docs(01-09): amend Task 5 step 11 + success criteria #3 post-Bug B

Original step 11 expected stop-sharing → ERROR badge + recovery
notification; under Bug B fix (b9eeeeb), user-stopped-sharing is
correctly routed → IDLE (badge OFF, no recovery notification) because
it's a deliberate lifecycle event, not an error.

Amendments:
- Step 11: badge OFF (not ERROR); no recovery notification; popup cleared
- Step 12: operator clicks toolbar directly (no notification to click)
- Step 14: failure-mode list updated to match new expectations
- Step 15 added: ERROR state coverage moved to separate genuine-error step
- Success criteria #3: split user-stopped-sharing (→ OFF) from genuine
  errors (→ ERROR + recovery notification, preserved fallback)

See .planning/debug/resolved/01-09-recovery-flow.md for the debug record.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.planning/phases/01-stabilize-video-pipeline/01-09-PLAN.md

@@ -537,10 +537,11 @@ NO 'as any', NO @ts-ignore — every new chrome.* call must be properly typed vi
     8. Wait ~35 seconds (or longer to validate the post-Option-C port lifecycle still holds).
     9. Click the toolbar icon. The popup opens (NOT the picker — because setRecordingMode set the popup to 'src/popup/index.html'). Click 'Сохранить отчёт об ошибке'. The save flow runs; the zip lands in ~/Downloads as session_report_*.zip.
     10. Open the zip; confirm video/last_30sec.webm is present and (validated by Plan 01-08) plays for ~30s in Chrome and mpv.
-    11. Stop the sharing via Chrome's 'Stop sharing' banner button. Badge transitions to ERROR ('ERR' text, yellow background). A recovery notification 'Mokosh stopped — Recording stopped. Click here to start a new session.' appears.
-    12. Click the recovery notification. The picker reappears; pick Entire screen; recording resumes; badge returns to REC.
+    11. Stop the sharing via Chrome's 'Stop sharing' banner button. Badge transitions to OFF ('OFF' text, neutral background — user stopped deliberately, this is not an error). NO recovery notification fires (would be noise for a deliberate stop; the OS 'Sharing your screen' indicator going away is the operator's confirmation). Popup is cleared so toolbar.onClicked re-fires for restart. (AMENDED 2026-05-17 post-Bug B: prior expectation routed user-stopped-sharing through ERROR state which locked operator out — see .planning/debug/resolved/01-09-recovery-flow.md.)
+    12. Click the toolbar icon (no notification to click since stop was deliberate). The picker reappears; pick Entire screen; recording resumes; badge returns to REC.
     13. Edge-case: click the toolbar icon WITHOUT a prior recording (after step 3 + reload extension without restart). The picker should appear directly (NOT the popup). This validates that initialize → setIdleMode set the popup to '' so onClicked fires.
-    14. If any of steps 4 (notification appears), 5 (picker is monitor-only), 9 (popup opens on toolbar click while recording), 11 (badge transitions to ERROR + recovery notification), 12 (recovery click triggers picker), or 13 (idle toolbar click triggers picker directly) FAIL, document the exact failure mode + reproduction steps. The plan iterates on the failing handler.
+    14. If any of steps 4 (notification appears), 5 (picker is monitor-only), 9 (popup opens on toolbar click while recording), 11 (badge transitions to OFF after deliberate stop — NOT ERROR; no recovery notification), 12 (post-stop toolbar click triggers picker for restart), or 13 (idle toolbar click triggers picker directly) FAIL, document the exact failure mode + reproduction steps. The plan iterates on the failing handler.
+    15. ERROR state coverage (separate from 11-12): genuine recording failures (codec init failure, port disconnect, etc.) still route through setErrorMode + recovery notification — that path is preserved by Bug B fix as the defensive fallback. No operator step here unless a real error surfaces during the smoke; if it does, document it.
   </how-to-verify>
   <resume-signal>
     Type 'approved' after steps 1-13 all PASS. If any step fails, paste the failure diagnostic + your Chrome version + locale + whether KEEP_PROFILE was used; Task 4 iterates.
@@ -585,7 +586,7 @@ NO 'as any', NO @ts-ignore — every new chrome.* call must be properly typed vi
 Plan 01-09 is complete when:
 1. The 4 displaySurface tests + 13 toolbar/badge/notification/popup-idle-race tests (17 new total) are all GREEN.
 2. All 60 baseline GREEN tests from Plan 01-08 remain GREEN.
-3. Operator runs the Task 5 checkpoint and confirms the end-to-end UX works: idle-toolbar-click triggers picker; recording-toolbar-click opens popup; onStartup notification appears; recovery notification appears after stop-sharing; badge transitions REC/OFF/ERROR visibly.
+3. Operator runs the Task 5 checkpoint and confirms the end-to-end UX works: idle-toolbar-click triggers picker; recording-toolbar-click opens popup; onStartup notification appears; deliberate stop-sharing transitions badge → OFF (not ERROR) with NO recovery notification (per Bug B fix — user-stopped-sharing is a normal lifecycle event); operator can restart via direct toolbar click; ERROR state + recovery notification still trigger for genuine error codes.
 4. manifest.json + smoke.sh + popup updated consistently with the new UX charter.
 5. tsc + build clean.
 </success_criteria>