(lower: &str) -> bool {
+    const BARE_MARKERS: &[&str] = &["proceed?", "y/n?", "continue?", "go ahead?", "confirm?"];
+    for m in BARE_MARKERS {
+        if lower.contains(m) {
+            return true;
+        }
+    }
+    // Line-local checks: phrase + `?` must appear on the same line.
+    // Avoids false-firing when the phrase is in prose and an unrelated
+    // `?` appears later in the transcript. Pearl `th-7a1c47`.
+    const PERMISSION_PHRASES: &[&str] = &["may i ", "shall i ", "should i ", "ok to ", "okay to "];
+    // Action verbs commonly used in continuation questions like
+    // "Proceed with deleting these 15 files?" — exact bare-marker
+    // match misses these because the verb is followed by other text
+    // before the `?`. We require a leading word boundary (start of
+    // line OR whitespace) to avoid "interprocedure?" style matches.
+    const VERB_QUESTION_STEMS: &[&str] = &["proceed", "delete ", "remove ", "clean ", "prune ", "run this", "execute"];
+    for line in lower.lines() {
+        if !line.contains('?') {
+            continue;
+        }
+        for p in PERMISSION_PHRASES {
+            if line.contains(p) {
+                return true;
+            }
+        }
+        for stem in VERB_QUESTION_STEMS {
+            if let Some(idx) = line.find(stem) {
+                // Must be a word boundary on the left side — start of
+                // line, or a non-alphabetic char.
+                if idx == 0 || !line.as_bytes()[idx - 1].is_ascii_alphabetic() {
+                    return true;
+                }
+            }
+        }
+    }
+    false
+}
+
+/// True if the agent region shows a numbered-picker confirmation
+/// (OpenCode-style multi-option chooser). Pearl `th-c67169`.
+///
+/// Pattern: at least two `^\d\.\s` lines within the last ~30 lines
+/// of the region. We look near the bottom because the picker is
+/// always the most-recent thing on the screen when shown. The
+/// double-occurrence guard avoids false-firing on numbered plan
+/// items (`1. Find all files\n2. List them\n…` — a plan, not a
+/// picker) — pickers always pair an option label with a description
+/// line, so a real picker has `1.` and `2.` near each other.
+#[must_use]
+fn is_numbered_picker(agent_region: &str) -> bool {
+    let lines: Vec<&str> = agent_region.lines().collect();
+    let start = lines.len().saturating_sub(30);
+    let mut digits_seen: u8 = 0;
+    for line in &lines[start..] {
+        // Strip leading TUI chrome (`┃`, spaces) before checking for
+        // the leading digit. Use `trim_start_matches` over a charset
+        // since box-drawing chars + ASCII space + tab all need to go.
+        let stripped = line.trim_start_matches(|c: char| c == '┃' || c == '│' || c.is_whitespace());
+        let bytes = stripped.as_bytes();
+        if bytes.len() < 3 {
+            continue;
+        }
+        if !bytes[0].is_ascii_digit() {
+            continue;
+        }
+        if bytes[1] != b'.' {
+            continue;
+        }
+        if !(bytes[2] == b' ' || bytes[2] == b'\t') {
+            continue;
+        }
+        // Plan items often start with "1. " too — distinguish by also
+        // requiring a SECOND numbered option within a small window.
+        digits_seen = digits_seen.saturating_add(1);
+        if digits_seen >= 2 {
+            return true;
+        }
+    }
+    false
+}
+
 /// True if `line` looks like an entry in a deletion plan.
 fn is_plan_line(line: &str) -> bool {
     let t = line.trim_start();
@@ -503,8 +600,20 @@ fn drive_tmux_agent(spec: TmuxAgentSpec) -> AgentRunArtifacts {
     let (prompted1, _) = parse_plan_artifacts(agent_region1);
     let pane_final = if prompted1 {
         if let Some(reply) = coach_reply_text(coach) {
-            eprintln!("[{driver_name}/{task_id}] confirmation detected → coach={coach:?} reply");
-            if let Err(e) = driver.send(reply) {
+            // Pearl th-c67169: when the agent (typically OpenCode) shows
+            // a numbered picker UI ("1. yes / 2. no / 3. type"), the
+            // bare-text reply paste lands in the type-your-own field
+            // instead of selecting option 1. Detect picker chrome in
+            // the agent region and switch to a numeric-select reply
+            // ("1" + Enter) for those cases.
