@antoneeo/course-creator 0.1.0-beta.16 → 0.1.0-beta.18

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [0.1.0-beta.18] - 2026-11-01
+
+### What's new
+
+**Branches that add review rows merge without a conflict.** When two branches both add rows to the review log and your project has no merge rule for that file, merging them stops on a conflict you resolve by hand. The check the agent runs when it closes a piece of work now notices the missing rule and prints the exact line to add to `.gitattributes`, so the agent sees what to fix while it works, without anyone reading release notes. Nothing changes at session start, and the note never makes a check fail.
+
+#### What to do
+
+**1. Update (everyone).** The changes arrive only with the update.
+1. Run `npm install -g @antoneeo/course-creator@latest`, then `course-creator-install-skill`.
+2. Close and reopen your agent sessions: the new version loads only at startup.
+
+To check: `npm ls -g @antoneeo/course-creator` shows 0.1.0-beta.18.
+
+### Changed
+- The shared validator (F-090): `check` prints a `[note]` when the review log (`<docs>/audit/reviews/REVIEW_LOG.md`) has no `merge` attribute, naming the line to add to `.gitattributes` at the repository root (`git check-attr`, with personal and system attribute files ignored; a per-clone `.git/info/attributes` still counts). A deliberate non-union driver is respected. The exit code is unchanged, and session orientation still runs no git.
+- `ENFORCEMENT.md`: «A review log git would not merge cleanly -- `check` names it» (F-090).
+
+## [0.1.0-beta.17] - 2026-10-31
+
+### What's new
+
+**Decisions taken on your behalf are labelled.** In the request record, a decision a session took under a delegation you gave it, and words you gave one session for work another session records, now carry their own heading. They are never read later as something you said yourself, and a delegated decision never overrides one of yours: a choice that would change it comes back to you as a question.
+
+#### What to do
+
+**1. Update (everyone).** The changes arrive only with the update.
+1. Run `npm install -g @antoneeo/course-creator@latest`, then `course-creator-install-skill`.
+2. Close and reopen your agent sessions: the new version loads only at startup.
+
+To check: `npm ls -g @antoneeo/course-creator` shows 0.1.0-beta.17.
+
+### Changed
+- Request record (`templates.md`, F-088): labelled entries `decided under delegation R<m>` and `received for <unit>`; `review.md` and `elicitation.md` treat them as the deciding session's choice or relayed words, never an owner statement.
+
 ## [0.1.0-beta.16] - 2026-10-31
 
 ### What's new

package/README.md

@@ -6,9 +6,9 @@ The package is the fourth lens of the Agentic SDLC family. It uses the shared `a
 
 <!-- whats-new:begin -->
 <!-- generated by scripts/whats_new.js from distributions/course-creator/CHANGELOG.md: edit the CHANGELOG, then run node scripts/whats_new.js --write -->
-## What's new in 0.1.0-beta.16
+## What's new in 0.1.0-beta.18
 
-**You approve the course design before production.** On significant work, such as a new course or a changed audience, once the independent design review passes, the agent stops and shows you a short summary of the design: what the course will teach and to whom, what it touches, the risks and how they are handled, and what the review found. Production starts only after your yes, which the agent records in the unit's request record. A "go ahead" given before you saw the design does not count, and in a session with nobody to answer the unit waits for you.
+**Branches that add review rows merge without a conflict.** When two branches both add rows to the review log and your project has no merge rule for that file, merging them stops on a conflict you resolve by hand. The check the agent runs when it closes a piece of work now notices the missing rule and prints the exact line to add to `.gitattributes`, so the agent sees what to fix while it works, without anyone reading release notes. Nothing changes at session start, and the note never makes a check fail.
 
 #### What to do
 
@@ -16,12 +16,7 @@ The package is the fourth lens of the Agentic SDLC family. It uses the shared `a
 1. Run `npm install -g @antoneeo/course-creator@latest`, then `course-creator-install-skill`.
 2. Close and reopen your agent sessions: the new version loads only at startup.
 
