fix(plan): review fixes — single notify per check_replace with Revised flag, rune-safe evidence_note truncation, wire rollback note

Author: jkyberneees

docs/PLANNING.md

@@ -300,6 +300,11 @@ standard built-in interface (`Name`/`Description`/`Schema`/`Call`).
 | `check_replace` | `step_id`, `check_id`, `justification`, plus `replacement` or `evidence_note` | Replaces one dead/stale/environment-denied check with a fresh pending one, or marks it satisfied by equivalent verification that ran via other tools. Justification is mandatory and audit-trailed in the revision block. |
 | `get` | — | Returns the current plan (or `"No active plan."`). |
 
+Note on wire compatibility: a check whose tool call was denied by the
+approval gate renders with status `blocked`. Sessions persisted by builds
+that know `blocked` fail to parse on older odek binaries (which reject the
+unknown status); resume such sessions only on equal-or-newer builds.
+
 ### Incremental revisions
 
 Use `revise` when the plan changes after work or evidence already exists.

internal/loop/plan.go

@@ -637,8 +637,8 @@ func (s *PlanStore) checkReplace(args planArgs) (string, error) {
 		wStep.Checks[ci] = fresh[0]
 	case args.EvidenceNote != "":
 		note := normalizePlanText(args.EvidenceNote)
-		if len(note) > maxPlanCheckDescChars {
-			note = note[:maxPlanCheckDescChars]
+		if runes := []rune(note); len(runes) > maxPlanCheckDescChars {
+			note = string(runes[:maxPlanCheckDescChars])
 		}
 		wStep.Checks[ci] = PlanCheck{
 			ID:          old.ID,
@@ -660,7 +660,10 @@ func (s *PlanStore) checkReplace(args planArgs) (string, error) {
 	}
 	s.noteStatusTransitionsLocked(s.plan.Steps, working)
 	s.plan = &candidate
-	s.notifyLocked(false, false)
+	// executeArgs fires the single notify for every effective mutation;
+	// notifying here would double-fire plan_updated. Mark the revision so
+	// downstream change events carry Revised (same contract as revise).
+	s.revisionNotify = true
 	return s.renderLocked(), nil
 }