Summary

Add human-in-the-loop apply for pdd checkup prompt <target>.

Users apply selected source-set improvements suggested by the unified prompt report, only with explicit human approval:

pdd checkup prompt csv_parser --interactive --apply
pdd checkup prompt csv_parser --interactive --apply --dry-run

Both --interactive and --apply are required in v1.

Part of epic #833. Depends on #1379 (unified report + actions[]).

Product goal

Keep users in prompt space longer. When PDD finds missing vocabulary, coverage, stories, or waivers, users should not manually copy-paste every fix. PDD proposes schema-aware edits; the human remains in control.

Authority model:

Deterministic report finds issues.
Optional explanation suggests actions (#1379 --explain).
Human approves selected actions.
Deterministic applicators edit prompt/story files.
Postflight re-runs checks.

LLM never writes files directly.

Focused commands (pdd checkup lint, pdd checkup contract check, …) remain unchanged for CI; postflight may call them or pdd checkup prompt <target> --strict on touched files.

Scope — writable files only

CLI rules

Patch kinds (v1)

Parse-aware only:

• add vocabulary definition
• create vocabulary section
• add coverage line
• append contract rule
• add waiver
• create story file from template
• append story ## Covers

No arbitrary unified-diff application in v1.

Safety

• Atomic writes
• Backup: .pdd/evidence/checkups/backups/<run_id>/
• Apply log: .pdd/evidence/checkups/apply-<run_id>.json
• Postflight: pdd checkup contract check or pdd checkup prompt <target> --strict on touched files
• On failure: show restore / backup path

Example UX

Issue 1 of 3: The term "valid row" is not defined.

Suggested patch:
Add to <vocabulary>:
- Valid row: a CSV row with the expected number of columns and parseable field values.

Apply this change? [y/N/e/s]

Modules (suggested)

• pdd/checkup_apply.py — deterministic patch applicators
• Wire into checkup_prompt_main.py from #1379
• Reuse contract_ir.py section boundaries

Non-goals

• No non-interactive auto-apply.
• No apply-by-confidence.
• No writes to generated code (#1371 territory).
• No arbitrary LLM patch application.
• No CI apply mode.
• No capability policy code-file changes.

Acceptance criteria

• --apply without --interactive returns a clear error.
• --dry-run leaves bytes unchanged.
• Approved vocabulary patch updates prompt file.
• Rejected patch leaves file unchanged.
• Story creation handles collisions safely.
• Apply log and backup written before mutation.
• Postflight check runs and reports result.
• pdd checkup lint / contract check / … still work unchanged.