A link's agents run as the receiving environment's user, so at full access
the fence only ever stopped T3's own tools, never what the agent could do.
It also kept a host from driving machines it fully trusts: answering a
pending question or steering a thread the user started there, updating a
project, or running the project's setup script in a worktree it launched.

The stamp now records the access the link was paired with, and only a link
below full access is fenced. Its work still carries linkOrigin, so clients
keep showing where it came from. Stamps from before access was recorded stay
fenced.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>