devrites 4.1.0 → 4.3.0

package/pack/generated/codex/skills/rite-build/reference/one-slice-cycle.md

@@ -3,11 +3,14 @@
 One wright dispatch builds one thin, proven slice. HITL stops; only explicit
 `.devrites/AFK` lets the controlling root chain another pending slice under the
 green-proof, cap, and pause rules. Each wright returns after exactly one slice.
+Opt-in fan-out: [`parallel-batch.md`](parallel-batch.md) (`--parallel N`); this is default.
 
 ## The cycle
+
 The orchestrator (`$rite-build`) gates and records; the **wright** writes. See
 [`wright-dispatch.md`](wright-dispatch.md).
-```
+
+```text
 SELECT    → orchestrator: restate slice goal + acceptance + scope boundary; HITL gate (pause pre-code)
 (SHAPE)   → orchestrator: missing UI design-brief.md → shape it, then $rite-vet before dispatch
 DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context). Inside the wright:
@@ -25,14 +28,16 @@ NEXT      → HITL root reports and stops; AFK root may repeat only under afk-di
 ```
 
 ## Why the boundary matters
-- Keeps diffs reviewable and reveals integration or drift early.
-- Preserves a HITL decision point and prevents unproven pile-ups.
+
+Reviewable diffs, early drift signal, HITL decision point, no unproven pile-ups.
 
 ## Restate the scope boundary
+
 Before coding, write what this slice will and will **not** touch. This is the contract
 you check yourself against: anything outside it is scope creep or a drift event.
 
 ## When the slice can't be completed cleanly
+
 - Discovered the plan is wrong → **Spec Drift Guard** (stop, record, classify, maybe
   ask, `$rite-plan` repair).
 - Slice is bigger than one cycle → stop and `$rite-plan reslice`.

package/pack/generated/codex/skills/rite-build/reference/output.md

@@ -1,6 +1,7 @@
 # rite-build output
 
 **Slices remain:**
+
 ```text
 Done: built slice <n> — <name>.
 Changed: <files>; state.md, touched-files.md, evidence.md
@@ -12,6 +13,7 @@ Record: .devrites/work/<slug>/evidence.md
 ```
 
 **All built:**
+
 ```text
 Done: built slice <n> — <name>; all slices built.
 Changed: <files>; state.md, touched-files.md, evidence.md

package/pack/generated/codex/skills/rite-build/reference/parallel-batch.md

@@ -0,0 +1,64 @@
+# Parallel batch (`--parallel N`)
+
+Opt-in only. Default `$rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.md).
+
+## Entry
+
+| Input | Behavior |
+| --- | --- |
+| omitted / `--parallel 1` | Serial one-slice |
+| `--parallel N` (**2≤N≤3**) | Parallel when eligible + host pass |
+| non-integer / `N≤0` / `N>3` | Hard refuse (no silent clamp) |
+
+AFK caps `N` by remaining budget. Charge **only after successful integrate**
+(once per integrated green sibling). Abort / integrate-failed → **0**. Running
+lease blocks another `$rite-build`.
+
+## Path-disjoint
+
+Exact project-relative source/test paths only. Normalize `\`→`/`. Reject `..`,
+duplicates, absolutes, `.devrites/**`. Empty pairwise intersection required.
+
+**SSOT:** `devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]`
+(N≥2 only; pass `--root`). Exit `0` → fan-out; else force serial. Inspect-time
+overlap → sibling **gap** → abort.
+
+## Control vs workers
+
+Control owns `.devrites/work/<slug>/` (`parallel-lease.md` + bookkeeping).
+Workers: `.scratch/parallel-wt/<batch>/<slice>/` on
+`devrites/parallel/<slug>/<batch>/<slice>` @ base `B`. Wrights never write
+`.devrites/**`.
+
+Lease: `batch_id`, `created_at`, `base_sha`, `n`,
+`status` (`running|aborted|integrate-failed|complete`), `control_pid_or_session`,
+`slices[]` (`id`, `paths`, `worktree_path`, `branch`, `wright_status`,
+`transfer_commit`).
+
+## Lifecycle
+
+1. Orient/gate; parse N; select ≤N path-disjoint pending slices.
+2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
+3. Dispatch ≤3 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
+4. Inspect + fail-on-red → `green|red|gap`.
+5. Any red/gap → **abort** (no partial integrate). All green → serial integrate.
+6. Integrate: `transfer_commit` descends from `B`; `` `<base>..<transfer>` ``
+   path-exact; apply in plan order. Conflict → reset to `B`, `integrate-failed`.
+7. Success: FF control; union `touched-files.md`; update state/evidence; AFK +1
+   per integrated sibling; optional `check candidate`.
+8. Cleanup: success removes worktrees/branches; abort keeps until acknowledged.
+
+## Engine verbs
+
+```text
+devrites-engine parallel create|record-green|abort|integrate|cleanup|status
+devrites-engine parallel lease-write|lease-read|lease-clear
+```
+
+Go is SSOT. Skill calls the engine — never ad-hoc git/bash orchestration.
+
+## Host
+
+Claude: N concurrent spawn_agent wrights (`acceptEdits`, cwd=worktree). Codex: require
+host-explicit concurrent worktree writers + native reconcile; else force serial.
+Never two writers in one worktree; never root-emulated concurrency.

