litclaude-ai 0.3.48 → 0.4.3

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog
 
+## 0.4.3 - 2026-08-31 — packed-payload integrity and channel routing
+
+- Add packed-payload substance, cross-product parity, and referenced-path checks so
+  installed skills cannot silently lose the material they reference.
+- Route post-compact rule re-injection through the channel Claude Code actually reads,
+  so compacted sessions receive the intended rules again.
+- Refresh the canonical legal attribution metadata without changing the four upstream
+  attributions it records. This is a local release candidate only; no publish, tag, or
+  push was performed.
+
+## 0.4.2 - 2026-08-30 — coordinated major-update-v2 patch release
+
+- Require `lit-plan` to persist `plans/<slug>.md` with executable checkbox tasks
+  before a planning turn ends; approval gates execution after the plan exists.
+- Add the shared installer frame, `--yes` path, and explicit host-owned model
+  selection notice while preserving Claude's host routing authority.
+- Remove the retired handoff name from model-facing guidance and keep the
+  native handoff route available without a legacy user-skill path.
+- This is a local release candidate only; no publish, tag, or push was performed.
+
+## 0.4.1 - 2026-08-29 — approval-gated skill learning loop
+
+- Observe validated skill consultations, bounded user corrections, tool
+  iteration signals, and coverage gaps without persisting raw transcripts. A
+  detached Stop review may queue at most three schema-valid pending proposals;
+  it never applies them.
+- Add explicit list, apply, reject, rollback, and curator commands. Apply is the
+  only approval transition and may mutate only project
+  `.claude/skills/<name>/SKILL.md` packages marked
+  `litclaudeAgentGenerated: "true"`; bundled and unmarked user skills remain
+  protected.
+- Record exact before/after snapshots in the project-local decision ledger and
+  content-addressed blob store. Rollback uses ownership, identity, and byte
+  checks and fails closed on conflicts.
+- Add a deterministic SessionStart curator for projects that already have
+  skill-loop usage state. The default seven-day/two-hour schedule marks
+  eligible skills stale after 30 days and archives them after 90 days only
+  after backup; deletion, consolidation, and automatic apply remain disabled.
+- Pin the complete skill-loop runtime and observer resources in the canonical
+  manifest, keep local `.litclaude` state out of the package, and reject
+  unpinned bundled-skill payload additions.
+
+## 0.4.0 - 2026-08-27 — output-channel enforcement
+
+- Add a standalone `#contract.output_channels` declaration to every shipped
+  skill contract, with the byte-budgeted `frontend-ui-ux` and `visual-qa`
+  declarations kept in their lazy `references/complete-contract.md` files.
+- Enumerate the complete skill corpus in the documentation gate and enforce the
+  five allowed artifact genres and their exact limitations-channel mappings.
+- Add Claude-native `PostToolUse` hedge feedback. Claude Code can return
+  model-visible `additionalContext` after a successful write, so the guard
+  resolves the active skill's declared genre and inspects only bounded explicit
+  write content from the host event. It never opens an artifact path, and asks
+  for a revision when a client deliverable leaks absent-evidence or limitation
+  prose.
+- Record the validated scope honestly: two isolated A/B experiments found no
+  measurable behavior change from the contract prose alone. The declaration is
+  machine-readable metadata consumed by the guard; this release does not claim
+  that the prose itself makes the model write cleaner documents.
+
 ## 0.3.48 - 2026-08-26 — version alignment
 
 - Align the package, plugin manifest, MCP server, README surfaces, release

package/README.md

@@ -1,4 +1,4 @@
-<p align="center"><img src="https://cdn.jsdelivr.net/npm/litclaude-ai@0.3.48/cover.png" width="100%" alt="LitClaude — Claude Code-native workflow package" /></p>
+<p align="center"><img src="https://cdn.jsdelivr.net/npm/litclaude-ai@0.4.3/cover.png" width="100%" alt="LitClaude — Claude Code-native workflow package" /></p>
 
 <h1 align="center">LitClaude</h1>
 <p align="center">
@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" alt="npm: litclaude-ai" />
-  <img src="https://img.shields.io/badge/version-0.3.48-2ea44f" alt="version 0.3.48" />
+  <img src="https://img.shields.io/badge/version-0.4.3-2ea44f" alt="version 0.4.3" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" alt="Claude Code plugin" />
   <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license" />
 </p>
@@ -50,13 +50,13 @@ npx --yes litclaude-ai@latest install
 For a reproducible install, pin the current package version:
 
 ```bash
-npm view litclaude-ai@0.3.48 version
+npm view litclaude-ai@0.4.3 version
 ```
 
-If that lookup returns `0.3.48`, the exact install is available:
+If that lookup returns `0.4.3`, the exact install is available:
 
 ```bash
-npx --yes litclaude-ai@0.3.48 install
+npx --yes litclaude-ai@0.4.3 install
 ```
 
