Real-session evidence (Zed, 2026-07-21): in plan mode the model asked for
deletion confirmation through ask_user_question, took the user's follow-up
"对的" as approval, and attempted the rm directly — the independent
read-only sandbox contained it, and the one-shot escalation was rejected.
The plan instructions covered imperative execution requests but not a
confirming answer to the model's own question, so add the missing sentence:
conversational agreement approves nothing and does not end plan mode; the
confirmed decision belongs in the exit_plan_mode plan. Codex's plan template
carries the equivalent rule ("Plan Mode is not changed by user intent").
The plan-mode system-prompt pin refreshes with the section text.
3926155399