-To check: `npm ls -g @antoneeo/course-creator` shows 0.1.0-beta.16.
-
-**2. Approving the design (significant units).**
-- **This concerns you if** you use the skill for significant (L3) work. Nothing to configure: after the design review passes, the agent asks whether to proceed. Answer yes to start the production, or say what to change; the design is then revised and, where the change touches what the review judged, reviewed again before you are asked again.
-- **A unit already in progress.** Units started before 2026-10-31 are not affected. If a unit started on or after 2026-10-31 with an earlier version is already in progress or finished, `sdlc_check.py validate` shows a `[note]` saying it has `no design approval in its request record`. Why: the earlier version never asked you. To clear it, tell the agent that you approve the design as it was implemented; it records your words under a label that begins `design approved` (for example `design approved after implementation`). The note never fails a check, so you can also leave it.
-- **To check:** on your next significant unit, the agent stops after the design review and asks you before any production starts.
+To check: `npm ls -g @antoneeo/course-creator` shows 0.1.0-beta.18.
 
 Full history: [CHANGELOG](https://github.com/Antoneeo/agentic-sdlc-skill/blob/main/distributions/course-creator/CHANGELOG.md)
 <!-- whats-new:end -->

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "course-creator",
-  "version": "0.1.0-beta.16",
+  "version": "0.1.0-beta.18",
   "description": "Course creation for defined learners, with progressive explanations, sourced facts and diagnostic independent testing.",
   "author": "Antonio Pinto (https://github.com/Antoneeo)"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antoneeo/course-creator",
-  "version": "0.1.0-beta.16",
+  "version": "0.1.0-beta.18",
   "description": "Design sourced, progressive courses for a defined learner with Agentic SDLC governance and diagnostic learner simulations.",
   "keywords": ["claude-code", "gemini-cli", "codex", "course-design", "skill", "ai-agent"],
   "author": "Antonio Pinto (https://github.com/Antoneeo)",

