## What changed

Adds a zero-argument foreground Planner tool, `request_visual_preview`, for a member's explicit request to explore continuous design settings. Its durable domain operation records the exact active member message as a bounded pending request in the document sidecar and returns its ID only after the fenced commit. Repeated calls for the same message return the same ID, including after a room restart.

The record stores the channel, source message, original instruction, requester, source document revision, and server creation time. Background Planner jobs cannot call this writer. A stopped foreground turn rejects requests still waiting for the document lock, while an already committed request remains durable. Ordinary discrete team choices continue through `ask`.

## Availability gate


There is no production request consumer or preview publisher. Normal hosted turns therefore omit the tool, its guidance, and its Chat callback. A complete injected test capability enables the three together and can publish a verified decision and resolve its artifact. A resolver or enable flag alone is insufficient. The portable local toolkit in #416 is not a hosted fulfillment provider.

## Request flow


This earlier diagram shows the committed pending state when the capability is installed. It does not represent a production preview or a saved visual decision.

## Checks

At `c694dff5f8b32b90272121d5fa720f543aeb3e0b`, refreshed #417 (`c7a7f905383b3638ed9a355729954a8831890d2d`) is merged without rewriting #418 or creating a top-layer conflict. Local `bun run types`, `bun run ci`, `bun run build`, and 126 focused tests passed, including the Stop Planner lock regression, preview availability, both channel routes, and editor decisions. Exact-head CI validation, PostgreSQL tests, browser E2E, and container build passed. A focused diff review confirmed the default-off gate and captured-controller cancellation check remain in #418's layer. Two independent reviews passed on the pre-refresh `0655de5d` head; this forward parent merge did not change their reviewed request logic.

In an earlier disposable detached integration of pinned #419 with the pre-refresh stack, type and design contract checks, 41 domain/projection tests, 72 PostgreSQL contract tests, and six editor tests passed. Both `017_*` migration IDs coexisted in that scratch merge; #419 remains separately owned and unchanged.

The earlier, separately authorized three-turn live acceptance on the pre-gate head recorded two pending requests and one ordinary four-option question. Browser reload and PostgreSQL readback succeeded; a live server or room restart was not tested. The request-domain restart test passed. Chat does not expose token usage. No preview was published. That acceptance demonstrates the request domain, not current production availability.

Stacked on #417. Ready for review; no merge or deploy.