Should Claude Code's 'plan first' mode be a real lock, not just a hint?

With terminal coding agents like Claude Code or Codex, telling the agent to plan first or hold off on edits doesn't always stop it before files get touched. In one case, a Codex run was asked to stop and explain its plan, but by then a couple of files had already been edited, leaving an awkward half-finished diff to decide whether to keep or clean up. Right now, an instruction like "don't edit files yet" is just a prompt-level request the agent is expected to remember while making tool calls, not something that's actually enforced.

The idea raised is to turn plan-first into a genuine read-only lock that stays in effect until the user explicitly unlocks it, rather than something the agent could forget mid-task. It also floats the idea of a small state report whenever a run is interrupted, showing which files changed, which commands started, what's safe to revert, and what the agent still intended to do.