create-agdf 0.30.0 → 0.31.0

package/generated/plugins/agdf/companion/run-state.mjs

@@ -1,106 +1,93 @@
-import { projectStoredRun } from './core.mjs';
-// Bounded, read-only current-Run projection. Typed records and display policy come
-// from the canonical pure Core modules. This does not qualify seals or file evidence
-// and never authorizes a gate or command. File access remains injected by the host.
+// Run view reader (SD SDD-010): obtains the Core run view through the plugin runtime's read-only
+// `run-view` command and maps it to the companion's runs. The companion derives no run semantics of
+// its own: status, gate path, missing approval, next step and figure come from the status card's
+// evaluator. Process access is injected by the host ({ run(argv, init) }, as `$.process` provides).
 
-export const GATES = Object.freeze(['UR', 'PRD', 'SD', 'TP', 'QA', 'UAT', 'OR']);
-// The internal steps between an approved TP and QA, shown as the build phase (SDD-02, SDD-03).
+export const RUN_VIEW_SCHEMA = 'run-view/1';
+export const RUN_VIEW_TIMEOUT_MS = 10_000;
+// Why a run-view read failed; each has a catalog text under `unreadable` (shown with the failure).
+export const READ_FAILURE_REASONS = Object.freeze(['timeout', 'unavailable', 'exit', 'malformed', 'source_changed']);
+// Store reasons of a read that may succeed on the next attempt (a write during the read, the read
+// budget); they keep the last good view, marked stale, like a failed read (CR delta review RV-1).
+export const TRANSIENT_STORE_REASONS = Object.freeze(['source_changed', 'timeout']);
+// The internal steps between an approved TP and QA, shown as the build phase in the gate bar.
 export const BUILD_GATES = Object.freeze(['Brownfield Analysis', 'CD+Tests', 'CR']);
 export const isStructured = route => route === 'structured_delivery' || route === 'structured_slice';
-// The host rejects reads over 4 MiB; the largest observed run state is about 280 KB.
-export const MAX_RUN_STATE_BYTES = 1024 * 1024;
 const TEXT_LIMIT = 240;
+const clip = text => { const value = String(text ?? ''); return value.length > TEXT_LIMIT ? `${value.slice(0, TEXT_LIMIT - 1)}…` : value; };
 
-// The run lifecycles the core reader accepts (`LIFECYCLES` in run-state-parser.js); the logic suite
-// asserts that both sets are equal, so a new core lifecycle fails it instead of reading unreadable.
-export const LIFECYCLES = Object.freeze(['active', 'completed', 'superseded', 'abandoned']);
-const KNOWN_LIFECYCLES = new Set(LIFECYCLES);
-const plain = value => String(value ?? '').replace(/`/gu, '').trim();
-const clip = text => (text.length > TEXT_LIMIT ? `${text.slice(0, TEXT_LIMIT - 1)}…` : text);
-
-// Body of a level-two section, without its heading; '' when absent.
-export function section(text, heading) {
-  const lines = text.split('\n');
-  const start = lines.findIndex(line => line.trimEnd() === `## ${heading}`);
-  if (start < 0) return '';
-  const rest = lines.slice(start + 1);
-  const end = rest.findIndex(line => line.startsWith('## '));
-  return (end < 0 ? rest : rest.slice(0, end)).join('\n');
+// The only command the companion runs: the read-only run view of one project root.
+export function runViewArgv({ pluginRoot, root, language, runIds = [] }) {
+  return ['node', `${pluginRoot}/runtime/agdf-local.js`, 'run-view', '--dir', root, '--json', '--language', language,
+    ...runIds.flatMap(runId => ['--run', runId])];
 }
 
-const field = (body, key) => plain(body.match(new RegExp(`^- ${key}:[ \\t]*(.*)$`, 'mu'))?.[1]);
-
-// Canonical writers keep a review or gate result in the Artefacts row of the step that produced it
-// (`CR | … | revise`, `QA | … | block`); a Quick Task's Code Review is the CR row. The Run Meta
-// `decision` stays `in_progress` (CR-F02).
-const RESULT_ROWS = Object.freeze({ 'Quick Task Execution': ['CR'] });
-const RESULTS = new Set(['revise', 'block', 'blocked']);
-// The core's decision-content placeholder rule (`isDecisionContentPlaceholder`,
-// decision-content-readiness.js), so a template objective is never shown as the run's goal.
-const PROMPTS = new Set(['describe the trustworthy outcome.', 'what outcome should become possible?',
-  'which tp tasks are fully done, partially done or not done?', 'what remains unverified?', 'which risks remain and what is their impact?']);
-export function isPlaceholderText(value) {
-  if (typeof value !== 'string') return true;
-  const text = value.trim().replace(/^`([^`]+)`$/u, '$1').replace(/\s+/gu, ' ').toLowerCase();
-  return !text || PROMPTS.has(text)
-    || /^(?:todo|tbd|<[^>]+>|(?:draft|done|ready|blocked|pass|revise|block)(?:\s*\|\s*(?:draft|done|ready|blocked|pass|revise|block))+)$/u.test(text);
+// One run-view entry as the companion's run.
+export function companionRun(entry) {
+  return Object.freeze({
+    id: entry.run_id,
+    lifecycle: entry.lifecycle,
+    evaluated: entry.evaluated === true,
+    gate: entry.current_gate ?? null,
+    route: entry.mode ?? null,
+    updatedAt: entry.last_activity ?? '',
+    missing: entry.missing_approval ?? 'none',
+    next: entry.next_step ?? '',
+    nextText: entry.next_step_text ?? '',
+    blockingText: entry.blocking_text ?? '',
+    path: Object.freeze((entry.path ?? []).map(({ gate, status }) => Object.freeze({ gate, status }))),
+    figure: entry.figure,
+    // Bound documents changed after recording (SDD-008), as the run view reports them.
+    drift: Object.freeze((entry.drift ?? []).map(item => Object.freeze({ ...item }))),
+    // The authored objective, never the status card's run title or a template text.
+    objective: clip(entry.objective ?? ''),
+  });
 }
 
