create-agdf 0.20.2 → 0.31.0

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/mcp-lifecycle/owner-client.js

@@ -0,0 +1,79 @@
+import { EventEmitter } from 'node:events';
+import { randomUUID } from 'node:crypto';
+import { GENERATION_LIMITS as L, OWNER_LIMITS, ownerFrame, encodeOwnerFrame, decodeOwnerFrame,
+  validGenerationMessage, generationMessage, publicationSelector } from '../mcp-owner-protocol.js';
+
+// Logical connections only. The remote owner holds the genuine Worker objects.
+export function createOwnerClient(port, binding) {
+  const rows = new Map(), pending = new Map(), lifecycle = new EventEmitter();
+  let bytes = 0, disconnected = false;
+  function send(kind, payload, requestId, row) {
+    if (disconnected) throw Error('generation_connection_lost');
+    const frame = ownerFrame(binding, kind, payload, requestId, row);
+    const wire = encodeOwnerFrame(frame, binding);
+    if (pending.size >= OWNER_LIMITS.frames || bytes + Buffer.byteLength(wire) > OWNER_LIMITS.bytes) throw Error('generation_request_capacity');
+    return wire;
+  }
+  const generationFailure = (frame, p) => generationMessage(p.row.epoch, p.row.generation, 'failure', { reason: frame.payload.reason }, {}, p.original, frame.request_id);
+  function release(id) { const p = pending.get(id); if (p) { pending.delete(id); bytes -= p.bytes; clearTimeout(p.timer); } return p; }
+  port.on('message', wire => {
+    let frame; try { frame = decodeOwnerFrame(wire, binding, { reply: true }); } catch { return; }
+    if (frame.kind === 'stop' && frame.generation_id === null && frame.publication_id === binding.publication_id) {
+      lifecycle.emit('message', { kind: 'facade_stop', token: binding.token }); return;
+    }
+    const row = rows.get(frame.generation_id);
+    if (!row || row.epoch !== frame.generation_epoch || row.publication_id !== frame.publication_id) return;
+    const p = pending.get(frame.request_id);
+    if (frame.kind === 'exit' && Object.keys(frame.payload).sort().join() === 'code' && Number.isInteger(frame.payload.code)) {
+      row.connected = false; if (frame.payload.code === 0) rows.delete(row.generation); row.emit('exit', frame.payload.code, null); return;
+    }
+    if (!p || p.row !== row) return;
+    if (frame.kind === 'failure' && typeof frame.payload?.reason === 'string') {
+      release(frame.request_id); p.reject?.(Error(frame.payload.reason)); if (p.kind === 'send') row.emit('message', generationFailure(frame, p));
+    } else if (frame.kind === 'opened' && p.kind === 'open' && frame.payload?.opened === true) {
+      release(frame.request_id); p.resolve(row);
+    } else if (frame.kind === 'message' && p.kind === 'send'
+      && validGenerationMessage(frame.payload, { epoch: row.epoch, generation: row.generation, reply: true })
+      && frame.payload.request_id === frame.request_id && frame.payload.original_operation_id === p.original) {
+      release(frame.request_id); row.emit('message', frame.payload);
+    }
+  });
+  port.on('close', () => {
+    disconnected = true;
+    for (const [id] of pending) { const p = release(id); p.reject?.(Error('generation_connection_lost')); }
+    for (const row of rows.values()) if (row.connected) { row.connected = false; row.emit('disconnect'); }
+    lifecycle.emit('disconnect');
+  });
+  return Object.freeze({
+    lifecycle: {
+      on: (...args) => lifecycle.on(...args),
+      send(value, callback) {
+        if (value?.kind !== 'facade_closed' || value.token !== binding.token || typeof value.confirmed !== 'boolean') throw Error('generation_input_limit');
+        port.postMessage(encodeOwnerFrame(ownerFrame(binding, 'closed', { confirmed: value.confirmed }, randomUUID()), binding)); callback?.();
+      },
+      close: () => port.close(),
+    },
+    async open({ packageInfo, epoch, generation }) {
+      if (rows.size >= L.slots || rows.has(generation)) throw Error('generation_capacity_protected');
+      const row = new EventEmitter(); Object.assign(row, { epoch, generation, publication_id: packageInfo.publication_id, connected: true });
+      rows.set(generation, row);
+      row.send = (message, callback) => {
+        try {
+          if (!row.connected || !validGenerationMessage(message, { epoch, generation }) || pending.has(message.request_id)) throw Error('generation_input_limit');
+          const wire = send('send', message, message.request_id, row);
+          const entry = { kind: 'send', row, original: message.original_operation_id, bytes: Buffer.byteLength(wire) };
+          // Expiry retains the row; uncertainty is handled by the generation router.
+          entry.timer = setTimeout(() => { release(message.request_id); row.emit('message', generationFailure({ payload: { reason: 'generation_response_unknown' }, request_id: message.request_id }, entry)); }, L.qualify);
+          pending.set(message.request_id, entry); bytes += entry.bytes; port.postMessage(wire); callback?.();
+        } catch (error) { callback?.(error); }
+      };
+      const id = randomUUID(), wire = send('open', publicationSelector(packageInfo), id, row);
+      return new Promise((resolve, reject) => {
+        const entry = { kind: 'open', row, resolve, reject, bytes: Buffer.byteLength(wire) };
+        entry.timer = setTimeout(() => { release(id); row.connected = false; reject(Error('generation_response_unknown')); }, L.qualify);
+        pending.set(id, entry); bytes += entry.bytes;
+        try { port.postMessage(wire); } catch (error) { release(id); reject(error); }
+      });
+    },
+  });
+}

