ci: widen the path filter to tools/

The filter still named check-branding.sh at the repo root, a path that no
longer exists after the move — so a change to the branding toolkit would
not have triggered CI at all. Silent, and exactly the failure the toolkit
exists to prevent elsewhere.

'tools/**' also covers the deploy scripts that will land there.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WHt4DykxXaQnyaJfyS8KCn

.github/workflows/ci.yaml

@@ -9,7 +9,7 @@ on:
       - 'Cargo.toml'
       - 'Cargo.lock'
       - 'bundler.toml'
-      - 'check-branding.sh'
+      - 'tools/**'
   pull_request:
     branches: [ master ]
   workflow_dispatch:
@@ -41,7 +41,7 @@ jobs:
       # Cheap and needs no toolchain, so it runs first: a rename that only
       # landed in half the files is worth catching before spending a build on it.
       - name: Branding consistency
-        run: sh check-branding.sh
+        run: sh tools/check-branding.sh
 
       # The default build is CLAP-only; the vst3 feature is opt-in, so both
       # configurations have to be built to know the cfg gates are still correct.

NOTICE

@@ -1,4 +1,4 @@
-nih-plug-template
+Plugin Name
 Copyright 2026 Mikkeli Matlock
 
 This product is licensed under the GNU General Public License v3.0 or later.

README.md

@@ -20,31 +20,53 @@ sh check-branding.sh
 
 ## Renaming
 
-Branding is duplicated across `Cargo.toml`, `bundler.toml`, `src/lib.rs` and the docs,
+Identity is duplicated across `Cargo.toml`, `bundler.toml`, `src/lib.rs`, `NOTICE`,
-and nothing makes those agree — so a half-finished rename builds a bundle under one name
+`Cargo.lock`, the CI workflow and the docs. Nothing makes those agree, so a half-finished
-while the docs and deploy script look for another.
+rename builds a bundle under one name while CI bundles another.
 
-`check-branding.sh` declares the identity once at the top and asserts every copy matches:
+Everything for it lives in `tools/`:
 
-```bash
+```
-sh check-branding.sh      # exit 0 = consistent, 1 = drift found
+tools/branding.conf         the names, and what derives from what
+tools/branding-sites.tsv    where each name has to appear, and in what form
+tools/brand-plugin.sh       changes names
+tools/check-branding.sh     verifies them
 ```
 
-It covers the identity a host actually sees (package and bundle names, `Plugin::NAME`,
+```bash
-`VENDOR`, `EMAIL`, `CLAP_ID`, `VST3_CLASS_ID`, the descriptions) and the Rust type names
+sh tools/brand-plugin.sh                         # interactive; Enter keeps a value
-(`MyPlugin`, `PluginParams`) at every site they appear. Renaming the types is cosmetic —
+sh tools/brand-plugin.sh --display "Fuzz Box"    # or non-interactive; dry run
-no host ever sees them — but leaving `MyPlugin` in a shipped plugin is the kind of residue
+sh tools/brand-plugin.sh --display "Fuzz Box" --apply
-that says nobody read the file. Leave them as-is and those checks simply stay green.
+sh tools/check-branding.sh                       # exit 0 = consistent, 1 = drift
+```
 
-To rename: edit the canonical block at the top of the script, run it, and fix everything
+**One name drives the rest.** `PLUGIN_NAME` derives the package name (`Fuzz Box` →
-it reports. The placeholder spellings are pre-seeded into its `STALE` list, and each one
+`fuzz_box`), the Rust types (`FuzzBox`, `FuzzBoxParams`) and the display name. Each is
-arms itself as soon as you change the matching canonical value — so leftovers surface
+overridable in `branding.conf`, because the derivation is sometimes wrong and sometimes
-without you having to track them. It also asserts `VST3_CLASS_ID` is exactly 16 bytes and
+outright invalid — `206 Prototype` derives to `206_prototype`, which Cargo rejects since a
-that `CLAP_ID` is reverse-DNS safe, both of which are otherwise a compile error or a
+package name cannot start with a digit. The helper refuses those, along with Rust keywords
-silent identity change between machines.
+and built-in crate names.
 
-Checks for files the template doesn't ship (e.g. a `deploy.ps1`) report as `skip` and
+**The checker does both halves.** Every canonical value is asserted *present* where it
-start enforcing once you add them.
+belongs, and every retired spelling is swept for. Absence alone is not enough: renaming to
+the wrong new spelling would pass a stale-sweep and still break CI.
+
+**Two things it will not do for you.** `CLAP_ID` and `VST3_CLASS_ID` are how hosts recognise
+saved projects and presets — change either and every existing session silently loses the
+plugin, with no error. They need `--allow-identity-change`, and the 16-byte class ID is
+*proposed* rather than derived, because that choice is yours. And `CLAP_DESCRIPTION` is
+rejected if it carries a retired name or the repo codename: hosts show it to users who never
+knew your development history.
+
+**The repo name is deliberately not derived.** It is fixed when the repo is created and keeps
+its development codename while the plugin gets a product name. `CODENAME` records it so it
+can be kept out of user-facing text.
+
+Adding a site the template doesn't ship is one row in `branding-sites.tsv` with owner
+`custom` — no shell to edit, and it survives regeneration. Rows the helper owns are rewritten
+on each rename; custom rows are carried through and value-substituted like any other file.
+Both files can be hand-edited; the helper is what keeps them agreeing, so run the checker
+after if you do.
 
 ## Build
 
@@ -105,7 +127,7 @@ bundler.toml        # Bundle name for `cargo xtask bundle`
 src/lib.rs          # Plugin skeleton — params, DSP, and egui editor, with one example gain param
 xtask/              # Bundler xtask (cargo xtask bundle)
 .cargo/config.toml  # xtask alias
-check-branding.sh   # Asserts the plugin's identity strings agree everywhere (see Renaming)
+tools/              # Branding toolkit — see Renaming
 .gitattributes      # Pins *.sh to LF so Windows checkouts keep a valid shebang
 .github/workflows/  # CI: branding check, both feature sets build, test, bundle
 ```

