@sqdr2/dsh-fusion 0.0.0-stage → 0.3.2

package/src/host/coordinator.ts

@@ -0,0 +1,2160 @@
+import { readFileSync } from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import type { Context } from '@deepseek-ai/cordis'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import type { GenerateOptions } from '@deepseek-ai/dsh-llm'
+import { NativeWorkerNotices } from './native-worker-notices.js'
+import { SessionId as NativeSessionId } from '@deepseek-ai/dsh-session'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+import type { ToolExecution, ToolRunContext } from '@deepseek-ai/dsh-tools'
+import type { ExplorationReport, FusionEvent, Role, TaskId, WorkerReport, WorkOrder } from '../contracts.js'
+import { EpochId, OperationId, SessionId, SnapshotId, TaskId as asTaskId, WorkOrderId } from '../contracts.js'
+import { digestOf } from '../digest.js'
+import { WorkspaceWriteLease } from '../execution/write-lease.js'
+import type { LeaseRecord } from '../execution/write-lease.js'
+import type { ResolvedProfile } from '../profile/resolve.js'
+import { appendCapturedReviewResult, persistReviewRequest } from '../review/dispatch.js'
+import { classifyReview } from '../review/protocol.js'
+import { assertCurrentSubject } from '../review/ticket.js'
+import { StatusPending } from '../task/status-index.js'
+import type { SqliteFusionStore } from '../task/sqlite-store.js'
+import type { TaskState } from '../task/state.js'
+import type { DeletionBlocker } from '../task/deletion.js'
+import { BindingRepository } from './bindings.js'
+import type { SessionBinding } from './bindings.js'
+import { BASELINE_PARSERS, MAX_CHECK_SECONDS, TEST_PARSERS, checkCommandUnavailable, checkPrograms, freezeChecks, probeMissingPrograms, runBaselineChecks, runNativeChecks } from './native-checks.js'
+import type { CheckDefinition, FrozenCheck } from './native-checks.js'
+import { captureNativeReviewRequest, nativeReviewProof } from './native-review.js'
+import { NativeFusionScopes } from './native-scopes.js'
+import { NativeContextGuard } from './native-context.js'
+import { NativeModelControl, readModelControl } from './native-model-control.js'
+import { installCompactionRouting } from './compaction-routing.js'
+import { adaptiveWorkflow, enforcedWorkflow, NativeWorkflow } from './native-workflow.js'
+import { NativeRoleSandbox, roleSeparated } from './native-role-sandbox.js'
+import type {} from '@deepseek-ai/dsh-api-session-controller'
+import { NativeOnDemandContext } from './native-on-demand-context.js'
+import { NativeTaskContext } from './native-task-context.js'
+import { NativeApprovals } from './native-approvals.js'
+import { NativeEffects } from './native-effects.js'
+import { isShellTool, nativeShellTool } from './shell.js'
+import { observeNativeUsage } from './native-usage.js'
+import { NativeAuxiliaryRequests } from './native-auxiliary.js'
+import { NativeCacheKeepalive } from './native-keepalive.js'
+import type { KeepaliveClock } from './native-keepalive.js'
+import { hasStartActivation } from './subagent-seam.js'
+import { NativeWorkerTransport } from './native-worker.js'
+import { NativeFusionActivity } from './native-activity.js'
+import { captureExploration, citedEvidenceChanged } from './native-exploration.js'
+import { workspaceWriterDenial } from './workspace-guard.js'
+import { absentWorkerOutcome, workerNoReportCause, workerStopExplanation, workerUnreachableFor, workerUnreachableReply } from './worker-terminal.js'
+import { resolveModelOutputLimits } from './model-output.js'
+import { assertWorkerBriefRequest, captureWorkerBrief, workerToolBriefProblem } from './native-worker-brief.js'
+import { changedPaths, grantOf, pathAllowed, snapshotWorkspace, workspacePath, workspaceRelative } from './workspace.js'
+import type { WorkspaceSnapshot } from './workspace.js'
+import { captureChangeBase, captureLaterChangeBase, saveChangeManifest } from './change-evidence.js'
+import { CachePolicy } from './cache-policy.js'
+import type { ChangeBase } from './change-evidence.js'
+import { evidencePage } from './evidence-page.js'
+import { readNativeEvidence } from './native-evidence.js'
+import { isRouteTransportName, registeredRouteTransport, withRouteTransport } from './route-transport.js'
+
+const textOutput = { schema: { type: 'string' as const }, render: (_args: unknown, text: string) => [{ type: 'text' as const, text }] }
+const stringList = { type: 'array' as const, items: { type: 'string' as const }, required: true as const }
+const optionalStringList = { type: 'array' as const, items: { type: 'string' as const } }
+const READ_TOOLS = new Set(['fusion_read_state', 'glob', 'grep', 'read', 'fusion_read_evidence', 'job_output'])
+const isRead = (exec: Readonly<ToolExecution>) => READ_TOOLS.has(exec.name)
+  || exec.name === 'str_replace_editor' && (exec.arguments as { command?: unknown }).command === 'view'
+const FUSION_TOOLS = new Set(['fusion_read_state', 'fusion_delegate_text', 'fusion_explore', 'fusion_delegate', 'fusion_rework', 'fusion_wait', 'fusion_review_result', 'fusion_submit_result', 'fusion_takeover', 'fusion_finish_direct', 'fusion_read_evidence'])
+const WORKER_FUSION_TOOLS = new Set(['fusion_submit_result', 'fusion_read_state', 'fusion_read_evidence'])
+export interface CoordinatorOptions {
+  profile: ResolvedProfile
+  workerTools: readonly string[]
+  /** Must validate existing authorization and durably reserve this actual request. */
+  authorizeRequest(agent: Agent, binding: SessionBinding, role: Role, turn: number, step: number): void
+  /** Actual native stream admission, including auxiliary compaction calls. */
+  resumeAuthorization?(binding: SessionBinding): string
+  reserveRequest?(request: GenerateOptions, binding: SessionBinding, role: Role): void
+  leaseRoot?: string
+  maxWorkerSteps?: number
+  maxReworkRounds?: number
+  commandMaxSeconds?: number
+  /** Test clock only; production retains the recovered fixed schedule. */
+  keepaliveClock?: KeepaliveClock
+}
+interface RuntimeRecord {
+  schemaVersion: 1
+  taskId: TaskId
+  root: string
+  base: WorkspaceSnapshot
+  /** Exact pre-edit bytes; absent on tasks delegated by earlier plugin versions. */
+  changeBase?: ChangeBase
+  checks: readonly FrozenCheck[]
+  reworkRounds: number
+  /** Pre-report feedback, bounded separately; absent on older persisted tasks. */
+  continuationRounds?: number
+  /** Omitted on pre-steering records; those requests begin at revision zero. */
+  briefRevision?: number
+  background?: boolean
+  submitted?: { summary: string; unresolved: string[]; status: WorkerReport['status'] }
+  explorationSubmitted?: ExplorationReport
+  verification?: 'unverified' | 'partial' | 'verified'
+  verificationReasons?: readonly string[]
+  completedTurn?: number
+  takeover?: boolean
+  /** enforced-v3: why the Host unlocked takeover, and how many Lead write turns it has used. */
+  escalation?: string
+  leadSubmissions?: number
+  /** A quiescent Worker cannot admit more requests for this frozen order. */
+  workerStepStop?: { workOrderId: WorkOrderId; requests: number; limit: number }
+  workerFailure?: { workOrderId: WorkOrderId; childId: string; eventSeq: number; userSeq: number;
+    category: 'quota-exhausted' | 'provider-error'; code?: string }
+  /** A user-authorized retry must not rediscover the same retained native error. */
+  workerFailureClearedThrough?: { childId: string; eventSeq: number }
+  /**
+   * The Worker for this frozen order was dispatched a tool table it never called,
+   * so its route cannot reach `fusion_submit_result` and the order can never be
+   * reported. Recorded once the Host observes it, so the task stops presenting the
+   * handoff as live (session-16660dfd: the task stayed WORKER_RUNNING with no way
+   * forward, because only a settle could rediscover a fact already known).
+   */
+  workerUnreachable?: { workOrderId: WorkOrderId; childId: string; provider: string; model: string }
+}
+const STUB_REVIEW = /^(?:placeholder|todo|tbd|n\/?a|none|ok|okay|lgtm|done|accept(?:ed)?|looks good|fine|test)\.?$/i
+
+/** At least a sentence that is not a stock stub. */
+export function substantiveReview(reason: string): boolean {
+  const text = reason.trim()
+  return text.length >= 20 && !STUB_REVIEW.test(text)
+}
+
+type LooseCheck = { command: string; id?: string; description?: string; parser?: CheckDefinition['parser']; kind?: CheckDefinition['kind'];
+  timeoutSeconds?: number; definitionPaths?: readonly string[]; baseline?: CheckDefinition['baseline'] }
+
+/** Fill the defaults a Lead may omit; an explicit test kind without a parser still fails in freezeChecks. */
+export function normalizeChecks(raw: readonly LooseCheck[]): CheckDefinition[] {
+  return raw.map((check, index) => {
+    const parser = check.parser ?? (check.kind === 'test' ? undefined : 'exit-code')
+    const kind = check.kind ?? (parser && parser !== 'exit-code' ? 'test' : 'static-check')
+    return { id: check.id?.trim() || `check-${index + 1}`, description: check.description?.trim() || check.command,
+      command: check.command, kind, parser: parser as CheckDefinition['parser'], definitionPaths: check.definitionPaths ?? [],
+      ...(check.timeoutSeconds === undefined ? {} : { timeoutSeconds: check.timeoutSeconds }),
+      ...(check.baseline === undefined ? {} : { baseline: check.baseline }) }
+  })
+}
+
+/** Consecutive read-only calls allowed before a model must act; the Lead delegates broad reading. */
+export const READ_STREAK: Record<Role, number> = { lead: 25, worker: 60 }
+
+/** A few lines stay natural for the Lead; anything larger goes to the Sidekick. */
+export const LEAD_DIRECT_WRITE = { perCall: 30, perTask: 80 } as const
+
+const lineCount = (text: unknown) => typeof text === 'string' && text.length ? text.split('\n').length : 0
+
+/** Lines a Lead tool call would write; 0 for reads and ordinary commands. */
+export function directWriteLines(exec: Readonly<ToolExecution>): number {
+  const args = (exec.arguments ?? {}) as Record<string, unknown>
+  if (exec.name === 'write') return lineCount(args.content)
+  if (exec.name === 'edit') return lineCount(args.new_string)
+  if (exec.name === 'str_replace_editor') return lineCount(args.file_text) || lineCount(args.new_str)
+  if (isShellTool(exec.name) && typeof args.command === 'string') {
+    // Heredocs/here-strings and redirected multi-line scripts are file writing by another name;
+    // pwsh write cmdlets (Set-Content/Out-File/...) count at least the command itself.
+    const writes = /<<-?\s*['"]?\w+/.test(args.command) || /[@]["']\s*\r?\n/.test(args.command)
+      || (/(^|[^>&0-9])>{1,2}\s*[^\s&|]/.test(args.command) && args.command.includes('\n'))
+      || /\b(Set-Content|Add-Content|Out-File|Tee-Object)\b/i.test(args.command)
+    return writes ? Math.max(1, lineCount(args.command)) : 0
+  }
+  return 0
+}
+
+/**
+ * The Worker is the cheap model: a real task needs room to explore, run and fix.
+ * Stopping it early pushes work back to the expensive Lead or the user.
+ */
+export const DEFAULT_POLICY = { maxWorkerSteps: 150, maxReworkRounds: 3, commandMaxSeconds: 600 } as const
+
+interface DelegateInput {
+  goal: string; brief: string; constraints: string[]; allowedPaths: string[]; checks: CheckDefinition[]
+  block?: boolean
+  /** Verbatim quotes of the user's hard requirements; frozen as user-provenance constraints. */
+  requirements?: string[]
+}
+
+/** Whitespace-insensitive, otherwise exact: a requirement must be the user's own words. */
+export const normalizeQuote = (text: string) => text.replace(/\s+/g, ' ').trim()
+
+/** Literal code spans (`like this`) a requirement asks for; a candidate that omits them gets flagged. */
+export const literalSpans = (text: string) => [...new Set([...text.matchAll(/`([^`\n]{2,120})`/g)].map(match => match[1]!))]
+
+/** The enforced-v3 Lead's fixed catalog (order is part of the cached prompt prefix). */
+const SEPARATED_LEAD_TOOLS: readonly string[] = [...new Set([...READ_TOOLS, nativeShellTool, ...[...FUSION_TOOLS].filter(name =>
+  !['fusion_takeover', 'fusion_submit_result', 'fusion_finish_direct'].includes(name))])]
+
+/** Test files by common conventions (Python, JS/TS, Go, Rust and generic test directories). */
+const TEST_FILE = /(^|\/)(tests?|__tests__|specs?)\/|(^|\/)test_[^/]+\.py$|_test\.(py|go)$|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)conftest\.py$/i
+
+export interface RewrittenTest {
+  path: string
+  /** Original lines no longer present in the file. */
+  removedLines?: number
+  deleted?: boolean
+  /** Widened into scope after the change: no original bytes exist to compare against. */
+  unavailableBase?: boolean
+}
+
+/**
+ * Existing test files whose original lines were removed or changed (pure additions are not listed). A Worker
+ * that rewrites an old test to fit its change hides a regression the maintainers' test would catch
+ * (round 4, canvasapi): the Lead must look at these before accepting.
+ */
+export function rewrittenTests(store: SqliteFusionStore, taskId: TaskId, root: string, changeBase: ChangeBase | undefined, changes: readonly string[]): RewrittenTest[] {
+  if (!changeBase) return []
+  return changes.filter(path => TEST_FILE.test(path)
+    && (Object.hasOwn(changeBase.contents, path) || changeBase.unavailable?.includes(path))).flatMap((path): RewrittenTest[] => {
+    // Widened after the Worker had already changed it: there are no original lines to compare,
+    // so the Lead is told to look at the file instead of the Host silently clearing the gate.
+    if (!Object.hasOwn(changeBase.contents, path)) return [{ path, unavailableBase: true }]
+    const original = Buffer.from(store.readArtifacts(taskId, [changeBase.contents[path]!.id])[0]!).toString('utf8')
+    let current = ''
+    try { current = readFileSync(workspacePath(root, path), 'utf8') } catch { return [{ path, removedLines: original.split('\n').filter(line => line.trim()).length, deleted: true }] }
+    const remaining = new Map<string, number>()
+    for (const line of current.split('\n')) if (line.trim()) remaining.set(line.trim(), (remaining.get(line.trim()) ?? 0) + 1)
+    let removed = 0
+    for (const line of original.split('\n')) {
+      const key = line.trim(); if (!key) continue
+      const count = remaining.get(key) ?? 0
+      if (count) remaining.set(key, count - 1); else removed++
+    }
+    return removed ? [{ path, removedLines: removed }] : []
+  })
+}
+
+/** Rework rounds after which a still-failing work order unlocks Lead takeover (enforced-v3). */
+export const ESCALATE_AFTER_REWORKS = 2
+/** Lead takeover submissions allowed per escalated work order. */
+export const MAX_LEAD_SUBMISSIONS = 3
+
+/** Native AgentLoop owns work; optional auxiliary calls use the public LLM service. */
+export class FusionCoordinator {
+  readonly bindings: BindingRepository
+  readonly scopes: NativeFusionScopes
+  readonly transport: NativeWorkerTransport
+  readonly activity: NativeFusionActivity
+  readonly leases: WorkspaceWriteLease
+  readonly taskContext: NativeTaskContext
+  readonly onDemand: NativeOnDemandContext
+  readonly approvals: NativeApprovals
+  readonly effects: NativeEffects
+  readonly keepalive: NativeCacheKeepalive
+  /** Per-model cache keepalive settings, evidence and defaults (shared with the settings API). */
+  readonly cachePolicy: CachePolicy
+  readonly #auxiliary = new NativeAuxiliaryRequests()
+  readonly #dispose: (() => void)[] = []
+  readonly #nestedChecks = new Map<string, { agent: Agent; parent: symbol }>()
+  readonly #reads = new Map<string, number>()
+  readonly #held = new Map<TaskId, LeaseRecord>()
+  readonly #installErrors = new Map<string, string>()
+  readonly #trackingErrors = new Map<TaskId, string>()
+  readonly #leadMutations = new Map<TaskId, symbol>()
+  readonly #stoppingTasks = new Map<TaskId, number>()
+  readonly #backgroundStops = new Map<TaskId, Promise<void>>()
+  readonly #statusAbort = new AbortController()
+  #closing = false
+
+  readonly modelControl: NativeModelControl
+  readonly workflow: NativeWorkflow
+  readonly roleSandbox: NativeRoleSandbox
+
+  constructor(readonly ctx: Context, readonly store: SqliteFusionStore, readonly options: CoordinatorOptions) {
+    this.bindings = new BindingRepository(store)
+    this.workflow = new NativeWorkflow(store)
+    this.roleSandbox = new NativeRoleSandbox(ctx, store, id => this.bindings.read(id)?.binding)
+    this.transport = new NativeWorkerTransport(ctx)
+    this.activity = new NativeFusionActivity(ctx, store)
+    this.leases = new WorkspaceWriteLease(options.leaseRoot)
+    this.taskContext = new NativeTaskContext(store, id => ctx.agents.get(NativeSessionId(id)))
+    this.onDemand = new NativeOnDemandContext(store, this.taskContext)
+    const notices = new NativeWorkerNotices(store)
+    this.scopes = new NativeFusionScopes({
+      route: (binding, role) => this.modelControl?.route(binding, role) ?? binding.profile[role],
+      beforeTurn: (agent, binding, role) => {
+        const previous = this.state(binding.taskId)
+        if (role !== 'lead' || previous.control.mode !== 'completed') return binding
+        // Adopt the known completed child of pre-workerId bindings once.
+        if (!binding.workerId && previous.acceptedChild) this.bindings.assignWorker(agent.id, binding.taskId, previous.acceptedChild)
+        const nextTask = asTaskId(randomUUID())
+        this.#createTask(agent, nextTask, { profile: binding.profile, prompts: binding.prompts }, binding.taskId)
+        return this.bindings.rollover(agent.id, binding.taskId, nextTask)
+      },
+      taskContext: (agent, binding, role) => binding.profile.interactionMode === 'model-like'
+        ? this.onDemand.message(agent, binding, role) : this.taskContext.message(agent, binding, role),
+      beforeStep: (agent, binding, role) => {
+        if (role !== 'lead') return
+        notices.projectHistory(agent, binding)
+        this.#acknowledgeUserRetry(agent, binding.taskId)
+      },
+      projectMessage: (agent, binding, role, message) => role === 'lead' ? notices.project(agent, binding, message) : message,
+      canAccess: (agent, binding, role) => this.#accessBlocked(agent, binding, role),
+      prepareRequest: (_agent, binding, _role, signal) => this.#prepareStatus(binding.taskId, signal),
+      canRequest: (agent, binding, role) => this.#requestBlocked(agent, binding, role),
+      canExecute: (exec, binding, role) => this.#toolBlocked(exec, binding, role),
+      modelLimits: (provider, model) => resolveModelOutputLimits(this.ctx, provider, model),
+      beforeRequest: (agent, turn, step, binding, role) => {
+        this.options.authorizeRequest(agent, binding, role, turn, step)
+        this.roleSandbox.ensure(agent, binding, role, role === 'lead' && this.#leadWriter(binding, agent))
+        const state = this.state(binding.taskId)
+        if (role === 'lead' && state.activeReviewTicket) captureNativeReviewRequest(store, agent, turn, step, state.activeReviewTicket)
+        if (role === 'worker') {
+          try { captureWorkerBrief(store, binding.taskId, agent, turn, step, this.#runtime(binding.taskId).briefRevision ?? 0) }
+          catch (error) { this.#trackingFailed(agent, `Worker brief tracking failed: ${String(error)}`); throw error }
+        }
+      },
+      installTools: (scope, agent, _binding, role) => this.#tools(scope, agent, role),
+      readOnlyTools: (agent, binding, role) => {
+        const ceiling = this.#roleCeiling(agent, binding, role)
+        // A bridge route (Antigravity's agy) can only answer under its own
+        // transport, so any role that must call tools needs it in the table —
+        // the Lead to delegate and review, the Worker to report. A text
+        // delegation answers in prose and a finished task may call nothing, so
+        // those ceilings keep their exact shape.
