Seal the plan as a specification instead of four bullet lists

The plan artifact was Changes{Target,Intent} plus three string lists, every
entry capped at 500 single-line characters. That bound makes a specification
impossible: a phase cannot carry a code block, a paragraph of reasoning, or a
verification command with its own argument list. renderSealed then flattened
what little survived through collapse(), so an implement session received a
summary of a summary.

plan.md replaces it. Markdown, 128 KiB, no per-line cap, sealed through the
existing path under the existing PlanRef. The parser enforces the structure the
brief states: required sections, phases numbered from 1 with no gaps, Files,
Changes and Verification per phase, and at least one automated or manual check,
because a phase nobody can verify can never be established as done. Automated
entries are JSON argv arrays, so a pipe is a literal argument rather than an
operator. Headings inside fenced blocks are content, so a plan may show
markdown without parsing its own example.

Citations resolve at seal time against the accepted research, on the
coordinator, which is the only party holding ResearchRef. A plan resting on a
finding nobody recorded fails on the planner while its session is still alive
to be told.

The plan now renders byte for byte into the implement launch, and a rotated
successor receives the same complete document. That is the property the whole
change exists for. collapse() stays for research findings, which really are
short claims.

DecodeStoredPlan reads pre-markdown refs and renders them into the same type,
labelled, so nothing downstream branches on which era a plan came from. A
legacy plan carries no phases, which is honest: the old artifact never named an
executable unit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

internal/operations/trajectory_test.go

@@ -10,7 +10,6 @@ import (
 	"orchestra/internal/domain"
 	"orchestra/internal/registry"
 	"orchestra/internal/store"
-	"orchestra/internal/workphase"
 )
 
 func gatedProject() registry.Project {
@@ -55,11 +54,47 @@ func TestTrajectoryGateBlocksThenClears(t *testing.T) {
 	}
 
 	// plan to implement is gated.
-	proposal := sealed(t, workphase.Plan{
-		Changes:      []workphase.Change{{Target: "internal/attr/attr.go", Intent: "add the cache"}},
-		Verification: []string{"go test ./internal/attr/"},
-		Risks:        []string{"cache invalidation on rename"},
-	})
+	proposal := []byte("# Attribution cache plan\n" + `
+## Overview
+add the cache
+
+## Current state
+runs per figure, per research:r1.
+
+## Desired end state
+Aggregation is cached per person.
+
+## Non-goals
+No identity change.
+
+## Approach
+Memoise in the aggregation loop.
+
+## Phase 1: Add the cache
+
+### Files
+- internal/attr/attr.go
+
+### Changes
+add the cache to internal/attr/attr.go
+
+### Verification
+
+#### Automated
+- run: ["go", "test", "./internal/attr/"]
+
+## Testing strategy
+go test ./internal/attr/
+
+## Risks and edge cases
+cache invalidation on rename
+
+## Migration
+None.
+
+## References
+- research:r1
+`)
 	_, err := AdvanceWorkPhase(s, project, id, proposal)
 	if !errors.Is(err, ErrTrajectoryGate) {
 		t.Fatalf("want ErrTrajectoryGate, got %v", err)
@@ -122,7 +157,7 @@ func TestUngatedProjectAdvances(t *testing.T) {
 	if _, err := AdvanceWorkPhase(s, project, id, sealed(t, research)); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := AdvanceWorkPhase(s, project, id, sealed(t, plan)); err != nil {
+	if _, err := AdvanceWorkPhase(s, project, id, planDoc); err != nil {
 		t.Fatal(err)
 	}
 	if got, _ := s.Task(id); got.WorkPhase != domain.WorkPhaseImplement {
@@ -141,7 +176,7 @@ func TestOlderDecisionDoesNotOpenTheGate(t *testing.T) {
 	if _, err := AdvanceWorkPhase(s, project, id, sealed(t, research)); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := AdvanceWorkPhase(s, project, id, sealed(t, plan)); !errors.Is(err, ErrTrajectoryGate) {
+	if _, err := AdvanceWorkPhase(s, project, id, planDoc); !errors.Is(err, ErrTrajectoryGate) {
 		t.Fatalf("want ErrTrajectoryGate, got %v", err)
 	}
 }