@@ -71,6 +71,17 @@ with a run without a file in between:
 deno task xmd plan "prepare the release" | deno task xmd run -
 ```
 
+That composition is the whole relationship between the two commands:
+
+```text
+Plan produces a program.
+Run executes a program from the host/CLI.
+Composition decides whether and when a planned program runs.
+```
+
+`xmd plan` writes approved source and stops — to standard output, or to an
+`--output` file it creates exclusively. Running it is a command you write.
+
 Preparation is common to all of them, so the block above is the document's own
 preamble: whichever target you select runs it first, and the checkout is
 prepared again before the work you asked for.
 
@@ -10,9 +10,14 @@
 
 import type { PermissionMode } from "@executablemd/core";
 
-export interface AgentFlags {
+/** What settling who writes needs, and the whole of it. */
+export interface AuthorshipFlags {
   agentProvider: string;
   defaultAgent: string | undefined;
+}
+
+/** The same, plus the flags that select a document execution's permission mode. */
+export interface AgentFlags extends AuthorshipFlags {
   approveAll: boolean;
   approveReads: boolean;
   denyAll: boolean;
 
@@ -1,14 +1,14 @@
 /**
- * The one Agent configuration an invocation resolves, and the two things a
- * host does with it (specs/acp-client-spec.md §Command-line configuration).
+ * The Agent configuration an invocation resolves, and what a host does with it
+ * (specs/acp-client-spec.md §Command-line configuration).
  *
- * `xmd run` and `xmd plan` take the same Agent, permission and provider
- * options, so they resolve them once, here, rather than each reading the flags
- * again. What they do with the result differs, and deliberately: a run installs
- * the registered provider into the Agent Api so a document may reach it, while
- * `xmd plan` hands the same answer to two consumers — the authorship profile, which
- * takes the provider name and the default agent and nothing else, and the
- * approved document, which runs the ordinary run stack.
+ * Two commands ask, and they ask for different amounts. `xmd run` settles the
+ * whole of it and installs the registered provider into the Agent Api so a
+ * document may reach it. `xmd plan` writes a program and runs none, so it
+ * settles only who writes — the provider name, the default agent and the
+ * adapters this build carries — and hands that to the authorship profile.
+ * Resolving it once, here, is what keeps `DEFAULT_AGENT_NAME` from being read
+ * twice and answered differently.
  *
  * `agent-config.ts` stays the pure flag-to-permission mapping. This module is
  * where the environment, the provider registry and the host's own machine
@@ -37,7 +37,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 
 import { resolveAgentConfig } from "./agent-config.ts";
-import type { AgentFlags } from "./agent-config.ts";
+import type { AgentFlags, AuthorshipFlags } from "./agent-config.ts";
 import type { MachineSessionAssembly } from "./session-coordinator.ts";
 
 /**
@@ -50,55 +50,77 @@ import type { MachineSessionAssembly } from "./session-coordinator.ts";
  */
 export const DEFAULT_ADAPTER_ROOT: string = join(homedir(), ".xmd", "adapters");
 
-/** Everything one invocation settled about agents, resolved exactly once. */
-export interface AgentStack {
+/**
+ * Who writes, and what this host launches them with.
+ *
+ * The whole of what Plan authorship settles. There is no permission mode here
+ * because the authorship frame installs its own fixed one, and no command line
+ * selects it: the flags that choose a permission mode configure a document
+ * execution, and `xmd plan` starts none.
+ */
+export interface AuthorshipStack {
   /** The provider name the caller selected, already known to be registered. */
   provider: string;
   /** The agent every consumer defaults to, environment fallback applied. */
   defaultAgent: string;
-  permissionMode: PermissionMode;
-  /**
-   * The ACP adapters this build carries, and where this host puts them.
-   *
-   * Part of the one settled answer because both consumers resolve agents
-   * through it: the assistant that writes a Plan and the run of the approved
-   * Plan are the same Codex or Claude, launched from the same snapshot.
-   */
+  /** The ACP adapters this build carries, and where this host puts them. */
   adapters: EmbeddedAdapters;
   /** What this host states about machine-wide agent sessions, if anything. */
   sessions?: MachineSessionAssembly;
 }
 
+/** Everything one `xmd run` invocation settled about agents, resolved once. */
+export interface AgentStack extends AuthorshipStack {
+  permissionMode: PermissionMode;
+}
+
 /**
- * Read the command line, the environment and the host's assembly into one
- * configuration.
+ * Read the provider selection, the environment and the host's assembly into the
+ * answer authorship needs.
  *
  * A failure comes back as a `Result` rather than as a printed line and an exit,
  * so the same resolution serves a command that runs a document and one that
- * generates one first.
+ * only writes one.
  */
-export function* resolveAgentStack(
-  flags: AgentFlags,
+export function* resolveAuthorshipStack(
+  flags: AuthorshipFlags,
   sessions: MachineSessionAssembly | undefined,
-): Operation<Result<AgentStack>> {
-  const config = resolveAgentConfig(flags);
-  if ("error" in config) {
-    return Err(new Error(config.error));
-  }
+): Operation<Result<AuthorshipStack>> {
   if (flags.agentProvider !== "acpx") {
     return Err(new Error(`Unknown agent provider "${flags.agentProvider}"`));
   }
   const defaultAgent =
-    config.defaultAgent ?? (yield* readEnv("DEFAULT_AGENT_NAME")) ?? DEFAULT_AGENT_NAME;
+    flags.defaultAgent ?? (yield* readEnv("DEFAULT_AGENT_NAME")) ?? DEFAULT_AGENT_NAME;
   return Ok({
     provider: flags.agentProvider,
     defaultAgent,
-    permissionMode: config.permissionMode,
     adapters: createEmbeddedAdapters(DEFAULT_ADAPTER_ROOT),
     ...(sessions === undefined ? {} : { sessions }),
   });
 }
 
+/**
+ * The same answer, plus the permission mode the document a run executes is
+ * installed under.