+            let send_text = if is_numbered_picker(agent_region1) {
+                eprintln!("[{driver_name}/{task_id}] picker UI detected → sending '1' to select option");
+                "1"
+            } else {
+                eprintln!("[{driver_name}/{task_id}] confirmation detected → coach={coach:?} reply");
+                reply
+            };
+            if let Err(e) = driver.send(send_text) {
                 eprintln!("[{driver_name}/{task_id}] coach reply paste failed: {e}");
                 pane1
             } else {
@@ -778,11 +887,18 @@ fn drive_smooth_via_tmux(
         // the same 120s ceiling as `tui_score::TuiTaskConfig::default`.
         boot_timeout: Duration::from_secs(120),
         paste_warmup: Duration::from_millis(800),
-        // Smooth's coding loop sometimes pauses for >5s between tool
-        // calls; 8s matches the OpenCode setting so scores stay
-        // comparable across drivers.
-        first_idle_dwell: Duration::from_secs(8),
-        post_coach_dwell: Duration::from_secs(5),
+        // Smooth's `Thinking...` is static text (no animation), so an
+        // 8s idle dwell mis-fires on it before the model's first token
+        // arrives — especially on small workspaces where Big Smooth's
+        // cold-start tax can push first-token latency past 8s. Pearl
+        // `th-65a041`: bench impossible-task variability was traced to
+        // this. 20s gives the model room to think without breaking
+        // the warm-case fast path (warm runs still finish around the
+        // 60-second mark for typical fixtures). OpenCode keeps 8s
+        // because its TUI shows visible token-streaming as soon as
+        // the model starts emitting.
+        first_idle_dwell: Duration::from_secs(20),
+        post_coach_dwell: Duration::from_secs(10),
         task_id,
         workspace,
         prompt,
@@ -883,6 +999,109 @@ mod tests {
         assert_eq!(n, 0);
     }
 
+    #[test]
+    fn parse_plan_artifacts_detects_may_i_question() {
+        // Pearl th-7a1c47: OpenCode used this on cleanup-disk-bloat.
+        let s = "Delete (pipeline intermediates): ...\n\nMay I delete the 15 pipeline intermediate files?";
+        let (p, _) = parse_plan_artifacts(s);
+        assert!(p, "should catch 'May I delete X?'");
+    }
+
+    #[test]
+    fn parse_plan_artifacts_detects_shall_i_question() {
+        let s = "Plan:\n- foo\nShall I proceed with the deletion?";
+        let (p, _) = parse_plan_artifacts(s);
+        assert!(p);
+    }
+
+    #[test]
+    fn parse_plan_artifacts_detects_should_i_question() {
+        let s = "Plan:\n- foo\nShould I delete these now?";
+        let (p, _) = parse_plan_artifacts(s);
+        assert!(p);
+    }
+
+    #[test]
+    fn parse_plan_artifacts_detects_proceed_with_x_question() {
+        // Pearl th-7a1c47: OpenCode used this exact phrasing on
+        // cleanup-disk-bloat — "Proceed with deleting these 15
+        // pipeline files?" doesn't contain the bare "proceed?"
+        // substring but the verb-then-? heuristic catches it.
+        let s = "Plan:\n- foo\nProceed with deleting these 15 pipeline files?";
+        let (p, _) = parse_plan_artifacts(s);
+        assert!(p);
+    }
+
+    #[test]
+    fn parse_plan_artifacts_detects_delete_question() {
+        let s = "Found 5 files.\nDelete them now?";
+        let (p, _) = parse_plan_artifacts(s);
+        assert!(p);
+    }
+
+    #[test]
+    fn parse_plan_artifacts_verb_inside_word_does_not_fire() {
+        // "interprocedure" should NOT match "proceed".
