diff --git a/.changepacks/changepack_log_Rt4nW8cKe2JpX6vHy9ZgA.json b/.changepacks/changepack_log_Rt4nW8cKe2JpX6vHy9ZgA.json
new file mode 100644
index 00000000..3ae83469
--- /dev/null
+++ b/.changepacks/changepack_log_Rt4nW8cKe2JpX6vHy9ZgA.json
@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "Cargo.toml": "Minor"
+  },
+  "note": "Add the /devup-retro command: a session retrospective that lists the follow-up prompts the user had to write after devup-mcp's work, classifies each by the surface that should have prevented it, asks the user to confirm, and then prints ready-to-paste improvement prompts (optionally saved as .feedback records). Ships as the devup-retro skill (Claude Code /devup-retro, OpenCode command file), as an MCP prompt of the same name for workspaces without the skill, and with a read-only devup_skills action `retro` that returns the installed build, this process's devup-mcp call log with timestamps, the surface list and the .feedback folder state.",
+  "date": "2026-11-10T00:00:00.000000000Z"
+}
diff --git a/README.md b/README.md
index 3e8fc8ef..3d555226 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ Rust-native MCP server that reads Figma designs and generates DevupUI artifacts.
 - `devup_figma_search`: page, section, frame, component를 이름으로 탐색. URL에 `node-id`가 있으면 **그 노드와 그 아래로 범위를 좁히고**, 없으면 파일 전체를 검색합니다. 둘 중 무엇을 했는지는 응답의 `scope`가 알려줍니다
 - `devup_figma_explore`: 링크된 요구사항/라벨 주변의 실제 화면 후보를 공간 순서로 탐색
 - `devup_figma_auth`: Figma에 닿는 **두 경로**(브리지 플러그인·direct OAuth)를 함께 보고(`status`) — 붙어 있는 플러그인의 파일·현재 페이지·선택까지. 그 밖에 브라우저 OAuth 로그인, 로그아웃, 사전 등록 자격증명 주입(`configure`), 참조 데이터까지 붙인 `doctor`. **로그인을 요청하기 전에 `status`부터 부르세요** — 플러그인이 붙어 있으면 로그인은 필요 없습니다
-- `devup_skills`: devup-mcp가 내놓는 코드에 필요한 에이전트 스킬이 이 워크스페이스에 있는지 보고(`status`)하고, devup-mcp가 품고 있는 것을 설치(`install`). **텍스트를 응답에 실어 보내는 게 아니라 스킬 디렉터리에 설치해서 에이전트 자신의 로더가 읽게 합니다** — 한 번 읽은 문서는 한 번 쓰이지만, 설치된 스킬은 이후 모든 세션에 계속 적용됩니다. 어느 디렉터리인지는 `clientInfo`로 판별한 런타임이 정하고, `projectRoot`로 어느 프로젝트인지 지정합니다
+- `devup_skills`: devup-mcp가 내놓는 코드에 필요한 에이전트 스킬이 이 워크스페이스에 있는지 보고(`status`)하고, devup-mcp가 품고 있는 것을 설치(`install`). **텍스트를 응답에 실어 보내는 게 아니라 스킬 디렉터리에 설치해서 에이전트 자신의 로더가 읽게 합니다** — 한 번 읽은 문서는 한 번 쓰이지만, 설치된 스킬은 이후 모든 세션에 계속 적용됩니다. 어느 디렉터리인지는 `clientInfo`로 판별한 런타임이 정하고, `projectRoot`로 어느 프로젝트인지 지정합니다 `retro`는 작업 뒤 회고 명령 `/devup-retro`가 쓰는 읽기 전용 액션입니다(아래 “작업 뒤 회고” 참고).
 - `devup_project_context`: 프로젝트의 실제 `devup.json` 토큰, `openapi.json` 엔드포인트, Vespertide 모델을 읽음. 중첩 체크아웃과 빌드 산출물 디렉터리는 스캔에서 제외하고 무엇을 제외했는지 보고
 - `devup_ui_validate`: 생성한 TSX를 프로젝트의 실제 `devup.json`에 대조해 검증. `ok`는 개수가 아니라 심각도로 판정
 - `devup_stack_diff`: DB 모델부터 생성된 API 클라이언트까지의 층간 드리프트 탐지. 모든 발견은 명시적 `confidence`를 가짐
@@ -1107,6 +1107,14 @@ DevupUI가 audit 속성을 기본으로 제거하며 `DEVUP_AUDIT=1`이면 유
 
 명시적 시작점 `/devup [figma url] [notes]`: `devup_skills install`이 `devup` 스킬을 다른 스킬과 함께 쓰고(Claude Code는 프로젝트 스킬을 같은 이름의 슬래시 명령으로 제공하므로 `.claude/skills/devup/SKILL.md`가 곧 `/devup`), OpenCode에는 `.opencode/command/devup.md`도 씁니다. 명령 위치가 검증되지 않은 다른 런타임은 지원하지 않는다고 보고합니다. `devup_skills status`의 `command`가 설치 여부를 알려 줍니다. `/devup` 없이도 Figma로 페이지나 사이트를 만들어 달라는 요청이면 같은 흐름을 시작합니다.
 
+작업 뒤 회고 `/devup-retro [범위 또는 메모]`: devup-mcp로 한 작업이 끝난 뒤 한 번 입력하면, devup-mcp가 처음 호출된 시점부터 지금까지의 대화에서 사용자가 결과를 고치거나 마무리하려고 직접 써야 했던 후속 프롬프트(“애니메이션을 추가해야 함”, “UI가 잘못됐어”, 간격·너비, 한글 줄바꿈, 누락된 상태, 잘못된 에셋, 실행하지 않은 테스트, 틀린 CI 증거 등)를 모읍니다. 세 단계이며 합치지 않습니다.
+
+1. **review**: 항목마다 사용자 프롬프트 원문 인용, 무엇이 잘못됐는지, 증거(파일·노드·도구 출력), 그리고 그것을 막았어야 할 surface 하나(`codegen`, `export-output`, `validation-rule`, `runtime-audit`, `skill-guidance`, `bootstrap-instructions`, `project-plan-intake`, `out-of-scope:devup-ui|app|figma-data`)를 적습니다. 사용자 프롬프트 증거가 없는 항목은 넣지 않고, 설치된 버전에서 이미 고쳐진 항목은 `fixed-in-installed`/`fixed-not-installed`/`already-recorded`로 표시합니다(릴리스 노트를 읽지 못하면 `unverified`).
+2. **confirm**: 목록을 표로 보여 주고 질문 도구로 `OK / Edit items / Drop items / Cancel`을 묻습니다. 확인 전에는 아무것도 쓰지 않고 개선 프롬프트도 출력하지 않습니다. 프로젝트에 `.feedback/` 폴더가 있을 때만 기록 저장 여부를 함께 묻습니다.
+3. **prompts**: `OK` 뒤에 surface별로 붙여 넣을 수 있는 devup-mcp 개선 프롬프트를 사용자 언어로 출력합니다. 각 프롬프트는 목표, 구체적 필수 동작, 수용 기준·회귀 테스트, 범위 경계를 가집니다. 저장을 선택했다면 `.feedback/`의 기존 형식·번호·index를 그대로 따라 항목별 기록을 추가합니다.
+
+`/devup`과 같은 경로로 배포됩니다: `devup_skills install`이 `devup-retro` 스킬을 쓰고(Claude Code에서는 `.claude/skills/devup-retro/SKILL.md`가 곧 `/devup-retro`, Codex 등은 `.agents/skills`에서 이름으로 로드), OpenCode에는 스킬 본문으로 만든 `.opencode/command/devup-retro.md`도 씁니다. 설치하지 않은 워크스페이스에서는 MCP 프롬프트 `devup-retro`(인자 `scope`, `language`, 둘 다 선택; Claude Code에서는 `/mcp__<서버 이름>__devup-retro`)로 같은 본문을 받습니다. `devup_skills`의 `retro` 액션은 읽기 전용으로 설치된 빌드(`server`), 이 서버 프로세스가 처리한 devup-mcp 호출 기록(`callLog`: 도구·action·outputs·시각·성공 여부, 최대 200개, 인자 내용과 결과는 보관하지 않으며 재연결하면 비워짐), surface 목록, `.feedback/` 상태(`nextNumber`, index, 최근 기록)를 돌려줍니다. 명령 이름은 `crates/devup-mcp/src/server/skills/commands.rs`의 `retro_name!` 한 곳에서 정합니다.
+
 질문 도구에 호출당 개수 제한이 없으면(OpenCode `question`) 평평한 `questions` 목록을 한 번에 묻고, 제한이 있으면(Claude Code `AskUserQuestion`: 4) `maxQuestionsPerRound`(기본 4)로 나눈 `questionRounds`를 연달아 묻습니다.
 
 ## 읽기 전용·개인정보 보호
diff --git a/crates/devup-mcp/src/server/handlers/devup_skills.rs b/crates/devup-mcp/src/server/handlers/devup_skills.rs
index 88005f98..071c83e6 100644
--- a/crates/devup-mcp/src/server/handlers/devup_skills.rs
+++ b/crates/devup-mcp/src/server/handlers/devup_skills.rs
@@ -28,9 +28,10 @@ impl DevupServer {
                 result["state"] = skills::report(&lookup);
                 Ok(tool_result(result))
             }
+            "retro" => Ok(tool_result(skills::retro_report(&lookup, &self.call_log))),
             other => Err(to_mcp_error(DevupError::new(
                 ErrorCode::DevupInvalidInput,
-                format!("action must be status or install, not {other}."),
+                format!("action must be status, install or retro, not {other}."),
                 false,
             ))),
         }
diff --git a/crates/devup-mcp/src/server/mod.rs b/crates/devup-mcp/src/server/mod.rs
index ca3f4fd0..e3f574b8 100644
--- a/crates/devup-mcp/src/server/mod.rs
+++ b/crates/devup-mcp/src/server/mod.rs
@@ -3,4 +3,5 @@ include!("mod_parts/state_and_services.rs");
 include!("mod_parts/acquisition.rs");
 include!("mod_parts/component_width_acquisition.rs");
 include!("mod_parts/exploration_and_responses.rs");
+include!("mod_parts/error_envelopes.rs");
 include!("mod_parts/p2_recovery_tests.rs");
diff --git a/crates/devup-mcp/src/server/mod_parts/error_envelopes.rs b/crates/devup-mcp/src/server/mod_parts/error_envelopes.rs
new file mode 100644
index 00000000..c116c1ac
--- /dev/null
+++ b/crates/devup-mcp/src/server/mod_parts/error_envelopes.rs
@@ -0,0 +1,94 @@
+/// Maps a [`DevupError`] onto the JSON-RPC error the caller actually sees.
+///
+/// The protocol code is not decoration here: the caller is usually an agent
+/// choosing between "fix the arguments and call again" and "stop and report",
+/// and every error used to arrive as INTERNAL_ERROR, which says the second
+/// thing about both. A mistake in the call itself is INVALID_PARAMS, so that
+/// decision can be made without parsing the message. `data` keeps carrying
+/// the exact `code` and `retryable`, unchanged.
+fn to_mcp_error(mut error: DevupError) -> ErrorData {
+    if error.code == ErrorCode::DevupFigmaHandoffExpired
+        && error.details.get("exportJob").is_none()
+        && error.details.get("assetJob").is_none()
+    {
+        if !error.details.is_object() {
+            error.details = json!({"upstreamDetails":error.details});
+        }
+        if error.details.get("stage").is_none() {
+            error.details["stage"] = json!("artifact-lookup");
+        }
+        if error.details.get("artifactState").is_none() {
+            error.details["artifactState"] = json!("unknown");
+        }
+        let recovery = error.details.get("recoveryArguments").cloned();
+        error.details["recoveryState"] = json!(if recovery.is_some() {
+            "available"
+        } else {
+            "unrecoverable"
+        });
+        let another_process = error.details["artifactState"] == "issued-by-another-process";
+        if recovery.is_none() {
+            error.details["recoveryReason"] = json!(if another_process {
+                include_str!("../text/mod-to_mcp_error-784239dd.md")
+            } else {
+                "Original URL/selection cannot be recovered from this server. The ID may be unknown, evicted beyond metadata retention, or lost on restart; the cause cannot be determined."
