feat(claude-config): fix the automation-gaps inventory, persist findings, and guard the posture

plugins/claude-config/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "claude-config",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "Nine configuration-health skills (plus setup) for a repo's Claude Code configuration: audit (settings.json / .mcp.json / hooks / plugins / permissions drift), audit-automation-gaps (evidence-gated verdicts on automation gaps), audit-permission-grants (allow-rule / allowed-tools grants for auto-mode durability and portability), audit-permission-state (the permission rules actually in effect: every settings scope merged with per-rule provenance, what auto mode drops on entry, config written where nothing reads it, and which managed intents are enforced versus loosenable), draft-auto-mode-rules (interview and draft a paste-ready autoMode classifier block; prints only, never writes), audit-instructions (locally-owned instruction surfaces vs current model capability, proposing removals/rewrites of instructions the model no longer needs, and detecting cross-surface instruction conflicts), audit-prompting-postures (the additive lane: posture guidance the prompting guide says a component's purpose needs but the component does not carry), audit-pass (one coordinated, ordered, resumable pass over a named target: three-scope inventory, run-time-derived exclusion set, stable finding identity, suppression memory, resume, one human gate, delegating every check to the plugin that owns it), and unhobble (the empirical bare-baseline experiment: reversibly strip a repo's standing instructions, log real stumbles against the current model, re-add only what evidence earns).",
   "author": {
     "name": "Melodic Software",

plugins/claude-config/CHANGELOG.md

@@ -3,6 +3,50 @@
 All notable changes to the `claude-config` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.46.0]
+
+### Added
+
+- **`audit-automation-gaps`**: `scripts/findings-state.sh` persists a run's verdict table, evidence
+  and implementation plans, so `--implement` has something to read in a later session. Keyed per
+  project through the shared `lib/state-key.sh`, so one checkout never reads another's verdicts,
+  and `--plugin-data` is required because `${CLAUDE_PLUGIN_DATA}` is absent from the Bash tool
+  environment.
+- **`audit-automation-gaps`**: a Gotchas surface built from observed failures, a `## Next` section,
+  and presence-gated routing to `overengineering:audit` in both directions.
+- **`audit-automation-gaps`**: eval cases covering the persisted artifact and the revised
+  `Already enforced` gate.
+
+### Changed
+
+- **`audit-automation-gaps`**: `scripts/inventory.sh` counts all seven documented hook locations
+  instead of the project `.claude` tree alone, which had it reporting 3 hook scripts and 0 skills
+  for a repository carrying 93 wired handlers and 271 skills. An unreadable scope now reports
+  `unreadable` rather than zero, conditional scopes are split from the standing set, and enablement
+  inputs are emitted with a pointer instead of a computed verdict.
+- **`audit-automation-gaps`**: a `git log --grep` count is now treated as a ceiling rather than a
+  frequency in both gates that consumed it. A frequency claim requires a sample, reported with its
+  denominator and sample size; a ceiling already under 5 percent still settles YAGNI without one.
+- **`audit-automation-gaps`**: the `Already enforced` gate takes a shift-left carve-out with three
+  falsifiable conjuncts, keeping the hook budget a hard gate, so a consumer documenting a budget
+  with no headroom left keeps the REJECT.
+- **`audit-automation-gaps`**: one batched docs fetch is mandatory for any candidate whose mechanism
+  is a Claude Code surface; conditionality survives only for non-harness facts, and a skip records
+  how the fact was settled.
+- **`audit-automation-gaps`**: the refusal gate and the implementation review both dispatch a
+  fresh-context judge, degrading to an inline review that records itself as same-context.
+- **`audit-automation-gaps`**: the findings store reports state it cannot trust separately from
+  state that is absent. A history file, pointer or payload that exists but is unreadable, an
+  incomplete publish, or a payload that does not parse, all exit 5; nothing stored still exits 4.
+  A missing `jq` is the prerequisite it is, exit 2, rather than a corruption claim about the
+  operator's artifact.
+- **`audit-automation-gaps`**: the audit writes twice, once when verdicts are presented and once
+  after the human selects, so `--implement` acts on what was chosen rather than on every candidate
+  the skill happened to pass.
+- **`audit-automation-gaps`**: `scripts/inventory.sh` exits 2 on a usage error or a project root it
+  cannot enter, where it previously always exited 0. Its only consumer already falls back to
+  `inventory unavailable`, so a nonzero exit degrades rather than injecting wrong numbers.
+
 ## [0.45.0]
 
 ### Added