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/mcp-lifecycle/package.js

@@ -1,3 +1,4 @@
+import { Worker } from 'node:worker_threads';
 import { ChildProcess, execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import {
@@ -16,16 +17,18 @@ import {
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import process from "node:process";
 import {
+  MCP_RUNTIME_OWNER as OWNER,
+  MCP_RUNTIME_MARKER as MARKER,
+  inspectOwnedMcpRuntimeRoot as inspectPackageRoot,
   digestDirectory,
   digestMcpDispatcherPackage,
   digestMcpSdkRuntime,
 } from "#agdf-core/runtime/plugin-provenance.js";
 import { defaultNpmInstallRoot, npmInvocation } from "../npm-invocation.js";
 import { renameSyncWithRetry } from "#agdf-core/fs-swap.js";
-import { fsyncDirectory, withOwnedFileLock } from '#agdf-core/control-state/run-state-writer.js';
+import { fsyncDirectory, withOwnedFileLock } from '#agdf-core/owned-file-lock.js';
+import { createPreparedCallJournal } from './prepared-call-journal.js';
 
-const OWNER = "create-agdf:mcp-runtime";
-const MARKER = ".agdf-mcp-owned.json";
 const CLAIMS = '.agdf-executable-claims';
 
 // Claims are package-local retention evidence, never a PID liveness ledger.
@@ -62,7 +65,7 @@ export function acquireMcpExecutableClaim(runtime, { ownerEpoch = randomUUID(),
     if (realpathSync(root) !== root || lstatSync(root).isSymbolicLink()) throw Error('AGDF_MCP_EXECUTABLE_CLAIM_INVALID');
     const fresh = inspectMcpServerPackage({ dataRoot: dirname(root), expectedVersion: runtime.version });
     if (fresh.status !== 'matched' || fresh.digest !== runtime.digest || fresh.dispatcherDigest !== runtime.dispatcherDigest
-      || fresh.sdkDigest !== runtime.sdkDigest) throw Error('AGDF_MCP_EXECUTABLE_CLAIM_INVALID');
+      || fresh.sdkDigest !== runtime.sdkDigest || fresh.markerPath !== runtime.markerPath) throw Error('AGDF_MCP_EXECUTABLE_CLAIM_INVALID');
     const marker = readJson(runtime.markerPath, 'AGDF_MCP_RUNTIME_MARKER_INVALID');
     if (marker.owner !== OWNER || marker.executable_retention !== 'claimed_immutable'
       || marker.server_digest !== runtime.digest || marker.dispatcher_digest !== runtime.dispatcherDigest
@@ -96,7 +99,14 @@ export function acquireMcpExecutableClaim(runtime, { ownerEpoch = randomUUID(),
         }
       }
     };
-    return Object.freeze({ token, owner_epoch: ownerEpoch, generation,
+    // Reuse this actual, lock-bound inspection in the supervising owner. It
+    // is an observation from this acquisition, never caller-supplied trust.
+    return Object.freeze({ token, owner_epoch: ownerEpoch, generation, verifiedRuntime: fresh,
+      bindOwnedWorker(worker, { confirmedEnd = () => false } = {}) {
+        if (bound || !(worker instanceof Worker) || worker.threadId <= 0) throw Error('AGDF_MCP_EXECUTABLE_CLAIM_INVALID');
+        bound = true;
+        worker.once('exit', code => { try { if (code === 0 && confirmedEnd() === true) releaseConfirmed(); } catch {} });
+      },
       bindOwnedChild(child, { confirmedEnd = () => true } = {}) {
         if (bound || !(child instanceof ChildProcess)) throw Error('AGDF_MCP_EXECUTABLE_CLAIM_INVALID');
         bound = true;
@@ -166,81 +176,6 @@ export function inspectMcpExecutableRoot({ root, expectedVersion } = {}) {
 