-// Returns { ok: true, run } or { ok: false, id, reason } with reason missing | too_large | format.
-// Only version 4 typed records are accepted; retired persisted derived tables are refused.
-export function parseRunState(id, text) {
-  if (typeof text !== 'string') return { ok: false, id, reason: 'missing' };
-  if (text.length > MAX_RUN_STATE_BYTES) return { ok: false, id, reason: 'too_large' };
-  const normalized = text.replace(/^/u, '').replace(/\r\n?/gu, '\n');
-  const meta = section(normalized, 'Run Meta');
-  let projection; try { projection = projectStoredRun(normalized); } catch { return { ok: false, id, reason: 'format' }; }
-  const control = projection.control;
-  const runId = field(meta, 'run_id');
-  const lifecycle = field(meta, 'lifecycle');
-  const gate = control.current_gate;
-  const decision = lifecycle === 'completed' ? 'completed' : 'in_progress';
-  const updatedAt = Number.isNaN(Date.parse(field(meta, 'updated_at'))) ? '' : field(meta, 'updated_at');
-  if (!meta || runId !== id || !KNOWN_LIFECYCLES.has(lifecycle) || !gate) return { ok: false, id, reason: 'format' };
-  const objective = section(normalized, 'Objective').split('\n').map(line => line.trim()).find(Boolean) ?? '';
-  const statuses = new Map([...projection.facts.artefacts].map(([name, row]) => [name, row.status]));
-  const gateResult = (RESULT_ROWS[gate] ?? [gate]).map(type => statuses.get(type)).find(status => RESULTS.has(status)) ?? null;
-  return { ok: true, run: Object.freeze({
-    id,
-    lifecycle,
-    gate,
-    decision,
-    route: projection.route,
-    gateResult,
-    gateDecision: control.presentation_decision?.action ?? null,
-    updatedAt,
-    missing: clip(projection.facts.artefacts.get(gate)?.path || gate === 'UAT' ? control.missing_approval ?? '' : 'none'),
-    next: clip(control.next_allowed_action ?? ''),
-    approved: Object.freeze([...projection.facts.approvals].filter(([, row]) => row.status === 'approved').map(([name]) => name)),
-    objective: isPlaceholderText(objective) ? '' : clip(objective),
-  }) };
+// stdout of the command as a snapshot: { status, root, runs, unreadable, diagnosis, readAt }.
+// status is ok, no_control, unavailable (store diagnosis with reason) or failed (no usable view).
+export function snapshotFromRunView(stdout, { now }) {
+  let view;
+  try { view = JSON.parse(stdout); } catch { return { status: 'failed', runs: [], unreadable: [], readAt: now, error: 'malformed' }; }
+  if (view?.schema_version !== RUN_VIEW_SCHEMA || !Array.isArray(view.runs) || !view.store) {
+    return { status: 'failed', runs: [], unreadable: [], readAt: now, error: 'malformed' };
+  }
+  if (view.store.status === 'unavailable' && TRANSIENT_STORE_REASONS.includes(view.store.reason)) {
+    return { status: 'failed', runs: [], unreadable: [], readAt: now, error: view.store.reason };
+  }
+  // A run read while its files changed (after the run view's bounded retries) makes the view incomplete;
+  // like a transient store failure it keeps the last good view instead of showing that run as blocked.
+  const changedRun = view.runs.find(run => TRANSIENT_STORE_REASONS.includes(run?.evaluation_error));
+  if (changedRun) return { status: 'failed', runs: [], unreadable: [], readAt: now, error: changedRun.evaluation_error };
+  const status = view.store.status === 'ok' ? 'ok' : view.store.status === 'no_control' ? 'no_control' : 'unavailable';
+  return {
+    status,
+    root: view.root,
+    reason: view.store.reason ?? null,
+    // The run folders of an unsupported store, which the run view counts without reading them (AC-002).
+    runFolders: Number.isSafeInteger(view.store.run_folders) && view.store.run_folders > 0 ? view.store.run_folders : null,
+    runs: view.runs.filter(entry => entry.valid !== false && entry.listed !== false).map(companionRun),
+    unreadable: (view.diagnosis?.unreadable ?? []).map(({ run_id, reason }) => ({ id: run_id, reason })),
+    diagnosis: view.diagnosis ?? null,
+    readAt: now,
+  };
 }
 
