@p4code/cli 0.5.16 → 0.5.17

package/dist/bin.mjs

@@ -265,7 +265,7 @@ const make$120 = () => {
 const layer$122 = Layer.sync(NetService, make$120);
 //#endregion
 //#region package.json
-var version$1 = "0.5.16";
+var version$1 = "0.5.17";
 //#endregion
 //#region src/config.ts
 /**
@@ -29731,13 +29731,17 @@ function parseMarkdownFrontmatter(contents) {
 	const name = typeof record.name === "string" ? record.name.trim() : "";
 	const description = typeof record.description === "string" ? record.description.trim() : "";
 	const disableModelInvocation = readFrontmatterBoolean(record["disable-model-invocation"]);
+	const tools = Array.isArray(record.tools) ? record.tools.flatMap((tool) => typeof tool === "string" && tool.trim() ? [tool.trim()] : []) : void 0;
+	const model = typeof record.model === "string" ? record.model.trim() : "";
 	const requiredInteractionMode = record["required-interaction-mode"] === "default" || record["required-interaction-mode"] === "plan" ? record["required-interaction-mode"] : void 0;
 	return {
 		kind: "parsed",
 		...name ? { name } : {},
 		...description ? { description } : {},
 		...disableModelInvocation === void 0 ? {} : { disableModelInvocation },
-		...requiredInteractionMode === void 0 ? {} : { requiredInteractionMode }
+		...requiredInteractionMode === void 0 ? {} : { requiredInteractionMode },
+		...tools && tools.length > 0 ? { tools } : {},
+		...model ? { model } : {}
 	};
 }
 //#endregion
@@ -30041,6 +30045,42 @@ const discoverClaudeSkills = Effect.fn("discoverClaudeSkills")(function* (config
 		scope: "project"
 	}] : []], disabledSkills);
 });
+/**
+* Load named subagent definitions from the user config dir.
+*
+* The CLI finds these itself whenever the `user` setting source is loaded, so
+* nothing calls this on an ordinary session. It exists for the sessions that
+* drop that source and still owe the user a specific agent - a Fusion half
+* under the lean context profile, which must still run the delivery reviewer.
+* Reading only the names asked for keeps that session from paying for the rest
+* of the user's agents, which is what dropping the source bought.
+*
+* Best-effort like the skill discovery beside it: a missing or malformed
+* definition is skipped rather than failing the session, because a session
+* that cannot start is worse than one missing an agent.
+*/
+const discoverClaudeUserAgents = Effect.fn("discoverClaudeUserAgents")(function* (config, names, environment, cwd) {
+	if (names.length === 0) return {};
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path$1.Path;
+	const agentsDir = yield* resolveClaudeUserAgentsDir(config, environment, cwd);
+	const definitions = {};
+	for (const name of names) {
+		const contents = yield* fileSystem.readFileString(path.join(agentsDir, `${name}.md`)).pipe(Effect.orElseSucceed(() => void 0));
+		if (contents === void 0) continue;
+		const frontmatter = parseMarkdownFrontmatter(contents);
+		if (frontmatter.kind !== "parsed") continue;
+		const prompt = stripMarkdownFrontmatter(contents);
+		if (frontmatter.description === void 0 || prompt.length === 0) continue;
+		definitions[name] = {
+			description: frontmatter.description,
+			prompt,
+			...frontmatter.tools ? { tools: frontmatter.tools } : {},
+			...frontmatter.model ? { model: frontmatter.model } : {}
+		};
+	}
+	return definitions;
+});
 //#endregion
 //#region src/mcp/ClaudeMcpFiles.ts
 /**
@@ -41620,7 +41660,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
 	const EvidenceReadContextRow = Schema$1.Struct({
 		usedTokensAtRead: Schema$1.NullOr(Schema$1.Number),
 		readAt: Schema$1.String,
-		afterSequence: Schema$1.NullOr(Schema$1.Number)
+		afterSequence: Schema$1.NullOr(Schema$1.Number),
+		throughSequence: Schema$1.NullOr(Schema$1.Number)
 	});
 	const getEvidenceReadContextRow = SqlSchema.findOneOption({
 		Request: Schema$1.String,
@@ -41633,7 +41674,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
             ELSE NULL
           END AS "usedTokensAtRead",
           created_at AS "readAt",
-          json_extract(payload_json, '$.afterSequence') AS "afterSequence"
+          json_extract(payload_json, '$.afterSequence') AS "afterSequence",
+          json_extract(payload_json, '$.throughSequence') AS "throughSequence"
         FROM projection_thread_activities
         WHERE activity_id = ${activityId}
         LIMIT 1
@@ -41747,6 +41789,10 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
         WHERE reads.thread_id = ${threadId}
           AND reads.kind = 'fusion.evidence.read'
           AND json_extract(reads.payload_json, '$.throughSequence') >= 0
+          -- A raw row's bound is wherever paging reached, never the bound a
+          -- wake named, so no report can pair with it and an unpaired one must
+          -- not read as a review nobody answered.
+          AND COALESCE(json_extract(reads.payload_json, '$.raw'), 0) = 0
         ORDER BY reads.created_at DESC, reads.rowid DESC
         LIMIT 1
       `
@@ -59449,8 +59495,17 @@ const readWorkflowScript = Effect.fn("orchestration.readWorkflowScript")(functio
 * written as if the setting applied only to user-facing answers.
 */
 const FUSION_PAIR_COMMUNICATION_INSTRUCTIONS = `Everything you send the other half of the pair obeys the thread's active response-compression mode, exactly as a user-facing answer does: phase reports, advice, reviews, questions, and handoffs. When the mode is off, write normal prose. Compression governs form only - never drop a requirement, a negation, a number or unit, a file, symbol, or command name, code, security or warning text, the evidence behind a claim, or an exact protocol heading or token in order to save words.`;
-const FUSION_BUILDER_INSTRUCTIONS = `You are Fusion Builder in an already-created native server pair. Server owns pairing and coordination. Follow the current turn's [fusion-review-policy] block when present; it overrides the phase-boundary scheduling rules below. Do not inspect or invoke the Fusion skill, create/pair/rename threads, or announce/setup Fusion. Start the user's task directly. The phase plan is not yours: Supervisor authors it, orders it, and moves every phase status, and it renders in your task banner from there. Never create or edit a phase list yourself - not with TaskCreate, TaskUpdate, TodoWrite, update_plan, the MCP task board tools, or thread_plan_update - and never mark your own phase complete. Work the one phase Supervisor put in progress, and report what you did. Step-level notes for your own use are fine as long as they never become a phase list. Complete exactly one phase per turn, and finish the whole phase in that turn rather than stopping early. Do not run tests, typecheck, lint, or builds per phase; write the tests the change needs, then run verification once in the final phase over the whole task. Exception: a phase whose own correctness is unclear may run the single narrowest check that resolves it. End every phase turn with a report of at most six non-empty lines: the phase you finished, what changed and where, what you verified with its result, and anything unresolved. One line each, every fact once, no restatement of the plan or of advice you were given. Code, exact error text and security warnings are exempt from the cap. Do not start the next phase in the same turn. Server then wakes the paired Supervisor, which resumes you through ${FUSION_ADVICE_PROMPT_PREFIX}; a user message may also revise or resume the work. Final phase verifies the entire task against the original request and labels it ready for whole-task review. Supervisor is unreachable during your turn. Never spawn/use another Supervisor thread/subagent or attribute Supervisor decisions without ${FUSION_ADVICE_PROMPT_PREFIX}. Within the current phase, continue when straightforward or evidence is clear. For a concrete unresolved tradeoff, correctness risk, or design decision materially needing judgment, stop safely before the risky choice; final response states the exact question and why review is needed. Evaluate/follow Supervisor advice unless conflicting with user request or verified repo state. ${FUSION_PAIR_COMMUNICATION_INSTRUCTIONS}`;
-const FUSION_WATCHER_TOOL_INSTRUCTIONS = `Supervisor tools belong to the p4-code MCP server: thread_watch_review, thread_watch_events, thread_evidence_report, thread_plan_update, thread_advise, and thread_gate_respond. If absent from the visible tool list, first use the available tool search/discovery facility to load those exact tools, including provider-prefixed names; absence from the initial list does not establish unavailability. If discovery or a call fails, report the exact missing capability or error and the need to restore the p4-code MCP connection. Do not offer manual relay, draft or implement the task yourself, or abandon the supervisor role as a workaround. For an actionable user requirement, read the relevant builder evidence and relay it through thread_advise; when a gate is open, answer through thread_gate_respond instead. Structure every actionable supervisor advice message with these Markdown headings, in order:
+/**
+* What a role does when a tool it wants is not its own.
+*
+* Both halves get the same words because the failure is the same on both
+* sides: a denied capability is an answer about what this role may do, and
+* treating it as an obstacle to route around turns a boundary the server
+* enforces into one it merely suggests.
