feat(plans): plan editor hardening deferred from #631 (atomic Save, editor API, managed dates) #1057

Follow-up to #631. On 2026-10-17 the owner cut #631 to a UI-first ship. The laddering plan UI ships on the existing plan create/update path, extended to store the ramp settings and step dates. The hardening work below is deferred here. Every branch is kept locally, and nothing is published unless this issue says so.

Deferred work

1. Atomic plan-editor Save command (M3). One transaction that merges the target, cancels and replaces roots, updates the plan and its next date, and writes an immutable command receipt. It also covers retries for serialization failures and deadlocks, replay by command id, a bounded wait when busy, and pool-size handling.

• Branch feat/631-m3-on-guards holds about 31 local commits, rebased on main.
• Its migration is the receipts table, plan_schedule_command_receipts. It must be renumbered above any migration merged first.
• Parked locally: a two-client lock-coverage race proof (T6a). It has 18 passing subtests. Its flakiness, lint and full-suite runs were not done.
• Not built: T6b (final clock, winner conflicts, pool max 2).
• Includes the cumulative-percent store mode (T7).

2. Plan-editor HTTP API (preview and Save, plus the read-only GET).

• Built: request decoding and bounds, the typed target, the field and intent policy (403 before 409, sorted), step-date rules, changed-field validators, scheduling validators, and cumulative-percent targets with a parity test against the store merge.
• Not built: C1d, C2b-e, C3a-c, C4a-e, C5a-b.
• Branches: feat/631-api-on-m3 (current, stacked on M3), plus feat/631-api-lane and feat/631-api-c1e (older copies).

3. Editor-managed Save (dates_managed) and its UI. These are the UI commits that save through PUT /api/plans/{id}/editor and POST .../editor/preview: the review panel and acknowledgements, command-id retry, and handling of an uncertain outcome. They are on branch feat/631-editor-ui-rebased. The publication plan for the scoped ship lists which of its commits are parked. The legacy-writer guards (#1010-#1014) are merged and become active only once this ships.

4. Retention ledger runtime, #905. The PR is open and parked (see its last comment).

• Finding 2 is fixed.
• Part 1 of finding 1 is pushed: never-started legacy ramps become 'new'.
• Part 2 is built locally and needs review. Mid-ramp legacy ramps become 'trusted' and freeze their baseline from the demand shown at the next step; the owner decided both of these rules.
• Branches: fix/631-retention-ledger-runtime and fix/631-905-finding2.
• Related: fix(purchase): fail a plan step's root row atomically with its reason and suppression release #1052.

5. Canonical service slugs everywhere. The owner decided that legacy pre-#608 slugs are rewritten to canonical, and that the ledger treats both as one service. The plan has 6 tasks (A2, A1, B1, B2, C, D) and was reviewed to closure. A2 is parked locally on branch fix/631-canonical-slugs-baselines.

6. End-to-end harness (M6) and editor route exposure (M7). A planned browser → API → Postgres Playwright harness with an egress recorder. It is reviewed to closure. It depends on 1-3.

7. Smaller items recorded during the work:

• The integration tests run on postgres:16-alpine, not 17.
• Frontend Playwright hard-codes port 4173, which collides across worktrees; PORT should come from the environment.
• Duplicate Create on reload.
• A draft is lost on session expiry.
• A toast overlaps at 320px.
• A plan with a filter and a scheduled root cannot clear the filter in the editor.

Refs #631