Make `xmd plan` authorship observable during and after an invocation

[taras]

Story

As an operator, I want visible progress while xmd plan authors a program and
an optional diagnostic journal when I need lasting evidence, so a long or failed
planning invocation is understandable without contaminating the approved source.

Common paths

Ordinary planning reports readable Markdown progress on stderr while stdout
remains reserved for exact approved XMD source:

xmd plan "Prepare the release program." > release.md

Long-form verbose presentation adds generated drafts and structured XMD check
diagnostics after secret detection clears them:

xmd plan "Prepare the release program." --verbose

An exclusive authorship journal preserves diagnostic evidence:

xmd plan "Prepare the release program." --journal plan-authorship.jsonl

--verbose and --journal describe authorship only. They never observe a later
program execution because #724 makes xmd plan source-only.

Live presentation

The phase prose is authored in the packaged Plan.md beside the control flow it
describes. A private command-only presentation component emits it only for the
xmd plan surface. On the ordinary component surface it returns before
expanding its content.

Default progress covers:

• getting the available XMD components and constructs and preparing the
  planning session;
• drafting the Plan, with the current attempt shown separately;
• checking and repairing a draft, including the bounded repair count;
• waiting for human review;
• revising after requested changes;
• closing the planning session and producing the final Plan from the approved
  draft;
• authored Stop; and
• the automatic final explanation already owned by Make <Plan> emit or capture approved XMD source #722 when the tenth invalid
  attempt exhausts its repairs.

Every phase appears before the potentially long operation it describes. The
host drains the command document's output while the producer is alive,
normalizes the Markdown prose, and applies terminal formatting only when stderr
is a TTY. Non-TTY stderr receives normalized Markdown progressively rather than
one synthesized report at the end.

Default progress never includes the request, draft source, diagnostics, review
feedback, Agent output, tool or provider output, or approved program source.
Approval and finalization may be reported when they occur, but presentation does
not claim stdout or --output delivery before final host validation and the
artifact sink succeed.

The command adapter renders no incidental prose. Ordinary bare <Plan> emits
only exact approved source, captured <Plan as="…"> binds those bytes and emits
nothing, and neither receives command progress.

Verbose authorship presentation

Only the long --verbose spelling is accepted. It adds two command-only blocks
to stderr:

• each generated draft after its Agent turn; and
• the exact structured diagnostics after a failed XMD draft check.

Both are provisional authorship material, never stdout or --output content.
They do not add the request, review feedback, tool output, provider chatter, or
approved source as separate presentation.

Verbose material is emitted only after the durable event that supplied it
passes the existing secret-detection boundary and commits. A rejected Agent
result or draft-check result creates no binding, so the private presentation
call holding that draft or diagnostics is never reached. The rejected material
is neither displayed nor persisted. Authorship fails, its complete scope tears
down, and no approved source reaches stdout or --output.

Help says:

--verbose show generated drafts and XMD check diagnostics on stderr

The removed -V alias remains unsupported.

Authorship journal and secret detection

Only the long --journal <path> spelling is accepted. The host exclusively
creates that path before authorship and selects either its file-backed
DurableStream or a fresh in-memory stream when no journal was requested. It
passes that selected stream to the plan-command executeInstalled() call with
secret detection enabled.

Every live durable event crosses useSecretDetection() and its pre-append
serialized-event gate before the selected stream receives it. A cleared event is
appended in ordinary execution order. A rejected event is absent from the file
and the in-memory committed sequence, while every earlier complete JSONL entry
remains readable. Rejection fails authorship after complete teardown and writes
no approved source.

The journal is the existing raw durable-event sequence, not a curated or
separately versioned projection. It includes cleared Agent turns, draft checks,
review decisions, admission, and the terminal outcome that commits. It contains
no later program-execution events. xmd plan never opens the file as replay
input and the journal grants no resume authority.

A pre-existing journal path refuses before planning begins. A write failure
after authorship begins fails the invocation and leaves the previously committed
prefix readable. An invocation without --journal creates no diagnostic file.

Help says:

--journal <path> record the planning process as diagnostic JSONL (path must not exist)

Secret detection checks journal entries before they are recorded, but it may not catch every sensitive detail. The journal can contain prompts, drafts, and review answers.

The removed -j alias remains unsupported.

Failure and teardown

Presentation consumption remains inside the command-document execution scope. A
stderr write failure stops consumption, cancels the producer, and completes all
provider, Prompt, Elicitation, session-directory, and execution teardown before
the command returns nonzero. It never attempts stdout or --output afterward;
stderr bytes already accepted by the host are not rolled back.

Cancellation, teardown failure, journal rejection, journal write failure, final
host validation failure, and artifact-sink failure retain their ordinary
diagnostics. No presentation claims final delivery before it succeeds.

