feat: make Plan mode enforceable and recovery-safe

CONTEXT.md

@@ -198,6 +198,30 @@ Interaction mode controls the style of a provider turn. `default` is ordinary ex
 
 Plan mode can create actionable proposed plans that may later be implemented or handed off, so UI should preserve the distinction between a plan and an ordinary assistant response.
 
+Plan mode is also an app-owned authorization boundary. JCode's structured provider policy,
+server admission, adapter permission enforcement, runtime identity, and durable turn authority
+decide whether Plan is available and what a turn may do. Provider prompts and legacy capability
+flags are not authority. Plan permits bounded reads and user questions and denies commands,
+workspace writes, external effects, and unknown operations.
+
+Claude Agent and Kilo are supported through provider-specific enforcement. OpenCode is
+available only through a current, session-bound, authenticated JCode Managed Isolated
+attestation. Codex is retained as a legacy read-only server path but is not presented as
+Plan-capable. Cursor, Devin, Gemini, OpenClaw, and Pi are unsupported. The UI preserves exact
+loading or denial reasons and does not silently convert unavailable Plan work to Default.
+
+Implementing a proposed plan creates a separate Default-mode turn bound to the exact source
+thread, plan ID, and `planUpdatedAt` revision. The server revalidates that reference at command
+admission, queued promotion, and provider-start ingestion. Provider starts and lifecycle events
+must also match durable expected-start identity, authority epoch, scope, phase, and routing.
+Inbox, immutable ledger, outbox, consumer receipts, rollback tombstones, FIFO scheduling,
+backpressure, quarantine, and startup redrive make that authority replayable across reordering
+and restart.
+
+The canonical decision, provider matrix, Managed OpenCode attestation contract, migration
+lineage, privacy/retention rules, and non-goals are in
+[ADR 0012](docs/adr/0012-plan-mode-authorization-and-durable-turn-lifecycle-authority.md).
+
 ### Thread Environment
 
 A thread environment describes whether a thread works in the project's local workspace or an associated git worktree. `local` uses the project workspace root. `worktree` uses branch/worktree metadata and may be created for isolated implementation or pull-request preparation.

DESIGN.md

@@ -48,7 +48,7 @@ JCode has two token layers: generic shadcn/Tailwind-compatible tokens and cockpi
 | Terminal        | `--terminal-font-family`, `--app-terminal-search-match-*`, `--app-terminal-search-active-match-*`, `--app-scrollbar-thumb`, `--app-scrollbar-thumb-hover`                                                                                                                                                                  | Terminal xterm font, search highlights, and scrollbar parity.                                                          |
 | Chrome controls | `--app-chrome-control-bg`, `--app-chrome-control-border`, `--app-chrome-control-fg`, `--app-chrome-control-hover-bg`, `--app-chrome-control-hover-fg`, `--app-chrome-control-active-bg`, `--app-control-icon-*`, `.sidebar-icon-button`                                                                                    | Compact icon buttons, message actions, terminal/browser/diff toolbar actions.                                          |
 | Metadata        | `--app-metadata-fg`, `--app-metadata-muted-fg`, `--app-text-metadata`, `--app-text-metadata-strong`                                                                                                                                                                                                                        | Secondary labels, timestamps, environment labels, settings status text.                                                |
-| Status          | `--app-status-{working,success,warning,input,plan,error,muted}-{fg,dot,bg,border}`                                                                                                                                                                                                                                         | Thread, terminal, PR, plan, input, warning, success, working, error, and muted markers.                                |
+| Status          | `--app-status-{working,success,warning,input,plan,error,muted}-{fg,dot,bg,border}`, `--app-toast-warning-bg`                                                                                                                                                                                                               | Thread, terminal, PR, plan, input, warning, success, working, error, and muted markers plus opaque warning toasts.     |
 | Agent accents   | `--app-agent-chip-*`, `--app-subagent-accent-*`                                                                                                                                                                                                                                                                            | Provider/agent chips and subagent identity accents.                                                                    |
 
 Source rules:
@@ -84,6 +84,7 @@ Rules:
 - `ChatTranscriptPane` owns the transcript stage through `.app-transcript-stage` and renders `MessagesTimeline` with scroll-to-bottom chrome using `--app-scroll-button-*`.
 - `MessagesTimeline` renders assistant messages in `.app-assistant-message`, user messages in `.app-user-message`, and file-change/activity summaries through `--app-work-row-*`, `--app-diff-card-*`, and metadata tokens.
 - `ChatMarkdown` owns markdown scannability: headings, links, inline code role classes, code blocks, copy buttons, tables, local generated images, and lazy image rendering.
+- `ComposerPlanModeBlockedReason` renders complete, wrapped Plan recovery guidance above the compact composer toolbar so narrow panes keep the required action visible.
 - Chat-output semantic roles must stay conservative: file paths, commands, theme tokens, success/warning/error states can be colored; ordinary text stays neutral.
 
 ### Diff