+        if (ceiling === undefined) return ceiling
+        const reportsBack = role === 'worker'
+          ? this.state(binding.taskId).currentWorkOrder?.mode !== 'text'
+          : ceiling.length > 0
+        return reportsBack ? withRouteTransport(ceiling, this.#routeTransport(binding, role)) : ceiling
+      },
+    })
+    this.approvals = new NativeApprovals(ctx, store, { owner: agent => this.owner(agent),
+      state: id => this.state(id),
+      pending: (id, approval) => { this.append(id, 'approval/pending', { approval }) },
+      answered: (id, approvalId, state) => { this.append(id, 'approval/answered', { approvalId, state }) },
+      failed: (agent, error) => this.#trackingFailed(agent, `Fusion approval tracking failed: ${String(error)}`) })
+    this.#dispose.push(this.approvals.install())
+    this.#dispose.push(this.roleSandbox.install())
+    this.effects = new NativeEffects(ctx, store, { owner: agent => this.owner(agent),
+      // A bridge-route transport replays a step its own loop already executed, so
+      // it is never an outstanding effect this Host must settle.
+      track: exec => !isRead(exec) && !FUSION_TOOLS.has(exec.name) && !isRouteTransportName(exec.name),
+      backgroundMaxMs: (_exec, binding) => binding.profile.interactionMode === 'model-like' ? null : (this.state(binding.taskId).currentWorkOrder?.policy.commandMaxSeconds ?? this.options.commandMaxSeconds ?? DEFAULT_POLICY.commandMaxSeconds) * 1000,
+      failed: (agent, error) => this.#trackingFailed(agent, `Fusion native effect tracking failed: ${String(error)}`) })
+    this.#dispose.push(this.effects.install())
+    this.#dispose.push(ctx.on('tools/execute', async (exec, next) => {
+      const owner = exec.agent && this.owner(exec.agent)
+      if (owner?.role !== 'lead' || !FUSION_TOOLS.has(exec.name) || isRead(exec)) return next()
+      const taskId = owner.binding.taskId
+      if (this.#leadMutations.has(taskId)) throw new Error('Another Fusion control call is active; issue delegation, steering, wait and takeover sequentially')
+      this.#leadMutations.set(taskId, exec.token)
+      try { return await next() }
+      finally { if (this.#leadMutations.get(taskId) === exec.token) this.#leadMutations.delete(taskId) }
+    }))
+    // An observer exception is contained by native AgentRegistry. Root backstops
+    // prevent a partially installed child from reaching either tools or an LLM.
+    this.#dispose.push(ctx.on('agent/created', async ({ agent }) => { this.#attachKnown(agent); }))
+    this.#dispose.push(ctx.tools.guard(exec => {
+      if (!exec.agent) return undefined
+      const owner = this.owner(exec.agent)
+      // The lease governs Fusion's own Lead and Worker only. Another session in
+      // the same directory is not made read-only by a Fusion writer.
+      if (!owner) return undefined
+      try { this.scopes.assertReady(exec.agent) } catch (error) { return String(error) }
+      const cwd = exec.agent.session.header.cwd
+      return workspaceWriterDenial({
+        fusionOwned: true,
+        exempt: isRead(exec) || FUSION_TOOLS.has(exec.name) || exec.name === 'run_code',
+        cwd,
+        leaseHolder: cwd ? this.leases.current(cwd)?.holder : undefined,
+        agentId: SessionId(exec.agent.id),
+      })
+    }))
+    this.cachePolicy = new CachePolicy(store)
+    this.keepalive = new NativeCacheKeepalive(ctx, store, this.#auxiliary, {
+      owner: agent => this.owner(agent), allowed: (agent, owner) => {
+        const state = this.state(owner.binding.taskId)
+        if (digestOf(this.modelControl?.route(owner.binding, owner.role) ?? owner.binding.profile[owner.role]) !== digestOf(owner.binding.profile[owner.role])) return false
+        try { if (state.control.mode !== 'running' || this.#requestBlocked(agent, owner.binding, owner.role)) return false }
+        catch (error) { if (error instanceof StatusPending) return false; throw error }
+        if (agent.status === 'running') return true
+        if (owner.role !== 'lead') return false
+        const childId = state.acceptedChild ?? state.reservedChild
+        const child = childId && ctx.agents.get(NativeSessionId(childId))
+        return Boolean(child && child.status === 'running')
+      }, failed: (agent, reason) => this.#trackingFailed(agent, reason),
+      policy: (owner, provider, model) => {
+        const policy = this.cachePolicy.resolve(provider, model, owner.role, owner.binding.profile.cacheKeepalive?.[owner.role])
+        return { mode: policy.mode, intervalMs: policy.intervalSeconds * 1000 }
+      },
+      observe: (owner, provider, model, sample) => this.cachePolicy.observe(provider, model, sample,
+        this.cachePolicy.resolve(provider, model, owner.role, owner.binding.profile.cacheKeepalive?.[owner.role]).intervalSeconds),
+    }, options.keepaliveClock)
+    this.#dispose.push(observeNativeUsage(ctx, store, agent => {
+      const owner = this.owner(agent)
+      return owner ? { taskId: owner.binding.taskId, role: owner.role } : undefined
+    }, this.#auxiliary))
+    const context = new NativeContextGuard(ctx, store, agent => this.owner(agent), (owner, reason) => {
+      if (this.state(owner.binding.taskId).control.mode === 'running') this.append(owner.binding.taskId, 'task/paused', { reason })
+    }, this.taskContext, this.#auxiliary, (binding, role) => this.modelControl.route(binding, role))
+    this.#dispose.push(context.install((_agent, owner, request) => {
+      options.reserveRequest?.(request, owner.binding, owner.role)
+    }, (agent, request) => {
+      this.scopes.assertReady(agent)
+      this.keepalive.assertRequest(agent, request)
+      const owner = this.owner(agent)
+      if (owner && owner.binding.profile.interactionMode !== 'model-like') this.taskContext.assertPresent(agent, owner.binding, owner.role, request)
+      if (owner?.role === 'worker' && owner.binding.profile.interactionMode !== 'model-like') assertWorkerBriefRequest(store, owner.binding.taskId, request)
+    }))
+    this.modelControl = new NativeModelControl(ctx, store, {
+      owner: agent => this.owner(agent),
+      resolve: async id => {
+        const live = ctx.agents.get(NativeSessionId(id))
+        if (live) return live
+        const result = await ctx.sessionController.resolveAgent(NativeSessionId(id))
+        if ('error' in result) throw new Error(result.error.message)
+        return result.agent
+      },
+      pause: agent => this.pause(agent), resume: agent => this.resume(agent, options.resumeAuthorization?.(this.bindings.read(agent.id)!.binding) ?? 'native-account'),
+      settled: binding => { const state = this.state(binding.taskId); return !this.effects.pending(binding.taskId).length
+        && !state.control.recovering && !state.control.outcomeUnknown && !state.control.pendingApprovalIds.length },
+      stopAuxiliary: binding => { void this.keepalive.stopTask(binding.taskId, 'provider-unavailable') },
+    })
+    this.#dispose.push(installCompactionRouting(ctx, {
+      owner: agent => this.owner(agent), route: (binding, role) => this.modelControl.route(binding, role),
+      epoch: binding => readModelControl(store, binding)?.epoch ?? 0,
+    }))
+    this.#dispose.push(ctx.on('tools/result', (exec, result) => {
+      const owner = exec.agent && this.owner(exec.agent)
+      if (!owner || !enforcedWorkflow(owner.binding)) return
+      try {
+        if (this.workflow.observe(exec, result, owner.binding, owner.role, isRead(exec))) {
+          if (!this.workflow.repairProgress(exec.agent!, owner.binding, owner.role)) this.modelControl.failure(owner.binding, owner.role, { code: 'NO_PROGRESS', message: 'Repeated unchanged results after a local replanning opportunity' })
+        }
+      } catch (error) { this.#trackingFailed(exec.agent!, `Workflow observation failed: ${String(error)}`) }
+    }))
+    this.#dispose.push(ctx.on('agent/turn-stopping', ({ agent, signal }) => {
+      const owner = this.owner(agent)
+      if (!owner || !enforcedWorkflow(owner.binding) || signal.aborted || this.#accessBlocked(agent, owner.binding, owner.role)) return
+      const { binding, role } = owner, state = this.state(binding.taskId)
+      let instruction: string | undefined
+      if (role === 'lead' && state.phase === 'REVIEWING') instruction = 'The current report has not been accepted. Inspect its evidence and call fusion_review_result; failed checks cannot be accepted. Use needs-decision for a genuine missing user decision.'
+      else if (role === 'lead' && adaptiveWorkflow(binding) && state.phase === 'REWORK') instruction = 'Your review requires a correction. Send the specific feedback to the same Sidekick through fusion_rework; do not end the task before the correction and its checks. If a real user decision is missing, explain it explicitly.'
+      else if (role === 'worker' && state.currentWorkOrder && !this.#runtime(binding.taskId).submitted) instruction = 'Submit the current work through fusion_submit_result with its actual status and unresolved requirements. Prose alone cannot complete this work order.'
+      else if (role === 'lead' && !state.currentWorkOrder && this.workflow.deniedEffect(binding)) instruction = 'A requested effect was blocked and has not executed. Delegate it through fusion_delegate, or explain the blocker. This task cannot be recorded as completed by a text-only response.'
+      if (!instruction) return
+      if (!this.workflow.repairStop(agent, binding, role, instruction)) this.modelControl.failure(binding, role, {
+        code: 'WORKFLOW_INCOMPLETE', message: 'The required workflow transition is still missing after one repair opportunity',
+      })
+    }))
+    this.keepalive.install()
+    this.#dispose.push(ctx.on('session/event', (session, event) => {
+      if (event.type !== 'compaction/end') return
+      const agent = ctx.agents.get(NativeSessionId(session.id)), owner = agent && this.owner(agent)
+      if (!agent || owner?.binding.profile.interactionMode !== 'model-like') return
+      const message = this.onDemand.message(agent, owner.binding, owner.role)
+      if (message) agent.session.append('user/message', message, { surfaceOp: 'append' })
+    }))
+    this.#dispose.push(ctx.on('session/event', (session, event) => {
+      if (event.type !== 'user/message' || event.data.source && event.data.source.kind !== 'user') return
+      const binding = this.bindings.read(session.id)?.binding
+      if (!binding?.selected) return
+      const id = `task-index:${binding.taskId}`, row = store.readDocument(id)
+      const value = row?.value as { title?: string } | undefined
+      const title = event.data.content.filter(block => block.type === 'text').map(block => block.text).join(' ').trim().replace(/\s+/g, ' ').slice(0, 160)
+      if (row && value?.title === '对话任务' && title) store.writeDocument(id, row.revision, { ...value, title })
+    }))
+    this.#dispose.push(ctx.on('session/event', (session, event) => {
+      if (event.type !== 'turn/end') return
+      const binding = this.bindings.read(session.id)?.binding
+      if (!binding?.selected) return
+      const state = this.state(binding.taskId)
+      if (event.data.reason.kind !== 'completed') {
+        if (state.currentWorkOrder && this.#runtime(binding.taskId).background) {
+          const parent = ctx.agents.get(NativeSessionId(session.id))
+          if (parent) void this.#stopBackground(parent, binding)
+        }
+        return
+      }
+      if (state.currentWorkOrder || state.control.mode !== 'running' || this.modelControl.blocked(binding, 'lead')) return
+      if (state.lease && binding.profile.interactionMode !== 'model-like') return
+      if (this.effects.pending(binding.taskId).length) return
+      try {
+        this.#release(binding.taskId)
+        this.append(binding.taskId, 'intent/chosen', { intent: 'DIRECT' })
+        // A direct conversational answer has no verified source artifact.
+        this.append(binding.taskId, 'task/completed', { verification: 'unverified',
+          snapshot: SnapshotId(`conversation:${digestOf({ sessionId: session.id, turn: event.data.turn, eventSeq: event.seq })}`) })
+      } catch (error) { this.#installErrors.set(session.id, String(error)) }
+    }))
+    // HMR / cold boot preserves bindings. Active effects require reconciliation;
+    // no old prepared outbox is blindly dispatched again.
+    for (const binding of this.bindings.selected()) {
+      const state = this.state(binding.taskId)
+      const pendingDispatch = this.store.outbox(binding.taskId).some(row => row.kind === 'native-worker'
+        && ['prepared', 'dispatched', 'accepted'].includes(row.state))
+      const uncertainCheck = this.store.listDocumentIds(`check-invocation:${binding.taskId}:`).some(id => {
+        const row = this.store.readDocument(id)?.value as { evidence?: { state?: string } } | undefined
+        return row?.evidence?.state === 'started' || row?.evidence?.state === 'outcome-unknown'
+      })
+      const interruptedCompaction = this.store.listDocumentIds(`context-recovery:${binding.taskId}:`).some(id =>
+        (this.store.readDocument(id)?.value as { state?: string } | undefined)?.state === 'started')
+      const interruptedApproval = this.store.listDocumentIds(`native-approval:${binding.taskId}:`).some(id =>
+        (this.store.readDocument(id)?.value as { state?: string } | undefined)?.state === 'pending')
+      const interruptedEffect = this.effects.pending(binding.taskId).length > 0
+      const uncertainBrief = this.store.listDocumentIds(`worker-delivery:${binding.taskId}:`).some(id =>
+        (this.store.readDocument(id)?.value as { state?: string } | undefined)?.state === 'prepared')
+      const detachedWorker = (this.store.readDocument(`runtime:${binding.taskId}`)?.value as RuntimeRecord | undefined)?.background
+      if ((state.lease || pendingDispatch || uncertainCheck || interruptedCompaction || interruptedApproval || interruptedEffect || uncertainBrief || detachedWorker || state.pendingApprovalIds.length) && state.control.mode !== 'completed' && !state.control.recovering) {
+        this.append(binding.taskId, 'recovery/needed', { reason: 'Host runtime was replaced with a recorded writer, pending dispatch/approval, uncertain check or unfinished compaction' })
+      }
+    }
+    for (const agent of ctx.agents.list()) this.#attachKnown(agent)
+  }
+
+  state(id: TaskId): TaskState {
+    const state = this.store.load(id)
+    if (!state) throw new Error('Fusion task is missing; reconcile durable state')
+    return state
+  }
+
+  /**
+   * Why a task still owns live work in this Host process, or `undefined` when it
+   * owns none. This answers the deletion question that persisted state cannot:
+   * `control.mode` and `phase` only ever record what a running process last
+   * appended, so a task whose process was replaced keeps `mode: 'running'`
+   * forever. The registries below are the truth about what runs *now*.
+   *
+   * Read-only and side-effect free: it may be called from the delete route.
+   */
+  liveWork(id: TaskId): DeletionBlocker | undefined {
+    if (this.#stoppingTasks.has(id) || this.#backgroundStops.has(id)) return 'job'
+    if (this.#held.get(id)?.taskId === id) return 'lease'
+    if (this.effects.live(id)) return 'tool'
+    const state = this.store.load(id)
+    // A Lead session outlives the task: rollover rebinds it to a successor, so only
+    // `owner()` can say whether its current turn belongs to *this* task. Crediting a
+    // rolled-over Lead would make every earlier record in the session undeletable.
+    const lead = state && this.ctx.agents.get(NativeSessionId(state.parent))
+    if (lead && lead.status !== 'idle' && this.owner(lead)?.binding.taskId === id) return 'agent'
+    // A Worker is created for one task and dies with it, so naming it is enough.
+    // Asking `owner()` here would miss a Worker whose parent already rolled over.
+    const workerId = state?.acceptedChild ?? state?.reservedChild
+    const worker = workerId && this.ctx.agents.get(NativeSessionId(workerId))
+    if (worker && worker.status !== 'idle') return 'agent'
+    return undefined
+  }
+
+  append<T extends FusionEvent['type']>(id: TaskId, type: T, payload: Extract<FusionEvent, { type: T }>['payload']): TaskState {
+    const state = this.state(id)
+    const event = { schemaVersion: 1, id: randomUUID(), taskId: id, seq: state.seq + 1, revision: state.revision,
+      createdAt: new Date().toISOString(), causeId: 'native-fusion', type, payload } as Extract<FusionEvent, { type: T }>
+    const next = this.store.append(id, state.revision, [event])
+    const parent = this.ctx.agents.get(NativeSessionId(next.parent))
+    if (parent && this.scopes.get(parent)?.binding.taskId === id) this.scopes.refreshTools(parent)
+    if (next.control.mode !== 'running' || next.control.budgetBlocked || next.control.recovering
+      || next.control.outcomeUnknown || next.control.pendingApprovalIds.length) void this.keepalive?.stopTask(id, 'task-gated')
+    return next
+  }
+
+  owner(agent: Agent): { binding: SessionBinding; role: Role } | undefined {
+    const selected = this.bindings.read(agent.id)?.binding
+    if (selected?.selected) return { binding: selected, role: 'lead' }
+    const row = this.store.readDocument(`child:${agent.id}`)?.value as { parent?: unknown; taskId?: unknown } | undefined
+    if (!row || row.parent !== agent.session.header.parentSession || typeof row.parent !== 'string') return undefined
+    const binding = this.bindings.read(row.parent)?.binding
+    return binding?.selected && binding.taskId === row.taskId ? { binding, role: 'worker' } : undefined
+  }
+
+  async select(agent: Agent, resolved: ResolvedProfile = this.options.profile): Promise<void> {
+    this.transport.assertAvailable()
+    if (agent.session.header.parentSession) throw new Error('Fusion selection is available on top-level sessions only')
+    await agent.runMaintenance(async () => {
+      this.selectBeforeAssembly(agent, resolved)
+    })
+  }
+
+  /** Only at idle selection or native running reservation, before prompt assembly. */
+  selectBeforeAssembly(agent: Agent, resolved: ResolvedProfile): void {
+    if (agent.session.header.parentSession) throw new Error('Fusion requires a top-level session')
+    this.transport.assertAvailable()
+    if (this.bindings.read(agent.id)?.binding.selected) return
+    const taskId = asTaskId(randomUUID())
+    this.#createTask(agent, taskId, resolved)
+    const binding = this.bindings.select(agent.id, taskId, resolved)
+    this.modelControl.reset(binding)
+    this.scopes.install(agent, binding, 'lead')
+  }
+
+  /**
+   * `continues` names the task this one replaced. An automatic rollover keeps the
+   * conversation's user-instruction boundary; only a fresh selection starts a new one.
+   * A predecessor with no recorded boundary had the whole conversation in scope, so
+   * the successor records 0 rather than re-narrowing to this rollover point — the
+   * same conservative rule `render` applies to unrecorded tasks.