package/scripts/init.js

@@ -1,62 +1,62 @@
-#!/usr/bin/env node
-"use strict";
-const fs = require('fs');
-const path = require('path');
-const { execFileSync } = require('child_process');
-const { SKILL_SOURCE, INSTALLED_SKILL_NAME, SELF_LENS, SIBLING_LENSES,
-  CLIENTS, clientDetected, skillTarget, wireOrientHook, detectPython } = require('./lib');
-
-const root = process.cwd();
-const seed = new Map([
-  ['ai_docs/README.md', `---\ndefault_domain: course\n---\n# Project knowledge and course work\n\nRead vision/project_vision.md, INDEX.md and reference/INDEX.md first.\n`],
-  ['ai_docs/vision/project_vision.md', `---\ndescription: Project benefit and boundaries.\nstatus: DRAFT\n---\n# Project Vision\nStatus: DRAFT\n<!-- STUB: awaiting the owner interview (vision.md §The owner interview). Not a\n     Vision: no artifact traces to it. -->\n`],
-  ['ai_docs/vision/roadmap.md', `---\ndescription: Project learning and delivery roadmap.\nstatus: DRAFT\n---\n# Roadmap\nStatus: DRAFT\n`],
-  ['ai_docs/vision/principles.md', `---\ndescription: Decisions that constrain project work.\nstatus: DRAFT\n---\n# Principles\nStatus: DRAFT\n`],
-  ['ai_docs/strategic/architecture.md', `---\ndescription: Verified component inventory.\nstatus: CURRENT\n---\n# Architecture\n\n## Component Map\n| Component | Capability it owns | Contract | Where |\n|---|---|---|---|\n\n## Architectural Patterns\n<Add only verified patterns.>\n`],
-  ['ai_docs/strategic/existing_features.md', `---\ndescription: Existing capabilities verified in this project.\nstatus: CURRENT\n---\n# Existing Features\n`],
-  ['ai_docs/audit/audit_plan.md', `# Audit Plan\n\n| Area | State | Reference | Notes |\n|---|---|---|---|\n| . | PENDING | - | Initial analysis |\n`],
-]);
-function writeIfAbsent(rel, content) {
-  const dest = path.join(root, rel);
-  if (fs.existsSync(dest)) return false;
-  fs.mkdirSync(path.dirname(dest), { recursive: true });
-  fs.writeFileSync(dest, content, 'utf8');
-  console.log(`Created ${rel}`);
-  return true;
-}
-for (const [rel, content] of seed) writeIfAbsent(rel, content);
-for (const dir of ['ai_docs/vision/features', 'ai_docs/reference', 'ai_docs/solutions/courses',
-  'ai_docs/audit/reviews']) fs.mkdirSync(path.join(root, dir), { recursive: true });
-
-const pointer = `# Course Creator project protocol\n\nUse the installed \`course-creator\` skill when the deliverable teaches a defined learner. It applies Agentic SDLC in Standalone mode: triage, project and course Vision, ANALYSIS, progressive explanations, sourced facts, independent diagnostic testing and a truthful efficacy label. Course files live in \`ai_docs/solutions/courses/<slug>/\`. Read \`ai_docs/README.md\` and the skill before working.\n\nInstall if missing: \`npm i -g @antoneeo/course-creator@beta && course-creator-install-skill\`.\n`;
-const pointers = { claude: 'CLAUDE.md', gemini: 'GEMINI.md', codex: 'AGENTS.md',
-  antigravity: 'AGENTS.md' };
-const detected = CLIENTS.filter(clientDetected);
-for (const client of detected) writeIfAbsent(pointers[client.key], pointer);
-writeIfAbsent('.cursorrules', pointer);
-const siblings = new Map();
-for (const client of detected) {
-  const parent = path.dirname(skillTarget(client));
-  for (const [name, lens] of Object.entries(SIBLING_LENSES)) {
-    if (fs.existsSync(path.join(parent, name))) siblings.set(name, lens);
-  }
-}
-if (siblings.size) {
-  const rows = [`- \`${INSTALLED_SKILL_NAME}\` — the **${SELF_LENS}** lens`,
-    ...[...siblings].map(([name, lens]) => `- \`${name}\` — the **${lens}** lens`)];
-  writeIfAbsent('AGENTIC_MULTI_LENS.md',
-    `# Agentic SDLC family routing\n\nRead \`routing.md\` to choose the owner of each deliverable; \`memory.md\` is shared.\n\n${rows.join('\n')}\n`);
-}
-const python = detectPython();
-for (const client of detected.filter(c => c.key === 'claude')) {
-  const result = wireOrientHook({ cwd: root, client, python, docsLabel: 'ai_docs' });
-  console.log(`Claude SessionStart orientation: ${result.code}`);
-}
-if (python) {
-  try {
-    execFileSync(python, [path.join(SKILL_SOURCE, 'scripts/sdlc_check.py'),
-      'index', '--root', root], { stdio: 'ignore' });
-    console.log('Generated ai_docs indexes.');
-  } catch (e) { console.log('Run sdlc_check.py index when Python is available.'); }
-}