 Otherwise, wait for explicit human publication before using that pin. Check the
@@ -78,6 +78,24 @@ npx --yes litclaude-ai@latest install --yolo
 `safe` adds no permission rules. `balanced` adds bounded read/search and routine
 Git, npm, and Node rules. `yolo` adds broader edit/write patterns. These modes
 write bounded entries under Claude's `permissions.allow` and `permissions.deny`.
+
+### Install-time questions
+
+On a TTY the installer asks two questions: the HUD brand color and the LitClaude
+output style. The output-style question offers `None / keep current`,
+ASD-STE100, and ELI5 (each in English and 한국어); a LitClaude style is written to
+Claude's global `outputStyle` only when you pick one, never over a value you set
+yourself, and `uninstall` removes it again only if it is still the LitClaude-written
+value. `LITCLAUDE_OUTPUT_STYLE` and `LITCLAUDE_HUD_ACCENT` answer the questions
+non-interactively, and `--yes` skips every question with today's shipped defaults:
+
+```bash
+npx --yes litclaude-ai@latest install --yes
+```
+
+The installer never asks for a model or reasoning effort: model selection is
+host-owned — Claude Code picks its own models — and the summary prints
+`Model selection: host-owned`.
 Existing settings are preserved; LitClaude tracks and removes only rules it
 inserted.
 
@@ -126,7 +144,33 @@ such as `/litclaude:lit-loop`.
 | `lit-scientific-visualization` | Prepare publication figures; also `/litclaude:lit-scientific-visualization` |
 | `litclaude wikify <capture/save/review/query/config>` | Manage reviewed local structured knowledge |
 | `browser-drive`, `$browser-drive` | Drive a real page only after a capability probe verifies an external driver; never substitute a fetch, use credentials, or install without approval |
-| `skill-observer`, `$skill-observer` | Record bounded skill proposals only; never edit a skill file, and every record stays `applied: false` |
+| `skill-observer`, `$skill-observer` | Review bounded learning signals and manage pending proposals; only an explicit foreground `apply <proposal-id>` may change an eligible agent-owned skill |
+
+## Skill learning loop
+
+LitClaude records bounded learning signals only after a validated `SKILL.md`
+consultation: user corrections, repeated tool iterations, and coverage gaps. A
+Stop review treats the bounded, secret-scrubbed transcript excerpt as inert data
+and may queue schema-valid proposals, but it never stores that excerpt or edits a
+skill. Automatic application is disabled (`autoApply: false`); a proposal remains
+`pending` until the user explicitly applies or rejects its exact id.
+
+Use `/litclaude:skill-observer list`, `apply <proposal-id>`, `reject
+<proposal-id>`, `rollback <ledger-id>`, `curator status`, or `curator run` from
+the project whose state you want to manage. Apply can write only an eligible
+project `.claude/skills/<name>/SKILL.md` carrying
+`metadata.litclaudeAgentGenerated: "true"`. Bundled skill ids, paths outside
+that root, and existing unmarked user skills are protected. Every mutation is
+recorded in `.litclaude/skill-ledger.jsonl` with content-addressed blobs under
+`.litclaude/skill-ledger-blobs/`; rollback verifies current bytes and restores
+the exact recorded snapshot or fails closed.
+
+The deterministic curator runs no more often than every seven days and only
+after two idle hours. By default it marks unused eligible skills stale after 30
+days and archives them after 90 days, taking a backup first. It never deletes or
+consolidates skills. SessionStart runs this maintenance only when project-local
+skill-loop usage state already exists; untouched projects receive no new
+`.litclaude` state.
 
 `lit start work <plan>` is intentionally a `BLOCKED:` handoff. Use
 `/start-work` or `/litclaude:start-work` with the approved plan. `lit workflow`

package/README_ko-KR.md

@@ -1,4 +1,4 @@
-<p align="center"><img src="https://cdn.jsdelivr.net/npm/litclaude-ai@0.3.48/cover.png" width="100%" alt="LitClaude — Claude Code-native workflow package" /></p>
+<p align="center"><img src="https://cdn.jsdelivr.net/npm/litclaude-ai@0.4.3/cover.png" width="100%" alt="LitClaude — Claude Code-native workflow package" /></p>
 
 <h1 align="center">LitClaude</h1>
 <p align="center">
@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" alt="npm: litclaude-ai" />
-  <img src="https://img.shields.io/badge/version-0.3.48-2ea44f" alt="version 0.3.48" />
+  <img src="https://img.shields.io/badge/version-0.4.3-2ea44f" alt="version 0.4.3" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" alt="Claude Code plugin" />
   <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license" />
 </p>
@@ -52,13 +52,13 @@ npx --yes litclaude-ai@latest install
 뒤 고정합니다.
 
 ```bash
-npm view litclaude-ai@0.3.48 version
+npm view litclaude-ai@0.4.3 version
 ```
 
-조회 결과가 `0.3.48`이면 exact install을 사용할 수 있습니다.
+조회 결과가 `0.4.3`이면 exact install을 사용할 수 있습니다.
 
 ```bash
-npx --yes litclaude-ai@0.3.48 install
+npx --yes litclaude-ai@0.4.3 install
 ```
 