+*/
+const FUSION_TOOL_BOUNDARY_INSTRUCTIONS = `A tool missing from your role, or a call the server denies for want of a capability or a grant, is a limit to report rather than an obstacle to route around. Never substitute the server's own database, its HTTP API, another MCP server, or any other back channel for a capability you were not granted; say which tool or grant you lacked and what you would have done with it.`;
+const FUSION_BUILDER_INSTRUCTIONS = `You are Fusion Builder in an already-created native server pair. Server owns pairing and coordination. Follow the current turn's [fusion-review-policy] block when present; it overrides the phase-boundary scheduling rules below. Do not inspect or invoke the Fusion skill, create/pair/rename threads, or announce/setup Fusion. Start the user's task directly. The phase plan is not yours: Supervisor authors it, orders it, and moves every phase status, and it renders in your task banner from there. Never create or edit a phase list yourself - not with TaskCreate, TaskUpdate, TodoWrite, update_plan, the MCP task board tools, or thread_plan_update - and never mark your own phase complete. Work the one phase Supervisor put in progress, and report what you did. Step-level notes for your own use are fine as long as they never become a phase list. Complete exactly one phase per turn, and finish the whole phase in that turn rather than stopping early. Do not run tests, typecheck, lint, or builds per phase; write the tests the change needs, then run verification once in the final phase over the whole task. Exception: a phase whose own correctness is unclear may run the single narrowest check that resolves it. End every phase turn with a report of at most six non-empty lines: the phase you finished, what changed and where, what you verified with its result, and anything unresolved. One line each, every fact once, no restatement of the plan or of advice you were given. Code, exact error text and security warnings are exempt from the cap. Do not start the next phase in the same turn. Server then wakes the paired Supervisor, which resumes you through ${FUSION_ADVICE_PROMPT_PREFIX}; a user message may also revise or resume the work. Final phase verifies the entire task against the original request and labels it ready for whole-task review. Supervisor is unreachable during your turn. Never spawn/use another Supervisor thread/subagent or attribute Supervisor decisions without ${FUSION_ADVICE_PROMPT_PREFIX}. Within the current phase, continue when straightforward or evidence is clear. For a concrete unresolved tradeoff, correctness risk, or design decision materially needing judgment, stop safely before the risky choice; final response states the exact question and why review is needed. Evaluate/follow Supervisor advice unless conflicting with user request or verified repo state. The review tools are Supervisor's half of the pair, not yours: thread_watch_review, thread_watch_events and thread_evidence_report are its tools, and a thread outside this pair is not yours to read. Your provider may still list them; that is not a grant, and every call fails. The tracker is Supervisor's too: you neither read nor write tickets, so when the work needs one filed, commented, or moved, say so in your phase report and let Supervisor carry it. ${FUSION_TOOL_BOUNDARY_INSTRUCTIONS} ${FUSION_PAIR_COMMUNICATION_INSTRUCTIONS}`;
+const FUSION_WATCHER_TOOL_INSTRUCTIONS = `Supervisor tools belong to the p4-code MCP server: thread_watch_review, thread_watch_events, thread_evidence_report, thread_plan_update, thread_advise, thread_gate_respond, and the task board tools task_current, task_get, task_list, task_create and task_update. Read the board whenever planning needs it, and read a named ticket with ticket_resolve together with its comments, treating a later comment as newer intent than the description. Resolve which task that is by calling task_current with the builder's threadId, because a pair started from the board links the row to the builder and not to you; a bare task_current answers for your own thread and reports the task as unlinked. Write only within that task: update it or a subtask you created under it, never an unrelated row, never another project's board, and never any board but this one - task_create files a real ticket on an external tracker when given a source such as 'linear', and that is not yours to file. If absent from the visible tool list, first use the available tool search/discovery facility to load those exact tools, including provider-prefixed names; absence from the initial list does not establish unavailability. If discovery or a call fails, report the exact missing capability or error and the need to restore the p4-code MCP connection. Do not offer manual relay, draft or implement the task yourself, or abandon the supervisor role as a workaround. For an actionable user requirement, read the relevant builder evidence and relay it through thread_advise; when a gate is open, answer through thread_gate_respond instead. Structure every actionable supervisor advice message with these Markdown headings, in order:
 ## Recommendation
 State the decision or correction in one sentence. For a phase review, say whether the phase is approved or needs changes.
 ## Reason
@@ -59465,7 +59520,7 @@ Give ordered, concrete actions for the builder, including the next phase and its
 * which is what it did before this existed.
 */
 const FUSION_EVIDENCE_SUMMARY_INSTRUCTIONS = `Read the builder's evidence through a summarizer subagent rather than into your own context: spawn one subagent with the evidence range and have it call thread_watch_review itself, paging with nextAfterSequence against a fixed throughSequence until hasMore is false, and return a summary. Your tool grants reach it, so it can read the paired builder thread exactly as you can. Instruct that subagent that thread_watch_review and thread_watch_events may be absent from its visible tool list and that absence does not establish unavailability: it must first use the available tool search/discovery facility to load those exact tools by name, including provider-prefixed names, and if discovery itself fails it must report that exact error rather than reporting no such tool. Require of that summary: every file path touched with the scale of the change to each, every command run and whether it succeeded or failed, check and test results with their counts, exact error text quoted rather than characterized, the builder's completion claims marked as claims, and anything the builder flagged as uncertain, blocked or unresolved. Over a multi-turn range it must also carry unresolved objections of yours and whether each was answered, phases completed versus reopened, claims never verified, and files touched repeatedly. Every statement cites the sequences behind it so you can check any one of them with a targeted thread_watch_events read. Fail open: if no subagent is available, the spawn errors, it times out, or what comes back is empty or does not cite sequences, read the range yourself and review from the raw evidence. Never skip or shorten a review because a summary was unavailable. Record which fallback you took: a subagent that could not load the watch tools is a misconfiguration worth naming in your report, and it is not the same as a spawn that errored or timed out. Then close the review by calling thread_evidence_report exactly once, after the last page: pass the watched thread id, the same fixed throughSequence the first review page returned - not lastSequence and not the final page's nextAfterSequence, because the server pairs the report to the read by that exact number - the first and last sequence you actually covered, the model you spawned on, and outcome summarized with the subagent's exact returned text, fallback when you read the raw range yourself, or failed when the summarizer could not run or could not report - with the reason in your own words for the last two. Report even when the summary never arrived; a review with no report cannot be told apart from a supervisor that never tried. Never paste builder tool output into it.`;
-const FUSION_WATCHER_INSTRUCTIONS = `You are Fusion Supervisor (watcher) in an already-created native server pair. Follow the current turn's [fusion-review-policy] block when present; it overrides phase scheduling. Server owns pairing and coordination and wakes you with ${FUSION_REVIEW_PROMPT_PREFIX} or ${FUSION_GATE_PROMPT_PREFIX} prompts at builder turn boundaries. A plain message outside such a wake may arrive after your conversational memory of the pair is gone; its [fusion-pair] metadata block is authoritative: the builder thread exists and is the counterpart thread id. Never report that no builder thread exists. For a new pair, the initial user request is yours, and its first turn is research, not relay. Research it: when the request names a ticket, read that ticket AND its comments, including replies and inline comments, and treat a later comment as newer intent than the description; read the code, docs, project instructions, and current state the request touches. Analyse what you found: root cause or the concrete design constraint, scope, what the user actually wants delivered, and which delivery steps they authorized. Only then write the phase plan and direct its first phase. The plan is yours alone: call thread_plan_update with the builder's threadId, sending the complete ordered list every time, each phase named in 3-6 words by its outcome rather than by a command, file path, or flag, with exactly one in progress. Split it into the fewest substantial phases the task genuinely needs plus a final integration/whole-task phase; most tasks need one to three work phases, each a complete reviewable slice of behavior. Never split per file, per function, or per trivial step. State each phase's completion condition to the builder in the advice, not in the banner title. On every later review, rewrite the same plan: an approved phase becomes completed and the next becomes in progress in the same call, an objection leaves the current phase in progress or reopens a phase you had marked completed, and the final approval completes the last phase. The builder never touches it, so a phase you do not move stays where it is. Then direct the phase to the idle builder through thread_advise, stating the findings that make the direction actionable alongside the original requirements, constraints, and authorized delivery scope. Never echo