@lifeaitools/rdc-skills 0.36.1 → 0.37.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.36.1",
+  "version": "0.37.1",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/.github/workflows/publish.yml

@@ -53,8 +53,19 @@ jobs:
       - name: Ensure npm supports trusted publishing
         run: npm install -g npm@latest && npm --version
 
+      # Every tag from v0.33.0 to v0.37.0 failed here with a bare E404 on the PUT and no
+      # reason, and no published version carries provenance, so the OIDC exchange has not
+      # succeeded once since this workflow moved to it. npm logs that exchange only at
+      # verbose level. The next step pulls those lines out, so the reason is printed
+      # rather than inferred.
       - name: Publish
-        run: npm publish --access public
+        run: |
+          set -o pipefail
+          npm publish --access public --loglevel verbose 2>&1 | tee publish.log
+
+      - name: OIDC exchange result
+        if: always()
+        run: grep -iE 'oidc|provenance|trusted|npm error' publish.log || echo "no oidc lines logged"
 
       - name: Notify clauth channel
         if: always()

package/CHANGELOG.md

@@ -7,6 +7,66 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## v0.37.1 — one version in every manifest
+
+### Fixed
+- `clauth-plugin.json` declared 0.35.10 while the package shipped 0.37.0, and
+  `package.json` `claude.version` still said 0.10.0. Both are now 0.37.1, with
+  `.claude-plugin/plugin.json`, `package.json` and `package-lock.json`. Nothing had
+  failed on either: the only check, `rdc-skills-self-test`, compared `plugin.json`
+  alone.
+
+### Added
+- `scripts/lib/manifest-versions.mjs` is one list of every place the package
+  declares its version, built from a repository search for `"version"`. Three
+  things read it:
+  - `tests/manifest-version-parity.test.mjs` (in `test:acceptance`) fails on any
+    declaration that differs from `package.json`. It also scans the repository and
+    fails on any JSON file with a top-level `version` that the list does not name.
+  - `rdc-skills-self-test` now checks every packaged declaration, not only
+    `plugin.json`.
+  - The npm `version` lifecycle hook, `scripts/sync-manifest-versions.mjs --stage`,
+    means `npm version patch|minor|major` sets and stages every manifest in the
+    same step. `--check` changes nothing and exits 1 on drift.
+
+### Changed
+- `RELEASE.md` step 2 drops the hand edit of `plugin.json`: `npm version` now sets
+  every manifest, and `node scripts/sync-manifest-versions.mjs --check` confirms it.
+
+---
+
+## v0.37.0 — review gates run the deterministic validators, in 1–2 minutes
+
+### Changed
+- The code-review step in `rdc:build` (9b), `rdc:fixit` (5.5), `rdc:review`
+  (8b), `rdc:release` and `rdc:overnight` now runs one deterministic gate,
+  `guides/review-gate.md`:
+  - `rdc-solid-score --diff <base>`;
+  - the repo linter on changed files (`--write`, then check);
+  - `tsc`;
+  - the touched package's tests;
+  - the UI spec when a route changed.
+
+  On the PRT launch build it took 9.3 s over 33 changed code files, where each
+  open-ended `pr-review-toolkit:code-reviewer` pass had taken 4–10 minutes. The
+  reviewer agent remains, but only for a named question the validators cannot
+  answer.
+- `rdc-clean-code-score` is documented as advisory. It has no `--diff`, and in a
+  monorepo it needs `--project-root <package>`; its default dead-export scope ran
+  out of 4 GB of heap on regen-root.
+
+### Fixed
+- `rdc-solid-score --diff` exited 2 on any diff that added a file. Git's
+  "exists on disk, but not in <ref>" wording was not recognized as absent at the
+  ref; it now is. A bad ref or a path-form mismatch is still rethrown.
+- `rdc-solid-score --diff` exited 2 with ENOENT on any diff that deleted a file.
+  Deletions are now split out with `--diff-filter=D` and reported in a new
+  `removedFiles` output field.
+- The README File Structure omitted `convo` (shipped in 0.36.0), which failed
+  `npm run test:acceptance`.
+
+---
+
 ## v0.35.11 — Design Review is explicit opt-in
 
