Seal the plan as a specification instead of four bullet lists

The plan artifact was Changes{Target,Intent} plus three string lists, every
entry capped at 500 single-line characters. That bound makes a specification
impossible: a phase cannot carry a code block, a paragraph of reasoning, or a
verification command with its own argument list. renderSealed then flattened
what little survived through collapse(), so an implement session received a
summary of a summary.

plan.md replaces it. Markdown, 128 KiB, no per-line cap, sealed through the
existing path under the existing PlanRef. The parser enforces the structure the
brief states: required sections, phases numbered from 1 with no gaps, Files,
Changes and Verification per phase, and at least one automated or manual check,
because a phase nobody can verify can never be established as done. Automated
entries are JSON argv arrays, so a pipe is a literal argument rather than an
operator. Headings inside fenced blocks are content, so a plan may show
markdown without parsing its own example.

Citations resolve at seal time against the accepted research, on the
coordinator, which is the only party holding ResearchRef. A plan resting on a
finding nobody recorded fails on the planner while its session is still alive
to be told.

The plan now renders byte for byte into the implement launch, and a rotated
successor receives the same complete document. That is the property the whole
change exists for. collapse() stays for research findings, which really are
short claims.

DecodeStoredPlan reads pre-markdown refs and renders them into the same type,
labelled, so nothing downstream branches on which era a plan came from. A
legacy plan carries no phases, which is honest: the old artifact never named an
executable unit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

internal/operations/trajectory.go

@@ -122,30 +122,15 @@ func TrajectoryGatePacket(s *store.Store, t domain.Task, from, to domain.WorkPha
 		}
 	}
 	if len(planned) > 0 {
-		{
-			if p, err := workphase.DecodePlan(planned); err == nil {
-				b.WriteString("\nProposed changes:\n")
-				for _, c := range p.Changes {
-					fmt.Fprintf(&b, "- %s: %s\n", oneLine(c.Target), oneLine(c.Intent))
-				}
-				if len(p.Verification) > 0 {
-					b.WriteString("\nVerification:\n")
-					for _, v := range p.Verification {
-						fmt.Fprintf(&b, "- %s\n", oneLine(v))
-					}
-				}
-				if len(p.Risks) > 0 {
-					b.WriteString("\nRisks:\n")
-					for _, r := range p.Risks {
-						fmt.Fprintf(&b, "- %s\n", oneLine(r))
-					}
-				}
-				if len(p.DecisionsNeeded) > 0 {
-					b.WriteString("\nOpen decisions for you:\n")
-					for _, d := range p.DecisionsNeeded {
-						fmt.Fprintf(&b, "- %s\n", oneLine(d))
-					}
-				}
+		// The plan reaches the human as the document that was sealed. A
+		// trajectory gate asks whether this direction is right, and a
+		// flattened summary is not the thing being approved. maxPacketBytes
+		// below bounds what a notification surface actually carries.
+		if p, err := workphase.DecodeStoredPlan(planned); err == nil {
+			b.WriteString("\nProposed plan:\n\n")
+			b.WriteString(p.Markdown)
+			if !strings.HasSuffix(p.Markdown, "\n") {
+				b.WriteString("\n")
 			}
 		}
 	}