Summary

The bump-coana skill bumped package.json's version itself and wrote its own ## [<version>] changelog heading. Both belong to the release workflow, and the skill's versions of them caused real damage on v1.x:

• Changelog headings for 1.1.160, a version with no tag, no GitHub release, and nothing on npm — written twice, by upgrading coana to version 15.10.17 #1502 and upgrading coana to version 15.10.23 #1510.
• v1.1.159 shipped with empty notes. upgrading coana to version 15.10.16 #1501's hand-written heading consumed the ## [Unreleased] block, so when the real release ran it found nothing to promote.
• The first 1.1.160 release attempt failed outright: with the manifest already hand-written to 1.1.160, writeManifestVersion's rewrite was byte-identical, and its replaced === raw guard reported "no top-level version line" against a manifest whose version field was present and well-formed.

Changes

.claude/skills/bump-coana/SKILL.md

• Step 2 no longer touches the top-level version, and says why: the release owns that field, and hand-writing it breaks the next release.
• Step 3 adds the entry under ## [Unreleased], recreating the heading when the previous release consumed it. Having nowhere to put notes is what motivated the invented headings, so the fix has to cover that case or it will recur.
• Explicit "never write a ## [<version>] heading", plus a matching line under Important Notes.

scripts/release/bump.mts

• Separate the two failures the old guard conflated: test for the version field, then replace. A manifest already holding the target version now passes through as a no-op instead of failing the release. The base comes from release tags and the registry, never the manifest, so an already-correct manifest is not a reason to stop.

test/release-bump.test.mts

• Add the missing no-op case. Verified against the old implementation: it throws on this input, the new one does not, and both the missing-field and empty-version cases still throw.

Verification

• pnpm run lint — 0 errors
• pnpm run check:tsc — clean, both projects
• pnpm test:unit test/release-bump.test.mts — 5/5

No changelog entry: internal tooling, excluded per the repo's changelog rules.

Follow-up not included here

Step 5 still commits with git commit -n, which skips the commit-msg PII guard that CLAUDE.md says not to work around. Left alone since the intent was probably to skip the pre-commit lint hook — DISABLE_PRECOMMIT_LINT=1 would do that without disarming the guard.