-// Reads every run state below <projectRoot>/.agdf/control/runs through the injected file access
-// ({ exists, list, read }, as `$.fs` provides). Never writes. A failing directory read is
-// transient (status 'failed'); a single unreadable run state is reported per run. Without a
-// control folder the snapshot names the checked project root, so the panel can say where it looked.
-export async function readSnapshot(fs, projectRoot, { now }) {
-  const runsDir = `${projectRoot}/.agdf/control/runs`;
+// Runs the command through the host and never throws: a process failure, a timeout or malformed
+// output is a failed snapshot with its cause, which the adapter settles as stale.
+export async function readSnapshot(processes, { pluginRoot, root, language, runIds = [], now, clock = () => Date.now() }) {
+  let ran;
+  const started = await clock();
   try {
-    if (!(await fs.exists(`${projectRoot}/.agdf/control`))) return { status: 'no_control', root: projectRoot, runs: [], unreadable: [], readAt: now };
-    if (!(await fs.exists(runsDir))) return { status: 'ok', runs: [], unreadable: [], readAt: now };
-    const folders = (await fs.list(runsDir)).filter(entry => entry.kind === 'dir' && !entry.isLink);
-    const results = await Promise.all(folders.map(folder => fs.read(`${runsDir}/${folder.name}/RUN_STATE.md`)
-      .then(text => parseRunState(folder.name, text), () => ({ ok: false, id: folder.name, reason: 'missing' }))));
-    return {
-      status: 'ok',
-      runs: results.filter(result => result.ok).map(result => result.run),
-      unreadable: results.filter(result => !result.ok).map(({ id, reason }) => ({ id, reason })),
-      readAt: now,
-    };
-  } catch (error) {
-    return { status: 'failed', runs: [], unreadable: [], readAt: now, error: String(error?.message ?? error).slice(0, TEXT_LIMIT) };
+    ran = await processes.run(runViewArgv({ pluginRoot, root, language, runIds }), { timeoutMs: RUN_VIEW_TIMEOUT_MS });
+  } catch {
+    // `$.process.run` rejects when the command cannot start or is still running at the timeout; its
+    // message format is not specified, so the elapsed time tells the two apart (CR finding CIR-06).
+    const elapsed = (await clock()) - started;
+    return { status: 'failed', runs: [], unreadable: [], readAt: now, error: elapsed >= RUN_VIEW_TIMEOUT_MS ? 'timeout' : 'unavailable' };
   }
+  if (ran.exitCode !== 0 && ran.exitCode !== 2) return { status: 'failed', runs: [], unreadable: [], readAt: now, error: 'exit' };
+  return snapshotFromRunView(ran.stdout, { now });
 }
 
 // A transient failure keeps the last good snapshot, marked stale with the failed read time (AC-006).

package/generated/plugins/agdf/companion/state.mjs

@@ -1,37 +1,11 @@
-// State rules (AC-003, AC-002 of the follow-up): which of the five moods a run shows and why, as a
-// reason descriptor the view localizes. A run matching no rule is reported unreadable rather than
-// guessed (SDD-04).
+// Figure state of a run (SD SDD-004): the Core run view carries the derived mood and reason, so the
+// companion only overlays its own turn activity. It derives no run semantics itself.
 
-import { BUILD_GATES, isStructured } from './run-state.mjs';
+export const MOODS = Object.freeze(['laeuft', 'baut', 'wartet', 'blockiert', 'fertig', 'bereit']);
 
-export const MOODS = Object.freeze(['laeuft', 'baut', 'wartet', 'blockiert', 'fertig']);
-const BLOCKING = new Set(['revise', 'block', 'blocked', 'decline']);
-const AWAITING = new Set(['pending', 'awaiting_uat']);
-const WORKING = new Set(['in_progress', 'pass', 'qa_approved', 'completed']);
-
-// The gate a pending approval names, as in "Exact Approval: QA." or "Exact Approval: PRD for the new revision."
-export const pendingApproval = missing => String(missing ?? '').match(/\bApproval: (UR|PRD|SD|TP|QA|UAT|OR)\b/u)?.[1] ?? null;
-
-// The blocking outcome of a run: a legacy Run Meta decision, the current gate's recorded result
-// (`revise`, `block`, `blocked`) or a deliberate decision on its presented material.
-function blockingOutcome(run) {
-  if (BLOCKING.has(run.decision)) return run.decision;
-  if (run.gateResult) return run.gateResult;
-  return { reject: 'decline', request_change: 'revise' }[run.gateDecision] ?? null;
-}
-
-// { mood, reason: { key, gate?, decision? } } or { mood: null, reason: { key: 'unknownState' } }.
-// A structured run between an approved TP and QA (Brownfield Analysis, CD+Tests, CR) is being built.
+// { mood, reason: { key, gate?, decision?, reason? } } as the run view derived it.
 export function runState(run) {
-  if (run.lifecycle === 'completed') return { mood: 'fertig', reason: { key: 'done' } };
-  const outcome = blockingOutcome(run);
-  if (outcome) return { mood: 'blockiert', reason: { key: 'blocked', gate: run.gate, decision: outcome } };
-  const approval = pendingApproval(run.missing);
-  if (approval) return { mood: 'wartet', reason: { key: 'waitingApproval', gate: approval } };
-  if (AWAITING.has(run.decision)) return { mood: 'wartet', reason: { key: 'waitingDecision', gate: run.gate } };
-  if (WORKING.has(run.decision) && isStructured(run.route) && BUILD_GATES.includes(run.gate)) return { mood: 'baut', reason: { key: 'building', gate: run.gate } };
-  if (WORKING.has(run.decision)) return { mood: 'laeuft', reason: { key: 'working', gate: run.gate } };
-  return { mood: null, reason: { key: 'unknownState' } };
+  return run?.figure ?? { mood: 'bereit', reason: { key: 'idle' } };
 }
 