 ### Changed

package/README.md

@@ -321,6 +321,7 @@ skills/
   co-develop/SKILL.md  (peer-aware Claude/Codex co-development)
   collab/SKILL.md      (bidirectional claude.ai ↔ Claude Code relay)
   convert/SKILL.md     (Office/Markdown conversion)
+  convo/SKILL.md       (attributed discussion that converges to a decision)
   deploy/SKILL.md      (Coolify ops: deploy, new, diagnose, audit)
   design/SKILL.md      (RDC/Studio design, Palette Library, Rampa CLI)
   edit/SKILL.md        (local website editor launcher)

package/RELEASE.md

@@ -27,16 +27,19 @@ git checkout master
 git pull --ff-only origin master
 git merge <feature-branch> --no-edit
 
-# 2. Bump the version — package.json AND the plugin manifest, they must match.
-#    rdc-skills-self-test fails the whole run (plugin manifest FAIL) if they drift,
-#    and .claude-plugin/plugin.json ships inside the published npm package, so a
-#    stale plugin.json version is a real defect in the release, not a lint nit.
+# 2. Bump the version. `npm version` bumps package.json and package-lock.json, then
+#    its `version` lifecycle hook (scripts/sync-manifest-versions.mjs --stage) sets
+#    every other declaration to match and stages it: .claude-plugin/plugin.json,
+#    clauth-plugin.json, and package.json `claude.version`. The list lives in
+#    scripts/lib/manifest-versions.mjs. Never hand-edit a manifest version.
 npm version patch|minor|major --no-git-tag-version
-# then hand-edit .claude-plugin/plugin.json's top-level "version" field to match —
-# there is no script for this yet, only the self-test catches drift after the fact.
+node scripts/sync-manifest-versions.mjs --check   # exit 1 names any declaration that drifted
+#    tests/manifest-version-parity.test.mjs and rdc-skills-self-test (plugin
+#    manifest FAIL) both fail on drift. 0.37.0 shipped clauth-plugin.json at 0.35.10
+#    because the self-test then checked plugin.json alone.
 
-# 3. Commit, tag, and push
-git add package.json .claude-plugin/plugin.json
+# 3. Commit, tag, and push (the hook already staged every manifest)
+git add CHANGELOG.md
 git commit -m "release: v$(node -e \"console.log(require('./package.json').version)\")"
 git tag "v$(node -e \"console.log(require('./package.json').version)\")"
 git push origin master --tags

package/clauth-plugin.json

@@ -1,7 +1,7 @@
 {
   "schema": "lifeai.plugin.v1",
   "id": "rdc-skills",
-  "version": "0.35.10",
+  "version": "0.37.1",
   "publisher": "LIFEAI",
   "core": false,
   "documentation": {

package/commands/compare-compliance.md

@@ -8,4 +8,8 @@ description: rdc:compare-compliance <path> --diff <ref> — gate a change agains
 Use Skill tool with skill: "solid-validator", passing the path and a
 required `--diff <ref>` as args. Read `regressions` and `boundaryViolations`
 from the output — either non-empty means the change made compliance worse
-than the base ref, not merely "still imperfect."
+than the base ref, not merely "still imperfect." `removedFiles` lists what the
+change deleted; those are reported, never scored.
+
+This is step 1 of the review gate. For the whole gate (lint, tsc, tests and UI
+spec as well), follow `guides/review-gate.md`.

package/commands/quick-check.md

@@ -7,4 +7,6 @@ description: rdc:quick-check <path> — fast mechanical pass, SOLID score and bo
 
 Use Skill tool with skill: "solid-validator", passing the path as args.
 This is the mechanical-only subset — no judgment dispatch, meant to run in
-seconds during active editing. Use `full-analysis` before a merge.
+seconds during active editing. Before a merge, run the review gate in
+`guides/review-gate.md`, which takes one to two minutes. `full-analysis` is a
+deeper advisory pass, not the merge gate.