 // Retirement checks the same verified package after its owned atomic rename.
 // It must not accidentally inspect a new package at the former version path.
-function inspectPackageRoot(root, expectedVersion) {
-  const markerPath = join(root, MARKER);
-  if (!existsSync(root)) return Object.freeze({ status: "absent", root, entrypoint: null, digest: null });
-  if (!lstatSync(root).isDirectory() || lstatSync(root).isSymbolicLink() || !existsSync(markerPath)) {
-    return Object.freeze({ status: "foreign", root, entrypoint: null, digest: null });
-  }
-  try {
-    const marker = readJson(markerPath, "AGDF_MCP_RUNTIME_MARKER_INVALID");
-    const packageRoot = join(root, "node_modules", "@agdf", "mcp-server");
-    const dispatcherRoot = join(root, "node_modules", "create-agdf");
-    const sdkServerRoot = join(root, "node_modules", "@modelcontextprotocol", "server");
-    const sdkCoreRoot = join(root, "node_modules", "@modelcontextprotocol", "core");
-    const sdkClientRoot = join(root, "node_modules", "@modelcontextprotocol", "client");
-    const sdkV1Root = join(root, "node_modules", "@modelcontextprotocol", "sdk");
-    const manifestPath = join(packageRoot, "package.json");
-    const dispatcherManifestPath = join(dispatcherRoot, "package.json");
-    if (marker.owner !== OWNER || marker.version !== expectedVersion
-        || !existsSync(manifestPath) || !existsSync(dispatcherManifestPath)) {
-      return Object.freeze({ status: "mismatch", root, entrypoint: null, digest: null });
-    }
-    for (const ownedRoot of [packageRoot, dispatcherRoot, sdkServerRoot, sdkCoreRoot]) {
-      if (!existsSync(ownedRoot) || !lstatSync(ownedRoot).isDirectory() || lstatSync(ownedRoot).isSymbolicLink()) {
-        return Object.freeze({ status: "mismatch", root, entrypoint: null, digest: null });
-      }
-    }
-    const manifest = readJson(manifestPath, "AGDF_MCP_SERVER_MANIFEST_INVALID");
-    const dispatcherManifest = readJson(dispatcherManifestPath, "AGDF_MCP_DISPATCHER_MANIFEST_INVALID");
-    const sdkServerManifest = readJson(join(sdkServerRoot, "package.json"), "AGDF_MCP_SDK_MANIFEST_INVALID");
-    const sdkCoreManifest = readJson(join(sdkCoreRoot, "package.json"), "AGDF_MCP_SDK_MANIFEST_INVALID");
-    const entrypoint = join(packageRoot, "bin", "agdf-mcp.js");
-    const serverDigest = digestDirectory(packageRoot);
-    const dispatcherDigest = digestMcpDispatcherPackage(dispatcherRoot);
-    const sdkDigest = digestMcpSdkRuntime(root);
-    const valid = [1, 2].includes(marker.schema_version)
-      && typeof marker.node_executable === "string"
-      && isAbsolute(marker.node_executable)
-      && manifest.name === "@agdf/mcp-server"
-      && manifest.version === expectedVersion
-      && manifest.dependencies?.["create-agdf"] === expectedVersion
-      && manifest.dependencies?.["@modelcontextprotocol/server"] === "2.0.0"
-      && manifest.engines?.node === ">=22"
-      && dispatcherManifest.name === "create-agdf"
-      && dispatcherManifest.version === expectedVersion
-      && sdkServerManifest.name === "@modelcontextprotocol/server"
-      && sdkServerManifest.version === "2.0.0"
-      && sdkCoreManifest.name === "@modelcontextprotocol/core"
-      && sdkCoreManifest.version === "2.0.0"
-      && !existsSync(sdkClientRoot)
-      && !existsSync(sdkV1Root)
-      && existsSync(entrypoint)
-      && lstatSync(entrypoint).isFile()
-      && !lstatSync(entrypoint).isSymbolicLink()
-      && marker.server_digest === serverDigest
-      && marker.dispatcher_digest === dispatcherDigest
-      && marker.sdk_digest === sdkDigest;
-    return Object.freeze({
-      status: valid ? "matched" : "mismatch",
-      version: expectedVersion,
-      root,
-      packageRoot,
-      dispatcherRoot,
-      markerPath,
-      entrypoint: valid ? entrypoint : null,
-      digest: serverDigest,
-      dispatcherDigest,
-      sdkDigest,
-      nodeExecutable: typeof marker.node_executable === "string" ? marker.node_executable : null,
-      references: Object.freeze(Array.isArray(marker.references) ? marker.references : []),
-      markerSchemaVersion: marker.schema_version,
-      sdkVerification: typeof marker.sdk_verification === "string" ? marker.sdk_verification : null,
-    });
-  } catch {
-    return Object.freeze({ status: "mismatch", root, entrypoint: null, digest: null });
-  }
-}
 