 // Moods a main-loop turn does not cover: a run being built stays baut, and a run waiting for an
@@ -43,6 +17,6 @@ const THROUGH_TURN = new Set(['baut', 'wartet']);
 // the turn.
 export function displayState(run, { isTurnActive = false } = {}) {
   const derived = runState(run);
-  if (isTurnActive && derived.mood !== null && !THROUGH_TURN.has(derived.mood)) return { mood: 'laeuft', reason: { key: 'turnActive' } };
+  if (isTurnActive && !THROUGH_TURN.has(derived.mood)) return { mood: 'laeuft', reason: { key: 'turnActive' } };
   return derived;
 }

package/generated/plugins/agdf/companion/view.mjs

@@ -5,53 +5,73 @@
 import { assignRun } from './assignment.mjs';
 import { FIGURE_TEXT } from './figure.mjs';
 import { condensedGateBar, gateBar, gateMarks } from './gate-bar.mjs';
-import { gateTitle, label, localizeNextStep } from './localization.mjs';
+import { gateTitle, label } from './localization.mjs';
 import { displayState } from './state.mjs';
+import { READ_FAILURE_REASONS } from './run-state.mjs';
+import { eventText, latestReview, PANE_EVENTS, shortDigest } from './events.mjs';
 
 const two = value => String(value).padStart(2, '0');
+// Preview lines the terminal text shows beneath the material line.
+export const TERMINAL_PREVIEW_LINES = 3;
 // Last part of a project root in either path form ("C:\Work\app\" → "app").
 const folderName = root => String(root ?? '').replace(/[\\/]+$/u, '').split(/[\\/]/u).pop() || String(root ?? '');
 // Host-local wall-clock time, HH:MM.
 export const clockText = ms => { const at = new Date(ms); return `${two(at.getHours())}:${two(at.getMinutes())}`; };
 
 // input: { snapshot, sessionStartedAt, selection, mention, isBrowsing, isTurnActive, registry, labels,
-// locale, columns, isObjectiveExpanded }. Display only: the adapter persists selection changes.
+// locale, columns, isObjectiveExpanded, events, eventsAvailable }. Display only: the adapter persists
+// selection changes. `events` are this root's journal events since the last main-loop turn, newest first.
 export function buildPanelView(input) {
   const { snapshot, registry, labels, locale } = input;
   const t = (path, params) => label(labels, locale, path, params);
-  const base = { title: t('title'), locale, mood: 'neutral', stateLabel: t('states.neutral'),
+  const base = { title: t('title'), locale, mood: 'bereit', stateLabel: t('states.bereit'),
     readAt: snapshot ? t('fields.lastRead', { time: clockText(snapshot.readAt) }) : null,
     stale: snapshot?.stale ? t('messages.stale', { time: clockText(snapshot.stale.failedAt), readAt: clockText(snapshot.readAt) }) : null,
     canRetry: true, openRuns: [] };
-  const neutral = (message, extra = {}) => ({ ...base, message, ...extra });
+  // Event lines name only runs other than the shown one (owner request of 2026-11-06, T-013).
+  const events = shownRunId => eventFields(input, t, { shownRunId, runs: snapshot?.runs ?? [] });
+  const neutral = (message, extra = {}) => ({ ...base, ...events(null), message, ...extra });
   const unreadable = reason => neutral(t('messages.unreadable', { reason: t(`unreadable.${reason}`) }));
 
   if (!snapshot) return neutral(t('messages.reading'), { readAt: null });
-  if (snapshot.status === 'failed') return unreadable('failed');
+  if (snapshot.status === 'failed') {
+    const reason = READ_FAILURE_REASONS.includes(snapshot.error) ? snapshot.error : 'unavailable';
+    return neutral(t('messages.runViewUnavailable', { reason: t(`unreadable.${reason}`) }));
+  }
+  if (snapshot.status === 'unavailable') {
+    // An unsupported store names how many run folders it holds and why none is readable (AC-002).
+    const reason = snapshot.reason ?? 'read_failed';
+    return snapshot.runFolders
+      ? neutral(t('messages.unreadableRuns', { count: snapshot.runFolders, reasons: t(`unreadable.${reason}`) }))
+      : unreadable(reason);
+  }
   if (snapshot.status === 'no_control') {
     return neutral(t('messages.noControl', { folder: folderName(snapshot.root) }), { hint: t('messages.noControlHint', { path: snapshot.root ?? '' }) });
   }
 