+   */
+  #createTask(agent: Agent, taskId: TaskId, resolved: ResolvedProfile, continues?: TaskId): void {
+    this.store.create({ schemaVersion: 1, id: randomUUID(), taskId, seq: 1, revision: 1,
+      type: 'task/created', createdAt: new Date().toISOString(), causeId: 'model-selector',
+      payload: { parent: SessionId(agent.id), selection: { kind: 'profile', profileId: resolved.profile.id } } })
+    this.append(taskId, 'profile/frozen', { digest: resolved.profile.digest, profileId: resolved.profile.id, version: resolved.profile.version })
+    const inherited = continues === undefined ? undefined : this.taskContext.originSeq(continues) ?? 0
+    this.taskContext.begin(agent, taskId, inherited)
+  }
+
+  async clear(agent: Agent): Promise<void> {
+    const binding = this.bindings.read(agent.id)?.binding
+    if (!binding?.selected) return
+    if (agent.status !== 'idle') throw new Error('Stop the current turn before changing the execution profile')
+    this.modelControl.cancel(binding, 'Fusion 已退出')
+    await this.keepalive.stopTask(binding.taskId, 'selection-cleared')
+    await this.#backgroundStops.get(binding.taskId)
+    await agent.runMaintenance(async () => {
+      const state = this.state(binding.taskId)
+      const workerId = binding.workerId ?? state.acceptedChild
+      const child = workerId && this.ctx.agents.get(NativeSessionId(workerId))
+      await this.#stopJobs(binding.taskId, async () => {
+        if (child) { await this.transport.release(agent, child.id); this.scopes.detach(child) }
+      })
+      if (this.#trackingErrors.has(binding.taskId) || state.control.recovering || state.control.outcomeUnknown) throw new Error('Reconcile the recorded effects before clearing Fusion')
+      this.#release(binding.taskId)
+      this.scopes.detach(agent)
+      this.bindings.clear(agent.id)
+      if (roleSeparated(binding)) this.roleSandbox.restore(agent)
+    })
+  }
+
+  #attachKnown(agent: Agent): void {
+    const owner = this.owner(agent)
+    if (!owner) return
+    try { this.scopes.install(agent, owner.binding, owner.role); this.#installErrors.delete(agent.id) }
+    catch (error) { this.#installErrors.set(agent.id, String(error)) }
+  }
+
+  #trackingFailed(agent: Agent, reason: string): void {
+    try {
+      const taskId = this.owner(agent)?.binding.taskId
+      if (!taskId) this.#installErrors.set(agent.id, reason)
+      else {
+        // Block both roles even if the store cannot persist the recovery gate.
+        // This is cleared only after successful human reconciliation, without
+        // hiding unrelated Agent-scope installation errors.
+        this.#trackingErrors.set(taskId, reason)
+        try {
+          if (!this.state(taskId).control.recovering) this.append(taskId, 'recovery/needed', { reason })
+        } catch (error) { this.#trackingErrors.set(taskId, `${reason}; recovery state could not be persisted: ${String(error)}`) }
+      }
+    } catch (error) { this.#installErrors.set(agent.id, `${reason}; task identity could not be read: ${String(error)}`) }
+    finally { agent.cancel({ kind: 'hook', reason }, { keepInbox: true }) }
+  }
+
+  #accessBlocked(agent: Agent, binding: SessionBinding, role: Role): string | undefined {
+    const unavailable = this.modelControl?.blocked(binding, role)
+    if (unavailable) return unavailable
+    if (this.#closing) return 'Fusion runtime is closing'
+    if (this.#stoppingTasks.has(binding.taskId)) return 'Fusion native effects are stopping'
+    const failed = this.#installErrors.get(agent.id)
+    if (failed) return failed
+    const trackingFailure = this.#trackingErrors.get(binding.taskId)
+    if (trackingFailure) return trackingFailure
+    const state = this.state(binding.taskId), control = state.control
+    if (control.mode === 'completed' && role === 'lead') return undefined // final explanation; tools remain read-only
+    if (control.mode !== 'running' || control.budgetBlocked || control.recovering || control.outcomeUnknown || control.pendingApprovalIds.length) {
+      return `Fusion execution is gated: ${state.phase}`
+    }
+    if (role === 'worker') {
+      const runtime = this.#runtime(binding.taskId)
+      if (runtime.submitted) return 'Worker report was submitted; wait for Lead feedback'
+    }
+    return undefined
+  }
+
+  async #prepareStatus(taskId: TaskId, signal?: AbortSignal): Promise<void> {
+    const combined = signal ? AbortSignal.any([signal, this.#statusAbort.signal]) : this.#statusAbort.signal
+    await this.store.statusSnapshotAsync(index => index.workerConversations(taskId), combined)
+  }
+
+  async #readyBinding(agent: Agent, role: Role, signal: AbortSignal): Promise<SessionBinding> {
+    for (;;) {
+      const before = this.#binding(agent, role)
+      await this.#prepareStatus(before.taskId, signal)
+      const current = this.#binding(agent, role)
+      if (current.taskId === before.taskId) return current
+    }
+  }
+
+  #requestBlocked(agent: Agent, binding: SessionBinding, role: Role): string | undefined {
+    const blocked = this.#accessBlocked(agent, binding, role)
+    if (blocked) return blocked
+    if (role === 'worker') {
+      // The last admitted response may still contain tools or its report.
+      // This count prevents another generation; it does not revoke that response.
+      if (this.#workerStepLimit(binding.taskId)) return 'Worker step limit reached'
+      if (this.#workerQuotaStop(binding.taskId)) return 'Worker provider quota exhausted; waiting for user input'
+    }
+    return undefined
+  }
+
+  #workerStepLimit(taskId: TaskId, limit = this.state(taskId).currentWorkOrder?.policy.maxWorkerSteps ?? DEFAULT_POLICY.maxWorkerSteps): { requests: number; limit: number } | undefined {
+    if (this.bindings.read(this.state(taskId).parent)?.binding.profile.interactionMode === 'model-like') return undefined
+    const requests = this.store.statusSnapshot(index => index.workerConversations(taskId), false)
+    return requests >= limit ? { requests, limit } : undefined
+  }
+
+  #latestUserSeq(agent: Agent): number {
+    return agent.session.snapshotEvents().findLast(event => event.type === 'user/message'
+      && (event.data.source === undefined || event.data.source.kind === 'user'))?.seq ?? 0
+  }
+
+  /**
+   * What the Worker was actually offered and what it dispatched, read from its own
+   * session log so a disposed Worker still answers. `offered` comes from the recorded
+   * request header — the table the route really received — never from this plugin's
+   * configured ceiling: a text assignment is offered the three Worker Fusion tools
+   * and nothing else, so a configured-count guess would report it as tool-less.
+   * An unreadable log yields zeroes, which merely keeps the generic verdict.
+   */
+  async #workerToolEvidence(childId: string | undefined): Promise<{ offered: number; dispatched: number }> {
+    if (!childId) return { offered: 0, dispatched: 0 }
+    try {
+      const live = this.ctx.agents.get(NativeSessionId(childId))
+      const events = live ? live.session.snapshotEvents() : (await this.ctx.sessionQuery.readSession(NativeSessionId(childId))).events
+      const header = events.findLast(event => event.type === 'request/header')
+      return { offered: header?.type === 'request/header' ? header.data.header.tools?.length ?? 0 : 0,
+        dispatched: events.filter(event => event.type === 'tool/call').length }
+    } catch { return { offered: 0, dispatched: 0 } }
+  }
+
+  /**
+   * A Worker that never dispatched one tool call of the table it was offered
+   * could not reach `fusion_submit_result` at all: its route ran the assignment
+   * outside this Host's tool loop. That is an adapter/configuration mismatch, so
+   * it is named instead of a generic incomplete turn the Lead would retry in vain.
+   */
+  async #unreachableTools(binding: SessionBinding, childId: string | undefined): Promise<string | undefined> {
+    const evidence = await this.#workerToolEvidence(childId)
+    if (workerNoReportCause({ requestedTools: evidence.offered, dispatchedToolCalls: evidence.dispatched }) !== 'unreachable-tools') return undefined
+    const route = this.modelControl.route(binding, 'worker')
+    this.#recordWorkerUnreachable(binding, childId, route)
+    return workerUnreachableReply(childId, route)
+  }
+
+  /**
+   * Record that this order's Worker can never report, so every later entry point
+   * agrees instead of waiting again. Without this the verdict lived only in the
+   * tool result: `fusion_wait` refused because the lease was gone, `fusion_rework`
+   * had no resident child to continue, and `fusion_delegate` refused because the
+   * order still "owned" the task, leaving the task in WORKER_RUNNING with no exit
+   * (session-16660dfd). The record is keyed by work order, so a replacement route
+   * under a new order is judged on its own dispatch.
+   */
+  #recordWorkerUnreachable(binding: SessionBinding, childId: string | undefined, route: { provider: string; model: string }): void {
+    const order = this.state(binding.taskId).currentWorkOrder
+    if (!order || !childId) return
+    const runtime = this.#runtime(binding.taskId)
+    const record = { workOrderId: order.id, childId, provider: route.provider, model: route.model }
+    if (digestOf(runtime.workerUnreachable ?? null) !== digestOf(record)) this.#saveRuntime({ ...runtime, workerUnreachable: record })
+  }
+
+  /** The recorded verdict for the current order, when it still owns the handoff. */
+  #workerUnreachable(binding: SessionBinding): RuntimeRecord['workerUnreachable'] {
+    // A task that has never delegated has no runtime record yet; that is simply
+    // "no verdict", not a broken record.
+    const row = this.store.readDocument(`runtime:${binding.taskId}`)?.value as RuntimeRecord | undefined
+    if (!row || row.schemaVersion !== 1 || row.taskId !== binding.taskId) return undefined
+    return workerUnreachableFor(this.state(binding.taskId).currentWorkOrder, row.workerUnreachable)
+      ? row.workerUnreachable : undefined
+  }
+
+  /**
+   * Stop the dead-end Worker and free its lease before the replacement order is
+   * frozen. The route never reached a tool, so nothing it did is pending; a child
+   * that is already gone is equally final. Refusing to wait here is the point:
+   * the alternative was a frontier Lead turn blocked until the CLI exited.
+   */
+  async #stopUnreachableWorker(agent: Agent, binding: SessionBinding): Promise<void> {
+    const childId = this.state(binding.taskId).acceptedChild
+    if (childId) {
+      const resident = this.ctx.agents.get(NativeSessionId(childId))
+      if (resident && resident.session.header.parentSession === agent.id) {
+        await this.#stopJobs(binding.taskId, () => this.transport.stop(agent, childId))
+      }
+    }
+    if (this.effects.pending(binding.taskId).length) throw new Error('An unreachable Worker still has unfinished native effects; reconcile it before replacing the work order')
+    this.#release(binding.taskId)
+  }
+
+  #clearWorkerFailure(taskId: TaskId): void {
+    const runtime = this.store.readDocument(`runtime:${taskId}`)?.value as RuntimeRecord | undefined
+    const failure = runtime?.workerFailure
+    if (runtime && failure) this.#saveRuntime({ ...runtime, workerFailure: undefined,
+      workerFailureClearedThrough: { childId: failure.childId, eventSeq: failure.eventSeq } })
+  }
+
+  #acknowledgeUserRetry(agent: Agent, taskId: TaskId): void {
+    const runtime = this.store.readDocument(`runtime:${taskId}`)?.value as RuntimeRecord | undefined
+    if (runtime?.workerFailure && this.#latestUserSeq(agent) > runtime.workerFailure.userSeq) this.#clearWorkerFailure(taskId)
+  }
+
+  #rememberWorkerFailure(agent: Agent, binding: SessionBinding): void {
+    const state = this.state(binding.taskId), childId = state.acceptedChild
+    const child = childId && this.ctx.agents.get(NativeSessionId(childId))
+    if (!state.currentWorkOrder || !child || child.status !== 'idle' || this.effects.pending(binding.taskId).length) return
+    const end = child.session.snapshotEvents().findLast(event => event.type === 'turn/end')
+    if (!end || end.type !== 'turn/end' || end.data.reason.kind !== 'error') return
+    const runtime = this.#runtime(binding.taskId), cleared = runtime.workerFailureClearedThrough
+    if (runtime.workerFailure?.childId === child.id && runtime.workerFailure.eventSeq === end.seq
+      || cleared?.childId === child.id && cleared.eventSeq >= end.seq) return
+    const error = end.data.reason.error
+    // 429 alone also means transient concurrency/rate pressure. Only explicit
+    // quota/billing exhaustion closes automatic continuation. Do not project raw
+    // upstream text (which may contain account details) into another model.
+    const code = error.code && /^[A-Z0-9_-]{1,64}$/i.test(error.code) ? error.code : undefined
+    const quota = ['QUOTA', 'INSUFFICIENT_QUOTA', 'BILLING_HARD_LIMIT_REACHED'].includes(code?.toUpperCase() ?? '')
+      || code === 'RATE_LIMIT' && /insufficient_quota|billing_hard_limit_reached|\bquota\s+(?:exceeded|exhausted)\b|Token Plan 用量上限/i.test(error.message)
+    this.#saveRuntime({ ...runtime, workerFailure: { workOrderId: state.currentWorkOrder.id, childId: child.id,
+      eventSeq: end.seq, userSeq: this.#latestUserSeq(agent), category: quota ? 'quota-exhausted' : 'provider-error', ...(code ? { code } : {}) } })
+  }
+
+  #workerQuotaStop(taskId: TaskId): RuntimeRecord['workerFailure'] | undefined {
+    const state = this.state(taskId), runtime = this.store.readDocument(`runtime:${taskId}`)?.value as RuntimeRecord | undefined
+    const failure = runtime?.workerFailure
+    return failure?.category === 'quota-exhausted' && failure.workOrderId === state.currentWorkOrder?.id
+      && failure.childId === state.acceptedChild ? failure : undefined
+  }
+
+  #recordWorkerStepStop(taskId: TaskId, spent: { requests: number; limit: number }): void {
+    const state = this.state(taskId), child = state.acceptedChild && this.ctx.agents.get(NativeSessionId(state.acceptedChild))
+    // An admitted final response or native effect may still be settling.
+    // Do not label it stopped, interrupt it, or alter its report.
+    if (!state.currentWorkOrder || child && child.status !== 'idle' || this.effects.pending(taskId).length) return
+    const runtime = this.#runtime(taskId)
+    const workerStepStop = { workOrderId: state.currentWorkOrder.id, ...spent }
+    if (digestOf(runtime.workerStepStop ?? null) !== digestOf(workerStepStop)) this.#saveRuntime({ ...runtime, workerStepStop })
+  }
+
+  #assertWorkerCapacity(taskId: TaskId, limit?: number): void {
+    const spent = this.#workerStepLimit(taskId, limit)
+    if (!spent) return
+    this.#recordWorkerStepStop(taskId, spent)
+    throw new Error(`Worker step limit reached (${spent.requests}/${spent.limit}); no feedback or new work order was sent. Existing reports and counters are retained. Do not retry Worker feedback; collect any still-settling response with fusion_wait, explain unfinished work, and await a user decision.`)
+  }
+
+  /**
+   * The transport this role's route needs to hand a step back, when this Host
+   * registers it. A bridge route (Antigravity's agy) runs its own loop and can
+   * only answer under its own transport name, so a ceiling without it makes
+   * every advertised tool unreachable. Nothing is invented: an unregistered
+   * transport is skipped (see `route-transport.ts`).
+   */
+  #routeTransport(binding: SessionBinding, role: Role): string | undefined {
+    return registeredRouteTransport(this.ctx, this.modelControl.route(binding, role).provider)
+  }
+
+  /**
+   * The Worker's full request ceiling: the configured tools plus the transport
+   * its route needs. Start-time `toolFilter` (0.2.0) and the scope restriction
+   * (0.2.1) both read it, so the transport cannot be lost on either host.
+   */
+  #workerCeiling(binding: SessionBinding): readonly string[] {
+    return withRouteTransport(this.options.workerTools, this.#routeTransport(binding, 'worker'))
+  }
+
+  /**
+   * One role's capability ceiling before any route transport is added. `undefined`
+   * means "no narrowing"; an empty array means "this role may call nothing".
+   */
+  #roleCeiling(agent: Agent, binding: SessionBinding, role: Role): readonly string[] | undefined {
+    const state = this.state(binding.taskId)
+    // enforced-v3 keeps its fixed catalog (prompt cache); the guard refuses tools on a completed task.
+    if (role === 'lead' && adaptiveWorkflow(binding) && state.control.mode === 'completed' && !roleSeparated(binding)) return []
+    if (role === 'worker') {
+      if (state.currentWorkOrder?.mode === 'text') return []
+      if (state.currentWorkOrder?.mode === 'explore') return this.options.workerTools.filter(name => READ_TOOLS.has(name))
+      // Implement mode. 0.2.0 keeps `undefined`: `startContinuable` still
+      // sends `toolFilter`, and returning an array here would also call
+      // `presentAs('native')` in NativeFusionScopes. 0.2.1 has no start-time
+      // toolFilter, so the array is the ceiling. The scope is installed at
+      // `agent/created`, before the child's first request, and that array
+      // also presents the Worker natively, as the read-only modes already were.
+      // The deny-only guard stays the second gate on both hosts.
+      return hasStartActivation(this.ctx.subagents) ? [...this.options.workerTools] : undefined
+    }
+    const lease = this.#held.get(binding.taskId)
+    if (roleSeparated(binding)) return this.#leadWriter(binding, agent) ? undefined : this.#separatedLeadTools(state, binding)
+    if (enforcedWorkflow(binding)) {
+      if (adaptiveWorkflow(binding) && !state.currentWorkOrder) return undefined
+      const takeover = state.currentWorkOrder && this.#runtime(binding.taskId).takeover
+      if (takeover && lease?.holder === SessionId(agent.id) && this.leases.stillHeld(lease)) return undefined
+      return [...READ_TOOLS, ...FUSION_TOOLS].filter(name => {
+        if (adaptiveWorkflow(binding) && state.currentWorkOrder) {
+          // Do not offer new handoffs while this persistent Worker owns the
+          // task. The delegate method remains the hard guard for forged calls.
+          if (name === 'fusion_delegate_text' || name === 'fusion_explore') return false
+          if (name === 'fusion_delegate' || name === 'fusion_finish_direct') return state.currentWorkOrder.mode === 'explore'
+            && state.phase === 'PLANNING' && state.exploration?.status === 'completed'
+          if (name === 'fusion_review_result') return state.phase === 'REVIEWING'
+          if (name === 'fusion_wait') return state.phase === 'WORKER_RUNNING'
+        }
+        return name !== 'fusion_submit_result'
+        && (name !== 'fusion_takeover' || state.currentWorkOrder?.mode !== 'text'
+          && state.currentWorkOrder?.mode !== 'explore' && state.reviewResult?.decision === 'rework')
+      })
+    }
+    if (binding.profile.interactionMode === 'model-like' && !state.currentWorkOrder) return undefined
+    return state.control.mode === 'running' && lease?.holder === SessionId(agent.id) && this.leases.stillHeld(lease)
+      ? undefined : [...READ_TOOLS, ...FUSION_TOOLS]
+  }
+
+  #toolBlocked(exec: Readonly<ToolExecution>, binding: SessionBinding, role: Role): string | undefined {
+    if (!exec.agent) return 'Fusion tools require a native Agent'
+    const blocked = this.#accessBlocked(exec.agent, binding, role)
+    if (blocked) return blocked
+    if (binding.profile.interactionMode === 'model-like' && !enforcedWorkflow(binding)) {
+      const stalled = this.#readStreak(exec, role)
+      if (stalled) return stalled
+    }
+    const state = this.state(binding.taskId)
+    if (exec.name === 'job_list') return 'Use the recorded job id; Fusion does not expose jobs outside the current task'
+    if (exec.name === 'job_output' || exec.name === 'job_kill') {
+      const issue = this.effects.jobProblem(exec, binding.taskId)
+      if (issue) return issue
+    }
+    if (state.control.mode === 'completed') return 'This task is completed; begin a new task before using tools'
+    if (role === 'lead' && ['fusion_delegate', 'fusion_delegate_text', 'fusion_explore', 'fusion_rework', 'fusion_takeover'].includes(exec.name) && this.modelControl.waiting(binding, 'worker')
+      // A Worker that stopped without its report, looped, or hit an unclassified error can be redirected by the
+      // Lead with a new instruction (bounded); quota and credential stops still need the user.
+      && !(exec.name === 'fusion_takeover' && this.#escalation(binding))
+      && !(exec.name !== 'fusion_takeover' && this.modelControl.leadRecover(binding, 'worker'))) {
+      return 'Sidekick is unavailable; preserve its task and use the local Fusion controls to continue or replace its model. Do not retry delegation or take over automatically.'
+    }
+    // A bridge route (Antigravity's agy) reports each step it ran inside its own
+    // loop through its transport (`agy_tool`), which only replays the recorded
+    // output. It carries no authority of its own: the real call was dispatched
+    // inside the bridge, where the agent-scope guard applied first. So it must
+    // not be refused as an unconfigured tool, counted as a read-only violation
+    // or a stale-brief action, or made to hold the write lease — every role and
+    // mode that reports back (a Lead delegating, a Worker exploring or
+    // implementing) needs it, and losing it silently degrades the turn to prose
+    // (WORKER_TOOLS_UNREACHABLE).