Acceptance

• A slow successful invocation presents the phases progressively on stderr while
  stdout or --output receives only byte-identical approved source.
• Draft and repair ordinals remain correct through repair and requested-change
  revisions.
• Non-TTY stderr receives normalized Markdown; a stderr TTY receives terminal
  formatting.
• The Make <Plan> emit or capture approved XMD source #722 automatic explanation is presented with no final invalid-draft
  Elicitation and no Plan afterward.
• Cleared --verbose drafts and structured diagnostics appear in phase order on
  stderr and nowhere in the artifact.
• A secret-containing verbose draft or diagnostic is neither displayed nor
  appended; rejection completes teardown and produces no Plan.
• --journal exclusively creates the diagnostic file before the first Agent
  turn and preserves a readable committed prefix after success, ordinary
  failure, write failure, and secret-detection rejection.
• A rejected journal event is absent, and the journal contains no later
  program-execution events.
• No-journal planning creates no diagnostic file.
• Ordinary bare and captured <Plan> remain free of command presentation.
• Existing exact-source, output exclusivity, cancellation, teardown, and sink
  failure behavior remains unchanged.

Documentation and focused evidence

Add the presentation, verbose, secret-detection, and authorship-journal contract
to specs/plan-command-spec.md and the host/authorship lifecycle in
architecture.md. Update the affected command lifecycle and <Plan> sections
of specs/executable-mdx-spec.md, CLI grammar and help, and the relevant
component and command inventory. Preserve #722's post-teardown admission order
and #724's source-only command.

Focused feedback evidence:

deno task test \
 packages/cli/tests/plan-cli.test.ts \
 packages/cli/tests/plan-component.test.ts \
 packages/cli/tests/plan-command-document.test.ts

The command-document suite owns progressive phase order, ordinals, verbose
blocks, and the automatic-explanation presentation. The component suite owns
the ordinary bare/captured negative controls. The CLI suite owns stderr/stdout
separation, TTY choice, grammar, journal creation and prefixes, secret rejection,
cancellation, teardown, and artifact-sink failures.

Add packages/cli/tests/plan-args.test.ts,
packages/cli/tests/syntax-cli.test.ts, and
packages/cli/tests/packaged-document.test.ts to the focused command when the
grammar, help, or packaged private declaration changes. Add a shared output- or
secret-middleware suite only if implementation changes that shared boundary;
using the existing boundary requires only Plan integration evidence.

After the focused cases pass, create the feedback commit and return its exact SHA
with every focused command run. Then run deno task test --changed=origin/main
on that revision. Do not wait for CI for feedback review.

Dependencies

• Make <Plan> emit or capture approved XMD source #722 first supplies the exact text component and the automatic final
  explanation as settled Plan behavior. Its amended contract requires a new
  feedback commit; ebb7e57760b4cbe7781ae08bd32b53209484110e is not accepted
  evidence for it.
• Add standard-input programs to xmd run #723 supplies explicit stdin execution.
• Make xmd plan produce approved XMD source only #724 removes implicit execution and every former execution-only spelling from
  xmd plan. This story then introduces the long authorship --verbose and
  --journal options together with their behavior.

Planning and prompt-quality review may proceed before those dependencies land.
Implementation starts from the exact accepted #724 head or merged result. This
story remains a related follow-up and does not block #725.

Out of scope

• Implicit or automatic execution of approved source.
• Public progress syntax or ordinary <Plan> presentation.
• Draft or diagnostic presentation without long-form --verbose.
• Authorship replay, resume, or a stable diagnostic projection.
• Changing post-teardown Plan admission.
• New XMD language primitives.
• Unrelated Quest: Preserve planned XMD programs for explicit execution #725 work.

[taras]

Planner handoff: live authorship presentation and journal

Implement only after the amended #722 contract has a new accepted result, #723
is delivered, and the exact #724 feedback head or merged result is known. Start
from that exact #724 revision in a clean worktree. The earlier #722 feedback
commit ebb7e57760b4cbe7781ae08bd32b53209484110e is not an accepted dependency.

Exact presentation copy

Keep the phase copy in the packaged Plan.md beside the operation it precedes.
Bind the maximum 10 Plan attempts and 3 repairs once, derive conditions and
messages from them, and render human ordinals (1st through 10th) in the
supporting paragraphs.

Before Plan inputs and catalog preparation:

## Preparing the Plan

Getting the available XMD components and constructs and setting up the planning session.

Before the first or a newly generated Plan attempt:

## Drafting the Plan

The coding agent is turning your request into an XMD program.

This is the {ordinal} of up to 10 attempts.

After a cleared Agent result, only under --verbose:

## Generated draft

The coding agent produced this draft:

```markdown
{draft}
```

Before every draft check:

## Checking the draft

Checking that it is valid XMD and uses the available components and constructs correctly.

After a cleared invalid check, only under --verbose:

## Problems found in the draft

The XMD check found these problems:

```json
{diagnostics}
```

Before each repair Agent turn:

## Repairing the draft

The coding agent is correcting problems found by the XMD check.

This is the {repair ordinal} of up to 3 repairs for the current Plan attempt.