   const { run, origin, open, chatRunId } = assignRun({ runs: snapshot.runs, sessionStartedAt: input.sessionStartedAt, selection: input.selection,
     mention: input.mention ?? null, isBrowsing: Boolean(input.isBrowsing) });
+  // Unreadable runs stay visible as a count with their reasons beside the readable ones (AC-002, AC-003).
+  const reasons = [...new Set(snapshot.unreadable.map(item => t(`unreadable.${item.reason}`)))].join(', ');
+  const unreadableHint = snapshot.unreadable.length ? t('messages.unreadableRuns', { count: snapshot.unreadable.length, reasons }) : null;
   // Each open run carries its condensed gate bar for the list (owner request of 2026-10-28).
   const openRuns = open.map(item => ({ id: item.id, objective: item.objective, bar: condensedGateBar(gateMarks(item)) }));
   if (!run) {
     const broken = input.selection && snapshot.unreadable.find(item => item.id === input.selection);
-    if (broken) return { ...unreadable(broken.reason), openRuns, chatRunId };
-    if (!open.length) return neutral(t('messages.noOpenRuns'));
-    return neutral(t('messages.noRunAssigned'), { hint: t('messages.noRunAssignedHint'), openRuns, chatRunId,
+    if (broken) return { ...unreadable(broken.reason), openRuns, chatRunId, unreadableHint };
+    if (!open.length) return neutral(unreadableHint ?? t('messages.noOpenRuns'));
+    return neutral(t('messages.noRunAssigned'), { hint: t('messages.noRunAssignedHint'), openRuns, chatRunId, unreadableHint,
       openCount: t('fields.openRuns', { count: open.length }) });
   }
 
   const position = open.findIndex(item => item.id === run.id);
   const openCount = position >= 0 ? t('fields.position', { position: position + 1, count: open.length }) : t('fields.openRuns', { count: open.length });
   const state = displayState(run, { isTurnActive: input.isTurnActive });
-  // A run in an unknown state keeps stepping and the way back to the chat's run (CR-F01).
-  if (state.mood === null) return { ...unreadable('unknownState'), runId: run.id, openRuns, chatRunId, openCount };
-  const reasonParams = { gate: gateTitle(registry, locale, state.reason.gate), decision: t(`decisions.${state.reason.decision}`) };
+  const reasonParams = { gate: gateTitle(registry, locale, state.reason.gate), decision: run.blockingText || state.reason.decision,
+    reason: state.reason.reason ? t(`unreadable.${state.reason.reason}`) : '' };
   return {
     ...base,
+    ...events(run.id),
     mood: state.mood,
     stateLabel: t(`states.${state.mood}`),
     reason: t(`reasons.${state.reason.key}`, reasonParams),
@@ -59,12 +79,28 @@ export function buildPanelView(input) {
     runId: run.id,
     objective: run.objective,
     isObjectiveExpanded: Boolean(input.isObjectiveExpanded),
-    nextStep: run.lifecycle === 'completed' ? null : localizeNextStep(registry, locale, run.next).text,
+    nextStep: run.lifecycle === 'completed' ? null : run.nextText || null,
+    unreadableHint,
     origin: t(`origin.${origin}`),
     originKind: origin,
     chatRunId,
     openRuns,
     openCount,
+    drift: run.drift?.length ? run.drift.map(item => t('messages.drift', { document: item.document,
+      recorded: shortDigest(item.recorded_digest), current: shortDigest(item.current_digest) })) : null,
+  };
+}
+
+// Pane entries of the journal (decision P1) and the review facts of the newest staging or recording
+// (decision P2); without a readable journal the pane says so and invents nothing. `naming` is
+// { shownRunId, runs }: the shown run's events name no run.
+function eventFields(input, t, naming) {
+  const events = (input.events ?? []).slice(0, PANE_EVENTS);
+  const gate = value => gateTitle(input.registry, input.locale, value);
+  return {
+    events: events.length ? events.map(event => `${clockText(Date.parse(event.at))} ${eventText(event, t, { gateTitle: gate, ...naming })}`) : null,
+    review: latestReview(events, t),
+    eventsHint: input.eventsAvailable === false ? t('messages.eventsUnavailable') : null,
   };
 }
 
