Function explain_with_coverage_at_level 

pub fn explain_with_coverage_at_level(
    command: &str,
    engine_level: Option<&'static Level>,
) -> Explanation

The coverage-fallback explanation (built-in classifier + the user’s permissions.allow patterns), computed UNDER the configured engine level so a covered command honors that level’s rule — a worktree destroy an editor plan forbids classifies as denied here too, not re-admitted. None engine level → the plain 3-band coverage (paranoid/reader/default). The caller still gates the result’s overall <= threshold; running under the level closes the last path a lower plan’s tighter rule could leak through.