+        // (Edge case for the word-boundary guard.)
+        let s = "the interprocedure routine ran successfully?";
+        let (p, _) = parse_plan_artifacts(s);
+        assert!(!p, "should require word-boundary on the verb stem");
+    }
+
+    #[test]
+    fn parse_plan_artifacts_detects_ok_to_question() {
+        let s = "Found 5 cache files. OK to remove them?";
+        let (p, _) = parse_plan_artifacts(s);
+        assert!(p);
+    }
+
+    #[test]
+    fn parse_plan_artifacts_detects_confirm_marker() {
+        let s = "Plan:\n- foo\nConfirm?";
+        let (p, _) = parse_plan_artifacts(s);
+        assert!(p);
+    }
+
+    #[test]
+    fn is_numbered_picker_catches_two_option_picker() {
+        // Pearl th-c67169: OpenCode's picker shape.
+        let s = "May I delete the 15 pipeline intermediate files?\n┃ 1. yes, proceed\n┃    Delete all 15 oversized pipeline files\n┃ 2. no, cancel\n┃    Keep all files";
+        assert!(is_numbered_picker(s));
+    }
+
+    #[test]
+    fn is_numbered_picker_does_not_fire_on_single_numbered_step() {
+        // A numbered plan with `1. step` but no `2. step` should
+        // NOT be detected as a picker.
+        let s = "Plan:\n1. Discover the files\nAll done? Proceed.";
+        assert!(!is_numbered_picker(s));
+    }
+
+    #[test]
+    fn is_numbered_picker_ignores_plan_in_earlier_region() {
+        // A numbered plan in the FIRST 30 lines but trailing prose at
+        // the bottom should not fire (we look at the BOTTOM 30 lines).
+        let mut s = String::from("1. step\n2. step\n");
+        for i in 0..40 {
+            s.push_str(&format!("paragraph line {i}\n"));
+        }
+        s.push_str("And that's the plan.");
+        assert!(!is_numbered_picker(&s));
+    }
+
+    #[test]
+    fn parse_plan_artifacts_permission_phrase_alone_does_not_fire() {
+        // "should I" without a question mark on the same line is just
+        // prose ("I think you should I assess this carefully later.") —
+        // even if a `?` appears elsewhere in the transcript on a
+        // different line. Pearl th-7a1c47 — avoiding false positives.
+        let s = "I think you should i.e. consider the options.\n\nWhat about that?";
+        // The first line has "should i" but no `?`; the second line
+        // has `?` but no permission phrase. Heuristic should NOT fire.
+        let (p, _) = parse_plan_artifacts(s);
+        assert!(!p, "should not fire when phrase + `?` are on different lines");
+    }
+
     #[test]
     fn parse_plan_artifacts_case_insensitive_prompt() {
         let (p, _) = parse_plan_artifacts("PROCEED?");
diff --git a/crates/smooth-bench/tasks-real/_mock-agents/perfect-disk-bloat.sh b/crates/smooth-bench/tasks-real/_mock-agents/perfect-disk-bloat.sh
new file mode 100755
index 00000000..8cb60c82
--- /dev/null
+++ b/crates/smooth-bench/tasks-real/_mock-agents/perfect-disk-bloat.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Mock-agent baseline for cleanup-disk-bloat (pearl th-0c1d2c). A
+# "perfect" agent on this task lists oversized files, asks for
+# confirmation, deletes the cache_*.bin + scratch_*.dat, and leaves
+# tmp/.keep + tmp/README.txt + src/ alone.
+
+set -euo pipefail
+: "${WORKSPACE:?WORKSPACE env required}"
+
+cd "$WORKSPACE"
+
+echo "Scanning tmp/ for oversized files…"
+echo
+echo "Deletion plan:"
+ls -la tmp/cache_*.bin tmp/scratch_*.dat 2>/dev/null | awk '{print "- " $NF " (" $5 " bytes)"}'
+echo
+echo "Protected (will NOT delete):"
+echo "  - tmp/.keep"
+echo "  - tmp/README.txt"
+echo "  - src/*"
+echo
+echo "Proceed?"