the request back as its own direction, never hand over a plan you did not ground in evidence, and never send ${FUSION_NO_OBJECTION_TEXT} before the builder has received its first phase and produced a turn to review. The builder has not received the initial prompt and must not start before your direction. Missing builder turn evidence is expected before that first direction; do not wait for it or implement the work yourself. Ask the user only when needed to resolve a blocking requirement. ${FUSION_WATCHER_TOOL_INSTRUCTIONS} To resume supervision, read builder evidence with thread_watch_review from lastReviewedImplementerSequence, capture its throughSequence on the first page and reuse that fixed bound while paging with nextAfterSequence until hasMore is false (including empty pages). Apply message append/replace operations by identity; recover truncated evidence through targeted raw thread_watch_events source ranges. Retain reviewed requirements and evidence for final review; recover missing context with targeted history reads rather than mandatory raw replay from zero, derive phase from artifacts (git log/status, PR, builder events, including its turn.plan.updated phase list), steer with thread_advise, and answer an open gate with thread_gate_respond. When a review or gate wake prompt specifies an explicit event range, that range wins over this metadata. Never poll or wait for the builder; deliver review or advice, then end the turn. Every thread_advise starts a builder turn whose completion wakes you again, so never advise a builder that is idle on an external wait or has nothing actionable; report the state in your own thread and end without advising. ${FUSION_PAIR_COMMUNICATION_INSTRUCTIONS}`;
+const FUSION_WATCHER_INSTRUCTIONS = `You are Fusion Supervisor (watcher) in an already-created native server pair. Follow the current turn's [fusion-review-policy] block when present; it overrides phase scheduling. Server owns pairing and coordination and wakes you with ${FUSION_REVIEW_PROMPT_PREFIX} or ${FUSION_GATE_PROMPT_PREFIX} prompts at builder turn boundaries. A plain message outside such a wake may arrive after your conversational memory of the pair is gone; its [fusion-pair] metadata block is authoritative: the builder thread exists and is the counterpart thread id. Never report that no builder thread exists. For a new pair, the initial user request is yours, and its first turn is research, not relay. Research it: when the request names a ticket, read that ticket AND its comments, including replies and inline comments, and treat a later comment as newer intent than the description; read the code, docs, project instructions, and current state the request touches. Analyse what you found: root cause or the concrete design constraint, scope, what the user actually wants delivered, and which delivery steps they authorized. Only then write the phase plan and direct its first phase. The plan is yours alone: call thread_plan_update with the builder's threadId, sending the complete ordered list every time, each phase named in 3-6 words by its outcome rather than by a command, file path, or flag, with exactly one in progress. Split it into the fewest substantial phases the task genuinely needs plus a final integration/whole-task phase; most tasks need one to three work phases, each a complete reviewable slice of behavior. Never split per file, per function, or per trivial step. State each phase's completion condition to the builder in the advice, not in the banner title. On every later review, rewrite the same plan: an approved phase becomes completed and the next becomes in progress in the same call, an objection leaves the current phase in progress or reopens a phase you had marked completed, and the final approval completes the last phase. The builder never touches it, so a phase you do not move stays where it is. Then direct the phase to the idle builder through thread_advise, stating the findings that make the direction actionable alongside the original requirements, constraints, and authorized delivery scope. Never echo the request back as its own direction, never hand over a plan you did not ground in evidence, and never send ${FUSION_NO_OBJECTION_TEXT} before the builder has received its first phase and produced a turn to review. The builder has not received the initial prompt and must not start before your direction. Missing builder turn evidence is expected before that first direction; do not wait for it or implement the work yourself. Ask the user only when needed to resolve a blocking requirement. ${FUSION_WATCHER_TOOL_INSTRUCTIONS} To resume supervision, read builder evidence with thread_watch_review from lastReviewedImplementerSequence, capture its throughSequence on the first page and reuse that fixed bound while paging with nextAfterSequence until hasMore is false (including empty pages). Apply message append/replace operations by identity; recover truncated evidence through targeted raw thread_watch_events source ranges. Retain reviewed requirements and evidence for final review; recover missing context with targeted history reads rather than mandatory raw replay from zero, derive phase from artifacts (git log/status, PR, builder events, including its turn.plan.updated phase list), steer with thread_advise, and answer an open gate with thread_gate_respond. When a review or gate wake prompt specifies an explicit event range, that range wins over this metadata. Never poll or wait for the builder; deliver review or advice, then end the turn. Every thread_advise starts a builder turn whose completion wakes you again, so never advise a builder that is idle on an external wait or has nothing actionable; report the state in your own thread and end without advising. ${FUSION_TOOL_BOUNDARY_INSTRUCTIONS} ${FUSION_PAIR_COMMUNICATION_INSTRUCTIONS}`;
 /**
 * The one-line stand-in for the full block on a message whose session already
 * carries the role instructions.
@@ -59625,7 +59680,18 @@ const FUSION_SAFETY_KERNEL = [
 	"- Never commit, push, or open a pull request unless the current turn asked for it, and never commit to main or master directly.",
 	"- Never add AI attribution to a commit message, pull request, issue, comment, code, or document."
 ].join("\n");
-/** Everything the supervisor half needs from the P4 MCP server, and nothing else. */
+/**
+* Everything the supervisor half needs from the P4 MCP server, and nothing else.
+*
+* The task tools are here because planning is the supervisor's job, not an
+* aside to it: it owns the phase plan, so it has to be able to read the board,
+* break the work down and keep the authorized task honest. Mutation stays
+* bounded by the prompt rather than by this set, which can only say whether a
+* tool exists - the rule is the current task, never someone else's board row.
+* `task_propose` is deliberately absent: it tells its caller to stop and wait
+* for the user, and a supervisor that waits is one the builder sits idle
+* behind. Asking the user is what `ask_user_question` is for.
+*/
 const FUSION_SUPERVISOR_P4_TOOLS = /* @__PURE__ */ new Set([
 	"thread_watch_review",
 	"thread_watch_events",
@@ -59634,7 +59700,12 @@ const FUSION_SUPERVISOR_P4_TOOLS = /* @__PURE__ */ new Set([
 	"thread_gate_respond",
 	"thread_plan_update",
 	"ask_user_question",
-	"task_current"
+	"task_current",
+	"task_get",
+	"task_list",
+	"task_create",
+	"task_update",
+	"ticket_resolve"
 ]);
 /**
 * What the builder half must not reach.
@@ -59642,15 +59713,27 @@ const FUSION_SUPERVISOR_P4_TOOLS = /* @__PURE__ */ new Set([
 * Framed as a denial rather than an allowance because the builder's job is
 * open-ended: it needs coding, verification and preview tools, and a new one of
 * those should reach it without an edit here. What it must never have is the
-* pair's own machinery - spawning threads, creating or detaching pairs,
-* advising, answering its own gate - the phase plan, which the supervisor
-* owns outright, plus task-board mutation and the external services that
-* belong to a person rather than to an implementation turn.
+* pair's own machinery - spawning threads, creating pairs, advising, answering
+* its own gate - the phase plan, which the supervisor owns outright, plus
+* task-board mutation and the external services that belong to a person rather
+* than to an implementation turn. The review tools join that list: they read
+* the review of the builder's own work, which is the supervisor watching the
+* builder and never the other way round.
+*
+* `thread_pair_detach` is the one piece of pair machinery the builder keeps,
+* because it is the way out of the arrangement rather than a way to do the
+* supervisor's job. `thread_pair_detach`'s own handler already limits it to a
+* pair whose implementer is the calling thread and whose supervisor that
+* thread created, so the only pair a builder can end is one it made of itself.
+* Denying it here would leave no agent able to detach any pair at all, which
+* is the one-way door this repository treats as a bug.
 */
 const FUSION_BUILDER_DENIED_P4_TOOLS = /* @__PURE__ */ new Set([
 	"thread_spawn",
+	"thread_watch_review",
+	"thread_watch_events",
+	"thread_evidence_report",
 	"thread_pair_create",
-	"thread_pair_detach",
 	"thread_cleanup",
 	"thread_rename",
 	"thread_configure",
@@ -59695,21 +59778,90 @@ function fusionContextPolicyFor(role, optimizedContext) {
 		optimizedContext
 	};
 }
-/** Whether the lean profile applies at all. Ordinary threads never reach it. */
+/**
+* Whether a role may call one P4 tool at all, regardless of any setting.
+*
+* The hiding functions below are a context measure: they keep a role's tool
+* list short, they only work on adapters that expose a per-session filter, and
+* the user can turn them off. This is the authorization question instead, so
+* it takes no setting and no adapter - a role that cannot act on a tool must
+* not be able to call it on any provider, whether or not the list it was shown
+* mentioned it.
+*
+* Shaped from the same two sets the hiding uses, so the list a role sees and
+* the calls it may make cannot drift apart. A thread with no role is not half
+* of a pair and is not this function's business.
+*/
+function fusionRoleMayCallP4Tool(role, toolName) {
+	if (role === void 0) return true;
+	return role === "watcher" ? FUSION_SUPERVISOR_P4_TOOLS.has(toolName) : !FUSION_BUILDER_DENIED_P4_TOOLS.has(toolName);
+}
+/**
+* Whether the context trimming applies. Ordinary threads never reach it.
