fix(agent): refuse plan re-proposal + emit done on error (close divergence chain)

Operator-reported bug: on 'proceed with the rest' the agent re-proposed the
plan, duplicating it in the sidebar. Root cause was a three-bug chain, not
one bug:

1. Trigger — model empty-response on 'proceed' (approval vocabulary didn't
   list 'proceed', so the agent wasn't sure it was approved and no-op'd).
2. Amplifier — chatWith emitted 'error' without 'done' on empty response
   (agent.go:370). The frontend's onComplete saw !receivedDone and
   misclassified the model failure as a network disconnect, calling
   handleDisconnect -> resumeSession.
3. Divergence — the reconnect note was generic ('report your state'), so
   the agent re-proposed + re-executed instead of advancing the plan.

Fixes (shipped, e2e-validated against the live agent on oikos-nomos-1):

- A.2: proposePlan refuses re-proposal once a step has started (returns
  errPlanInFlight). Drops the append-mode safety net (commit 5384499) that
  was the direct source of the sidebar duplication. The agent must advance
  with update_plan_step + run; the tool result directs it.
- A.1: proposePlan sets the 'generation' column on INSERT (migration 020
  added the column + frontend grouping, but the INSERT never wired it).
- A.3: propose_plan tool description restated as a crisp contract (ONCE,
  STOP and wait, REFUSES once a step started, advance with update_plan_step).
- F.3: approval vocabulary expanded to approved/yes/go/proceed/continue/ok/
  go ahead; propose_plan result string tightened to an imperative.
- B.1: chatWith emits 'done' after 'error' on every terminal path via a new
  emitError helper. The frontend now treats model errors as ended (not
  disconnected), so no auto-reconnect -> resumeSession fires.
- B.2: reconnect/resume note carries the operator's last message + an
  explicit 'advance the plan, do NOT call propose_plan again' directive when
  a plan is in flight. Wired into all 4 resume entry points (reconnect,
  /resume, idle-sweep, question-answer) via enrichResumeNote.
- B.3: resumeSession escalates the recovery note across its 3 attempts (final
  retry: 'pick the lowest-pending step, mark it running, call run — do that
  now') instead of 3 identical notes -> 3 identical empties.

Verification: TestProposePlan_RefuseInFlight replaces TestProposePlan_
AppendVsReplace. e2e conversations against the rebuilt container:
  conv2 ('proceed with the rest') -> 0 propose_plan calls, plan stayed at
    3 steps (was 6+ before), update_plan_step x5 + run x2 + complete_task.
  conv3 (full plan, 'go ahead') -> apt-get update on lxc:dns auto-ran under
    the plan window, update_entity_attributes writeback, clean complete_task.
  nomos logs show zero reconnect/resume entries for the plan-proposing
    sessions (the three-bug chain is closed).

Remaining (not in this commit): D.1 refuse complete_task without writeback
(next blocker), C.1/C.2, F.1/F.2 SOUL.md consolidation, B.4-B.6, E.1/E.2.
See plans/2026-07-14-post-fix-session-remainders.md.

Also: re-audit 2026-07-10-general-gated-execution.md — request_execution enum
retirement (60effcb) closes item 9; only auto-act revival (item 10) remains.

Version 0.4.1 -> 0.5.0 (minor: new structural behavior, not a bugfix).

cmd/nomos/store_test.go

@@ -10,6 +10,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"math/rand"
 	"os"
@@ -159,19 +160,19 @@ func TestGetRecentMessages_Truncation(t *testing.T) {
 	}
 }
 
-// TestProposePlan_AppendVsReplace is the concrete proof for the plan-append
-// fix (commit 5384499, "plan panel showed only the latest step, not the full
-// plan"): proposePlan must REPLACE the step list only while every existing
-// step is still 'pending' (a genuine pre-execution revision), and APPEND
-// once any step has started — otherwise a model that calls propose_plan once
-// per step (rather than once with the full list, as instructed) erases every
-// already-completed step each time, and the operator only ever sees the
-// latest single step instead of real progress.
-func TestProposePlan_AppendVsReplace(t *testing.T) {
+// TestProposePlan_RefuseInFlight is the concrete proof for the plan-drift
+// fix (2026-07-14, "plan added twice in the sidebar"): proposePlan must
+// REPLACE the step list only while every existing step is still 'pending'
+// (a genuine pre-execution revision), and REFUSE the call once any step has
+// started. The prior append-mode safety net (commit 5384499) preserved
+// history but duplicated the plan in the sidebar when the agent re-proposed
+// on "proceed". Refusing is the correct default — the agent must advance
+// with update_plan_step + run.
+func TestProposePlan_RefuseInFlight(t *testing.T) {
 	s := newTestStore(t)
 	ctx := context.Background()
 