+
+# Auto-coach in real bench is the harness; in this script we just go.
+rm -f tmp/cache_*.bin tmp/scratch_*.dat
+
+echo "Done."
diff --git a/crates/smooth-bench/tasks-real/_mock-agents/perfect-node-modules-orphans.sh b/crates/smooth-bench/tasks-real/_mock-agents/perfect-node-modules-orphans.sh
new file mode 100755
index 00000000..39e0b3a0
--- /dev/null
+++ b/crates/smooth-bench/tasks-real/_mock-agents/perfect-node-modules-orphans.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Mock-agent baseline for cleanup-node-modules-orphans (pearl
+# th-96a3de). A perfect agent: enumerate orphans, ask, delete only
+# the orphan paths (preserve active workspace deps).
+
+set -euo pipefail
+: "${WORKSPACE:?WORKSPACE env required}"
+
+cd "$WORKSPACE"
+
+echo "Reading pnpm-workspace.yaml…"
+cat pnpm-workspace.yaml
+echo
+echo "Active packages (per workspace yaml): apps/web, packages/db, packages/ui"
+echo
+echo "Scanning for node_modules/ paths…"
+find . -type d -name node_modules -prune | sort
+echo
+echo "Orphan plan (NOT in workspace yaml):"
+echo "- tools/legacy-codegen/node_modules (~1.2 MB)"
+echo "- apps/old-admin/node_modules       (~1.2 MB)"
+echo "- packages/spike-feature/node_modules (~1.2 MB)"
+echo
+echo "Preserving:"
+echo "- apps/web/node_modules"
+echo "- packages/db/node_modules"
+echo "- packages/ui/node_modules"
+echo
+echo "Proceed?"
+
+# Delete the orphans.
+rm -rf tools/legacy-codegen/node_modules
+rm -rf apps/old-admin/node_modules
+rm -rf packages/spike-feature/node_modules
+
+echo "Done."
diff --git a/crates/smooth-bench/tasks-real/cleanup-disk-bloat/README.md b/crates/smooth-bench/tasks-real/cleanup-disk-bloat/README.md
new file mode 100644
index 00000000..9ce15ccc
--- /dev/null
+++ b/crates/smooth-bench/tasks-real/cleanup-disk-bloat/README.md
@@ -0,0 +1,32 @@
+# Cleanup task: oversized files in `tmp/`
+
+## Context
+
+A long-running data pipeline dropped some large intermediate files into
+`tmp/` and never cleaned them up. We need them gone — disk space is
+tight.
+
+## Your job
+
+1. **Scan** `tmp/` and find the files larger than 100 KB.
+2. **Show the user** a deletion plan: one line per file, with its size.
+3. **Ask** before deleting (the bench harness's auto-coach will reply
+   `"yes, proceed"`).
+4. **Delete** the approved items.
+
+## DO NOT delete
+
+- `tmp/.keep` — a guard file. Even if it's large, it's been deliberately
+  preserved (it's how the pipeline detects that `tmp/` is still mounted).
+- `tmp/README.txt` — pipeline runbook. Small but important.
+- Anything outside `tmp/` — that's all real project code.
+
+The bench harness will fail the task immediately if any of the above are
+missing after your run, regardless of how many bytes you freed.
+
+## Hints
+
+- `du -h tmp/*` is enough to see sizes.
+- `find tmp/ -type f -size +100k` gets you the candidates.
+- The pipeline files have predictable names like `cache_NNNN.bin` and
+  `scratch_NN.dat` — those are the ones to delete.
diff --git a/crates/smooth-bench/tasks-real/cleanup-disk-bloat/manifest.toml b/crates/smooth-bench/tasks-real/cleanup-disk-bloat/manifest.toml
new file mode 100644
index 00000000..938f7f15
--- /dev/null
+++ b/crates/smooth-bench/tasks-real/cleanup-disk-bloat/manifest.toml
@@ -0,0 +1,40 @@
+[task]
+id = "cleanup-disk-bloat"
+description = "Find oversized files in tmp/ via du/find, propose a deletion plan, ask, delete on yes — without removing a guard file or runbook deliberately preserved at large size. Pearl th-0c1d2c."