 // Names of all packages installed under root/node_modules, scoped included; npm's dot entries
 // (.bin, .package-lock.json) are bookkeeping, not packages.
@@ -506,6 +441,12 @@ export function createMcpGenerationPublisher(base, { publicationDeadline = Infin
   if (canonical !== base.publisher_root || !base.immutable) throw Error('runtime_publication_unowned');
   return Object.freeze({
     initial: base,
+    // Only a freshly owned publisher supplies persistent transport storage.
+    // This is lazy: constructing/discovering the SDK creates no journal files.
+    preparedCallStore({ surface }) {
+      return createPreparedCallJournal({ publisherRoot: canonical, identity: { surface, version: base.version,
+        server_digest: base.digest, dispatcher_digest: base.dispatcherDigest, sdk_digest: base.sdkDigest } });
+    },
     resolve(candidate) {
       const keys = ['schema_version', 'publication_id', 'version', 'server_digest', 'dispatcher_digest', 'sdk_digest'];
       if (!candidate || Object.keys(candidate).sort().join() !== keys.sort().join()

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/mcp-lifecycle/plugin-runtime.js

@@ -1,10 +1,11 @@
 import { execFileSync, spawn, fork } from "node:child_process";
-import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync, rmdirSync } from "node:fs";
+import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync, rmdirSync, unlinkSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import process from "node:process";
 import { createHash, randomUUID } from 'node:crypto';
-import { digestDirectory, digestPluginMcpDispatcherSource, MCP_DISPATCHER_RUNTIME_ENTRIES } from "#agdf-core/runtime/plugin-provenance.js";
+import { digestDirectory, digestPluginMcpDispatcherSource, mcpDispatcherRuntimeEntries, mcpDispatcherPackageExports } from "#agdf-core/runtime/plugin-provenance.js";
 import { acquireMcpExecutableClaim, inspectMcpServerPackage, mcpPackageConstants, mcpRuntimeRetirementState, prepareMcpServerPackage, createMcpRuntimeRetirementTransaction } from "./package.js";
+import { inspectPreparedCallJournals, retirePreparedCallJournals } from './prepared-call-journal.js';
 
