diff --git a/.agents/AGENTS.reference.md b/.agents/AGENTS.reference.md
index c5d9f89c..3f111089 100644
--- a/.agents/AGENTS.reference.md
+++ b/.agents/AGENTS.reference.md
@@ -6,6 +6,8 @@ This is the canonical, harness-agnostic guidance for agents working in this repo
 
 The human keeps delivery state in `.agents/work.toml`. It contains at most five ordered steps and uses only `active`, `pending`, and `complete` statuses. While work remains, `selected_action` names exactly one active step; it is omitted only after every step is complete. Before work starts, replace the starter text with a bounded user problem, change, acceptance criteria, and why-next rationale. Run `agent-flow next` for the current brief.
 
+The four prose fields (`user_problem`, `change`, each `acceptance` item, and `why_next`) may hold paragraphs, so write them with a TOML multi-line string (`"""`) when one line will not state the problem honestly. The structural values stay on one line each: `selected_action`, every step `id`, every `blocked_by` id, and every status. Tabs, carriage returns, other control characters, and Unicode line or paragraph separators are rejected everywhere, in prose as well; only the line-feed paragraph break is prose-only. The `next` brief indents every continuation line, so prose cannot forge a heading of its own.
+
 To start the selected action, copy `.agents/user-prompts/kickoff.md`, fill in its optional context, and paste it to the agent.
 
 `.agents/work.toml` is the only workflow task-state file. Do not create a plan tree, ledger, round log, findings directory, or review record. Product-development checks under `.agents/checks.toml`, `.agents/checks/`, and `.agents/hooks/` are optional tooling, not task state or proof of review.
diff --git a/.agents/work.toml b/.agents/work.toml
index 45bbf4b2..5926bc88 100644
--- a/.agents/work.toml
+++ b/.agents/work.toml
@@ -1,5 +1,5 @@
 version = 1
-selected_action = "support-safe-work-paragraphs"
+selected_action = "explore-general-review-surface"
 
 [[step]]
 id = "enforce-reset-guardrails"
@@ -20,7 +20,7 @@ why_next = "Every later action is safer once a mechanical gate, not a promise, h
 
 [[step]]
 id = "support-safe-work-paragraphs"
-status = "active"
+status = "complete"
 blocked_by = ["enforce-reset-guardrails"]
 user_problem = "Every work field must fit one line, so a step cannot explain its problem without cramming it."
 change = "Let prose fields carry paragraphs while ids and structural fields stay single-line, and keep both projections safe."
@@ -35,7 +35,7 @@ why_next = "Bounded state is only worth trusting if a step can state its problem
 
 [[step]]
 id = "explore-general-review-surface"
-status = "pending"
+status = "active"
 blocked_by = ["support-safe-work-paragraphs"]
 user_problem = "The scaffold supports delivery review, but not a standalone review of a current tree or a diff between two states."
 change = "Compare a compact prompt, a dedicated CLI command and no product surface, then recommend one."
diff --git a/AGENTS.md b/AGENTS.md
index c5d9f89c..3f111089 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -6,6 +6,8 @@ This is the canonical, harness-agnostic guidance for agents working in this repo
 
 The human keeps delivery state in `.agents/work.toml`. It contains at most five ordered steps and uses only `active`, `pending`, and `complete` statuses. While work remains, `selected_action` names exactly one active step; it is omitted only after every step is complete. Before work starts, replace the starter text with a bounded user problem, change, acceptance criteria, and why-next rationale. Run `agent-flow next` for the current brief.
 
+The four prose fields (`user_problem`, `change`, each `acceptance` item, and `why_next`) may hold paragraphs, so write them with a TOML multi-line string (`"""`) when one line will not state the problem honestly. The structural values stay on one line each: `selected_action`, every step `id`, every `blocked_by` id, and every status. Tabs, carriage returns, other control characters, and Unicode line or paragraph separators are rejected everywhere, in prose as well; only the line-feed paragraph break is prose-only. The `next` brief indents every continuation line, so prose cannot forge a heading of its own.
+
 To start the selected action, copy `.agents/user-prompts/kickoff.md`, fill in its optional context, and paste it to the agent.
