docs(plans): add viewport-relative cursor and server-side sub-status plans

[RonenMars]

Two implementation plans, each validated across multiple review rounds with every load-bearing claim independently reproduced before it was written down.

PlanCup — viewport-relative cursor positioning (tb-mobile)

services/virtual-terminal.ts resolves absolute cursor moves against its whole append-only scrollback grid instead of the 40-row viewport the TUI paints against, so every footer repaint lands in the middle of the transcript.

Measured on origin/main: one repaint after 41+ seeded rows loses two transcript lines and mangles a third into "tr✻ Brewing… (12s · ↑ 3.4k tokens)", and a spinner repeats it for the whole turn.
It fires on every session resume, not only long sessions, because terminal_replay seeds ~200 rendered rows before the first live frame arrives.

Scope is the four cursor-moving handlers — H, f, A, B — chosen by two independent principles that select the same set: handlers that move the cursor become viewport-relative, handlers that mutate grid structure do not; and only defects with measured impact are in.
The prototype is 152/152 across eleven terminal suites with tsc clean and zero test rewrites.

PlanIndicator — server-side agent sub-status (tb-streamer + tb-mobile)

Replaces the closed #647, which derived the indicator on the client by scraping mobile's own emulator and never worked because of the bug above.
The streamer already runs a correct headless screen at the geometry the TUI paints against, already scrapes it on every chunk, and already ships model/effort/permissionMode off the same footer.

The plan carries the clearing rule that keeps the phase from latching, a bespoke scoped frame rather than a session copy, and an always-emit-null contract.

Review notes

Two questions each caught a defect that had already cleared two sign-offs, and both are recorded in the plans:

• Any input used to reject an alternative must be run against the accepted design. This caught an unclamped cursor move that made the fix strictly worse than the status quo — 62 stray escapes evicted 121 of 200 transcript rows where main lost none — and then caught a phase field that latched exactly as #647's pill did.
• What does the thing I am reusing already do on every call? This caught unguarded per-tick SQLite writes, a response mapper whose != null guard silently drops an explicit null, and an elapsedMs that recomputes every call and would have re-rendered the app ~3x/second for a whole turn.

Line-anchor drift occurred twice during review, so every path:line reference in both documents was extracted and machine-checked against the cited file.

Docs only — no code changes.