todo: plan mode is built and needs the owner to run it

TODO.md

@@ -400,6 +400,38 @@ outside the example's new README:
 - [ ] A plugin's `assets/icon.png` is only published while installed, so its real icon is invisible in the
       store before install. The catalogue's `iconUrl` works around it, and an author has to know to add one.
 
+## Waiting on the owner to run it
+
+- [ ] **Plan mode is built and has never executed.** Landed `1b811dfa` on 2026-08-17, typechecks, unit
+      tested at the translation layer — and not one line of it has run on a machine. The owner was away
+      when it was finished and asked to be reminded, which is what this entry is.
+
+      **Restart BOTH:** `pm2 restart officer` and `pm2 restart officer-claude-code`. The sidecar holds
+      every interesting part (the gate, the pending-plan map, the mode control request); restarting only
+      the server leaves the old sidecar running with no `canUseTool` at all, and the toggle would then
+      appear to work while changing nothing. Note the server is ALSO carrying two earlier unrestarted
+      changes — the tier-less-model fix (`773f0e1c`) and the sessions-list work.
+
+      **Then, in `/chat`, in this order:**
+
+      1. The clipboard icon by the model picker lights up, and `pm2 logs officer-claude-code` says
+         `[claude:plan:<key>] plan mode on`.
+      2. Ask for something that needs a plan. The agent researches and does NOT edit — a `Write` in plan
+         mode should reach neither the disk nor the gate.
+      3. The plan card renders with Approve / Reject, and **the turn is genuinely parked** while it sits
+         there (the spinner stays; that is correct, an agent is blocked on a promise in the sidecar).
+      4. Approve → the agent continues *in the same turn*, and `plan mode off` follows immediately rather
+         than at turn end. Reject with a reason → it revises and asks again.
+      5. Refresh mid-plan → the card replays with its decision, rather than a conversation that stops dead.
+      6. Pick `claude-code/opusplan` with plan mode OFF → the toggle's tooltip says it is resting on Sonnet.
+
+      **The one failure worth watching for** is a turn that never ends after a plan is answered. That would
+      mean a `canUseTool` promise was left unresolved — the agent waits forever and the stall watchdog
+      eventually tears the session down. `settleAllPlans` runs on every teardown path plus a 20-minute
+      timeout to make it impossible, and it is the part with no test behind it.
+
+      Design decisions and the verification they came from: `docs/chat-plan-mode.md`.
+
 ## Known bugs
 
 - [ ] **Background job logs appeared INSIDE an open file in the code editor.** Reported 2026-08-16 by the