docs: correct nine false statements in the sweep record, and fix three citations no reader could resolve

docs/specs/docs-hygiene-sweep-unapplied-remediations.md

@@ -344,13 +344,30 @@ citing text the audit quoted.
 
 > **Closure stamp, 2026-08-28. All 34 rows below are closed. The tables are left verbatim as the
 > inventory this record exists to preserve; only this note is added.** The sentence directly above
-> is the one thing in this section that was never true: #3380 wrote it and fixed 32 of the 34 in the
-> same commit, so it asserts a re-verification of citing text it had already deleted. Three separate
-> later passes each re-derived this roster from scratch because of it. Rows closed by
-> [#3380](https://github.com/melodic-software/claude-code-plugins/pull/3380) (`6c7a1032`): 22 of
-> Group 1, **all 8 of Group 2**, and both of Group 3. `V-review-13` and `V-review-14` closed later,
-> in [#3475](https://github.com/melodic-software/claude-code-plugins/pull/3475). Group 2's eight
-> were rewritten from the bare `skills/<s>/<path>` form to the anchored
+> went stale rather than starting false. It was written on 2026-08-26 by
+> [#3362](https://github.com/melodic-software/claude-code-plugins/pull/3362) (`3fbe9789`), the
+> commit that created this file and this whole section, while all 34 rows were open; it was true
+> then. Rows closed by [#3380](https://github.com/melodic-software/claude-code-plugins/pull/3380)
+> (`6c7a1032`): 22 of Group 1, **all 8 of Group 2**, and both of Group 3. #3380 fixed those 32 in
+> the citing files and never touched this section — `git show 6c7a1032 -- <this file>` has hunks
+> only in "Status at the stamp", L2 structure, L6 and L7 — so the summary above kept asserting a
+> re-verification of citing text that no longer stood. Three separate later passes each re-derived
+> this roster from scratch because of it.
+>
+> **Correction, 2026-08-28 (seventh review round).** An earlier version of this stamp said the
+> sentence "was never true" and that "#3380 wrote it … in the same commit". Both are false, and the
+> generalizable rule the sweep spec drew from them was drawn from something that did not happen.
+> `git log --diff-filter=A -- docs/specs/docs-hygiene-sweep-unapplied-remediations.md` returns
+> `3fbe9789` (#3362), and `git blame -L 340,343` puts the sentence on `3fbe97898`. The corrected
+> rule is in the sweep spec's "The L4 roster is closed" section.
+>
+> `V-review-13` and `V-review-14` closed later, in
+> [#3468](https://github.com/melodic-software/claude-code-plugins/pull/3468) (`c66f26ce`), which
+> rewrote all three `docs/conventions/native-references/README.md` sites to slash invocations. An
+> earlier version of this stamp credited #3475; that PR touched only that convention's CHANGELOG.
+> The 34-closed total is unaffected either way.
+>
+> Group 2's eight were rewritten from the bare `skills/<s>/<path>` form to the anchored
 > `${CLAUDE_PLUGIN_ROOT}/skills/<s>/<path>` form clause 3 requires, and all seven distinct targets
 > resolve on disk. Group 3's two anchors were dropped to file-level links. **Do not re-derive this
 > roster again; verify against the sweep spec's closure section instead.**

plugins/discovery/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "discovery",
-  "version": "0.16.16",
+  "version": "0.16.17",
   "description": "Structured discovery before changes: explore the local codebase, run disciplined multi-source external research, and reconstruct why a past decision was made from evidence outside the code — each dispatching a purpose-built subagent by default so the reading stays out of the main conversation, with source tiers, falsification, recency gates, an intent-evidence tier, and a corpus-coverage ledger — persisting EXPLORE.md / RESEARCH.md / INTENT.md index-plus-sidecar handoff artifacts.",
   "author": {
     "name": "Melodic Software",

plugins/discovery/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog — discovery plugin
 