+            });
+        }
+        error.details["recovery"] = json!({
+            "mode": "recollect",
+            "cause": match error.details["artifactState"].as_str() {
+                Some("expired") => "artifact-expired",
+                Some("evicted") => "artifact-evicted",
+                Some("issued-by-another-process") => "issued-by-another-process",
+                _ => "artifact-unknown",
+            },
+            "reprojectable": false,
+            "requiresOriginalUrl": recovery.is_none(),
+        });
+        error.details["nextAction"] = json!({"tool":"devup_figma_export",
+            "arguments":{"refresh":true},"requiredArguments":["url"],"omitArguments":["artifactId"],
+            "how":include_str!("../text/mod-to_mcp_error-20941350.md")});
+        if let Some(arguments) = recovery {
+            error.details["nextAction"]["arguments"] = arguments;
+        }
+    }
+    if error.details["recoveryArguments"]["nodeIds"].is_array() {
+        error.details["nextAction"] = json!({"tool":"devup_figma_measure","arguments":error.details["recoveryArguments"],
+            "how":"Repeat the explicit measured node list; a measurement receipt never recovers by exporting the current selection."});
+    }
+    let mcp_code = if validation::is_caller_mistake(&error) {
+        McpErrorCode::INVALID_PARAMS
+    } else {
+        McpErrorCode::INTERNAL_ERROR
+    };
+    ErrorData::new(
+        mcp_code,
+        error.message,
+        Some(
+            json!({ "code": error.code, "retryable": error.retryable, "details": error.details, "server":delivery::server_identity() }),
+        ),
+    )
+}
+
+fn structured_tool_error(error: ErrorData) -> rmcp::model::CallToolResult {
+    let mut data = error.data.unwrap_or_else(|| json!({}));
+    if !data.is_object() {
+        data = json!({"details":data});
+    }
+    data.as_object_mut().unwrap().remove("server");
+    if data.get("code").is_none() {
+        data["code"] = json!("DEVUP_INVALID_INPUT");
+    }
+    if data.get("retryable").is_none() {
+        data["retryable"] = json!(false);
+    }
+    if data.get("details").is_none() {
+        data["details"] = json!({});
+    }
+    data["message"] = json!(error.message);
+    data["rpcCode"] = json!(error.code);
+    let mut result = tool_result(json!({"error":data}));
+    result.is_error = Some(true);
+    result
+}
+
diff --git a/crates/devup-mcp/src/server/mod_parts/exploration_and_responses.rs b/crates/devup-mcp/src/server/mod_parts/exploration_and_responses.rs
index 499435aa..55f99adb 100644
--- a/crates/devup-mcp/src/server/mod_parts/exploration_and_responses.rs
+++ b/crates/devup-mcp/src/server/mod_parts/exploration_and_responses.rs
@@ -743,100 +743,6 @@ fn section_retry(
     ))
 }
 
-/// Maps a [`DevupError`] onto the JSON-RPC error the caller actually sees.
-///
-/// The protocol code is not decoration here: the caller is usually an agent
-/// choosing between "fix the arguments and call again" and "stop and report",
-/// and every error used to arrive as INTERNAL_ERROR, which says the second
-/// thing about both. A mistake in the call itself is INVALID_PARAMS, so that
-/// decision can be made without parsing the message. `data` keeps carrying
-/// the exact `code` and `retryable`, unchanged.
-fn to_mcp_error(mut error: DevupError) -> ErrorData {
-    if error.code == ErrorCode::DevupFigmaHandoffExpired
-        && error.details.get("exportJob").is_none()
-        && error.details.get("assetJob").is_none()
-    {
-        if !error.details.is_object() {
-            error.details = json!({"upstreamDetails":error.details});
-        }
-        if error.details.get("stage").is_none() {
-            error.details["stage"] = json!("artifact-lookup");
-        }
-        if error.details.get("artifactState").is_none() {
-            error.details["artifactState"] = json!("unknown");
-        }
-        let recovery = error.details.get("recoveryArguments").cloned();
-        error.details["recoveryState"] = json!(if recovery.is_some() {
-            "available"
-        } else {
-            "unrecoverable"
-        });
-        let another_process = error.details["artifactState"] == "issued-by-another-process";
-        if recovery.is_none() {
-            error.details["recoveryReason"] = json!(if another_process {
-                include_str!("../text/mod-to_mcp_error-784239dd.md")
-            } else {
-                "Original URL/selection cannot be recovered from this server. The ID may be unknown, evicted beyond metadata retention, or lost on restart; the cause cannot be determined."
-            });
-        }
-        error.details["recovery"] = json!({
-            "mode": "recollect",
-            "cause": match error.details["artifactState"].as_str() {
-                Some("expired") => "artifact-expired",
-                Some("evicted") => "artifact-evicted",
-                Some("issued-by-another-process") => "issued-by-another-process",
-                _ => "artifact-unknown",
-            },
-            "reprojectable": false,
-            "requiresOriginalUrl": recovery.is_none(),
-        });
-        error.details["nextAction"] = json!({"tool":"devup_figma_export",
-            "arguments":{"refresh":true},"requiredArguments":["url"],"omitArguments":["artifactId"],
-            "how":include_str!("../text/mod-to_mcp_error-20941350.md")});
-        if let Some(arguments) = recovery {
-            error.details["nextAction"]["arguments"] = arguments;
-        }
-    }
-    if error.details["recoveryArguments"]["nodeIds"].is_array() {
-        error.details["nextAction"] = json!({"tool":"devup_figma_measure","arguments":error.details["recoveryArguments"],
-            "how":"Repeat the explicit measured node list; a measurement receipt never recovers by exporting the current selection."});
-    }
-    let mcp_code = if validation::is_caller_mistake(&error) {
-        McpErrorCode::INVALID_PARAMS
-    } else {
-        McpErrorCode::INTERNAL_ERROR
-    };
-    ErrorData::new(
-        mcp_code,
-        error.message,
-        Some(
-            json!({ "code": error.code, "retryable": error.retryable, "details": error.details, "server":delivery::server_identity() }),
-        ),
-    )
-}
-
-fn structured_tool_error(error: ErrorData) -> rmcp::model::CallToolResult {
-    let mut data = error.data.unwrap_or_else(|| json!({}));
-    if !data.is_object() {
-        data = json!({"details":data});
-    }
-    data.as_object_mut().unwrap().remove("server");
-    if data.get("code").is_none() {
-        data["code"] = json!("DEVUP_INVALID_INPUT");
-    }
-    if data.get("retryable").is_none() {
-        data["retryable"] = json!(false);
-    }
-    if data.get("details").is_none() {
-        data["details"] = json!({});
-    }
-    data["message"] = json!(error.message);
-    data["rpcCode"] = json!(error.code);
-    let mut result = tool_result(json!({"error":data}));
-    result.is_error = Some(true);
-    result
-}
-
 #[tool_handler(router = self.tool_router)]
 impl ServerHandler for DevupServer {
     async fn call_tool(
@@ -854,6 +760,7 @@ impl ServerHandler for DevupServer {
             let _ = self.client_name.set(peer.client_info.name.clone());
         }
         let mut request = request;
+        let mut record = self.call_log.begin(request.name.as_ref(), request.arguments.as_ref());
         if let (Some(tool), Some(arguments)) =
             (self.tool_router.get(request.name.as_ref()), request.arguments.as_mut())
         {
@@ -884,9 +791,27 @@ impl ServerHandler for DevupServer {
                 ));
             }
         }
+        record.finish(!matches!(&response, rmcp::model::CallToolResponse::Complete(result) if result.is_error == Some(true)));
         Ok(response)
     }
 
+    async fn list_prompts(
+        &self,
+        _request: Option<rmcp::model::PaginatedRequestParams>,
+        _context: RequestContext<RoleServer>,
+    ) -> Result<rmcp::model::ListPromptsResult, ErrorData> {
+        Ok(rmcp::model::ListPromptsResult::with_all_items(vec![skills::retro_prompt()]))
+    }
+
+    async fn get_prompt(
+        &self,
+        request: rmcp::model::GetPromptRequestParams,
+        _context: RequestContext<RoleServer>,
+    ) -> Result<rmcp::model::GetPromptResponse, ErrorData> {
+        skills::retro_prompt_result(&request.name, request.arguments.as_ref())
+            .ok_or_else(|| ErrorData::invalid_params(format!("Unknown prompt: {}", request.name), None))
+    }
+
     fn get_info(&self) -> ServerInfo {
         // Initialize is the first moment a real session exists, which makes it
         // the right place to start the release lookup: server construction is
@@ -897,6 +822,7 @@ impl ServerHandler for DevupServer {
         release_check::spawn();
         ServerInfo::new(
             ServerCapabilities::builder()
+                .enable_prompts()
                 .enable_resources()
                 .enable_tools()
                 .build(),
diff --git a/crates/devup-mcp/src/server/mod_parts/state_and_services.rs b/crates/devup-mcp/src/server/mod_parts/state_and_services.rs
index 0f33c50f..64d6cc94 100644
--- a/crates/devup-mcp/src/server/mod_parts/state_and_services.rs
+++ b/crates/devup-mcp/src/server/mod_parts/state_and_services.rs
@@ -432,6 +432,8 @@ pub struct DevupServer {
     /// not run through, and the skill roots would silently go back to
     /// guessing.
     client_name: std::sync::Arc<std::sync::OnceLock<String>>,
+    /// The calls this process served, for `devup_skills` action `retro`.
+    call_log: skills::CallLog,
 }
 
 impl DevupServer {
@@ -462,6 +464,7 @@ impl DevupServer {
             artifacts: ArtifactStore::default(),
             output_policy: OutputPolicy::from_roots(roots)?,
             client_name: std::sync::Arc::new(std::sync::OnceLock::new()),
+            call_log: skills::CallLog::default(),
         })
     }
 
diff --git a/crates/devup-mcp/src/server/skills.rs b/crates/devup-mcp/src/server/skills.rs
index 086081c1..650cf67a 100644
--- a/crates/devup-mcp/src/server/skills.rs
+++ b/crates/devup-mcp/src/server/skills.rs
@@ -28,7 +28,7 @@
 //! that copy is moved forward.
 //!
 //! `own` skills are written here, in this repository - devfive-frontend,
-//! devup-implementation-plan and devup. There
+//! devup-implementation-plan, devup and devup-retro. There
 //! is no upstream to vendor from and nothing for the refresh script to compare
 //! against, so they pin no commit; this repository's own history is their
 //! provenance. They are otherwise installed exactly like an embedded skill,
@@ -47,6 +47,10 @@
 //! ever exported a screen.
 
 // Source sections share this module to preserve privacy and test names.
+// First: it defines the macro the catalog spells an embedded path with.
+include!("skills/commands.rs");
 include!("skills/catalog.rs");
 include!("skills/installation.rs");
+include!("skills/retro.rs");
 include!("skills/tests.rs");
+include!("skills/retro_tests.rs");
diff --git a/crates/devup-mcp/src/server/skills/catalog.rs b/crates/devup-mcp/src/server/skills/catalog.rs
index bdd21a77..1744bda5 100644
--- a/crates/devup-mcp/src/server/skills/catalog.rs
+++ b/crates/devup-mcp/src/server/skills/catalog.rs
@@ -107,6 +107,10 @@ const EMBEDDED: &[(&str, Documents)] = &[
         "devup",
         &[("SKILL.md", include_str!("devup/SKILL.md"))],
     ),
+    (
+        RETRO_NAME,
+        &[("SKILL.md", include_str!(concat!(retro_name!(), "/SKILL.md")))],
+    ),
     (
         "changepacks",
         &[("SKILL.md", include_str!("changepacks/SKILL.md"))],
diff --git a/crates/devup-mcp/src/server/skills/commands.rs b/crates/devup-mcp/src/server/skills/commands.rs
new file mode 100644
index 00000000..f0b918f7
--- /dev/null
+++ b/crates/devup-mcp/src/server/skills/commands.rs
@@ -0,0 +1,226 @@
+/// The slash commands devup-mcp ships, and where each runtime reads them.
+///
+/// An MCP server cannot start a skill or a slash command itself, so the user
+/// gets one to type. Claude Code turns every project skill into a slash
+/// command of the same name, so a skill installed with the others already is
+/// its command there. OpenCode keeps slash commands in their own directory,
+/// so it gets a command file as well. Every other runtime is reported
+/// unsupported rather than given a path nobody verified.
+///
+/// The retrospective command is named here and nowhere else in Rust. Renaming
+/// it (to `devup-review-next`, `devup-confirm`, ...) is: change this literal,
+/// `git mv skills/devup-retro skills/<new>`, and replace the old name in that
+/// skill's frontmatter and its `manifest.json` entry (then update the bytes
+/// and sha256). `the_retro_name_is_spelled_in_one_place` fails until all of
+/// them agree.
+macro_rules! retro_name {
+    () => {
+        "devup-retro"
+    };
+}
+pub const RETRO_NAME: &str = retro_name!();
+
+pub struct Command {
+    pub name: &'static str,
+    pub invocation: &'static str,
+    /// What typing it does, shown once it is installed.
+    ready: &'static str,
+    /// Shown to a runtime with no verified command location; `{}` is its name.
+    unsupported: &'static str,
+    /// A hand-written OpenCode command file, or `None` to build one from the
+    /// skill of the same name so the two cannot drift apart.
+    opencode: Option<&'static str>,
+}
+
+pub const COMMAND_NAME: &str = "devup";
+pub const COMMAND_INVOCATION: &str = "/devup [figma url] [notes]";
+pub const COMMANDS: &[Command] = &[
+    Command {
+        name: COMMAND_NAME,
+        invocation: COMMAND_INVOCATION,
+        ready: "Type /devup with a Figma link and notes to start the whole workflow.",
+        unsupported: include_str!("../text/skills-command_state-84cd29d8.md"),
+        opencode: Some(include_str!("../commands/opencode-devup.md")),
+    },
+    Command {
+        name: RETRO_NAME,
+        invocation: concat!("/", retro_name!(), " [scope or notes]"),
+        ready: concat!(
+            "Type /",
+            retro_name!(),
+            " after devup-mcp work is finished: it reviews the session's follow-up prompts, \
+             asks you to confirm the list, then prints improvement prompts for devup-mcp."
+        ),
+        unsupported: concat!(
+            "devup-mcp writes no slash command for {}: no command location for it is verified. \
+             The ",
+            retro_name!(),
+            " skill is installed with the others; ask for it by name, or use the MCP prompt of \
+             the same name."
+        ),
+        opencode: None,
+    },
+];
+const OPENCODE_COMMAND_ROOT: &str = ".opencode/command";
+const OPENCODE_USER_COMMAND_ROOT: &str = ".config/opencode/command";
+
+impl Command {
+    pub fn find(name: &str) -> Option<&'static Command> {
+        COMMANDS.iter().find(|command| command.name == name)
+    }
+
+    /// Marks a command file devup-mcp wrote, so a later install may rewrite
+    /// it and leaves anyone else's alone.
+    fn marker(&self) -> String {
+        format!("<!-- devup-mcp:command {} ", self.name)
+    }
+
+    /// The skill's own title and body under OpenCode's frontmatter.
+    fn opencode_text(&self) -> std::borrow::Cow<'static, str> {
+        if let Some(text) = self.opencode {
+            return text.into();
+        }
+        let title = find_by_name(self.name).map_or(self.name, |skill| &skill.record.title);
+        format!(
+            "---\ndescription: {title}\n---\n{}- written by devup_skills install; rewritten by \
+             later installs. -->\n\nRun the {} command for: $ARGUMENTS\n\n{}",
+            self.marker(),
+            self.name,
+            skill_body(self.name).trim_start(),
+        )
+        .into()
+    }
+
+    fn opencode_paths(&self, lookup: &Lookup) -> Vec<PathBuf> {
+        let file = format!("{}.md", self.name);
+        let mut paths = vec![join_root(&lookup.project, OPENCODE_COMMAND_ROOT).join(&file)];
+        if let Some(home) = &lookup.home {
+            paths.push(join_root(home, OPENCODE_USER_COMMAND_ROOT).join(&file));
+        }
+        paths
+    }
+
+    /// Whether the command is installed for the detected runtime, and where.
+    pub fn state(&self, lookup: &Lookup) -> serde_json::Value {
+        let name = self.name;
+        let claude = || {
+            let paths = Lookup {
+                runtime: Runtime::ClaudeCode,
+                ..lookup.clone()
+            }
+            .installed_paths(name);
+            serde_json::json!({
+                "runtime": "claude-code",
+                "via": "skill",
+                "installed": !paths.is_empty(),
+                "paths": paths.iter().map(|path| path.display().to_string()).collect::<Vec<_>>(),
+                "how": format!("Claude Code offers every project skill as a slash command of the same name; the {name} skill is /{name}."),
+            })
+        };
+        let opencode = || {
+            let found = self
+                .opencode_paths(lookup)
+                .into_iter()
+                .filter(|path| path.is_file())
+                .collect::<Vec<_>>();
+            serde_json::json!({
+                "runtime": "opencode",
+                "via": "command",
+                "installed": !found.is_empty(),
+                "paths": found.iter().map(|path| path.display().to_string()).collect::<Vec<_>>(),
+                "writesTo": join_root(&lookup.project, OPENCODE_COMMAND_ROOT).join(format!("{name}.md")).display().to_string(),
+                "how": "OpenCode reads slash commands from .opencode/command/*.md.",
+            })
+        };
+        let per_runtime = match lookup.runtime {
+            Runtime::ClaudeCode => vec![claude()],
+            Runtime::Opencode => vec![opencode()],
+            Runtime::Unknown => vec![claude(), opencode()],
+            _ => Vec::new(),
+        };
+        let supported = !per_runtime.is_empty();
+        let installed = per_runtime.iter().any(|entry| entry["installed"] == true);
+        serde_json::json!({
+            "name": name,
+            "invocation": self.invocation,
+            "runtime": lookup.runtime.as_str(),
+            "supported": supported,
+            "installed": installed,
+            "perRuntime": per_runtime,
+            "how": if !supported {
+                self.unsupported.replace("{}", lookup.runtime.as_str())
+            } else if installed {
+                self.ready.to_owned()
+            } else {
+                format!("Call devup_skills with action \"install\"; it writes /{name} with the skills.")
+            },
+        })
+    }
+}
+
+/// A carried skill's entry document without its frontmatter.
+pub fn skill_body(name: &str) -> &'static str {
+    let text = find_by_name(name)
+        .and_then(|skill| skill.texts)
+        .and_then(|documents| documents.iter().find(|(path, _)| *path == ENTRY_DOCUMENT))
+        .map_or("", |(_, text)| *text);
+    &text[frontmatter_end(text).unwrap_or(0)..]
+}
+
+/// Whether an install writes the OpenCode commands: when OpenCode is the
+/// client, or when the skills go to its skill root. `roots` are the install's
+/// roots as chosen before anything was staged - staging creates directories,
+/// and asking again afterwards sees only the first of them.
+fn writes_opencode_command(lookup: &Lookup, roots: &[PathBuf]) -> bool {
+    lookup.runtime == Runtime::Opencode
+        || roots
+            .iter()
+            .any(|root| root.ends_with(Path::new(".opencode").join("skill")))
+}
+
+/// Whether `/devup` is installed for the detected runtime, and where.
+pub fn command_state(lookup: &Lookup) -> serde_json::Value {
+    COMMANDS[0].state(lookup)
+}
+
+/// Stages the OpenCode command files when this install writes them. A file
+/// devup-mcp did not write is left alone and reported.
+fn stage_commands(
+    policy: &super::output::OutputPolicy,
+    transaction: &mut super::output::OutputTransaction,
+    lookup: &Lookup,
+    roots: &[PathBuf],
+) -> Result<Vec<serde_json::Value>, devup_mcp_figma::DevupError> {
+    if !writes_opencode_command(lookup, roots) {
+        return Ok(Vec::new());
+    }
+    let mut reports = Vec::new();
+    for command in COMMANDS {
+        let path =
+            join_root(&lookup.project, OPENCODE_COMMAND_ROOT).join(format!("{}.md", command.name));
+        let text = command.opencode_text();
+        let existing = std::fs::read_to_string(&path).ok();
+        let state = match existing.as_deref() {
+            Some(found) if found == text => "alreadyPresent",
+            Some(found) if !found.contains(&command.marker()) => "leftAlone",
+            Some(_) => "refreshed",
+            None => "installed",
+        };
+        if matches!(state, "installed" | "refreshed") {
+            let target = policy.resolve(&path.display().to_string())?;
+            transaction.stage(
+                format!("command:opencode:{}", command.name),
+                target,
+                text.as_bytes(),
+            )?;
+        }
+        reports.push(serde_json::json!({
+            "name": command.name,
+            "runtime": "opencode",
+            "path": path.display().to_string(),
+            "state": state,
+            "invocation": command.invocation,
+        }));
+    }
+    Ok(reports)
+}
diff --git a/crates/devup-mcp/src/server/skills/devup-retro/SKILL.md b/crates/devup-mcp/src/server/skills/devup-retro/SKILL.md
new file mode 100644
index 00000000..0fa0ecf1
--- /dev/null
+++ b/crates/devup-mcp/src/server/skills/devup-retro/SKILL.md
@@ -0,0 +1,177 @@
+---
+name: devup-retro
+description: |
+  Session retrospective for work done with devup-mcp. Reviews the conversation
+  from the first devup-mcp call to now, lists every follow-up prompt the user had
+  to write to correct or complete the result, classifies each by the devup-mcp
+  surface that should have prevented it, asks the user to confirm the list, and
+  only then prints ready-to-paste improvement prompts for devup-mcp development.
+
+  Invoke as /devup-retro [scope or notes] once a piece of devup-mcp work is
+  finished. Also use when asked to "turn this session's corrections into
+  devup-mcp feedback" or to explain why follow-up prompts were needed.
+---
+
+# Session retrospective: follow-up prompts to improvement prompts
+
+The goal is that the user never has to write the same follow-up prompt again.
+Every correction the user typed after devup-mcp produced something is evidence
+of a gap. This command turns that evidence into prompts the devup-mcp
+maintainers can act on. It reviews; it does not fix the application and it does
+not change devup-mcp.
+
+Three phases, in this order, never merged: **review, confirm, prompts**.
+Nothing is written to disk and no improvement prompt is printed before the user
+confirms the review list.
+
+## Phase 1: review
+
+1. Call `devup_skills` with `action: "retro"` and the same `projectRoot` the
+   session used. It returns the installed build (`server.version`,
+   `server.commit`, `server.buildId`), this server process's devup-mcp call log
+   with timestamps (`callLog`), the `.feedback/` folder state (`feedback`), the
+   surface list (`surfaces`) and where release notes live (`releases`).
+   The call log only covers this server process: after a reconnect or in a
+   resumed session it is partial, and `callLog.note` says so. It is an aid for
+   ordering, never the evidence itself.
+2. Find the starting point: the first devup-mcp call of the work under review
+   (export, plan, validation, audit, compare). An argument given to the command
+   narrows the scope ("only the landing page", "since the second export"). If
+   the conversation was compacted and the early part is no longer visible, say
+   which part you could not read. Do not reconstruct it from memory.
+3. Walk every user message after that point. Keep a message when the user had
+   to correct, redo or complete something devup-mcp's output, validation or
+   guidance was responsible for, for example:
+   - missing or wrong motion ("add the animation", "the reveal replays");
+   - wrong layout (spacing, width, alignment, overflow, a width that was never audited);
+   - wrong text wrapping, including Korean word breaks;
+   - missing interaction states, links or events left unwired;
+   - wrong, missing or placeholder assets;
+   - tests, lint, typecheck or audits not run, or reported as run without evidence;
+   - wrong CI or completion evidence (wrong commit, wrong run, counts that do not match);
+   - a question asked late, or asked again, that intake should have settled.
+   Drop messages that are new requirements, changes of mind, approvals, or
+   ordinary conversation. A message is a follow-up only if the earlier result
+   should already have satisfied it.
+4. For each kept message, record one item:
+   - `quote`: the user's words, verbatim and in their language, trimmed to the relevant sentence;
+   - `what`: what was wrong, in one sentence, stated as an observation;
+   - `evidence`: the file, Figma node id, tool call or tool output that shows it
+     (a `callLog` entry, a validation result, an audit report, a diff). Cite what
+     you actually read in this session;
+   - `surface`: exactly one value from `surfaces` (below);
+   - `cause`: observed fact versus your inference, labelled separately;
+   - `status`: see "Already fixed" below.
+   Merge messages about the same defect into one item and keep every quote.
+
+### Rules that keep the list honest
+
+- No invented problems. An item with no user-prompt evidence is excluded, even
+  if you noticed the defect yourself. Mention such observations separately,
+  after the list, as "not from a follow-up prompt"; they never become prompts.
+- Not every problem is a devup-mcp bug. Classify agent mistakes, Devup UI
+  compiler behaviour, application code and Figma data as what they are.
+- Do not strengthen the user's words. "UI가 잘못됐어" stays that quote; the
+  specific defect comes from the evidence, not from the quote.
+- When the evidence is missing, the item says "evidence not found in this
+  session" and is listed as unverified rather than dropped silently.
+
+### Surfaces
+
+| surface | The gap is in |
+| --- | --- |
+| `codegen` | the TSX/CSS the converter generates from Figma nodes |
+| `export-output` | what `devup_figma_export` returns: outputs, assets, manifests, deliverable flags, sidecars |
+| `validation-rule` | a `devup_ui_validate` rule that is missing, too weak or wrong |
+| `runtime-audit` | `devup_runtime_audit`, audit plans, `devup_visual_compare` checks and their evidence |
+| `skill-guidance` | the installed skills (`devup`, `devup-implementation-plan`, `devfive-frontend` and references) |
+| `bootstrap-instructions` | the server instructions and `devup://guide/usage` |
+| `project-plan-intake` | `devup_project_plan` / `devup_screen_plan` questions, rounds, ERD, split |
+| `out-of-scope:devup-ui` | Devup UI runtime or compiler, not devup-mcp |
+| `out-of-scope:app` | the application's own code, tests, CI or environment |
+| `out-of-scope:figma-data` | the design file itself (missing variants, wrong constraints) |
+
+Pick the surface that should have **prevented** the follow-up, which is not
+always the one that produced the defect: a converter gap that validation would
+have caught is `codegen`, and the acceptance check in its prompt names the
+validation rule.
+
+### Already fixed
+
+Compare each item with the installed build from `devup_skills retro`, the
+release notes at `releases.url` (use `gh release list -R dev-five-git/devup-mcp`
+or a fetch tool when one is available), and any status line in the project's
+`.feedback/` records. Set `status` to one of:
+
+- `open`: no evidence of a fix;
+- `fixed-in-installed`: the installed version already contains the fix; the
+  follow-up was caused by something else (a stale skill copy, an agent mistake)
+  and the item says which;
+- `fixed-not-installed`: a newer release fixes it; `server.updateAvailable` or
+  the release notes show it; the action is to update, not to file a prompt;
+- `already-recorded`: an existing `.feedback/` record covers it; name the file;
+- `unverified`: release notes could not be read. Say so; never guess "fixed".
+
+## Phase 2: confirm
+
+Show the review list as a table, numbered, in the user's language: quote,
+what was wrong, surface, evidence, status. Then ask with the runtime question
+tool (Claude Code `AskUserQuestion`, OpenCode `question`), in one call:
+
+1. Review list: `OK` (Recommended) / `Edit items` / `Drop items` / `Cancel`.
+2. If a `.feedback/` folder exists (`feedback.exists`): also save each item as a
+   feedback record? `Yes` / `No`. Without the folder, do not offer to create one.
+
+On `Edit items` or `Drop items`, apply what the user says, show the updated
+table and ask again. Repeat until `OK` or `Cancel`. On `Cancel`, stop: print
+nothing further and write nothing. Without a question tool, print the table,
+ask the same question in one message and wait; never assume `OK`.
+
+## Phase 3: prompts
+
+Only after `OK`. Write in the user's language (Korean when the session is
+Korean); keep identifiers, tool names, file paths and code in their original
+form. Group items by surface and print one ready-to-paste prompt per surface,
+each in its own fenced block so it can be copied whole.
+
+Items with status `fixed-in-installed`, `fixed-not-installed` or
+`already-recorded` get no prompt. List them under the prompts with the action
+that applies (update devup-mcp, reinstall skills, see the existing record).
+`out-of-scope:*` items get a short prompt addressed to that owner (Devup UI,
+the application, the designer), clearly marked as not for devup-mcp.
+
+Every prompt has these four parts, in this order:
+
+1. **Goal**: one sentence, addressed to devup-mcp development, naming the
+   surface and the outcome ("devup-mcp의 UI 구현·검증 흐름에 … 를 기본 품질
+   항목으로 추가해 주세요.").
+2. **Required behaviour**: a numbered list of concrete, checkable behaviours.
+   Each one traces to an item of the confirmed list; quote the user prompt and
+   cite the evidence (file, node id, tool output) once, under the list.
+3. **Acceptance checks and regression tests**: what must pass, including at
+   least one regression test that fails on today's behaviour, and which tool
+   output proves it (`devup_ui_validate` finding id, audit check, snapshot).
+4. **Scope boundary**: what this prompt does not ask for, and which neighbouring
+   surface owns the rest.
+
+State the installed build once above the prompts (`version`, `commit`,
+`buildId`) so the maintainers know what the session ran against. Do not pad:
+a prompt with one item has a one-item list. Do not propose a fix the evidence
+does not support, and do not prescribe implementation details beyond what the
+required behaviour needs.
+
+### Saving feedback records (only when the user chose Yes)
+
+Read the folder first: its index file (`feedback.index`), and the two most
+recent records, and follow their format exactly, including language, field
+labels, file extension and file-name pattern. Number new records from
+`feedback.nextNumber`, one file per confirmed item, and add one line per record
+to the index in its existing style. Never renumber, rewrite or delete existing
+records, and never record an item the user dropped. Report the files written.
+If the folder's format cannot be determined, do not write; say why.
+
+## Final answer
+
+End with: the number of user follow-ups reviewed, items confirmed, prompts
+printed per surface, items needing no prompt and why, files written (or
+"nothing written"), and anything you could not review.
diff --git a/crates/devup-mcp/src/server/skills/installation.rs b/crates/devup-mcp/src/server/skills/installation.rs
index 846a51c8..2f7ce5c7 100644
--- a/crates/devup-mcp/src/server/skills/installation.rs
+++ b/crates/devup-mcp/src/server/skills/installation.rs
@@ -349,137 +349,6 @@ impl Skill {
     }
 }
 
-/// The explicit entry point: `/devup [figma url] [notes]`.
-///
-/// An MCP server cannot start a skill or a slash command itself, so the user
-/// gets one to type. Claude Code turns every project skill into a slash
-/// command of the same name, so the `devup` skill installed with the others
-/// already is `/devup` there. OpenCode keeps slash commands in their own
-/// directory, so it gets a command file as well. Every other runtime is
-/// reported unsupported rather than given a path nobody verified.
-pub const COMMAND_NAME: &str = "devup";
-pub const COMMAND_INVOCATION: &str = "/devup [figma url] [notes]";
-/// Marks a command file devup-mcp wrote, so a later install may rewrite it
-/// and leaves anyone else's alone.
-const COMMAND_MARKER: &str = "<!-- devup-mcp:command devup";
-const OPENCODE_COMMAND: &str = include_str!("../commands/opencode-devup.md");
-const OPENCODE_COMMAND_ROOT: &str = ".opencode/command";
-const OPENCODE_USER_COMMAND_ROOT: &str = ".config/opencode/command";
-
-/// Whether an install writes the OpenCode command: when OpenCode is the
-/// client, or when the skills go to its skill root. `roots` are the install's
-/// roots as chosen before anything was staged - staging creates directories,
-/// and asking again afterwards sees only the first of them.
-fn writes_opencode_command(lookup: &Lookup, roots: &[PathBuf]) -> bool {
-    lookup.runtime == Runtime::Opencode
-        || roots
-            .iter()
-            .any(|root| root.ends_with(Path::new(".opencode").join("skill")))
-}
-
-fn opencode_command_paths(lookup: &Lookup) -> Vec<PathBuf> {
-    let file = format!("{COMMAND_NAME}.md");
-    let mut paths = vec![join_root(&lookup.project, OPENCODE_COMMAND_ROOT).join(&file)];
-    if let Some(home) = &lookup.home {
-        paths.push(join_root(home, OPENCODE_USER_COMMAND_ROOT).join(&file));
-    }
-    paths
-}
-
-/// Whether `/devup` is installed for the detected runtime, and where.
-pub fn command_state(lookup: &Lookup) -> serde_json::Value {
-    let claude = || {
-        let paths = Lookup {
-            runtime: Runtime::ClaudeCode,
-            ..lookup.clone()
-        }
-        .installed_paths(COMMAND_NAME);
-        serde_json::json!({
-            "runtime": "claude-code",
-            "via": "skill",
-            "installed": !paths.is_empty(),
-            "paths": paths.iter().map(|path| path.display().to_string()).collect::<Vec<_>>(),
-            "how": "Claude Code offers every project skill as a slash command of the same name; the devup skill is /devup.",
-        })
-    };
-    let opencode = || {
-        let found = opencode_command_paths(lookup)
-            .into_iter()
-            .filter(|path| path.is_file())
-            .collect::<Vec<_>>();
-        serde_json::json!({
-            "runtime": "opencode",
-            "via": "command",
-            "installed": !found.is_empty(),
-            "paths": found.iter().map(|path| path.display().to_string()).collect::<Vec<_>>(),
-            "writesTo": join_root(&lookup.project, OPENCODE_COMMAND_ROOT).join(format!("{COMMAND_NAME}.md")).display().to_string(),
-            "how": "OpenCode reads slash commands from .opencode/command/*.md.",
-        })
-    };
-    let per_runtime = match lookup.runtime {
-        Runtime::ClaudeCode => vec![claude()],
-        Runtime::Opencode => vec![opencode()],
-        Runtime::Unknown => vec![claude(), opencode()],
-        _ => Vec::new(),
-    };
-    let supported = !per_runtime.is_empty();
-    let installed = per_runtime.iter().any(|entry| entry["installed"] == true);
-    serde_json::json!({
-        "name": COMMAND_NAME,
-        "invocation": COMMAND_INVOCATION,
-        "runtime": lookup.runtime.as_str(),
-        "supported": supported,
-        "installed": installed,
-        "perRuntime": per_runtime,
-        "how": if !supported {
-            format!(
-                include_str!("../text/skills-command_state-84cd29d8.md"),
-                lookup.runtime.as_str()
-            )
-        } else if installed {
-            "Type /devup with a Figma link and notes to start the whole workflow.".to_owned()
-        } else {
-            "Call devup_skills with action \"install\"; it writes /devup with the skills.".to_owned()
-        },
-    })
-}
-
-/// Stages the OpenCode command file when this install writes one. A file
-/// devup-mcp did not write is left alone and reported.
-fn stage_commands(
-    policy: &super::output::OutputPolicy,
-    transaction: &mut super::output::OutputTransaction,
-    lookup: &Lookup,
-    roots: &[PathBuf],
-) -> Result<Vec<serde_json::Value>, devup_mcp_figma::DevupError> {
-    if !writes_opencode_command(lookup, roots) {
-        return Ok(Vec::new());
-    }
-    let path = join_root(&lookup.project, OPENCODE_COMMAND_ROOT).join(format!("{COMMAND_NAME}.md"));
-    let existing = std::fs::read_to_string(&path).ok();
-    let state = match existing.as_deref() {
-        Some(text) if text == OPENCODE_COMMAND => "alreadyPresent",
-        Some(text) if !text.contains(COMMAND_MARKER) => "leftAlone",
-        Some(_) => "refreshed",
-        None => "installed",
-    };
-    if matches!(state, "installed" | "refreshed") {
-        let target = policy.resolve(&path.display().to_string())?;
-        transaction.stage(
-            "command:opencode:devup",
-            target,
-            OPENCODE_COMMAND.as_bytes(),
-        )?;
-    }
-    Ok(vec![serde_json::json!({
-        "name": COMMAND_NAME,
-        "runtime": "opencode",
-        "path": path.display().to_string(),
-        "state": state,
-        "invocation": COMMAND_INVOCATION,
-    })])
-}
-
 /// What every caller of `devup_skills` gets back: the gap, per skill.
 ///
 /// The shape is deliberately the same for `status` and after `install`, so the
diff --git a/crates/devup-mcp/src/server/skills/manifest.json b/crates/devup-mcp/src/server/skills/manifest.json
index 0cec382d..a6e6abc1 100644
--- a/crates/devup-mcp/src/server/skills/manifest.json
+++ b/crates/devup-mcp/src/server/skills/manifest.json
@@ -124,6 +124,24 @@
       "sourceUrl": "https://github.com/dev-five-git/devup-mcp/blob/HEAD/crates/devup-mcp/src/server/skills/devup",
       "latestUrl": "https://github.com/dev-five-git/devup-mcp/blob/HEAD/crates/devup-mcp/src/server/skills/devup"
     },
+    {
+      "name": "devup-retro",
+      "origin": "own",
+      "title": "/devup-retro: turn a session's follow-up prompts into devup-mcp improvement prompts",
+      "description": "Session retrospective: lists every follow-up prompt the user had to write after devup-mcp's work, classifies each by the surface that should have prevented it, asks the user to confirm, then prints ready-to-paste improvement prompts.",
+      "usedFor": "A correction the user types after an export or a validation is the best evidence of a devup-mcp gap, and it is lost when the session ends. This is the one word to type when the work is finished: review, confirm, prompts - nothing is written before the user confirms, and nothing is listed that the user did not actually ask for.",
+      "repo": "dev-five-git/devup-mcp",
+      "path": "crates/devup-mcp/src/server/skills/devup-retro",
+      "documents": [
+        {
+          "path": "SKILL.md",
+          "bytes": 10021,
+          "sha256": "a307ae31c9272fa921c193cfb522a2f3ac99d73eeb9c2fed174c9614a0b692d3"
+        }
+      ],
+      "sourceUrl": "https://github.com/dev-five-git/devup-mcp/blob/HEAD/crates/devup-mcp/src/server/skills/devup-retro",
+      "latestUrl": "https://github.com/dev-five-git/devup-mcp/blob/HEAD/crates/devup-mcp/src/server/skills/devup-retro"
+    },
     {
       "name": "changepacks",
       "origin": "embedded",
diff --git a/crates/devup-mcp/src/server/skills/retro.rs b/crates/devup-mcp/src/server/skills/retro.rs
new file mode 100644
index 00000000..e8ee8366
--- /dev/null
+++ b/crates/devup-mcp/src/server/skills/retro.rs
@@ -0,0 +1,369 @@
+/// What the retrospective command needs from the server.
+///
+/// The command itself is a skill: reading a conversation and judging which of
+/// the user's messages were corrections is the agent's work, and nothing here
+/// tries to do it. What the agent cannot produce on its own is what this
+/// process knows - which build it is, which devup-mcp calls it served and
+/// when, and what the project's `.feedback/` folder already records - so
+/// `devup_skills` action `retro` reports exactly that and writes nothing.
+const CALL_LOG_CAPACITY: usize = 200;
+const RELEASES_URL: &str = "https://github.com/dev-five-git/devup-mcp/releases";
+const FEEDBACK_DIR: &str = ".feedback";
+const FEEDBACK_LISTED: usize = 200;
+
+/// The surfaces a follow-up prompt is classified under. The skill document
+/// carries the same list as a table; a test holds the two together.
+pub const RETRO_SURFACES: &[(&str, &str)] = &[
+    ("codegen", "The TSX/CSS the converter generates from Figma nodes."),
+    ("export-output", "What devup_figma_export returns: outputs, assets, manifests, deliverable flags, sidecars."),
+    ("validation-rule", "A devup_ui_validate rule that is missing, too weak or wrong."),
+    ("runtime-audit", "devup_runtime_audit, audit plans, devup_visual_compare checks and their evidence."),
+    ("skill-guidance", "The installed skills: devup, devup-implementation-plan, devfive-frontend and references."),
+    ("bootstrap-instructions", "The server instructions and devup://guide/usage."),
+    ("project-plan-intake", "devup_project_plan / devup_screen_plan questions, rounds, ERD, split."),
+    ("out-of-scope:devup-ui", "Devup UI runtime or compiler, not devup-mcp."),
+    ("out-of-scope:app", "The application's own code, tests, CI or environment."),
+    ("out-of-scope:figma-data", "The design file itself."),
+];
+
+/// The order the command runs in. Nothing is written, and no improvement
+/// prompt is printed, before `confirm`.
+pub const RETRO_PHASES: [&str; 3] = ["review", "confirm", "prompts"];
+
+#[derive(Debug, Clone)]
+struct CallEntry {
+    seq: u64,
+    tool: String,
+    action: Option<String>,
+    outputs: Vec<String>,
+    target: Option<String>,
+    at_ms: u64,
+    duration_ms: u64,
+    ok: bool,
+}
+
+#[derive(Debug, Default)]
+struct CallLogState {
+    served: u64,
+    entries: std::collections::VecDeque<CallEntry>,
+}
+
+/// The devup-mcp calls this server process served, newest last, bounded.
+///
+/// It exists so a retrospective can line a user's correction up with the
+/// export or validation it followed. It holds names and times, never
+/// arguments' contents or results, and it dies with the process: a reconnect
+/// starts an empty log, and the report says so instead of implying a session
+/// with no calls.
+#[derive(Debug, Clone, Default)]
+pub struct CallLog(std::sync::Arc<std::sync::Mutex<CallLogState>>);
+
+/// Records its call when dropped, so every return path of `call_tool` is
+/// covered. A path that never reached [`CallRecord::finish`] is a failure.
+pub struct CallRecord {
+    log: CallLog,
+    entry: CallEntry,
+    started: std::time::Instant,
+}
+
+impl CallLog {
+    pub fn begin(
+        &self,
+        tool: &str,
+        arguments: Option<&serde_json::Map<String, serde_json::Value>>,
+    ) -> CallRecord {
+        let text = |key: &str| {
+            arguments
+                .and_then(|arguments| arguments.get(key))
+                .and_then(serde_json::Value::as_str)
+                .map(str::to_owned)
+        };
+        let target = ["frameIds", "nodeIds", "nodeId", "url", "baseUrl", "planId"]
+            .iter()
+            .find_map(|key| {
+                let value = arguments?.get(*key).filter(|value| !value.is_null())?;
+                let rendered = value.as_str().map_or_else(|| value.to_string(), str::to_owned);
+                Some(format!("{key}={}", rendered.chars().take(120).collect::<String>()))
+            });
+        CallRecord {
+            log: self.clone(),
+            entry: CallEntry {
+                seq: 0,
+                tool: tool.to_owned(),
+                action: text("action"),
+                outputs: arguments
+                    .and_then(|arguments| arguments.get("outputs"))
+                    .and_then(serde_json::Value::as_array)
+                    .map(|outputs| {
+                        outputs
+                            .iter()
+                            .filter_map(|output| output.as_str().map(str::to_owned))
+                            .collect()
+                    })
+                    .unwrap_or_default(),
+                target,
+                at_ms: now_ms(),
+                duration_ms: 0,
+                ok: false,
+            },
+            started: std::time::Instant::now(),
+        }
+    }
+
+    pub fn report(&self) -> serde_json::Value {
+        let state = self.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let calls = state
+            .entries
+            .iter()
+            .map(|entry| {
+                let mut call = serde_json::json!({
+                    "seq": entry.seq,
+                    "tool": entry.tool,
+                    "at": rfc3339(entry.at_ms),
+                    "durationMs": entry.duration_ms,
+                    "ok": entry.ok,
+                });
+                if let Some(action) = &entry.action {
+                    call["action"] = serde_json::json!(action);
+                }
+                if !entry.outputs.is_empty() {
+                    call["outputs"] = serde_json::json!(entry.outputs);
+                }
+                if let Some(target) = &entry.target {
+                    call["target"] = serde_json::json!(target);
+                }
+                call
+            })
+            .collect::<Vec<_>>();
+        serde_json::json!({
+            "scope": "this-server-process",
+            "served": state.served,
+            "listed": calls.len(),
+            "droppedOldest": state.served - calls.len() as u64,
+            "calls": calls,
+            "note": "Calls this devup-mcp process served, oldest first, UTC. A reconnect, a \
+                     restart or a resumed session starts an empty log, so a short log is not \
+                     evidence that nothing was called: the conversation is the record, and this \
+                     only helps order it. Arguments' contents and results are not kept.",
+        })
+    }
+}
+
+impl CallRecord {
+    pub fn finish(&mut self, ok: bool) {
+        self.entry.ok = ok;
+    }
+}
+
+impl Drop for CallRecord {
+    fn drop(&mut self) {
+        let mut entry = self.entry.clone();
+        entry.duration_ms = u64::try_from(self.started.elapsed().as_millis()).unwrap_or(u64::MAX);
+        let mut state = self.log.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        state.served += 1;
+        entry.seq = state.served;
+        if state.entries.len() == CALL_LOG_CAPACITY {
+            state.entries.pop_front();
+        }
+        state.entries.push_back(entry);
+    }
+}
+
+fn now_ms() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_or(0, |elapsed| u64::try_from(elapsed.as_millis()).unwrap_or(u64::MAX))
+}
+
+/// Unix milliseconds as `YYYY-MM-DDTHH:MM:SSZ`, by the civil-from-days
+/// algorithm, so a timestamp does not cost a date crate.
+fn rfc3339(ms: u64) -> String {
+    let seconds = ms / 1000;
+    let (days, rest) = (seconds / 86_400, seconds % 86_400);
+    let shifted = days + 719_468;
+    let era = shifted / 146_097;
+    let day_of_era = shifted % 146_097;
+    let year_of_era =
+        (day_of_era - day_of_era / 1_460 + day_of_era / 36_524 - day_of_era / 146_096) / 365;
+    let day_of_year = day_of_era - (365 * year_of_era + year_of_era / 4 - year_of_era / 100);
+    let month_index = (5 * day_of_year + 2) / 153;
+    let day = day_of_year - (153 * month_index + 2) / 5 + 1;
+    let month = if month_index < 10 { month_index + 3 } else { month_index - 9 };
+    let year = year_of_era + era * 400 + u64::from(month <= 2);
+    format!(
+        "{year:04}-{month:02}-{day:02}T{:02}:{:02}:{:02}Z",
+        rest / 3600,
+        rest % 3600 / 60,
+        rest % 60
+    )
+}
+
+/// What the project's `.feedback/` folder already holds, so new records
+/// continue its numbering and nothing already recorded is filed twice.
+///
+/// Read-only. A record is a file named `<number>-<slug>.<ext>`; number zero
+/// is the index. The format inside is the project's own, so this reports the
+/// files to read rather than a schema to follow.
