refactor(desktop): move Plan state and readers into Conversation

[chihumyum]

Summary

Plan state and proposal projection currently live in AppShellContent, so Plan updates rebuild the shell even though the proposal and execution surfaces are their actual readers. Move the existing controller into a Conversation-owned PlanProvider and put both production readers below it. AppShell supplies only the Session target; the public entry exposes regional components and services, not the Plan controller or full-state hook.

Inject a narrow Plan service port, preserve the current query gate, scope fencing, confirmation targets and approval/resume retry inputs, and leave settings writes with Session Settings. Register the sole controller owner with the existing architecture guard, remove the old root module/barrel access, and shrink the shell hook inventory from 33 hooks / 55 calls to 32 / 54. No product, visual, storage or IPC behavior change is intended.

Refs #4582 (M4). This is the bounded Plan ownership slice, not completion of the full R2 issue.

Verification

Rebased onto 751f9cc2521ab9cb33f17a1fa356204ea4c7fe2a (including #5850), with the current lockfile and dependency patches. Local checks on the rebased branch:

• Desktop build and test suite: 3,069 passed, 0 failed.
• Renderer architecture: 121 passed, plus --base upstream/main --strict-base; checker implementation is unchanged.
• Desktop typecheck (main, preload, renderer and Storybook), full Desktop build, lint, format and Desktop Knip passed.
• Hook gate, ASF headers, locale hygiene, Astryx and Windows inventory checks passed; generated inventories were refreshed. git diff --check and merge-tree validation against main passed.
• The new integration test mounts the real proposal/execution readers in ChatSurfaceLayout: a shared query/subscription owner updates their output without rerendering the frame or sibling or replacing its draft input. The existing Plan lifecycle tests remain in use. The adapter test covers non-enumerable/Proxy bridge methods.

Computer Use acceptance used a real Electron window, preload/Main/Host, Runtime tools and SQLite with an isolated profile and a deterministic local model endpoint. It passed proposal creation/revision/approval, progress updates, Session switching, stop, full process restart, resume/completion, and both cancel/confirm paths for abandonment. During a 1/3 → 2/3 update, the real Composer retained its draft and selected text; typing replaced the preserved selection without refocusing. Read-only SQLite inspection confirmed 14 ordered Plan events and the expected completed/cancelled executions.

That window run used the original implementation before the main-branch integrations above and was not repeated during this conflict resolution. The Plan controller, panels, owner, service port/adapter and owner integration test remain byte-identical to the reviewed original head. Shell integration now preserves #5850's scoped read ports and test-only constructors, and service composition retains the new storage-usage provider. Automated checks were rerun after integration. This does not claim online-provider, signed-package or whole-application performance acceptance. The full Playwright E2E suite was not run; #5447 remains independent Plan lifecycle E2E work.

Integration

#5850 is now on the base branch. This PR preserves its Session-bound readers and private construction modules, uses its testing entry for state construction, and adds the private Plan controller owner. The architecture ledger and Astryx inventory were regenerated from the combined source; no checker rules were weakened. Storage-usage services added by #5832 remain wired alongside the Plan services.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with architecture analysis, implementation, tests, local validation, Computer Use acceptance and PR preparation. The commit includes Generated-by: OpenAI Codex.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[hqhq1025]

Reviewed commit 743628e354d2d95aa2a188101a6aa173f95e601d. The Plan controller moves from AppShell into the Conversation PlanProvider (apps/desktop/src/renderer/app-shell.tsx:1781, features/conversation/ui/plan-provider.tsx:25); proposal and execution projections now read that shared owner near their UI surfaces (features/conversation/ui/plan-surfaces.tsx:26-40). The controller's session scope, latest-read fencing, query gate, control retries, and confirmation behavior remain in place; the Desktop adapter delegates the same bridge session methods. I found no substantiated P0–P3 issue in the inspected paths.

Locally, the focused Plan/query-gate tests passed (11/11), the renderer architecture tests and guard passed (112/112), AppShell hook check passed, and Desktop main build plus renderer typecheck passed after applying the repository's dependency patches. The current-head hosted test and label checks pass, and the branch merges cleanly with current main. I did not repeat the PR author's real Electron lifecycle run, online-provider testing, signed packaging, or the full local Desktop suite; this is not merge approval.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[Astro-Han]

Reviewed exact head 743628e354d2d95aa2a188101a6aa173f95e601d. No P0–P2 findings; the move looks behaviour-preserving.

• use-plan-mode-state.ts is a rename of the old panel hook; the only change is routing the seven window.maka.sessions.* calls through injected services (created once in main.tsx, so subscriptions are not re-armed). PlanProposalCard / PlanExecutionPanel bodies are unchanged.
• PlanProvider receives the same session input as the old call site and is not keyed, so session-switch reset, latest-read fencing and teardown are unchanged; the execution panel keeps its !sharedSessionActive && sessionsSelected guard.
• Plan-only updates now re-render the provider and its two readers instead of the whole shell; moved tests only changed imports / gained a PlanServicesProvider wrapper, and plan-owner.test.ts adds shared-read and render-isolation coverage.

Optional P3 nits:

1. create-conversation-plan-services.ts returns the whole bridge.sessions object (inline).
2. PlanProvider passes the hook result straight into the context value; if that object is rebuilt per render, both readers re-render on every shell render. Same cost as before, so not a regression — useMemo if you want it.
3. Doc comments in observable-state.ts, session-catalog-state.ts and use-external-store-selector.ts still name the deleted app-shell-session-ui-state module.

Checks run locally: ASF headers, git diff --check, check:app-shell-hooks, check:renderer-architecture, windows:inventory (current), astryx surface inventory, Desktop typecheck, and focused Plan / query-gate / session UI-state tests (all passed). Not run: the app itself, full test:dist, renderer build.

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

[Astro-Han]

P3: this hands the feature the entire bridge.sessions object, so PlanServices narrows only the type, not the runtime surface. The Goal adapter wraps method-by-method; doing the same here would keep the boundary real. The test currently asserts identity, so this may be deliberate — optional.