-console.log('Course Creator initialization complete.');
+#!/usr/bin/env node
+"use strict";
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { SKILL_SOURCE, INSTALLED_SKILL_NAME, SELF_LENS, SIBLING_LENSES,
+  CLIENTS, clientDetected, skillTarget, wireOrientHook, detectPython } = require('./lib');
+
+const root = process.cwd();
+const seed = new Map([
+  ['ai_docs/README.md', `---\ndefault_domain: course\n---\n# Project knowledge and course work\n\nRead vision/project_vision.md, INDEX.md and reference/INDEX.md first.\n`],
+  ['ai_docs/vision/project_vision.md', `---\ndescription: Project benefit and boundaries.\nstatus: DRAFT\n---\n# Project Vision\nStatus: DRAFT\n<!-- STUB: awaiting the owner interview (vision.md §The owner interview). Not a\n     Vision: no artifact traces to it. -->\n`],
+  ['ai_docs/vision/roadmap.md', `---\ndescription: Project learning and delivery roadmap.\nstatus: DRAFT\n---\n# Roadmap\nStatus: DRAFT\n`],
+  ['ai_docs/vision/principles.md', `---\ndescription: Decisions that constrain project work.\nstatus: DRAFT\n---\n# Principles\nStatus: DRAFT\n`],
+  ['ai_docs/strategic/architecture.md', `---\ndescription: Verified component inventory.\nstatus: CURRENT\n---\n# Architecture\n\n## Component Map\n| Component | Capability it owns | Contract | Where |\n|---|---|---|---|\n\n## Architectural Patterns\n<Add only verified patterns.>\n`],
+  ['ai_docs/strategic/existing_features.md', `---\ndescription: Existing capabilities verified in this project.\nstatus: CURRENT\n---\n# Existing Features\n`],
+  ['ai_docs/audit/audit_plan.md', `# Audit Plan\n\n| Area | State | Reference | Notes |\n|---|---|---|---|\n| . | PENDING | - | Initial analysis |\n`],
+]);
+function writeIfAbsent(rel, content) {
+  const dest = path.join(root, rel);
+  if (fs.existsSync(dest)) return false;
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.writeFileSync(dest, content, 'utf8');
+  console.log(`Created ${rel}`);
+  return true;
+}
+for (const [rel, content] of seed) writeIfAbsent(rel, content);
+for (const dir of ['ai_docs/vision/features', 'ai_docs/reference', 'ai_docs/solutions/courses',
+  'ai_docs/audit/reviews']) fs.mkdirSync(path.join(root, dir), { recursive: true });
+
+const pointer = `# Course Creator project protocol\n\nUse the installed \`course-creator\` skill when the deliverable teaches a defined learner. It applies Agentic SDLC in Standalone mode: triage, project and course Vision, ANALYSIS, progressive explanations, sourced facts, independent diagnostic testing and a truthful efficacy label. Course files live in \`ai_docs/solutions/courses/<slug>/\`. Read \`ai_docs/README.md\` and the skill before working.\n\nInstall if missing: \`npm i -g @antoneeo/course-creator@beta && course-creator-install-skill\`.\n`;
+const pointers = { claude: 'CLAUDE.md', gemini: 'GEMINI.md', codex: 'AGENTS.md',
+  antigravity: 'AGENTS.md' };
+const detected = CLIENTS.filter(clientDetected);
+for (const client of detected) writeIfAbsent(pointers[client.key], pointer);
+writeIfAbsent('.cursorrules', pointer);
+const siblings = new Map();
+for (const client of detected) {
+  const parent = path.dirname(skillTarget(client));
+  for (const [name, lens] of Object.entries(SIBLING_LENSES)) {
+    if (fs.existsSync(path.join(parent, name))) siblings.set(name, lens);
+  }
+}
+if (siblings.size) {
+  const rows = [`- \`${INSTALLED_SKILL_NAME}\` — the **${SELF_LENS}** lens`,
+    ...[...siblings].map(([name, lens]) => `- \`${name}\` — the **${lens}** lens`)];
+  writeIfAbsent('AGENTIC_MULTI_LENS.md',
+    `# Agentic SDLC family routing\n\nRead \`routing.md\` to choose the owner of each deliverable; \`memory.md\` is shared.\n\n${rows.join('\n')}\n`);
+}
+const python = detectPython();
+for (const client of detected.filter(c => c.key === 'claude')) {
+  const result = wireOrientHook({ cwd: root, client, python, docsLabel: 'ai_docs' });
+  console.log(`Claude SessionStart orientation: ${result.code}`);
+}
+if (python) {
+  try {
+    execFileSync(python, [path.join(SKILL_SOURCE, 'scripts/sdlc_check.py'),
+      'index', '--root', root], { stdio: 'ignore' });
+    console.log('Generated ai_docs indexes.');
+  } catch (e) { console.log('Run sdlc_check.py index when Python is available.'); }
+}
+console.log('Course Creator initialization complete.');

