Seal the plan as a specification instead of four bullet lists

The plan artifact was Changes{Target,Intent} plus three string lists, every
entry capped at 500 single-line characters. That bound makes a specification
impossible: a phase cannot carry a code block, a paragraph of reasoning, or a
verification command with its own argument list. renderSealed then flattened
what little survived through collapse(), so an implement session received a
summary of a summary.

plan.md replaces it. Markdown, 128 KiB, no per-line cap, sealed through the
existing path under the existing PlanRef. The parser enforces the structure the
brief states: required sections, phases numbered from 1 with no gaps, Files,
Changes and Verification per phase, and at least one automated or manual check,
because a phase nobody can verify can never be established as done. Automated
entries are JSON argv arrays, so a pipe is a literal argument rather than an
operator. Headings inside fenced blocks are content, so a plan may show
markdown without parsing its own example.

Citations resolve at seal time against the accepted research, on the
coordinator, which is the only party holding ResearchRef. A plan resting on a
finding nobody recorded fails on the planner while its session is still alive
to be told.

The plan now renders byte for byte into the implement launch, and a rotated
successor receives the same complete document. That is the property the whole
change exists for. collapse() stays for research findings, which really are
short claims.

DecodeStoredPlan reads pre-markdown refs and renders them into the same type,
labelled, so nothing downstream branches on which era a plan came from. A
legacy plan carries no phases, which is honest: the old artifact never named an
executable unit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

internal/authn/http.go

@@ -145,7 +145,7 @@ func (h HTTP) Account(w http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			switch {
 			case errors.Is(err, ErrInvalidCredentials):
-				http.Error(w, "current password is incorrect", http.StatusUnauthorized)
+				http.Error(w, "current password is incorrect", http.StatusForbidden)
 			case errors.Is(err, ErrUsernameExists):
 				http.Error(w, err.Error(), http.StatusConflict)
 			default:

internal/authn/http_test.go

@@ -92,3 +92,60 @@ func TestHTTPAccountUpdateRevokesExistingSessions(t *testing.T) {
 		t.Fatalf("updated login: %v", err)
 	}
 }
+
+func TestHTTPAccountRejectsWrongCurrentPasswordWithoutEndingSession(t *testing.T) {
+	users, _ := openTestStore(t)
+	if _, _, err := users.SetPassword("operator", "original password"); err != nil {
+		t.Fatal(err)
+	}
+	sessions := &authz.Sessions{}
+	h := HTTP{Users: users, Sessions: sessions}
+	value, err := sessions.IssueFor("operator")
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodPut, "/v1/ui/account", bytes.NewBufferString(`{"current_password":"incorrect password","username":"operator","new_password":"replacement password"}`))
+	req.AddCookie(&http.Cookie{Name: authz.SessionCookie, Value: value})
+	w := httptest.NewRecorder()
+	h.Account(w, req)
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("status=%d body=%s", w.Code, w.Body)
+	}
+	if !sessions.Valid(value) {
+		t.Fatal("a rejected credential update ended the valid browser session")
+	}
+}
+
+func TestBrowserAuthHandlersComposeWithSessionMiddleware(t *testing.T) {
+	users, _ := openTestStore(t)
+	if _, _, err := users.SetPassword("operator", "correct horse battery"); err != nil {
+		t.Fatal(err)
+	}
+	sessions := &authz.Sessions{}
+	h := HTTP{Users: users, Sessions: sessions}
+	mux := http.NewServeMux()
+	mux.HandleFunc(authz.SessionPath, h.Session)
+	mux.HandleFunc("/v1/ui/account", h.Account)
+	server := authz.HTTPWithSessions(nil, sessions, mux)
+
+	w := httptest.NewRecorder()
+	server.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/v1/ui/account", nil))
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("uncredentialed account status=%d", w.Code)
+	}
+
+	w = httptest.NewRecorder()
+	server.ServeHTTP(w, httptest.NewRequest(http.MethodPost, authz.SessionPath, bytes.NewBufferString(`{"username":"operator","password":"correct horse battery"}`)))
+	if w.Code != http.StatusOK || len(w.Result().Cookies()) != 1 {
+		t.Fatalf("login status=%d body=%s", w.Code, w.Body)
+	}
+	cookie := w.Result().Cookies()[0]
+
+	request := httptest.NewRequest(http.MethodGet, "/v1/ui/account", nil)
+	request.AddCookie(cookie)
+	w = httptest.NewRecorder()
+	server.ServeHTTP(w, request)
+	if w.Code != http.StatusOK || !bytes.Contains(w.Body.Bytes(), []byte(`"username":"operator"`)) {
+		t.Fatalf("authenticated account status=%d body=%s", w.Code, w.Body)
+	}
+}

internal/authn/store.go

@@ -116,7 +116,7 @@ func ValidateUsername(username string) error {
 }
 
 func ValidatePassword(password string) error {
-	if len(password) < MinimumPassword {
+	if utf8.RuneCountInString(password) < MinimumPassword {
 		return fmt.Errorf("password must be at least %d characters", MinimumPassword)
 	}
 	if len([]byte(password)) > maximumPassword {

internal/authn/store_test.go

@@ -2,6 +2,7 @@ package authn
 
 import (
 	"errors"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -42,6 +43,13 @@ func TestPasswordRecordPersistsAndAuthenticates(t *testing.T) {
 	if _, err := reopened.Authenticate("kami", "correct horse battery"); err != nil {
 		t.Fatalf("persisted authentication: %v", err)
 	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := info.Mode().Perm(); got != databaseFileMode {
+		t.Fatalf("auth database permissions = %o, want %o", got, databaseFileMode)
+	}
 }
 
 func TestUpdateRequiresCurrentPasswordAndMovesUsername(t *testing.T) {