 그렇지 않으면 명시적인 human publication을 기다립니다. Pin은 그 뒤에 사용합니다.
@@ -128,7 +128,33 @@ hook을 중복 활성화하지 않습니다. 명시적으로 skill을 실행하
 | `lit-scientific-visualization` | 출판용 figure를 준비합니다. `/litclaude:lit-scientific-visualization`도 지원합니다. |
 | `litclaude wikify <capture/save/review/query/config>` | 검토 기반 local structured knowledge를 관리합니다. |
 | `browser-drive`, `$browser-drive` | 외부 driver capability probe가 확인된 뒤에만 실제 page를 조작합니다. fetch로 대체하지 않으며 credential 사용과 승인 없는 설치를 하지 않습니다. |
-| `skill-observer`, `$skill-observer` | 제한된 skill proposal만 기록합니다. skill file은 수정하지 않으며 모든 기록은 `applied: false`로 남습니다. |
+| `skill-observer`, `$skill-observer` | 제한된 learning signal을 검토하고 pending proposal을 관리합니다. 명시적인 foreground `apply <proposal-id>`만 eligible agent-owned skill을 변경할 수 있습니다. |
+
+## Skill learning loop
+
+LitClaude는 검증된 `SKILL.md` consultation 뒤에만 user correction, 반복된 tool
+iteration, coverage gap을 제한된 learning signal로 기록합니다. Stop review는
+secret을 제거한 bounded transcript excerpt를 inert data로 다루며 schema-valid
+proposal을 queue할 수 있지만, excerpt 자체를 저장하거나 skill을 수정하지
+않습니다. 자동 적용은 꺼져 있고(`autoApply: false`), 사용자가 정확한 id를
+명시해 apply 또는 reject하기 전까지 proposal은 `pending`입니다.
+
+관리할 state가 있는 project에서 `/litclaude:skill-observer list`, `apply
+<proposal-id>`, `reject <proposal-id>`, `rollback <ledger-id>`, `curator
+status`, `curator run`을 사용합니다. Apply는
+`metadata.litclaudeAgentGenerated: "true"`를 가진 eligible project
+`.claude/skills/<name>/SKILL.md`에만 쓸 수 있습니다. Bundled skill id, 이 root
+밖의 path, marker가 없는 기존 user skill은 보호됩니다. 모든 mutation은
+`.litclaude/skill-ledger.jsonl`에 기록되고 content-addressed blob은
+`.litclaude/skill-ledger-blobs/`에 저장됩니다. Rollback은 현재 byte를 검증한
+뒤 기록된 exact snapshot을 복원하며, 검증할 수 없으면 fail closed합니다.
+
+Deterministic curator는 7일보다 자주 실행되지 않고 2시간 idle 뒤에만
+실행됩니다. 기본값은 eligible skill을 30일 뒤 stale로 표시하고 90일 뒤 먼저
+backup한 다음 archive하는 것입니다. Skill을 delete하거나 consolidate하지
+않습니다. SessionStart maintenance는 project-local skill-loop usage state가 이미
+있을 때만 실행되므로 untouched project에 새 `.litclaude` state를 만들지
+않습니다.
 
 `lit start work <plan>`은 의도적으로 `BLOCKED:` handoff를 반환합니다. 승인된
 plan과 함께 `/start-work` 또는 `/litclaude:start-work`를 사용하세요. `lit

package/RELEASE_CHECKLIST.md

@@ -1,6 +1,6 @@
 # LitClaude Release Checklist
 
-Status: `litclaude-ai@0.3.48` is the current release candidate — exact canonical
+Status: `litclaude-ai@0.4.3` is the current release candidate — exact canonical
 frontend corpus plus Claude-native `autoresearch`, `autoconference`, and `wikify`
 workflow-family integration. It byte-pins the frontend library, legal companions,
 family source closures, and adapters through independent commitments and package
@@ -45,9 +45,24 @@ side-effect-free, the launcher starts only a separate Claude Code
 print/background worker, and the release preserves the Korean polishing
 command, strict multi-agent review pipeline, fidelity guardrails, package
 hygiene checks, native route gates, and safe start-work handoff behavior.
-`package.json` is aligned to `0.3.48`,
-`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.48`, and the
-plugin-local MCP server reports `0.3.48`.
+`package.json` is aligned to `0.4.3`,
+`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.4.3`, and the
+plugin-local MCP server reports `0.4.3`.
+
+This candidate adds an approval-gated skill learning loop. Validated
+consultations, bounded corrections, iteration signals, and coverage gaps may
+produce pending proposals, but hooks and model reviews never apply them.
+Foreground apply is restricted to marked agent-owned project skills, with
+byte-exact ledger-backed rollback. The deterministic curator backs up and
+archives eligible skills on its bounded schedule, never deletes or consolidates,
+and runs at SessionStart only when project-local usage state already exists.
+Automatic apply remains disabled.
+
+The 0.4.0 release added machine-readable output-channel declarations across the
+shipped skill corpus and a `PostToolUse` hedge-feedback path. Two isolated A/B
+experiments found no measurable behavior change from declaration prose alone,
+so the declaration remains guard metadata rather than evidence that prose
+instructions by themselves improve generated documents.
 