 
 `.agents/work.toml` is the only workflow task-state file. Do not create a plan tree, ledger, round log, findings directory, or review record. Product-development checks under `.agents/checks.toml`, `.agents/checks/`, and `.agents/hooks/` are optional tooling, not task state or proof of review.
diff --git a/README.md b/README.md
index 7f50529b..3dbea83b 100644
--- a/README.md
+++ b/README.md
@@ -178,10 +178,14 @@ agent-flow render --check --strict docs/plans/my-task.plan.toml
 
 When `.agents/work.toml` exists, bounded work mode is the default. The same source can be selected explicitly with `--source .agents/work.toml`. The version-1 file is at most 4,096 bytes, contains at most five total ordered `[[step]]` entries, and uses only `active`, `pending`, and `complete`. While any step remains active or pending, `selected_action` is required and names an active step; it may be absent only when every step is complete. Several steps may be active, but every blocker id must exist and an active step's blockers must already be complete; pending steps may depend on active or pending predecessors.
 
+Fields split into prose and structure, and only prose may span lines. The four prose fields (`user_problem`, `change`, each `acceptance` item, and `why_next`) accept TOML multi-line strings, so a step can state its problem in paragraphs instead of cramming it onto one line. The structural values stay one line each: `selected_action`, every step `id`, every `blocked_by` id, and every status. Everything else stays unsafe in both kinds of field, prose included: tabs, carriage returns, any other control character, and the Unicode line (U+2028) and paragraph (U+2029) separators are rejected with the offending field named. Only the line-feed paragraph break is prose-only.
+
 `validate` checks those invariants and exits nonzero with source-prefixed diagnostics on a violation. For an all-complete file it reports valid completion. It does not read plans, ledgers, workflow specs, review directories, or metrics logs in work mode, so a self-authored review record cannot change the result.
 
 `status` projects every ordered step, its status, and dependency ids with their current statuses, plus the selected action or no action after completion. Human and `--json` forms are deterministic and fail rather than truncate above 16,384 bytes. `next` lists every active unit in file order and one selected action with its user problem, change, acceptance criteria, and why-next rationale; after completion it lists no active units, no selected action, and an explicit completed result (`selected_action` is `null` in JSON). Pending-step prose and all legacy process files are not read by this path. Both `next` formats retain their 8,192-byte fail-rather-than-truncate limit.
 
+Multiline prose keeps its paragraphs in both formats. The human brief prints the first line beside its label and indents every continuation line behind a `  |` gutter, blank paragraph lines included; since no top-level line of that output begins with a space, prose reading `SELECTED ACTION`, `acceptance:`, `- forged` or `why next:` arrives as the indented continuation it is and cannot forge a heading, an active-unit row, or an acceptance item. `--json` needs no gutter and preserves each accepted string exactly, line feeds and blank lines included.
+
 ```sh
 # Bounded human brief from .agents/work.toml:
 agent-flow next
diff --git a/pack/AGENTS.md b/pack/AGENTS.md
index 9f3215db..145b0b8a 100644
--- a/pack/AGENTS.md
+++ b/pack/AGENTS.md
@@ -6,6 +6,8 @@ This is the canonical, harness-agnostic guidance for agents working in this repo
 
 The human keeps delivery state in `.agents/work.toml`. It contains at most five ordered steps and uses only `active`, `pending`, and `complete` statuses. While work remains, `selected_action` names exactly one active step; it is omitted only after every step is complete. Before work starts, replace the starter text with a bounded user problem, change, acceptance criteria, and why-next rationale. Run `agent-flow next` for the current brief.
 
+The four prose fields (`user_problem`, `change`, each `acceptance` item, and `why_next`) may hold paragraphs, so write them with a TOML multi-line string (`"""`) when one line will not state the problem honestly. The structural values stay on one line each: `selected_action`, every step `id`, every `blocked_by` id, and every status. Tabs, carriage returns, other control characters, and Unicode line or paragraph separators are rejected everywhere, in prose as well; only the line-feed paragraph break is prose-only. The `next` brief indents every continuation line, so prose cannot forge a heading of its own.
+
 To start the selected action, copy `.agents/user-prompts/kickoff.md`, fill in its optional context, and paste it to the agent.