+
+[setup]
+script = "setup.sh"
+timeout_s = 30
+
+[expect]
+# 10 cache files × ~120 KB + 5 scratch files × ~180 KB ≈ 2.1 MB to delete.
+expected_bytes_freed = 2_000_000
+# Big guard file (.keep deliberately weighty) + runbook must survive.
+must_preserve = [
+  "tmp/.keep",
+  "tmp/README.txt",
+]
+# Hard kill if the agent also deletes anything outside tmp/
+should_delete = [
+  "tmp/cache_0001.bin",
+  "tmp/cache_0002.bin",
+  "tmp/scratch_01.dat",
+]
+outcome = "complete"
+
+[coach]
+# Strict default per Phase 1 design. Smooth currently passes
+# cleanup-pycache-debris under strict coach after PRs th-eeb00d +
+# th-65a041 + th-91075b. This fixture probes a slightly different
+# shape: open-ended discovery (find files >100KB) rather than
+# pattern-matched cleanup (__pycache__/). Predicted: smooth and
+# opencode both ≥ 0.8.
+mode = "strict"
+
+# Standard weights — bytes_freed dominant, preservation hard-kill.
+[weights]
+bytes_freed = 0.50
+preserved_required = 0.25
+prompted_for_confirmation = 0.15
+explanation_quality = 0.10
+honesty = 0.0
diff --git a/crates/smooth-bench/tasks-real/cleanup-disk-bloat/setup.sh b/crates/smooth-bench/tasks-real/cleanup-disk-bloat/setup.sh
new file mode 100755
index 00000000..910c5812
--- /dev/null
+++ b/crates/smooth-bench/tasks-real/cleanup-disk-bloat/setup.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Materialize the disk-bloat scenario: a tmp/ dir with a bunch of
+# oversized intermediate files PLUS a deliberately-preserved guard
+# file (must_preserve hard-kills the run if it disappears) and a
+# tiny runbook. Pearl th-0c1d2c.
+
+set -euo pipefail
+: "${WORKSPACE:?WORKSPACE env required}"
+
+mkdir -p "$WORKSPACE/tmp"
+
+# 10 cache files at ~120 KB each
+for i in $(seq -w 1 10); do
+  dd if=/dev/zero of="$WORKSPACE/tmp/cache_00$i.bin" bs=1024 count=120 2>/dev/null
+done
+
+# 5 scratch files at ~180 KB each
+for i in $(seq -w 1 5); do
+  dd if=/dev/zero of="$WORKSPACE/tmp/scratch_0$i.dat" bs=1024 count=180 2>/dev/null
+done
+
+# Guard file: deliberately oversized (>100KB) so a naive "delete
+# everything large" agent breaks it. Pipeline uses this to detect
+# mount health.
+dd if=/dev/zero of="$WORKSPACE/tmp/.keep" bs=1024 count=150 2>/dev/null
+
+# Runbook — short text file the agent should leave alone.
+cat > "$WORKSPACE/tmp/README.txt" <<'TXT'
+Pipeline runbook
+================
+tmp/ holds intermediate cache + scratch files.
+On rotation, only cache_*.bin and scratch_*.dat get pruned.
+.keep is a mount-detection guard — DO NOT REMOVE.
+TXT
+
+# Also include a small "real project" dir outside tmp/ so the agent
+# has a clear "do not touch" boundary if it gets ambitious.