+*
+* Only the measures that exist to save tokens ask this: the P4 tool list and
+* the setting sources. What a role may do is not a token question and must not
+* consult a setting the user can turn off - see `fusionRoleApplies`.
+*/
 function fusionLeanContextApplies(input) {
 	return input.role !== void 0 && input.optimizedContext;
 }
 /**
-* The external MCP registrations a Fusion session keeps: none.
+* Whether a role's restrictions apply: whenever there is a role.
+*
+* Kept apart from the trimming above because the two answer different
+* questions. Turning context optimization off should cost a pair its token
+* savings, never hand the builder the tracker and the planning tools back or
+* give the supervisor an editor.
+*/
+function fusionRoleApplies(input) {
+	return input.role !== void 0;
+}
+/**
+* The registered servers the supervisor half keeps, by lowercased name.
+*
+* Only the tracker, and only for the supervisor. It researches the request
+* before it plans, and `ticket_resolve` answers with a ticket's description
+* alone - the comments that routinely carry newer intent are reachable only
+* through the user's own Linear registration. The builder keeps none: it
+* implements the phase it was given and has no errand on a tracker.
+*
+* The name is repeated here rather than imported from `mcp/LinearMcpClient`,
+* which every adapter would then pull into a provider process. A test pins
+* the two together, exactly as the P4 tool catalogue is pinned.
+*/
+const FUSION_SUPERVISOR_EXTERNAL_MCP_SERVERS = /* @__PURE__ */ new Set(["linear"]);
+/**
+* The name a registration was given, with the user-scope prefix taken back off.
+*
+* A server the user registered in their own provider config reaches a session
+* re-keyed as `p4-user-<name>`, so matching the raw key would look for a name
+* the registry never hands over and would drop the tracker it was written to
+* keep. The prefix is spelled here for the same reason the name is: importing
+* the registry would pull it into every provider process.
+*/
+const USER_SCOPE_REGISTRATION_PREFIX = "p4-user-";
+const fusionRegistrationBareName = (name) => {
+	const lowered = name.toLowerCase();
+	return lowered.startsWith(USER_SCOPE_REGISTRATION_PREFIX) ? lowered.slice(8) : lowered;
+};
+/**
+* The external MCP registrations a Fusion session keeps.
+*
+* Applies to any pair turn, optimized or not: which servers a role may reach
+* is authorization, and the setting only governs what is trimmed to save
+* tokens.
 *
-* Everything a user registered for their own work goes, because neither role
-* can act on it during a pair turn and every definition is paid for on every
-* turn of the loop. Computer Use needs no exception here - it is a
+* Everything else a user registered for their own work goes, because neither
+* role can act on it during a pair turn and every definition is paid for on
+* every turn of the loop. Computer Use needs no exception here - it is a
 * provider-owned endpoint attached only to a session that was granted it, not
 * a registration in this map, so a granted session keeps it either way.
 */
 function fusionExternalMcpServers(servers, input) {
-	return fusionLeanContextApplies(input) ? {} : { ...servers };
+	if (!fusionRoleApplies(input)) return { ...servers };
+	if (input.role !== "watcher") return {};
+	return Object.fromEntries(Object.entries(servers).filter(([name]) => FUSION_SUPERVISOR_EXTERNAL_MCP_SERVERS.has(fusionRegistrationBareName(name))));
 }
 /**
 * P4 tools this role must not see, given the full catalogue.
@@ -59723,20 +59875,70 @@ function fusionHiddenP4Tools(catalogue, input) {
 	return input.role === "watcher" ? catalogue.filter((name) => !FUSION_SUPERVISOR_P4_TOOLS.has(name)) : catalogue.filter((name) => FUSION_BUILDER_DENIED_P4_TOOLS.has(name));
 }
 /**
+* Provider-native tools the supervisor must not see.
+*
+* It reviews and directs; it never edits the tree. Reading tools stay, because
+* grounding an objection in the code is exactly its job, and a shell stays too
+* - `git log` and `git status` are how it derives phase from artifacts. What
+* goes is the means to write the change it is supposed to be reviewing.
+*
+* Named per provider, like the builder's list, because the names are the
+* provider's rather than ours.
+*/
+const FUSION_SUPERVISOR_DENIED_NATIVE_TOOLS = [
+	"Edit",
+	"MultiEdit",
+	"Write",
+	"NotebookEdit",
+	"apply_patch"
+];
+/**
 * Provider-native tools this role must not see.
 *
 * The supervisor keeps its own planning tool: it is the half that plans, and
-* for its own thread that tool is the ordinary one.
+* for its own thread that tool is the ordinary one. It loses the editing tools
+* instead, which are the builder's half of the same split.
+*
+* Applies to any pair turn, optimized or not, for the same reason the external
+* registrations do: a builder holding the planning tool is a role problem, not
+* a token one.
 */
 function fusionHiddenNativeTools(input) {
-	return fusionLeanContextApplies(input) && input.role === "implementer" ? FUSION_BUILDER_DENIED_NATIVE_TOOLS : [];
+	if (!fusionRoleApplies(input)) return [];
+	return input.role === "implementer" ? FUSION_BUILDER_DENIED_NATIVE_TOOLS : FUSION_SUPERVISOR_DENIED_NATIVE_TOOLS;
+}
+/**
+* Global agents a pair still owes its user after the lean profile drops the
+* user setting source.
+*
+* Dropping that source is what makes the profile lean, but it takes the user's
+* subagent definitions with it, and the delivery loop this pair runs on names
+* one of them outright: the supervisor will not accept the work until the
+* global `pr-reviewer` has reviewed the branch. Leaving it unregistered means
+* the builder either cannot comply or quietly reviews with something else,
+* which is the failure this list exists to prevent. Named rather than
+* discovered, so the cost stays one definition instead of every agent the user
+* happens to have.
+*/
+const FUSION_REQUIRED_GLOBAL_AGENTS = ["pr-reviewer"];
+/**
+* Which global agents this session has to register for itself.
+*
+* Empty unless the lean profile actually dropped the user source: when it is
+* off the provider loads them the usual way, and registering them again would
+* be a second definition of the same agent.
+*/
+function fusionRequiredGlobalAgents(input) {
+	return fusionLeanContextApplies(input) ? FUSION_REQUIRED_GLOBAL_AGENTS : [];
 }
 /**
 * Setting sources a Fusion session reads.
 *
 * `user` carries the global memory files and the user-level skills; the
 * project's own instructions live in `project` and `local` and stay, because
-* they are the ones that describe the code being changed.
+* they are the ones that describe the code being changed. What the drop also
+* takes, and what `fusionRequiredGlobalAgents` above hands back, is the user's
+* subagent definitions.