 
 `.agents/work.toml` is the only workflow task-state file. Do not create a plan tree, ledger, round log, findings directory, or review record. Product-development checks under `.agents/checks.toml`, `.agents/checks/`, and `.agents/hooks/` are optional tooling, not task state or proof of review.
diff --git a/src/next.rs b/src/next.rs
index 64c3a914..888142a9 100644
--- a/src/next.rs
+++ b/src/next.rs
@@ -152,20 +152,62 @@ pub(crate) fn render_work_human(projection: &WorkProjection) -> String {
 
 	out.push_str("\nSELECTED ACTION\n");
 	if let Some(action) = &projection.selected_action {
+		// The id is structural and single-line by construction (`work::reject_structural_text`),
+		// so it stays an ordinary inline substitution.
 		out.push_str(&format!("id: {}\n", action.id));
-		out.push_str(&format!("user problem: {}\n", action.user_problem));
-		out.push_str(&format!("change: {}\n", action.change));
+		push_prose(&mut out, "user problem:", &action.user_problem);
+		push_prose(&mut out, "change:", &action.change);
 		out.push_str("acceptance:\n");
 		for criterion in &action.acceptance {
-			out.push_str(&format!("- {criterion}\n"));
+			push_prose(&mut out, "-", criterion);
 		}
-		out.push_str(&format!("why next: {}", action.why_next));
+		push_prose(&mut out, "why next:", &action.why_next);
+		// `why_next` is the last block, and this projection ends without a trailing
+		// newline (`emit_next_output` adds the one). Same idiom as `render_status_human`.
+		out.pop();
 	} else {
 		out.push_str("none\n\nRESULT\ncompleted");
 	}
 	out
 }
 
+/// The gutter every continuation line of a multiline prose value carries.
+///
+/// This is the whole heading-injection defence, and it works by exhausting the
+/// alternative: EVERY top-level line of this projection starts at column zero with
+/// `source:`, `ACTIVE UNITS`, `SELECTED ACTION`, `RESULT`, `id:`, `user problem:`,
+/// `change:`, `acceptance:`, `why next:`, `none`, `completed`, `- ` or nothing at all.
+/// None of those begins with a space, so a line that begins with this gutter is a
+/// continuation and can be nothing else. The bar keeps a blank paragraph line visible
+/// (and keeps it from being bare trailing whitespace) so the break survives a reader,
+/// a copy, and a formatter.
+const PROSE_CONTINUATION: &str = "  |";
+
+/// Append one labelled prose value: `<label> <first line>`, then one gutter-prefixed
+/// line per continuation line.
+///
+/// A single-line value renders the exact line this projection has always printed, so
+/// the ordinary brief is unchanged. A multiline one keeps its paragraph structure while
+/// every line after the first arrives behind `PROSE_CONTINUATION`, so prose reading
+/// `SELECTED ACTION`, `ACTIVE UNITS`, `acceptance:`, `- forged`, `id: forged` or
+/// `why next:` is rendered as the indented continuation it is rather than as the
+/// top-level line it imitates. The separating space is written only for a non-empty
+/// line, so neither the label nor the gutter ever trails whitespace.
+fn push_prose(
+	out: &mut String,
+	label: &str,
+	value: &str,
+) {
+	for (index, line) in value.split('\n').enumerate() {
+		out.push_str(if index == 0 { label } else { PROSE_CONTINUATION });
+		if !line.is_empty() {
+			out.push(' ');
+			out.push_str(line);
+		}
+		out.push('\n');
+	}
+}
+
 pub(crate) fn render_work_json(projection: &WorkProjection) -> Result<String, serde_json::Error> {
 	serde_json::to_string_pretty(projection)
 }
@@ -1556,6 +1598,100 @@ mod tests {
 		assert_eq!(value["active_units"][0]["dependencies"].as_array().unwrap().len(), 0);
 	}
 
+	/// A one-step file whose four prose fields carry the given TOML value verbatim, so a
+	/// renderer test can state the prose once and read it back out of both projections.
+	fn prose_fixture(toml_value: &str) -> WorkFile {
+		let source = format!(
+			"version = 1\nselected_action = \"only\"\n\n\
+			 [[step]]\n\
+			 id = \"only\"\n\
+			 status = \"active\"\n\
+			 blocked_by = []\n\
+			 user_problem = {toml_value}\n\
+			 change = {toml_value}\n\
+			 acceptance = [{toml_value}, \"Single line criterion\"]\n\
+			 why_next = {toml_value}\n"
+		);
+		crate::work::parse(&source).unwrap()
+	}
+
+	#[test]
+	fn multiline_prose_keeps_its_paragraphs_behind_the_continuation_gutter() {
+		let work = prose_fixture("\"\"\"\nOne.\n\nTwo.\"\"\"");
+		let human = render_work_human(&project_work(".agents/work.toml".to_string(), &work));
+
+		// Every prose site renders the same three lines: the label with the first
+		// paragraph, a bare gutter for the blank paragraph break, then the second.