Before each actionable human review:

## Waiting for your review

Review the draft and choose what should happen next.

Before a requested-change Agent turn:

## Revising the Plan

The coding agent is applying the changes you requested.

This is the {next ordinal} of up to 10 attempts.

After approval and before authorship teardown:

## Finalizing the Plan

Closing the planning session and producing the final Plan from the approved draft.

Do not add a separate post-teardown validation or “Plan produced” message.
<AdmitPlan> remains the existing fail-closed integrity and retention gate after
the session closes; its failure receives the ordinary diagnostic and no source.

Before authored Stop teardown:

## Stopping planning

Closing the planning session without producing a Plan.

Its final diagnostic is:

xmd plan stopped at your request. Nothing was output.

The amended #722 workflow owns the automatic final explanation. #676 presents
its already-settled turn before it begins:

## Could not generate a Plan

The draft still has problems after 10 attempts. The coding agent is reviewing why planning was unsuccessful and how to improve the outcome of a future attempt.

The #722 failure then reports:

xmd plan could not generate an approved Plan after 10 attempts.

The coding agent explained why planning was unsuccessful and how to improve the outcome:

{explanation}

Nothing was output.

The unexpected no-Plan fallback remains a diagnostic rather than a progress
phase:

xmd plan ended unexpectedly without an approved Plan. Nothing was output.

Run the same command again with --journal plan-authorship.jsonl. If the problem repeats, include the journal in the bug report.

Help and host diagnostics

Command summary:

Turn a request into an XMD Plan, review it, and write the approved source.

Options:

--verbose show generated drafts and XMD check diagnostics on stderr
--journal <path> record the planning process as diagnostic JSONL (path must not exist)

Secret detection checks journal entries before they are recorded, but it may not catch every sensitive detail. The journal can contain prompts, drafts, and review answers.

Only those long spellings are accepted. Do not restore -V, -j, or
--trace.

Existing journal path:

Journal file already exists: <path>. Choose a different --journal path.

Other journal creation failure:

Could not create journal file <path>: <reason>

Choose a different --journal path and try again.

Journal append failure:

Could not write the next entry to journal file <path>: <reason>

The journal still contains the entries recorded before this failure.

Progress sink failure, if stderr can receive the later diagnostic:

Could not write planning progress to stderr: <reason>

Planning was cancelled, and no Plan was output.

A permanently failed stderr receives no stdout fallback. That is a lifecycle
invariant, not additional user-facing copy.

Ownership and ordering

• packages/cli/src/documents/Plan.md owns every phase and verbose block.
• packages/cli/src/plan-component.ts owns a private command-only presentation
  boundary. On the ordinary component surface it returns before expanding its
  content. Verbose blocks also require the sealed verbose mode.
• packages/cli/src/documents/plan-command.md remains an output-free adapter
  that captures the exact Plan text.
• packages/cli/src/authorship-profile.ts installs normalized output, terminal
  formatting only for a stderr TTY, passes the host-selected DurableStream to
  executeInstalled() with secret detection enabled, and drains output while
  the producer is alive.
• packages/cli/src/cli.ts owns exclusive journal creation, the in-memory
  fallback, stderr delivery, TTY selection, and long-only grammar/help.
• packages/cli/src/plan.ts preserves final caller-owned validation and exact
  stdout/--output delivery after complete command-document teardown.

The event supplying a draft or diagnostics must commit through
useSecretDetection() and its serialized-event pre-append gate before the
binding becomes available to presentation. Rejection therefore reaches no
verbose presentation call, appends no rejected event, preserves the earlier
journal prefix, completes teardown, and produces no approved source. Do not add
a second presentation-specific secret scanner.

Frozen focused evidence

Required feedback command:

deno task test \
 packages/cli/tests/plan-cli.test.ts \
 packages/cli/tests/plan-component.test.ts \
 packages/cli/tests/plan-command-document.test.ts

Because this implementation changes grammar, help, and the packaged private
declaration, also run:

deno task test \
 packages/cli/tests/plan-args.test.ts \
 packages/cli/tests/syntax-cli.test.ts \
 packages/cli/tests/packaged-document.test.ts

The cases must discriminate:

• progressive phase order and correct Plan/repair ordinals;
• exact stdout and --output separation from stderr;
• normalized non-TTY Markdown and stderr-TTY formatting;
• the automatic explanation with no final invalid-draft Elicitation and no
  Plan;
• cleared verbose draft and diagnostic presentation;
• withholding and journal rejection for secret-containing verbose material;
• absence of the rejected event and a readable previously committed prefix;
• journal write failure, cancellation, teardown, and artifact-sink failure; and
• ordinary bare and captured <Plan> receiving no command presentation.

Do not add a shared output- or secret-middleware suite unless implementation
changes that shared boundary.

After the focused commands pass, create the feedback commit promptly and return
its exact SHA with every command run. Run
deno task test --changed=origin/main on that exact revision afterward. Do not
wait for CI before requesting the feedback verdict.