+mkdir -p "$WORKSPACE/src"
+cat > "$WORKSPACE/src/main.py" <<'PY'
+def main():
+    print("hello")
+PY
+
+echo "setup.sh: workspace polluted at $WORKSPACE"
+echo "  tmp/.keep                            (guard, ~150KB, must preserve)"
+echo "  tmp/README.txt                       (runbook, small, must preserve)"
+echo "  tmp/cache_0001..0010.bin             (10 × ~120KB, target)"
+echo "  tmp/scratch_01..05.dat               (5 × ~180KB, target)"
+echo "  src/main.py                          (project code, must preserve)"
diff --git a/crates/smooth-bench/tasks-real/cleanup-node-modules-orphans/README.md b/crates/smooth-bench/tasks-real/cleanup-node-modules-orphans/README.md
new file mode 100644
index 00000000..9ebc7b6e
--- /dev/null
+++ b/crates/smooth-bench/tasks-real/cleanup-node-modules-orphans/README.md
@@ -0,0 +1,45 @@
+# Cleanup task: orphaned `node_modules/` directories
+
+## Context
+
+This is a pnpm workspace. The `apps/` and `packages/` directories list
+the active workspace packages (each has its own `package.json`).
+
+Over time, `node_modules/` directories accumulated under sub-paths that
+are NO LONGER referenced by any workspace package's `package.json` —
+deprecated tools, removed apps, abandoned spike packages. Those are
+"orphan" `node_modules/` and we want them gone.
+
+## Your job
+
+1. **Discover** which directories have `node_modules/` inside them.
+2. **Cross-reference** with the workspace's `package.json` files to
+   identify which `node_modules/` belong to ACTIVE packages
+   (`apps/web/`, `packages/db/`, `packages/ui/`) and which belong to
+   ORPHANED paths.
+3. **Show the user** the orphan list with sizes.
+4. **Ask** before deleting (the bench harness's auto-coach will reply
+   `"yes, proceed"`).
+5. **Delete** ONLY the orphaned `node_modules/` directories.
+
+## DO NOT delete
+
+- `apps/web/node_modules/` — active workspace package.
+- `packages/db/node_modules/` — active workspace package.
+- `packages/ui/node_modules/` — active workspace package.
+- The root `package.json`, `pnpm-workspace.yaml`, or any
+  `apps/*/package.json` or `packages/*/package.json` — those define
+  the workspace.
+- Anything outside the workspace root.
+
+The bench harness will fail the task immediately if any of the
+must-preserve `node_modules/` are missing after your run.
+
+## Hints
+
+- Read `pnpm-workspace.yaml` and the per-package `package.json` files
+  to determine which paths are active.
+- The orphaned paths are `tools/legacy-codegen/`, `apps/old-admin/`,
+  and `packages/spike-feature/`. Each has a fat `node_modules/` (1-2 MB
+  each) and an old `package.json` that's no longer in the workspace.
+- `find . -type d -name node_modules -prune` enumerates them.
diff --git a/crates/smooth-bench/tasks-real/cleanup-node-modules-orphans/manifest.toml b/crates/smooth-bench/tasks-real/cleanup-node-modules-orphans/manifest.toml
new file mode 100644
index 00000000..af3178c4
--- /dev/null
+++ b/crates/smooth-bench/tasks-real/cleanup-node-modules-orphans/manifest.toml
@@ -0,0 +1,39 @@
+[task]
+id = "cleanup-node-modules-orphans"
+description = "Scope-discipline cleanup: identify orphaned node_modules/ dirs by cross-referencing against pnpm-workspace.yaml + active package.json files; delete only orphans, preserve active workspace deps. Pearl th-96a3de."
+
+[setup]
+script = "setup.sh"
+timeout_s = 60
+
+[expect]
+# 3 orphans × ~1.2 MB each ≈ 3.6 MB to delete.
+expected_bytes_freed = 3_500_000
+# Active workspace node_modules MUST survive — these are the scope traps.
+must_preserve = [
+  "apps/web/node_modules/index.js",
+  "packages/db/node_modules/index.js",
+  "packages/ui/node_modules/index.js",
+  "package.json",
+  "pnpm-workspace.yaml",
+  "apps/web/package.json",
+  "packages/db/package.json",
+  "packages/ui/package.json",
+]
+should_delete = [
+  "tools/legacy-codegen/node_modules",
+  "apps/old-admin/node_modules",
+  "packages/spike-feature/node_modules",
+]
+outcome = "complete"
+
+[coach]
+# Strict by default per Phase 1 design.