 */
 function fusionSettingSources(sources, input) {
 	if (!fusionLeanContextApplies(input)) return sources;
@@ -69927,6 +70129,7 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 			optimizedContext: fusionPromptSettings?.optimizedContext ?? DEFAULT_FUSION_PROMPT_SETTINGS.optimizedContext
 		};
 		const externalMcpServers = fusionExternalMcpServers(registeredMcpServers, fusionContextPolicy);
+		const requiredGlobalAgents = yield* discoverClaudeUserAgents(claudeSettings, fusionRequiredGlobalAgents(fusionContextPolicy), claudeEnvironment, input.cwd).pipe(Effect.provideService(FileSystem.FileSystem, fileSystem), Effect.provideService(Path$1.Path, path));
 		const hiddenTools = [...fusionHiddenP4Tools(providerMcpToolNames(), fusionContextPolicy).map((name) => `mcp__${P4CODE_MCP_SERVER_NAME}__${name}`), ...fusionHiddenNativeTools(fusionContextPolicy)];
 		const unpromptedSubagents = input.unpromptedSubagents !== void 0 ? input.unpromptedSubagents : options?.resolveUnpromptedSubagents === void 0 ? DEFAULT_SERVER_SETTINGS.enableUnpromptedSubagents : yield* options.resolveUnpromptedSubagents;
 		const compressRuleset = compressRulesetFor(input.compressMode ?? "off");
@@ -69958,6 +70161,7 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 				...systemPromptAppend.length > 0 ? { append: systemPromptAppend } : {}
 			},
 			settingSources: [...fusionSettingSources(CLAUDE_SETTING_SOURCES, fusionContextPolicy)],
+			...Object.keys(requiredGlobalAgents).length > 0 ? { agents: requiredGlobalAgents } : {},
 			...hiddenTools.length > 0 ? { disallowedTools: hiddenTools } : {},
 			...effectiveEffort ? { effort: effectiveEffort } : {},
 			...permissionMode ? { permissionMode } : {},
@@ -130660,14 +130864,15 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 	const httpServer = yield* HttpServer.HttpServer;
 	const state = yield* SynchronizedRef.make({
 		records: /* @__PURE__ */ new Map(),
-		spawnedThreads: /* @__PURE__ */ new Map()
+		spawnedThreads: /* @__PURE__ */ new Map(),
+		fusionRoles: /* @__PURE__ */ new Map()
 	});
 	const currentTimeMillis = options.now ? Effect.sync(options.now) : Clock.currentTimeMillis;
 	const livenessWindowMs = options.livenessWindowMs ?? DEFAULT_LIVENESS_WINDOW_MS;
 	const endpoint = httpServer.address._tag === "TcpAddress" ? `http://${getHttpMcpEndpointHost(httpServer.address.hostname)}:${httpServer.address.port}/mcp` : "http://127.0.0.1/mcp";
 	const hashToken = (token) => crypto.digest("SHA-256", new TextEncoder().encode(token)).pipe(Effect.map(bytesToHex), Effect.orDie);
 	const revokeWhere = Effect.fn("McpSessionRegistry.revokeWhere")(function* (predicate) {
-		const removed = yield* SynchronizedRef.modify(state, ({ records, spawnedThreads }) => {
+		const removed = yield* SynchronizedRef.modify(state, ({ records, spawnedThreads, fusionRoles }) => {
 			const next = new Map(records);
 			const scopes = [];
 			for (const [hash, record] of records) {
@@ -130678,7 +130883,8 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 			}
 			return [scopes, {
 				records: next,
-				spawnedThreads
+				spawnedThreads,
+				fusionRoles
 			}];
 		});
 		yield* Effect.forEach(removed, (scope) => scope.authorizationLifetime?.revocation ? Deferred.succeed(scope.authorizationLifetime.revocation, void 0) : Effect.void, { discard: true });
@@ -130706,6 +130912,8 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 		if (watchThreadIds.size > 0) capabilities.add("watch");
 		if (adviseThreadIds.size > 0) capabilities.add("advise");
 		const threadId = ThreadId.make(request.threadId);
+		const rememberedRole = yield* SynchronizedRef.get(state).pipe(Effect.map((current) => current.fusionRoles.get(threadId)));
+		const fusionRole = rememberedRole === void 0 ? request.fusionRole : rememberedRole ?? void 0;
 		const scopeWith = (mayCreateThreads, mayCreateFusionPairs, revocation = mainRevocation) => ({
 			authorizationLifetime: {
 				revoked: false,
@@ -130719,11 +130927,12 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 			capabilities,
 			...watchThreadIds.size > 0 ? { watchThreadIds } : {},
 			...adviseThreadIds.size > 0 ? { adviseThreadIds } : {},
+			...fusionRole === void 0 ? {} : { fusionRole },
 			mayCreateThreads,
 			mayCreateFusionPairs,
 			issuedAt
 		});
-		yield* SynchronizedRef.update(state, ({ records, spawnedThreads }) => {
+		yield* SynchronizedRef.update(state, ({ records, spawnedThreads, fusionRoles }) => {
 			const next = new Map(records);
 			next.set(tokenHash, {
 				tokenHash,
@@ -130743,7 +130952,8 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 			});
 			return {
 				records: next,
-				spawnedThreads
+				spawnedThreads,
+				fusionRoles
 			};
 		});
 		return { config: {
@@ -130765,12 +130975,13 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 		const tokenHash = yield* hashToken(rawToken);
 		const timestamp = yield* currentTimeMillis;
 		yield* pruneDead(timestamp);
-		return yield* SynchronizedRef.modify(state, ({ records, spawnedThreads }) => {
+		return yield* SynchronizedRef.modify(state, ({ records, spawnedThreads, fusionRoles }) => {
 			const current = records;
 			const record = current.get(tokenHash);
 			if (!record) return [void 0, {
 				records: current,
-				spawnedThreads
+				spawnedThreads,
+				fusionRoles
 			}];
 			const next = new Map(current);
 			next.set(tokenHash, {
@@ -130784,14 +130995,15 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 				watchThreadIds: /* @__PURE__ */ new Set([...record.scope.watchThreadIds ?? [], ...record.controlThreadIds])
 			}, {
 				records: next,
-				spawnedThreads
+				spawnedThreads,
+				fusionRoles
 			}];
 		});
 	});
 	const touch = Effect.fn("McpSessionRegistry.touch")(function* (threadId) {
 		const timestamp = yield* currentTimeMillis;
 		yield* pruneDead(timestamp);
-		yield* SynchronizedRef.update(state, ({ records, spawnedThreads }) => {
+		yield* SynchronizedRef.update(state, ({ records, spawnedThreads, fusionRoles }) => {
 			const current = records;
 			const next = new Map(current);
 			for (const [tokenHash, record] of current) if (record.scope.threadId === threadId) next.set(tokenHash, {
@@ -130800,12 +131012,13 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 			});
 			return {
 				records: next,
-				spawnedThreads
+				spawnedThreads,
+				fusionRoles
 			};
 		});
 	});
 	const grantWatchThread = Effect.fn("McpSessionRegistry.grantWatchThread")(function* ({ watcherThreadId, watchedThreadId }) {
-		yield* SynchronizedRef.update(state, ({ records, spawnedThreads }) => {
+		yield* SynchronizedRef.update(state, ({ records, spawnedThreads, fusionRoles }) => {
 			const next = new Map(records);
 			for (const [tokenHash, record] of records) {
 				if (record.scope.threadId !== watcherThreadId) continue;
@@ -130820,12 +131033,13 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 			}
 			return {
 				records: next,
-				spawnedThreads
+				spawnedThreads,
+				fusionRoles
 			};
 		});
 	});
 	const revokeWatchThread = Effect.fn("McpSessionRegistry.revokeWatchThread")(function* ({ watcherThreadId, watchedThreadId }) {
-		yield* SynchronizedRef.update(state, ({ records, spawnedThreads }) => {
+		yield* SynchronizedRef.update(state, ({ records, spawnedThreads, fusionRoles }) => {
 			const next = new Map(records);
 			for (const [tokenHash, record] of records) {
 				if (record.scope.threadId !== watcherThreadId) continue;
@@ -130848,12 +131062,13 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 			}
 			return {
 				records: next,
-				spawnedThreads
+				spawnedThreads,
+				fusionRoles
 			};
 		});
 	});
 	const grantAdviseThread = Effect.fn("McpSessionRegistry.grantAdviseThread")(function* ({ watcherThreadId, advisedThreadId }) {
-		yield* SynchronizedRef.update(state, ({ records, spawnedThreads }) => {
+		yield* SynchronizedRef.update(state, ({ records, spawnedThreads, fusionRoles }) => {
 			const next = new Map(records);
 			for (const [tokenHash, record] of records) {
 				if (record.scope.threadId !== watcherThreadId) continue;
@@ -130868,12 +131083,13 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 			}
 			return {
 				records: next,
-				spawnedThreads
+				spawnedThreads,
+				fusionRoles
 			};
 		});
 	});
 	const revokeAdviseThread = Effect.fn("McpSessionRegistry.revokeAdviseThread")(function* ({ watcherThreadId, advisedThreadId }) {
-		yield* SynchronizedRef.update(state, ({ records, spawnedThreads }) => {
+		yield* SynchronizedRef.update(state, ({ records, spawnedThreads, fusionRoles }) => {
 			const next = new Map(records);
 			for (const [tokenHash, record] of records) {
 				if (record.scope.threadId !== watcherThreadId) continue;
@@ -130896,12 +131112,47 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 			}
 			return {
 				records: next,
-				spawnedThreads
+				spawnedThreads,
+				fusionRoles
 			};
 		});
 	});
+	/**
+	* Rewrites one thread's half on every credential it holds, and remembers it.
+	*
+	* A pair is routinely made over a thread that is already running, so the
+	* credential it is using was minted before the pair existed and carries no
+	* role. Patching the live record is what closes that session's gate without
+	* restarting it; the remembered value is what answers for a session that has
+	* not started yet, or has not reached its `issue` call.