package/git-sha.json

@@ -1,3 +1,3 @@
 {
-  "sha": "a5325ff86c953a4f64b3deef96551975d530f528"
+  "sha": "ed080efda2d2537ca723128a016188aefd8f8fb5"
 }

package/guides/review-gate.md

@@ -0,0 +1,133 @@
+# Review Gate — deterministic validators on the diff
+
+> The code-review gate used by `rdc:build` (step 9b), `rdc:fixit` (5.5),
+> `rdc:review` (8b), `rdc:release` and `rdc:overnight`. It runs the specific
+> validators over the changed files and finishes in one to two minutes.
+>
+> Approved: direct operator instruction — "we need to tune our code reviews to
+> be specific -- if you ran the validator for solid and lint etc... it should
+> take 1-2 minutes". 2026-09-21, Dave, in session.
+
+## Why this replaced the open-ended reviewer
+
+The previous default dispatched one `pr-review-toolkit:code-reviewer` agent to
+read the whole diff. On the PRT launch build (2026-09-21) four such passes took
+4 to 10 minutes and roughly 200–300k tokens each. Each one was a new judgment
+call, so two runs could not be compared.
+
+The gate below took **9.3 seconds** over the same build's 33 changed code files.
+It found two things that had shipped:
+
+- a SOLID regression: `investors/page.tsx` went from 96.3 to 85, on OCP;
+- 45 lint diagnostics in 14 touched files. Most were import order. Three were
+  accessibility defects: two buttons with no `type`, and an SVG with no title.
+
+A number that two runs agree on can block a merge. An opinion cannot.
+
+## The gate
+
+Run every step and report every result. A red step does not stop the others,
+because the reader needs the whole picture in one pass.
+
+```bash
+BASE=<ref the change is measured against>     # wave base sha, origin/develop, last release tag
+SCOPE=<package or app dir the change touches> # never the monorepo root
+CHANGED=$(git diff --name-only --diff-filter=d "$BASE" -- "$SCOPE" | grep -E '\.(ts|tsx|js|jsx|mjs|cjs)$')
+```
+
+| # | Check | Command | Blocks when |
+|---|---|---|---|
+| 1 | **FORM**: SOLID and boundaries | `rdc-solid-score "$SCOPE" --diff "$BASE" --format json` (add `--config <repo>/.solid-score.yml` if the repo has one) | `regressions`, `boundaryViolations` or `boundaryMisconfigured` is non-empty |
+| 2 | **LINT**: changed files only | the repo's own linter; fix first, then check: `npx biome check --write $CHANGED` then `npx biome check $CHANGED` (ESLint: `npx eslint --fix` then `npx eslint`) | the second command exits non-zero |
+| 3 | **TYPES** | `npx tsc --noEmit -p <package>/tsconfig.json`, once per touched package | exit non-zero |
+| 4 | **TESTS**, scoped | the touched package's own test command, e.g. `pnpm --filter <pkg> exec vitest run` | any failure |
+| 5 | **RENDERED UI**, if a route changed | the project's pinned `test:ui` Playwright spec against a fresh app-owned server (`rdc:review` step 9a) | any red assertion, or no harness |
+
+Read the scorer output fully:
+
+- `removedFiles` lists deletions. They are reported, not scored: a deleted file has no units left that can regress.
+- `unresolvedLanguages` lists files no plugin parses, such as `.css`. They are unmeasured, never passed.
+
+### Rules that keep it honest
+
+- **Lint is fixed, never baselined.** Diagnostics already in a touched file
+  are fixed in the same change. Run `--write` first, and most of them clear
+  mechanically. Do not add an ignore list or a count ratchet.
+- **SOLID is a ratchet by design.** `--diff` compares each unit with itself at
+  `$BASE`. OCP and LSP report `low` confidence, and that confidence is data. A
+  regression still blocks. The usual fix for an OCP drop is to move the
+  branching into a named module; for `investors/page.tsx` that means taking the
+  data read and FAQ shaping out into a loader.
+- **Stay inside the time budget by narrowing scope.** Changed files and touched
+  packages only. If the gate takes more than two minutes, it is scanning too
+  wide. Narrow `$SCOPE` rather than dropping a step.
+- **Never edit what a gate measures to turn it green.** A red check is either
+  fixed properly or reported as a finding.
+
+### New UI tests: prove them before trusting them
+
+Three lessons from the same build:
+
+- **Negative-control every new UI assertion.** Run it once against the broken
+  or old state and watch it go red. A test that has never failed has not
+  proved anything. The CTA-clipping spec was trusted only after it failed on
+  the old CSS.
+- **Measure settled layout.** Take bounding boxes after motion finishes, using
+  reduced motion or waiting for the animation to end. A panel measured
+  mid-slide reports the wrong size.
+- **Include a 1280×800 viewport.** A laptop screen is where a tall panel
+  clips its call-to-action. 1440 and 390 alone missed it.
+
+## When an LLM reviewer is still right
+
+Only for a **named question the validators cannot answer**, scoped to the
+files that question touches. Examples:
+
+- "Does this middleware bypass skip auth on any protected path?"
+- "Does any public string state a return figure?"
+
+```
+Agent({
+  subagent_type: "pr-review-toolkit:code-reviewer",
+  description: "<the question, in five words>",
+  prompt: "Answer one question about <files>: <question>. Read only those files.
+           Return CODE_REVIEW_COMPLETE with { critical_count, high_count, medium_count,
+           low_count, findings: [{severity, file:line, issue, suggested_fix}] }."
+})
+```
+
+A reviewer asked to "review the diff" with no question is the pattern this
+guide retired. Critical and high findings from a named-question pass block, the
+same as a red gate step.
+
+## What is not in the default gate
+
+| Tool | Why it is not in the default gate | When to run it |
+|---|---|---|
+| `rdc-clean-code-score` | No `--diff`, so it reports absolute counts. On the PRT build it reported 475 findings in 17 files, 459 of them N4 "magic number" on SVG coordinates. Its default dead-export scope is the whole git repo, which ran out of 4 GB of heap on regen-root. | Advisory, in `rdc:full-analysis`. Always pass `--project-root <package dir>`; that run took 7.9 s. |
+| `rdc-architecture-score` | No `--diff`. With no `layers:` config, every file is `unclassified`, so it measures nothing. | When the repo declares layers. |
+| `rdc-duplication-score` | Absolute, not a delta. | Advisory. |
+
+## Review is not closure
+
+The gate replaces the per-wave LLM code review. It does **not** replace the
+validator.
+
+A non-epic work item still reaches `done` only through
+`update_work_item_status(..., 'done', ..., <validator session>, 'validator')`,
+and the database refuses an actor session equal to the item's own. A forked
+agent shares its parent's session id, so a fork cannot validate the parent's
+item. Dispatch a fresh agent for that.
+
+## Receipt
+
+Emit this line. The skill that ran the gate quotes it in the implementation
+report or review report:
+
+```
+REVIEW_GATE: { base, scope, files, solid: { regressions, boundaryViolations, removedFiles, unresolved },
+               lint: <exit>, tsc: <exit>, tests: "<N passed>", ui: "<spec + viewports> | n/a",
+               elapsed_s, verdict: "CLEAN|HAS_ISSUES" }
+```
+
+Under `RDC_TEST=1`: echo `[RDC_TEST] skipping review gate` and continue.