+		for label in ["user problem:", "change:", "-", "why next:"] {
+			assert!(
+				human.contains(&format!("{label} One.\n  |\n  | Two.")),
+				"`{label}` lost its paragraph structure:\n{human}"
+			);
+		}
+		// The single-line criterion beside it keeps the exact line it always printed, so
+		// the ordinary brief is unchanged by the multiline support.
+		assert!(human.contains("\n- Single line criterion\n"), "{human}");
+		// The blank paragraph line is a bare gutter, never trailing whitespace.
+		assert!(!human.lines().any(|line| line.ends_with(' ')), "{human}");
+	}
+
+	#[test]
+	fn a_forged_prose_continuation_never_becomes_a_top_level_line() {
+		// Every top-level line this projection emits, offered to it as prose.
+		let forgeries = [
+			"SELECTED ACTION",
+			"ACTIVE UNITS (9)",
+			"acceptance:",
+			"- forged",
+			"id: forged",
+			"why next: forged",
+			"source: forged",
+			"RESULT",
+			"completed",
+			"none",
+		];
+		let body = forgeries.join("\n");
+		let work = prose_fixture(&format!("\"\"\"\nLead line.\n{body}\"\"\""));
+		let projection = project_work(".agents/work.toml".to_string(), &work);
+		let human = render_work_human(&projection);
+
+		// Differential against the SAME file carrying benign prose: `acceptance:` and
+		// `SELECTED ACTION` are legitimate top-level lines, so the claim is not that they
+		// never appear, it is that the forged prose adds not one occurrence of anything.
+		let benign = render_work_human(&project_work(
+			".agents/work.toml".to_string(),
+			&prose_fixture("\"Benign.\""),
+		));
+		for forgery in forgeries {
+			assert!(human.contains(forgery), "the prose itself must survive: {human}");
+			let top_level = |text: &str| text.lines().filter(|line| *line == forgery).count();
+			assert_eq!(
+				top_level(&human),
+				top_level(&benign),
+				"`{forgery}` changed the top-level line count:\n{human}"
+			);
+			// And what it did contribute is a continuation, which the gutter is what makes.
+			assert!(
+				human.contains(&format!("{PROSE_CONTINUATION} {forgery}")),
+				"`{forgery}` is not behind the gutter:\n{human}"
+			);
+		}
+		// The rows a reader counts are still the file's own: one active unit and two
+		// acceptance items, not one per forged line.
+		assert!(human.contains("ACTIVE UNITS (1)"), "{human}");
+		assert_eq!(human.lines().filter(|line| line.starts_with("- ")).count(), 3, "{human}");
+
+		// The JSON side needs no gutter: the strings are escaped, and they round-trip to
+		// exactly the accepted prose.
+		let value: serde_json::Value =
+			serde_json::from_str(&render_work_json(&projection).unwrap()).unwrap();
+		let expected = format!("Lead line.\n{body}");
+		assert_eq!(value["selected_action"]["user_problem"], expected);
+		assert_eq!(value["selected_action"]["change"], expected);
+		assert_eq!(value["selected_action"]["acceptance"][0], expected);
+		assert_eq!(value["selected_action"]["why_next"], expected);
+	}
+
 	#[test]
 	fn next_output_size_includes_the_trailing_newline_and_never_truncates() {
 		enforce_output_size(&"x".repeat(MAX_OUTPUT_BYTES - 1)).unwrap();
diff --git a/src/work.rs b/src/work.rs
index 9f30c86e..d956e53d 100644
--- a/src/work.rs
+++ b/src/work.rs
@@ -144,7 +144,12 @@ impl std::fmt::Display for ParseError {
 					(None, Some(item)) => format!("work file field `{field}` item {item}"),
 					(None, None) => format!("work file field `{field}`"),
 				};
-				write!(f, "{location} contains control character U+{:04X}", u32::from(*character))
+				write!(
+					f,
+					"{location} contains {} U+{:04X}",
+					unsafe_character_kind(*character),
+					u32::from(*character)
+				)
 			}
 			Self::UnknownBlocker {
 				step,
@@ -212,13 +217,68 @@ impl std::error::Error for ParseError {
 	}
 }
 
-fn reject_control_characters(
+/// Whether a character is unsafe in ANY work-file value. Two families: the control
+/// characters (which include the C1 block, so U+0085 NEXT LINE is here rather than
+/// spelled out), and the two Unicode separators a consumer may render as a line break.
