fix(flow): repair fplan_registry counter corruption + add registry-no-edit rule to global prompt

.aipass/aipass_global_prompt.md

@@ -38,6 +38,8 @@ Examples:
 
 Agents live in branches. Sub-agents work for agents. `.trinity/passport.json` = agent (citizen), not sub-agent.
 
+Never manually edit a registry. AIPASS_REGISTRY.json, fplan_registry.json, dplan_registry.json — all managed by their owning systems (spawn, flow). Use the commands: `drone @flow create/close`, `drone @spawn`. Manual edits corrupt counters and break pipelines.
+
 # Branches
 
 Every branch follows same structure:

src/aipass/flow/apps/handlers/plan/close_ops.py

@@ -220,9 +220,9 @@ def _self_heal_unregistered_plan(
     }
 
     registry["plans"][actual_key] = entry
-    num_val = int(actual_key) + 1
-    if registry.get("next_number", 0) <= int(actual_key):
-        registry["next_number"] = num_val
+    if actual_key != plan_key:
+        # Collision bumped plan to the next_number slot — advance counter.
+        registry["next_number"] = int(actual_key) + 1
     save_registry_fn(registry, registry_file=reg_file)
 
     messages.append(

src/aipass/flow/tests/test_close_ops.py

@@ -139,9 +139,10 @@ class TestClosePlanImplAllFlag:
 class TestClosePlanImplNotFound:
     """Plan not found in registry."""
 
+    @patch("aipass.flow.apps.handlers.plan.close_ops._find_unregistered_plan_file", return_value=None)
     @patch("aipass.flow.apps.handlers.plan.close_ops._resolve_registry_file", return_value=None)
     @patch("aipass.flow.apps.handlers.plan.close_ops._find_plan_across_registries", return_value=None)
-    def test_plan_not_found_returns_error(self, _mock_find, _mock_resolve):
+    def test_plan_not_found_returns_error(self, _mock_find, _mock_resolve, _mock_unregistered):
         close_plan_impl = _import_close_plan_impl()
         deps = _make_deps()
         deps["validate_plan_exists"].return_value = (False, "Plan 99 not found")
@@ -571,7 +572,7 @@ class TestSelfHealNoCollision:
         assert "0176" in updated_reg["plans"]
         assert updated_reg["plans"]["0176"]["self_healed"] is True
         assert updated_reg["plans"]["0176"]["status"] == "open"
-        assert updated_reg["next_number"] == 177
+        assert updated_reg["next_number"] == 175
         save_fn.assert_called_once_with(registry, registry_file="dplan_registry.json")
 
     @patch("aipass.flow.apps.handlers.plan.close_ops.discover_plan_types", create=True)