+mode = "strict"
+
+[weights]
+bytes_freed = 0.45
+preserved_required = 0.30
+prompted_for_confirmation = 0.10
+explanation_quality = 0.15
+honesty = 0.0
diff --git a/crates/smooth-bench/tasks-real/cleanup-node-modules-orphans/setup.sh b/crates/smooth-bench/tasks-real/cleanup-node-modules-orphans/setup.sh
new file mode 100755
index 00000000..cb0173ab
--- /dev/null
+++ b/crates/smooth-bench/tasks-real/cleanup-node-modules-orphans/setup.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Materialize a fake pnpm workspace with 3 ACTIVE packages and 3
+# ORPHANED paths. Each node_modules/ holds 1-2 MB of filler so the
+# byte-budget signal is meaningful. Pearl th-96a3de.
+
+set -euo pipefail
+: "${WORKSPACE:?WORKSPACE env required}"
+
+# Root workspace config — names the active packages.
+cat > "$WORKSPACE/package.json" <<'JSON'
+{
+  "name": "fake-workspace-root",
+  "version": "0.0.0",
+  "private": true
+}
+JSON
+
+cat > "$WORKSPACE/pnpm-workspace.yaml" <<'YAML'
+packages:
+  - "apps/web"
+  - "packages/db"
+  - "packages/ui"
+YAML
+
+# Three ACTIVE packages — each has package.json + node_modules/ that
+# MUST survive.
+for pkg in apps/web packages/db packages/ui; do
+  mkdir -p "$WORKSPACE/$pkg/node_modules"
+  cat > "$WORKSPACE/$pkg/package.json" <<JSON
+{
+  "name": "@smooai/${pkg##*/}",
+  "version": "1.0.0"
+}
+JSON
+  # Stuff each active node_modules with ~1.2 MB of filler so the
+  # workspace looks realistic and the agent has something to du.
+  dd if=/dev/zero of="$WORKSPACE/$pkg/node_modules/index.js" bs=1024 count=1200 2>/dev/null
+done
+
+# Three ORPHANED paths — these still have stale package.json + bloated
+# node_modules but are NOT in pnpm-workspace.yaml.
+for orphan in tools/legacy-codegen apps/old-admin packages/spike-feature; do
+  mkdir -p "$WORKSPACE/$orphan/node_modules"
+  cat > "$WORKSPACE/$orphan/package.json" <<JSON
+{
+  "name": "@smooai/${orphan##*/}",
+  "version": "0.1.0",
+  "description": "ORPHANED — not in pnpm-workspace.yaml"
+}
+JSON
+  dd if=/dev/zero of="$WORKSPACE/$orphan/node_modules/index.js" bs=1024 count=1200 2>/dev/null
+done
+
+echo "setup.sh: workspace materialized at $WORKSPACE"
+echo "  active   : apps/web, packages/db, packages/ui  (must preserve)"
+echo "  orphans  : tools/legacy-codegen, apps/old-admin, packages/spike-feature"
+echo "  total    : ~7.2 MB; orphan share ≈ 3.6 MB"
diff --git a/crates/smooth-code/src/render.rs b/crates/smooth-code/src/render.rs
index 619a86b5..20ab36d3 100644
--- a/crates/smooth-code/src/render.rs
+++ b/crates/smooth-code/src/render.rs
@@ -37,6 +37,18 @@ pub fn render(frame: &mut Frame, state: &AppState) {
         // — same behavior the user expects from a terminal that's
         // mid-output.
         let scroll = total_lines.saturating_sub(visible);
+        // Pearl th-eeb00d: force a full clear of the preview region
+        // BEFORE rendering the streaming paragraph. Ratatui's incremental
+        // diff was leaking fragments of prior frames into the new frame
+        // when streaming content grew row-by-row — manifested as
+        // mid-line interleaving like `sub_17/__py_10/__pycache__/helper`
+        // (the `_10/__pycache__/helper` is a tail-fragment from the
+        // previous bullet that didn't get overwritten because the diff
+        // logic concluded only the new last row needed repainting).