+/// U+2028 and U+2029 are not control characters, so `char::is_control` alone would let
+/// them through into text that is about to be printed as lines.
+///
+/// This is the whole unsafe set. The two callers below differ in ONE character: prose
+/// exempts the line feed, and nothing else.
+fn is_unsafe_character(character: char) -> bool {
+	character.is_control() || matches!(character, '\u{2028}' | '\u{2029}')
+}
+
+/// What to call an unsafe character in a diagnostic. The separators get their own words
+/// because calling U+2028 a control character would send a reader looking for something
+/// that is not there.
+fn unsafe_character_kind(character: char) -> &'static str {
+	match character {
+		'\u{2028}' => "line separator",
+		'\u{2029}' => "paragraph separator",
+		_ => "control character",
+	}
+}
+
+/// A STRUCTURAL value: `selected_action`, a step `id`, a blocker id. These name things
+/// and are printed inline inside composed lines (`- {id} [{status}; ...]`), so a line
+/// break anywhere in one forges output. Every unsafe character is rejected, the line
+/// feed included.
+fn reject_structural_text(
+	value: &str,
+	step: Option<usize>,
+	field: &'static str,
+	item: Option<usize>,
+) -> Result<(), ParseError> {
+	reject_unsafe_text(value, step, field, item, is_unsafe_character)
+}
+
+/// A PROSE value: `user_problem`, `change`, an `acceptance` item, `why_next`. A step
+/// cannot state its problem honestly on one line, so these carry paragraphs: the line
+/// feed is accepted, and the renderer indents every continuation line behind a gutter
+/// (`next::PROSE_CONTINUATION`) so a paragraph break cannot become a top-level output
+/// line. Every OTHER unsafe character stays rejected, including the tab and the carriage
+/// return, which a terminal can move the cursor with, and the two Unicode separators,
+/// which some consumers break lines on.
+fn reject_prose_text(
 	value: &str,
 	step: Option<usize>,
 	field: &'static str,
 	item: Option<usize>,
 ) -> Result<(), ParseError> {
-	if let Some(character) = value.chars().find(|character| character.is_control()) {
+	reject_unsafe_text(value, step, field, item, |character| {
+		character != '\n' && is_unsafe_character(character)
+	})
+}
+
+fn reject_unsafe_text(
+	value: &str,
+	step: Option<usize>,
+	field: &'static str,
+	item: Option<usize>,
+	is_unsafe: impl Fn(char) -> bool,
+) -> Result<(), ParseError> {
+	if let Some(character) = value.chars().find(|character| is_unsafe(*character)) {
 		return Err(ParseError::UnsafeText {
 			step,
 			field,
@@ -242,22 +302,24 @@ pub(crate) fn parse(source: &str) -> Result<WorkFile, ParseError> {
 	}
 
 	if let Some(selected_action) = &work.selected_action {
-		reject_control_characters(selected_action, None, "selected_action", None)?;
+		reject_structural_text(selected_action, None, "selected_action", None)?;
 	}
 
 	let mut positions = BTreeMap::new();
 	for (index, step) in work.steps.iter().enumerate() {
 		let position = index + 1;
-		reject_control_characters(&step.id, Some(position), "id", None)?;
+		// Structural first, then prose: the split is per FIELD, not per file, so one
+		// weakened predicate can never let a line break into an id.