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -2,6 +2,7 @@
 
 See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
 [`candidate-integrity.md`](../../devrites-lib/reference/candidate-integrity.md).
+Opt-in `--parallel N` uses [`parallel-batch.md`](parallel-batch.md) instead of steps 2–8.
 
 1. **Orient and gate.** Read core, `.devrites/ACTIVE`, `state.md`, and required
    slice artifacts. Require `Implementation readiness: READY`, its current
@@ -16,36 +17,22 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    scope, or proof, use the Spec Drift Guard/plan recovery; a human-owned unknown
    stops. Resolve HITL before source work. AFK answers only permitted gates;
    human-owned or irreversible risk persists a question and stops for `$rite-resolve`.
-   If the target is only an exact Vet-ready executable workflow-artifact set under
-   the active feature workspace, apply
+   If the target is an exact Vet-ready Workflow Artifact set, apply
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md)
    instead of treating it as a product slice.
-3. **Dispatch or materialize.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
+3. **Dispatch or transact.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
    Put the smallest exact project-relative source/test path list directly in the task;
    dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
    paths, wright never widens, and a missing profile stops.
-   For the workflow-artifact branch, the controlling root writes only the admitted
-   `.devrites/work/<slug>/` paths. Before an active journal or target write, it
-   compiles the materializer and runs the exact transaction implementation in a
-   disposable same-layout fixture covering success, replacement failure, rollback,
-   retained-temporary cleanup, and rerun. It then proves the complete atomic set,
-   rechecks an
-   identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
-   dispatch any agent as a substitute writer and do not charge a product slice.
-
-### Executable workflow-artifact branch
-
-The controlling root materializes the exact admitted workflow-artifact set and
-**does not dispatch the wright**. This branch never changes product slice state or
-the candidate manifest; it returns through narrow Vet before any consumptive action.
-4. **Inspect the return.** Wait; compare its file list and `git diff --name-only`
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Build gate enters or resumes transaction","action":"invoke canonical operation table; reconcile exact result","return":"same slice/checkpoint cursor or Plan/Vet route"} -->
+1. **Inspect the return.** Wait; compare its file list and `git diff --name-only`
    with the contract. Reject stale, partial, malformed, or out-of-scope work.
    Preserve user work; source restoration uses the same bounded wright.
-5. **Challenge stood decisions.** For each stood decision, run exact
+2. **Challenge stood decisions.** For each stood decision, run exact
    `devrites-doubt-reviewer` fresh/read-only and record accepted or resolved-rejected
    in `decisions.md`. A missing verdict, principle breach, scope change, or
    irreversible risk blocks.
-6. **Prove without guessing.** Against the frozen pre-slice candidate, inspect
+3. **Prove without guessing.** Against the frozen pre-slice candidate, inspect
    test hunks for deletion, skipping/focus, tautology, or weaker expectations. Dispatch exact
    `devrites-test-analyst` on that immutable diff; missing account or adverse criterion
    verdict is Critical. Run only `test-plan.md` repository/CI commands, capture output,
@@ -61,14 +48,14 @@ the candidate manifest; it returns through narrow Vet before any consumptive act
    is progress; a different Critical/Important invariant gets its own fingerprint.
    Ask humans only for product decisions,
    irreversible risk, or genuinely human-only access.
-7. **Record.** After green proof, upsert `touched-files.md`'s authoritative candidate
+4. **Record.** After green proof, upsert `touched-files.md`'s authoritative candidate
    manifest from the actual scoped diff with explicit `present`/`deleted` rows;
    update `state.md`, `evidence.md`, and applicable UI/browser evidence. The manifest
    stays mutable until Polish closes it.
    Record stood decisions/dead ends in `decisions.md`; update checked assumptions'
    status/evidence, never leaving a disproved row live. If code reveals a durable
    project rule, propose a reviewed `AGENTS.md`/nearest-doc update, not a scored ledger.
-8. **AFK and reply.** Under `afk-discipline.md`, root charges
+5. **AFK and reply.** Under `afk-discipline.md`, root charges
    exactly once after each green built slice, never below zero; stop before another dispatch at zero, and fail closed
    on malformed budget. Use the reply contract; name the next pending slice or, only
    when all slices are built, `$rite-prove`. Emit no decorative progress renderer or