package/scripts/lib.js

@@ -3,8 +3,8 @@
 
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
-const crypto = require('crypto');
+const os = require('os');
+const crypto = require('crypto');
 const { execSync } = require('child_process');
 
 const PACKAGE_ROOT = path.resolve(__dirname, '..');
@@ -449,104 +449,104 @@ function pathsEqual(a, b) {
     return false;
   }
 }
-function pathInside(child, parent) {
+function pathInside(child, parent) {
   try {
     const rel = path.relative(String(parent), String(child));
     return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
   } catch (e) {
     return false;
   }
-}
-
-// Ownership is per file. An existing directory without our marker belongs to its
-// owner, and a file edited after installation is retained on uninstall.
-const INSTALL_MARKER = '.course-creator-install.json';
-function hashFile(file) {
-  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
-}
-function sourceFiles(dir = SKILL_SOURCE, prefix = '') {
-  const found = [];
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    if (entry.isSymbolicLink()) continue;
-    const rel = path.join(prefix, entry.name);
-    if (entry.isDirectory()) found.push(...sourceFiles(path.join(dir, entry.name), rel));
-    else if (entry.isFile()) found.push(rel);
-  }
-  return found;
-}
-function safeOwnedPath(target, rel) {
-  if (path.isAbsolute(rel) || rel.split(/[\\/]/).includes('..')) return null;
-  const full = path.resolve(target, rel);
-  if (!pathInside(full, target)) return null;
-  let cur = path.resolve(target);
-  for (const part of path.relative(cur, full).split(path.sep)) {
-    cur = path.join(cur, part);
-    if (fs.existsSync(cur) && fs.lstatSync(cur).isSymbolicLink()) return null;
-  }
-  return full;
-}
-function ownedMarker(target) {
-  const marker = path.join(target, INSTALL_MARKER);
-  if (!fs.existsSync(marker)) return null;
-  try {
-    if (!fs.lstatSync(marker).isFile() || fs.lstatSync(marker).isSymbolicLink()) return null;
-    const data = JSON.parse(fs.readFileSync(marker, 'utf8'));
-    return data.skill === INSTALLED_SKILL_NAME && data.files &&
-      typeof data.files === 'object' ? data : null;
-  } catch (e) { return null; }
-}
-function installOwned(target) {
-  if (!fs.existsSync(SKILL_SOURCE)) return { code: 'missing-source' };
-  if (fs.existsSync(target) && (!fs.lstatSync(target).isDirectory() ||
-      fs.lstatSync(target).isSymbolicLink())) return { code: 'unowned' };
-  const existing = fs.existsSync(target) ? fs.readdirSync(target) : [];
-  const prior = ownedMarker(target);
-  if (existing.length && !prior) return { code: 'unowned' };
-  fs.mkdirSync(target, { recursive: true });
-  const owned = { ...(prior ? prior.files : {}) };
-  let copied = 0, preserved = 0;
-  for (const rel of sourceFiles()) {
-    const dest = safeOwnedPath(target, rel);
-    if (!dest) { preserved++; continue; }
-    if (fs.existsSync(dest)) {
-      if (!Object.hasOwn(owned, rel) || hashFile(dest) !== owned[rel]) {
-        preserved++; continue;
-      }
-    }
-    fs.mkdirSync(path.dirname(dest), { recursive: true });
-    fs.copyFileSync(path.join(SKILL_SOURCE, rel), dest);
-    owned[rel] = hashFile(dest);
-    copied++;
-  }
-  fs.writeFileSync(path.join(target, INSTALL_MARKER),
-    JSON.stringify({ skill: INSTALLED_SKILL_NAME, files: owned }, null, 2) + '\n');
-  return { code: 'installed', copied, preserved };
-}
-function uninstallOwned(target) {
-  if (!fs.existsSync(target) || fs.lstatSync(target).isSymbolicLink()) {
-    return { code: 'unowned' };
-  }
-  const prior = ownedMarker(target);
-  if (!prior) return { code: 'unowned' };
-  let removed = 0, preserved = 0;
-  for (const [rel, hash] of Object.entries(prior.files)) {
-    const dest = safeOwnedPath(target, rel);
-    if (!dest || !fs.existsSync(dest) || !fs.lstatSync(dest).isFile() ||
-        hashFile(dest) !== hash) { preserved++; continue; }
-    fs.unlinkSync(dest);
-    removed++;
-  }
-  fs.unlinkSync(path.join(target, INSTALL_MARKER));
-  // Remove only empty directories; a user-owned file keeps its parent.
-  const dirs = new Set(Object.keys(prior.files).map(rel => path.dirname(rel)));
-  for (const rel of [...dirs].sort((a, b) => b.length - a.length)) {
-    const dir = path.resolve(target, rel);
-    if (!pathInside(dir, target)) continue;
-    try { fs.rmdirSync(dir); } catch (e) { /* non-empty or absent */ }
-  }
-  try { fs.rmdirSync(target); } catch (e) { /* user files remain */ }
-  return { code: 'removed', removed, preserved };
-}
+}
+
+// Ownership is per file. An existing directory without our marker belongs to its
+// owner, and a file edited after installation is retained on uninstall.
+const INSTALL_MARKER = '.course-creator-install.json';
+function hashFile(file) {
+  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+function sourceFiles(dir = SKILL_SOURCE, prefix = '') {
+  const found = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) continue;
+    const rel = path.join(prefix, entry.name);
+    if (entry.isDirectory()) found.push(...sourceFiles(path.join(dir, entry.name), rel));
+    else if (entry.isFile()) found.push(rel);
+  }
+  return found;
+}
+function safeOwnedPath(target, rel) {
+  if (path.isAbsolute(rel) || rel.split(/[\\/]/).includes('..')) return null;
+  const full = path.resolve(target, rel);
+  if (!pathInside(full, target)) return null;
+  let cur = path.resolve(target);
+  for (const part of path.relative(cur, full).split(path.sep)) {
+    cur = path.join(cur, part);
+    if (fs.existsSync(cur) && fs.lstatSync(cur).isSymbolicLink()) return null;
+  }
+  return full;
+}
+function ownedMarker(target) {
+  const marker = path.join(target, INSTALL_MARKER);
+  if (!fs.existsSync(marker)) return null;
+  try {
+    if (!fs.lstatSync(marker).isFile() || fs.lstatSync(marker).isSymbolicLink()) return null;
+    const data = JSON.parse(fs.readFileSync(marker, 'utf8'));
+    return data.skill === INSTALLED_SKILL_NAME && data.files &&
+      typeof data.files === 'object' ? data : null;
+  } catch (e) { return null; }
+}
+function installOwned(target) {
+  if (!fs.existsSync(SKILL_SOURCE)) return { code: 'missing-source' };
+  if (fs.existsSync(target) && (!fs.lstatSync(target).isDirectory() ||
+      fs.lstatSync(target).isSymbolicLink())) return { code: 'unowned' };
+  const existing = fs.existsSync(target) ? fs.readdirSync(target) : [];
+  const prior = ownedMarker(target);
+  if (existing.length && !prior) return { code: 'unowned' };
+  fs.mkdirSync(target, { recursive: true });
+  const owned = { ...(prior ? prior.files : {}) };
+  let copied = 0, preserved = 0;
+  for (const rel of sourceFiles()) {
+    const dest = safeOwnedPath(target, rel);
+    if (!dest) { preserved++; continue; }
+    if (fs.existsSync(dest)) {
+      if (!Object.hasOwn(owned, rel) || hashFile(dest) !== owned[rel]) {
+        preserved++; continue;
+      }
+    }
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.copyFileSync(path.join(SKILL_SOURCE, rel), dest);
+    owned[rel] = hashFile(dest);
+    copied++;
+  }
+  fs.writeFileSync(path.join(target, INSTALL_MARKER),
+    JSON.stringify({ skill: INSTALLED_SKILL_NAME, files: owned }, null, 2) + '\n');
+  return { code: 'installed', copied, preserved };
+}
+function uninstallOwned(target) {
+  if (!fs.existsSync(target) || fs.lstatSync(target).isSymbolicLink()) {
+    return { code: 'unowned' };
+  }
+  const prior = ownedMarker(target);
+  if (!prior) return { code: 'unowned' };
+  let removed = 0, preserved = 0;
+  for (const [rel, hash] of Object.entries(prior.files)) {
+    const dest = safeOwnedPath(target, rel);
+    if (!dest || !fs.existsSync(dest) || !fs.lstatSync(dest).isFile() ||
+        hashFile(dest) !== hash) { preserved++; continue; }
+    fs.unlinkSync(dest);
+    removed++;
+  }
+  fs.unlinkSync(path.join(target, INSTALL_MARKER));
+  // Remove only empty directories; a user-owned file keeps its parent.
+  const dirs = new Set(Object.keys(prior.files).map(rel => path.dirname(rel)));
+  for (const rel of [...dirs].sort((a, b) => b.length - a.length)) {
+    const dir = path.resolve(target, rel);
+    if (!pathInside(dir, target)) continue;
+    try { fs.rmdirSync(dir); } catch (e) { /* non-empty or absent */ }
+  }
+  try { fs.rmdirSync(target); } catch (e) { /* user files remain */ }
+  return { code: 'removed', removed, preserved };
+}
 