+## [0.16.17]
+
+### Fixed
+
+- **`reference/topic-docs.md` cited its three agent definitions by a path that
+  resolved against nothing.** The return-payload sentence named `agents/explorer.md`,
+  `agents/researcher.md` and `agents/intent-tracer.md`, whose implied base is the
+  plugin root while their real base is `reference/`, the defect class
+  [ADR 0018](../../docs/adr/0018-treat-the-plugin-as-the-encapsulation-boundary-for-skill-citation.md)'s
+  correction 1 names. All three now carry `${CLAUDE_PLUGIN_ROOT}/`, the form the
+  next sentence of the same paragraph already uses for the three dispatch docs.
+  This file is not fetched from outside the plugin, so the anchored form resolves
+  for every reader it has and the invocation is not needed.
+
+  Found by the round verifying the sweep's own third derivation. That derivation
+  was `skills/`-scoped and therefore blind by construction to citations naming no
+  skill, which is why three defects of the same class survived it three lines
+  above rows the sweep had already closed.
+
 ## [0.16.16]
 
 ### Changed

plugins/discovery/reference/topic-docs.md

@@ -82,8 +82,9 @@ checkout (worktree or background session) returns findings by value instead, and
 the memory slice.
 
 **Where that rule is reachable from.** A worker does not choose the by-value mode by reading this
-file; it is `persistence: by-value` in the return payload (`agents/explorer.md`,
-`agents/researcher.md`, `agents/intent-tracer.md`), and the parent acts on it at the
+file; it is `persistence: by-value` in the return payload
+(`${CLAUDE_PLUGIN_ROOT}/agents/explorer.md`, `${CLAUDE_PLUGIN_ROOT}/agents/researcher.md`,
+`${CLAUDE_PLUGIN_ROOT}/agents/intent-tracer.md`), and the parent acts on it at the
 `persistence: by-value` rung of each family's recovery ladder —
 `${CLAUDE_PLUGIN_ROOT}/skills/explore/reference/dispatch.md`,
 `${CLAUDE_PLUGIN_ROOT}/skills/research/context/dispatch.md` and

plugins/songwriting/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "songwriting",
-  "version": "1.4.17",
+  "version": "1.4.18",
   "description": "Songwriting craft companion — nine concern-scoped lyric-craft skills (workflow router, rhyme, object-writing, metaphor, meter-prosody, song-form, co-write, diagnose, practice) applying Pat Pattison's methods, with an object-writing agent that performs the sensory exercise itself and per-skill emission boundaries that route generation to the skill that owns it, plus Suno v5.5 prompt engineering (style prompts, tagged lyrics, genre templates, troubleshooting).",
   "author": {
     "name": "Melodic Software",

plugins/songwriting/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to the `songwriting` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [1.4.18]
+
+### Fixed
+
+- **`lyric-melodic-roadmaps.md` cited `meter-prosody` by an unresolvable path.** The
+  keep-these-four-consistent sentence named `prosody.md` and `meter.md`, which are siblings and
+  resolve, alongside `skills/meter-prosody/SKILL.md`, whose implied base is the plugin root while
+  its real base is `context/pat-pattison/research/`, the defect class
+  [ADR 0018](../../docs/adr/0018-treat-the-plugin-as-the-encapsulation-boundary-for-skill-citation.md)'s
+  correction 1 names. It now reads `${CLAUDE_PLUGIN_ROOT}/skills/meter-prosody/SKILL.md`, the
+  anchored form this `research/` tree already uses for the Datamuse script. The sentence is the
+  plugin's own prose, not printed Pat Pattison text, so the distilled-corpus exclusion does not
+  cover it. Intra-plugin citation, legal under clause 1; clause 3 only, so the target is unchanged.
+
 ## [1.4.17]
 
 ### Added

plugins/songwriting/context/pat-pattison/research/lyric-melodic-roadmaps.md

@@ -200,7 +200,7 @@ is in the second one. Matching a lyric to a *model lyric* (verse 2 against verse
 *melody* — the frame of this whole file — a mismatch in **either** direction is
 a greedy spot, because either one fights the bar. That two-frame split is the
 plugin's, not Pat's, and it is stated the same way in `prosody.md`, `meter.md`
-and `skills/meter-prosody/SKILL.md`; keep the four consistent.
+and `${CLAUDE_PLUGIN_ROOT}/skills/meter-prosody/SKILL.md`; keep the four consistent.
 
