Every plan that lands snapshots the previous working graph. Undo restores it, including any rule violations the plan had closed. Nothing is ever lost.
Rules let you turn 'we always do X' into a one-line invariant. They re-evaluate after every applied plan, so the moment something drifts, you see the violation, and the planner already has a suggested fix.
Watch this: the auth fix from lesson 3 gets undone — and the rule violation reappears, because the rule says every route under /todos needs requireAuth. The Rules panel opens so you can see the rule that flagged it.