+    if (isRouteTransportName(exec.name) && this.#routeTransport(binding, role) === exec.name) return undefined
+    if (role === 'worker' && !isRead(exec)) {
+      const problem = workerToolBriefProblem(this.store, binding.taskId, exec, this.#runtime(binding.taskId).briefRevision ?? 0,
+        this.#routeTransport(binding, role))
+      if (problem) return problem
+    }
+    if (role === 'worker' && state.currentWorkOrder?.mode === 'text' && !WORKER_FUSION_TOOLS.has(exec.name)) return 'Text delegation has no external tools; prepare the result from the supplied material'
+    if (role === 'worker' && state.currentWorkOrder?.mode === 'explore'
+      && !isRead(exec) && exec.name !== 'fusion_submit_result') {
+      return 'Exploration is read-only: use file search/read tools and fusion_submit_result with source ranges; no shell, edits or run_code'
+    }
+    // The Sidekick's ceiling also holds at execution. A tool another plugin registers on the
+    // Worker itself survives both the 0.2.0 start-time toolFilter and the 0.2.1 scope restriction.
+    if (role === 'worker' && !this.options.workerTools.includes(exec.name) && !WORKER_FUSION_TOOLS.has(exec.name)) {
+      return `${exec.name} is outside the Sidekick's configured tools (${this.options.workerTools.join(', ')})`
+    }
+    if (binding.profile.interactionMode === 'model-like' && !isRead(exec)) {
+      const restore = this.onDemand.blocked(exec.agent, binding)
+      if (restore) return restore
+    }
+    if (roleSeparated(binding) && role === 'lead') {
+      const separated = this.#separatedLeadGuard(exec, binding)
+      if (separated !== false) return separated
+    }
+    if (enforcedWorkflow(binding) && role === 'lead' && !isRead(exec) && !FUSION_TOOLS.has(exec.name)
+      && (!adaptiveWorkflow(binding) || state.currentWorkOrder)) {
+      const nested = this.#nestedChecks.get(exec.callId)
+      const check = isShellTool(exec.name) && nested?.agent === exec.agent && nested.parent === exec.parent
+      const takeover = state.currentWorkOrder && this.#runtime(binding.taskId).takeover
+      if (!check && !takeover) return this.workflow.denyEffect(binding)
+    }
+    if (isRead(exec) || FUSION_TOOLS.has(exec.name) || exec.name === 'run_code') return undefined
+    if (binding.profile.interactionMode === 'model-like' && !enforcedWorkflow(binding) && role === 'lead') {
+      const refused = this.#leadWriteBoundary(exec, binding)
+      if (refused) return refused
+    }
+    if (binding.profile.interactionMode === 'model-like' && role === 'lead' && !state.currentWorkOrder && !this.#held.has(binding.taskId)) {
+      const root = exec.agent.session.header.cwd
+      // No workspace is required for conversational or non-file native tools.
+      // Filesystem/shell effects need an identified resource to coordinate.
+      if (!root && (isShellTool(exec.name) || ['write', 'edit', 'str_replace_editor'].includes(exec.name))) return 'This native file operation needs a workspace'
+      if (!root) return undefined
+      this.append(binding.taskId, 'intent/chosen', { intent: 'DIRECT' })
+      try { this.#acquire(binding, root, exec.agent.id, OperationId(randomUUID())) }
+      catch (error) { return String(error) }
+    }
+    const lease = this.#held.get(binding.taskId)
+    if (!lease || lease.holder !== SessionId(exec.agent.id) || !this.leases.stillHeld(lease)) return 'Acquire the workspace write lease before effectful tools'
+    if (['write', 'edit', 'str_replace_editor'].includes(exec.name)) {
+      const args = exec.arguments as { file_path?: unknown; path?: unknown }, raw = args.file_path ?? args.path
+      if (typeof raw !== 'string') return 'A native edit must identify its workspace path'
+      const path = workspaceRelative(lease.workspaceId, raw)
+      if (path === undefined) return `Path escapes the workspace: ${JSON.stringify(raw)} is outside the project root ${lease.workspaceId}`
+      try { workspacePath(lease.workspaceId, path) } catch (error) { return String(error) }
+      if (state.currentWorkOrder && !pathAllowed(path, state.currentWorkOrder.allowedPaths)) return 'The edit is outside frozen allowedPaths'
+    }
+    if (isShellTool(exec.name)) {
+      const args = exec.arguments as { workdir?: string; run_in_background?: boolean }
+      if (args.run_in_background) {
+        const issue = this.effects.backgroundProblem(exec)
+        if (issue) return issue
+      }
+      if (args.workdir) {
+        const dir = workspaceRelative(lease.workspaceId, args.workdir)
+        if (dir === undefined) return `Shell commands run inside the project root ${lease.workspaceId}; workdir ${JSON.stringify(args.workdir)} is outside it. Omit workdir or pass a directory inside the project.`
+        try { if (dir) workspacePath(lease.workspaceId, dir) } catch (error) { return String(error) }
+      }
+      const nested = this.#nestedChecks.get(exec.callId)
+      if (role === 'lead' && state.intent === 'DELEGATE' && !this.#runtime(binding.taskId).takeover
+        && (!nested || nested.agent !== exec.agent || nested.parent !== exec.parent)) {
+        return 'Lead is reviewing; use the native acceptance checks or request takeover'
+      }
+    }
+    return undefined
+  }
+
+  /**
+   * Prompts alone did not stop a capable Lead from writing whole implementations
+   * itself (A/B 2026-09-24: zero delegations). The Lead stays a normal model for
+   * conversation, lookups, commands and small edits; larger writing is refused
+   * with a pointer to the Sidekick, which is the point of pairing a cheaper model.
+   */
+  #leadWriteBoundary(exec: Readonly<ToolExecution>, binding: SessionBinding): string | undefined {
+    const lines = directWriteLines(exec)
+    if (!lines) return undefined
+    const key = `lead-direct:${binding.taskId}`, prior = this.store.readDocument(key)
+    const spent = (prior?.value as { lines?: number } | undefined)?.lines ?? 0
+    if (lines > LEAD_DIRECT_WRITE.perCall || spent + lines > LEAD_DIRECT_WRITE.perTask) {
+      return `Direct Lead writing is for small edits (this call ${lines} lines; this task ${spent}/${LEAD_DIRECT_WRITE.perTask} lines, at most ${LEAD_DIRECT_WRITE.perCall} per call). `
+        + 'You are the more expensive model: delegate this implementation to the Sidekick with fusion_delegate (goal, constraints, allowedPaths, checks), then review its result. '
+        + 'If the user explicitly requires you to write it yourself, explain that Fusion hands larger writing to its Sidekick and that a single model can be selected instead.'
+    }
+    this.store.writeDocument(key, prior?.revision ?? 0, { schemaVersion: 1, taskId: binding.taskId, lines: spent + lines })
+    return undefined
+  }
+
+  /**
+   * Successful calls can loop too (seen live: a Lead read a file one line per
+   * call for 130+ calls). Consecutive reads with no action in between are
+   * refused past a role-specific bound, so the model must decide with what it has.
+   */
+  #readStreak(exec: Readonly<ToolExecution>, role: Role): string | undefined {
+    const id = exec.agent!.id, limit = READ_STREAK[role]
+    // Recovery paging and waiting on a job are required steps, not browsing: neither counts nor resets.
+    if (exec.name === 'fusion_read_state' || exec.name === 'job_output') return undefined
+    if (!isRead(exec)) { this.#reads.delete(id); return undefined }
+    const count = (this.#reads.get(id) ?? 0) + 1
+    this.#reads.set(id, count)
+    if (count <= limit) return undefined
+    return `${count - 1} consecutive read-only calls without any other action. Stop reading and act on what you already know: `
+      + (role === 'lead' ? 'answer, delegate or record fusion_review_result with the evidence you have. Broad reading belongs to the Sidekick.'
+        : 'implement, run the check, or submit your report with what remains unresolved.')
+  }
+
+  /**
+   * enforced-v3 role separation: the Lead never holds execution tools. It may
+   * read, run shell commands the Host confines to read-only, and coordinate.
+   * Every change goes through the Sidekick. The only exception is a takeover the
+   * Host unlocks from objective state (#escalation), never the Lead's choice.
+   */
+  #separatedLeadTools(_state: TaskState, binding: SessionBinding): readonly string[] {
+    // One catalog for the whole conversation. Tools sit in the prompt prefix, so a phase-dependent catalog
+    // reset the frontier model's prompt cache at every handoff and review (round 4: 12 changes in one task,
+    // Lead cache hit 69% against 94% alone). Phase rules stay enforced where they belong: in each tool and
+    // the guard, whose refusals say what to do instead. Takeover appears only once the Host unlocks it.
+    return this.#escalation(binding) ? [...SEPARATED_LEAD_TOOLS, 'fusion_takeover'] : SEPARATED_LEAD_TOOLS
+  }
+
+  /** undefined = allow now, string = refuse, false = not decided here (continue the ordinary guard). */
+  #separatedLeadGuard(exec: Readonly<ToolExecution>, binding: SessionBinding): string | undefined | false {
+    // A Host-unlocked takeover holding the lease is an ordinary single writer: lease, allowedPaths and checks apply.
+    if (this.#leadWriter(binding, exec.agent!)) return exec.name === 'fusion_finish_direct' ? 'Submit the correction with fusion_submit_result; the frozen checks decide' : false
+    if (exec.name === 'fusion_takeover' && this.#escalation(binding)) return false
+    if (exec.name === 'fusion_takeover') {
+      return `FUSION_LEAD_READ_ONLY: takeover unlocks only when the Host sees the Sidekick cannot finish: ${ESCALATE_AFTER_REWORKS} rework rounds with checks still failing (after you record a rework review), its step limit, or repeated stalls. Until then send corrections with fusion_rework.`
+    }
+    if (exec.name === 'fusion_submit_result' || exec.name === 'fusion_finish_direct') {
+      return 'FUSION_LEAD_READ_ONLY: in this Fusion mode the Lead never writes. Send corrections to the same Sidekick with fusion_rework.'
+    }
+    if (isRead(exec) || FUSION_TOOLS.has(exec.name)) return false
+    const nested = this.#nestedChecks.get(exec.callId)
+    if (isShellTool(exec.name) && nested && nested.agent === exec.agent && nested.parent === exec.parent) return false
+    if (isShellTool(exec.name) && (exec.arguments as { run_in_background?: unknown }).run_in_background === true) {
+      this.workflow.denyEffect(binding)
+      return 'FUSION_LEAD_READ_ONLY: the Lead runs only short foreground inspection commands. Test runs and long commands belong to the Sidekick: delegate them.'
+    }
+    const shell = isShellTool(exec.name) ? this.roleSandbox.leadShellProblem(exec) : undefined
+    if (isShellTool(exec.name) && !shell) return undefined
+    // Record the refusal so a text-only answer cannot mark undelegated work complete.
+    this.workflow.denyEffect(binding)
+    if (shell) return shell
+    return 'FUSION_LEAD_READ_ONLY: in this Fusion mode the Lead only reads and runs read-only commands. Every workspace change, file write or code execution goes to the Sidekick: use fusion_delegate (or fusion_delegate_text for writing without a workspace).'
+  }
+
+  /**
+   * enforced-v3 escalation: why the Host lets the Lead take over the current implementation, from objective
+   * state only. A persistent failure after ESCALATE_AFTER_REWORKS rework rounds, the Worker's step limit, or a
+   * Worker that stalled again after the Lead's bounded redirects. Quota and credential stops stay with the user.
+   */
+  #escalation(binding: SessionBinding): string | undefined {
+    // Consulted on every Lead request: an unreadable record means no takeover, never a failed request.
+    try { return this.#escalationOf(binding) } catch { return undefined }
+  }
+
+  #escalationOf(binding: SessionBinding): string | undefined {
+    if (!roleSeparated(binding)) return undefined
+    const state = this.state(binding.taskId), order = state.currentWorkOrder
+    if (!order || order.mode !== 'implement' || state.control.mode === 'completed' || !this.store.readDocument(`runtime:${binding.taskId}`)) return undefined
+    const runtime = this.#runtime(binding.taskId)
+    if (runtime.takeover) return (runtime.leadSubmissions ?? 0) < MAX_LEAD_SUBMISSIONS && !this.#held.has(binding.taskId) ? runtime.escalation : undefined
+    if (runtime.workerStepStop?.workOrderId === order.id) return 'worker-step-limit'
+    if (this.modelControl.recoveriesExhausted(binding, 'worker')) return 'worker-stalled'
+    if (runtime.submitted && state.reviewResult?.decision === 'rework' && runtime.reworkRounds >= ESCALATE_AFTER_REWORKS
+      && runtime.verification !== 'verified') return 'checks-still-failing'
+    return undefined
+  }
+
+  /** The Lead currently writes through a takeover and holds the lease. */
+  #leadWriter(binding: SessionBinding, agent: Agent): boolean {
+    if (!roleSeparated(binding) || !this.store.readDocument(`runtime:${binding.taskId}`)) return false
+    const lease = this.#held.get(binding.taskId)
+    try { return Boolean(this.#runtime(binding.taskId).takeover && lease?.holder === SessionId(agent.id) && this.leases.stillHeld(lease)) }
+    catch { return false }
+  }
+
+  #runtime(id: TaskId): RuntimeRecord {
+    const row = this.store.readDocument(`runtime:${id}`)?.value as RuntimeRecord | undefined
+    if (!row || row.schemaVersion !== 1 || row.taskId !== id || !row.root || !Array.isArray(row.checks)) throw new Error('Fusion runtime record is missing or incompatible')
+    return row
+  }
+
+  #candidate(runtime: RuntimeRecord): WorkspaceSnapshot {
+    return this.state(runtime.taskId).currentWorkOrder?.mode === 'text'
+      ? { ...runtime.base, id: SnapshotId(`text:${digestOf({ order: this.state(runtime.taskId).currentWorkOrder, brief: runtime.briefRevision, submitted: runtime.submitted })}`) }
+      : snapshotWorkspace(runtime.root)
+  }
+
+  #saveRuntime(row: RuntimeRecord): void {
+    const key = `runtime:${row.taskId}`, prior = this.store.readDocument(key)
+    this.store.writeDocument(key, prior?.revision ?? 0, row)
+  }
+
+  #binding(agent: Agent, role: Role): SessionBinding {
+    const owner = this.owner(agent)
+    if (!owner || owner.role !== role) throw new Error('Fusion role identity mismatch')
+    this.scopes.assertReady(agent)
+    return owner.binding
+  }
+
+  #acquire(binding: SessionBinding, root: string, holder: string, operationId: ReturnType<typeof OperationId>): void {
+    const lease = this.leases.acquire({ cwd: root, holder: SessionId(holder), taskId: binding.taskId, operationId })
+    this.#held.set(binding.taskId, lease)
+    try { this.append(binding.taskId, 'lease/acquired', { lease }) }
+    catch (error) { this.leases.release(lease); this.#held.delete(binding.taskId); throw error }
+  }
+
+  #release(id: TaskId): void {
+    const lease = this.#held.get(id)
+    if (!lease) return
+    this.leases.release(lease)
+    this.append(id, 'lease/released', { workspaceId: lease.workspaceId, generation: lease.generation })
+    this.#held.delete(id)
+  }
+
+  async #stopJobs(taskId: TaskId, stopChild?: () => Promise<unknown>): Promise<void> {
+    this.#stoppingTasks.set(taskId, (this.#stoppingTasks.get(taskId) ?? 0) + 1)
+    try { await this.effects.stopJobs(taskId); await stopChild?.() }
+    finally {
+      const remaining = this.#stoppingTasks.get(taskId)! - 1
+      if (remaining) this.#stoppingTasks.set(taskId, remaining)
+      else this.#stoppingTasks.delete(taskId)
+    }
+  }
+
+  /** A detached native child remains a recorded writer until wait/takeover/stop. */
+  #stopBackground(agent: Agent, binding: SessionBinding): Promise<void> {
+    const previous = this.#backgroundStops.get(binding.taskId)
+    if (previous) return previous
+    const pending = (async () => {
+      try {
+        const state = this.state(binding.taskId)
+        if (state.control.mode === 'running') this.append(binding.taskId, 'task/paused', { reason: 'Lead turn stopped during a background handoff' })
+        const childId = state.acceptedChild ?? state.reservedChild
+        const child = childId && this.ctx.agents.get(NativeSessionId(childId))
+        if (child) { await this.#stopJobs(binding.taskId, () => this.transport.stop(agent, child.id)) }
+        else if (state.lease) throw new Error('Background Worker is absent with a recorded writer; reconcile before releasing')
+        if (this.effects.pending(binding.taskId).length) throw new Error('Background stop left unfinished native effects; inspection is required')
+        this.#release(binding.taskId)
+        this.#saveRuntime({ ...this.#runtime(binding.taskId), background: false })
+      } catch (error) { this.#trackingFailed(agent, `Background Worker stop requires recovery: ${String(error)}`) }
+    })().finally(() => { this.#backgroundStops.delete(binding.taskId) })
+    this.#backgroundStops.set(binding.taskId, pending)
+    return pending
+  }
+
+  #runningReply(binding: SessionBinding, delivery: string): string {
+    const state = this.state(binding.taskId)
+    return JSON.stringify({ status: 'worker-running', childId: state.acceptedChild, messageId: state.acceptedMessageId,
+      briefRevision: this.#runtime(binding.taskId).briefRevision ?? 0, delivery,
+      mode: state.currentWorkOrder?.mode ?? 'implement',
+      next: state.currentWorkOrder?.mode === 'explore'
+        ? 'The Worker is exploring read-only with no write lease. Continue read-only analysis, use fusion_rework for more facts, or fusion_wait to collect the source findings before planning implementation.'
+        : 'The Worker retains write ownership. Continue read-only work, use fusion_rework to steer the same Worker, or call fusion_wait for its report and native checks.' })
+  }
+
+  /** A disposed Worker is a terminal persisted state, not an unknown side effect, when nothing is still running. */
+  async #collectAbsentWorker(agent: Agent, binding: SessionBinding, exec: ToolRunContext): Promise<string> {
+    const outcome = absentWorkerOutcome({
+      pendingEffects: this.effects.pending(binding.taskId).length,
+      outcomeUnknown: this.state(binding.taskId).control.outcomeUnknown,
+      submitted: Boolean(this.#runtime(binding.taskId).submitted),
+    })
+    if (outcome.kind === 'recovery') {
+      this.#trackingFailed(agent, `Worker wait requires recovery: ${outcome.reason}`)
+      throw new Error(outcome.reason)
+    }
+    this.#release(binding.taskId)
+    exec.signal.throwIfAborted()
+    this.scopes.assertReady(agent)
+    return this.#validate(agent, binding, exec)
+  }
+
+  async #waitWorker(agent: Agent, binding: SessionBinding, exec: ToolRunContext): Promise<string> {
+    const childId = this.state(binding.taskId).acceptedChild
+    if (!childId) throw new Error('No accepted Worker to wait for')
+    this.#saveRuntime({ ...this.#runtime(binding.taskId), background: false })
+    const resident = this.ctx.agents.get(NativeSessionId(childId))
+    if (!resident || resident.session.header.parentSession !== agent.id) return this.#collectAbsentWorker(agent, binding, exec)
+    try {
+      const settled = await this.transport.settle(agent, childId, exec.signal, true)
+      if (!settled) {
+        exec.signal.throwIfAborted()
+        this.scopes.assertReady(agent)
+        // The native inbox remains authoritative. Return this tool so the Lead
+        // can consume steering, retaining the exact Worker and its write lease.