package/hooks/require-work-item-on-commit.js

@@ -156,6 +156,17 @@ function isGitCommit(command) {
 function extractCommitMessage(command) {
   const cmd = String(command || '');
 
+  // `-m "$(cat <<'EOF' … EOF)"` / `-m "$(cat <<-'EOF' … EOF)"`: the plain -m
+  // regexes below match the FIRST unrelated quote inside the substitution
+  // (the opening `'` of `<<'EOF'` reads as a closing delimiter to the
+  // non-greedy pattern) and return early with literal shell text as the
+  // "message" -- before the heredoc fallback ever runs. This is the same
+  // defect class the 2026-08-29 fix addressed for a bare heredoc, just one
+  // wrapper layer further out: detect the substitution shape first and
+  // extract from its OWN heredoc body.
+  const mSub = cmd.match(/-m\s+"\$\(\s*cat\s+<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1\s*\n([\s\S]*?)\n[ \t]*\2\s*\)"/);
+  if (mSub) return { message: mSub[3], readable: true };
+
   const msgMatch = cmd.match(/-m\s+["']([^"']+)["']/s) ||
                    cmd.match(/-m\s+"([\s\S]+?)"\s*(?:&&|$)/);
   if (msgMatch) return { message: msgMatch[1], readable: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.36.1",
+  "version": "0.37.1",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",
@@ -19,7 +19,7 @@
     "type": "plugin",
     "skills": "skills/",
     "guides": "guides/",
-    "version": "0.10.0",
+    "version": "0.37.1",
     "commands": "commands/"
   },
   "bin": {
@@ -45,7 +45,7 @@
     "rdc-design": "node scripts/rdc-design-cli.mjs",
     "test:hooks": "node scripts/test-rdc-hooks.mjs",
     "test:truth-gate": "node tests/run-evidence-gate.test.mjs && node tests/work-item-exit-gate-l2.test.mjs && node tests/work-item-exit-gate-l3.test.mjs && node tests/require-work-item-on-commit.test.mjs && node tests/harness-gates.test.mjs && node tests/foreground-process-gate.test.mjs",
-    "test:acceptance": "node tests/acceptance.test.mjs && node tests/install-rdc-skills.test.mjs && node tests/help-surface.test.mjs && node tests/manifest-contract-fields.test.mjs && node tests/plugin-namespace-names.test.mjs && node tests/skill-test-matrix.test.mjs && node tests/completion-gate-supervisor-admission.test.mjs && node tests/curl-surface.test.mjs && node tests/clauth-plugin-postinstall.test.mjs && node tests/install-duplicate-purge.test.mjs",
+    "test:acceptance": "node tests/acceptance.test.mjs && node tests/install-rdc-skills.test.mjs && node tests/help-surface.test.mjs && node tests/manifest-contract-fields.test.mjs && node --test tests/manifest-version-parity.test.mjs && node tests/plugin-namespace-names.test.mjs && node tests/skill-test-matrix.test.mjs && node tests/completion-gate-supervisor-admission.test.mjs && node tests/curl-surface.test.mjs && node tests/clauth-plugin-postinstall.test.mjs && node tests/install-duplicate-purge.test.mjs",
     "acceptance": "node scripts/acceptance.mjs --changed",
     "test:mcp": "node tests/mcp.test.mjs",
     "test:mcp:remote": "node tests/mcp.test.mjs --remote",
@@ -56,6 +56,7 @@
     "test:brochure": "node tests/rdc-brochure.test.mjs",
     "mcp": "node bin/rdc-skills-mcp.mjs",
     "prepack": "node scripts/prepack.mjs",
+    "version": "node scripts/sync-manifest-versions.mjs --stage",
     "test:deploy": "node tests/deploy-updater.test.mjs"
   },
   "dependencies": {

package/scripts/lib/manifest-versions.mjs

@@ -0,0 +1,154 @@
+/**
+ * Every place this package states its own version, and one way to keep them equal.
+ *
+ * package.json `version` is the source. Every entry in VERSION_DECLARATIONS must equal
+ * it. The list was built from a repository search for `"version"`, not from memory:
+ * 0.37.0 shipped with clauth-plugin.json at 0.35.10 and package.json `claude.version`
+ * at 0.10.0, because the only check (self-test) compared plugin.json alone.
+ *
+ * Three readers share this list, so none can drift from the others:
+ *   - tests/manifest-version-parity.test.mjs  fails on any mismatch, and on any JSON
+ *     file with a top-level `version` that is not listed here
+ *   - scripts/self-test.mjs                   the packaged declarations, post-install
+ *   - scripts/sync-manifest-versions.mjs      the `version` lifecycle hook, so
+ *     `npm version <x>` moves every declaration and the test never has to catch it
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { isDeepStrictEqual } from 'node:util';
+import path from 'node:path';
+
+export const VERSION_SOURCE = Object.freeze({ file: 'package.json', keyPath: Object.freeze(['version']) });
+
+/** `packaged: false` — npm never ships the file, so an installed copy cannot check it. */
+export const VERSION_DECLARATIONS = Object.freeze([
+  { file: 'package.json', keyPath: ['claude', 'version'], packaged: true },
+  { file: '.claude-plugin/plugin.json', keyPath: ['version'], packaged: true },
+  { file: 'clauth-plugin.json', keyPath: ['version'], packaged: true },
+  { file: 'package-lock.json', keyPath: ['version'], packaged: false },
+  { file: 'package-lock.json', keyPath: ['packages', '', 'version'], packaged: false },
+].map((d) => Object.freeze({ ...d, keyPath: Object.freeze([...d.keyPath]) })));
+
+export function label({ file, keyPath }) {
+  return `${file} ${keyPath.map((k) => (k === '' ? '""' : k)).join('.')}`;
+}
+
+function getPath(obj, keyPath) {
+  let cur = obj;
+  for (const key of keyPath) {
+    if (cur === null || typeof cur !== 'object' || !(key in cur)) return undefined;
+    cur = cur[key];
+  }
+  return cur;
+}
+
+function setPath(obj, keyPath, value) {
+  const copy = structuredClone(obj);
+  let cur = copy;
+  for (const key of keyPath.slice(0, -1)) cur = cur[key];
+  cur[keyPath[keyPath.length - 1]] = value;
+  return copy;
+}
+
+/** `{ exists, text, json, error }` — an unreadable file is reported, never thrown past the caller. */
+function readJson(root, file) {
+  const full = path.join(root, file);
+  if (!existsSync(full)) return { exists: false, text: null, json: null, error: null };
+  try {
+    const text = readFileSync(full, 'utf8');
+    return { exists: true, text, json: JSON.parse(text), error: null };
+  } catch (error) {
+    return { exists: true, text: null, json: null, error: error.message };
+  }
+}
+
+/** The source version: package.json `version`. Throws when package.json cannot say. */
+export function sourceVersion(root) {
+  const { json, error } = readJson(root, VERSION_SOURCE.file);
+  if (error) throw new Error(`${VERSION_SOURCE.file} is unreadable: ${error}`);
+  const version = json ? getPath(json, VERSION_SOURCE.keyPath) : undefined;
+  if (typeof version !== 'string' || !version) throw new Error(`${VERSION_SOURCE.file} has no version`);
+  return version;
+}
+
+/**
+ * Every declaration with its current value. Each is read on its own: one unreadable
+ * file is that declaration's `error`, and every other declaration is still checked.
+ * @returns {{ source: string, declarations: Array<{file, keyPath, packaged, label, exists, value, error}> }}
+ */
+export function readDeclarations(root, { packagedOnly = false } = {}) {