 // Plugin-local AGDF MCP runtime shared by the hosts whose runtime plugin declares the server itself:
 // Claude Code passes ${CLAUDE_PLUGIN_DATA}, which it deletes on uninstall; Codex receives an absolute
@@ -15,6 +16,12 @@ const SDK_PACKAGE_SPEC = "@modelcontextprotocol/server@2.0.0";
 // the shipped digest; the override deliberately restores the unverified install and is recorded.
 export const SDK_BUNDLE = Object.freeze({ manifest: "package.json", lock: "package-lock.json", expected: "expected-sdk.json" });
 export const SDK_OVERRIDE_ENV = "AGDF_MCP_ALLOW_UNVERIFIED_SDK";
+// The journal's data-root variable (COMPANION_DATA_ROOT_ENV of core companion/journal.js), kept as a
+// literal so the launcher stays free of the journal module; the journal test asserts both agree.
+export const COMPANION_DATA_ROOT_ENV = "AGDF_COMPANION_DATA_ROOT";
+// The journal's directory and its two files below the data root (JOURNAL_DIRECTORY, JOURNAL_FILE and
+// JOURNAL_ROTATED_FILE of core companion/journal.js), owned and removed with the runtime (SD SDD-006).
+export const COMPANION_JOURNAL = Object.freeze({ directory: "companion", files: Object.freeze(["events.jsonl", "events.1.jsonl"]) });
 export const SDK_VERIFICATION = Object.freeze({ verified: "verified", override: "unverified_override" });
 
