fix: separate plan results, execution recovery, and tool outcomes

[1052326311]

An approved plan can keep showing a build spinner after the turn ends. Recovery also infers execution intent from English sentences and detects repeated work from truncated tool-name lists, so localized continuation requests and legitimate reads of different files can stop incorrectly. Tool hooks and SDK notifications can additionally double-count an invocation or interpret an external-tool dispatch acknowledgment as a completed operation.

This change separates durable plan results, the active turn, and individual tool outcomes:

• Stable plan/step IDs, atomic revisions, explicit reopen/report operations, project-scoped permissions, and snapshot reconciliation preserve checked results across turns, reordering, reloads and interrupted streams.
• A language-independent report_task_status protocol replaces sentence/word-count recovery heuristics. Recovery compares full per-cycle arguments and result digests, is bounded, and preserves waiting/error/stalled/aborted outcomes. Read-only requests cannot trigger automatic file repair.
• SDK execution events own the invocation ledger; supplementary hooks preserve clarification, integration and artifacts. Cached hooks rebind to the current stream. Dispatch acknowledgments are not execution success. Historical cards with no recorded result remain unconfirmed.
• Final replies and recovery rounds share the same event pipeline. The UI separates completed, failed and unknown operations and stops spinning when a turn ends without guessing plan completion.

Validation is documented in docs/plan-progress.md. Regression coverage includes Chinese/English intent, negations and filenames, distinct/repeated/changed reads, inner MCP failures, missing reports, cancellation, complete-only responses, cached callback rebinding, and a replay of the real SDK external-tool acknowledgment sequence. Database plan tests also cover concurrent/idempotent writes, isolation, rollback and retirement. Downstream production validation uses a separate QA project and preserves existing app sources.

The final Linux runtime regression suite passes 52/52 tests; the standalone public core suite passes 35/35. The production Web build passes. Full type checks still have existing baseline errors (11 API errors in index/preview-proxy and two Web NotebookLM store errors); this is not a claim of a completely green upstream tree. Provider behavior and all-device/multi-user concurrency are not exhaustively covered.

This branch includes #55's final-response fix; reviewing/merging #55 first reduces this diff. #57 adds localization on top of this lifecycle change. This PR retains Doable branding and English defaults and contains no downstream domains, credentials or business data.

[1052326311]

Superseded by #59 with a clean consolidated history, current regression evidence, and resumed-session instruction refresh. Closing this overlapping PR; the previous discussion and patch remain available here.