+  const source = sourceVersion(root);
+  const cache = new Map();
+  const declarations = VERSION_DECLARATIONS
+    .filter((d) => !packagedOnly || d.packaged)
+    .map((d) => {
+      if (!cache.has(d.file)) cache.set(d.file, readJson(root, d.file));
+      const { exists, json, error } = cache.get(d.file);
+      return { ...d, label: label(d), exists, error, value: json ? getPath(json, d.keyPath) : undefined };
+    });
+  return { source, declarations };
+}
+
+/** The declarations that do not equal package.json's version (missing or unreadable counts). */
+export function mismatches(root, options = {}) {
+  const { source, declarations } = readDeclarations(root, options);
+  return declarations.filter((d) => d.error || d.value !== source).map((d) => ({ ...d, expected: source }));
+}
+
+/** What a declaration currently says, for a message: the value, or why there is none. */
+export function describeValue(d) {
+  if (!d.exists) return '(file missing)';
+  if (d.error) return `(unreadable: ${d.error})`;
+  if (d.value === undefined) return '(key missing)';
+  return JSON.stringify(d.value);
+}
+
+/**
+ * Replace one string value in JSON text without reformatting the file. Each
+ * `"<key>": "<old>"` occurrence is tried in turn and kept only when the result parses
+ * to exactly the original document with that one value changed — so a same-named key
+ * elsewhere (package-lock.json has hundreds of `version`s) is never the one edited.
+ */
+export function replaceJsonString(text, keyPath, oldValue, newValue) {
+  const original = JSON.parse(text);
+  const want = setPath(original, keyPath, newValue);
+  const key = keyPath[keyPath.length - 1];
+  const literal = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const pattern = new RegExp(`("${literal(key)}"\\s*:\\s*)"${literal(oldValue)}"`, 'g');
+  for (const match of text.matchAll(pattern)) {
+    const at = match.index;
+    const candidate = `${text.slice(0, at)}${match[1]}${JSON.stringify(newValue)}${text.slice(at + match[0].length)}`;
+    let parsed;
+    try { parsed = JSON.parse(candidate); } catch { continue; }
+    if (isDeepStrictEqual(parsed, want)) return candidate;
+  }
+  throw new Error(`could not locate ${keyPath.join('.')} = "${oldValue}" as a plain string to rewrite`);
+}
+
+/**
+ * Set every declaration to package.json's version, formatting untouched. All or
+ * nothing: every new file text is computed first and nothing is written unless every
+ * declaration could be set, so a failure never leaves some manifests bumped. A missing
+ * file or a non-string value is an error, never skipped.
+ * @returns {Array<{label, from, to}>} what changed
+ */
+export function syncDeclarations(root) {
+  const source = sourceVersion(root);
+  const texts = new Map();
+  const changed = [];
+  for (const d of VERSION_DECLARATIONS) {
+    const full = path.join(root, d.file);
+    if (!texts.has(full)) {
+      if (!existsSync(full)) throw new Error(`${d.file} is listed as a version declaration but does not exist`);
+      texts.set(full, { original: readFileSync(full, 'utf8'), text: null });
+    }
+    const entry = texts.get(full);
+    const text = entry.text ?? entry.original;
+    const current = getPath(JSON.parse(text), d.keyPath);
+    if (current === source) continue;
+    if (typeof current !== 'string') throw new Error(`${label(d)} is ${JSON.stringify(current)}, not a version string`);
+    entry.text = replaceJsonString(text, d.keyPath, current, source);
+    changed.push({ label: label(d), from: current, to: source });
+  }
+  for (const [full, { text }] of texts) if (text !== null) writeFileSync(full, text);
+  return changed;
+}