+        this.#saveRuntime({ ...this.#runtime(binding.taskId), background: true })
+        return this.#runningReply(binding, 'user-steering')
+      }
+      if (this.effects.pending(binding.taskId).length) throw new Error('Worker stopped with unfinished native effects; inspection is required')
+      exec.signal.throwIfAborted()
+    } catch (error) {
+      const cause = exec.signal.aborted ? new Error('FUSION_INTERRUPTED: the native turn was cancelled; progress is retained. Continue the existing task after its effects settle.') : error
+      const gone = this.ctx.agents.get(NativeSessionId(childId))
+      if (!exec.signal.aborted && (!gone || gone.session.header.parentSession !== agent.id)) {
+        return this.#collectAbsentWorker(agent, binding, exec)
+      }
+      try {
+        // 0.2.1 natural settlement may already have disposed the idle child.
+        // Stopping a handle that is gone throws; the journal still decides
+        // whether the writer can be released.
+        await this.#stopJobs(binding.taskId, async () => {
+          const resident = this.ctx.agents.get(NativeSessionId(childId))
+          if (!resident || resident.session.header.parentSession !== agent.id) return
+          await this.transport.stop(agent, childId)
+        })
+        if (this.effects.pending(binding.taskId).length) throw new Error('Worker has unfinished native effects')
+        this.#release(binding.taskId)
+        if (!this.state(binding.taskId).control.recovering) this.append(binding.taskId, 'task/paused', { reason: String(cause) })
+      } catch (stopError) { this.#trackingFailed(agent, `Worker wait requires recovery: ${String(stopError)}`) }
+      throw cause
+    }
+    this.#release(binding.taskId)
+    exec.signal.throwIfAborted()
+    this.#rememberWorkerFailure(agent, binding)
+    this.scopes.assertReady(agent)
+    return this.#validate(agent, binding, exec)
+  }
+
+  async wait(agent: Agent, exec: ToolRunContext): Promise<string> {
+    const binding = this.#binding(agent, 'lead'), state = this.state(binding.taskId)
+    if (!state.currentWorkOrder || !state.acceptedChild) throw new Error('No Worker handoff is pending')
+    if (state.phase === 'REVIEWING') throw new Error('The current report is ready; review it before another wait')
+    if (this.#runtime(binding.taskId).takeover) throw new Error('Lead takeover must submit its own result')
+    // Re-report the recorded verdict instead of refusing a lease-less handoff:
+    // there is nothing to wait for, and the Lead must be able to read why.
+    const unreachable = this.#workerUnreachable(binding)
+    if (unreachable) return workerUnreachableReply(unreachable.childId, unreachable)
+    const operation = readModelControl(this.store, binding)?.operation
+    const resumeId = operation && `workflow-worker-resume:${binding.taskId}:${operation.id}`
+    const child = this.ctx.agents.get(NativeSessionId(state.acceptedChild))
+    if (adaptiveWorkflow(binding) && operation?.taskId === binding.taskId && operation.state === 'delivered'
+      && (!child || child.status === 'idle') && !this.#runtime(binding.taskId).submitted && !this.effects.pending(binding.taskId).length
+      && !this.modelControl.waiting(binding, 'worker') && resumeId && !this.store.readDocument(resumeId)) {
+      this.store.writeDocument(resumeId, 0, { schemaVersion: 1, operationId: operation.id, childId: state.acceptedChild,
+        causeId: exec.callId, at: new Date().toISOString() })
+      return this.rework(agent, 'The user explicitly continued this task through the local Fusion controls. Resume the unchanged work order on this same Sidekick; restore saved state before effects and do not repeat an uncertain operation.', exec)
+    }
+    if (['explore', 'text'].includes(state.currentWorkOrder.mode ?? '') ? state.phase !== 'WORKER_RUNNING' : state.lease?.holder !== state.acceptedChild) {
+      throw new Error('No active Worker handoff; send specific feedback before waiting again')
+    }
+    return this.#waitWorker(agent, binding, exec)
+  }
+
+  /** Refuse a work order whose acceptance programs this host cannot run, before any Worker request. */
+  async #preflightPrograms(root: string, definitions: readonly CheckDefinition[]): Promise<void> {
+    const programs = [...new Set(definitions.flatMap(definition => checkPrograms(definition.command)))]
+    const probe = programs.length ? await probeMissingPrograms(root, programs) : undefined
+    if (!probe?.missing.length) return
+    const hints = probe.missing.map(name => {
+      const found = [...probe.alternatives[name]!.map(item => `${item} on PATH`), ...probe.locations[name]!.map(path => `installed at ${path}, not on PATH`)]
+      return found.length ? `${name} (${found.join('; ')})` : name
+    })
+    throw new Error(`Acceptance commands use programs this host's check shell cannot find: ${hints.join('; ')}. Checks and the Worker run in the same non-interactive shell with the Host's PATH (a desktop app started from the Dock gets only the system PATH). Retry fusion_delegate with commands that exist here, using the absolute path shown when one is installed off PATH, and tell the Worker to use the same path.`)
+  }
+
+  async delegate(agent: Agent, args: DelegateInput, exec: ToolRunContext, mode: 'explore' | 'implement' | 'text' = 'implement'): Promise<string> {
+    const binding = await this.#readyBinding(agent, 'lead', exec.signal)
+    const priorState = this.state(binding.taskId)
+    const held = this.#held.get(binding.taskId)
+    const directHandoff = (mode === 'implement' || binding.profile.interactionMode === 'model-like') && priorState.intent === 'DIRECT' && !priorState.currentWorkOrder
+      && priorState.control.mode === 'running' && !priorState.control.recovering && !priorState.control.outcomeUnknown
+      && priorState.lease?.holder === SessionId(agent.id) && held?.holder === SessionId(agent.id)
+      && held.generation === priorState.lease.generation && this.leases.stillHeld(held)
+    if (priorState.lease && !directHandoff || held && !priorState.lease || this.effects.pending(binding.taskId).length) {
+      throw new Error('Settle the current writer and effects before a new work order: wait for or stop your running commands (job_output, job_kill) and let pending tools finish, then delegate again')
+    }
+    const promoting = mode === 'implement' && priorState.currentWorkOrder?.mode === 'explore'
+    // An order whose route can never report holds no useful handoff: it is a dead
+    // end, not a running Worker. Replacing it is the only way out of WORKER_RUNNING
+    // (session-16660dfd), so this is allowed exactly once the Host has recorded that
+    // verdict for this order — never for an ordinary in-flight Worker.
+    const replacesUnreachable = Boolean(this.#workerUnreachable(binding))
+    if (replacesUnreachable) await this.#stopUnreachableWorker(agent, binding)
+    if (priorState.currentWorkOrder && !promoting && !replacesUnreachable) throw new Error('A Worker already owns this task; use fusion_rework with model-authored feedback (after a report it can also add allowedPaths with addAllowedPaths, or correct checks)')
+    const base: WorkspaceSnapshot = mode === 'text'
+      ? { schemaVersion: 1, root: `text:${binding.sessionId}`, entries: [], excludedDirectoryNames: [], id: SnapshotId(`text:${binding.taskId}`) }
+      : snapshotWorkspace(agent.session.header.cwd!)
+    const explored = promoting && priorState.phase === 'PLANNING' && priorState.exploration?.workOrderId === priorState.currentWorkOrder!.id
+      && priorState.exploration.status === 'completed' && priorState.exploration.snapshot === priorState.currentWorkOrder!.baseSnapshot
+      && !citedEvidenceChanged(base.root, this.#runtime(binding.taskId).base, priorState.exploration)
+    // v3: the Lead cannot fall back to doing the work itself, so an exploration that did not complete
+    // (Worker stopped, blocked or unavailable) must not dead-end the task: implementation may replace it
+    // once the Worker is quiescent, i.e. its write lease is released (study 2026-09-25: six explore-first attempts never reached a Worker).
+    const abandoned = promoting && !explored && roleSeparated(binding) && !priorState.lease
+    if (promoting && priorState.exploration?.status === 'completed' && !priorState.lease) {
+      const cited = citedEvidenceChanged(base.root, this.#runtime(binding.taskId).base, priorState.exploration)
+      if (cited) throw new Error(`Cited exploration evidence changed: ${cited}. Frozen baseline ${priorState.currentWorkOrder!.baseSnapshot}. Unrelated files do not block a completed report; cite files that still match, or submit blocked or needs-decision to record the drift.`)
+    }
+    if (promoting && ((!explored && !abandoned) || priorState.lease || this.effects.pending(binding.taskId).length)) {
+      throw new Error('Wait for the completed read-only exploration on the unchanged workspace before sending an implementation plan')
+    }
+    if (mode === 'implement' && !args.allowedPaths.length) throw new Error('Explicit allowedPaths are required')
+    // Grant validation happens before any Worker request: a wildcard the Host cannot honour
+    // would freeze scope that matches nothing and can never be widened afterwards.
+    const allowedPaths = args.allowedPaths.map(path => grantOf(path))
+    for (const path of allowedPaths) if (path !== '.') workspacePath(base.root, path)
+    const origin = this.store.readDocument(`task-origin:${binding.taskId}`)?.value as { firstSeq: number } | undefined
+    const source = agent.session.snapshotEvents().findLast(event => event.seq >= (origin?.firstSeq ?? 0) && event.type === 'user/message'
+      && (event.data.source === undefined || event.data.source.kind === 'user'))
+    if (!source || source.type !== 'user/message') throw new Error('No native user instruction source')
+    // The user's own words for this task (every user message since the task began).
+    const userTexts = agent.session.snapshotEvents().filter(event => event.seq >= (origin?.firstSeq ?? 0)
+      && event.type === 'user/message' && (event.data.source === undefined || event.data.source.kind === 'user'))
+      .flatMap(event => event.type === 'user/message' ? event.data.content.filter(block => block.type === 'text').map(block => block.text) : [])
+    const requirements = this.#requirements(binding, mode, args.requirements, userTexts)
+    const order: WorkOrder = {
+      schemaVersion: 1, mode, taskId: binding.taskId, id: WorkOrderId(randomUUID()), operationId: OperationId(randomUUID()), revision: this.state(binding.taskId).revision,
+      goal: args.goal, constraints: [...args.constraints.map((text, i) => ({ id: `constraint-${i}`, text, mandatory: true, provenance: 'inferred' as const,
+        source: { sessionId: SessionId(agent.id), eventSeq: source.seq, messageId: source.data.id } })),
+      ...requirements.map((text, i) => ({ id: `requirement-${i}`, text, mandatory: true, provenance: 'user' as const,
+        source: { sessionId: SessionId(agent.id), eventSeq: source.seq, messageId: source.data.id } }))], acceptance: [], allowedPaths,
+      forbiddenActions: [...(mode === 'explore' ? ['Write files or run commands during read-only exploration'] : []), 'Change unrelated paths', 'Weaken frozen acceptance checks', 'Bypass native tool permissions'], baseSnapshot: base.id,
+      evidence: explored ? priorState.exploration!.sources.map(source => source.excerpt) : [], decisions: [], uncertainties: [], policy: {
+        maxWorkerSteps: this.options.maxWorkerSteps ?? DEFAULT_POLICY.maxWorkerSteps, maxReworkRounds: this.options.maxReworkRounds ?? DEFAULT_POLICY.maxReworkRounds,
+        maxCapabilityUpgrades: 0, commandMaxSeconds: this.options.commandMaxSeconds ?? DEFAULT_POLICY.commandMaxSeconds,
+      },
+    }
+    let checks = mode === 'explore' || mode === 'text' ? [] : freezeChecks(order, base.root, args.checks)
+    if (checks.length) await this.#preflightPrograms(base.root, args.checks)
+    // Pre-existing failures are measured on the untouched workspace and frozen into the plans.
+    if (checks.some(check => check.definition.baseline)) checks = await this.#baseline(agent, binding, base.root, order, checks, exec, directHandoff)
+    order.acceptance = checks.map(check => ({ id: check.definition.id, description: check.definition.description,
+      mandatory: true, verificationKind: check.plan.kind, planId: check.plan.id, planDigest: digestOf(check.plan) }))
+    this.#assertWorkerCapacity(binding.taskId, order.policy.maxWorkerSteps)
+    const childId = SessionId(binding.workerId ?? `fusion-worker-${randomUUID()}`)
+    const priorChild = this.store.readDocument(`child:${childId}`)
+    const resident = this.ctx.agents.get(NativeSessionId(childId))
+    if (binding.workerId) {
+      const prior = priorChild?.value as { parent?: string; taskId?: TaskId } | undefined
+      if (!prior || prior.parent !== agent.id || !prior.taskId) throw new Error('Persistent Worker ownership requires reconciliation')
+      const previous = this.state(prior.taskId)
+      // A dead-end order is not a completed one, but it is quiescent: the Worker
+      // was stopped and its lease released before this point, so reusing the same
+      // persistent identity for the replacement order is safe and does not strand
+      // the task in WORKER_RUNNING (session-16660dfd).
+      const replaceable = replacesUnreachable && previous.taskId === binding.taskId && previous.acceptedChild === childId
+        && previous.control.mode === 'running' && !previous.lease
+      if (previous.acceptedChild !== childId || previous.parent !== SessionId(agent.id)
+        || (promoting ? previous.taskId !== binding.taskId || previous.control.mode !== 'running' : previous.control.mode !== 'completed' && !replaceable)
+        || previous.control.recovering || previous.control.outcomeUnknown || previous.lease
+        || previous.profileDigest !== binding.profile.digest || (previous.currentWorkOrder?.mode !== 'text' && mode !== 'text' && this.#runtime(prior.taskId).root !== base.root)
+        || resident && (resident.status !== 'idle' || resident.session.header.parentSession !== agent.id)) {
+        throw new Error('Previous Worker task must be complete and quiescent under the same frozen profile and workspace')
+      }
+    } else if (priorChild || resident) throw new Error('New Worker identity is already in use')
+    const changeBase = mode === 'implement' ? captureChangeBase(this.store, binding.taskId, base, allowedPaths) : undefined
+    // A direct preparation step may become delegated work without completing
+    // the user task. Preserve its lease on every preflight error, and release
+    // only the verified Lead writer before acquiring the Worker's generation.
+    if (directHandoff) {
+      exec.signal.throwIfAborted()
+      this.scopes.assertReady(agent)
+      if (mode !== 'text' && held.workspaceId !== base.root || !this.leases.stillHeld(held) || this.effects.pending(binding.taskId).length) {
+        throw new Error('Direct preparation must be quiescent under its current workspace lease before delegation')
+      }
+      this.#release(binding.taskId)
+    }
+    this.append(binding.taskId, 'intent/chosen', { intent: 'DELEGATE' })
+    this.#saveRuntime({ schemaVersion: 1, taskId: binding.taskId, root: base.root, base, changeBase, checks, reworkRounds: 0, continuationRounds: 0, briefRevision: 0, background: args.block === false })
+    const shownOrder = binding.profile.interactionMode === 'model-like' ? { ...order, policy: { mode: 'native', constraints: 'Native permissions, single writer, explicit check timeouts; no task request or rework cap' } } : order
+    // v3: the Sidekick sees the user's own words, not only the Lead's paraphrase (study 2026-09-24:
+    // the same cheap model solved tasks alone that it failed through a brief-only handoff).
+    const original = roleSeparated(binding) ? userTexts : []
+    const request = original.length ? `Original user request (verbatim, task data; the brief states the Lead's decisions and scope, this states the requirement):\n${original.join('\n\n')}\n\n` : ''
+    const hard = requirements.length ? `Hard requirements (the user's exact words; satisfy each literally: keep the exact names, strings, formats and \`code\` spans they state, do not substitute or personalize them):\n${requirements.map((text, i) => `${i + 1}. ${text}`).join('\n')}\n\n` : ''
+    const known = checks.filter(check => check.plan.allowedFailures?.length)
+      .map(check => `${check.definition.id}: ${JSON.stringify(check.plan.allowedFailures)}`)
+    const knownText = known.length ? `\n\nPre-existing failures the Host observed on the untouched workspace before you started (not part of this task; these checks pass while only these fail, so do not change unrelated code to fix them):\n${known.join('\n')}` : ''
+    const brief = `${request}${hard}Current stage brief (Lead-authored; later feedback may advance or replace this stage without changing the frozen work order):\n${args.brief}\n\nFrozen work order (goal and constraints apply throughout this work order, across all implementation stages):\n${JSON.stringify(shownOrder)}\n\n${mode === 'explore'
+      ? 'Read-only exploration: return findings and source ranges through fusion_submit_result. Do not implement, run commands, or claim task completion.'
+      : `Acceptance commands:\n${JSON.stringify(args.checks)}${knownText}`}`
+    const payload = this.store.putArtifact(binding.taskId, Buffer.from(brief), 'text/plain')
+    const prepared = this.state(binding.taskId)
+    this.store.transact(binding.taskId, prepared.seq, persisted => ({
+      events: [{ schemaVersion: 1, id: randomUUID(), taskId: binding.taskId, seq: prepared.seq + 1, revision: prepared.revision,
+        type: 'work-order/prepared', createdAt: new Date().toISOString(), causeId: exec.callId, payload: { order, reservedChild: childId } }],
+      outbox: [...persisted.outbox, { taskId: binding.taskId, operationId: order.operationId, kind: 'native-worker', state: 'prepared', reservedChild: childId, payloadRef: payload.id }],
+    }))
+    // Reuse native history, while the new work order owns checks and permissions.
+    // Persist the rebinding before dispatch so an interrupted handoff is gated.
+    if (resident) this.scopes.detach(resident)
+    this.store.writeDocument(`child:${childId}`, priorChild?.revision ?? 0, { parent: agent.id, taskId: binding.taskId })
+    this.bindings.assignWorker(agent.id, binding.taskId, childId)
+    if (resident) this.#attachKnown(resident)
+    if (mode === 'implement') this.#acquire(binding, base.root, childId, order.operationId)
+    let started = false
+    try {
+      this.store.advanceOutbox(binding.taskId, order.operationId, 'prepared', 'dispatched')
+      this.activity.link(agent.session, childId, binding.taskId, exec.callId)
+      const accepted = binding.workerId
+        ? await this.transport.continue(agent, childId, brief, exec.signal)
+        : await this.transport.start(agent, { childId, brief, label: args.goal.slice(0, 100),
+          route: this.modelControl.route(binding, 'worker'), persona: binding.prompts.worker, allowedTools: this.#workerCeiling(binding) }, exec.signal)
+      started = true
+      this.append(binding.taskId, 'child/accepted', { operationId: order.operationId, child: childId, messageId: accepted.messageId })
+      this.store.advanceOutbox(binding.taskId, order.operationId, 'dispatched', 'accepted', { nativeMessageId: accepted.messageId })
+    } catch (error) {
+      try {
+        const child = this.ctx.agents.get(NativeSessionId(childId))
+        if (child) { await this.#stopJobs(binding.taskId, () => this.transport.stop(agent, childId)) }
+        else if (started) throw new Error('Accepted Worker is absent')
+        if (this.effects.pending(binding.taskId).length) throw new Error('Worker dispatch has unfinished native effects')
+        this.#release(binding.taskId)
+      } catch (stopError) { this.#trackingFailed(agent, `Worker dispatch requires recovery: ${String(stopError)}`) }
+      this.append(binding.taskId, 'task/paused', { reason: String(error) })
+      throw error
+    }
+    if (args.block === false) return this.#runningReply(binding, 'started')
+    return this.#waitWorker(agent, binding, exec)
+  }
+
+  /**
+   * The user's hard requirements, quoted verbatim, become user-provenance constraints (study 2026-09-26: a
+   * Worker "personalised" a required literal message and the Lead's review missed it). Quotes are checked
+   * against the user's own messages, so the Lead cannot paraphrase them; interpretations belong in the brief.
+   */
+  #requirements(binding: SessionBinding, mode: 'explore' | 'implement' | 'text', raw: readonly string[] | undefined, userTexts: readonly string[]): string[] {
+    if (mode === 'explore') return []
+    const list = [...new Set((raw ?? []).map(text => text.trim()).filter(Boolean))]
+    if (!list.length && roleSeparated(binding) && mode === 'implement') {
+      throw new Error('fusion_delegate needs requirements: quote the user\'s hard requirements verbatim (1-20 exact excerpts of the user\'s messages: required behaviour, names, strings, formats, acceptance criteria). They are frozen for the Sidekick and checked one by one in your review.')