+ */
+export function* resolveAgentStack(
+  flags: AgentFlags,
+  sessions: MachineSessionAssembly | undefined,
+): Operation<Result<AgentStack>> {
+  const config = resolveAgentConfig(flags);
+  if ("error" in config) {
+    return Err(new Error(config.error));
+  }
+  const authorship = yield* resolveAuthorshipStack(
+    { agentProvider: flags.agentProvider, defaultAgent: config.defaultAgent },
+    sessions,
+  );
+  if (!authorship.ok) {
+    return authorship;
+  }
+  return Ok({ ...authorship.value, permissionMode: config.permissionMode });
+}
+
 /**
  * What this host carries and what it built, stated to the provider.
  *
@@ -112,7 +134,7 @@ export function* resolveAgentStack(
  * ones a document could replace are not ones. The two advertised sets are stated
  * by the host, not inherited.
  */
-export function hostAcpDependencies(stack: AgentStack): AcpxProviderDependencies {
+export function hostAcpDependencies(stack: AuthorshipStack): AcpxProviderDependencies {
   const { sessions } = stack;
   const adapters = embeddedAdapterDependencies(stack.adapters);
   if (sessions === undefined) {
 
@@ -3,9 +3,9 @@
  * runs under, and the only thing that ever runs under it
  * (specs/plan-command-spec.md).
  *
- * `xmd plan` executes this root on every invocation, and a second one — the
- * Plan it returns — only under `--run`, behind a complete scope boundary. This
- * module is the one that always happens. It supplies that document's inputs, a
+ * `xmd plan` executes this root on every invocation, and no other: the Plan it
+ * returns is source, and running it is a later command's business. This
+ * module supplies that document's inputs, a
  * constrained Agent provider, Elicitation, the fixed first-party components and
  * the host-declared draft checker, and it exposes no custom root and no
  * repository component search: the document it runs is the one the CLI ships.
@@ -52,7 +52,7 @@ import { API } from "@executablemd/runtime";
 import { FormOpener } from "@executablemd/web";
 
 import { hostAcpDependencies } from "./agent-stack.ts";
-import type { AgentStack } from "./agent-stack.ts";
+import type { AuthorshipStack } from "./agent-stack.ts";
 import { PLAN_COMMAND_DOCUMENT, readPackagedDocument } from "./packaged-document.ts";
 
 /**
@@ -108,8 +108,6 @@ export interface AuthorshipProfile {
   root: string;
   /** The Agent context this host can give a Plan, or why it can give none. */
   context: Result<PlanAuthorship>;
-  /** Who answers the review question. */
-  installElicitation(): Operation<void>;
   /**
    * The `<Plan>` declaration this command runs under.
    *
@@ -119,20 +117,11 @@ export interface AuthorshipProfile {
    * could supply or a document could reach.
    */
   declaration: DeclaredMarkdownComponent;
-  /**
-   * The host's assessment of one candidate.
-   *
-   * A candidate-authored failure comes back as `valid: false` and is repairable.
-   * A caller-source failure raises, which ends that execution: the document
-   * has no way to catch it and no way to recategorize it as feedback
-   * for an agent that could not have caused it.
-   */
-  assess(source: string): Operation<CandidateAssessment>;
 }
 
 /** What building the constrained provider needs, and nothing more. */
 export interface AuthorshipProviderInputs {
-  readonly stack: AgentStack;
+  readonly stack: AuthorshipStack;
   readonly acp?: AcpxProviderDependencies;
 }
 
@@ -145,9 +134,9 @@ export interface AuthorshipProviderInputs {
  * middleware can reach or replace — which is what keeps "who may write a Plan"
  * a question about the host rather than about what a document arranged.
  *
- * Availability is all it decides. What the Plan then runs under — the permission
- * mode, the prompt-failure policy, the capability refusals and the session
- * directory — is {@link installAuthorshipFrame}'s fixed policy, identical for
+ * Availability is all it decides. What writing a Plan then happens under — the
+ * permission mode, the prompt-failure policy, the capability refusals and the
+ * session directory — is {@link installAuthorshipFrame}'s fixed policy, identical for
  * every provider, so a second implementation cannot quietly bring a weaker one.
  */
 export interface PlanAuthorship {
@@ -222,7 +211,7 @@ export function noAgentContextFrom(provider: string): string {
  * were when this was the only way to supply one.
  */
 export function planAgentContext(
-  stack: AgentStack | undefined,
+  stack: AuthorshipStack | undefined,
   acp?: AcpxProviderDependencies,
 ): Result<PlanAuthorship> {
   if (stack === undefined) {
@@ -359,7 +348,7 @@ export function* runPlanCommandDocument(profile: AuthorshipProfile): Operation<R
   // supplies no Agent context refuses rather than writing a Plan under a weaker one.
   const context = profile.context;
   if (!context.ok) {
-    return Err(new Error(`${context.error.message} Nothing was output or run.`));
+    return Err(new Error(`${context.error.message} Nothing was output.`));
   }
 
   return yield* scoped(function* (): Operation<Result<string>> {
@@ -644,7 +633,7 @@ function* establishDirectory(directory: string): Operation<Result<string>> {
  * nothing is deleted, because a leaf that changed underneath a conversation
  * nobody authorized to write there is interference, not a tidying job. The
  * failure raises out of the profile's scope, so no final admission follows it,
- * and the approved Plan reaches no stdout, no file and no run.
+ * and the approved Plan reaches no stdout and no file.
  *
  * A directory the conversation never got — establishment refused it, or never
  * made it — is a different question, and one already answered: whatever