 // The marker lives under the family's agent-global root (the same root the
 // validator's AGENTIC_SDLC_KB_ROOT seam names), read at call time so the test
@@ -720,10 +720,10 @@ module.exports = {
   detectPython,
   pathsEqual,
   orientHookCommand,
-  copyRecursive,
-  installOwned,
-  uninstallOwned,
-  ownedMarker,
+  copyRecursive,
+  installOwned,
+  uninstallOwned,
+  ownedMarker,
   loadTemplates,
   templateFor,
 };

package/scripts/postinstall.js

@@ -1,16 +1,16 @@
-#!/usr/bin/env node
-"use strict";
-const { CLIENTS, clientDetected, skillTarget, installOwned,
-  wireGlobalOrientHook, detectPython } = require('./lib');
-
-for (const client of CLIENTS) {
-  if (!clientDetected(client)) continue;
-  const target = skillTarget(client);
-  const result = installOwned(target);
-  console.log(`${client.label}: ${result.code} (${target})`);
-  if (client.key === 'claude' && result.code === 'installed') {
-    try { wireGlobalOrientHook({ client, python: detectPython() }); }
-    catch (e) { console.log('Session orientation can be wired from ENFORCEMENT.md.'); }
-  }
-}
-console.log('Initialize a project with course-creator-init.');
+#!/usr/bin/env node
+"use strict";
+const { CLIENTS, clientDetected, skillTarget, installOwned,
+  wireGlobalOrientHook, detectPython } = require('./lib');
+
+for (const client of CLIENTS) {
+  if (!clientDetected(client)) continue;
+  const target = skillTarget(client);
+  const result = installOwned(target);
+  console.log(`${client.label}: ${result.code} (${target})`);
+  if (client.key === 'claude' && result.code === 'installed') {
+    try { wireGlobalOrientHook({ client, python: detectPython() }); }
+    catch (e) { console.log('Session orientation can be wired from ENFORCEMENT.md.'); }
+  }
+}
+console.log('Initialize a project with course-creator-init.');