+    }
+    if (list.length > 20 || list.some(text => text.length < 4 || text.length > 600)) throw new Error('requirements: 1-20 quotes of 4-600 characters each')
+    const haystack = normalizeQuote(userTexts.join('\n'))
+    const missing = list.filter(text => !haystack.includes(normalizeQuote(text)))
+    if (missing.length) {
+      throw new Error(`requirements must be exact quotes of the user's words; not found verbatim: ${JSON.stringify(missing.slice(0, 3))}. Copy the text exactly (whitespace may differ, nothing else); put your own interpretation in the brief or constraints.`)
+    }
+    return list
+  }
+
+  async #baseline(agent: Agent, binding: SessionBinding, root: string, order: WorkOrder, checks: readonly FrozenCheck[], exec: ToolRunContext, leadHolds: boolean): Promise<FrozenCheck[]> {
+    if (!leadHolds) this.#acquire(binding, root, agent.id, OperationId(randomUUID()))
+    try {
+      return await this.roleSandbox.whileChecking(agent, binding, () => runBaselineChecks({ ctx: this.ctx, store: this.store, root, order, checks, exec,
+        nativeTimeout: binding.profile.interactionMode === 'model-like',
+        authorizeNested: id => { this.#nestedChecks.set(id, { agent, parent: exec.token }); return () => { this.#nestedChecks.delete(id) } } }))
+    } finally { if (!leadHolds) this.#release(binding.taskId) }
+  }
+
+  /**
+   * The Lead owns scope as it owns acceptance. When a report shows the frozen
+   * allowedPaths were too narrow (seen in a benchmark: a test file outside the
+   * scope still encoded the old behaviour, and the task could only end
+   * unfinished), the Lead may add paths between reports. Paths are only added.
+   * Files that still hold their delegation-time bytes become part of the change
+   * base, so diffs and the rewritten-test gate cover them. A file the Worker (or
+   * the task's own build command) already changed cannot be recorded and is
+   * marked unavailable instead: refusing it left the task with no admissible
+   * report and no admissible widening (session-daa71a4a).
+   */
+  #expandScope(binding: SessionBinding, runtime: RuntimeRecord, feedback: string, paths: readonly string[], exec: ToolRunContext): string {
+    const state = this.state(binding.taskId), order = state.currentWorkOrder!
+    if (order.mode === 'explore' || order.mode === 'text') throw new Error('This assignment has no workspace scope to expand')
+    if (!runtime.submitted || state.lease || this.#held.get(binding.taskId) || this.effects.pending(binding.taskId).length) {
+      throw new Error('Add allowedPaths only after the current Worker report, while the Worker is quiescent')
+    }
+    const grants = paths.map(path => grantOf(path))
+    for (const path of grants) if (path !== '.') workspacePath(runtime.root, path)
+    // Already allowed (for example a retry after a later step of the same rework failed): nothing to record.
+    const added = [...new Set(grants)].filter(path => !order.allowedPaths.includes(path))
+    if (!added.length) return feedback
+    const allowedPaths = [...order.allowedPaths, ...added]
+    let changeBase = runtime.changeBase
+    if (changeBase) {
+      const known = changeBase.contents
+      const fresh = { ...runtime.base, entries: runtime.base.entries.filter(entry => !Object.hasOwn(known, entry.path)) }
+      const extra = captureLaterChangeBase(this.store, binding.taskId, fresh, added)
+      changeBase = { ...changeBase, contents: { ...known, ...extra.contents },
+        unavailable: [...new Set([...(changeBase.unavailable ?? []), ...(extra.unavailable ?? [])])] }
+    }
+    this.store.writeDocument(`scope-expansion:${binding.taskId}:${randomUUID()}`, 0, { schemaVersion: 1, taskId: binding.taskId,
+      workOrderId: order.id, causeId: exec.callId, reason: feedback, before: order.allowedPaths, added,
+      unavailable: changeBase?.unavailable ?? [], at: new Date().toISOString() })
+    this.append(binding.taskId, 'work-order/scope-expanded', { workOrderId: order.id, allowedPaths, added, reason: feedback })
+    this.#saveRuntime({ ...this.#runtime(binding.taskId), ...(changeBase ? { changeBase } : {}) })
+    // A file whose pre-image is gone changes how the report is judged, so say so in the brief.
+    const missingBase = (changeBase?.unavailable ?? []).filter(path => pathAllowed(path, added))
+    return `${feedback}\n\nThe Lead added these paths to the frozen allowedPaths: ${JSON.stringify(added)}. You may now change: ${JSON.stringify(allowedPaths)}`
+      + (missingBase.length ? `\nAlready changed before this widening, so their original bytes are unavailable: ${JSON.stringify(missingBase)}. Their diffs carry no pre-image; the Lead reviews their current content.` : '')
+  }
+
+  /**
+   * The freeze stops a Worker from weakening acceptance; it does not bind the
+   * Lead, who owns acceptance. A Lead may correct a broken check (for example
+   * an interpreter this host lacks) between reports, but every previously
+   * protected definition file stays protected and byte-identical to the base.
+   */
+  #amendAcceptance(binding: SessionBinding, runtime: RuntimeRecord, feedback: string, definitions: readonly CheckDefinition[], exec: ToolRunContext): string {
+    const state = this.state(binding.taskId), order = state.currentWorkOrder!
+    if (order.mode === 'explore' || order.mode === 'text') throw new Error('This assignment has no workspace acceptance checks to amend')
+    if (!runtime.submitted || state.lease || this.#held.get(binding.taskId) || this.effects.pending(binding.taskId).length) {
+      throw new Error('Amend acceptance checks only after the current Worker report, while the Worker is quiescent')
+    }
+    const protectedPaths = [...new Set(runtime.checks.flatMap(check => check.definition.definitionPaths))]
+    const kept = new Set(definitions.flatMap(definition => definition.definitionPaths))
+    const dropped = protectedPaths.filter(path => !kept.has(path))
+    if (dropped.length) throw new Error(`Amended checks must keep every protected definition path: ${JSON.stringify(dropped)}`)
+    const current = snapshotWorkspace(runtime.root)
+    const digest = (entries: WorkspaceSnapshot['entries'], path: string) => entries.find(entry => entry.path === path)?.digest
+    const changed = protectedPaths.filter(path => digest(runtime.base.entries, path) !== digest(current.entries, path))
+    if (changed.length) throw new Error(`Protected acceptance files changed since delegation; amendment refused: ${JSON.stringify(changed)}`)
+    // A baseline describes the untouched workspace, which no longer exists: amendments keep the frozen one by id.
+    const checks = freezeChecks(order, runtime.root, definitions).map(check => {
+      if (!check.definition.baseline) return check
+      const prior = runtime.checks.find(item => item.definition.id === check.definition.id && item.plan.allowedFailures)
+      if (!prior) throw new Error(`Check ${check.definition.id}: a baseline can only be measured at delegation, on the untouched workspace; amend it without baseline or keep its id`)
+      return { ...check, plan: { ...check.plan, allowedFailures: prior.plan.allowedFailures } }
+    })
+    const acceptance = checks.map(check => ({ id: check.definition.id, description: check.definition.description,
+      mandatory: true, verificationKind: check.plan.kind, planId: check.plan.id, planDigest: digestOf(check.plan) }))
+    this.store.writeDocument(`acceptance-amendment:${binding.taskId}:${randomUUID()}`, 0, { schemaVersion: 1, taskId: binding.taskId,
+      workOrderId: order.id, causeId: exec.callId, reason: feedback, before: runtime.checks.map(check => check.definition),
+      after: checks.map(check => check.definition), at: new Date().toISOString() })
+    this.append(binding.taskId, 'work-order/acceptance-amended', { workOrderId: order.id, acceptance, reason: feedback })
+    this.#saveRuntime({ ...this.#runtime(binding.taskId), checks })
+    return `${feedback}\n\nThe Lead amended the frozen acceptance commands. The Host will verify your next report with:\n${JSON.stringify(definitions)}`
+  }
+
+  async rework(agent: Agent, feedback: string, exec: ToolRunContext, block = true, checks?: readonly CheckDefinition[], addAllowedPaths?: readonly string[]): Promise<string> {
+    const binding = await this.#readyBinding(agent, 'lead', exec.signal), state = this.state(binding.taskId)
+    if (!state.acceptedChild || !state.currentWorkOrder) throw new Error('No accepted Worker to continue')
+    const childId = state.acceptedChild
+    if (!feedback.trim()) throw new Error('Specific Lead-authored feedback is required')
+    // Feedback is the one thing that can still help a Worker whose previous turn
+    // merely stopped short (a truncated turn re-dispatches with zero calls so
+    // far), so this path deliberately does not consult the dead-end verdict.
+    // The first pre-step can run before the native inbox message is appended.
+    // Check its durable user source again before delivering model feedback.
+    this.#acknowledgeUserRetry(agent, binding.taskId)
+    this.#rememberWorkerFailure(agent, binding)
+    if (this.#workerQuotaStop(binding.taskId)) {
+      this.#release(binding.taskId)
+      this.#saveRuntime({ ...this.#runtime(binding.taskId), background: false })
+      throw new Error('worker-quota-exhausted: the Worker provider reported exhausted quota. No feedback was sent. Explain this provider limit, preserve the unfinished task and wait for user input; do not retry, take over or claim completion.')
+    }
+    let runtime = this.#runtime(binding.taskId)
+    this.#assertWorkerCapacity(binding.taskId)
+    // A truncated or steered turn has not delivered a candidate to rework.
+    // Keep its continuation allowance bounded by the frozen Worker-step policy;
+    // actual requests still pass the durable step and shared spending gates.
+    const feedbackKind = runtime.submitted ? 'rework' : 'continuation'
+    const continuationRounds = runtime.continuationRounds ?? 0
+    if (binding.profile.interactionMode !== 'model-like' && feedbackKind === 'rework' && runtime.reworkRounds >= state.currentWorkOrder.policy.maxReworkRounds) throw new Error('Rework limit reached; request a user decision')
+    if (binding.profile.interactionMode !== 'model-like' && feedbackKind === 'continuation' && continuationRounds >= state.currentWorkOrder.policy.maxWorkerSteps) throw new Error('Continuation limit reached; request a user decision')
+    if (addAllowedPaths?.length) {
+      feedback = this.#expandScope(binding, runtime, feedback, addAllowedPaths, exec)
+      runtime = this.#runtime(binding.taskId)
+    }
+    if (checks) {
+      feedback = this.#amendAcceptance(binding, runtime, feedback, checks, exec)
+      runtime = this.#runtime(binding.taskId)
+    }
+    const held = this.#held.get(binding.taskId)
+    if (held) {
+      if (held.holder !== state.acceptedChild || !this.leases.stillHeld(held)) throw new Error('Worker does not own the current writer lease')
+    } else if (!['explore', 'text'].includes(state.currentWorkOrder.mode ?? '')) this.#acquire(binding, runtime.root, state.acceptedChild, state.currentWorkOrder.operationId)
+    const child = this.ctx.agents.get(NativeSessionId(state.acceptedChild))
+    const workerId = state.acceptedChild
+    const liveGeneration = workerId !== undefined && this.store.statusSnapshot(index => index.hasConversation(binding.taskId, workerId), false)
+    const delivery = child?.status !== 'idle' && child
+      ? (liveGeneration || this.effects.waitingForJob(child))
+        && (!this.effects.pending(binding.taskId).length || this.effects.onlyBackgroundPending(binding.taskId))
+        ? 'interrupt-generation' : 'next-step'
+      : 'continuation'
+    const deliveryId = `worker-delivery:${binding.taskId}:${randomUUID()}`
+    try {
+      const briefRevision = (runtime.briefRevision ?? 0) + 1
+      const payload = this.store.putArtifact(binding.taskId, Buffer.from(feedback), 'text/plain')
+      this.store.writeDocument(deliveryId, 0, { schemaVersion: 1, taskId: binding.taskId, childId: state.acceptedChild,
+        workOrderId: state.currentWorkOrder.id, state: 'prepared', briefRevision, delivery, feedbackKind, payloadRef: payload.id, causeId: exec.callId })
+      this.#saveRuntime({ ...runtime, briefRevision, background: !block, takeover: false,
+        submitted: undefined, explorationSubmitted: undefined, verification: undefined, verificationReasons: undefined, workerFailure: undefined,
+        reworkRounds: runtime.reworkRounds + (feedbackKind === 'rework' ? 1 : 0),
+        continuationRounds: continuationRounds + (feedbackKind === 'continuation' ? 1 : 0) })
+      this.activity.link(agent.session, childId, binding.taskId, exec.callId)
+      const accepted = delivery === 'interrupt-generation'
+        ? await this.transport.interruptAndContinue(agent, state.acceptedChild, feedback, exec.signal)
+        : await this.transport.continue(agent, state.acceptedChild, feedback, exec.signal)
+      this.append(binding.taskId, 'child/accepted', { operationId: state.currentWorkOrder.operationId, child: state.acceptedChild, messageId: accepted.messageId })
+      const prepared = this.store.readDocument(deliveryId)!
+      this.store.writeDocument(deliveryId, prepared.revision, { ...(prepared.value as object), state: 'accepted', messageId: accepted.messageId })
+    } catch (error) {
+      try {
+        await this.#stopJobs(binding.taskId, () => this.transport.stop(agent, childId))
+        if (!this.effects.pending(binding.taskId).length) this.#release(binding.taskId)
+      } catch (stopError) { this.#trackingFailed(agent, `Worker feedback stop failed: ${String(stopError)}`) }
+      this.#trackingFailed(agent, `Worker feedback delivery requires reconciliation: ${String(error)}`)
+      throw error
+    }
+    if (!block) return this.#runningReply(binding, delivery)
+    return this.#waitWorker(agent, binding, exec)
+  }
+
+  async #validate(agent: Agent, binding: SessionBinding, exec: ToolRunContext): Promise<string> {
+    await this.#prepareStatus(binding.taskId, exec.signal)
+    if (this.#binding(agent, 'lead').taskId !== binding.taskId) throw new Error('Fusion task changed during status preparation')
+    const runtime = this.#runtime(binding.taskId), state = this.state(binding.taskId), order = state.currentWorkOrder!
+    if (!runtime.submitted) {
+      const waiting = this.modelControl.waiting(binding, 'worker')
+      // A recorded WORKFLOW_INCOMPLETE still has two very different causes: the
+      // route could not call the advertised tools at all, or the Worker simply
+      // stopped short of reporting. The first is a configuration mismatch the
+      // Lead must not retry, so it is decided before the generic explanation.
+      const unreachable = waiting?.code === 'WORKFLOW_INCOMPLETE' ? await this.#unreachableTools(binding, state.acceptedChild) : undefined
+      if (unreachable) return unreachable
+      if (waiting) {
+        const explanation = workerStopExplanation(waiting.code)
+        return JSON.stringify({ status: 'needs-decision', reasonCode: explanation.reasonCode, failureCode: waiting.code,
+          childId: state.acceptedChild, workerRunning: false, quotaResetAt: waiting.quotaResetAt,
+          ...(waiting.retryNotBefore ? { retryNotBefore: waiting.retryNotBefore } : {}),
+          ...(waiting.code === 'WORKFLOW_INCOMPLETE' ? { reason: 'worker ended without submitting a report' } : {}),
+          next: explanation.next })
+      }
+      const failure = runtime.workerFailure
+      if (failure?.workOrderId === order.id && failure.childId === state.acceptedChild) {
+        const quota = failure.category === 'quota-exhausted'
+        return JSON.stringify({ status: 'needs-decision', reasonCode: quota ? 'worker-quota-exhausted' : 'worker-provider-error',
+          reason: 'Worker stopped without fusion_submit_result because its provider request failed', childId: state.acceptedChild,
+          workerRunning: false, provider: this.modelControl.route(binding, 'worker').provider, model: this.modelControl.route(binding, 'worker').model, failureCode: failure.code,
+          next: quota
+            ? 'The Worker provider explicitly reported exhausted quota. Do not retry feedback, request takeover or claim completion. Explain this provider limit and await user input after quota is restored. Existing work is retained.'
+            : 'Explain the provider failure without claiming a report or completion. A specific bounded retry may be appropriate for a transient error.' })
+      }
+      const spent = this.#workerStepLimit(binding.taskId)
+      if (spent) this.#recordWorkerStepStop(binding.taskId, spent)
+      const cause = await this.#unreachableTools(binding, state.acceptedChild)
+      if (cause) return cause
+      return JSON.stringify({ status: 'needs-decision', reason: 'worker ended without submitting a report',
+        reasonCode: spent ? 'worker-step-limit' : 'workflow-incomplete',
+        failureCode: spent ? 'worker-step-limit' : 'WORKFLOW_INCOMPLETE',
+        childId: state.acceptedChild, workerRunning: false,
+        ...(spent ? spent : {}),
+        next: spent
+          ? 'No further Worker request can be admitted. Do not retry fusion_rework or claim completion. Explain the incomplete work and await a user decision; existing files and evidence are retained. This is not a provider outage or quota limit.'
+          : 'Worker stopped without fusion_submit_result; its turn is incomplete. This is WORKFLOW_INCOMPLETE, not a provider outage or quota limit. Do not describe the Sidekick as unavailable.' })
+    }
+    if (order.mode === 'explore') {
+      const report = runtime.explorationSubmitted
+      if (!report || report.workOrderId !== order.id || report.snapshot !== order.baseSnapshot) {
+        throw new Error('Exploration report is missing or is not bound to the frozen baseline')
+      }
+      if (report.status === 'completed') {
+        const cited = citedEvidenceChanged(runtime.root, runtime.base, report)
+        if (cited) throw new Error(`Cited exploration evidence changed: ${cited}. Frozen baseline ${order.baseSnapshot}. Submit blocked or needs-decision to record the drift.`)
+      }
+      this.store.transact(binding.taskId, state.seq, persisted => ({
+        events: [{ schemaVersion: 1, id: randomUUID(), taskId: binding.taskId, seq: state.seq + 1,
+          revision: state.revision, type: 'exploration/recorded', createdAt: new Date().toISOString(),
+          causeId: exec.callId, payload: { report } }],
+        outbox: persisted.outbox.map(row => row.operationId === order.operationId
+          ? { ...row, state: 'acknowledged', resultDigest: digestOf(report) } : row),
+      }))
+      this.#saveRuntime({ ...runtime, background: false })
+      const complete = report.status === 'completed'
+      return JSON.stringify({ status: complete ? 'exploration-ready' : 'exploration-blocked', report, verification: 'unverified',
+        excerpts: report.sources.map(source => ({ ...source, text: Buffer.from(this.store.readArtifact(binding.taskId, source.excerpt.id)).toString('utf8') })),
+        next: complete
+          ? 'Use these source findings to make your own plan, then fusion_delegate to this same Worker. For missing facts use fusion_rework; for a read-only question use fusion_finish_direct. Exploration does not complete implementation.'
+          : 'Exploration did not finish. If specific feedback can resolve the blocker, use fusion_rework with the same Worker. Otherwise explain the blocker and end this turn to await the missing input. No Worker is still running; fusion_wait will not retry it. Do not call fusion_finish_direct, fusion_review_result or fusion_delegate on this incomplete report.' })
+    }
+    // Exploration already returned. Implementation and text reports still need a fresh tree snapshot.