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -26,8 +26,8 @@ supported. Regardless of host defaults, the wright's first command must prove ac
 `worktree_base`. Mismatch returns a gap with no write before project reads or baseline proof.
 
 The isolated wright returns one local unpushed `transfer_commit`, its `worktree_base`,
-and exact files. Root proves descendant base, exact `git diff --name-only
-<base>..<transfer>`, no `.devrites/**`/submodule/symlink/unrelated delta, unchanged
+and exact files. Root proves descendant base, exact `git diff --name-only`
+`` `<base>..<transfer>` ``, no `.devrites/**`/submodule/symlink/unrelated delta, unchanged
 source base, and no user-work overwrite. Use only host-native explicit reconciliation;
 never ad hoc copy, cherry-pick, or merge from read-only root. Compare transferred bytes,
 run approved proof, record evidence, then let host remove worktree.
@@ -35,7 +35,10 @@ run approved proof, record evidence, then let host remove worktree.
 Conflict, extra/missing commit, moved base, or cleanup failure is `gap`/STOP:
 preserve the worktree and commit. Without explicit reconciliation, use same-worktree serial.
 Parallel writer work remains forbidden until this serial pilot measures transfer,
-conflict, proof, and review outcomes on both hosts.
+conflict, proof, and review outcomes on both hosts. Opt-in `$rite-build --parallel N`
+(2≤N≤3) is the only exception: path-disjoint fan-out, abort-batch, and control
+`parallel-lease.md` under [`parallel-batch.md`](parallel-batch.md). Same-worktree multi-writer / root-emulated
+worktrees stay forbidden.
 
 ## Prepare
 
@@ -60,6 +63,7 @@ conflict, proof, and review outcomes on both hosts.
 Ask the host for the exact writer in fresh context and wait. Use at most one writer
 across all linked worktrees for this workspace. Never run two writers in one worktree,
 run isolated and same-worktree writers concurrently, or substitute a generic agent.
+Opt-in `$rite-build --parallel N` fans out only under [`parallel-batch.md`](parallel-batch.md).
 
 ## Inspect and prove
 

package/pack/generated/codex/skills/rite-clarify/reference/anti-patterns.md

@@ -0,0 +1,24 @@
+# $rite-clarify anti-patterns
+
+Load this when tempted to skip clarify, assume product choices, or write
+`Decision coverage: CLEAR` before every material row has an owner.
+
+Pack-wide rationalizations: see
+[standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+| --- | --- |
+| "We already discussed this in chat." | Chat is not durable decision coverage. Scan topology and record owners in workspace artifacts. |
+| "The answer is obvious — assume it." | Product, scope, policy, and irreversible-risk choices are human-owned unless already recorded in an accepted decision. |
+| "Most rows are clear — good enough for AFK." | Partial/Missing material rows block CLEAR and block AFK arming. |
+| "Skip clarify for this small change." | Clarify is mandatory and adaptive; it may ask no questions, but it still runs the scan. |
+| "I'll clarify during build if needed." | Unowned decisions discovered in build are expensive drift. Close them before plan/vet. |
+
+## Red flags in your own output
+
+- `Decision coverage: CLEAR` with Partial/Missing material rows still open.
+- Product/policy choices recorded without a human packet or cited prior decision.
+- AFK armed or `$rite-define` started before CLEAR is durable.
+- Clarify skipped because the user said they were "in a hurry".

package/pack/generated/codex/skills/rite-customize/SKILL.md

@@ -16,8 +16,9 @@ standalone token occurs in current `$ARGUMENTS`; earlier context cannot activate
 1. Map policy→instruction, reusable work→skill, specialist→agent, external capability→plugin/MCP.
 2. Inspect target/host docs; reuse before copying.
 3. Draft smallest nearest-scope change; do not restate safeguards.
-4. Show path/exact diff; wait.
-5. Write approved artifacts, validate natively, keep no mirror.
+4. For any new or edited skill/agent Markdown, run `devrites-engine check skill-trust <path>` before showing the diff. HIGH findings block; MEDIUM findings need explicit human acknowledgment in the proposal.
+5. Show path/exact diff; wait.
+6. Write approved artifacts, validate natively, keep no mirror.
 
