fix(02): revise plans per checker (B1 + 4 flags) — add tabs permission for D-P2-02

- BLOCKER B1: add `tabs` to manifest.json permissions (DEC-011 Amendment 1
  cites Phase 2 D-P2-02 meta.urls feature as justification). Honors
  D-P2-02 "all tabs visible" wording verbatim. Updates manifest-i18n test
  expected permission list lockstep.
- F1: add A28 harness assertion for REQ-archive-layout strict zip-layout
  verification (5 entries, no extras).
- F2: createArchive empty-tracker fallback removed; logs warn + sets
  urls:[] instead of fake [extension-origin URL]. 02-01 RED test pins
  empty-tracker → urls:[].
- F3: 02-02 Task 3 prose deliberation struck; typed `blob-url-mint-failed`
  throw is the resolved-only contract.
- F4: 02-02 Task 3 verify block adds full-suite `npm test` after focused
  test runs.
- A27 strict-mode (Plan 02-04): REQUIRES both URLs in meta.urls; FAILS
  on length < 2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.planning/phases/02-stabilize-export-pipeline/02-CONTEXT.md

@@ -136,7 +136,42 @@ None — discussion stayed within phase scope.
 
 </deferred>
 
+## Revision Log
+
+### 2026-05-20 — DEC-011 Amendment 1 + plan-checker iteration 1
+
+- **DEC-011 Amendment 1 (Phase 2 scope addition):** `tabs` permission ADDED to manifest.json
+  per user direction during plan-checker iteration 1. Justification: Phase 2's D-P2-02
+  meta.urls feature REQUIRES tab URL visibility beyond active-tab semantics. Audit T-1-02
+  ("declaring unused permissions expands attack surface") is acknowledged but overridden for
+  this Phase 2 feature; the meta.urls feature is now genuinely USED, so the permission is not
+  unused. tests/i18n/manifest-i18n.test.ts pins the new 8-entry permission set as a
+  regression guard. PROJECT.md DEC-011 row rewritten with Amendment 1 prose.
+- **Plan 02-04 A27 strict-mode:** harness MUST observe BOTH tab URLs in meta.urls after a
+  multi-tab session. meta.urls.length >= 2 REQUIRED; test FAILS on length < 2. No
+  extension-origin sentinels permitted. Empty-tracker case (no browser interaction during
+  recording) still produces urls:[] per F2 resolution — but A27 explicitly EXERCISES the
+  multi-tab path so its meta.urls is NEVER empty.
+- **createArchive empty-tracker fallback removed (F2):** tracker.getTabUrlsSeen() returning
+  empty array is meaningful (whole-desktop-no-tab session) and meta.urls: [] is the canonical
+  representation. tests/background/meta-json-urls-schema.test.ts adds Test 5 pinning this
+  contract; tests/build/strict-meta-json-validation.test.ts Test 3 relaxed to PERMIT empty
+  urls[] (still validates URL format on non-empty arrays). createArchive calls a new
+  snapshotOpenTabs() helper (chrome.tabs.query({}) defensive enumeration via DEC-011
+  Amendment 1) BEFORE reading getTabUrlsSeen() so any tab the operator opened but never
+  activated is still captured. Empty array IS the result when no tabs are open at SAVE time.
+- **Plan 02-04 A28 added (F1):** REQ-archive-layout strict zip-layout pin. Harness driver
+  enumerates zip entries and asserts EXACTLY 5 paths (`video/last_30sec.webm`,
+  `rrweb/session.json`, `logs/events.json`, `screenshot.png`, `meta.json`). Cross-references
+  REQ-archive-layout + REQ-popup-ui + REQ-screenshot-on-export. UAT target: 28→29 GREEN.
+- **Plan 02-02 Task 3 F3 resolved:** OR-deliberation in createArchive prose struck. The
+  resolved-only contract is: throw typed `blob-url-mint-failed` error on empty/timeout
+  response from offscreen; NO data: URL fallback for any archive size.
+- **Plan 02-02 Task 3 F4 resolved:** verify block extended with full-suite `npm test` after
+  the focused-test runs so unrelated regressions surface during execution.
+
 ---
 
 *Phase: 2-stabilize-export-pipeline*
 *Context gathered: 2026-05-20*
+*Revised: 2026-05-20 (plan-checker iteration 1)*