+		reject_structural_text(&step.id, Some(position), "id", None)?;
 		for (item, blocker) in step.blocked_by.iter().enumerate() {
-			reject_control_characters(blocker, Some(position), "blocked_by", Some(item + 1))?;
+			reject_structural_text(blocker, Some(position), "blocked_by", Some(item + 1))?;
 		}
-		reject_control_characters(&step.user_problem, Some(position), "user_problem", None)?;
-		reject_control_characters(&step.change, Some(position), "change", None)?;
+		reject_prose_text(&step.user_problem, Some(position), "user_problem", None)?;
+		reject_prose_text(&step.change, Some(position), "change", None)?;
 		for (item, criterion) in step.acceptance.iter().enumerate() {
-			reject_control_characters(criterion, Some(position), "acceptance", Some(item + 1))?;
+			reject_prose_text(criterion, Some(position), "acceptance", Some(item + 1))?;
 		}
-		reject_control_characters(&step.why_next, Some(position), "why_next", None)?;
+		reject_prose_text(&step.why_next, Some(position), "why_next", None)?;
 
 		if let Some(first) = positions.insert(step.id.as_str(), position) {
 			return Err(ParseError::DuplicateStepId {
@@ -629,8 +691,8 @@ mod tests {
 			(
 				"user problem",
 				"user_problem = \"Alpha problem\"",
-				"user_problem = \"Alpha\\nspoof\"",
-				"step 1 field `user_problem` contains control character U+000A",
+				"user_problem = \"Alpha\\rspoof\"",
+				"step 1 field `user_problem` contains control character U+000D",
 			),
 			(
 				"change",
@@ -647,8 +709,8 @@ mod tests {
 			(
 				"why next",
 				"why_next = \"Beta why\"",
-				"why_next = \"Beta\\nspoof\"",
-				"step 2 field `why_next` contains control character U+000A",
+				"why_next = \"Beta\\tspoof\"",
+				"step 2 field `why_next` contains control character U+0009",
 			),
 		];
 
@@ -659,6 +721,97 @@ mod tests {
 		}
 	}
 
+	/// Two paragraphs with a blank line between them, at every one of the four prose
+	/// sites, written as the TOML multi-line basic strings a human would actually type.
+	/// The leading newline after each `"""` is TOML's own trim, so every value starts at
+	/// its first word.
+	fn paragraphs_source() -> String {
+		"version = 1\nselected_action = \"alpha\"\n\n\
+		 [[step]]\n\
+		 id = \"alpha\"\n\
+		 status = \"active\"\n\
+		 blocked_by = []\n\
+		 user_problem = \"\"\"\nProblem one.\n\nProblem two.\"\"\"\n\
+		 change = \"\"\"\nChange one.\n\nChange two.\"\"\"\n\
+		 acceptance = [\"\"\"\nCriterion one.\n\nCriterion two.\"\"\", \"Single line criterion\"]\n\
+		 why_next = \"\"\"\nWhy one.\n\nWhy two.\"\"\"\n"
+			.to_string()
+	}
+
+	#[test]
+	fn every_prose_field_carries_paragraphs_verbatim() {
+		let work = parse(&paragraphs_source()).unwrap();
+		let step = &work.steps[0];
+		assert_eq!(step.user_problem, "Problem one.\n\nProblem two.");
+		assert_eq!(step.change, "Change one.\n\nChange two.");
+		assert_eq!(step.acceptance, ["Criterion one.\n\nCriterion two.", "Single line criterion"]);
+		assert_eq!(step.why_next, "Why one.\n\nWhy two.");
+		// The structural half of the same file is untouched by the prose relaxation.
+		assert_eq!(step.id, "alpha");
+		assert_eq!(work.selected_action.as_deref(), Some("alpha"));
+	}
+
+	#[test]
+	fn prose_accepts_the_line_feed_and_no_other_unsafe_character() {
+		// One case per unsafe family, at a prose site: the tab and the carriage return a
+		// terminal moves the cursor with, another C0 control, the C1 NEXT LINE, and the two
+		// Unicode separators that are not control characters at all and so needed checking
+		// for on top of `char::is_control`.
+		let cases = [
+			("tab", "\\t", "control character U+0009"),
+			("carriage return", "\\r", "control character U+000D"),
+			("vertical tab", "\\u000B", "control character U+000B"),
+			("next line", "\\u0085", "control character U+0085"),
+			("line separator", "\\u2028", "line separator U+2028"),
+			("paragraph separator", "\\u2029", "paragraph separator U+2029"),
+		];
+		for (name, escape, expected) in cases {
+			let input = source(Some("alpha")).replace(
+				"user_problem = \"Alpha problem\"",
+				&format!("user_problem = \"Alpha{escape}spoof\""),
+			);
+			assert_eq!(
+				parse(&input).unwrap_err().to_string(),
+				format!("step 1 field `user_problem` contains {expected}"),
+				"{name}"
+			);
+		}
+	}
+
+	#[test]
+	fn a_structural_field_rejects_the_line_feed_prose_now_accepts() {
+		// The same character, the same file, the two verdicts the split exists to give.