@@ -74,10 +110,19 @@ export function terminalText(view, { labels, locale }) {
   const lines = [view.title, `${FIGURE_TEXT[view.mood]} ${view.stateLabel}${view.reason ? ` · ${view.reason}` : ''}`];
   if (view.message) lines.push(view.message);
   if (view.hint) lines.push(view.hint);
+  if (view.unreadableHint && view.unreadableHint !== view.message) lines.push(view.unreadableHint);
   if (view.gateBar) lines.push(view.gateBar);
   if (view.runId) lines.push(view.origin ? `${view.runId} · ${view.origin}` : view.runId);
   if (view.objective) lines.push(`${t('fields.objective')}: ${view.objective}`);
   if (view.nextStep) lines.push(`${t('fields.nextStep')}: ${view.nextStep}`);
+  for (const warning of view.drift ?? []) lines.push(warning);
+  if (view.events) lines.push(`${t('fields.events')}:`, ...view.events);
+  if (view.review) {
+    lines.push(`${t('fields.material')}: ${view.review.summary} · ${view.review.match}${view.review.truncated ? ` · ${view.review.truncated}` : ''}`);
+    // The terminal shows the start of the preview too (PRD M1, AC-007; CR finding B10).
+    if (view.review.preview) lines.push(...view.review.preview.split('\n').slice(0, TERMINAL_PREVIEW_LINES).map(line => `  ${line}`));
+  }
+  if (view.eventsHint) lines.push(view.eventsHint);
   if (view.stale) lines.push(view.stale);
   if (view.readAt) lines.push(view.readAt);
   return lines.join('\n');

package/generated/plugins/agdf/control/README.md

@@ -11,6 +11,7 @@ Explicit initialization creates `control_layout: "run-folders-v1"`. This is the
   SOT_REGISTRY.md
   CONTEXT_GRAPH.md
   AGENT_QUALITY_CONTRACTS.json
+  BRAND.md
   templates/
   planned/<plan_id>/UR.md
   runs/<run_id>/
@@ -28,6 +29,10 @@ Explicit initialization creates `control_layout: "run-folders-v1"`. This is the
 
 Configuration, templates and curated project context stay project-wide. A multi-Run closure preview is a target-wide decision proposal under `closure-previews/`; it changes no Run until deliberately applied. Run-owned outputs never use a separate top-level artefacts directory.
 
+`BRAND.md` starts as a neutral English worksheet. Complete it with the project's
+own design intent and declare the finished source in `SOT_REGISTRY.md` when it is
+authoritative for design work.
+
 `RUN_STATE.md` keeps identity, objective, mode and typed decisions, source bindings and operations. Approval status, current gate, current document references, relationship chains, evidence summaries and inventory are derived when read. They are not separately writable tables or a second state file. A binding embeds its reviewer attestation; no separate RECORD/REVIEW JSON repeats its mapping. A planned handoff records its source in the creation receipt and immutable planning snapshot, without an origin JSON copy.
 
 Create a fresh scaffold in an explicitly confirmed existing Git repository:

package/generated/plugins/agdf/control/templates/BRAND.md

@@ -0,0 +1,28 @@
+# Brand and Design Intent
+
+Complete this worksheet with confirmed project decisions. Declare the completed
+profile in `SOT_REGISTRY.md` when it is the project's authoritative design source.
+
+## Owner and scope
+
+Name the accountable owner, the product, and the surfaces and audiences covered.
+
+## Design intent
+
+Describe what people should understand, feel, or be able to do when using the
+product. Tie each priority to a concrete user task or situation.
+
+## Information and visual priorities
+
+Explain what deserves emphasis in relevant states and how the project balances
+competing priorities. Record any confirmed constraints and their sources.
+
+## Observable checks
+
+For each applicable priority, name the scenario, the expected observable outcome,
+and the evidence that would verify it. Record open decisions with their owners.
+
+## Related sources
+
+Link the project's design system, implementation values, and brand usage policy
+where applicable.

package/generated/plugins/agdf/control/templates/artefacts/PRD.md

@@ -69,6 +69,17 @@ visible feedback, blocker/failure behavior, recovery/next action, observable suc
 evidence. Specify observable behavior, not implementation. Do not leave the section empty or retain
 placeholders when requesting approval.
 
+Use separate field names; never combine them (for example,
+`observable_success_required_evidence` is not `observable_success`). For same-language approval,
+each criterion needs at least one nonempty `observable_success`, `visible_feedback` or
+`expected_effective_state`. Keep applicable UX fields separate as well. Example:
+
+```markdown
+- criterion_id: AC-001
+  - observable_success: A later list command shows the saved task unchanged.
+  - required_evidence: A real CLI test across separate processes.
+```
+
 ## 6. Non-Goals
 
 What remains out of scope?

package/generated/plugins/agdf/control/templates/artefacts/SD.md

@@ -25,6 +25,10 @@ Use stable IDs. If no binding design decision is needed, record one reasoned bul
 When a decision selects or changes external technology (framework, library, API, protocol,
 service or major version), name the checked authoritative source, version and check date in its
 rationale.
+Quoted CLI arguments such as `done <id>` are literal syntax. In a decision clause, a labelled
+inline JSON schema/example may use quoted type metavariables such as `"<uuid>"` and
+`"<non-empty string>"`; keep actual choices, rationale and consequence concrete. The complete
+notation and unresolved-prompt boundary are defined in `meta/contracts/sd-definition.md`.
 