 function readJson(path) {
@@ -39,7 +46,7 @@ function copyPluginPackages({ pluginRoot, stage, version }) {
   }
   cpSync(serverSource, join(stage, "node_modules", "@agdf", "mcp-server"), { recursive: true });
   const dispatcherRoot = join(stage, "node_modules", "create-agdf");
-  for (const entry of MCP_DISPATCHER_RUNTIME_ENTRIES.filter((item) => item !== "package.json")) {
+  for (const entry of mcpDispatcherRuntimeEntries(runtimePackage).filter((item) => item !== "package.json")) {
     cpSync(join(runtimePackage, entry), join(dispatcherRoot, entry), { recursive: true });
   }
   writeFileSync(join(dispatcherRoot, "package.json"), `${JSON.stringify({
@@ -47,7 +54,7 @@ function copyPluginPackages({ pluginRoot, stage, version }) {
     version,
     private: true,
     type: "module",
-    exports: { "./mcp-dispatch-runtime": "./lib/mcp-dispatch-runtime.js" },
+    exports: mcpDispatcherPackageExports(runtimePackage),
     imports: { "#agdf-core": "./runtime/core/lib/index.js", "#agdf-core/*": "./runtime/core/lib/*" },
   }, null, 2)}\n`, "utf8");
 }
@@ -249,9 +256,18 @@ export async function launchPluginMcpServer({
     return null;
   }
   const { surface, dataRoot, cockpitDir, cockpitMode, prepareOnly } = invocation;
+  // Companion events (companion core SDD-006): the facade and its generations journal final tool
+  // results below the data root this launcher received; the variable reaches them with the facade's
+  // environment only. Preparation keeps the launcher's own environment.
+  const facadeEnv = typeof dataRoot === 'string' && dataRoot ? { ...env, [COMPANION_DATA_ROOT_ENV]: resolve(dataRoot) } : env;
   const publicationDeadline = performance.now() + CONCURRENT_PUBLICATION_WAIT_MS;
-  let runtime;
+  let runtime, waitingOwner;
   try {
+    // Bootstrap only the existing SDK-free owner while this process performs
+    // preparation. It cannot claim or start a facade until the private message
+    // carries the successfully verified publication.
+    if (!prepareOnly && !startFacade && acquireClaim === acquireMcpExecutableClaim && ensure === ensurePluginMcpRuntime)
+      waitingOwner = startFacadeOwner({ surface, cockpitDir, cockpitMode, pluginRoot, env: facadeEnv, publicationDeadline });
     // Reject a damaged installed dispatcher before publication, claim acquisition
     // or SDK execution. Its downstream resource context cannot qualify a facade;
     // starting one first would correctly retain its unconfirmed executable use.
@@ -262,6 +278,7 @@ export async function launchPluginMcpServer({
     }
     runtime = ensure({ pluginRoot, dataRoot, env, publicationDeadline });
   } catch (error) {
+    if (waitingOwner) { waitingOwner.stop(); await waitingOwner.settled.catch(() => {}); }
     const code = /^AGDF_[A-Z_]+/.exec(error?.message ?? "")?.[0] ?? 'AGDF_MCP_PLUGIN_RUNTIME_FAILED';
     stderr.write(`${launcherFailureLine(code, code === 'AGDF_MCP_PLUGIN_RUNTIME_FAILED' ? 'preparation' : undefined)}\n`);
     process.exitCode = 1;
@@ -278,7 +295,11 @@ export async function launchPluginMcpServer({
   // The stable launcher directly owns the facade process. It retains its exact
   // executable before fork and releases only after orderly teardown AND exit.
   if (!startFacade && acquireClaim === acquireMcpExecutableClaim) {
-    try { return await startFacadeOwner({ runtime, surface, cockpitDir, cockpitMode, pluginRoot, env, publicationDeadline }); }
+    try {
+      const owner = waitingOwner ?? startFacadeOwner({ runtime, surface, cockpitDir, cockpitMode, pluginRoot, env: facadeEnv, publicationDeadline });
+      waitingOwner?.activate(runtime);
+      return await owner.settled;
+    }
     catch (error) { const code = Object.hasOwn(LAUNCHER_FAILURES, error?.message) ? error.message : 'AGDF_MCP_PLUGIN_RUNTIME_FAILED';
       stderr.write(`${launcherFailureLine(code, code === 'AGDF_MCP_PLUGIN_RUNTIME_FAILED' ? 'facade' : undefined)}\n`); process.exitCode = 1; return null; }
   }
@@ -289,7 +310,7 @@ export async function launchPluginMcpServer({
       ? error.message : 'AGDF_MCP_EXECUTABLE_CLAIM_INVALID';
     stderr.write(`${launcherFailureLine(code)}\n`); process.exitCode = 1; return null;
   }
-  try { return await (startFacade ?? supervisePluginMcpFacade)({ runtime, surface, cockpitDir, cockpitMode, pluginRoot, env, publicationDeadline, claim }); }
+  try { return await (startFacade ?? supervisePluginMcpFacade)({ runtime, surface, cockpitDir, cockpitMode, pluginRoot, env: facadeEnv, publicationDeadline, claim }); }
   catch (error) {
     const code = Object.hasOwn(LAUNCHER_FAILURES, error?.message) ? error.message : 'AGDF_MCP_PLUGIN_RUNTIME_FAILED';
     stderr.write(`${launcherFailureLine(code, 'facade')}\n`); process.exitCode = 1; return null;
@@ -326,15 +347,21 @@ export function supervisePluginMcpFacade({ runtime, surface, cockpitDir, cockpit
 function startFacadeOwner({ runtime, surface, cockpitDir, cockpitMode, pluginRoot, env, publicationDeadline }) {
   const token = randomUUID();
   const deadline = (process.hrtime.bigint() + BigInt(Math.floor(Math.max(0, publicationDeadline - performance.now()) * 1e6))).toString();
-  return new Promise((resolve, reject) => {
+  let activate, stop;
+  const settled = new Promise((resolve, reject) => {
     const child = fork(join(pluginRoot, 'runtime/create-agdf/lib/mcp-lifecycle/facade-owner-entry.js'),
-      [JSON.stringify({ runtime, surface, cockpitDir, cockpitMode, pluginRoot, token, deadline_ns: deadline })],
+      [JSON.stringify({ runtime, await_runtime: runtime === undefined, surface, cockpitDir, cockpitMode, pluginRoot, token, deadline_ns: deadline })],
       { env, detached: true, windowsHide: true, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], execArgv: [] });
-    let confirmed = false, failure;
-    const stop = () => { if (child.connected) child.send({ kind: 'owner_stop', token }, () => {}); };
+    let confirmed = false, failure, ready = runtime !== undefined, pending, stopped = false;
+    const send = message => { if (child.connected) child.send(message, error => { if (error) reject(error); }); };
+    stop = () => { stopped = true; if (ready && child.connected) child.send({ kind: 'owner_stop', token }, () => {}); };
+    activate = publication => { pending = publication; if (ready && !stopped) send({ kind: 'owner_start', token, runtime: pending }); };
     process.once('SIGTERM', stop); process.once('SIGINT', stop);
     const detach = () => { process.off('SIGTERM', stop); process.off('SIGINT', stop); };
     child.on('message', message => {
+      if (message?.kind === 'owner_ready' && message.token === token && !ready) {
+        ready = true; if (stopped) stop(); else if (pending) activate(pending);
+      }
       if (message?.kind === 'owner_closed' && message.token === token && message.confirmed === true) confirmed = true;
       if (message?.kind === 'owner_failed' && message.token === token && Object.hasOwn(LAUNCHER_FAILURES, message.code)) failure = message.code;
     });
@@ -344,6 +371,10 @@ function startFacadeOwner({ runtime, surface, cockpitDir, cockpitMode, pluginRoo
       else reject(Error(failure ?? 'AGDF_MCP_FACADE_CLOSE_UNCONFIRMED'));
     });
   });
+  // Preparation is synchronous; the owner can fail first while its promise is
+  // intentionally not awaited yet. Keep that rejection observed in both phases.
+  settled.catch(() => {});
+  return Object.freeze({ settled, activate: publication => activate(publication), stop: () => stop() });
 }
 
