test: harden v0.8.3 plan-mode trust-boundary tests + fix nested marker tracking (#899)

Follow-up from the v0.8.3 multi-model code review (GPT 5.4, Gemini 3.1 Pro,
Kimi K2.5, MiniMax M2.7, Claude). All non-blocking; the release is correct.

- processor.ts: remove the nested `// altimate_change` block around the
  reworded plan-no-tool warning. `script/upstream/analyze.ts` `findMarkers`
  uses a single `openBlock` with no nesting stack, so the inner `start`
  clobbered the outer plan-refusal block and dropped it from marker tracking.
  The warning text is already inside the outer block, so removing the inner
  markers keeps the strict gate green (pure deletion) and restores correct
  block tracking. (Gemini, verified against analyze.ts:499-520.)
- plan.txt: revert the start-marker description edit. plan.txt is imported raw
  into the LLM prompt, so the added words were model-visible; the prose itself
  already documents the trivial-task escape hatch. (Gemini #5.)
- plan-layer-e2e.test.ts / release-v0.8.3-adversarial.test.ts: replace
  `session: {} as any` with a structurally valid `{ slug, time: { created } }`
  and add an explicit `Flag.OPENCODE_EXPERIMENTAL_PLAN_MODE === false`
  precondition, so a future flag flip fails loudly instead of throwing an
  opaque TypeError in `Session.plan`. (Consensus; Gemini MAJOR.)
- plan-layer-e2e.test.ts: add an end-to-end SINK test — drive insertReminders'
  output through the real `system`-array hoist and `MessageV2.toModelMessages`,
  asserting attacker text never reaches `system` and the hoisted reminder is
  not duplicated into the user role. (GPT.)
- release-v0.8.3-adversarial.test.ts: make the wording-fix guards
  concept/synonym-tolerant (keep the load-bearing negative "too thin to act
  on" guard) so legitimate copy improvements don't break the suite. (MiniMax.)
- plan-layer-e2e.test.ts: rename the mislabeled `insertReminders return shape`
  test — it asserts the `InsertRemindersResult` type alias, not runtime
  behaviour (which is covered by the behavioral describe). (MiniMax.)

Closes #898

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: anandgupta42

packages/opencode/src/session/processor.ts

@@ -398,15 +398,13 @@ export namespace SessionProcessor {
                       type: "text",
                       synthetic: true,
                       text:
-                        // altimate_change start — #888 follow-up: reworded warning copy (de-blame the user, /model last resort)
                         `⚠️ altimate-code: the \`plan\` agent on \`${input.model.providerID}/${input.model.id}\` ` +
                         `stopped without calling any tools — it neither read, searched, nor explored the codebase. ` +
                         `Common causes: (a) the model wrote a plan from prompt context alone, (b) the model declined ` +
                         `to engage with the request (content-policy refusal), or (c) the request may need more detail. ` +
                         `To recover, try one of: reply asking it to investigate first (\`read\`/\`grep\`/\`glob\`/\`explore\`); ` +
                         `rephrase the request more concretely; or, if it keeps refusing, \`/model\` to a tier that's more ` +
                         `eager to explore (e.g. Claude Sonnet/Opus).`,
-                        // altimate_change end
                       time: { start: Date.now(), end: Date.now() },
                     })
                   }

packages/opencode/src/session/prompt/plan.txt

@@ -20,7 +20,7 @@ Ask the user clarifying questions or ask for their opinion when weighing tradeof
 
 ---
 
-// altimate_change start — mandatory exploration before drafting (+ trivial-task escape hatch)
+// altimate_change start — mandatory exploration before drafting
 ## Investigate before drafting (REQUIRED)
 
 Before you write any plan content — outline OR full plan — you MUST call at least one read-only investigation tool against the actual codebase. Acceptable first moves: