docs(release): complete package distribution validation

TODO.md

@@ -10,6 +10,9 @@
 - [x] Add unit and installer regression tests and coverage threshold.
 - [x] Install the generated tarball in an isolated project and validate
   idempotent CLI install/uninstall and native agent discovery.
+- [x] Validate the tarball in a project with pre-existing JSONC settings,
+  unrelated plugins, and a user-owned skill; verify repeat install and
+  conservative uninstall after a managed-file edit.
 - [x] Diagnose and fix plugin loading: register the installed local plugin
   directory, and expose its namespaced tool through Code Mode. Verify activation
   and execution in OpenCode 2.0.24 against a local mock provider.

docs/IMPLEMENTATION-PLAN.md

@@ -110,7 +110,7 @@ provider call was made.
 **Acceptance:** project install is idempotent; user files are not overwritten;
 uninstall preserves locally modified content.
 
-### Phase 4 — Validate distribution artifact (open)
+### Phase 4 — Validate distribution artifact (complete)
 
 - Build and pack the real package.
 - Install its tarball into a clean project outside this repository.
@@ -121,7 +121,19 @@ uninstall preserves locally modified content.
 idempotent and OpenCode discovers the three packaged agents. Runtime testing
 showed that the old npm-name entry caused a registry 404 and that the namespaced
 tool needed Code Mode enabled. Both were corrected and the packaged plugin and
-tool were verified in a local mock-provider session.
+tool were verified in a local mock-provider session. The actual `0.1.0` tarball
+was also installed into an isolated project containing a pre-existing JSONC
+config, unrelated plugin, and user-owned skill. Assertions confirmed that
+installation preserved those resources and installed all three toolkit skills,
+the package entry point, and license files; a second install made no changes.
+After locally editing an installed toolkit skill, uninstall removed the
+unmodified package-owned assets and only the toolkit plugin entry, while
+preserving the edited skill, user config, unrelated plugin, and user-owned skill.
+The package was installed from the tarball with its declared dependencies, not
+from a checkout path or symlink. `npm run typecheck`, all 16 tests,
+`npm run test:coverage` (87.4% lines, 95.23% functions), and `npm pack --dry-run`
+also passed. The temporary fixture and assertions were under `/tmp/opencode`;
+provider-backed agent delegation and skill behavior remain unverified.
 
 **Acceptance:** no checkout symlink or development dependency is needed at
 runtime; config collisions are handled or reported before writes; the V2 plugin