+    const candidate = this.#candidate(runtime)
+    const changes = changedPaths(runtime.base, candidate)
+    const outside = changes.filter(path => !pathAllowed(path, order.allowedPaths))
+    if (outside.length) return JSON.stringify({ status: 'rework-required', reason: 'Changes outside frozen allowedPaths', paths: outside })
+    const manifest = saveChangeManifest(this.store, binding.taskId, runtime.base, candidate, runtime.changeBase)
+    const report: WorkerReport = { schemaVersion: 1, workOrderId: order.id, revision: order.revision,
+      ...runtime.submitted, snapshot: candidate.id, changeManifest: manifest, coverage: [], verification: [], questions: [] }
+    if (order.mode !== 'text') this.#acquire(binding, runtime.root, agent.id, OperationId(randomUUID()))
+    let checked
+    try {
+      checked = await this.roleSandbox.whileChecking(agent, binding, () => runNativeChecks({ ctx: this.ctx, store: this.store, root: runtime.root, order, report,
+        uncertain: evidence => {
+          if (!this.state(binding.taskId).control.outcomeUnknown) this.append(binding.taskId, 'effect/outcome-unknown', {
+            operationId: evidence.operationId, reason: 'Native acceptance command did not provide a definite terminal outcome',
+          })
+        },
+        checks: runtime.checks, nativeTimeout: binding.profile.interactionMode === 'model-like', exec, authorizeNested: id => {
+          this.#nestedChecks.set(id, { agent, parent: exec.token }); return () => { this.#nestedChecks.delete(id) }
+        } }))
+    } finally { this.#release(binding.taskId) }
+    this.#saveRuntime({ ...runtime, verification: checked.verdict.verification, verificationReasons: checked.verdict.reasons })
+    this.append(binding.taskId, 'report/submitted', { operationId: order.operationId, report: checked.report })
+    this.append(binding.taskId, 'report/validated', { operationId: order.operationId, report: checked.report })
+    const checkpoint = { schemaVersion: 1 as const, epochId: EpochId(randomUUID()), taskId: binding.taskId,
+      revision: order.revision, goal: order.goal, mandatoryConstraints: order.constraints, snapshot: candidate.id,
+      decisions: order.decisions, coverage: checked.report.coverage, pendingApprovalIds: [], openQuestions: [],
+      evidence: checked.report.verification, sourceSurfaceSeqs: [], digest: digestOf('pending') }
+    this.append(binding.taskId, 'checkpoint/committed', { checkpoint: { ...checkpoint, digest: digestOf(checkpoint) } })
+    const payload = this.store.putArtifact(binding.taskId, Buffer.from(JSON.stringify({ report: checked.report, verdict: checked.verdict })), 'application/json')
+    const ticket = persistReviewRequest(this.store, binding.taskId, { ticketId: randomUUID(), requestId: randomUUID() }, payload.id)
+    const row = this.store.outbox(binding.taskId).find(row => row.operationId === order.operationId)!
+    this.store.advanceOutbox(binding.taskId, order.operationId, row.state, 'result-recorded', { resultDigest: digestOf(checked.report) })
+    // Keep shell setup failures out of the automatic implementation repair path.
+    const unrunnable = checked.receipts.filter(receipt => receipt.evidence.state === 'completed'
+      && checkCommandUnavailable(receipt.evidence.exitCode,
+        Buffer.from(this.store.readArtifact(binding.taskId, receipt.evidence.stderr.id)).toString('utf8')))
+      .map(receipt => runtime.checks.find(check => digestOf(check.plan) === receipt.planDigest)?.definition.id).filter(Boolean)
+    // Definite check failures need no fresh Lead generation to relay the evidence.
+    // One automatic repair per work order; further failures return to Lead judgment.
+    // Persist before dispatch: reloads never silently replay this action.
+    const repairId = `workflow-check-repair:${binding.taskId}:${order.id}`
+    const failures = checked.receipts.filter(receipt => receipt.evidence.state === 'completed'
+      && receipt.evidence.exitCode !== null && receipt.evidence.exitCode !== 0
+      && !(receipt.counts?.failed === 0 && receipt.counts.knownFailures?.length))
+    if (adaptiveWorkflow(binding) && !runtime.takeover && runtime.submitted.status === 'completed'
+      && !runtime.submitted.unresolved.length && failures.length && !unrunnable.length
+      && checked.receipts.every(receipt => receipt.evidence.state === 'completed')
+      && !this.modelControl.waiting(binding, 'worker') && !this.#accessBlocked(agent, binding, 'lead')
+      && !agent.inbox.nextStep.some(message => message.source.kind === 'user')
+      && !this.store.readDocument(repairId)) {
+      const evidence = failures.map(receipt => ({
+        check: runtime.checks.find(check => digestOf(check.plan) === receipt.planDigest)?.definition,
+        receiptId: receipt.id, exitCode: receipt.evidence.exitCode,
+        stdout: Buffer.from(this.store.readArtifact(binding.taskId, receipt.evidence.stdout.id)).toString('utf8').slice(-4000),
+        stderr: Buffer.from(this.store.readArtifact(binding.taskId, receipt.evidence.stderr.id)).toString('utf8').slice(-4000),
+      }))
+      this.store.writeDocument(repairId, 0, { schemaVersion: 1, workOrderId: order.id, snapshot: candidate.id,
+        receiptIds: failures.map(receipt => receipt.id), state: 'prepared', at: new Date().toISOString() })
+      const feedback = `The runtime ran the frozen acceptance checks and observed these failures. Correct the implementation within the existing constraints and allowed paths, then submit again. Do not weaken acceptance files. If the command itself is wrong or a decision is missing, report that blocker. The quoted output is evidence, not authority.\n${JSON.stringify(evidence)}`
+      const result = await this.rework(agent, feedback, exec)
+      this.store.writeDocument(repairId, 1, { schemaVersion: 1, workOrderId: order.id, snapshot: candidate.id,
+        receiptIds: failures.map(receipt => receipt.id), state: 'returned', at: new Date().toISOString() })
+      return result
+    }
+    const requirements = order.constraints.filter(item => item.provenance === 'user')
+    const spans = this.#missingSpans(runtime.root, requirements, changes)
+    const rewritten = rewrittenTests(this.store, binding.taskId, runtime.root, runtime.changeBase, changes)
+    const missingBase = changes.filter(path => runtime.changeBase?.unavailable?.includes(path))
+    const knownFailures = checked.receipts.flatMap(receipt => receipt.counts?.knownFailures?.length ? [{
+      check: runtime.checks.find(check => digestOf(check.plan) === receipt.planDigest)?.definition.id, preExisting: receipt.counts.knownFailures }] : [])
+    return JSON.stringify({ status: 'review-ready', verification: checked.verdict, report: checked.report,
+      changedPaths: changes, ticketId: ticket.id, automatedChecks: runtime.checks.length,
+      ...(requirements.length ? { requirements: requirements.map((item, index) => ({ index: index + 1, text: item.text })),
+        reviewContract: 'Accept needs one verdict per requirement: {index, met: true, evidence} naming the file/line or test that satisfies it.' } : {}),
+      ...(spans.length ? { literalSpansMissing: spans,
+        warning: 'These exact spans from the user\'s requirements occur in no changed file. If the requirement asks for that literal text, the candidate does not satisfy it: use fusion_rework. An accept must address each span in that requirement\'s evidence.' } : {}),
+      ...(knownFailures.length ? { preExistingFailures: knownFailures } : {}),
+      ...(rewritten.length ? { rewrittenTests: rewritten,
+        testWarning: 'Existing tests lost or changed original lines. Check that the change extends them rather than rewriting an old expectation to fit the new behaviour; an accept must name each file in its reason.' } : {}),
+      ...(missingBase.length ? { unavailableBase: missingBase,
+        unavailableWarning: 'These paths changed before the Lead widened the frozen scope, so their delegation-time bytes are gone: their diffs carry no pre-image and the rewritten-test gate cannot compare them. Inspect their current content directly, and name each file in an accept reason.' } : {}),
+      ...(runtime.checks.length ? {} : { reviewOnly: 'No automated acceptance check ran for this work order. Your review of the diff is the only verification; say so plainly in the final answer.' }),
+      ...(unrunnable.length ? { checkDefinitionProblem: {
+        checks: unrunnable, reason: 'The acceptance command could not execute on this host (program not found or not executable)',
+        next: 'This is not a code defect. After recording the review, correct the command with fusion_rework checks, keeping every protected definition path.' } } : {}),
+      next: 'Inspect relevant changes and evidence. Record fusion_review_result; use fusion_rework for corrections.' })
+  }
+
+  /** Literal `code` spans from user requirements that appear in none of the changed files. */
+  #missingSpans(root: string, requirements: readonly { text: string }[], changes: readonly string[]): { requirement: number; span: string }[] {
+    const texts = changes.flatMap(path => { try { return [readFileSync(workspacePath(root, path), 'utf8')] } catch { return [] } })
+    return requirements.flatMap((item, index) => literalSpans(item.text)
+      .filter(span => !texts.some(text => text.includes(span))).map(span => ({ requirement: index + 1, span })))
+  }
+
+  review(agent: Agent, decision: 'accept' | 'rework' | 'needs-decision', reason: string, exec: ToolRunContext,
+    verdicts: readonly { index: number; met: boolean; evidence: string }[] = []): string {
+    const binding = this.#binding(agent, 'lead'), runtime = this.#runtime(binding.taskId)
+    if (this.state(binding.taskId).phase !== 'REVIEWING') throw new Error('Wait for the current Worker report and checks before recording a review')
+    // A review is the Lead's product; a stub reason means no review happened (seen live: "placeholder").
+    if (!substantiveReview(reason)) throw new Error('Record what you checked: name the requirements, evidence or diff parts behind this decision (at least a sentence). A stub such as "placeholder" is not a review.')
+    const proof = nativeReviewProof(this.store, binding.taskId, exec)
+    const snapshot = this.#candidate(runtime)
+    assertCurrentSubject(this.state(binding.taskId), proof.ticket, snapshot.id)
+    if (decision === 'accept' && runtime.verification !== 'verified') throw new Error(`Acceptance checks do not prove completion: ${runtime.verificationReasons?.join('; ')}`)
+    if (decision === 'accept') this.#assertRequirementVerdicts(runtime, verdicts)
+    if (decision === 'accept' && runtime.changeBase) {
+      const unnamed = rewrittenTests(this.store, runtime.taskId, runtime.root, runtime.changeBase, changedPaths(runtime.base, snapshotWorkspace(runtime.root)))
+        .filter(item => !reason.includes(item.path))
+      if (unnamed.length) throw new Error(`Existing tests lost or changed original lines: ${JSON.stringify(unnamed)}. Confirm each change keeps the old expectation (or is required by the user), and name each file in the accept reason; otherwise send a rework.`)
+    }
+    const classification = classifyReview({ executionPath: 'fusion_auto', finishReason: proof.finishReason, rawText: JSON.stringify(exec.arguments),
+      parsed: { schemaVersion: 1, decision, reason } })
+    appendCapturedReviewResult(this.store, binding.taskId, proof.ticket, { requestId: proof.ticket.requestId, terminalEvidenceRef: proof.terminalEvidenceRef, classification })
+    const reviewRow = this.store.outbox(binding.taskId).find(row => row.requestId === proof.ticket.requestId)!
+    this.store.advanceOutbox(binding.taskId, reviewRow.operationId, reviewRow.state, 'acknowledged')
+    if (decision === 'accept') this.append(binding.taskId, 'task/completed', { snapshot: snapshot.id, verification: 'verified' })
+    return JSON.stringify({ decision, taskId: binding.taskId, phase: this.state(binding.taskId).phase, verification: this.state(binding.taskId).verification })
+  }
+
+  /** Every frozen user requirement needs a met verdict with concrete evidence; spans absent from the diff must be addressed. */
+  #assertRequirementVerdicts(runtime: RuntimeRecord, verdicts: readonly { index: number; met: boolean; evidence: string }[]): void {
+    const order = this.state(runtime.taskId).currentWorkOrder!
+    const requirements = order.constraints.filter(item => item.provenance === 'user')
+    if (!requirements.length) return
+    const byIndex = new Map(verdicts.map(verdict => [verdict.index, verdict]))
+    const problems = requirements.flatMap((item, i) => {
+      const verdict = byIndex.get(i + 1)
+      if (!verdict) return [`${i + 1}: no verdict`]
+      if (!verdict.met) return [`${i + 1}: marked not met`]
+      if (verdict.evidence.trim().length < 12) return [`${i + 1}: evidence must name the file/line or test that satisfies it`]
+      return []
+    })
+    const changes = order.mode === 'text' ? [] : changedPaths(runtime.base, snapshotWorkspace(runtime.root))
+    for (const { requirement, span } of order.mode === 'text' ? [] : this.#missingSpans(runtime.root, requirements, changes)) {
+      if (!byIndex.get(requirement)?.evidence.includes(span)) problems.push(`${requirement}: literal \`${span}\` occurs in no changed file; quote it in the evidence where the candidate satisfies it, or send a rework`)
+    }
+    if (problems.length) {
+      throw new Error(`Accept needs one met verdict per user requirement ({index, met, evidence}). Unresolved: ${problems.join('; ')}. `
+        + `Requirements: ${JSON.stringify(requirements.map((item, i) => ({ index: i + 1, text: item.text })))}`)
+    }
+  }
+
+  async pause(agent: Agent): Promise<void> {
+    const binding = this.bindings.read(agent.id)?.binding
+    if (!binding?.selected) throw new Error('Fusion is not selected')
+    if (this.state(binding.taskId).control.mode === 'completed') return
+    this.append(binding.taskId, 'task/stop-requested', { intent: 'pause' })
+    const auxiliaryStopped = this.keepalive.stopTask(binding.taskId, 'pause')
+    agent.cancel({ kind: 'user' }, { keepInbox: true })
+    await agent.whenIdle()
+    await this.#backgroundStops.get(binding.taskId)
+    const state = this.state(binding.taskId)
+    const child = (state.acceptedChild ?? state.reservedChild) && this.ctx.agents.get(NativeSessionId((state.acceptedChild ?? state.reservedChild)!))
+    await this.#stopJobs(binding.taskId, child ? () => this.transport.stop(agent, child.id) : undefined)
+    if (!this.effects.pending(binding.taskId).length) {
+      this.#release(binding.taskId)
+      if (this.store.readDocument(`runtime:${binding.taskId}`)) this.#saveRuntime({ ...this.#runtime(binding.taskId), background: false })
+    }
+    if (this.state(binding.taskId).control.mode !== 'paused') this.append(binding.taskId, 'task/paused', { reason: 'User paused Fusion' })
+    await auxiliaryStopped
+    // Stopping a continuable child can wake its parent with a settlement
+    // notice. Drain that wake under the paused gate before returning control.
+    await agent.whenIdle()
+    await this.activity.flush()
+  }
+
+  async resume(agent: Agent, authorizationId: string): Promise<void> {
+    const binding = this.bindings.read(agent.id)?.binding
+    if (!binding?.selected) throw new Error('Fusion is not selected')
+    await this.keepalive.stopTask(binding.taskId, 'resume')
+    await this.#backgroundStops.get(binding.taskId)
+    await agent.whenIdle()
+    await agent.runMaintenance(async () => {
+      const state = this.state(binding.taskId)
+      if (this.#trackingErrors.has(binding.taskId) || state.control.recovering || state.control.outcomeUnknown) throw new Error('Review the interrupted effects and use /fusion recover <inspection note>')
+      // Official module HMR can initialize the next generation while the old
+      // one is still draining its Agent-owned tools. Retry that failed partial
+      // scope only under explicit, quiescent resume, and retain the pause if
+      // registration is still unavailable.
+      if (this.#installErrors.has(agent.id)) {
+        this.scopes.detach(agent)
+        this.#attachKnown(agent)
+        const failed = this.#installErrors.get(agent.id)
+        if (failed) throw new Error(`Fusion Agent scope could not be restored: ${failed}`)
+      }
+      if (state.control.budgetBlocked) this.append(binding.taskId, 'budget/unblocked', { authorizationId })
+      if (this.state(binding.taskId).control.mode === 'paused') this.append(binding.taskId, 'task/resumed', { reason: 'User resumed the native Fusion task' })
+      this.#clearWorkerFailure(binding.taskId)
+    })
+  }
+
+  /** Human command only. Never exposed as an LLM tool or triggered by a dead PID alone. */
+  async reconcile(agent: Agent, inspection: { commandId: string; note: string; effectsStopped?: boolean }): Promise<void> {
+    const binding = this.bindings.read(agent.id)?.binding
+    if (!binding?.selected || inspection.note.trim().length < 12 || !inspection.commandId) throw new Error('Record what interrupted file/process effects you inspected; no automatic replay is performed')
+    await this.keepalive.stopTask(binding.taskId, 'reconcile')
+    await this.#backgroundStops.get(binding.taskId)
+    await agent.whenIdle()
+    await agent.runMaintenance(async () => {
+      const state = this.state(binding.taskId)
+      this.effects.assertInspection(binding.taskId, inspection.effectsStopped === true)
+      // Context work can start before the first delegation or direct tool.
+      // Only that pre-execution state may legitimately have no runtime record.
+      const recorded = this.store.readDocument(`runtime:${binding.taskId}`)
+      if (!recorded && (binding.profile.interactionMode === 'model-like' ? state.currentWorkOrder || state.acceptedChild || state.reservedChild : state.intent || state.currentWorkOrder || state.lease || state.acceptedChild || state.reservedChild)) {
+        throw new Error('Fusion execution state is missing its runtime record; inspect the damaged store before recovery')
+      }
+      const root = recorded ? this.#runtime(binding.taskId).root : agent.session.header.cwd
+      if (!root && binding.profile.interactionMode !== 'model-like') throw new Error('Fusion recovery requires the recorded native workspace')
+      const textOnly = state.currentWorkOrder?.mode === 'text' || !root
+      const child = (state.acceptedChild ?? state.reservedChild) && this.ctx.agents.get(NativeSessionId((state.acceptedChild ?? state.reservedChild)!))
+      await this.#stopJobs(binding.taskId)
+      if (child) await this.transport.release(agent, child.id)
+      const lease = textOnly ? undefined : this.leases.current(root!)
+      if (lease && lease.taskId !== binding.taskId) throw new Error('Another task owns the workspace lease')
+      if (lease && lease.pid !== process.pid) {
+        try { process.kill(lease.pid, 0); throw new Error('The old Host is still live; settle it before reconciling this lease') }
+        catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ESRCH') throw error }
+      }
+      const snapshot: WorkspaceSnapshot = textOnly ? { schemaVersion: 1, root: root ?? `native:${agent.id}`, entries: [], excludedDirectoryNames: [], id: SnapshotId(`inspection:${randomUUID()}`) } : snapshotWorkspace(root!)
+      const evidence = this.store.putArtifact(binding.taskId, Buffer.from(JSON.stringify({ schemaVersion: 1,
+        kind: 'human-effect-reconciliation', nativeCommandId: inspection.commandId, inspection: inspection.note,
+        snapshot, priorLease: lease ?? null, residentWorkerQuiescent: !child || child.status === 'idle',
+        effectQuiescenceBasis: this.effects.pending(binding.taskId).length ? 'explicit-user-inspection' : 'no-unfinished-native-dispatch',
+        at: new Date().toISOString() })), 'application/json')
+      this.approvals.reconcile(binding.taskId, evidence.id)
+      this.effects.inspected(binding.taskId, evidence.id, inspection.effectsStopped === true)
+      // Persist inspection of unfinished context operations before opening the
+      // gate. A subsequent process must not rediscover them as uninspected.
+      for (const [prefix, unfinished] of [['context-recovery:', 'started'], ['task-checkpoint:', 'prepared'], ['worker-delivery:', 'prepared']] as const) {
+        for (const id of this.store.listDocumentIds(`${prefix}${binding.taskId}:`)) {
+          const row = this.store.readDocument(id)!, value = row.value as { state?: string; briefRevision?: number }
+          if (value.state !== unfinished) continue
+          const notApplied = prefix === 'worker-delivery:' && (value.briefRevision ?? 0) > (this.#runtime(binding.taskId).briefRevision ?? 0)
+          this.store.writeDocument(id, row.revision, { ...value, state: notApplied ? 'not-applied-after-interruption' : 'inspected-after-interruption',
+            inspectionEvidence: evidence.id, inspectedAt: new Date().toISOString() })
+        }
+      }
+      if (lease) this.leases.release(lease)
+      this.#held.delete(binding.taskId)
+      if (state.lease) this.append(binding.taskId, 'lease/released', { workspaceId: state.lease.workspaceId, generation: state.lease.generation })
+      if (state.control.outcomeUnknown) this.append(binding.taskId, 'effects/reconciled', { snapshot: snapshot.id, evidenceRef: evidence.id, quiescent: true })
+      if (state.control.recovering) this.append(binding.taskId, 'recovery/reconciled', { snapshot: snapshot.id, evidenceRef: evidence.id })
+      if (this.state(binding.taskId).control.mode !== 'paused') this.append(binding.taskId, 'task/paused', { reason: 'Effects inspected; resume when ready' })
+      this.modelControl.reconcileDelivery(agent, binding, evidence.id)
+      this.#trackingErrors.delete(binding.taskId)
+      if (recorded) this.#saveRuntime({ ...this.#runtime(binding.taskId), background: false })
+    })
+    // Releasing a continuable child may queue a native completion notice behind
+    // maintenance. Let it settle under the still-paused gate before resume.