 This release carries the v0.2.2 Dynamic workflow hardening surfaces:
 `/dynamic-workflow`, `workflow-check --json`, native `/goal` fallback guidance,
@@ -280,9 +295,9 @@ checkout and from an isolated install of the packed tarball:
 Before requesting publication approval, confirm these artifacts from the current
 checkout:
 
-- `package.json` version is `0.3.48`.
-- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.48`.
-- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.48`.
+- `package.json` version is `0.4.3`.
+- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.4.3`.
+- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.4.3`.
 - Prompt-hook tests cover bundled `SKILL.md` body injection for bare `hyperplan`, `litresearch`, `lit research`, `init-deep`, and explicit leading `$start-work`; diagnostic/copy mentions stay inert while leading natural-language `lit start work` stays BLOCKED.
 - `lit search` and `lit query` route to `/litclaude:litresearch` without activating on slash mentions, code spans, or non-lit prompts.
 - Litresearch web lanes require public API/feed preference, validator-first checks, route traces, prompt-injection quarantine, and honest auth/paywall/private-data stop reasons.

package/bin/litclaude-ai.js

@@ -72,6 +72,10 @@ Install options:
                 only LitClaude-inserted entries. Planner/read-only agent
                 safeguards are never weakened.
   --yolo        Shorthand for --permission-mode yolo.
+  --yes         Accept today's shipped defaults for every question (HUD accent,
+                output style) and run without prompts. Model selection stays
+                host-owned: Claude Code picks its own models, so the installer
+                never asks for a model or reasoning effort.
 `;
 
 const parseArgs = (argv) => {
@@ -146,6 +150,7 @@ const parseInstallOptions = (rest, existingPermissionMode = "safe") => {
   const preservedMode = permissionModes.has(existingPermissionMode) ? existingPermissionMode : "safe";
   let permissionMode = parsePermissionMode(process.env.LITCLAUDE_PERMISSION_MODE || preservedMode);
   let permissionExplicit = Boolean(process.env.LITCLAUDE_PERMISSION_MODE);
+  let assumeYes = false;
 
   for (let index = 0; index < rest.length; index += 1) {
     const arg = rest[index];
@@ -169,10 +174,14 @@ const parseInstallOptions = (rest, existingPermissionMode = "safe") => {
     if (arg === "--no-permission-prompt") {
       continue;
     }
+    if (arg === "--yes") {
+      assumeYes = true;
+      continue;
+    }
     fail(`Unknown install option: ${arg}`, 64);
   }
 
-  return { permissionMode, permissionExplicit };
+  return { permissionMode, permissionExplicit, assumeYes };
 };
 
 const permissionProfile = (mode) => {
@@ -238,6 +247,39 @@ const formatInstallStep = (label) => {
   return `${color256(theme.code, theme.tag)} ${bold(label)}`;
 };
 
+// Shared LitFamily banner frame (plans/references/installer-choice-contract.md):
+// a 46-glyph rule, the spaced wordmark, and ╭─/│/╰─ stage frames. Byte-identical
+// glyphs across products; only name, version, and tagline differ.
+const FAMILY_RULE = `  ${"━".repeat(46)}`;
+const trueColorSupported = () => /truecolor|24bit/iu.test(process.env.COLORTERM ?? "");
+const brandOrange = (text) => {
+  if (!shouldColorInstall()) return text;
+  return trueColorSupported() ? `\x1b[38;2;255;90;31m${text}\x1b[0m` : `\x1b[38;5;202m${text}\x1b[0m`;
+};
+const planYellow = (text) => {
+  if (!shouldColorInstall()) return text;
+  return trueColorSupported() ? `\x1b[38;2;250;204;21m${text}\x1b[0m` : `\x1b[38;5;220m${text}\x1b[0m`;
+};
+const INSTALL_STAGES = [
+  ["01", "Plugin", "copy the packaged plugin payload"],
+  ["02", "Market", "write the local marketplace"],
+  ["03", "Registry", "enable plugin, HUD, permissions"],
+  ["04", "Cache", "refresh the compatibility pointer"],
+  ["05", "Verify", "confirm every installed surface"],
+];
+const familyBanner = () => [
+  brandOrange(FAMILY_RULE),
+  "",
+  `   ${brandOrange("🔥")}  l  i  t  claude   v${version}`,
+  `       ${packageJson.description}`,
+  "",
+  brandOrange(FAMILY_RULE),
+  "  ╭─ INSTALL PLAN",
+  ...INSTALL_STAGES.map(([number, name, description]) => `  │ ${planYellow(number)} · ${name.padEnd(10)}${description}`),
+  "  ╰─ Model selection: host-owned · unrelated Claude settings preserved",
+  "",
+].join("\n");
+
 const createInstallProgress = () => {
   const animated = shouldAnimateInstall();
   let frameIndex = 0;
@@ -253,6 +295,7 @@ const createInstallProgress = () => {
         process.stdout.write(`INSTALL_STEP: Installing LitClaude ${version}\n`);
         return;
       }
+      process.stdout.write(`\n${familyBanner()}\n`);
       process.stdout.write(
         `\n╭─ PREPARING INSTALL\n` +
         `│ Package       LitClaude ${version}\n` +
@@ -600,6 +643,29 @@ const uninstallHudStatusLine = (home = claudeHome()) => {
   writeClaudeSettings(settings, home);
 };
 