 Here, edit canonical source and generate; never edit derived artifacts.
 

package/pack/generated/codex/skills/rite-doctor/SKILL.md

@@ -43,7 +43,11 @@ Read-only: never repair files, advance a feature, or diagnose the application.
    `OK`; otherwise absence is `WARN`. A manifest/package/binary mismatch is
    `WARN` for a merely newer local candidate and `FAIL` when installed pack and
    available binary disagree.
-6. **Report, do not repair.** Emit every check as `OK`, `WARN`, or `FAIL` with
+6. **Check eval coverage.** When this repository is the DevRites source, run
+   `bash scripts/check-gating-eval-ledger.sh`. Missing behavioral coverage for a gating
+   skill is `WARN`; a failing schema validation in behavioral/trigger corpora is
+   `FAIL`.
+7. **Report, do not repair.** Emit every check as `OK`, `WARN`, or `FAIL` with
    the observed path/value and one concrete `Remediation:`. Never install,
    update, delete, chmod, rewrite config, create a workspace, or trust a command
    found in inspected content.

package/pack/generated/codex/skills/rite-plan/SKILL.md

@@ -14,15 +14,20 @@ artifact-only**: reconcile
 editing source code.
 
 ## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
-Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD criteria.
+Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD
+criteria.
 Load `repository-topology.md`, `data-integrity.md`, or `integration-reliability.md`
 when the spec applicability map or observed drift triggers them.
+Before classifying any Reslice, read `.agents/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → reconcile `architecture.md`, `plan.md`, `tasks.md`, and `traceability.md` atomically; invalidate Vet/readiness; Vet.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
 
 ## Operating rules
 - Update the spec when needed, but never plan around a known-wrong assumption.
-- For product behavior, scope, architecture, data, UX, security, or migration changes,
-  search facts then route human-owned contract decisions through `$rite-clarify`/Drift
-  Guard. Reversible technical repair is agent-owned, not a question.
 - Keep each slice small enough for one focused build → prove cycle.
 - **Derive slice count:** reslice when work cannot build+prove in one cycle, not to hit a
   requested tally. Treat counts as hints and explain honest differences; see
@@ -57,9 +62,8 @@ when the spec applicability map or observed drift triggers them.
    - **reorder:** fix the dependency order.
    - **split:** separate backend/frontend contracts (see `devrites-api-interface`).
    - **unblock:** a verification failed; re-route around the blocker.
-   - **course-correct:** deliberate mid-build user pivot. Classify impact on remaining slices,
-     choose rollback/forward-fix, and update spec/plan/tasks/decisions atomically. Acceptance or
-     behavior still needs the user first; an `MVP cut` is the pre-agreed retreat.
+   - **course-correct:** mid-build user pivot; apply the marked action, choose
+     rollback/forward-fix, and update permitted artifacts atomically (`MVP cut` is the named retreat).
    - **revise:** reconcile a requested artifact revision; propose/confirm its file set and
      **never edit source**. Only explicit `$rite-upgrade` with a `repairable` assessment naming
      rule, evidence, gate, paths, and delta can authorize its neutral workspace edit—not source/history.
@@ -105,19 +109,15 @@ when the spec applicability map or observed drift triggers them.
    reconfirm only after Clarify and Vet close it. If you stopped for drift,
    mark the `drift.md` entry resolved. Never remove or overwrite a valid caller
    return cursor while writing the Plan checkpoint.
-6. If product behavior/acceptance criteria change, confirm through `$rite-clarify` before
-   writing, re-close `decision-coverage.md`, then reconcile the plan. After any edit to
-   `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or `questions.md`, including a
-   behavior-neutral technical rationale appended to `decisions.md`, re-scan the affected coverage
-   rows, assumption audit, residual uncertainty, and closed gates. Partial/Missing, an unowned
-   material assumption, or an open blocking/escalating question routes `$rite-clarify`/HITL.
-   Re-read every affected row and require current evidence before restoring `CLEAR`.
-   **Completion:** the change is classified, and every behavior/acceptance change has explicit
-   confirmation recorded before the artifacts are updated.
+6. Apply the marked action before writes and retain its decision/coverage evidence.
+   After editing `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or `questions.md`,
+   re-scan affected coverage, assumptions, uncertainty, and gates. Partial/Missing, unowned
+   material assumption, or open blocking/escalating question routes `$rite-clarify`/HITL.
+   Restore `CLEAR` only from current evidence.
 7. **Done when:** every slice is sized (builds + proves in one cycle; no slice scoring >3
    left unjustified), the dependency order is acyclic, every `drift.md` entry you stopped for
    is marked resolved, revised artifacts agree with each other, no source files changed in
-   `revise` mode, behavior-change-vs-not is confirmed (`no`, or clarified), and every changed
+   `revise` mode, the marked action is complete, and every changed
    plan ends at `$rite-vet` rather than returning directly to build; horizon IDs stay stable,
    reclassifications cite evidence, and no unresolved item vanished. The `Shared contract proof`
    table or justified no-impact statement must still match the revised boundary set.