+		let cases = [
+			(
+				"selected_action = \"alpha\"",
+				"work file field `selected_action` contains control character U+000A",
+			),
+			("id = \"alpha\"", "step 1 field `id` contains control character U+000A"),
+			(
+				"blocked_by = [\"alpha\"]",
+				"step 2 field `blocked_by` item 1 contains control character U+000A",
+			),
+		];
+		for (field, expected) in cases {
+			let spoofed = field.replace("alpha", "alpha\\nspoof");
+			let input = source(Some("alpha")).replace(field, &spoofed);
+			assert_eq!(parse(&input).unwrap_err().to_string(), expected, "{field}");
+		}
+
+		// A structural id also rejects the two separators, which are not control
+		// characters, and names each one precisely rather than calling it a control.
+		for (escape, expected) in
+			[("\\u2028", "line separator U+2028"), ("\\u2029", "paragraph separator U+2029")]
+		{
+			let input =
+				source(Some("alpha")).replace("id = \"beta\"", &format!("id = \"beta{escape}\""));
+			assert_eq!(
+				parse(&input).unwrap_err().to_string(),
+				format!("step 2 field `id` contains {expected}")
+			);
+		}
+	}
+
 	#[test]
 	fn printable_ascii_and_unicode_projection_text_is_preserved() {
 		let input = source(Some("alpha")).replace(
diff --git a/tests/next_work_source.rs b/tests/next_work_source.rs
index 0146e155..ea645017 100644
--- a/tests/next_work_source.rs
+++ b/tests/next_work_source.rs
@@ -169,11 +169,149 @@ fn invalid_work_sources_fail_without_stdout_and_name_the_source() {
 		"selected_action `pending` has status `pending`; expected `active`",
 	);
 
+	// A newline in a STRUCTURAL value is still a forged line, so it still fails, still
+	// names the exact field, and still writes no stdout. The prose relaxation is per
+	// field: it did not weaken this.
 	assert_work_error(
-		"multiline-field",
-		&work_source("line one\nline two"),
-		"step 2 field `change` contains control character U+000A",
+		"structural-newline-id",
+		&work_source("Selected change").replace("id = \"third\"", "id = \"third\\nspoof\""),
+		"step 3 field `id` contains control character U+000A",
 	);
+	assert_work_error(
+		"structural-newline-selection",
+		&work_source("Selected change")
+			.replace("selected_action = \"second\"", "selected_action = \"second\\nspoof\""),
+		"work file field `selected_action` contains control character U+000A",
+	);
+	assert_work_error(
+		"structural-newline-blocker",
+		&work_source("Selected change")
+			.replace("blocked_by = [\"second\"]", "blocked_by = [\"second\\nspoof\"]"),
+		"step 4 field `blocked_by` item 1 contains control character U+000A",
+	);
+}
+
+#[test]
+fn unsafe_prose_characters_still_fail_before_any_output() {
+	// The line feed is the ONE character prose gained. Every other unsafe family still
+	// fails at the boundary, in both formats, before a byte of stdout: the tab and the
+	// carriage return, another C0 control, the C1 NEXT LINE, and the two Unicode
+	// separators that `char::is_control` does not cover and so are named precisely.
+	let cases = [
+		("tab", "\\t", "control character U+0009"),
+		("carriage-return", "\\r", "control character U+000D"),
+		("vertical-tab", "\\u000B", "control character U+000B"),
+		("next-line", "\\u0085", "control character U+0085"),
+		("line-separator", "\\u2028", "line separator U+2028"),
+		("paragraph-separator", "\\u2029", "paragraph separator U+2029"),
+	];
+	for (name, escape, expected) in cases {
+		let root = scratch(&format!("unsafe-prose-{name}"));
+		// Substituted into the rendered TOML rather than through `work_source`, whose
+		// `{:?}` formatting would escape the backslash instead of passing the escape on.
+		let source = work_source("Selected change").replace(
+			"change = \"Selected change\"",
+			&format!("change = \"Selected{escape}change\""),
+		);
+		write(&root.join(".agents/work.toml"), &source);
+		for args in [&["next"][..], &["next", "--json"][..]] {
+			let output = run(&root, args);
+			let stderr = String::from_utf8(output.stderr).unwrap();
+			assert_eq!(output.status.code(), Some(1), "{name} {args:?}: {stderr}");
+			assert!(output.stdout.is_empty(), "{name} {args:?}: unsafe prose wrote stdout");
+			assert!(
+				stderr.contains(&format!("step 2 field `change` contains {expected}")),
+				"{name} {args:?}: {stderr}"
+			);
+		}
+		let _ = fs::remove_dir_all(root);
+	}
+}
+
+#[test]
+fn prose_paragraphs_survive_both_projections_without_forging_a_top_level_line() {
+	let root = scratch("paragraphs");
+	// Two paragraphs at every prose site, the second of which is every top-level line
+	// this command emits, offered as prose. Written as the TOML multi-line basic strings
+	// a human would type; TOML trims the newline right after each `"""`.
