@@ -61,9 +61,11 @@ const openAIPromptAddendum = `<model_guidance>
   commands, and symbols.
 - Strongly prefer the native file tools (read_file, list_directory, grep, glob,
   edit_file, apply_patch, write_file) over shelling out to cat/sed/awk/python
-  for file work. Make one tool call per file; do not batch file writes into a
-  script. Independent tool calls (several reads, several edit_file calls to
-  different files) belong in the same turn.
+  for file work. read_file, edit_file and write_file take one file per call;
+  a single apply_patch may span several files when they form one coherent
+  change. Do not batch file writes into a script. Independent tool calls
+  (several reads, several edit_file calls to different files) belong in the
+  same turn.
 - Persist until the task is fully handled this turn: gather context, implement,
   run the validators, and report — do not stop at a partial result.
 </model_guidance>`
 
@@ -16,21 +16,47 @@ func TestApplyPatchPathBlockOnlyRejectsRelativeTraversal(t *testing.T) {
 		"absolute inside workspace": structured(inside),
 		"relative":                  structured("main.js"),
 		"decorated markers":         "*** Begin Patch ***\n*** Update File: main.js\n@@\n-a\n+b\n*** End Patch ***",
+		"no-space marker":           "***Begin Patch\n*** Update File: main.js\n@@\n-a\n+b\n***End Patch",
 	} {
 		request := Request{ToolName: "apply_patch", WorkspaceRoot: root, SideEffect: SideEffectWrite, Args: map[string]any{"patch": patch}}
 		if block := applyPatchPathBlock(request); block != nil {
 			t.Fatalf("%s: unexpected block %+v", name, block)
 		}
 	}
 	for _, path := range []string{"../escape.js", ".."} {
-		request := Request{ToolName: "apply_patch", WorkspaceRoot: root, SideEffect: SideEffectWrite, Args: map[string]any{"patch": structured(path)}}
-		block := applyPatchPathBlock(request)
-		if block == nil || block.Code != BlockOutsideWorkspace {
-			t.Fatalf("%q must be blocked as traversal, got %+v", path, block)
+		for name, patch := range map[string]string{"canonical": structured(path), "no-space": "***Begin Patch\n*** Update File: " + path + "\n@@\n-a\n+b\n***End Patch"} {
+			request := Request{ToolName: "apply_patch", WorkspaceRoot: root, SideEffect: SideEffectWrite, Args: map[string]any{"patch": patch}}
+			block := applyPatchPathBlock(request)
+			if block == nil || block.Code != BlockOutsideWorkspace {
+				t.Fatalf("%s %q must be blocked as traversal, got %+v", name, path, block)
+			}
 		}
 	}
 }
 
+// Every marker spelling the tool applies must be classified as structured at
+// the sandbox boundary too; otherwise the boundary scans the patch as a unified
+// diff, extracts no targets, and validates nothing (fail-open).
+func TestStructuredPatchClassifierMatchesToolSpellings(t *testing.T) {
+	for _, header := range []string{"*** Begin Patch", "*** Begin Patch ***", "***Begin Patch", "  *** Begin Patch  ", "\ufeff*** Begin Patch"} {
+		patch := header + "\n*** Update File: main.js\n@@\n-a\n+b\n*** End Patch"
+		if !IsStructuredPatch(patch) {
+			t.Fatalf("%q must classify as a structured patch", header)
+		}
+		if paths := applyPatchPaths(patch); len(paths) != 1 || paths[0] != "main.js" {
+			t.Fatalf("%q: sandbox must extract the structured target, got %v", header, paths)
+		}
+	}
+	for _, header := range []string{"--- a/x", "Begin Patch", "*** Begin Patchwork", "*** Update File: x"} {
+		if IsStructuredPatch(header + "\n-a\n+b") {
+			t.Fatalf("%q must not classify as a structured patch", header)
+		}
+	}
+	if StructuredPatchMarker("*** End Patch ***") != "end" || StructuredPatchMarker("***End Patch") != "end" {
+		t.Fatal("decorated end markers must classify as end")
+	}
+}
+
 func TestApplyPatchRequestPathsCarryAbsolutePathsToScopeValidation(t *testing.T) {
 	root := t.TempDir()
 	// NewScope also grants the system temp dir, so a sibling t.TempDir() is
@@ -39,10 +65,14 @@ func TestApplyPatchRequestPathsCarryAbsolutePathsToScopeValidation(t *testing.T)
 	if err != nil {
 		t.Fatal(err)
 	}
-	patch := strings.Join([]string{"*** Begin Patch", "*** Update File: " + outside, "@@", "-a", "+b", "*** End Patch"}, "\n")
-	paths := applyPatchRequestPaths(map[string]any{"patch": patch})
-	if len(paths) != 1 || paths[0] != outside {
-		t.Fatalf("absolute patch path must reach scope validation unchanged, got %v", paths)
+	for name, patch := range map[string]string{
+		"canonical": strings.Join([]string{"*** Begin Patch", "*** Update File: " + outside, "@@", "-a", "+b", "*** End Patch"}, "\n"),
+		"no-space":  strings.Join([]string{"***Begin Patch", "*** Update File: " + outside, "@@", "-a", "+b", "***End Patch"}, "\n"),
+	} {
+		paths := applyPatchRequestPaths(map[string]any{"patch": patch})
+		if len(paths) != 1 || paths[0] != outside {
+			t.Fatalf("%s: absolute patch path must reach scope validation unchanged, got %v", name, paths)
+		}
 	}
 	scope, err := NewScope(root, nil)
 	if err != nil {
 
@@ -300,8 +300,35 @@ func applyPatchPathBlock(request Request) *pathBlock {
 	return nil
 }
 