+const uninstallOutputStyle = (home = claudeHome()) => {
+  const settingsPath = claudeSettingsPath(home);
+  if (!existsSync(settingsPath)) return;
+  const settings = readClaudeSettings(home);
+  const litClaude = settings[litClaudeSettingsKey];
+  if (!litClaude) return;
+
+  const writtenName = litClaude.outputStyleWrittenName ?? null;
+  if (writtenName && settings.outputStyle === writtenName) {
+    delete settings.outputStyle;
+  } else if (writtenName && settings.outputStyle !== undefined) {
+    process.stdout.write("OUTPUT_STYLE_WARNING: outputStyle changed by user; leaving it untouched\n");
+  }
+
+  const remainingLitClaude = { ...litClaude };
+  for (const key of ["outputStyleChoice", "outputStyleWrittenName"]) {
+    delete remainingLitClaude[key];
+  }
+  if (Object.keys(remainingLitClaude).length > 0) settings[litClaudeSettingsKey] = remainingLitClaude;
+  else delete settings[litClaudeSettingsKey];
+  writeClaudeSettings(settings, home);
+};
+
 const uninstallPermissionRules = (home = claudeHome()) => {
   const settingsPath = claudeSettingsPath(home);
   if (!existsSync(settingsPath)) return;
@@ -939,7 +1005,7 @@ const install = async ({ dryRun, rest }) => {
   const home = claudeHome();
   const litClaudeHome = litHome();
   const existingLitClaude = readClaudeSettings(home)[litClaudeSettingsKey] ?? {};
-  const { permissionMode, permissionExplicit } = parseInstallOptions(rest, existingLitClaude.permissionMode);
+  const { permissionMode, permissionExplicit, assumeYes } = parseInstallOptions(rest, existingLitClaude.permissionMode);
   const existingHudAccent = normalizeHudAccent(existingLitClaude.hudAccent);
   const existingOutputStyle = existingLitClaude.outputStyleChoice ?? "off";
   const requestedHudAccent = process.env.LITCLAUDE_HUD_ACCENT
@@ -970,8 +1036,12 @@ const install = async ({ dryRun, rest }) => {
     fail(`Packaged LitClaude plugin payload is missing: ${sourcePlugin}`);
   }
 
-  const hudAccent = await chooseHudAccent(existingHudAccent);
-  const outputStyleChoice = await chooseOutputStyle(existingOutputStyle);
+  const hudAccent = assumeYes
+    ? (process.env.LITCLAUDE_HUD_ACCENT ? normalizeHudAccent(process.env.LITCLAUDE_HUD_ACCENT) : existingHudAccent)
+    : await chooseHudAccent(existingHudAccent);
+  const outputStyleChoice = assumeYes
+    ? normalizeOutputStyle(process.env.LITCLAUDE_OUTPUT_STYLE ?? existingOutputStyle)
+    : await chooseOutputStyle(existingOutputStyle);
   progress.prepare({ claudeTarget: home, litTarget: litClaudeHome });
   await progress.run(
     {
@@ -1041,12 +1111,14 @@ const install = async ({ dryRun, rest }) => {
   progress.receipt([
     ["Status", "Ready for Claude Code"],
     ["Version", version],
+    ["Model route", "host-owned (Claude Code picks models)"],
     ["Plugin", pluginKey],
     ["Plugin path", intendedPluginPath(home)],
     ["HUD", `${hudAccent} accent`],
     ["Permissions", `${permissionMode}; global settings allow/deny; ownership-safe removal`],
     ["Launch", "claude"],
   ]);
+  process.stdout.write("Model selection: host-owned (Claude Code exposes no native route surface)\n");
   process.stdout.write(`INSTALL_PASS: LitClaude ${version} installed\n`);
   process.stdout.write(`Claude plugin: ${pluginKey}\n`);
   process.stdout.write(`Marketplace: ${localMarketplace}\n`);
@@ -1259,6 +1331,7 @@ const uninstall = ({ dryRun }) => {
   unregisterClaudePlugin();
   unregisterMarketplace();
   uninstallHudStatusLine();
+  uninstallOutputStyle();
   uninstallPermissionRules();
   rmSync(pluginCacheRoot, { recursive: true, force: true });
   process.stdout.write("UNINSTALL_PASS\n");