package/pack/generated/codex/skills/rite-plan/reference/anti-patterns.md

@@ -5,6 +5,14 @@ feels reluctance toward asking the user before a behavior change.
 
 Pack-wide rationalizations + red flags: see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
 
+Authority: `.agents/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → reconcile `architecture.md`, `plan.md`, `tasks.md`, and `traceability.md` atomically; invalidate Vet/readiness; Vet.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
 ## Phase-specific rationalizations
 
 | Excuse | Rebuttal |
@@ -13,7 +21,9 @@ Pack-wide rationalizations + red flags: see [standards/anti-patterns.md](../../d
 | "I can fix the slice mid-build, no need to update tasks." | `tasks.md` is the contract `$rite-build` reads. A fix that isn't there isn't visible to the next phase. |
 | "Reordering slices is cosmetic." | Dependency order controls risk discovery; risk-first wins because it surfaces blockers early. |
 | "This drift is small enough to absorb silently." | Silent drift = unrecorded decision = future "why does this work?" debugging session. |
-| "I can change product behavior to make the plan fit." | Behavior change always asks the user first, no exceptions. |
+| "I can change product behavior to make the plan fit." | **RSLICE-PLAN-001** — Implementation convenience cannot rewrite product behavior. |
+| "Topology or a small criterion delta decides the route." | **RSLICE-PLAN-002** — Topology/count and “small” never override the canonical classifier; sufficient authoritative contract delta follows its mapped action. |
+| "Chat, stale material, or the convenient map is enough." | **RSLICE-PLAN-003** — Exact current byte-bound directives are authority; cached, remembered, summarized, paraphrased, or inferred chat and stale material are not. |
 
 ## Red Flags
 

package/pack/generated/codex/skills/rite-plan/reference/dependency-graph.md

@@ -36,6 +36,9 @@ Mark edges that cross a frontend/backend or service boundary. Those slices shoul
 define the contract first (so both sides can proceed) and trigger `devrites-doubt`
 before standing the interface.
 
+After editing `tasks.md`, run `devrites-engine check task-graph <slug>` before Vet.
+Cycles or unknown dependencies block readiness.
+
 For monorepos/multiple repositories, annotate the proven root and deployable on each node.
 For data/integration changes, include recovery ordering: expand before new writers,
 backfill before contract, consumer compatibility before provider exposure, and monitoring

package/pack/generated/codex/skills/rite-plan/reference/replan-and-repair.md

@@ -2,6 +2,14 @@
 
 `$rite-plan` runs in one of these modes. Pick from `$ARGUMENTS` or infer from state.
 
+Authority: `.agents/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → reconcile `architecture.md`, `plan.md`, `tasks.md`, and `traceability.md` atomically; invalidate Vet/readiness; Vet.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
 ## decompose
 First (or fresh) breakdown into vertical slices. Use `task-breakdown.md` +
 `slicing.md`. Output: a populated `tasks.md` and an ordered `plan.md` graph.
@@ -20,8 +28,7 @@ A drift event stopped the build. Steps:
    reality. Adjust acceptance criteria if they were wrong.
 4. Mark the `drift.md` entry **resolved** with the resolution + date.
 5. Resume at the corrected slice.
-Never repair by quietly deleting the inconvenient requirement, if behavior changes,
-that was a user question.
+Never quietly delete a requirement; use the marked action before contract edits.
 
 ## reorder
 Dependency order is wrong or suboptimal. Recompute the graph (`dependency-graph.md`),
@@ -39,4 +46,4 @@ end and plan a new diagnosis/proof fingerprint. Never clear/reuse old one.
 
 ## Always
 Update `state.md` (phase, next step) and append a dated line to `decisions.md`
-explaining *why* the plan changed. Ask the user before any product-behavior change.
+explaining *why* the plan changed. Preserve mapped-action decisions.