 export function claudePluginDataRoot({ claudeConfigDir, pluginId = "agdf@agdf" }) {
@@ -356,12 +387,18 @@ export const claudePluginMcpConstants = Object.freeze({ sdkPackageSpec: SDK_PACK
 
 // Codex keeps the plugin-local MCP runtime in an AGDF-owned data root because it passes no plugin data
 // directory; `codex plugin remove` cannot delete it. `dataRoot` is the launcher data root (--data);
-// uninstall removes it only when it holds nothing but owned runtimes and abandoned stages under mcp/.
+// uninstall removes it only when it holds nothing but owned runtimes and abandoned stages under mcp/
+// and the companion journal (a plain directory holding only its own regular files).
+function ownedCompanionJournal(dataRoot) {
+  const directory = join(dataRoot, COMPANION_JOURNAL.directory), stats = lstatSync(directory);
+  if (!stats.isDirectory() || stats.isSymbolicLink()) return false;
+  return readdirSync(directory).every(name => COMPANION_JOURNAL.files.includes(name) && lstatSync(join(directory, name)).isFile());
+}
 export function inspectPluginMcpDataRoot(dataRoot) {
   if (!existsSync(dataRoot)) return "absent";
   try {
     if (!lstatSync(dataRoot).isDirectory() || lstatSync(dataRoot).isSymbolicLink()) return "foreign";
-    if (readdirSync(dataRoot).some((name) => name !== "mcp")) return "foreign";
+    if (readdirSync(dataRoot).some((name) => name !== "mcp" && !(name === COMPANION_JOURNAL.directory && ownedCompanionJournal(dataRoot)))) return "foreign";
     const mcpDataRoot = join(realpathSync(dataRoot), "mcp");
     if (!existsSync(mcpDataRoot)) return "owned";
     if (!lstatSync(mcpDataRoot).isDirectory() || lstatSync(mcpDataRoot).isSymbolicLink()) return "foreign";
@@ -370,6 +407,10 @@ export function inspectPluginMcpDataRoot(dataRoot) {
       const path = join(mcpDataRoot, name);
       const stats = lstatSync(path);
       if (!stats.isDirectory() || stats.isSymbolicLink()) return "foreign";
+      if (name === 'prepared-calls') {
+        if (inspectPreparedCallJournals(mcpDataRoot) !== 'owned') return 'foreign';
+        continue;
+      }
       if (name !== 'generations') {
         if (!ownedRoot(path) && !name.startsWith('.stage-')) return 'foreign';
         protectedFiles = true; continue;
@@ -410,7 +451,14 @@ export function retirePluginMcpDataRoot(dataRoot, revalidate = () => {}) {
       rmdirSync(publication);
     }
     if (existsSync(generations)) rmdirSync(generations);
+    retirePreparedCallJournals(mcp);
     if (existsSync(mcp)) rmdirSync(mcp);
+    const journal = join(dataRoot, COMPANION_JOURNAL.directory);
+    if (existsSync(journal)) {
+      revalidate();
+      for (const name of COMPANION_JOURNAL.files) if (existsSync(join(journal, name))) unlinkSync(join(journal, name));
+      rmdirSync(journal);
+    }
     revalidate(); rmdirSync(dataRoot);
     return true;
   } catch (error) {