package/scripts/preuninstall.js

@@ -1,12 +1,12 @@
-#!/usr/bin/env node
-"use strict";
-const { CLIENTS, skillTarget, ownedMarker, uninstallOwned,
-  removeGlobalOrientHooks } = require('./lib');
-
-const ownedTargets = CLIENTS.map(skillTarget).filter(ownedMarker);
-try { removeGlobalOrientHooks(ownedTargets); } catch (e) { /* convenience only */ }
-for (const target of ownedTargets) {
-  const result = uninstallOwned(target);
-  console.log(`${result.code}: ${target} (${result.removed} owned files removed; ` +
-    `${result.preserved} retained)`);
-}
+#!/usr/bin/env node
+"use strict";
+const { CLIENTS, skillTarget, ownedMarker, uninstallOwned,
+  removeGlobalOrientHooks } = require('./lib');
+
+const ownedTargets = CLIENTS.map(skillTarget).filter(ownedMarker);
+try { removeGlobalOrientHooks(ownedTargets); } catch (e) { /* convenience only */ }
+for (const target of ownedTargets) {
+  const result = uninstallOwned(target);
+  console.log(`${result.code}: ${target} (${result.removed} owned files removed; ` +
+    `${result.preserved} retained)`);
+}

package/skills/course-creator/ENFORCEMENT.md

@@ -150,6 +150,16 @@ not see them, because the wired hook legitimately lives in the git-ignored
 mechanism (Gemini today) keeps the note -- read it as the manual-reads reminder; a
 `.codex/hooks.json` wired in a shape other than the documented one keeps it too.
 
+**A review log git would not merge cleanly -- `check` names it (F-090).** When the docs
+root holds `audit/reviews/REVIEW_LOG.md` and git reports no `merge` attribute for it (no
+committed `.gitattributes` line covers it: a project set up before the stanza, a custom
+docs root, a project below the repository root, a course project), `check` prints one
+`[note]` with the exact line to add at the repository root. Same contract as above:
+informational, never the exit code, never a `validate` warning. Personal attribute files
+(except the per-clone `.git/info/attributes`) are ignored, so the note matches what a
+teammate's clone does; a deliberate driver other
+than `union` is respected. Session orientation does not run it: it stays zero-execution.
+
 **Installing the package wires the hook machine-wide (F-042).** On Claude Code
 with Python, `npm i -g` (and every update) wires a SessionStart orient hook into
 the USER-level settings (`$CLAUDE_CONFIG_DIR/settings.json` when set, else

package/skills/course-creator/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: course-creator
-version: 0.1.0-beta.16
+version: 0.1.0-beta.18
 description: Design and improve courses that teach a defined learner through sourced, progressive explanations. Use when the deliverable is instruction or a learning path; route corpus intake to kb-agentic and persuasive campaigns to marketing-agentic.
 author: Antonio Pinto (https://github.com/Antoneeo)
 copyright: (c) 2026 Antonio Pinto

package/skills/course-creator/elicitation.md

@@ -89,7 +89,9 @@ intent choice with neither a source nor a weighing is a finding (`review.md`
 - **Unattended** — the practitioner is not reachable (the Unattended path above).
 - **Delegated** — their own words handed you this choice; cite their entry in the
   request record, or quote them where the unit has none (below L3). A general
-  "go ahead" is not a delegation.
+  "go ahead" is not a delegation. A choice you make under it goes, where the
+  unit has a request record, into it as a delegated entry (`templates.md` §REQUEST) and the artifact
+  cites that entry; it never changes an earlier decision of theirs — ask instead.
 