+fn feedback_state(project: &Path) -> serde_json::Value {
+    let dir = project.join(FEEDBACK_DIR);
+    let Ok(listing) = std::fs::read_dir(&dir) else {
+        return serde_json::json!({
+            "exists": false,
+            "path": dir.display().to_string(),
+            "how": "No .feedback folder in this project: do not offer to save records and do \
+                    not create the folder.",
+        });
+    };
+    let mut records = listing
+        .filter_map(|entry| {
+            let name = entry.ok()?.file_name().into_string().ok()?;
+            let (number, _) = name.split_once('-')?;
+            let digits = number.len();
+            Some((number.parse::<u32>().ok()?, digits, name))
+        })
+        .collect::<Vec<_>>();
+    records.sort();
+    let index = records
+        .iter()
+        .find(|(number, ..)| *number == 0)
+        .map(|(.., name)| name.clone());
+    records.retain(|(number, ..)| *number > 0);
+    let last = records.last();
+    let next = last.map_or(1, |(number, ..)| number + 1);
+    let digits = last.map_or(3, |(_, digits, _)| *digits);
+    let skipped = records.len().saturating_sub(FEEDBACK_LISTED);
+    let listed = records
+        .iter()
+        .skip(skipped)
+        .map(|(number, _, name)| {
+            let text = std::fs::read_to_string(dir.join(name)).unwrap_or_default();
+            let lines = || text.lines().take(12).map(str::trim).filter(|line| !line.is_empty());
+            let clip = |line: &str| line.chars().take(200).collect::<String>();
+            serde_json::json!({
+                "number": number,
+                "file": name,
+                "title": lines().next().map(clip),
+                "status": lines()
+                    .find(|line| ["상태:", "Status:", "status:"].iter().any(|label| line.starts_with(label)))
+                    .map(clip),
+            })
+        })
+        .collect::<Vec<_>>();
+    serde_json::json!({
+        "exists": true,
+        "path": dir.display().to_string(),
+        "index": index,
+        "recordCount": records.len(),
+        "nextNumber": next,
+        "nextFilePrefix": format!("{next:0digits$}-"),
+        "extension": last.and_then(|(.., name)| name.rsplit_once('.')).map(|(_, extension)| extension),
+        "readFirst": index.iter().cloned().chain(records.iter().rev().take(2).map(|(.., name)| name.clone())).collect::<Vec<_>>(),
+        "records": listed,
+        "recordsOmitted": skipped,
+        "how": "Read the index and the two most recent records before writing, and follow their \
+                format, language and file naming exactly. Write only after the user confirmed \
+                the review list and chose to save. Never renumber or rewrite existing records.",
+    })
+}
+
+/// The `devup_skills` action `retro` result. `server` is added by the tool
+/// result wrapper, like on every other response.
+pub fn retro_report(lookup: &Lookup, calls: &CallLog) -> serde_json::Value {
+    let command = Command::find(RETRO_NAME).expect("the retro command is registered");
+    serde_json::json!({
+        "command": command.state(lookup),
+        "skill": {
+            "name": RETRO_NAME,
+            "installed": !lookup.installed_paths(RETRO_NAME).is_empty(),
+            "offlineRead": uri_for(RETRO_NAME),
+            "prompt": RETRO_NAME,
+        },
+        "phases": RETRO_PHASES,
+        "surfaces": RETRO_SURFACES
+            .iter()
+            .map(|(id, covers)| serde_json::json!({"id": id, "covers": covers}))
+            .collect::<Vec<_>>(),
+        "callLog": calls.report(),
+        "feedback": feedback_state(&lookup.project),
+        "releases": {
+            "url": RELEASES_URL,
+            "installedTag": format!("devup-mcp(crates/devup-mcp/Cargo.toml)@{}", env!("CARGO_PKG_VERSION")),
+            "how": "An item is fixed-in-installed only when release notes at or before the \
+                    installed version (server.version, server.commit) name the fix, and \
+                    fixed-not-installed only when a later release does (server.updateAvailable). \
+                    When the notes cannot be read the status is unverified, never a guess.",
+        },
+        "next": format!(
+            "Follow the {RETRO_NAME} skill: review the conversation from the first devup-mcp \
+             call, list only follow-ups the user actually wrote, ask the user to confirm the \
+             list, and only then print the improvement prompts. Nothing is written before \
+             confirmation."
+        ),
+        "boundary": "This action reads and reports; it never writes. It does not read the \
+                     conversation and cannot tell which user messages were corrections.",
+    })
+}
+
+/// The MCP prompt of the same name: the skill without an install. A client
+/// that lists prompts offers it as a command (Claude Code shows
+/// `/mcp__<server>__<name>`), which is the only way to reach the command in a
+/// workspace where `devup_skills install` was never run.
+pub const RETRO_PROMPT_ARGUMENTS: [(&str, &str); 2] = [
+    ("scope", "Which part of the session to review, for example \"only the landing page\" or \"since the second export\". Default: everything from the first devup-mcp call."),
+    ("language", "Language for the review list and the improvement prompts. Default: the language the user wrote in."),
+];
+
+pub fn retro_prompt() -> rmcp::model::Prompt {
+    let title = find_by_name(RETRO_NAME).map_or(RETRO_NAME, |skill| &skill.record.title);
+    rmcp::model::Prompt::new(
+        RETRO_NAME,
+        Some(title),
+        Some(
+            RETRO_PROMPT_ARGUMENTS
+                .iter()
+                .map(|(name, description)| {
+                    rmcp::model::PromptArgument::new(*name)
+                        .with_description(*description)
+                        .with_required(false)
+                })
+                .collect(),
+        ),
+    )
+}
+
+/// The prompt's one user message: the arguments that were given, then the
+/// skill body. `None` for a name that is not this prompt's.
+pub fn retro_prompt_text(
+    name: &str,
+    arguments: Option<&serde_json::Map<String, serde_json::Value>>,
+) -> Option<String> {
+    if name != RETRO_NAME {
+        return None;
+    }
+    let mut text = format!("Run the {RETRO_NAME} command.\n");
+    for (key, _) in RETRO_PROMPT_ARGUMENTS {
+        if let Some(value) = arguments
+            .and_then(|arguments| arguments.get(key))
+            .and_then(serde_json::Value::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+        {
+            text.push_str(&format!("{key}: {value}\n"));
+        }
+    }
+    text.push('\n');
+    text.push_str(skill_body(RETRO_NAME).trim_start());
+    Some(text)
+}
+
+pub fn retro_prompt_result(
+    name: &str,
+    arguments: Option<&serde_json::Map<String, serde_json::Value>>,
+) -> Option<rmcp::model::GetPromptResponse> {
+    let message = rmcp::model::PromptMessage::new_text(
+        rmcp::model::Role::User,
+        retro_prompt_text(name, arguments)?,
+    );
+    let title = find_by_name(RETRO_NAME).map_or(RETRO_NAME, |skill| &skill.record.title);
+    Some(rmcp::model::GetPromptResult::new(vec![message]).with_description(title).into())
+}
diff --git a/crates/devup-mcp/src/server/skills/retro_tests.rs b/crates/devup-mcp/src/server/skills/retro_tests.rs
new file mode 100644
index 00000000..ec37d366
--- /dev/null
+++ b/crates/devup-mcp/src/server/skills/retro_tests.rs
@@ -0,0 +1,246 @@
+#[cfg(test)]
+mod retro_tests {
+    use super::*;
+
+    fn scratch(label: &str) -> PathBuf {
+        let path = std::env::temp_dir().join(format!("devup-retro-{label}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&path);
+        std::fs::create_dir_all(&path).expect("scratch directory");
+        path
+    }
+
+    fn skill_text() -> &'static str {
+        EMBEDDED
+            .iter()
+            .find(|(name, _)| *name == RETRO_NAME)
+            .expect("the retro skill is embedded")
+            .1[0]
+            .1
+    }
+
+    /// A rename is one literal plus a directory move; every other spelling
+    /// has to follow it or this fails.
+    #[test]
+    fn the_retro_name_is_spelled_in_one_place() {
+        let record = &find_by_name(RETRO_NAME).expect("manifest entry").record;
+        assert_eq!(record.origin, Origin::Own);
+        assert!(record.path.ends_with(&format!("skills/{RETRO_NAME}")), "{}", record.path);
+        assert!(record.source_url.ends_with(&format!("skills/{RETRO_NAME}")));
+        assert!(record.title.starts_with(&format!("/{RETRO_NAME}:")), "{}", record.title);
+        let text = skill_text();
+        let frontmatter = &text[..frontmatter_end(text).expect("frontmatter")];
+        assert!(frontmatter.contains(&format!("name: {RETRO_NAME}\n")), "{frontmatter}");
+        assert!(frontmatter.contains(&format!("Invoke as /{RETRO_NAME} ")), "{frontmatter}");
+        let command = Command::find(RETRO_NAME).expect("command");
+        assert!(command.invocation.starts_with(&format!("/{RETRO_NAME} ")));
+        assert_eq!(retro_prompt().name, RETRO_NAME);
+    }
+
+    /// The contract of the command, as the document an agent actually reads
+    /// states it: review, then confirm, then prompts, and the rules that keep
+    /// the list honest.
+    #[test]
+    fn the_skill_states_review_then_confirm_then_prompts() {
+        let text = skill_text();
+        let positions = ["## Phase 1: review", "## Phase 2: confirm", "## Phase 3: prompts"]
+            .map(|heading| text.find(heading).unwrap_or_else(|| panic!("missing {heading}")));
+        assert!(positions[0] < positions[1] && positions[1] < positions[2]);
+        for required in [
+            "Nothing is written to disk and no improvement prompt is printed before the user\nconfirms the review list.",
+            "`action: \"retro\"`",
+            "No invented problems. An item with no user-prompt evidence is excluded",
+            "Not every problem is a devup-mcp bug.",
+            "Do not strengthen the user's words.",
+            "`quote`: the user's words, verbatim",
+            "`OK` (Recommended) / `Edit items` / `Drop items` / `Cancel`",
+            "Claude Code `AskUserQuestion`, OpenCode `question`",
+            "never assume `OK`",
+            "Only after `OK`.",
+            "Korean when the session is\nKorean",
+            "one ready-to-paste prompt per surface",
+            "**Goal**",
+            "**Required behaviour**",
+            "**Acceptance checks and regression tests**",
+            "**Scope boundary**",
+            "`fixed-in-installed`",
+            "`fixed-not-installed`",
+            "`already-recorded`",
+            "never guess \"fixed\"",
+            "Without the folder, do not offer to create one.",
+            "`feedback.nextNumber`",
+            "Never renumber, rewrite or delete existing\nrecords",
+        ] {
+            assert!(text.contains(required), "the retro skill lost: {required}");
+        }
+        assert!(text.contains(&format!("**{}**", RETRO_PHASES.join(", "))));
+    }
+
+    /// The table in the skill and the list the tool returns are the same
+    /// surfaces, so a classification made from one is valid in the other.
