21-03-PLAN.md

phase	21-polish
plan	3
type	execute
wave	1
depends_on	21-polish/21-01-SUMMARY.md
files_modified	src/handlers/mention.ts src/handlers/mention.test.ts
autonomous	true

Improve write guardrail refusal UX: include the triggering file/path, the triggering rule, and the smallest config change to allow it when safe. This plan also covers policy refusals on the PR-branch update path (same-repo PR head), not just bot PR creation. Task 1: enrich refusal payload src/handlers/mention.ts When a write is blocked by denyPaths, allowPaths mismatch, entropy scan, or regex secret detection: - include `path` (or best-effort location) in the reply when available - include a stable rule identifier (existing reason code) - include a suggested minimal config change when safe (e.g. add a narrow allowPaths pattern), otherwise explicitly say no safe suggestion Task 2: add tests covering refusal message fields src/handlers/mention.test.ts Add unit tests asserting the refusal reply includes rule + path and that suggestions are conservative. - bun test Create `.planning/phases/21-polish/21-03-SUMMARY.md`.