0.19.0 — plan-mode false-block rework

Plan mode stopped fighting investigation work. Mined from two weeks of session history (155 sessions): 54 hard-blocked read-only commands, 28 headless confirm-blocks, 15 rejects — six false-positive classes in the plan-mode bash classifier, several reproduced live while debugging them.

Fixed (extensions/modules/plan)

• Quoted angle brackets are data — jq 'select(.x > "1")', grep -oE "[^<]" and friends auto-run again; the redirect scan is quote-aware. Real redirects (> file) and true writers stay hard-blocked.
• Substitutions classify their inner command — $(…)/backticks/<(…) no longer blanket hard-block: read-only inner runs (sed -n "$(grep -n f)p" file), unknown inner prompts (TOKEN=$(curl …)), write inner blocks.
• Heredocs prompt instead of dying — python3 - <<'EOF' analysis scripts take the confirm tier, not a write block.
• Bare env reads — env | grep -i PI_ was classified as a writer.
• sed stops parsing paths as s-commands — sed -n '800,845p' …/modules/plan/index.ts was 'not read-only' because the path faked s/modules/plan/index with flags containing e. A substitution as the sed script is uninspectable → confirm.
• Research tools auto-allow — web_search, web_extract, web_map, web_screenshot, web_pdf, tool_search, todo join READ_ONLY_TOOLS (web_interact/crawlers/generators stay confirm-tier).

Recommended next step (settings, no upgrade needed)

classifier.planGate.observe: true in ~/.pi/agent/settings.json logs safe/unsafe verdicts for confirm-tier commands (ceulen-plan-gate tag in classifier.log). After a planning session or two, flip classifier.planGate.enabled: true to auto-run the safe ones — that's the remaining Allow-prompt fatigue, absorbed.

29-command regression fixture table pins every command class from the logs; full suite 2877 green.