feat(tui): add session-scoped plan mode and durable plan editing

README.md

@@ -225,6 +225,24 @@ Common slash commands:
 | `/add-dir` | allow an extra write directory for this session |
 | `/theme`, `/doctor`, `/config` | adjust appearance and inspect setup |
 
+`/plan on` enables read-only planning for the current session; switching sessions
+exits Plan mode, and returning from `/btw` restores the parent's mode. Plan updates
+are accepted only after saving succeeds. A failed save reports an error and keeps
+the accepted plan available to the panel, status display, and later reloads.
+
+`/plan open` edits a protected copy through `$VISUAL` or `$EDITOR`. Newly saved
+plans include a `<!-- zero-plan-format: 2 -->` marker: keep it when editing so
+backslashes remain literal. To quote a literal `Notes:` line or a line beginning
+with a pipe and a space, insert `|` followed by one space after its indentation:
+
+```text
+  | Notes: this is literal content
+  | | this line starts with a literal pipe and space
+```
+
+Existing plans remain readable and are converted with a concurrency check before
+opening the editor.
+
 ### Headless `exec`
 
 ```bash

internal/agent/loop.go

@@ -1537,6 +1537,7 @@ func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCal
 		// the Run turn loop performs the actual provider switch. Empty for every
 		// ordinary tool result.
 		RequestedModel: result.Meta["escalate_to_model"],
+		PlanSnapshot:   result.PlanSnapshot,
 	}, nil
 }
 
@@ -1873,15 +1874,15 @@ func toolResultFromPrePermissionReject(call ToolCall, result tools.Result) ToolR
 	}
 }
 
-// hooksSuppressed reports whether advisory (non-veto) hooks must not run for
-// this run's permission mode. Plan mode promises a read-only turn, but
-// sessionStart/sessionEnd/afterTool hooks execute configured host commands
-// outside the advertised-tool and sandbox gates, so dispatching them would let
-// merely starting a plan session or finishing a read mutate the workspace.
+// hooksSuppressed reports whether lifecycle and afterTool hooks must not run
+// for this run's permission mode. Plan mode promises a read-only turn, but
+// sessionStart, sessionEnd, and afterTool hooks execute configured host
+// commands outside the advertised-tool and sandbox gates, so dispatching them
+// would let merely starting or finishing a plan session mutate the workspace
+// or spawn processes.
 //
-// beforeTool is intentionally NOT suppressed: a non-zero exit is a deny gate,
-// and skipping it fails open (operators who block secret-file reads via
-// beforeTool would lose that protection under /plan on). See dispatchBeforeTool.
+// beforeTool is intentionally not gated here: fail-closed policy vetoes must
+// still apply to read-only plan-mode calls (see dispatchBeforeTool).
 //
 // Spec-draft keeps the existing trust-gated hook model: project hooks still
 // fire when the workspace (or its worktree trust root) is trusted. That is