+// structuredPatchMarkerPattern is the single classifier for structured-patch
+// markers, shared by the sandbox boundary and the apply_patch tool (which
+// imports this package). It accepts the canonical "*** Begin Patch" /
+// "*** End Patch" and the decorated spellings models emit ("*** Begin Patch ***",
+// "***Begin Patch", trailing whitespace). Both sides must agree: a spelling the
+// tool would apply but the sandbox did not recognise would make the sandbox
+// scan the patch as a unified diff, extract no targets, and validate nothing.
+var structuredPatchMarkerPattern = regexp.MustCompile(`^\*{3}\s*(Begin|End) Patch\s*\**\s*$`)
+
+// StructuredPatchMarker classifies a line as the "begin" or "end" marker of a
+// structured patch, or "" when it is neither.
+func StructuredPatchMarker(line string) string {
+	match := structuredPatchMarkerPattern.FindStringSubmatch(strings.TrimSpace(line))
+	if match == nil {
+		return ""
+	}
+	return strings.ToLower(match[1])
+}
+
+// IsStructuredPatch reports whether patch opens with a structured begin marker.
+// The tool applies exactly the patches this returns true for, so the sandbox
+// extracts structured header paths for exactly the same set.
+func IsStructuredPatch(patch string) bool {
+	first, _, _ := strings.Cut(strings.TrimSpace(strings.TrimPrefix(patch, "\ufeff")), "\n")
+	return StructuredPatchMarker(first) == "begin"
+}
+
 func applyPatchPaths(patch string) []string {
-	if strings.HasPrefix(strings.TrimSpace(strings.TrimPrefix(patch, "\ufeff")), "*** Begin Patch") {
+	if IsStructuredPatch(patch) {
 		return structuredPatchHeaderPaths(patch)
 	}
 	return patchHeaderPaths(patch)
 
@@ -59,8 +59,18 @@ func (tool applyPatchTool) RunWithOptions(ctx context.Context, args map[string]a
 		return errorResult("Error applying patch: " + err.Error())
 	}
 	if isStructuredPatch(patch) {
+		// Structured patches (the format models use) are applied by Zero itself
+		// through an opened workspace root (os.Root): every read, create and
+		// write below is descriptor-relative and no-follow, so there is no
+		// pathname check-to-use window.
 		return tool.runStructuredPatch(applyRoot, relativeRoot, patch, options)
 	}
+	// Unified diffs are handed to git apply, which opens targets by name after
+	// the pathname checks below; that pre-existing check-to-use window is the
+	// same one the relative-path flow always had. Absolute paths are only ever
+	// rewritten to the same root-relative form relative paths already use, so
+	// this does not widen it. Moving unified diffs onto the os.Root path is a
+	// separate change.
 	patch = relativizeUnifiedPatchPaths(applyRoot, patch)
 	if err := validatePatchPaths(applyRoot, patch); err != nil {
 		return errorResult("Error applying patch: " + err.Error())
 
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/Gitlawb/zero/internal/pathjail"
+	"github.com/Gitlawb/zero/internal/sandbox"
 )
 
 const (
@@ -64,13 +65,6 @@ type structuredPatchChange struct {
 	mode   os.FileMode
 }
 
-// structuredPatchMarkerPattern accepts the canonical "*** Begin Patch" /
-// "*** End Patch" markers plus the decorated spellings models commonly emit
-// ("*** Begin Patch ***", "***Begin Patch", trailing whitespace). A strict
-// byte-equal match here made every patch from some models fail on line 1 and
-// pushed them into whole-file rewrites.
-var structuredPatchMarkerPattern = regexp.MustCompile(`^\*{3}\s*(Begin|End) Patch\s*\**\s*$`)
-
 // unifiedHunkRangePattern recognises a unified-diff range header ("-12,4 +12,6",
 // optionally followed by "@@ heading") written inside a structured hunk marker.
 // The line numbers carry no information for the context-anchored grammar, so
@@ -80,13 +74,12 @@ var unifiedHunkRangePattern = regexp.MustCompile(`^-\d+(?:,\d+)?\s+\+\d+(?:,\d+)
 const structuredPatchFormatHint = ` (format: "*** Begin Patch", then "*** Update File: path" / "*** Add File: path" / "*** Delete File: path" sections whose hunks start with "@@" and use " " context, "-" removed and "+" added lines, then "*** End Patch")`
 
 // structuredPatchMarker classifies a line as the "begin" or "end" marker of a
-// structured patch, or "" when it is neither.
+// structured patch, or "" when it is neither. The classifier is owned by the
+// sandbox package so the boundary check and the tool accept exactly the same
+// spellings; a strict byte-equal match here once made every patch from some
+// models fail on line 1 and pushed them into whole-file rewrites.
 func structuredPatchMarker(line string) string {
-	match := structuredPatchMarkerPattern.FindStringSubmatch(strings.TrimSpace(line))
-	if match == nil {
-		return ""
-	}
-	return strings.ToLower(match[1])
+	return sandbox.StructuredPatchMarker(line)
 }
 
 // structuredHunkAnchor normalises the text after a hunk's "@@ " marker. A
@@ -101,8 +94,7 @@ func structuredHunkAnchor(context string) string {
 }
 
 func isStructuredPatch(patch string) bool {
-	first, _, _ := strings.Cut(strings.TrimSpace(strings.TrimPrefix(patch, "\ufeff")), "\n")
-	return structuredPatchMarker(first) == "begin"
+	return sandbox.IsStructuredPatch(patch)
 }
 
 func (tool applyPatchTool) runStructuredPatch(applyRoot, relativeRoot, patch string, options RunOptions) Result {