 Pat's printed passage, which is the *model-lyric* frame:
 

plugins/source-control/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "source-control",
-  "version": "0.55.29",
+  "version": "0.55.30",
   "description": "Git and GitHub delivery workflow: /commit (Conventional Commits + Co-authored-by trailer via safe heredoc mechanics), /pull-request (prep, create, CI monitoring, review-comment triage, merge, CI-log fetch), /babysit-prs (self-pacing fleet loop \u2014 safe by default; opt-in worker/autopilot tiers add gate-checked merge and thread resolution behind a deterministic Python engine), /babysit-loop (the loop-lane merge lane: a standing or drain loop that invokes babysit-prs per cycle, configured through repo-scoped babysit_loop_* keys on the layered source-control.md seam, with merge authority human-only until the target repo's tracked config adopts the lane, a gate-proven C2-mechanical baseline once adopted, and standing merge-rung raises binding from the team-tracked layer only \u2014 with one named exception, where an invocation line explicitly typing both the autopilot tier keyword and the dedicated raise argument --merge c3-this-run widens that single invocation's merge authority up to C3 behind a fresh independent frontier-tier resolver, while C4-structural and C5-untrusted-provenance stay unconditionally human-merge), /worktree (create, status, cleanup, audit for parallel-session isolation), /setup (check the effective commit-subject / PR-title convention merged across its config layers and the babysit-prs config, or apply \u2014 interview the repo and write the convention config to a chosen layer), and /resolve-conflicts (intent-first merge/rebase conflict resolution with a semantic-conflict sweep \u2014 never --abort). The commit-subject / PR-title convention is configurable via a source-control.md config written by a re-runnable setup skill, layered across a ~/.claude user-global file, the tracked team file, and a gitignored .claude/source-control.local.md personal overlay merged per key; Conventional Commits is the default when no convention is declared.",
   "author": {
     "name": "Melodic Software",

plugins/source-control/CHANGELOG.md

@@ -3,6 +3,31 @@
 All notable changes to the `source-control` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.55.30]
+
+### Fixed
+
+- **`reference/config-resolution.md` cited `babysit-prs` by a path that resolved
+  against nothing.** The autonomy-table pointer read
+  `skills/babysit-prs/SKILL.md`, whose implied base is the plugin root while its
+  real base is `reference/`, the defect class
+  [ADR 0018](../../docs/adr/0018-treat-the-plugin-as-the-encapsulation-boundary-for-skill-citation.md)'s
+  correction 1 names. It now names the public invocation,
+  `/source-control:babysit-prs`, keeping the section name.
+
+  **The `${CLAUDE_PLUGIN_ROOT}` form this fix first took was wrong for the reader
+  that most needs it.** `work-items`'s `work` skill fetches this file over
+  `raw.githubusercontent.com`, and for that reader `${CLAUDE_PLUGIN_ROOT}` denotes
+  the `work-items` installation, so the anchor resolved to a `babysit-prs` skill
+  that does not exist there. This sentence is the doc's address for the autonomy
+  obligation, which is the case
+  [ADR 0018](../../docs/adr/0018-treat-the-plugin-as-the-encapsulation-boundary-for-skill-citation.md)'s
+  2026-08-28 amendment routes to the invocation rather than to a path whose
+  meaning depends on which plugin fetched the document. Found by a third
+  derivation over the plugin-level `reference/`, `context/` and `agents/` trees
+  whose predecessor could not see citations of a `SKILL.md` itself; the remedy
+  corrected by review before merge.
+
 ## [0.55.29]
 