check-branding.sh

@@ -1,208 +0,0 @@
-#!/bin/sh
-# SPDX-License-Identifier: GPL-3.0-or-later
-# check-branding.sh - verify the plugin's branding/identity strings agree everywhere.
-#
-# Plugin branding is duplicated across the build manifest, the bundler manifest,
-# the source, the docs and (once you add one) the deploy script. Nothing makes
-# them agree, so a rename drifts silently: the bundle builds under one name and
-# the deploy script looks for another. This asserts they match, and that the
-# identity constants are legal.
-#
-# In a template this matters more than usual: renaming is the first thing you do
-# with this repo, and it touches every file below. Run this immediately after,
-# and the STALE machinery will list whatever you missed.
-#
-# Usage: sh check-branding.sh          (exit 0 = consistent, 1 = drift found)
-#
-# ---------------------------------------------------------------------------
-# CANONICAL IDENTITY - the single source of truth. Edit these to rename, then
-# run this script; every failure it prints is a place still holding the old name.
-# ---------------------------------------------------------------------------
-
-PKG="nih_plug_template"                     # Cargo package name == bundler.toml table key
-DISPLAY="Plugin Name"                       # bundle name -> "<DISPLAY>.vst3" / "<DISPLAY>.clap"
-PLUGIN_NAME="Plugin Name"                   # Plugin::NAME - what the DAW displays
-VENDOR="Your Name"                          # Plugin::VENDOR
-EMAIL="your@email.com"                      # Plugin::EMAIL
-HOMEPAGE="https://github.com/YOUR-USERNAME/YOUR-PLUGIN-NAME"  # Cargo homepage -> Plugin::URL
-CLAP_ID="com.your-domain.plugin-name"       # CLAP_ID - stable plugin identity
-VST3_CLASS_ID="Unique16CharId!!"            # VST3_CLASS_ID - stable identity, MUST be 16 bytes
-DESCRIPTION="A minimal NIH-plug audio plugin"     # Cargo package description
-CLAP_DESCRIPTION="Your plugin description"        # CLAP_DESCRIPTION - shown in some host browsers
-
-# Rust type names. These never reach a host, so renaming them is cosmetic - but
-# leaving "MyPlugin" in a shipped plugin is the sort of residue that says nobody
-# read the file. Change these to make the checks below enforce your own names;
-# leave them alone and they simply stay green.
-STRUCT="MyPlugin"                           # the Plugin impl target
-PARAMS_STRUCT="PluginParams"                # the Params impl target
-
-# Spellings that must no longer appear anywhere in tracked files. Seeded with
-# this template's own placeholders, so that renaming is self-checking: each entry
-# is skipped while it is still one of the canonical values above, and becomes a
-# live check the moment you change that value. Add your own old names here after
-# a later rename.
-STALE="nih_plug_template
-MyPlugin
-PluginParams
-A minimal NIH-plug audio plugin
-Your plugin description
-Plugin Name
-Your Name
-your@email.com
-com.your-domain.plugin-name
-Unique16CharId!!
-YOUR-USERNAME
-YOUR-PLUGIN-NAME
-your-domain"
-
-set -u
-cd "$(dirname "$0")" || exit 1
-
-pass=0; fail=0; skip=0
