feat(docs): add detailed planning objectives and optimization rules documentation

docs/adr/0003-constraint-first-lexicographic-planning.md

@@ -2,4 +2,6 @@
 
 The ten-second automatic deadline is superseded by [ADR 0006](0006-user-selected-horizons-and-cancellable-calculations.md), implemented by issue #59. Technical callers can still opt into an explicit planning-work budget; the user flow has no automatic cutoff.
 
+The fixed ordering between user preferences and configurable optimization objectives, including the unconditional priority for at-risk loss prevention, is superseded by [ADR 0008](0008-user-controlled-planning-objectives.md); implementation of that decision is pending.
+
 VacOptimizer resolves obligation rules exactly and jointly, then applies deterministic heuristic stages for at-risk loss, ordered preferences, complete public-holiday weeks, calendar gain, work-sequence quality, supporting placements, balance expiry, and dates in that order; complete holiday weeks therefore precede broader calendar-gain and work-sequence optimization. A completed plan does not claim mathematical global optimality. The dependency-free planner targets five seconds, returns `PlanningIncomplete` if those stages are interrupted, and stops after ten seconds. A HiGHS WebAssembly spike missed that hard limit on representative inputs even on the development machine, so no solver dependency is accepted. This supersedes ADR 0001.

docs/adr/0008-user-controlled-planning-objectives.md

@@ -0,0 +1,23 @@
+---
+status: accepted
+---
+
+# User-Controlled Planning Objectives
+
+VacOptimizer represents configurable plan-wide objectives as named optimization rules in the same user-controlled list as calendar-based planning rules, adding rule types where existing calendar patterns cannot express the objective. All active preference rules share one user-defined lexicographic order, so moving an optimization preference above Samedi Malin may deliberately forgo earned leave to improve that higher-priority objective. Making the displayed order authoritative supersedes the fixed ordering between user preferences and optimization objectives in [ADR 0003](0003-constraint-first-lexicographic-planning.md).
+
+At-risk loss prevention also becomes an optimization rule, enabled in first position by default and freely disableable or reorderable. The planner follows the resulting preference order even when a higher-priority preference leaves more at-risk leave unplaced; this also supersedes ADR 0003's unconditional priority for loss prevention.
+
+Optimization rules use preference mode. Supporting them as obligations would require explicit thresholds and additional conflict semantics, which are outside this change.
+
+The shared model for user-created optimization rules selects planning elements and applicable conditions, a measure and its aggregation, and a direction to minimize or maximize. At minimum, the application supplies six presets expressed in that same model: loss prevention, public-holiday week value, non-working-day gain, longest work-sequence length, the deficit of internal work sequences shorter than five working days, and the number of supporting placements.
+
+These presets retain their existing domain meanings, including the weekday-dependent value of complete public-holiday weeks and the total deficit of short work sequences rather than their count. Supporting placements are additional uses of balances expiring after the planning horizon to improve the plan. User-created rules can compose supported planning elements and measures; introducing a new domain measure requires extending the planner.
+
+The six presets are initially enabled, ordered as loss prevention, existing calendar-based rules, then the other five optimization presets in their former engine order. Existing saved rule lists, including an empty list, receive this addition once while preserving every existing rule's identity, parameters, force, enabled state, and relative order. Subsequent loads restore the user's saved choices without reinserting deleted presets or reactivating disabled ones.
+
+After all active rules compare equally, earlier balance expiry and then earlier placement dates remain deterministic tie-breakers.
+
+Only active rules drive placement decisions and preference comparisons; disabled or deleted optimization rules have no residual influence through fixed optimization stages or protected metrics. With no active rules, the planner adds no leave placements, even when balances are at risk of expiring, and retains declared non-working days. Final tie-breakers cannot independently trigger new placements.
+
+Implementation is pending.