 ## 4. Integration Points
 

package/generated/plugins/agdf/control/templates/artefacts/UX_INTENT_DEFINITION.md

@@ -1,7 +1,7 @@
 # UX Intent Definition: <Title>
 
 Status: draft | ready | blocked | not_applicable
-Decision: ready | blocked | not_applicable
+- decision: ready | blocked | not_applicable
 Based on: approved UR and post-UR routing evidence
 Date:
 Owner:

package/generated/plugins/agdf/mcp/server/README.md

@@ -85,8 +85,18 @@ Unknown/unowned partial states remain blocked. Successful setup returns creation
 `agdf_run/run.create` creates an unapproved Run from a semantic title and original operation UUID;
 pre-Run `operation-status` resolves a lost response without inventing a second Run.
 `authoring-inputs` returns versioned templates and exact sources with bounded cursors.
-`agdf_record/material.stage` transfers at most 16 KiB per part and 128 KiB per file, then seals
-Core-owned references for existing typed writers, including reviewed formal artefacts, unapproved
+`authoring-inputs.material_call` supplies a bound form: fill its UTF-8 content and use
+`agdf_record/material.stage` action `put` to seal files of at most 48 KiB each within the 64 KiB whole JSON request bound in one call.
+The Core computes byte counts, material identities and digests. Larger files retain the bounded
+multipart path (16 KiB per part, 128 KiB per file). Each multipart action has its own operation UUID;
+only an identical retry reuses a UUID. Returned `recording_calls` provide the binding and material
+reference; fill only the listed author/review fields. Ready `next_calls` are executable as supplied;
+do not add intake/revision fields to a supplied `continue_delivery` dispatch.
+Pass authored Markdown as UTF-8 string data through structured input. If a host uses JavaScript,
+author with its file-editing tool and pass the UTF-8 file read as the content value; embedding
+the whole document in a backtick literal makes Markdown syntax executable JavaScript syntax.
+This guidance adds no server-side file reader and changes no byte or input limit.
+These Core-owned references feed existing typed writers, including reviewed formal artefacts, unapproved
 UR replacement, Verified Change and closeout. Code edits, actual tests and Git execution remain
 external work; none of these operations grants approval.
 
@@ -246,3 +256,17 @@ They do not qualify an installed host or another OS. The fixed performance test
 the actual owned plugin launcher with 20/20 samples and p95 limits of 2500 ms cold /
 1000 ms warm. Performance acceptance and native qualification are separate
 required evidence, not consequences of the topology declaration.
+
+The normal MCP path is `next_action.call`: either a ready call forwarded unchanged or a form with named `required_inputs` such as `content`, `title`, `reviewer`, `reviewed` or `response`. The adapter maps those names to the stored canonical payload fields. It retains the original target, Run, revision, permission group and operation UUID; it never fills authored content, review attestations or approval replies. The former competing `submit` form is absent. Raw requests remain accepted for compatibility, but the full original request is exposed only under the explicit `recovery_only` branch, with the exact field map and original UUID. Retain that branch and the actual submitted inputs for uncertain-outcome recovery; do not generate a replacement identity.
+
+Verified owned plugin launchers retain offered templates in a private bounded journal under their existing MCP data root. The namespace includes the serving surface, version and server/dispatcher/SDK identity. A reconnect at that same identity can resolve the original reference without a new UUID or refreshed revision. The original 30-minute lifetime is never renewed. No submitted author/review/reply inputs or execution receipts are added to this journal; it is transport storage, not canonical Run State or authority. Direct transports without this verified owner remain connection-local. Private material buffers have their separate existing generation lifetime and still require exact semantic-byte recovery after generation loss.
+
+Empty, malformed, unknown and known-expired references remain distinct. An unavailable live reference returns `prepared_call_unknown`, rather than blaming the authored command schema. Store failures are distinguished from missing references. A failed publication of a future reference never discards an already successful operation receipt; its exact original request remains in recovery. Every restored call still passes the current SDK, permission-group, Core and revision checks.
+
+For a unique Core-supplied normal next step, the adapter may execute one exact `agdf_inspect` call for `authoring-inputs`, `gate-check` or `operation-contract` and include it as `next_read.result`. `next_action.context_path` names that already-loaded context. The original operation outcome and receipt remain intact if this separate read fails. No dispatch, write, presentation or approval is chained automatically; `agdf_dispatch` is not read-only. Source pagination remains explicit. Internal read attempts/failures are accounted separately from outer MCP invocations in native observations.
+
+`authoring-inputs` supports `bundle:true` for bounded multi-document pages. Read every chunk and cursor without a duplicate writer-contract lookup. A retained first-page form is reusable only for the same exact manifest and an available connection reference; otherwise use the supplied first-page read. Page transport does not prove source review.
+
+Prepared references also retain explicitly offered `agdf_inspect` reads, including source pages, contract help and original-operation status. Read inputs stay `{}`; the original SDK schema validates the complete supplied request before registration. Target, Run, revision, cursor and original status selection are never inferred or refreshed. The actual `next_read.tool/arguments` remain the record of an already executed read; its separate `next_read.call` is the exact prepared retry. Explicit recovery reads remain Raw for reconnect, and dispatch retains its original schema. No reference changes permission or bypasses canonical validation.
+
+Bundled authoring reports use `document_bundle_v2`: `documents` contains complete text, `document_manifest` is metadata only, and `fragments` must be joined by identity and byte offsets across all cursors before editing. Missing content must never be coerced into a replacement string.

