a test plan for plan mode, for a day that is not today

the owner has no time to test any of it, so the checklist has to work for
someone with none of today's context: eleven ordered tests, what each should
show, and what its failure looks like.

test 4 is called out as the one most likely to be wrong - approving
ExitPlanMode drops the harness into default rather than back into
bypassPermissions, which is the finding that changed the design and therefore
the thing the implementation is most likely to have got wrong.

also separates what was verified from what was not: the probe runs against a
real claude, the turn-stream unit tests, and then everything end to end, which
is nothing.

the inline 'what to watch' list in chat-plan-mode.md is replaced by a pointer
so there is one source of truth, and TODO.md now says live-but-unexercised
rather than built-not-run - the restarts are done.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TODO.md

@@ -402,35 +402,22 @@ outside the example's new README:
 
 ## Waiting on the owner to run it
 
-- [ ] **Plan mode is built and has never executed.** Landed `1b811dfa` on 2026-08-17, typechecks, unit
-      tested at the translation layer — and not one line of it has run on a machine. The owner was away
-      when it was finished and asked to be reminded, which is what this entry is.
+- [ ] **Plan mode is live and has never been exercised.** Landed `1b811dfa` on 2026-08-17; all three
+      processes were restarted the same evening, so the code IS running. Not one part of it has been used:
+      not the toggle, not the plan card, not the round trip from the sidecar's pending promise to a browser
+      and back, not the stored column, not `settleAllPlans`.
 
-      **Restart BOTH:** `pm2 restart officer` and `pm2 restart officer-claude-code`. The sidecar holds
-      every interesting part (the gate, the pending-plan map, the mode control request); restarting only
-      the server leaves the old sidecar running with no `canUseTool` at all, and the toggle would then
-      appear to work while changing nothing. Note the server is ALSO carrying two earlier unrestarted
-      changes — the tier-less-model fix (`773f0e1c`) and the sessions-list work.
+      **`docs/chat-plan-mode-test-plan.md` is the checklist** — eleven ordered tests, what each should show,
+      and what its failure looks like. Test 4 (approve) is the one most likely to be wrong: it is the case
+      that changed the design, because approving `ExitPlanMode` drops the harness into `default` rather than
+      back into `bypassPermissions`.
 
-      **Then, in `/chat`, in this order:**
+      Safe to leave untested. Plan mode is opt-in and off by default, so a conversation that never touches
+      the toggle behaves exactly as it did before. The one failure worth knowing in advance is a turn that
+      never ends after a plan is answered — that would be a leaked `canUseTool` promise, and
+      `pm2 restart officer-claude-code` clears it.
 
-      1. The clipboard icon by the model picker lights up, and `pm2 logs officer-claude-code` says
-         `[claude:plan:<key>] plan mode on`.
-      2. Ask for something that needs a plan. The agent researches and does NOT edit — a `Write` in plan
-         mode should reach neither the disk nor the gate.
-      3. The plan card renders with Approve / Reject, and **the turn is genuinely parked** while it sits
-         there (the spinner stays; that is correct, an agent is blocked on a promise in the sidecar).
-      4. Approve → the agent continues *in the same turn*, and `plan mode off` follows immediately rather
-         than at turn end. Reject with a reason → it revises and asks again.
-      5. Refresh mid-plan → the card replays with its decision, rather than a conversation that stops dead.
-      6. Pick `claude-code/opusplan` with plan mode OFF → the toggle's tooltip says it is resting on Sonnet.
-
-      **The one failure worth watching for** is a turn that never ends after a plan is answered. That would
-      mean a `canUseTool` promise was left unresolved — the agent waits forever and the stall watchdog
-      eventually tears the session down. `settleAllPlans` runs on every teardown path plus a 20-minute
-      timeout to make it impossible, and it is the part with no test behind it.
-
-      Design decisions and the verification they came from: `docs/chat-plan-mode.md`.
+      Design and the probe results behind it: `docs/chat-plan-mode.md`.
 
 ## Known bugs