-	sess, err := s.createSession(ctx, "plan append test")
+	sess, err := s.createSession(ctx, "plan refuse test")
 	if err != nil {
 		t.Fatalf("createSession: %v", err)
 	}
@@ -185,39 +186,37 @@ func TestProposePlan_AppendVsReplace(t *testing.T) {
 	if len(out1) != 1 || out1[0]["seq"] != 1 {
 		t.Fatalf("proposePlan #1 = %+v, want one step at seq 1", out1)
 	}
+	if out1[0]["generation"] != 1 {
+		t.Fatalf("proposePlan #1 generation = %v, want 1", out1[0]["generation"])
+	}
 
 	// Mark step 1 as started.
 	if err := s.updatePlanStep(ctx, sess.ID, 1, "running", ""); err != nil {
 		t.Fatalf("updatePlanStep: %v", err)
 	}
 
-	// Second call, simulating a model that (against instructions) calls
-	// propose_plan again per-step instead of once with the full list: since
-	// step 1 has left 'pending', this MUST append, not replace.
-	out2, err := s.proposePlan(ctx, sess.ID, []planStepInput{{Title: "Step B"}})
-	if err != nil {
-		t.Fatalf("proposePlan #2: %v", err)
-	}
-	if len(out2) != 1 || out2[0]["seq"] != 2 {
-		t.Fatalf("proposePlan #2 = %+v, want one step at seq 2 (appended after the running step 1)", out2)
+	// Second call, simulating a model that re-proposes mid-flight (the
+	// operator-reported "proceed" bug): since step 1 has left 'pending',
+	// this MUST refuse with errPlanInFlight, not append or replace.
+	_, err = s.proposePlan(ctx, sess.ID, []planStepInput{{Title: "Step B"}})
+	if !errors.Is(err, errPlanInFlight) {
+		t.Fatalf("proposePlan #2: err = %v, want errPlanInFlight (refuse mid-flight re-proposal)", err)
 	}
 
+	// The original step 1 must be untouched — not erased, not appended to.
 	steps, err := s.getPlanSteps(ctx, sess.ID)
 	if err != nil {
 		t.Fatalf("getPlanSteps: %v", err)
 	}
-	if len(steps) != 2 {
-		t.Fatalf("got %d persisted steps, want 2 (step 1 must survive the second propose_plan call)", len(steps))
+	if len(steps) != 1 {
+		t.Fatalf("got %d persisted steps, want 1 (refused call must not mutate the plan)", len(steps))
 	}
 	if steps[0].Title != "Step A" || steps[0].Status != "running" {
-		t.Errorf("step 1 = %+v, want Step A still running (not erased)", steps[0])
-	}
-	if steps[1].Title != "Step B" || steps[1].Status != "pending" {
-		t.Errorf("step 2 = %+v, want Step B pending", steps[1])
+		t.Errorf("step 1 = %+v, want Step A still running (refused call must not touch it)", steps[0])
 	}
 
 	// Third call BEFORE anything runs on a fresh session: every step is
-	// still pending, so this must REPLACE, not append.
+	// still pending, so this must REPLACE, not refuse.
 	sess2, err := s.createSession(ctx, "plan replace test")
 	if err != nil {
 		t.Fatalf("createSession: %v", err)
@@ -233,6 +232,9 @@ func TestProposePlan_AppendVsReplace(t *testing.T) {
 		t.Fatalf("getPlanSteps: %v", err)
 	}
 	if len(revisedSteps) != 1 || revisedSteps[0].Title != "Revised" {
-		t.Fatalf("got %+v, want a single 'Revised' step (pre-execution revise must replace, not append)", revisedSteps)
+		t.Fatalf("got %+v, want a single 'Revised' step (pre-execution revise must replace, not refuse)", revisedSteps)
+	}
+	if revisedSteps[0].Generation != 1 {
+		t.Fatalf("revised step generation = %d, want 1 (fresh-start after DELETE resets generation)", revisedSteps[0].Generation)
 	}
 }