Make the Supply run from the plan revision Push to Calendar pushed

A plan edit landing between a successful Push and the Generate that
followed it made the Supply run from the newer plan while the push answer
reported supply_run generated, so the list could hold a dinner Calendar
never showed (MQ-133-01).

Push now returns the revision it pushed, and the push hook calls
shopping.GeneratePushed, which checks inside its transaction that the
week's plan is still at that revision (week_plans.revision, as the draft
path does) and otherwise fails with ErrPlanChanged, leaving the Supply run
as it was. The push answer then reports supply_run failed with error
plan_changed (retryable: push again), logged as a warning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/plans.go

@@ -106,9 +106,12 @@ type pushedPlan struct {
 // pushedSupplyRun says whether a Push to Calendar made the week's Supply
 // run. status is generated when it did; archived when the week's Supply
 // run is in the Supply archive and was left as it was; or failed when it
-// could not be made, when error says so and POST
-// /shopping/{weekStart}/generate makes it again. error is null when
-// status is generated.
+// was not made. A failed Supply run's error is plan_changed when the plan
+// was edited after it was pushed, so the Supply run was not made from a
+// plan Calendar does not show and pushing again makes it; or
+// supply_run_failed when it could not be made, and POST
+// /shopping/{weekStart}/generate makes it again. error is null when status
+// is generated.
 type pushedSupplyRun struct {
 	Status string    `json:"status"`
 	Error  *apiError `json:"error"`
@@ -122,15 +125,16 @@ type pushedSupplyRun struct {
 // The Supply run is made after the push, never as part of it: Calendar
 // already shows the plan, so a Supply run that cannot be made does not
 // undo or fail the push. The answer is still 200 with supply_run failed,
-// and the failure is logged as an error, so nothing claims a Supply run
-// that was not made.
+// and the failure is logged, so nothing claims a Supply run that was not
+// made. It is made only from the plan as pushed: one edited between the
+// push and the Supply run is not made into a Supply run.
 func postPlanPush(logger *slog.Logger, svc *plan.Service, shop *shopping.Service) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		week, ok := weekStartOrFail(w, r, logger)
 		if !ok {
 			return
 		}
-		p, err := svc.Push(r.Context(), week)
+		p, revision, err := svc.Push(r.Context(), week)
 		if err != nil {
 			writePlanPushError(w, r, logger, err)
 			return
@@ -139,9 +143,16 @@ func postPlanPush(logger *slog.Logger, svc *plan.Service, shop *shopping.Service
 		// gone.
 		ctx := context.WithoutCancel(r.Context())
 		run := pushedSupplyRun{Status: "generated"}
-		if _, err := shop.Generate(ctx, week); errors.Is(err, shopping.ErrFrozen) {
+		if _, err := shop.GeneratePushed(ctx, week, revision); errors.Is(err, shopping.ErrFrozen) {
 			logger.InfoContext(ctx, "Supply run in the Supply archive left as it was after Push to Calendar", "week", week.String())
 			run = pushedSupplyRun{Status: "archived", Error: &apiError{Code: "archived", Message: err.Error()}}
+		} else if errors.Is(err, shopping.ErrPlanChanged) {
+			logger.WarnContext(ctx, "plan edited after Push to Calendar; Supply run not made", "week", week.String())
+			run = pushedSupplyRun{Status: "failed", Error: &apiError{
+				Code:      "plan_changed",
+				Message:   "the plan is on Calendar as pushed, but it was edited before its Supply run was made, so no Supply run was made from it; push again",
+				Retryable: true,
+			}}
 		} else if err != nil {
 			logger.ErrorContext(ctx, "generate Supply run after Push to Calendar", "week", week.String(), "error", err)
 			run = pushedSupplyRun{Status: "failed", Error: &apiError{

internal/server/shopping_test.go

@@ -437,6 +437,51 @@ func TestPushPlanSupplyRunFails(t *testing.T) {
 	}
 }
 
+// TestPushPlanEditedBeforeSupplyRun: a plan edit landing after the push
+// is recorded but before the Supply run is made does not make the Supply
+// run from the edited plan, which Calendar does not show. The push stands
+// (200, on Calendar) and the answer says the Supply run was not made
+// because the plan changed.
+func TestPushPlanEditedBeforeSupplyRun(t *testing.T) {
+	t.Parallel()
+	e := newPlansRouter(t)
+	e.groundWeek(t)
+	e.connectCalendar(t, true)
+	// Once the push records Sunday's event, the household swaps Tuesday to
+	// Pad Thai, as a swap does: committed before the Supply run is made.
+	if _, err := e.st.Writer.ExecContext(t.Context(), `CREATE TRIGGER edit_after_push
+		AFTER UPDATE OF calendar_event_id ON plan_days
+		WHEN NEW.date = '2026-10-18' AND NEW.calendar_event_id IS NOT NULL
+		BEGIN
+			UPDATE plan_days SET dinner_id = '`+e.questLog+`', is_new = 1, calendar_event_id = NULL WHERE date = '2026-10-13';
+			UPDATE week_plans SET status = CASE WHEN status = 'synced' THEN 'changed' ELSE status END, revision = revision + 1;
+		END`); err != nil {
+		t.Fatal(err)
+	}
+
+	rec, body := e.push(t, "2026-10-12")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("push = %d %s, want 200", rec.Code, rec.Body)
+	}
+	want := map[string]any{"status": "failed", "error": map[string]any{
+		"code":      "plan_changed",
+		"message":   "the plan is on Calendar as pushed, but it was edited before its Supply run was made, so no Supply run was made from it; push again",
+		"retryable": true,
+	}}
+	if !reflect.DeepEqual(body["supply_run"], want) {
+		t.Errorf("supply_run = %v, want %v", body["supply_run"], want)
+	}
+	if n := len(e.google.Events(pushCalendar.ID)); n != 7 {
+		t.Errorf("calendar has %d events, want 7", n)
+	}
+	if status, got := callShopping(t, e, http.MethodGet, shoppingPath+"2026-10-12", "", nil); status != http.StatusNotFound {
+		t.Errorf("GET after the edit = %d %v, want 404: no Supply run from the edited plan", status, got)
+	}
+	if !strings.Contains(e.logs.String(), `"level":"WARN","msg":"plan edited after Push to Calendar; Supply run not made"`) {
+		t.Errorf("logs = %s, want the edit logged as a warning", e.logs)
+	}
+}
+
 // TestPushPlanLeavesArchivedSupplyRun: pushing a week whose Supply run is
 // in the Supply archive leaves it as it was and says so.
 func TestPushPlanLeavesArchivedSupplyRun(t *testing.T) {