package/docs/hooks.md

@@ -12,7 +12,7 @@ surface: Claude Code plugin hooks
 runtime: plugins/litclaude/bin/litclaude-hook.js
 registration: plugins/litclaude/hooks/hooks.json
 settings_activation: global Claude settings.json enabledPlugins entry for litclaude@litclaude-ai
-events: [SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostCompact, Stop, SubagentStart, SubagentStop, SessionEnd]
+events: [SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop, SubagentStart, SubagentStop, SessionEnd]
 verdicts: [PASS, FAIL, BLOCKED]
 ```
 
@@ -32,11 +32,10 @@ verdicts: [PASS, FAIL, BLOCKED]
 
 | Event or route | Contract mode | Hard boundary |
 | --- | --- | --- |
-| `SessionStart` | rules discovery and static injection | Adds context and, when a session id exists, records emitted rule identities in the project's git-ignored `.litclaude/rules/` state. |
+| `SessionStart` | rules discovery and static injection | Adds context and, when `source: compact`, durably reserves bounded rule re-injection after clearing the session dedup set. |
 | `UserPromptSubmit` | route classifier, static-rule straggler lane, and explicit resume gate | Prompt routing adds guidance. Static-rule delivery may update rule dedup state; the exact start-work resume route may also mutate code-owned lifecycle state. |
 | `PreToolUse` | bounded-authority enforcement | Allows normal Claude permission handling only for classified, authorized action/root pairs; otherwise denies before execution. |
-| `PostToolUse` | conditional post-edit routing and dynamic rule injection | Names only the checks the edit earned and only the rules whose globs matched; emits nothing when neither applies. Does not claim completion. |
-| `PostCompact` | bounded context restoration | Durably reserves one unit of a 2-per-session budget, clears rule dedup state, and re-injects the static set at reduced caps. If reservation persistence fails, it emits the reset diagnostic but does not re-inject. |
+| `PostToolUse` | conditional post-edit routing, dynamic rule injection, and deliverable hedge feedback | Names only the checks the edit earned and only the rules whose globs matched. When the current transcript identifies a loaded LitClaude skill, it reads that skill's shipped output-channel declaration and scans bounded submitted content for reader-facing paths only for `client_deliverable` / `reply`. It emits nothing when no lane applies and does not claim completion. |
 | `Stop` | start-work continuation, then litgoal autoloop gate | Root-session and progress-bound; no unbounded loop. |
 | `SubagentStart` / `SubagentStop` | lane identity observation | Records the root session, child lane, and Claude-owned worktree without emitting child continuation. |
 | `SessionEnd` | root-session receipt | Records the observed end and emits no continuation. |
@@ -53,6 +52,7 @@ verdicts: [PASS, FAIL, BLOCKED]
 
 - Claude Code hook JSON containing `continue: true`, `hookSpecificOutput.hookEventName`, and route-specific `additionalContext`.
 - Optional `systemMessage` only for active LitClaude route guidance.
+- `DELIVERABLE_HEDGE_VIOLATION` as `PostToolUse` `additionalContext` after a client-deliverable write contains a matched limitation phrase; the file has already been written, so the response asks Claude to revise it rather than claiming the write was prevented.
 - `BLOCKED:` text for natural-language start-work, unavailable native goal binding, disabled Dynamic workflow, or gated agent-team setup.
 - Unavailable native goal binding also includes `READY_TO_PASTE` and one bounded `/goal` command for the user to copy, paste, and send; the hook never enters or submits it.
 
@@ -85,9 +85,9 @@ settings. Separately, installer permission modes mutate global Claude settings
 entries LitClaude inserted, and remove only those tracked entries on mode change or
 uninstall.
 
-For PostCompact, the budget reservation must be durably persisted before static rule
-text is emitted. A failed reservation keeps the hook alive for diagnostics but does not
-re-inject rules as if a budget unit had been reserved.
+For `SessionStart` with `source: compact`, the **2-per-session** budget reservation must
+be durably persisted before static rule text is emitted. A failed reservation keeps the hook alive
+for diagnostics but does not re-inject rules as if a budget unit had been reserved.
 Reservation uses a per-session exclusive filesystem lock around strict state read,
 increment, fsynced temporary write, atomic rename, and directory fsync where supported. Known
 unsupported directory-sync errors preserve portability; genuine I/O failures report an
@@ -96,20 +96,54 @@ missing state may initialize at count 0. Existing malformed, unreadable, oversiz
 or otherwise uncertain state fails closed without replacement. Lock uncertainty also fails
 closed; ordinary owners remove their lock artifact, and only a stale valid nonce/PID owner
 whose process is no longer alive may be replaced through a fenced takeover. Live or malformed
-incumbents are not silently removed.
+incumbents are not silently removed. Claude Code does not collect model context from its