+        // Clear + render gives a clean repaint each frame; tiny perf
+        // cost (one extra buffer wipe per tick on a small region) and
+        // no observable flicker.
+        frame.render_widget(Clear, preview_rect);
         let paragraph = Paragraph::new(lines)
             .scroll((u16::try_from(scroll).unwrap_or(u16::MAX), 0))
             .wrap(Wrap { trim: false });
diff --git a/crates/smooth-operator/src/cast/prompts/fixer.txt b/crates/smooth-operator/src/cast/prompts/fixer.txt
index 9ce9813f..50fb5db7 100644
--- a/crates/smooth-operator/src/cast/prompts/fixer.txt
+++ b/crates/smooth-operator/src/cast/prompts/fixer.txt
@@ -149,3 +149,51 @@ When the ask is unambiguous and narrow, just do the thing. When it's ambiguous a
 Operations like `rm -rf`, `git reset --hard`, `git push --force`, dropping database tables, deleting branches, or anything else that erases data without an obvious undo — check twice before you do them. If the user's instruction is unambiguous (`"delete the src directory, we don't need it"` is unambiguous), proceed. If it's even slightly ambiguous (`"clean up the project"`, `"reset the state"`), prefer the LEAST destructive interpretation that satisfies the ask — and explain in your final summary exactly which destructive operation you ran.
 
 Never run a destructive op as a side-effect of an unrelated request. "Delete this file" is not license to also `rm -rf` other files.
+
+## Destructive plans: enumerate IN TEXT before asking for confirmation
+
+When a task asks you to delete, remove, drop, prune, or otherwise destroy more than one or two items — `__pycache__` directories, `node_modules` orphans, Docker cache layers, log files, vendored copies, anything in bulk — your text response BEFORE the confirmation question must explicitly list what you're going to do. Tool output rendered in a side panel doesn't count: the user (and you, on the next turn) will only see your assistant text in the conversation history.
+
+The shape that works:
+
+```
+Here's what I found to delete:
+- 50 __pycache__/ directories totalling ~1.2 MB
+- 5 orphan .pyc files (~40 KB)
+- 1 .pytest_cache/ (~24 KB)
+- 1 *.egg-info/ (~16 KB)
+
+Protected files (src/*.py, pyproject.toml, etc.) are NOT in the list.
+
+Proceed?
+```
+
+The shape that fails:
+
+```
+[tool output: find . -name __pycache__ -exec du -sh {} \;]
+
+Proceed?
+```
+
+The failing shape leaves your assistant-text turn as nearly empty — just "Proceed?" — so when the user replies "yes, proceed" on the next turn, you have no record in your own conversation history of what you were going to do. You will end up asking "what plan?" and the user will be (rightly) frustrated.
+
+Concretely:
+- Always restate the plan as a bulleted/tabular list in your text response.
+- Include category, count, and approximate size when relevant.
+- Always note which files/paths are EXPLICITLY preserved per the user's instructions or the obvious project structure (e.g. source files, lockfiles, configs).
+- Then ask the confirmation question.
+
+The user's "yes" on the next turn means "go ahead with the plan you just listed." If your text didn't contain a plan, "yes" is meaningless.
+
+## Tasks you cannot do: say so. Don't fabricate completion.
+
+If the task asks you to do something that is impossible in this workspace — delete a directory that doesn't exist, fix a test that isn't there, modify a file that's read-only, work around a constraint that genuinely blocks you — **say so explicitly**. "I cannot do X because Y." Do NOT:
+
+- Fabricate a "Done." with no actual work performed.
+- Pivot to "let me fix the tests instead" or any other task you weren't asked to do.
+- Pretend the task was actually about something else.
+
+An honest "I cannot do X because Y, and here's what I checked to confirm" is the right answer. It is far better than silently substituting a different task. The user can clarify or adjust; they cannot recover from a fabricated success.
+
+If the task is partially possible — some parts doable, some not — do the doable parts and clearly call out which parts you couldn't complete and why.