-ok()   { pass=$((pass+1)); printf '  ok    %s\n' "$1"; }
-bad()  { fail=$((fail+1)); printf '  FAIL  %s\n' "$1"; [ $# -gt 1 ] && printf '        %s\n' "$2"; return 0; }
-note() { skip=$((skip+1)); printf '  skip  %s\n' "$1"; }
-# Reported for awareness only - never counted, never fails the run.
-info() { printf '  --    %s\n' "$1"; }
-
-# has FILE PATTERN -> fixed-string search
-has() { grep -qF "$2" "$1" 2>/dev/null; }
-
-check() { # check LABEL FILE LITERAL
-  if [ ! -f "$2" ]; then bad "$1" "missing file: $2"; return; fi
-  if has "$2" "$3"; then ok "$1"; else bad "$1" "$2 does not contain: $3"; fi
-}
-
-# Same as check, but a missing file is "not applicable yet" rather than drift.
-# The template ships without a deploy script; this starts checking once you add one.
-opt_check() { # opt_check LABEL FILE LITERAL
-  if [ ! -f "$2" ]; then note "$1 ($2 not present)"; return; fi
-  if has "$2" "$3"; then ok "$1"; else bad "$1" "$2 does not contain: $3"; fi
-}
-
-printf 'branding check (canonical: %s / "%s")\n\n' "$PKG" "$DISPLAY"
-
-printf 'build manifests\n'
-check "Cargo.toml package name"   Cargo.toml   "name = \"$PKG\""
-check "Cargo.toml homepage"       Cargo.toml   "homepage = \"$HOMEPAGE\""
-check "Cargo.toml description"    Cargo.toml   "description = \"$DESCRIPTION\""
-check "bundler.toml table key"    bundler.toml "[$PKG]"
-check "bundler.toml display name" bundler.toml "name = \"$DISPLAY\""
-
-printf '\nsource identity (src/lib.rs)\n'
-check "Plugin::NAME"    src/lib.rs "const NAME: &'static str = \"$PLUGIN_NAME\""
-check "Plugin::VENDOR"  src/lib.rs "const VENDOR: &'static str = \"$VENDOR\""
-check "Plugin::EMAIL"   src/lib.rs "const EMAIL: &'static str = \"$EMAIL\""
-check "CLAP_ID"         src/lib.rs "const CLAP_ID: &'static str = \"$CLAP_ID\""
-check "CLAP_DESCRIPTION" src/lib.rs "const CLAP_DESCRIPTION: Option<&'static str> = Some(\"$CLAP_DESCRIPTION\")"
-check "VST3_CLASS_ID"   src/lib.rs "const VST3_CLASS_ID: [u8; 16] = *b\"$VST3_CLASS_ID\""
-
-# Plugin::URL is env!("CARGO_PKG_HOMEPAGE"), so the manifest is the only place
-# it is spelled. Assert the indirection is still in place rather than hardcoded.
-check "Plugin::URL from manifest" src/lib.rs "const URL: &'static str = env!(\"CARGO_PKG_HOMEPAGE\")"
-
-# VST3 class IDs are a fixed 16-byte array. A shorter or longer literal is a
-# compile error, but it is far clearer to say so here than to read rustc on it.
-n=$(printf '%s' "$VST3_CLASS_ID" | wc -c | tr -d ' ')
-if [ "$n" -eq 16 ]; then ok "VST3_CLASS_ID is 16 bytes"
-else bad "VST3_CLASS_ID is 16 bytes" "got $n bytes: \"$VST3_CLASS_ID\""; fi
-
-# CLAP IDs are reverse-DNS by convention and are compared verbatim by hosts, so
-# a stray space or capital is a silent identity change between machines.
-case "$CLAP_ID" in
-  *\ *|*[A-Z]*) bad "CLAP_ID is reverse-DNS safe" "no spaces or capitals allowed: \"$CLAP_ID\"" ;;
-  *.*)          ok  "CLAP_ID is reverse-DNS safe" ;;
-  *)            bad "CLAP_ID is reverse-DNS safe" "expected dotted reverse-DNS, got: \"$CLAP_ID\"" ;;
-esac
-
-printf '\nstructural names (src/lib.rs)\n'
