Execution Anomaly Detection & Root Cause Analysis for Decision Service Incidents

The RCA panel is the join that was missing: "is anything wrong", "explain this window", and "show me the evidence" — previously requiring four consoles — in one surface.

**Execution anomaly detection** finds statistical outliers in the recorded decision trace: step budget spikes vs p99, latency spikes, error rate increases, and new output shapes that weren't present in the baseline window. Detection is mathematical — no model involved.

**RCA narration**: the RCA API ('manager/src/rca_api.rs') provides detection, anomaly list, and explain endpoints. The explain step sends the anomaly record, associated execution traces, and structural diff to 'POST /ai/review-diff'. The narration is joined onto the structural diff — a rule named in the narration that doesn't appear in the diff is marked unverified.

**Export for SIEM**: the analysis list exports as CSV with model prose fenced between '[AI_NARRATION_START]' / '[AI_NARRATION_END]' markers so a reviewer can distinguish the measurement from the interpretation.

**Auth honesty**: a 401/403 response renders as a permission fact with the request path — not as an empty "healthy" list. An empty healthy list is the most dangerous response during an incident.