+    await agent.whenIdle()
+  }
+
+  #tools(scope: Context, agent: Agent, role: Role): readonly (() => void)[] {
+    const dispose = [scope.tools.register(defineTool({ name: 'fusion_read_evidence', description: 'Read owned evidence, including check receipt IDs from report coverage. Receipts include the frozen check, actual result and stdout/stderr references. Change manifests contain complete patch and before/after content references. Follow nextOffset until null to read a long artifact; binary content is explicitly base64.',
+      parameters: { id: { type: 'string', required: true }, offset: { type: 'integer', description: 'Text offset in UTF-16 code units; use nextOffset from the previous page. Default 0.' },
+        limit: { type: 'integer', description: 'Maximum page length, from 2 to 24000 UTF-16 code units. Default 24000.' } }, output: textOutput,
+      execute: async args => {
+        const binding = this.#binding(agent, role)
+        const bytes = readNativeEvidence(this.store, binding.taskId, args.id)
+        return JSON.stringify({ id: args.id, ...evidencePage(bytes, args.offset, args.limit) })
+      } }))]
+    dispose.push(scope.tools.register(defineTool({ name: 'fusion_submit_result', description: role === 'lead'
+      ? 'Lead use only after fusion_takeover: submit your own correction so the frozen checks run again. To judge a Sidekick report, use fusion_review_result instead.'
+      : 'Submit the current work-order report and conclude this Worker turn. Read-only exploration requires source ranges; implementation retains frozen checks and Lead review.',
+        parameters: { summary: { type: 'string', description: 'Changes and findings; put nonblocking observations here.', required: true }, status: { type: 'string', enum: ['completed', 'blocked', 'needs-decision'], required: true },
+          unresolved: { ...stringList, description: 'Remaining requirement failures, blocking risks or decisions. Every item prevents final acceptance. Nonblocking observations belong in summary; never omit an actual unresolved requirement.' },
+          sources: { type: 'array', description: 'Required for completed exploration: 1–12 workspace-relative file ranges, each at most 80 lines. Host captures exact text; no invented snippets.',
+            items: { type: 'object', additionalProperties: false, properties: {
+              path: { type: 'string', required: true }, startLine: { type: 'integer', required: true }, endLine: { type: 'integer', required: true },
+            } } },
+        }, output: textOutput,
+        execute: async (args, exec) => {
+          const binding = this.#binding(agent, role), runtime = this.#runtime(binding.taskId)
+          if (role === 'lead' && (!runtime.takeover || !this.state(binding.taskId).currentWorkOrder)) throw new Error('Lead submission requires takeover of an existing work order')
+          if (this.effects.pending(binding.taskId).length) throw new Error('Collect or stop every native job and settle effects before submitting a report')
+          if (args.summary.length > 16_000 || args.unresolved.length > 30) throw new Error('Worker report is too large')
+          const submitted = { summary: args.summary, unresolved: args.unresolved, status: args.status }
+          const order = this.state(binding.taskId).currentWorkOrder!
+          // A whole-tree snapshot can throw on an unrelated FIFO or socket. That must not
+          // drop a blocked or needs-decision report, and a completed report is decided
+          // only by the files it cites.
+          let current: WorkspaceSnapshot | undefined
+          let snapshotFailure: string | undefined
+          if (order.mode === 'explore') {
+            try { current = snapshotWorkspace(runtime.root) }
+            catch (error) { snapshotFailure = error instanceof Error ? error.message : String(error) }
+          }
+          const explorationSubmitted = order.mode === 'explore'
+            ? captureExploration(this.store, order, runtime.base, current, submitted, args.sources ?? [], snapshotFailure) : undefined
+          this.#saveRuntime({ ...runtime, submitted, explorationSubmitted })
+          if (role === 'lead') { this.#release(binding.taskId); return this.#validate(agent, binding, exec) }
+          exec.concludeTurn()
+          return 'Report persisted. The Lead will review after this Worker becomes quiescent.'
+        } })))
+    if (this.owner(agent)?.binding.profile.interactionMode === 'model-like') dispose.push(scope.tools.register(defineTool({
+      name: 'fusion_read_state', description: 'Read this task from durable storage only when needed, especially after compaction. Follow nextOffset until null to restore constraints before effectful tools.',
+      parameters: { offset: { type: 'integer' }, limit: { type: 'integer' } }, output: textOutput,
+      execute: async (args) => JSON.stringify(this.onDemand.read(agent, this.#binding(agent, role), role, args.offset, args.limit)),
+    })))
+    if (role === 'worker') return dispose
+    dispose.push(scope.tools.register(defineTool({ name: 'fusion_takeover', description: this.owner(agent) && enforcedWorkflow(this.owner(agent)!.binding)
+      ? 'Acquire exclusive write ownership for a Lead correction only after the current implementation report and a recorded rework review. Preserve the frozen checks; submit the correction and review it again.'
+      : 'Acquire exclusive write ownership for a small direct task, or for a Lead correction after the current Worker report. A delegated task keeps its frozen acceptance checks and review. Takeover is recorded separately from Worker implementation.',
+      parameters: { reason: { type: 'string', required: true } }, output: textOutput,
+      execute: async (args, exec) => {
+        if (!args.reason.trim()) throw new Error('Takeover reason required')
+        const binding = this.#binding(agent, 'lead'), state = this.state(binding.taskId)
+        const escalation = this.#escalation(binding)
+        if (roleSeparated(binding) && !escalation) throw new Error('FUSION_LEAD_READ_ONLY: the Host has not unlocked takeover for this work order')
+        if (!escalation && enforcedWorkflow(binding) && (!state.currentWorkOrder || state.reviewResult?.decision !== 'rework')) {
+          throw new Error('FUSION_TAKEOVER_REQUIRES_REWORK: delegate first, inspect the current report and record a rework review before taking over')
+        }
+        if (state.currentWorkOrder?.mode === 'text') throw new Error('Use fusion_rework to revise the text report')
+        if (state.currentWorkOrder?.mode === 'explore') throw new Error('Exploration cannot grant a writer; send the implementation plan with fusion_delegate first')
+        const stalled = escalation === 'worker-step-limit' || escalation === 'worker-stalled'
+        if (state.currentWorkOrder && !this.#runtime(binding.taskId).submitted && !stalled && !this.#runtime(binding.taskId).takeover) {
+          throw new Error('Lead takeover waits for the current Worker report; use fusion_rework on the same Worker')
+        }
+        if (state.acceptedChild) {
+          const child = this.ctx.agents.get(NativeSessionId(state.acceptedChild))
+          if (child) { await this.#stopJobs(binding.taskId, () => this.transport.stop(agent, child.id)) }
+          else if (state.lease) throw new Error('Absent Worker still owns a recorded lease; reconcile first')
+        }
+        exec.signal.throwIfAborted()
+        this.scopes.assertReady(agent)
+        if (this.effects.pending(binding.taskId).length) throw new Error('Inspect unfinished Worker effects before takeover')
+        this.#release(binding.taskId)
+        const base = snapshotWorkspace(agent.session.header.cwd!)
+        const runtime = state.currentWorkOrder ? this.#runtime(binding.taskId)
+          : { schemaVersion: 1 as const, taskId: binding.taskId, root: base.root, base, checks: [], reworkRounds: 0, continuationRounds: 0 }
+        const leadSubmissions = (runtime.leadSubmissions ?? 0) + 1
+        this.#saveRuntime({ ...runtime, takeover: true, background: false, submitted: undefined,
+          ...(escalation ? { escalation, leadSubmissions } : {}) })
+        if (escalation && state.currentWorkOrder) {
+          // Recorded for Fusion history: how often the frontier model had to write, and why.
+          const key = `lead-takeover:${binding.taskId}:${state.currentWorkOrder.id}`, prior = this.store.readDocument(key)
+          this.store.writeDocument(key, prior?.revision ?? 0, { schemaVersion: 1, taskId: binding.taskId, workOrderId: state.currentWorkOrder.id,
+            reason: escalation, reworkRounds: runtime.reworkRounds, leadSubmissions, at: new Date().toISOString(), note: args.reason })
+        }
+        if (!state.currentWorkOrder) this.append(binding.taskId, 'intent/chosen', { intent: 'DIRECT' })
+        this.#acquire(binding, base.root, agent.id, OperationId(randomUUID()))
+        return 'Lead owns the write lease. For an existing work order call fusion_submit_result after the correction. For direct work, fusion_delegate can transfer the lease after preparation; call fusion_finish_direct only when the entire user task is complete.'
+      } })))
+    dispose.push(scope.tools.register(defineTool({ name: 'fusion_finish_direct', description: 'Complete the entire direct user task or an answered read-only exploration. This closes the task; it is not a lease-release helper before delegation. Never use for an implementation work order. This does not claim independently verified acceptance.',
+      parameters: {}, output: textOutput, execute: async () => {
+        const binding = this.#binding(agent, 'lead'), state = this.state(binding.taskId)
+        if (state.currentWorkOrder?.mode === 'explore' && state.exploration?.status !== 'completed') {
+          throw new Error('Exploration is incomplete. Use fusion_rework with specific feedback. Explain the blocker and end this turn if missing input is required; do not record an implementation review or completion.')
+        }
+        const explored = state.currentWorkOrder?.mode === 'explore' && state.phase === 'PLANNING'
+          && state.exploration?.workOrderId === state.currentWorkOrder.id && state.exploration.status === 'completed'
+        if (!explored && (state.currentWorkOrder || state.intent !== 'DIRECT')) throw new Error('Use the bound report and review flow for delegated work')
+        if (this.effects.pending(binding.taskId).length) throw new Error('Collect or stop every native job before completing the direct task')
+        const runtime = this.#runtime(binding.taskId)
+        let snapshot: WorkspaceSnapshot['id']
+        if (explored) {
+          if (state.lease) throw new Error('Read-only exploration still holds a write lease')
+          const cited = citedEvidenceChanged(runtime.root, runtime.base, state.exploration!)
+          if (cited) throw new Error(`Cited exploration evidence changed: ${cited}. Frozen baseline ${state.exploration!.snapshot}.`)
+          // The cited files decide a read-only answer. An unrelated FIFO or socket that breaks
+          // the whole-tree snapshot falls back to the baseline those files were checked against.
+          try { snapshot = snapshotWorkspace(runtime.root).id }
+          catch { snapshot = state.exploration!.snapshot }
+          this.append(binding.taskId, 'intent/chosen', { intent: 'DIRECT' })
+        } else snapshot = snapshotWorkspace(runtime.root).id
+        this.#release(binding.taskId)
+        this.append(binding.taskId, 'task/completed', { snapshot, verification: 'unverified' })
+        return 'Direct task recorded; describe the checks you actually ran and any remaining uncertainty.'
+      } })))
+    dispose.push(scope.tools.register(defineTool({ name: 'fusion_explore', description: 'Optionally ask the persistent Worker for read-only code exploration before you plan implementation. It returns source-backed findings without changing files or running commands. Later fusion_delegate continues the same Worker.',
+      parameters: { goal: { type: 'string', required: true }, brief: { type: 'string', required: true }, constraints: stringList,
+        block: { type: 'boolean', description: 'Default true. False returns while exploration runs; use fusion_wait to collect findings.' } }, output: textOutput,
+      execute: (args, exec) => this.delegate(agent, { ...args, allowedPaths: [], checks: [] }, exec, 'explore') })))
+    if (this.owner(agent)?.binding.profile.interactionMode === 'model-like') dispose.push(scope.tools.register(defineTool({
+      name: 'fusion_delegate_text', description: 'Delegate writing, synthesis or analysis of supplied material to the persistent Sidekick. No workspace, test runner or external tools required. Include the complete relevant material and success criteria in the brief. Review the report before delivering.',
+      parameters: { goal: { type: 'string', required: true }, brief: { type: 'string', required: true }, constraints: stringList, block: { type: 'boolean' } }, output: textOutput,
+      execute: (args, exec) => this.delegate(agent, { ...args, allowedPaths: [], checks: [] }, exec, 'text'),
+    })))
+    // Only the command is essential. A rejected call makes the expensive Lead regenerate its
+    // whole brief (seen live: three schema retries in one task), so the rest has defaults.
+    const checkItem = { type: 'object', additionalProperties: false, properties: {
+      command: { type: 'string', required: true },
+      id: { type: 'string', description: 'Default check-N.' }, description: { type: 'string', description: 'Default: the command.' },
+      parser: { type: 'string', enum: [...TEST_PARSERS, 'exit-code'],
+        description: 'A test runner with a count parser (go needs `go test -v`) is verified by its counts; omitted means exit code only.' },
+      kind: { type: 'string', enum: ['test', 'static-check'], description: 'Usually inferred from parser.' },
+      timeoutSeconds: { type: 'integer', description: `Optional per-check limit, 1–${MAX_CHECK_SECONDS} seconds.` },
+      definitionPaths: { ...optionalStringList, description: 'Existing acceptance files whose bytes must remain unchanged; default none. Do not list files the Worker will create or edit.' },
+      baseline: { type: 'string', enum: ['no-new-failures'], description: `For a broad regression suite (${BASELINE_PARSERS.join(', ')}) that may already have unrelated failing tests: the Host runs it once on the untouched workspace and then requires no new failures. Omit for the tests this task must make pass.` },
+    } } as const
+    dispose.push(scope.tools.register(defineTool({ name: 'fusion_delegate', description: 'Delegate a bounded implementation to an independent persistent Worker. After direct Lead preparation, validated delegation transfers the quiescent write lease without completing the task. By default wait for its report and native checks; block=false returns while the Worker runs.',
+      parameters: { goal: { type: 'string', description: 'The complete implementation outcome, including all planned stages.', required: true },
+        brief: { type: 'string', description: 'The current stage plan. Put temporary deferrals and sequencing here; later feedback may advance this stage.', required: true },
+        constraints: { ...optionalStringList, description: 'Default none. Only durable requirements that remain true across every planned implementation stage. Do not freeze a temporary deferral such as not implementing stage two yet.' },
+        allowedPaths: { ...stringList, description: 'Workspace-relative files or directories the Worker may change across all planned stages, including regression tests. A directory grants every file under it; a trailing /** is accepted as the same grant, other wildcards are refused. The Worker cannot expand this set; after a report you can add paths with fusion_rework addAllowedPaths.' },
+        block: { type: 'boolean', description: 'Default true. False permits read-only Lead work while the Worker retains write ownership.' },
+        checks: { type: 'array', required: true, items: checkItem, description: 'Acceptance commands the Host runs after the Worker reports; [] for review-only work.' },
+        requirements: { ...optionalStringList, description: 'The user\'s hard requirements as exact quotes of their messages (required behaviour, names, strings, formats, acceptance criteria), 1-20 items. The Host verifies each quote against the user\'s words, freezes them for the Sidekick, and your accept must give one verdict per item.' } }, output: textOutput,
+      execute: (args, exec) => this.delegate(agent, { ...args, constraints: args.constraints ?? [], checks: normalizeChecks(args.checks), requirements: args.requirements ?? [] }, exec) })))
+    dispose.push(scope.tools.register(defineTool({ name: 'fusion_rework', description: 'Send specific Lead-authored feedback to the same persistent Worker, including advancing a planned implementation stage. Before a report this continues unfinished work within the Worker-step budget; after a report it consumes a rework round. Active generation and native job waits can be replaced without restarting a tracked job; an active foreground tool finishes before the new brief. Keep durable requirements unchanged. Do not suggest files outside the frozen allowed paths unless you add them with addAllowedPaths.',
+      // Orchestration includes human approval waits; leaf tools retain their
+      // resource deadlines, but the wait itself must not expire.
+      parameters: { feedback: { type: 'string', required: true }, block: { type: 'boolean', description: 'Default true. False returns after delivery; call fusion_wait for the report and checks.' },
+        addAllowedPaths: { ...optionalStringList, description: 'After a Worker report, when the task needs changes outside the frozen allowedPaths (for example an existing test elsewhere that encodes the old behaviour): workspace-relative files or directories to add. Paths are only added; the change is recorded and consumes this rework round. A file already changed before it was added cannot keep its original bytes, so its diff has no pre-image and the review must inspect it directly.' },
+        checks: { type: 'array', items: checkItem, description: 'Omit to keep the frozen acceptance checks. Only when a frozen check itself is wrong (for example its interpreter does not exist on this host), pass the complete corrected set after the Worker report. Every existing definitionPath must stay protected; the amendment is recorded and consumes this rework round.' } }, output: textOutput,
+      execute: (args, exec) => this.rework(agent, args.feedback, exec, args.block ?? true, args.checks && normalizeChecks(args.checks), args.addAllowedPaths) })))
+    dispose.push(scope.tools.register(defineTool({ name: 'fusion_wait', description: 'Wait for the background Worker to become quiescent. Exploration returns source findings for planning; implementation runs its frozen native checks. Call sequentially after a handoff or feedback.',
+      parameters: {}, output: textOutput, execute: (_args, exec) => this.wait(agent, exec) })))
+    dispose.push(scope.tools.register(defineTool({ name: 'fusion_review_result', description: 'Record a completed Lead review bound to the candidate this native request received. Accept requires passing evidence.',
+      parameters: { decision: { type: 'string', enum: ['accept', 'rework', 'needs-decision'], required: true }, reason: { type: 'string', required: true },
+        requirements: { type: 'array', description: 'Required to accept when the work order has user requirements: one verdict per requirement index.',
+          items: { type: 'object', additionalProperties: false, properties: { index: { type: 'integer', required: true }, met: { type: 'boolean', required: true },
+            evidence: { type: 'string', required: true, description: 'Where the candidate satisfies it: file and line, or the test that proves it.' } } } } }, output: textOutput,
+      execute: async (args, exec) => this.review(agent, args.decision, args.reason, exec, args.requirements ?? []) })))
+    return dispose
+  }
+
+  async close(): Promise<void> {
+    this.#statusAbort.abort()
+    await this.modelControl.close()
+    this.#closing = true
+    const auxiliaryStopped = this.keepalive.close()
+    for (const binding of this.bindings.selected()) {
+      const parent = this.ctx.agents.get(NativeSessionId(binding.sessionId))
+      if (!parent) continue
+      if (parent.status !== 'idle') parent.cancel({ kind: 'hook', reason: 'Fusion runtime is unloading' }, { keepInbox: true })
+      await parent.whenIdle()
+      await this.#backgroundStops.get(binding.taskId)
+      const state = this.state(binding.taskId)
+      // 0.2.1 delivers subagent-settled when release disposes the child, and that
+      // wake can run #stopBackground before the replacement scan. Record the
+      // gate while `runtime.background` is still the authority for an in-flight handoff.
+      const background = (this.store.readDocument(`runtime:${binding.taskId}`)?.value as { background?: boolean } | undefined)?.background
+      if (background && state.control.mode !== 'completed' && !state.control.recovering) {
+        this.append(binding.taskId, 'recovery/needed', { reason: 'Host runtime was replaced during a background handoff' })
+      }
+      const workerId = binding.workerId ?? state.acceptedChild
+      const child = workerId && this.ctx.agents.get(NativeSessionId(workerId))
+      await this.#stopJobs(binding.taskId)
+      if (child) { await this.transport.release(parent, child.id); this.scopes.detach(child) }
+      if (!this.effects.pending(binding.taskId).length) this.#release(binding.taskId)
+      // Releasing the child may have queued a final native settlement notice.
+      await parent.whenIdle()
+      this.scopes.detach(parent)
+    }
+    await Promise.all(this.#backgroundStops.values())
+    await auxiliaryStopped
+    await this.activity.close()
+    for (const dispose of this.#dispose.reverse()) dispose()
+  }
+}