chore(release): v0.4.0, since LINKS-OPEN-REFS is a new check

Same precedent as v0.2.0 and v0.3.0: a new check code is a minor bump,
not a patch. Bundles the register row for repo #20, the schemaless-host
fix, the reference dedup and the new OK/SKIP outcomes on checkLinks.

Also records the register-freshness decision in CLAUDE.md: --refresh
runs HERE before every release, and consumers of the register are told
not to check freshness themselves. Twice running a newly published repo
was missing when a census ran, and the cost landed in a DIFFERENT repo
than the stale one — portfolio-optimiser's status line stayed put
through a round in which it fixed everything really wrong with it.
Two owners of one invariant is the drift this register exists to remove.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NxP9N3p1fG6UYSB8rATBL6

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-standard",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Per-repo gate for the open/ presentation standard: README first screen, install block, files required by the repo's class, and dead repo references.",
   "author": {
     "name": "Kjell Tore Guttormsen"

CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to this project are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 versioning is [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0] — 2026-08-09
+
+### Added
+
+- `LINKS-OPEN-REFS`: the `open/` reference check now reports its own result
+  instead of only its failures. Emitting nothing on success made "no dead
+  references" and "the check never ran" identical in the output — a sweep
+  across the org could not tell 19 clean repos from 19 unread ones (measured:
+  org-ops census 03b). The OK line carries the count it resolved, because an
+  OK that cannot say how many it checked is the same silence in a different
+  colour. Zero enumerated files is now `LINKS-OPEN-REFS-UNAVAILABLE` (SKIP),
+  which is the honest name for the case that used to look like a pass.
+- `portfolio-optimiser-commons` registered as `shared-asset`, the org's 20th
+  repo. Class verified structurally rather than accepted: absent from the
+  catalog's `marketplace.json`, no `.claude-plugin/`, `README.md` + `LICENSE`
+  present, consumed by both reference implementations as a `git subtree` —
+  so `vendor` is the right install form and `## Install` would be wrong to
+  require. Its absence was producing three false `LINK-DEAD` ERRORs in
+  `portfolio-optimiser` against a repo that exists, and leaving repo #20 with
+  zero coverage. Verified after the fact: `portfolio-optimiser` now has no
+  ERROR, and the commons repo measures as WARN with 9 checks passed.
+
+### Fixed
+
+- `LINK-DEAD`/`LINK-NON-REPO` false negative on a schemaless host. `URL_REF`
+  required `://` or `@host:`, so `git.fromaitochitta.com/open/<name>` — the
+  form a subtree instruction routinely uses — resolved to nothing at all
+  (measured: llm-security/V3-UPGRADE.md:343). What makes a name resolvable is
+  its position after a host, not the scheme in front of it. Two guards keep
+  the widening from becoming noise: the host must end in a TLD-shaped label,
+  and a candidate preceded by `/` is a path segment that merely contains a
+  dot, not a host — so `docs/v1.2/open/` and `test/nav.golden/open/` stay
+  silent, and the API-endpoint rule from 0.3.0 is untouched. Measured before
+  shipping across 1501 tracked Markdown files in 20 local clones: 14 lines
+  changed verdict, 13 of them references that were previously invisible.
+- The 14th was a defect the widening introduced, caught by that same
+  measurement and fixed here: a markdown link whose display text repeats its
+  own URL matched on both halves, which prints one dead reference twice and
+  inflates the count the new OK line offers as evidence. References are now
+  deduplicated per name-and-line — two different names on one line, or the
+  same name on two lines, still count as two.
+
 ## [0.3.0] — 2026-08-04
 
 ### Added

CLAUDE.md

@@ -89,7 +89,7 @@ would recreate, in data, exactly the drift this plugin exists to remove.
 ## Commands
 
 ```bash
-npm test                                                  # 116 tests
+npm test                                                  # 129 tests
 node scripts/repo-standard-check.mjs --dir "$PWD"         # gate one repo
 node scripts/repo-standard-check.mjs --offline            # no network call
 node scripts/repo-standard-check.mjs --json               # machine output
@@ -98,6 +98,15 @@ node scripts/repo-standard-check.mjs --refresh            # register vs. forge
 
 ## Release
 
+**Run `--refresh` before every release.** Register freshness is owned HERE, not
+by the sweeps that read the register. Twice running, a newly published repo was
+missing when a census ran, and the cost is not a gap — it is false ERRORs in a
+*different* repo: `portfolio-optimiser` earned three `LINK-DEAD`s against a repo
+that existed, in the same round it fixed its three real ones, so its status line
+did not move even though the work was done. A stale register makes the gate
+lie about repos that are not even the stale one. One owner, no shared duty:
+consumers of the register are told not to check freshness themselves.
+
 Polyrepo rule: a version bump is not finished until the tag `vX.Y.Z` is pushed
 **and** the catalog `ref` is bumped to it. Use `release-plugin.mjs`, never a
 hand-edited `ref`.

README.md

@@ -10,7 +10,7 @@ checks that surface in one repository and reports what it finds.
 
 *AI-generated: all code produced by Claude Code through dialog-driven development.*
 
-![Version](https://img.shields.io/badge/version-0.3.0-blue)
+![Version](https://img.shields.io/badge/version-0.4.0-blue)
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
 ![Skills](https://img.shields.io/badge/skills-1-orange)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
@@ -167,7 +167,7 @@ without that, a raw scan turns three dead names into about twenty.
 npm test
 ```
 
-116 tests over the pure classifiers. The reference fixtures are measured false
+129 tests over the pure classifiers. The reference fixtures are measured false
 positives, each with its expected verdict — the six that produced the
 three-outcome reference rule, plus the noise sources found by running the gate
 against a real repository: regexes inside code spans that are markdown links to

package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-standard",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "type": "module",
   "engines": {