feat(fusion): the orchestrator plans and reviews, the workers do the work

[plombeer31]

Fusion's division of labour has been advice since the mode shipped, and a capable cloud model handed a catalog of forty tools reads the twelve files itself and never fans anything out. A QA run on v0.5.6 showed exactly that: nine steps, twelve os.fs.read calls, zero delegations, every completion on the cloud model — with the orange fusion chip on screen the whole time.

The gate

The first mutation of a fusion turn is refused until the turn has delegated once. Read, plan, split, delegate — then the gate opens, because two things genuinely belong to the orchestrator afterwards: integration, which is a write, and anything a worker handed up because it needed approval, which workers cannot request.

• A refusal, not a hidden descriptor: removing tools mid-turn rewrites the stable prefix and drops the session's KV cache, while a refusal costs one tool result and reads as an instruction. Same trade plan-mode.ts makes, and the same one fusion.delegate already makes for a worker that calls it.
• Never gated: read-only tools (planning is reading), the fan-out itself, and the terminal verbs — vetoing reply would veto the turn's exit.
• Never gated on a worker's own turn: the flag is per turn and skips ephemeral ones, so the hands the mode exists to free stay free.

The loop, in the guidance

Rewritten around what the gate now enforces: plan in the open and delegate in the same turn, parts sized so a big one gets its own worker and small ones share, one task per part in one call, briefs that stand alone, read every reply against its brief, merge yourself, and send rework back out — failed, needs_orchestrator, or anything you want refactored — instead of quietly absorbing it. Same prefix budget as before: 1397 of 1400 bytes.

The "delegate in the same turn" clause is not decoration: the first live run of this branch, on a cheap auto-routed model, read the files and replied "no edits were needed" without touching anything. Stopping after the plan is the cheapest way to satisfy "plan in the open".

Verified

npx tsc --noEmit clean; new unit tests for the gate (7) and executor-level tests (5, including that a held-back call's slot is filled with the refusal rather than dropped, that reads pass through while planning, that the same call dispatches once the turn has delegated, and that nothing is gated outside fusion); src/prompt and src/agent suites green.