 Each states **what it is taken from** and **the alternative it excludes**, and is
 listed where the practitioner will read it — an assumption nobody is shown is a

package/skills/course-creator/review.md

@@ -467,7 +467,9 @@ When you are the reviewer:
   the artifact relies on — an answer, an approval, a cost acceptance, a ruling, a
   delegation — that resolves to no entry of the unit's request record, or that the
   record contradicts, is a finding; so is a quotation in the record carrying what
-  its template says to redact. What makes a ground
+  its template says to redact, a delegated entry citing no delegation or changing
+  an earlier owner decision, and an artifact of a shared unit citing a received
+  entry instead of the shared record (`templates.md` §REQUEST, labelled entries). What makes a ground
   or an assumption legal is each lens's `elicitation.md` §The question discipline —
   cite it, never restate it. The fix is the question, not a better justification.
 - **Restated facts (cite, never copy).** Every governance slot has ONE owning document

package/skills/course-creator/scripts/sdlc_core.py

@@ -1377,9 +1377,12 @@ def _open_units(root):
     return units
 
 
-def _git_out(root, *args, timeout=30):
+def _git_out(root, *args, timeout=30, env=None):
+    # `env` is merged into the inherited environment, never a replacement: a bare
+    # dict would drop PATH and fail silently on Windows.
     r = subprocess.run(["git", *args], cwd=str(root), capture_output=True, text=True,
-                       encoding="utf-8", errors="replace", timeout=timeout)
+                       encoding="utf-8", errors="replace", timeout=timeout,
+                       env={**os.environ, **env} if env else None)
     return r.stdout if r.returncode == 0 else None
 
 
@@ -2481,10 +2484,64 @@ def cmd_check(root, strict=False, hybrid=False, extra_validate=None, extra_secti
     failed = any(rc for _, rc in rcs)
     print(f"\ncheck: {'NOT CLEAN' if failed else 'CLEAN'} "
           f"({', '.join(f'{title} rc={rc}' for title, rc in rcs)})")
-    print_orient_hook_note(root)
+    print_check_notes(root)
     return 1 if failed else 0
 
 
+def _attr_pattern(path):
+    """A .gitattributes pattern matching exactly `path`. Order matters (probed):
+    a backslash, glob characters and a leading `#` or `!` (comment, negation)
+    are escaped first, then the result is C-quoted when it holds whitespace,
+    `"` or a backslash."""
+    p = re.sub(r"([\\\[*?])", r"\\\1", path)
+    if p.startswith(("#", "!")):
+        p = "\\" + p
+    if re.search(r'[\s"\\]', p):
+        p = '"' + p.replace("\\", "\\\\").replace('"', '\\"') + '"'
+    return p
+
+
+def review_log_union_note(root):
+    """F-090: the note for a review log git would not merge with union, or None.
+
+    Git itself is asked (`check-attr`), so patterns and nested files count;
+    personal and system attribute files do not, so the answer is the one a
+    teammate's clone gets. Only `unspecified` is a gap: `union` or any other
+    driver is a choice. Residual: `.git/info/attributes` is still read. Any
+    failure -- no git, not a work tree, timeout -- is no note: `check` never
+    breaks on it."""
+    try:
+        log = ai_path(root, "audit", "reviews", "REVIEW_LOG.md")
+        if not log.is_file():
+            return None
+        prefix = _git_out(root, "rev-parse", "--show-prefix", timeout=3)
+        if prefix is None:
+            return None
+        rel = log.resolve().relative_to(Path(root).resolve()).as_posix()
+        out = _git_out(root, "-c", "core.attributesFile=", "check-attr", "-z", "merge",
+                       "--", rel, timeout=3, env={"GIT_ATTR_NOSYSTEM": "1"})
+        if out is None:
+            return None
+        fields = out.split("\0")
+        if len(fields) < 3 or fields[2] != "unspecified":
+            return None
+        path = prefix.rstrip("\r\n") + rel  # a folder may begin with a space
+        return (f"[note] {path} has no merge attribute: two branches that both add review "
+                "rows conflict when merged. Fix: add this line to .gitattributes at the "
+                f"repository root: {_attr_pattern(path)} merge=union")
+    except Exception:
+        return None
+
+
+def print_check_notes(root):
+    """Every check-layer note, informational and never an exit code. The one
+    place an overlay that replaces `check` calls, so a new note cannot miss it."""
+    print_orient_hook_note(root)
+    note = review_log_union_note(root)
+    if note:
+        print(note)
+
+
 # --------------------------------------------------------------------- gate
 
 # --- UserPromptSubmit reminder hook (F-046) --------------------------------