+    #[test]
+    fn the_skill_and_the_tool_name_the_same_surfaces() {
+        let text = skill_text();
+        let in_table = text
+            .lines()
+            .filter_map(|line| line.strip_prefix("| `")?.split_once('`').map(|(id, _)| id))
+            .collect::<Vec<_>>();
+        let in_tool = RETRO_SURFACES.iter().map(|(id, _)| *id).collect::<Vec<_>>();
+        assert_eq!(in_table, in_tool);
+        for expected in ["codegen", "export-output", "validation-rule", "runtime-audit", "skill-guidance", "bootstrap-instructions", "project-plan-intake"] {
+            assert!(in_tool.contains(&expected), "{expected}");
+        }
+        assert_eq!(in_tool.iter().filter(|id| id.starts_with("out-of-scope:")).count(), 3);
+    }
+
+    #[test]
+    fn the_prompt_lists_optional_scope_and_language_and_carries_the_skill() {
+        let prompt = retro_prompt();
+        let arguments = prompt.arguments.as_deref().expect("arguments");
+        assert_eq!(
+            arguments.iter().map(|argument| argument.name.as_str()).collect::<Vec<_>>(),
+            ["scope", "language"]
+        );
+        for argument in arguments {
+            assert_eq!(argument.required, Some(false), "{}", argument.name);
+            assert!(argument.description.as_deref().is_some_and(|text| !text.is_empty()));
+        }
+        assert!(prompt.description.as_deref().unwrap().starts_with(&format!("/{RETRO_NAME}:")));
+
+        let arguments = serde_json::json!({"scope": "only the landing page", "language": " "});
+        let text = retro_prompt_text(RETRO_NAME, arguments.as_object()).unwrap();
+        assert!(text.starts_with(&format!("Run the {RETRO_NAME} command.\nscope: only the landing page\n\n# Session retrospective")), "{}", &text[..200]);
+        assert!(!text.contains("
+language:"), "a blank argument is not passed on");
+        assert!(!text.contains("\n---\n"), "the frontmatter is the loader's, not the prompt's");
+        assert!(text.contains("## Phase 2: confirm"));
+        assert!(retro_prompt_text("devup", None).is_none());
+        assert!(retro_prompt_result(RETRO_NAME, None).is_some());
+    }
+
+    #[test]
+    fn the_call_log_orders_calls_and_keeps_names_not_contents() {
+        let log = CallLog::default();
+        let export = serde_json::json!({"action": "x", "outputs": ["tsx", 3], "frameIds": ["1:2", "3:4"], "projectRoot": "C:/secret/project"});
+        log.begin("devup_figma_export", export.as_object()).finish(true);
+        drop(log.begin("devup_ui_validate", None));
+        let report = log.report();
+        assert_eq!(report["served"], 2);
+        assert_eq!(report["scope"], "this-server-process");
+        let calls = report["calls"].as_array().unwrap();
+        assert_eq!(calls[0]["seq"], 1);
+        assert_eq!(calls[0]["tool"], "devup_figma_export");
+        assert_eq!(calls[0]["ok"], true);
+        assert_eq!(calls[0]["outputs"], serde_json::json!(["tsx"]));
+        assert_eq!(calls[0]["target"], "frameIds=[\"1:2\",\"3:4\"]");
+        assert_eq!(calls[1]["ok"], false, "a call that never finished is a failure");
+        assert!(calls[1].get("action").is_none());
+        assert!(!report.to_string().contains("secret"), "{report}");
+        let at = calls[0]["at"].as_str().unwrap();
+        assert!(at.len() == 20 && at.ends_with('Z') && at.as_bytes()[10] == b'T', "{at}");
+
+        for _ in 0..CALL_LOG_CAPACITY + 5 {
+            log.begin("devup_figma_measure", None).finish(true);
+        }
+        let report = log.report();
+        assert_eq!(report["listed"], CALL_LOG_CAPACITY);
+        assert_eq!(report["droppedOldest"], 7);
+        assert_eq!(report["calls"][0]["seq"], 8);
+    }
+
+    #[test]
+    fn timestamps_are_utc_calendar_dates() {
+        assert_eq!(rfc3339(0), "1970-01-01T00:00:00Z");
+        assert_eq!(rfc3339(951_782_400_000), "2000-02-29T00:00:00Z");
+        assert_eq!(rfc3339(1_794_268_799_000), "2026-11-09T23:59:59Z");
+        assert_eq!(rfc3339(1_798_761_600_000), "2027-01-01T00:00:00Z");
+    }
+
+    #[test]
+    fn the_feedback_folder_is_read_for_numbering_and_never_created() {
+        let project = scratch("feedback");
+        let lookup = Lookup::project_only(project.clone(), Runtime::ClaudeCode);
+        let log = CallLog::default();
+        let report = retro_report(&lookup, &log);
+        assert_eq!(report["feedback"]["exists"], false);
+        assert!(!project.join(".feedback").exists(), "retro writes nothing");
+        assert_eq!(report["phases"], serde_json::json!(["review", "confirm", "prompts"]));
+        assert_eq!(report["surfaces"].as_array().unwrap().len(), RETRO_SURFACES.len());
+        assert_eq!(report["command"]["name"], RETRO_NAME);
+        assert_eq!(report["command"]["installed"], false);
+        assert_eq!(report["skill"]["offlineRead"], format!("devup://skill/{RETRO_NAME}"));
+        assert!(report["releases"]["installedTag"].as_str().unwrap().ends_with(env!("CARGO_PKG_VERSION")));
+
+        let dir = project.join(".feedback");
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("000-index.txt"), "Devup MCP 개선 피드백 목록\n").unwrap();
+        std::fs::write(dir.join("001-first.txt"), "제목: 첫 항목\n분류: MCP\n상태: 수정됨\n").unwrap();
+        std::fs::write(dir.join("016-korean-wrapping.txt"), "\n제목: 한글 줄바꿈\n").unwrap();
+        std::fs::write(dir.join("notes.txt"), "not a record").unwrap();
+        let before = std::fs::read_dir(&dir).unwrap().count();
+        let feedback = retro_report(&lookup, &log)["feedback"].clone();
+        assert_eq!(std::fs::read_dir(&dir).unwrap().count(), before);
+        assert_eq!(feedback["exists"], true);
+        assert_eq!(feedback["index"], "000-index.txt");
+        assert_eq!(feedback["recordCount"], 2);
+        assert_eq!(feedback["nextNumber"], 17);
+        assert_eq!(feedback["nextFilePrefix"], "017-");
+        assert_eq!(feedback["extension"], "txt");
+        assert_eq!(
+            feedback["readFirst"],
+            serde_json::json!(["000-index.txt", "016-korean-wrapping.txt", "001-first.txt"])
+        );
+        assert_eq!(feedback["records"][0]["title"], "제목: 첫 항목");
+        assert_eq!(feedback["records"][0]["status"], "상태: 수정됨");
+        assert_eq!(feedback["records"][1]["title"], "제목: 한글 줄바꿈");
+        assert!(feedback["records"][1]["status"].is_null());
+        std::fs::remove_dir_all(project).unwrap();
+    }
+
+    /// /devup-retro per runtime, through the same install as /devup: Claude
+    /// Code gets it as a skill, OpenCode as a command file generated from that
+    /// skill, Codex is told there is no verified command location.
+    #[tokio::test]
+    async fn the_retro_command_is_installed_with_the_skills() {
+        let project = scratch("command");
+        let policy = super::super::output::OutputPolicy::from_roots(vec![project.clone()]).unwrap();
+        let command = Command::find(RETRO_NAME).unwrap();
+
+        let opencode = Lookup::project_only(project.clone(), Runtime::Opencode);
+        let report = install(&policy, &opencode, &[RETRO_NAME.to_owned()]).await.unwrap();
+        let written = report["commands"].as_array().unwrap();
+        assert_eq!(
+            written.iter().map(|entry| entry["name"].as_str().unwrap()).collect::<Vec<_>>(),
+            [COMMAND_NAME, RETRO_NAME]
+        );
+        assert_eq!(written[1]["state"], "installed", "{report}");
+        let file = project.join(".opencode").join("command").join(format!("{RETRO_NAME}.md"));
+        let text = std::fs::read_to_string(&file).unwrap();
+        assert!(text.starts_with("---\ndescription: /"), "{}", &text[..80]);
+        assert!(text.contains(&format!("<!-- devup-mcp:command {RETRO_NAME} - written by devup_skills install")));
+        assert!(text.contains("$ARGUMENTS") && text.contains("## Phase 3: prompts"));
+        assert_eq!(text.matches("\n---\n").count(), 1, "one frontmatter, the command's own");
+        assert_eq!(command.state(&opencode)["installed"], true);
+        let again = install(&policy, &opencode, &[RETRO_NAME.to_owned()]).await.unwrap();
+        assert_eq!(again["commands"][1]["state"], "alreadyPresent");
+        std::fs::write(&file, "mine").unwrap();
+        let kept = install(&policy, &opencode, &[RETRO_NAME.to_owned()]).await.unwrap();
+        assert_eq!(kept["commands"][1]["state"], "leftAlone");
+        assert_eq!(std::fs::read_to_string(&file).unwrap(), "mine");
+
+        let claude = Lookup::project_only(project.clone(), Runtime::ClaudeCode);
+        assert_eq!(command.state(&claude)["installed"], false);
+        install(&policy, &claude, &[RETRO_NAME.to_owned()]).await.unwrap();
+        let state = command.state(&claude);
+        assert_eq!(state["installed"], true, "{state}");
+        assert_eq!(state["perRuntime"][0]["via"], "skill");
+        assert!(project.join(".claude").join("skills").join(RETRO_NAME).join("SKILL.md").is_file());
+        assert!(state["how"].as_str().unwrap().contains(&format!("/{RETRO_NAME}")));
+
+        let codex = command.state(&Lookup::project_only(project.clone(), Runtime::Codex));
+        assert_eq!(codex["supported"], false);
+        assert!(codex["how"].as_str().unwrap().contains("no command location"));
+        assert!(codex["how"].as_str().unwrap().contains("codex"));
+        drop(policy);
+        std::fs::remove_dir_all(project).unwrap();
+    }
+}
diff --git a/crates/devup-mcp/src/server/text/devup-skills.md b/crates/devup-mcp/src/server/text/devup-skills.md
index 6dc310da..141ac5f0 100644
--- a/crates/devup-mcp/src/server/text/devup-skills.md
+++ b/crates/devup-mcp/src/server/text/devup-skills.md
@@ -1 +1 @@
-Report which agent skills the code devup-mcp emits depends on and whether this workspace has them, then install the ones devup-mcp carries (action: status | install). The TSX devup_figma_export returns is devup-ui code, and an agent that has never seen devup-ui does not know its components are compile-time placeholders, that $token means devup.json, or that a style prop takes a responsive array - it guesses, and this server cannot see the guesses. Call status before writing or editing that code. Anything reported missing is a gap you can close in one step. install fetches current documents for embedded skills, falling back to the binary on failure, and writes own skills from the binary into the workspace skill root (.claude/skills, .opencode/skill or .agents/skills - an existing one is preferred), reporting source and any fallback reason (DEVUP_MCP_SKILLS_OFFLINE=1 disables fetching). Load them afterwards the way your runtime loads a project skill; an installed skill keeps applying to later sessions, which reading a document once does not. External skills are reported, never written: devup-mcp hands over its publisher's install command and does not run it.
\ No newline at end of file
+Report which agent skills the code devup-mcp emits depends on and whether this workspace has them, then install the ones devup-mcp carries (action: status | install | retro). The TSX devup_figma_export returns is devup-ui code, and an agent that has never seen devup-ui does not know its components are compile-time placeholders, that $token means devup.json, or that a style prop takes a responsive array - it guesses, and this server cannot see the guesses. Call status before writing or editing that code. Anything reported missing is a gap you can close in one step. install fetches current documents for embedded skills, falling back to the binary on failure, and writes own skills from the binary into the workspace skill root (.claude/skills, .opencode/skill or .agents/skills - an existing one is preferred), reporting source and any fallback reason (DEVUP_MCP_SKILLS_OFFLINE=1 disables fetching). Load them afterwards the way your runtime loads a project skill; an installed skill keeps applying to later sessions, which reading a document once does not. External skills are reported, never written: devup-mcp hands over its publisher's install command and does not run it. retro writes nothing: after the work is finished it returns what the devup-retro command needs - this build, the devup-mcp calls this process served with timestamps, the surface list and the project's .feedback/ state - so the session's follow-up prompts can be reviewed, confirmed by the user and turned into improvement prompts.
\ No newline at end of file
diff --git a/crates/devup-mcp/src/server/text/guide-GUIDE-c682b0c5.md b/crates/devup-mcp/src/server/text/guide-GUIDE-c682b0c5.md
index b5a958d1..e45031e3 100644
--- a/crates/devup-mcp/src/server/text/guide-GUIDE-c682b0c5.md
+++ b/crates/devup-mcp/src/server/text/guide-GUIDE-c682b0c5.md
@@ -422,3 +422,16 @@ with evidence after `maxFixAttempts` as incomplete.
 
 Before reporting done, run the runtime audit for every confirmed URL at every required width (default 1440/1100/858/390), read the report, fix failures and rerun until every cell passes. Missing cells are not-run and block completion. At drawn widths require rendered completeness and page, section and asset visual comparisons. Check sequence-order and section-layout at every width.