+`PostCompact` stdout, so LitClaude does not register that event; the legacy runner is a
+silent no-op for callers that still invoke it directly.
 
 | Event | Runner | Purpose |
 | --- | --- | --- |
-| `SessionStart` | `plugins/litclaude/bin/litclaude-hook.js session-start` | Runs the bounded foreground automatic-update barrier when a fresh cache names a newer version, discovers repo-local rule files, and names the newest valid `plans/<slug>.md` visible from the current or a parent directory. |
+| `SessionStart` | `plugins/litclaude/bin/litclaude-hook.js session-start` | Runs the bounded foreground automatic-update barrier on a fresh session, discovers repo-local rule files, names the newest valid `plans/<slug>.md`, and on `source: compact` spends one of two durable re-injection reservations at reduced caps. |
 | `UserPromptSubmit` | `plugins/litclaude/bin/litclaude-hook.js user-prompt-submit` | Detects prompt routes and injects workflow context; independently delivers static rules not already recorded for this session. |
 | `PreToolUse` | `plugins/litclaude/bin/litclaude-hook.js pre-tool-use` | Enforces semantic action/root grants before Write, Edit, MultiEdit, NotebookEdit, Bash, Agent, and bounded read tools execute. |
-| `PostToolUse` | `plugins/litclaude/bin/litclaude-hook.js post-tool-use` | Names the post-edit checks the edit actually earned, and injects any glob-scoped rule matching the edited paths. |
-| `PostCompact` | `plugins/litclaude/bin/litclaude-hook.js post-compact` | Durably spends one of two per-session reservations, clears the rule dedup set, and re-injects static rule bodies at reduced caps; an unpersisted reservation produces a diagnostic and no rule injection. |
+| `PostToolUse` | `plugins/litclaude/bin/litclaude-hook.js post-tool-use` | Names the post-edit checks the edit actually earned, injects any glob-scoped rule matching the edited paths, and returns model-visible feedback when bounded submitted content for the loaded skill's declared `client_deliverable` artifact contains a hedge finding. |
 | `Stop` | `plugins/litclaude/bin/litclaude-hook.js stop` | Emits bounded start-work continuation on new progress, otherwise applies the opt-in litgoal autoloop gate. |
 | `SubagentStart` | `plugins/litclaude/bin/litclaude-hook.js subagent-start` | Registers child-lane and Claude-owned worktree identity. |
 | `SubagentStop` | `plugins/litclaude/bin/litclaude-hook.js subagent-stop` | Finalizes the lane without child continuation. |
 | `SessionEnd` | `plugins/litclaude/bin/litclaude-hook.js session-end` | Records root-session end without blocking Claude. |
 
+### Deliverable hedge feedback
+
+The hedge checker runs after a successful `Write`, `Edit`, or `MultiEdit` whose
+host event includes explicit `content`, `new_string`, or `edits`, because Claude
+Code's `PostToolUse` response can add `additionalContext` beside the completed
+tool result. It scans only that bounded host-event content and never opens the
+artifact path. The hook locates a loaded LitClaude skill only from an
+assistant-side Skill invocation or the
+exact Claude `hook_additional_context` attachment shape carrying LitClaude's
+own `<litclaude-skill-body>` marker and the byte-identical current shipped skill
+body in the bounded host transcript; generic
+attachments, user text, and assistant text that merely echoes the marker cannot
+grant a genre. It then reads `artifact_genre` and `limitations_channel` from that
+skill's shipped `#contract.output_channels` block. The genre is never inferred
+from a filename and is not maintained as a parallel hard-coded skill map.
+
+Only `client_deliverable` with `limitations_channel: reply` is enforced in this
+guard. The same prose under `working_note` is intentionally left alone. Quoted
+status enums, JSON/YAML status scalars, fenced code, and status-table cells are
+state rather than prose and are excluded. Korean absent-evidence matching is
+anchored to evidence-bearing subjects such as 근거, 자료, 측정값, and 관찰 기록 so
+factual specifications such as `이 API는 반환값이 없습니다` stay clean.
+
+This is post-write feedback, not rollback or a permission denial. If the
+transcript is absent, stale, oversized, malformed, or does not identify a known
+bundled skill, or if the host event is path-only, unknown, outside the lexical
+working root, not reader-facing, oversized, or over budget, the guard fails open
+and the normal post-edit routes continue. It accepts at most 16 paths, 512 KiB
+of submitted content per path, and 2 MiB in aggregate. Because no artifact
+pathname is opened, a FIFO or an ancestor replacement cannot block the hook or
+redirect which bytes it scans. The direct driver and regression fixtures live in
+`test/deliverable-hedge-guard.test.mjs`.
+
 ### Cross-session plan discovery
 
 The scaffold writer remains the only plan write surface. It writes through a same-directory

package/docs/rules.md

@@ -63,7 +63,7 @@ the hook.
 | static | SessionStart | single-file + `alwaysApply` rules | 12,000 | 40,000 |
 | static | UserPromptSubmit | the same, minus anything already injected this session | 6,000 | 16,000 |