+	*/
+	const applyFusionRole = (threadId, role) => SynchronizedRef.update(state, ({ records, spawnedThreads, fusionRoles }) => {
+		const next = new Map(records);
+		for (const [tokenHash, record] of records) {
+			if (record.scope.threadId !== threadId) continue;
+			const { fusionRole: _previous, ...scopeWithoutRole } = record.scope;
+			next.set(tokenHash, {
+				...record,
+				scope: role === null ? scopeWithoutRole : {
+					...scopeWithoutRole,
+					fusionRole: role
+				}
+			});
+		}
+		return {
+			records: next,
+			spawnedThreads,
+			fusionRoles: new Map(fusionRoles).set(threadId, role)
+		};
+	});
+	const setFusionRole = Effect.fn("McpSessionRegistry.setFusionRole")(function* (input) {
+		yield* applyFusionRole(input.threadId, input.role);
+	});
+	const clearFusionRole = Effect.fn("McpSessionRegistry.clearFusionRole")(function* (input) {
+		yield* applyFusionRole(input.threadId, null);
+	});
 	const recordSpawnedThread = Effect.fn("McpSessionRegistry.recordSpawnedThread")(function* (input) {
-		yield* SynchronizedRef.update(state, ({ records, spawnedThreads }) => {
+		yield* SynchronizedRef.update(state, ({ records, spawnedThreads, fusionRoles }) => {
 			const next = new Map(records);
 			for (const [tokenHash, record] of records) if (record.scope.providerSessionId === input.providerSessionId) next.set(tokenHash, {
 				...record,
@@ -130909,7 +131160,8 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 			});
 			return {
 				records: next,
-				spawnedThreads: new Map([...spawnedThreads, [input.threadId, input.mayCreateFusionPairs === true]])
+				spawnedThreads: new Map([...spawnedThreads, [input.threadId, input.mayCreateFusionPairs === true]]),
+				fusionRoles
 			};
 		});
 	});
@@ -130917,6 +131169,8 @@ const makeWithOptions = Effect.fn("McpSessionRegistry.make")(function* (options
 		issue,
 		resolve,
 		touch,
+		setFusionRole,
+		clearFusionRole,
 		grantWatchThread,
 		revokeWatchThread,
 		grantAdviseThread,
@@ -130948,6 +131202,8 @@ const issueActiveMcpCredential = (request) => activeMcpSessionRegistry ? activeM
 */
 const touchActiveMcpThread = (threadId) => activeMcpSessionRegistry ? activeMcpSessionRegistry.touch(threadId) : Effect.void;
 const grantActiveMcpWatchThread = (input) => activeMcpSessionRegistry ? activeMcpSessionRegistry.grantWatchThread(input) : Effect.void;
+const setActiveMcpFusionRole = (input) => activeMcpSessionRegistry ? activeMcpSessionRegistry.setFusionRole(input) : Effect.void;
+const clearActiveMcpFusionRole = (input) => activeMcpSessionRegistry ? activeMcpSessionRegistry.clearFusionRole(input) : Effect.void;
 const revokeActiveMcpWatchThread = (input) => activeMcpSessionRegistry ? activeMcpSessionRegistry.revokeWatchThread(input) : Effect.void;
 const grantActiveMcpAdviseThread = (input) => activeMcpSessionRegistry ? activeMcpSessionRegistry.grantAdviseThread(input) : Effect.void;
 const revokeActiveMcpAdviseThread = (input) => activeMcpSessionRegistry ? activeMcpSessionRegistry.revokeAdviseThread(input) : Effect.void;
@@ -131069,6 +131325,15 @@ const makeProviderService = Effect.fn("makeProviderService")(function* (options)
 			return Option.isSome(thread) ? resolveProjectAgentBrowserAccess(settings, thread.value.projectId) : false;
 		})), Effect.catch((cause) => Effect.logWarning("Could not read settings; withholding agent browser access.", { cause }).pipe(Effect.as(false))));
 		const computerUseAccess = yield* registry.getInstanceInfo(providerInstanceId).pipe(Effect.map((info) => info.driverKind !== "codex"), Effect.catch(() => Effect.succeed(false)));
+		const fusionRole = Option.isSome(projectionQuery) ? yield* projectionQuery.value.getActiveThreadPairs().pipe(Effect.map((pairs) => {
+			const pair = pairs.find((entry) => entry.watcherThreadId === threadId || entry.implementerThreadId === threadId);
+			if (pair === void 0) return void 0;
+			return pair.watcherThreadId === threadId ? "watcher" : "implementer";
+		}), Effect.mapError((cause) => new ProviderValidationError({
+			operation: "ProviderService.prepareMcpSession",
+			issue: "Could not read thread pairs, so the session's Fusion role is unknown. Refusing to issue an MCP credential that would carry no role.",
+			cause
+		}))) : yield* Effect.logWarning("No projection service, so an MCP credential is issued with no Fusion role. A pair whose event this process never saw will be ungated.", { threadId }).pipe(Effect.as(void 0));
 		const threadTitle = Option.isSome(projectionQuery) ? yield* projectionQuery.value.getThreadShellById(threadId).pipe(Effect.map((thread) => Option.isSome(thread) ? thread.value.title : void 0), Effect.catch(() => Effect.succeed(void 0))) : void 0;
 		const credential = yield* issueActiveMcpCredential({
 			threadId,
@@ -131077,7 +131342,8 @@ const makeProviderService = Effect.fn("makeProviderService")(function* (options)
 			browserAccess,
 			computerUseAccess,
 			...watchThreadIds !== void 0 ? { watchThreadIds } : {},
-			...adviseThreadIds !== void 0 ? { adviseThreadIds } : {}
+			...adviseThreadIds !== void 0 ? { adviseThreadIds } : {},
+			...fusionRole !== void 0 ? { fusionRole } : {}
 		});
 		if (credential) yield* Effect.sync(() => setMcpProviderSession(credential.config));
 		return credential;
@@ -131923,6 +132189,47 @@ const mcpInputSchema = (schema) => ({
 	...schema,
 	type: "object"
 });
+const P4_TOOL_NAMES = new Set(P4CODE_MCP_TOOL_NAMES);
+/**
+* The server's own answer to "may this role call this tool", applied to every
+* registered P4 tool before its handler runs.
+*
+* The adapters also hide a role's forbidden tools, but that is a context
+* measure: it depends on a user setting and on the one adapter that can filter
+* a session's tool list. A caller that never saw the tool can still name it,
+* so the rule that matters is enforced here, where every provider's call
+* arrives and neither a setting nor a prompt can move it.
+*
+* Only P4's own tools are governed. A name outside the catalogue belongs to
+* another server sharing this registration helper - Computer Use is one - and
+* this policy has nothing to say about it.
+*/
+const enforceFusionRole = (toolName) => Effect.serviceOption(McpInvocationContext).pipe(Effect.map((invocation) => {
+	if (!P4_TOOL_NAMES.has(toolName)) return null;
+	const role = invocation._tag === "Some" ? invocation.value.fusionRole : void 0;
+	if (role === void 0 || fusionRoleMayCallP4Tool(role, toolName)) return null;
+	return role;
+}));
+/** The half's own word, so the message names the caller rather than a code. */
+const ROLE_LABEL = {
+	implementer: "builder",
+	watcher: "supervisor"
+};
+const deniedResult = (toolName, role) => new McpSchema.CallToolResult({
+	isError: true,
+	content: [{
+		type: "text",
+		text: `${toolName} is not a tool the ${ROLE_LABEL[role]} half of a Fusion pair may call. Report the missing tool rather than working around it.`
+	}]
+});
+/**
+* Wraps one tool handler in the role gate.
+*
+* Exported because `addTool` is reachable from two places: this helper, and
+* the one tool registered by hand. A gate that only covered the helper would
+* leave that tool open, which is the kind of hole a policy is judged by.
+*/
+const withFusionRoleGate = (toolName, handle) => (payload) => enforceFusionRole(toolName).pipe(Effect.flatMap((deniedRole) => deniedRole === null ? handle(payload) : Effect.succeed(deniedResult(toolName, deniedRole))));
 const mcpToolkit = (toolkit) => Layer.effectDiscard(Effect.gen(function* () {
 	const server = yield* McpServer.McpServer;
 	yield* McpServer.registerToolkit(toolkit).pipe(Effect.provideService(McpServer.McpServer, {
@@ -131932,7 +132239,8 @@ const mcpToolkit = (toolkit) => Layer.effectDiscard(Effect.gen(function* () {
 			tool: new McpSchema.Tool({
 				...options.tool,
 				inputSchema: mcpInputSchema(options.tool.inputSchema)
-			})
+			}),
+			handle: withFusionRoleGate(options.tool.name, options.handle)
 		})
 	}));
 }));
@@ -132221,13 +132529,13 @@ const registerScreenshot = Effect.fn("device.registerScreenshot")(function* () {
 			}
 		}),
 		annotations: DeviceScreenshotTool.annotations,
-		handle: (payload) => Effect.withFiber((fiber) => built.handle("device_screenshot", payload).pipe(Stream.unwrap, Stream.run(Sink.last()), Effect.flatMap(Effect.fromOption), Effect.provideService(DeviceService, service), Effect.provideService(DeviceScreenshot, screenshots), Effect.provideService(McpInvocationContext, Context.getUnsafe(fiber.context, McpInvocationContext)), Effect.flatMap((result) => screenshotContent(result.encodedResult)), Effect.orElseSucceed(() => new McpSchema.CallToolResult({
+		handle: withFusionRoleGate(DeviceScreenshotTool.name, (payload) => Effect.withFiber((fiber) => built.handle("device_screenshot", payload).pipe(Stream.unwrap, Stream.run(Sink.last()), Effect.flatMap(Effect.fromOption), Effect.provideService(DeviceService, service), Effect.provideService(DeviceScreenshot, screenshots), Effect.provideService(McpInvocationContext, Context.getUnsafe(fiber.context, McpInvocationContext)), Effect.flatMap((result) => screenshotContent(result.encodedResult)), Effect.orElseSucceed(() => new McpSchema.CallToolResult({
 			isError: true,
 			content: [{
 				type: "text",
 				text: "Device screenshot unavailable. Check the open session and refresh devices."