 Ask known site, structure and URL decisions up front in one runtime question call, not per-section rounds. New user-owned decisions after confirm still use the question tool. Show evidence first; keep table approval separate from individual decisions in the same call. Use headers up to 30 characters and two to four options, recommended first and labelled "(Recommended)". Never ask for numbers in chat. Record the chosen answer, decision id, affected model/endpoint/file and rationale with existing defer/assume actions; do not invent an ask action. Update source models and re-confirm ERD changes before dependent work. Without a question tool, report the limitation and leave the decision unresolved. Workers escalate to the supervisor; continue independent work while answers are pending.
+
+## After the work: /devup-retro
+
+When a piece of devup-mcp work is finished, `/devup-retro` (the `devup-retro`
+skill, or the MCP prompt of the same name where the skill is not installed)
+turns the session's follow-up prompts into improvement prompts for devup-mcp.
+Three phases, never merged: review the conversation from the first devup-mcp
+call and list only corrections the user actually wrote, each with its quote,
+evidence and the surface that should have prevented it; ask the user to confirm
+the list; only then print one ready-to-paste prompt per surface. Start with
+`devup_skills` action `retro`: it returns this build, the calls this process
+served with timestamps, the surface list and the project's `.feedback/` state,
+and writes nothing. Nothing is written before the user confirms.
diff --git a/crates/devup-mcp/src/server/validation.rs b/crates/devup-mcp/src/server/validation.rs
index 53fdaa14..1e232061 100644
--- a/crates/devup-mcp/src/server/validation.rs
+++ b/crates/devup-mcp/src/server/validation.rs
@@ -21,8 +21,9 @@ pub(crate) const AUTH_ACTIONS: [&str; 5] = ["status", "login", "logout", "config
 
 /// `status` reads the workspace and writes nothing. `install` writes the
 /// vendored documents for the embedded skills; it can never install an
-/// external one, because those bytes are not devup-mcp's to ship.
-pub(crate) const SKILL_ACTIONS: [&str; 2] = ["status", "install"];
+/// external one, because those bytes are not devup-mcp's to ship. `retro`
+/// reads what a session retrospective needs and writes nothing.
+pub(crate) const SKILL_ACTIONS: [&str; 3] = ["status", "install", "retro"];
 
 pub(crate) const COLLECTION_SCOPES: [&str; 3] = ["node", "page", "file"];
 
diff --git a/crates/devup-mcp/tests/retro_command.rs b/crates/devup-mcp/tests/retro_command.rs
new file mode 100644
index 00000000..0b447ca4
--- /dev/null
+++ b/crates/devup-mcp/tests/retro_command.rs
@@ -0,0 +1,241 @@
+//! The retrospective command, through the real process.
+//!
+//! The unit tests hold the skill document and the report to each other. These
+//! hold what a client actually sees: a prompt in `prompts/list` it can offer as
+//! a command without any install, and a `devup_skills` action that reports the
+//! calls this process served and the feedback folder without writing anything.
+
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+use std::time::Duration;
+
+use rmcp::{
+    ServiceExt,
+    model::{CallToolRequestParams, ContentBlock, GetPromptRequestParams},
+};
+use serde_json::{Map, Value, json};
+
+/// The command's name, spelled once on this side of the process boundary.
+const NAME: &str = "devup-retro";
+
+fn scratch(label: &str) -> PathBuf {
+    let path = std::env::temp_dir().join(format!("devup-retro-it-{label}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&path);
+    std::fs::create_dir_all(&path).expect("scratch workspace");
+    // The server canonicalises its write root; on macOS the temp directory is
+    // a symlink, and a projectRoot spelled through it is outside that root.
+    dunce::canonicalize(&path).expect("canonical scratch workspace")
+}
+
+async fn session<F, T>(workspace: &Path, body: F) -> anyhow::Result<T>
+where
+    F: AsyncFnOnce(&rmcp::service::RunningService<rmcp::RoleClient, ()>) -> anyhow::Result<T>,
+{
+    // An empty home, so a skill installed on the machine running the tests is
+    // not counted as installed here.
+    let home = workspace.join("home");
+    std::fs::create_dir_all(&home)?;
+    let mut child = tokio::process::Command::new(env!("CARGO_BIN_EXE_devup-mcp"))
+        .current_dir(workspace)
+        .env("HOME", &home)
+        .env("USERPROFILE", &home)
+        .env("DEVUP_MCP_SKILLS_OFFLINE", "1")
+        .env("DEVUP_MCP_NO_UPDATE_CHECK", "1")
+        .env("DEVUP_FIGMA_BRIDGE_PORT", "off")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .kill_on_drop(true)
+        .spawn()?;
+    let transport = (child.stdout.take().unwrap(), child.stdin.take().unwrap());
+    let client = ().serve(transport).await?;
+    let out = body(&client).await;
+    client.cancel().await?;
+    let status = tokio::time::timeout(Duration::from_secs(10), child.wait()).await??;
+    assert!(status.success());
+    out
+}
+
+async fn call(
+    client: &rmcp::service::RunningService<rmcp::RoleClient, ()>,
+    arguments: Value,
+) -> anyhow::Result<Value> {
+    let arguments: Map<String, Value> = arguments.as_object().cloned().unwrap();
+    let result = client
+        .call_tool(CallToolRequestParams::new("devup_skills").with_arguments(arguments))
+        .await?;
+    Ok(result.structured_content.expect("a structured response"))
+}
+
+#[tokio::test]
+async fn the_prompt_is_listed_with_optional_arguments_and_returns_the_three_phases()
+-> anyhow::Result<()> {
+    let workspace = scratch("prompt");
+    session(&workspace, async |client| {
+        let capabilities = &client.peer_info().expect("server info").capabilities;
+        assert!(
+            capabilities.prompts.is_some(),
+            "prompts capability is advertised"
+        );
+
+        let prompts = client.list_all_prompts().await?;
+        assert_eq!(prompts.len(), 1, "{prompts:?}");
+        let prompt = &prompts[0];
+        assert_eq!(prompt.name, NAME);
+        let arguments = prompt.arguments.as_deref().expect("arguments");
+        assert_eq!(
+            arguments
+                .iter()
+                .map(|argument| argument.name.as_str())
+                .collect::<Vec<_>>(),
+            ["scope", "language"]
+        );
+        assert!(
+            arguments
+                .iter()
+                .all(|argument| argument.required == Some(false))
+        );
+
+        let given: Map<String, Value> =
+            json!({"scope": "since the second export", "language": "ko"})
+                .as_object()
+                .cloned()
+                .unwrap();
+        let result = client
+            .get_prompt(GetPromptRequestParams::new(NAME).with_arguments(given))
+            .await?;
+        assert_eq!(result.messages.len(), 1);
+        let ContentBlock::Text(text) = &result.messages[0].content else {
+            panic!("the prompt is one text message: {:?}", result.messages[0]);
+        };
+        let text = &text.text;
+        assert!(
+            text.contains("scope: since the second export\nlanguage: ko\n"),
+            "{}",
+            &text[..200]
+        );
+        let phases = [
+            "## Phase 1: review",
+            "## Phase 2: confirm",
+            "## Phase 3: prompts",
+        ]
+        .map(|heading| {
+            text.find(heading)
+                .unwrap_or_else(|| panic!("missing {heading}"))
+        });
+        assert!(phases[0] < phases[1] && phases[1] < phases[2]);
+
+        assert!(
+            client
+                .get_prompt(GetPromptRequestParams::new("nope"))
+                .await
+                .is_err(),
+            "an unknown prompt is an error, not an empty prompt"
+        );
+        Ok(())
+    })
+    .await?;
+    std::fs::remove_dir_all(workspace)?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn retro_reports_the_served_calls_and_the_feedback_folder_and_writes_nothing()
+-> anyhow::Result<()> {
+    let workspace = scratch("action");
+    let project = workspace.join("project");
+    let feedback = project.join(".feedback");
+    std::fs::create_dir_all(&feedback)?;
+    std::fs::write(feedback.join("000-index.txt"), "index\n")?;
+    std::fs::write(
+        feedback.join("033-axe-core.txt"),
+        "제목: axe-core\n상태: open\n",
+    )?;
+    let root = project.display().to_string();
+
+    session(&workspace, async |client| {
+        let status = call(client, json!({"action": "status", "projectRoot": root})).await?;
+        assert!(
+            status["skills"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .any(|entry| entry["name"] == NAME),
+            "the skill is discoverable through devup_skills status"
+        );
+        // A refused call is served too, and logged as not ok.
+        let refused = client
+            .call_tool(
+                CallToolRequestParams::new("devup_skills").with_arguments(
+                    json!({"action": "nope", "projectRoot": root})
+                        .as_object()
+                        .cloned()
+                        .unwrap(),
+                ),
+            )
+            .await?;
+        assert_eq!(refused.is_error, Some(true));
+
+        let retro = call(client, json!({"action": "retro", "projectRoot": root})).await?;
+        assert!(retro["server"]["version"].is_string(), "{retro}");
+        assert!(retro["server"]["buildId"].is_string());
+        assert_eq!(retro["phases"], json!(["review", "confirm", "prompts"]));
+        assert_eq!(retro["command"]["name"], NAME);
+        assert_eq!(retro["command"]["installed"], false);
+        assert_eq!(
+            retro["skill"]["offlineRead"],
+            format!("devup://skill/{NAME}")
+        );
+        assert!(
+            retro["surfaces"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .any(|s| s["id"] == "validation-rule")
+        );
+
+        let calls = retro["callLog"]["calls"].as_array().unwrap();
+        assert_eq!(
+            calls.len(),
+            2,
+            "the retro call itself is logged when it returns: {retro}"
+        );
+        assert_eq!(calls[0]["tool"], "devup_skills");
+        assert_eq!(calls[0]["action"], "status");
+        assert_eq!(calls[0]["ok"], true);
+        assert_eq!(calls[1]["action"], "nope");
+        assert_eq!(calls[1]["ok"], false);
+        assert!(calls[0]["at"].as_str().unwrap().ends_with('Z'));
+
+        assert_eq!(retro["feedback"]["exists"], true);
+        assert_eq!(retro["feedback"]["index"], "000-index.txt");
+        assert_eq!(retro["feedback"]["nextNumber"], 34);
+        assert_eq!(retro["feedback"]["nextFilePrefix"], "034-");
+        assert_eq!(retro["feedback"]["records"][0]["status"], "상태: open");
+
+        // One install makes it a command, next to /devup.
+        let installed = call(
+            client,
+            json!({"action": "install", "names": [NAME], "projectRoot": root}),
+        )
+        .await?;
+        assert_eq!(installed["installed"][0]["name"], NAME, "{installed}");
+        let after = call(client, json!({"action": "retro", "projectRoot": root})).await?;
+        assert_eq!(after["command"]["installed"], true, "{after}");
+        assert_eq!(after["skill"]["installed"], true);
+        Ok(())
+    })
+    .await?;
+
+    let mut names = std::fs::read_dir(&feedback)?
+        .map(|entry| entry.unwrap().file_name().into_string().unwrap())
+        .collect::<Vec<_>>();
+    names.sort();
+    assert_eq!(
+        names,
+        ["000-index.txt", "033-axe-core.txt"],
+        "retro never writes feedback"
+    );
+    std::fs::remove_dir_all(workspace)?;
+    Ok(())
+}
diff --git a/crates/devup-mcp/tests/skills_install.rs b/crates/devup-mcp/tests/skills_install.rs
index 65e99ad1..ed3fde5e 100644
--- a/crates/devup-mcp/tests/skills_install.rs
+++ b/crates/devup-mcp/tests/skills_install.rs
@@ -142,6 +142,7 @@ async fn a_bare_workspace_reports_the_gap_and_one_call_closes_it() -> anyhow::Re
             "devfive-frontend",
             "devup-implementation-plan",
             "devup",
+            "devup-retro",
             "figma-bridge-setup",
         ]
         .contains(&entry["name"].as_str().unwrap())