 ### Changed

plugins/source-control/reference/config-resolution.md

@@ -121,7 +121,7 @@ binding layer, never unioned).
 | `babysit_loop_trusted_internal_bot_logins` | flat Markdown bullet list (`- <login>` per line) of exact GitHub App bot logins the repository attests as its own internal automation — the C5 trust test's reviewed internal-bot trust signal; **honored in the team-tracked layer only** ("the C5 trust test's one reviewed widening" below) | none — empty set: the trust test accepts `OWNER`/`MEMBER` only |
 
 Dimension semantics — what each tier value grants per dimension — are owned by the babysit-prs
-autonomy table (`skills/babysit-prs/SKILL.md`, "Autonomy tiers (per action class)") and are not
+autonomy table (`/source-control:babysit-prs`, "Autonomy tiers (per action class)") and are not
 restated here. The merge dimension's rung semantics are owned by the loop-lane convention's autonomy
 ladder (`docs/conventions/loop-lane/README.md` §1 in the marketplace repository).
 

plugins/work-items/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "work-items",
-  "version": "0.39.38",
+  "version": "0.39.39",
   "description": "Manages development work items through a provider-neutral tracker seam that ships with the plugin (bundled dispatcher plus github, local-markdown, jira, gitea, and linear adapters; seam plugin-dir canonical, adapters consumer-local-first): dashboard, taxonomy-labeled creation, a race-safe assignee-plus-lease claim protocol, recurring-schedule checks, TODO scanning, stale-lease auditing, plan decomposition into vertical-slice items, a macro-journey router over spec containers (rollup, per-container execution shape, next-step routing), raw-intake triage (issues and unsolicited PRs through raw, verified, briefed, autonomous-eligible states), plus the two work-items loop lanes of the loop-lane convention: a self-paced autonomous work-loop drain (work-class admission gate, adaptive item cap, PR-only) and an attended attend-queue escalation lane. The re-runnable setup skill binds the provider (.work-item-tracker.json), seeds the recurring-schedule seam (.github/recurring-schedule.json), and remaps canonical role labels.",
   "author": {
     "name": "Melodic Software",

plugins/work-items/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to the `work-items` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.39.39]
+
+### Fixed
+
+- **`reference/permission-preflight.md` cited the `work` skill by an unresolvable path.** The Step 0
+  pointer for the `reclaim` classifier-denial mitigation read `skills/work/SKILL.md`, whose implied
+  base is the plugin root while its real base is `reference/`, the defect class
+  [ADR 0018](../../docs/adr/0018-treat-the-plugin-as-the-encapsulation-boundary-for-skill-citation.md)'s
+  correction 1 names. It now reads `${CLAUDE_PLUGIN_ROOT}/skills/work/SKILL.md`, the form the same
+  file already uses for `preflight.sh`. Intra-plugin citation, legal under clause 1; clause 3 only,
+  so the target is unchanged and no routing moves.
+
 ## [0.39.38]
 
 ### Changed

plugins/work-items/reference/permission-preflight.md

@@ -42,7 +42,8 @@ matching "arbitrary-code-execution patterns" as routed through the classifier re
 defining that pattern set precisely enough to say which side a script invocation (`work-item-tracker.sh
 reclaim <id>`) falls on. Do not write a rule into the standards floor on the strength of this doc
 alone; confirm the carve-out first. `/work-items:work`'s Step 0 treats a classifier denial of
-`reclaim` as a non-blocking, report-once-and-skip condition (see `skills/work/SKILL.md` "Step 0") —
+`reclaim` as a non-blocking, report-once-and-skip condition (see
+`${CLAUDE_PLUGIN_ROOT}/skills/work/SKILL.md` "Step 0") —
 that is the current mitigation; a permission-rule fix, if one applies, still lives operator-side per
 the pattern above.