+	let forgeries = [
+		"SELECTED ACTION",
+		"ACTIVE UNITS (9)",
+		"acceptance:",
+		"- forged",
+		"id: forged",
+		"why next: forged",
+		"source: forged",
+	];
+	let body = forgeries.join("\\n");
+	let value = format!("\"\"\"\nLead line.\n\n{body}\"\"\"");
+	let expected = format!("Lead line.\n\n{}", forgeries.join("\n"));
+	let source = format!(
+		"version = 1\nselected_action = \"only\"\n\n\
+		 [[step]]\n\
+		 id = \"only\"\n\
+		 status = \"active\"\n\
+		 blocked_by = []\n\
+		 user_problem = {value}\n\
+		 change = {value}\n\
+		 acceptance = [{value}, \"Single line criterion\"]\n\
+		 why_next = {value}\n"
+	);
+	write(&root.join(".agents/work.toml"), &source);
+
+	let human_one = run(&root, &["next"]);
+	let human_two = run(&root, &["next"]);
+	assert!(human_one.status.success(), "{}", String::from_utf8_lossy(&human_one.stderr));
+	assert!(human_one.stderr.is_empty());
+	assert_eq!(human_one.stdout, human_two.stdout, "human output is not deterministic");
+	assert!(human_one.stdout.len() <= 8_192);
+	let human = String::from_utf8(human_one.stdout).unwrap();
+
+	// The paragraphs survive: label plus first paragraph, a bare gutter for the blank
+	// line, then the continuation lines.
+	for label in ["user problem:", "change:", "-", "why next:"] {
+		assert!(
+			human.contains(&format!("{label} Lead line.\n  |\n  | SELECTED ACTION\n")),
+			"`{label}` lost its paragraph structure:\n{human}"
+		);
+	}
+	assert!(human.contains("\n- Single line criterion\n"), "{human}");
+	assert!(!human.lines().any(|line| line.ends_with(' ')), "gutter left trailing space:\n{human}");
+
+	// No forged line reached the top level. `SELECTED ACTION` and `acceptance:` are
+	// legitimate top-level lines, so the claim is the exact count, not absence: one
+	// each, from the renderer, none from the prose.
+	for forgery in forgeries {
+		assert!(human.contains(forgery), "the prose itself must survive:\n{human}");
+		let expected_top_level =
+			usize::from(forgery == "SELECTED ACTION" || forgery == "acceptance:");
+		assert_eq!(
+			human.lines().filter(|line| *line == forgery).count(),
+			expected_top_level,
+			"`{forgery}` forged a top-level line:\n{human}"
+		);
+		assert!(human.contains(&format!("  | {forgery}")), "`{forgery}` is not indented:\n{human}");
+	}
+	assert!(human.contains("ACTIVE UNITS (1)"), "{human}");
+	assert_eq!(human.lines().filter(|line| line.starts_with("- ")).count(), 3, "{human}");
+
+	// JSON preserves the accepted strings exactly, line feeds and blank paragraph line
+	// included, and stays deterministic and bounded.
+	let json_one = run(&root, &["next", "--json"]);
+	let json_two = run(&root, &["next", "--json"]);
+	assert!(json_one.status.success(), "{}", String::from_utf8_lossy(&json_one.stderr));
+	assert!(json_one.stderr.is_empty());
+	assert_eq!(json_one.stdout, json_two.stdout, "JSON output is not deterministic");
+	assert!(json_one.stdout.len() <= 8_192);
+	let projected: serde_json::Value = serde_json::from_slice(&json_one.stdout).unwrap();
+	let action = &projected["selected_action"];
+	assert_eq!(action["user_problem"], expected);
+	assert_eq!(action["change"], expected);
+	assert_eq!(action["acceptance"][0], expected);
+	assert_eq!(action["acceptance"][1], "Single line criterion");
+	assert_eq!(action["why_next"], expected);
+
+	let _ = fs::remove_dir_all(root);
 }
 
 #[test]