 			}]
-		}))))
+		})))))
 	});
 });
 const DeviceToolkitRegistrationLive = Layer.mergeAll(mcpToolkit(DeviceStandardToolkit), Layer.effectDiscard(registerScreenshot())).pipe(Layer.provide(DeviceToolkitHandlersLive));
@@ -132989,6 +133297,7 @@ const ThreadPairCreateTool = Tool.make("thread_pair_create", {
 	dependencies: [
 		McpInvocationContext,
 		OrchestrationEngineService,
+		McpSessionRegistry,
 		Crypto.Crypto
 	]
 }).annotate(Tool.Title, "Create a Fusion pair").annotate(Tool.Readonly, false).annotate(Tool.Destructive, false).annotate(Tool.Idempotent, false);
@@ -133383,6 +133692,14 @@ const ThreadToolkitHandlersLive = ThreadToolkit.toLayer({
 				watcherThreadId: fusionPair.watcherThreadId,
 				createdAt
 			}, threadId);
+			yield* registry.setFusionRole({
+				threadId,
+				role: "implementer"
+			});
+			yield* registry.setFusionRole({
+				threadId: fusionPair.watcherThreadId,
+				role: "watcher"
+			});
 		}
 		yield* dispatchControl({
 			type: "thread.turn.start",
@@ -133423,6 +133740,15 @@ const ThreadToolkitHandlersLive = ThreadToolkit.toLayer({
 			continuationMessageId,
 			createdAt: DateTime.formatIso(yield* DateTime.now)
 		}, invocation.threadId);
+		const registry = yield* McpSessionRegistry;
+		yield* registry.setFusionRole({
+			threadId: invocation.threadId,
+			role: "implementer"
+		});
+		yield* registry.setFusionRole({
+			threadId: watcherThreadId,
+			role: "watcher"
+		});
 		return {
 			pairId,
 			implementerThreadId: invocation.threadId,
@@ -134268,6 +134594,16 @@ const TypeSafeToolkitHandlersLive = TypeSafeToolkit.toLayer({ typesafe_ask: (inp
 * appending beside it.
 */
 const evidenceReadActivityId = (watchedThreadId, throughSequence) => EventId.make(`fusion-evidence:${watchedThreadId}:${throughSequence}`);
+/**
+* The key a raw read records under, when the supervisor paged the events itself.
+*
+* A raw read has no fixed bound to key on: the supervisor discovers where the
+* window ends by paging to it, so keying on the sequence it happens to have
+* reached would mint one row per page. The turn is the bound that already
+* exists, and it collapses the whole raw read into the single row a compact
+* review would have written.
+*/
+const rawEvidenceReadActivityId = (watchedThreadId, readerTurnId) => EventId.make(`fusion-evidence:${watchedThreadId}:turn:${readerTurnId}`);
 /** One report per review, keyed like the read it reports on so a retry replaces. */
 const evidenceReportActivityId = (watchedThreadId, throughSequence) => EventId.make(`fusion-evidence-summary:${watchedThreadId}:${throughSequence}`);
 /**
@@ -134300,7 +134636,8 @@ const evidenceTiming = (readAt, closedAt) => {
 const correlateEvidence = Effect.fn("fusionEvidenceReport.correlateEvidence")(function* (input) {
 	const projections = yield* ProjectionSnapshotQuery;
 	const latest = yield* projections.getLatestThreadContextWindow(input.readerThreadId).pipe(Effect.orElseSucceed(() => Option.none()));
-	const read = yield* projections.getEvidenceReadContext(input.readActivityId).pipe(Effect.orElseSucceed(() => Option.none()));
+	const readContext = (activityId) => projections.getEvidenceReadContext(activityId).pipe(Effect.orElseSucceed(() => Option.none()));
+	const read = yield* readContext(input.readActivityId).pipe(Effect.flatMap((row) => Option.isSome(row) || input.fallbackReadActivityId === void 0 ? Effect.succeed(row) : readContext(input.fallbackReadActivityId)));
 	const timing = Option.match(read, {
 		onNone: () => null,
 		onSome: (row) => evidenceTiming(row.readAt, input.closedAt)
@@ -134341,8 +134678,14 @@ const ThreadWatchEventsTool = Tool.make("thread_watch_events", {
 	parameters: ThreadWatchEventsInput,
 	success: ThreadWatchEventsResult,
 	failure: ThreadWatchToolError,
-	dependencies: [McpInvocationContext, ThreadEventStreamService]
-}).annotate(Tool.Title, "Read watched thread events").annotate(Tool.Readonly, true).annotate(Tool.Destructive, false).annotate(Tool.Idempotent, true);
+	dependencies: [
+		McpInvocationContext,
+		ThreadEventStreamService,
+		OrchestrationEngineService,
+		ProjectionSnapshotQuery,
+		Crypto.Crypto
+	]
+}).annotate(Tool.Title, "Read watched thread events").annotate(Tool.Readonly, false).annotate(Tool.Destructive, false).annotate(Tool.Idempotent, true);
 const ThreadWatchReviewTool = Tool.make("thread_watch_review", {
 	description: "Read bounded compact review evidence for an explicitly granted thread. Combines assistant fragments by message identity; preserves user requirements, tool evidence, plans, errors and turn boundaries. Resume with nextAfterSequence and the same throughSequence until hasMore is false, even on empty pages. Message operations append or replace by identity across pages. Truncated evidence includes source sequence ranges for targeted recovery with thread_watch_events; do not treat an excerpt as full proof.",
 	parameters: ThreadWatchReviewInput,
@@ -134394,20 +134737,24 @@ const REPORT_HEADING = {
 * for; losing the note that it happened is a smaller loss than losing the page,
 * so a rejected dispatch is logged and the page is returned anyway.
 */
-const recordEvidenceRead = Effect.fn("mcp.watch.recordEvidenceRead")(function* (readerThreadId, page, afterSequence) {
+const recordEvidenceRead = Effect.fn("mcp.watch.recordEvidenceRead")(function* (readerThreadId, window) {
 	const engine = yield* OrchestrationEngineService;
 	const crypto = yield* Crypto.Crypto;
 	const projections = yield* ProjectionSnapshotQuery;
 	const createdAt = DateTime.formatIso(yield* DateTime.now);
-	const recorded = yield* projections.getEvidenceReadContext(evidenceReadActivityId(page.threadId, page.throughSequence)).pipe(Effect.orElseSucceed(() => Option.none()));
+	const recorded = yield* projections.getEvidenceReadContext(window.activityId).pipe(Effect.orElseSucceed(() => Option.none()));
 	const opened = Option.isSome(recorded);
 	const readCreatedAt = Option.match(recorded, {
 		onNone: () => createdAt,
 		onSome: (row) => row.readAt
 	});
 	const readAfterSequence = Option.match(recorded, {
-		onNone: () => afterSequence,
-		onSome: (row) => row.afterSequence ?? afterSequence
+		onNone: () => window.afterSequence,
+		onSome: (row) => row.afterSequence ?? window.afterSequence
+	});
+	const readThroughSequence = Option.match(recorded, {
+		onNone: () => window.throughSequence,
+		onSome: (row) => row.throughSequence === null ? window.throughSequence : Math.max(row.throughSequence, window.throughSequence)
 	});
 	const activeTurnId = yield* projections.getActiveTurnId(readerThreadId).pipe(Effect.orElseSucceed(() => Option.none()), Effect.map(Option.getOrNull));
 	const usedTokensAtRead = opened ? Option.getOrNull(Option.map(recorded, (row) => row.usedTokensAtRead)) : yield* projections.getLatestThreadContextWindow(readerThreadId).pipe(Effect.map(Option.map((row) => row.usedTokens)), Effect.orElseSucceed(() => Option.none()), Effect.map(Option.getOrNull));
@@ -134417,29 +134764,40 @@ const recordEvidenceRead = Effect.fn("mcp.watch.recordEvidenceRead")(function* (
 		threadId: readerThreadId,
 		createdAt,
 		activity: {
-			id: evidenceReadActivityId(page.threadId, page.throughSequence),
+			id: window.activityId,
 			createdAt: readCreatedAt,
 			tone: "info",
 			kind: "fusion.evidence.read",
 			summary: "Read builder evidence",
 			turnId: null,
 			payload: {
-				watchedThreadId: page.threadId,
+				watchedThreadId: window.watchedThreadId,
 				afterSequence: readAfterSequence,
-				throughSequence: page.throughSequence,
-				nextAfterSequence: page.nextAfterSequence,
-				hasMore: page.hasMore,
-				scannedEvents: page.scannedEvents,
+				throughSequence: readThroughSequence,
+				nextAfterSequence: window.nextAfterSequence,
+				hasMore: window.hasMore,
+				scannedEvents: window.scannedEvents,
 				...activeTurnId === null ? {} : { turnId: activeTurnId },
+				...window.raw === true ? { raw: true } : {},
 				...usedTokensAtRead === null ? {} : { usedTokensAtRead }
 			}
 		}
 	}).pipe(Effect.catchCause((cause) => Effect.logWarning("could not record the supervisor's evidence read", {
 		readerThreadId,
-		watchedThreadId: page.threadId,
+		watchedThreadId: window.watchedThreadId,
 		cause
 	})));
 });
+/**
+* Whether this reader is the watcher half of a live pair over this thread.