package/generated/plugins/agdf/mcp/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agdf/mcp-server",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "Local MCP adapter for version-matched AGDF dispatch and control inspection.",
   "type": "module",
   "files": [
@@ -22,7 +22,7 @@
   "scripts": {
     "test:contract": "node ./test/worker-build.test.js && node ./test/contract.test.js",
     "test:continuation": "node ./test/continuation.test.js",
-    "test:protocol": "node ./test/defaulted-inputs.test.js && node ./test/protocol.test.js && node ./test/ergonomics.test.js && node ./test/skill-names.test.js && node ./test/tool-errors.test.js && node ./test/doctor-observation.test.js",
+    "test:protocol": "node ./test/defaulted-inputs.test.js && node ./test/protocol.test.js && node ./test/ergonomics.test.js && node ./test/skill-names.test.js && node ./test/tool-errors.test.js && node ./test/pre-dispatch-failure.test.js && node ./test/companion-journal.test.js && node ./test/doctor-observation.test.js && node ./test/prepared-call-transport.test.js && node ./test/prepared-call-journal.test.js && node --test ./test/next-action.test.js && node ./test/safe-read-continuation.test.js && node ./test/prepared-submission.test.js && node ./test/prepared-reads.test.js && node ./test/prepared-reconnect.test.js",
     "test:safety": "node ./test/safety.test.js && node ./test/worker-lock-release.test.js && node ./test/worker-deadline.test.js",
     "test:cockpit-gating": "node ./test/cockpit-gating.test.js",
     "test:provenance": "node ./test/provenance.test.js",
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.0.0",
-    "create-agdf": "0.30.0"
+    "create-agdf": "0.31.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "2.0.0"

package/generated/plugins/agdf/mcp/server/src/generation-runtime.js

@@ -12,6 +12,11 @@ export function startGenerationRuntime({ epoch, generation, channel }) {
     return { ...owned, inflight: inflight + (starting ? 1 : 0) + (owned.inflight ?? 0),
       executor: executor?.active ? 1 : 0, uncertain: unknown.size + (owned.uncertain ?? 0), closing };
   }
+  // Companion events (SD SDD-006): this generation executed the call, so it journals the final result
+  // once, before the result leaves; a failing journal never changes or delays the result.
+  function journal(name, args, projected) {
+    try { runtime.observeOutcome?.(name, args, projected); } catch { /* notification only */ }
+  }
   function send(input, kind, payload) {
     const reply = generationMessage(epoch, generation, kind, payload, {}, input.original_operation_id, input.request_id);
     if (validGenerationMessage(reply, { epoch, generation, reply: true })) channel.send(reply);
@@ -76,11 +81,15 @@ export function startGenerationRuntime({ epoch, generation, channel }) {
           if (input.original_operation_id && result.outcome === 'effect_unknown') unknown.add(input.original_operation_id);
           if (name === 'agdf_inspect' && args.operation === 'operation-status' && result.report?.status === 'recorded'
             && (result.report.receipt?.operation_id ?? result.report.receipt?.operation?.operation_id) === args.module.split('/').at(-1)) unknown.delete(args.module.split('/').at(-1));
-          send(input, 'result', runtime.projectToolResult(name, args, result));
+          const projected = runtime.projectToolResult(name, args, result);
+          journal(name, args, projected);
+          send(input, 'result', projected);
         } catch (error) {
           const facts = runtime.normalizeFailure(error, { phase });
           if (input.original_operation_id && facts.dispatch !== 'not_dispatched') unknown.add(input.original_operation_id);
-          send(input, 'result', runtime.projectToolResult(name, args, runtime.failure(facts.code, name, args, { ...facts, elapsed_ms: performance.now() - started }), facts));
+          const projected = runtime.projectToolResult(name, args, runtime.failure(facts.code, name, args, { ...facts, elapsed_ms: performance.now() - started }), facts);
+          journal(name, args, projected);
+          send(input, 'result', projected);
         } finally { --inflight; }
       }
     } catch (error) { if (input.kind === 'qualify') starting = false; send(input, 'failure', { reason: generationFailureReason(error) }); }

package/generated/plugins/agdf/mcp/server/src/main.js

@@ -73,6 +73,7 @@ export async function runMcpServer({ surface, cockpitDir, cockpitMode, runtime,
   const handle = serveAgdfStdio({
     runtime,
     executor: dispatchExecutor,
+    preparedCallStore: ownedPublication ? ownedPublisher?.preparedCallStore?.({ surface }) : undefined,
     onerror(code) {
       process.stderr.write(`${code}\n`);
     },