package/scripts/self-test.mjs

@@ -33,6 +33,7 @@ import { join, basename, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 import { loadAllManifests } from "./lib/manifest-schema.mjs";
+import { describeValue as describeVersionValue, mismatches as versionMismatches } from "./lib/manifest-versions.mjs";
 import { runManifest } from "./lib/runner.mjs";
 import {
   generateRunId,
@@ -48,7 +49,6 @@ const GUIDES_DIR = join(REPO_ROOT, "guides");
 const AGENT_GUIDES_DIR = join(GUIDES_DIR, "agents");
 const HOOKS_DIR = join(REPO_ROOT, "hooks");
 const PLUGIN_MANIFEST = join(REPO_ROOT, ".claude-plugin", "plugin.json");
-const PACKAGE_JSON = join(REPO_ROOT, "package.json");
 
 // ─── Guide-content validator constants ───────────────────────────────────────
 // Path to the regen-root project (sibling of rdc-skills).
@@ -600,19 +600,24 @@ function auditPluginManifest() {
     });
   }
   try {
-    const pkg = JSON.parse(readFileSync(PACKAGE_JSON, "utf8"));
-    if (manifest.version && pkg.version && manifest.version !== pkg.version) {
+    // Every declaration an installed copy carries, from the one list the parity test and
+    // the `npm version` hook also read (scripts/lib/manifest-versions.mjs). This checked
+    // plugin.json alone, and clauth-plugin.json sat at 0.35.10 through 0.37.0. Each
+    // declaration is read on its own, so an unreadable file is its own error and never
+    // hides the others.
+    for (const d of versionMismatches(REPO_ROOT, { packagedOnly: true })) {
       findings.push({
         level: "error",
         code: "manifest-version-mismatch",
-        message: `plugin.json version "${manifest.version}" ≠ package.json version "${pkg.version}"`,
+        message: `${d.label} ${describeVersionValue(d)} ≠ package.json version "${d.expected}"`,
       });
     }
   } catch (e) {
+    // Only package.json itself lands here: without it no version can be verified.
     findings.push({
-      level: "warn",
+      level: "error",
       code: "package-json-unreadable",
-      message: `could not read package.json for version cross-check: ${e.message}`,
+      message: `could not read package.json for the version cross-check: ${e.message}`,
     });
   }
   const ok = findings.every((f) => f.level !== "error");