+*
+* `thread_watch_events` is the generic polling tool, so an orchestrator reading
+* a thread it spawned goes through it too. Only a Fusion watcher is reading
+* builder evidence, and only its work log should grow a row saying so.
+*/
+const watchesAsFusionSupervisor = Effect.fn("mcp.watch.watchesAsFusionSupervisor")(function* (readerThreadId, watchedThreadId) {
+	return (yield* (yield* ProjectionSnapshotQuery).getActiveThreadPairs().pipe(Effect.orElseSucceed(() => []))).some((pair) => pair.watcherThreadId === readerThreadId && pair.implementerThreadId === watchedThreadId);
+});
 /** Bounded so one report cannot dominate a thread's activity storage. */
 const clip = (value, limit) => {
 	const trimmed = value?.trim();
@@ -134453,7 +134811,15 @@ const WatchToolkitHandlersLive = WatchToolkit.toLayer({
 			threadId: input.threadId,
 			detail: cause.message
 		})));
-		yield* recordEvidenceRead(invocation.threadId, page, input.afterSequence ?? 0);
+		yield* recordEvidenceRead(invocation.threadId, {
+			activityId: evidenceReadActivityId(page.threadId, page.throughSequence),
+			watchedThreadId: page.threadId,
+			afterSequence: input.afterSequence ?? 0,
+			throughSequence: page.throughSequence,
+			nextAfterSequence: page.nextAfterSequence,
+			hasMore: page.hasMore,
+			scannedEvents: page.scannedEvents
+		});
 		return page;
 	}),
 	thread_evidence_report: (input) => Effect.gen(function* () {
@@ -134461,9 +134827,11 @@ const WatchToolkitHandlersLive = WatchToolkit.toLayer({
 		const engine = yield* OrchestrationEngineService;
 		const crypto = yield* Crypto.Crypto;
 		const createdAt = DateTime.formatIso(yield* DateTime.now);
+		const activeTurnId = yield* (yield* ProjectionSnapshotQuery).getActiveTurnId(invocation.threadId).pipe(Effect.orElseSucceed(() => Option.none()), Effect.map(Option.getOrNull));
 		const { context, timing } = yield* correlateEvidence({
 			readerThreadId: invocation.threadId,
 			readActivityId: evidenceReadActivityId(input.threadId, input.throughSequence),
+			...activeTurnId === null ? {} : { fallbackReadActivityId: rawEvidenceReadActivityId(input.threadId, activeTurnId) },
 			closedAt: createdAt
 		});
 		const summary = clip(input.summary, THREAD_EVIDENCE_REPORT_MAX_CHARS);
@@ -134504,7 +134872,7 @@ const WatchToolkitHandlersLive = WatchToolkit.toLayer({
 		};
 	}),
 	thread_watch_events: (input) => Effect.gen(function* () {
-		yield* requireWatchCapability(input.threadId);
+		const invocation = yield* requireWatchCapability(input.threadId);
 		const page = yield* (yield* ThreadEventStreamService).read({
 			threadId: input.threadId,
 			...input.afterSequence !== void 0 ? { afterSequence: input.afterSequence } : {},
@@ -134513,6 +134881,28 @@ const WatchToolkitHandlersLive = WatchToolkit.toLayer({
 			threadId: input.threadId,
 			detail: cause.message
 		})));
+		const lastSequence = page.events.at(-1)?.sequence;
+		if (lastSequence !== void 0 && (yield* watchesAsFusionSupervisor(invocation.threadId, input.threadId))) {
+			const projections = yield* ProjectionSnapshotQuery;
+			const turnId = yield* projections.getActiveTurnId(invocation.threadId).pipe(Effect.orElseSucceed(() => Option.none()), Effect.map(Option.getOrNull));
+			if (turnId !== null) {
+				const activityId = rawEvidenceReadActivityId(input.threadId, turnId);
+				const opened = yield* projections.getLatestEvidenceRead(invocation.threadId).pipe(Effect.orElseSucceed(() => Option.none()));
+				if (!Option.match(opened, {
+					onNone: () => false,
+					onSome: (row) => row.turnId === turnId && row.watchedThreadId === input.threadId
+				})) yield* recordEvidenceRead(invocation.threadId, {
+					activityId,
+					watchedThreadId: input.threadId,
+					afterSequence: input.afterSequence ?? 0,
+					throughSequence: lastSequence,
+					nextAfterSequence: lastSequence,
+					hasMore: page.hasMore,
+					scannedEvents: page.events.length,
+					raw: true
+				});
+			}
+		}
 		return {
 			threadId: input.threadId,
 			events: page.events,
@@ -134590,7 +134980,7 @@ const registerPreviewSnapshot = Effect.fn("McpHttpServer.registerPreviewSnapshot
 			}
 		}),
 		annotations: tool.annotations,
-		handle: (payload) => Effect.withFiber((fiber) => {
+		handle: withFusionRoleGate(tool.name, (payload) => Effect.withFiber((fiber) => {
 			const invocation = Context.getUnsafe(fiber.context, McpInvocationContext);
 			return built.handle("preview_snapshot", payload).pipe(Stream.unwrap, Stream.run(Sink.last()), Effect.flatMap(Effect.fromOption), Effect.provideService(PreviewAutomationBroker, broker), Effect.provideService(McpInvocationContext, invocation), Effect.matchCauseEffect({
 				onFailure: previewSnapshotFailure,
@@ -134619,7 +135009,7 @@ const registerPreviewSnapshot = Effect.fn("McpHttpServer.registerPreviewSnapshot
 					}));
 				}
 			}));
-		})
+		}))
 	});
 });
 const PreviewStandardToolkitRegistrationLive = mcpToolkit(PreviewStandardToolkit).pipe(Layer.provide(PreviewStandardToolkitHandlersLive));
@@ -140132,6 +140522,7 @@ const make$3 = Effect.gen(function* () {
 		const { context, timing } = yield* correlateEvidence({
 			readerThreadId: pair.watcherThreadId,
 			readActivityId: evidenceReadActivityId(latest.watchedThreadId, latest.throughSequence),
+			...completion.payload.turnId === null ? {} : { fallbackReadActivityId: rawEvidenceReadActivityId(latest.watchedThreadId, completion.payload.turnId) },
 			closedAt: completion.occurredAt
 		});
 		yield* orchestrationEngine.dispatch({
@@ -140294,6 +140685,14 @@ const make$3 = Effect.gen(function* () {
 			case "thread-pair.gate-advanced": return yield* processGateAdvanced(event);
 			case "thread-pair.gate-resolved": return yield* processGateResolved(event);
 			case "thread-pair.created":
+				yield* setActiveMcpFusionRole({
+					threadId: event.payload.watcherThreadId,
+					role: "watcher"
+				});
+				yield* setActiveMcpFusionRole({
+					threadId: event.payload.implementerThreadId,
+					role: "implementer"
+				});
 				yield* grantActiveMcpWatchThread({
 					watcherThreadId: event.payload.watcherThreadId,
 					watchedThreadId: event.payload.implementerThreadId
@@ -140315,6 +140714,8 @@ const make$3 = Effect.gen(function* () {
 			case "thread-pair.detached": {
 				const pair = ((yield* projectionSnapshotQuery.getCommandReadModel()).threadPairs ?? []).find((candidate) => candidate.id === event.payload.pairId);
 				if (pair === void 0) return;
+				yield* clearActiveMcpFusionRole({ threadId: pair.watcherThreadId });
+				yield* clearActiveMcpFusionRole({ threadId: pair.implementerThreadId });
 				yield* revokeActiveMcpWatchThread({
 					watcherThreadId: pair.watcherThreadId,
 					watchedThreadId: pair.implementerThreadId