Apologies, a couple of typos:

>         form.add_password('passwd1', title="Password Confirm",
>             required=False,

         form.add_password('passwd1', title="Password",
             required=True,

....


> The Spec.explain_difference(value) pattern you suggest below is for
> sure useful for error details from a developer's point of view, but
> does feel right as the solution for this

but does *not* feel right...