package/scripts/solid-score.mjs

@@ -141,6 +141,23 @@ function walk(dir, exclude, out = []) {
   return out;
 }
 
+/**
+ * Does this `git show <ref>:<path>` stderr mean "the file is not at <ref>"?
+ *
+ * Git words it two ways, and the common one was missing until 2026-09-21:
+ *   - `fatal: path 'p' does not exist in 'ref'`        — absent at ref AND on disk
+ *   - `fatal: path 'p' exists on disk, but not in 'ref'` — a NEW file in the
+ *     working tree, i.e. every `--diff` over a change that adds a file
+ * Matching only the first made `--diff` crash on any diff with a new file.
+ * Anything else (a bad ref, a path-form mismatch) is not "absent" and must be
+ * rethrown, so a real error never passes silently as a new unit.
+ */
+export function isAbsentAtRef(stderr) {
+  const msg = String(stderr ?? '');
+  if (!msg.includes('fatal: path')) return false;
+  return msg.includes('does not exist in') || msg.includes('exists on disk, but not in');
+}
+
 /** Score a file's text as it existed at a given git ref, without touching the working tree. */
 function scoreAtRef(repoRoot, filePath, ref, weights) {
   const relPath = relative(repoRoot, filePath).split('\\').join('/');
@@ -151,10 +168,9 @@ function scoreAtRef(repoRoot, filePath, ref, weights) {
     // `git show` fails both when the file is genuinely new at `ref` AND for
     // unrelated reasons (a path-form mismatch, a bad ref). Collapsing both
     // into "it's new" hides the second case — the exact class of silent
-    // path-form bug found three times in this file already tonight. Only a
-    // "does not exist" message is treated as new; anything else is rethrown.
-    const msg = String(err.stderr ?? err.message ?? '');
-    if (msg.includes('does not exist in') || msg.includes('fatal: path') && msg.includes('does not exist')) return null;
+    // path-form bug found three times in this file already. Only git's two
+    // "not at this ref" messages are treated as new; anything else is rethrown.
+    if (isAbsentAtRef(err.stderr ?? err.message)) return null;
     throw err;
   }
   const plugin = pluginFor(filePath);
@@ -237,6 +253,7 @@ async function main() {
   }
 
   let files;
+  let removedFiles = [];
   if (diffRef) {
     // `git diff --name-only <ref> -- <path>` (no `...HEAD`) compares `<ref>`
     // directly against the WORKING TREE — committed history AND uncommitted
@@ -244,8 +261,16 @@ async function main() {
     // diff` form, so they're unioned in separately. Before this fix, only
     // `<ref>...HEAD` (committed history alone) was scored — a dirty tree
     // with real regressions scored zero files and exited 0.
-    const committed = execFileSync('git', ['diff', '--name-only', diffRef, '--', targetPath], { cwd: repoRoot, encoding: 'utf8' })
+    //
+    // Deleted paths are split out by git's own account (`--diff-filter=D`),
+    // not by an existsSync guess, so a path-form bug can never pass as a
+    // deletion. A deleted file has no current units and so nothing that can
+    // regress; before 2026-09-21 it reached extractUnits and crashed the gate
+    // with ENOENT. It is reported in `removedFiles`, never dropped silently.
+    const nameOnly = (filter) => execFileSync('git', ['diff', '--name-only', `--diff-filter=${filter}`, diffRef, '--', targetPath], { cwd: repoRoot, encoding: 'utf8' })
       .split('\n').filter(Boolean);
+    const committed = nameOnly('d');
+    removedFiles = nameOnly('D');
     const untracked = execFileSync('git', ['ls-files', '--others', '--exclude-standard', '--', targetPath], { cwd: repoRoot, encoding: 'utf8' })
       .split('\n').filter(Boolean);
     files = [...new Set([...committed, ...untracked])]
@@ -285,7 +310,7 @@ async function main() {
   const boundaryViolations = boundaryFindings.filter((f) => !f.satisfied);
 
   const output = {
-    results, regressions, boundaryFindings, boundaryViolations, boundaryMisconfigured, unresolvedLanguages,
+    results, regressions, removedFiles, boundaryFindings, boundaryViolations, boundaryMisconfigured, unresolvedLanguages,
     config: { weights: config.weights, diff: config.diff, boundaryRuleCount: (config.boundaries ?? []).length },
     configPath, configLoaded,
     parser: parserName,
@@ -312,6 +337,10 @@ async function main() {
       console.log('\nREGRESSIONS:');
       for (const r of regressions) console.log(`  ${r.file} :: ${r.unit} — ${r.reason} ${JSON.stringify(r)}`);
     }
+    if (removedFiles.length) {
+      console.log(`\n${removedFiles.length} file(s) deleted since ${diffRef} — no units left to score:`);
+      for (const f of removedFiles) console.log(`  ${f}`);
+    }
     if (unresolvedLanguages.length) {
       console.log(`\n${unresolvedLanguages.length} file(s) matched no registered language plugin — skipped, not silently passed:`);
       for (const f of unresolvedLanguages) console.log(`  ${relative(repoRoot, f)}`);