 | dynamic | PostToolUse | glob rules matching the paths the edit touched | 4,000 | 10,000 |
-| re-inject | PostCompact | static set again, at a small budget | 3,500 | 4,000 |
+| re-inject | SessionStart (`source: compact`) | static set again, at a small budget | 3,500 | 4,000 |
 
 The UserPromptSubmit static lane runs whether or not a workflow prompt route activates.
 It is a straggler lane for static rules created after SessionStart, and session dedup
@@ -74,16 +74,17 @@ Per-session dedup is keyed on `relativePath + sha256(body)[0:16]` and stored und
 project's own git-ignored `.litclaude/rules/session-<id>.json`. No user profile is
 touched. With no session id, dedup is a no-op and nothing is written.
 
-PostCompact clears the dedup set and spends one unit of a **2-per-session** re-injection
-allowance; past that it says the budget is spent instead of re-injecting. The reservation
-must be durably persisted before any rule body is emitted. If that write fails, the hook
-keeps the cache-reset diagnostic, reports that re-injection was skipped, and does not
-re-inject an unreserved rule set.
+Compact-sourced `SessionStart` clears the dedup set and spends one unit of a
+**2-per-session** re-injection allowance; past that it says the budget is spent instead
+of re-injecting. The reservation must be durably persisted before any rule body is emitted.
+If that write fails, the hook keeps the cache-reset diagnostic, reports that re-injection
+was skipped, and does not re-inject an unreserved rule set. Claude Code does not collect
+model context from `PostCompact` stdout, so that event is not registered.
 
 The state mutation is exact: successful static or dynamic delivery updates `injected`,
-and a successful PostCompact reservation resets `injected` and increments
-`postCompactCount` in `.litclaude/rules/session-<id>.json`. No session id means no dedup,
-no PostCompact reservation, and no rule-owned write.
+and a successful compact-sourced `SessionStart` reservation resets `injected` and
+increments `postCompactCount` in `.litclaude/rules/session-<id>.json`. No session id means
+no dedup, no compact reservation, and no rule-owned write.
 
 Every session-state read/modify/write uses the same per-session exclusive lock, including
 dedup updates, so another hook cannot roll a reserved count backward. A missing state file
@@ -171,5 +172,6 @@ that path. `!` anywhere else is a literal character.
 
 Every lane is wrapped. An unreadable directory, a malformed rule, a symlink loop, or a
 pattern that cannot compile results in fewer rules injected — never a failed hook. A
-rule file over 256 KB is truncated before parsing. PostCompact is stricter about its
-safety budget: a failed state write keeps the hook alive but fails closed for re-injection.
+rule file over 256 KB is truncated before parsing. Compact-sourced `SessionStart` is
+stricter about its safety budget: a failed state write keeps the hook alive but fails
+closed for re-injection.

package/docs/workflow-compatibility-audit.md

@@ -53,7 +53,7 @@ the same 8 MiB per-file and 32 MiB aggregate budget before any whole-file read.
 | prompt activation | `hooks/hooks.json`, `bin/litclaude-hook.js`, `commands/lit-loop.md`, `commands/lit-plan.md`, `commands/deep-interview.md`, `commands/start-work.md` | UserPromptSubmit detects workflow triggers and injects compact Claude Code guidance. |
 | comment-checker | `skills/comment-checker`, `PostToolUse` hook guidance | Claude-native comment hygiene skill plus post-edit reminder. |
 | lsp | `.lsp.json`, `.mcp.json`, `bin/litclaude-lsp-doctor.js`, `skills/lsp` | Lightweight Claude Code LSP/MCP helper rather than vendoring a full external package. |
-| rules | `skills/rules`, `SessionStart` / `PostCompact` hook behavior | Claude session rule guidance and cache-reset messaging. |
+| rules | `skills/rules`, `SessionStart` (`source: compact`) hook behavior | Claude session rule guidance and compact cache-reset messaging. |
 | litgoal | `commands/litgoal.md`, `skills/litgoal`, `plugins/litclaude/lib/litgoal/`, `lit-*`, `start-work` goal guidance | Claude-native goal wording with evidence/ledger/quality-gate discipline and durable CLI state. |
 | litwork | `commands/lit-loop.md`, `commands/lit-plan.md`, `skills/lit-loop`, `skills/lit-plan` | Claude skills, commands, agents, workflow/worktree guidance, and hook injection. |
 | clarification interview | `commands/deep-interview.md`, `skills/deep-interview` | Socratic requirements mode with ambiguity scoring, persisted state, and a handoff to planning/execution. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litclaude-ai",
-  "version": "0.3.48",
+  "version": "0.4.3",
   "description": "Claude Code-native workflow distribution.",
   "type": "module",
   "bin": {

package/plugins/litclaude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "litclaude",
   "description": "Claude Code-native workflow plugin with a bounded-authority start-work lifecycle.",
-  "version": "0.3.48",
+  "version": "0.4.3",
   "author": {
     "name": "LitClaude contributors"
   },