-# Every site the type names appear. A rename that misses one is a compile error
-# rather than silent drift, but naming the site is faster than reading rustc,
-# and the Vst3Plugin impl sits behind a cfg so a default build never reports it.
-check "struct $STRUCT"              src/lib.rs "struct $STRUCT {"
-check "impl Plugin"                 src/lib.rs "impl Plugin for $STRUCT {"
-check "impl ClapPlugin"             src/lib.rs "impl ClapPlugin for $STRUCT {"
-check "impl Vst3Plugin"             src/lib.rs "impl Vst3Plugin for $STRUCT {"
-check "nih_export_clap!"            src/lib.rs "nih_export_clap!($STRUCT);"
-check "nih_export_vst3!"            src/lib.rs "nih_export_vst3!($STRUCT);"
-check "struct $PARAMS_STRUCT"       src/lib.rs "struct $PARAMS_STRUCT {"
-check "impl Default for params"     src/lib.rs "impl Default for $PARAMS_STRUCT {"
-check "params field type"           src/lib.rs "params: Arc<$PARAMS_STRUCT>,"
-
-printf '\ndocs\n'
-opt_check "README bundle command" README.md "cargo xtask bundle $PKG"
-
-printf '\ndeploy script\n'
-opt_check "deploy.ps1 default package" deploy.ps1 "\$Package = \"$PKG\""
-opt_check "deploy.ps1 VST3 bundle"     deploy.ps1 "\$vst3Name = \"$DISPLAY.vst3\""
-opt_check "deploy.ps1 CLAP bundle"     deploy.ps1 "\$clapName = \"$DISPLAY.clap\""
-
-printf '\nstale spellings\n'
-# File list for the scan below. Prefer git, so build output and any vendored
-# tree stay out of it. Fall back to find when this is not a checkout - an
-# exported tarball, or a CI step that fetched without git metadata - because
-# `git ls-files` there returns nothing, and an empty list would report every
-# stale spelling as absent. A check that passes hardest when it can see least
-# is worse than no check.
-if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-  file_list() { git ls-files; }
-  scan_source="git"
-else
-  file_list() { find . -path ./.git -prune -o -path ./target -prune -o -type f -print | sed 's|^\./||'; }
-  scan_source="find (not a git checkout)"
-fi
-info "scanning tracked files via $scan_source"
-# Every canonical spelling concatenated, for the substring test below.
-CANONICAL_BLOB="$PKG
-$DESCRIPTION
-$CLAP_DESCRIPTION
-$STRUCT
-$PARAMS_STRUCT
-$DISPLAY
-$PLUGIN_NAME
-$VENDOR
-$EMAIL
-$HOMEPAGE
-$CLAP_ID
-$VST3_CLASS_ID"
-# Fed by here-doc rather than a pipe on purpose: a piped `while` runs in a
-# subshell, and the pass/fail counters it increments would be discarded.
-while IFS= read -r s; do
-  [ -n "$s" ] || continue
-
-  # Still part of a canonical value? Then it is current branding, not a leftover.
-  # This is what lets the list ship pre-seeded: entries arm themselves as you
-  # rename. Substring, not equality, because placeholders nest - "your-domain"
-  # lives inside the canonical CLAP_ID, and "YOUR-USERNAME" inside the homepage.
-  # Over-skipping is the safe direction: a false FAIL on a name you still use
-  # would train you to ignore this section.
-  case "$CANONICAL_BLOB" in
-    *"$s"*) note "\"$s\" (still canonical)"; continue ;;
-  esac
-
-  # This script names every placeholder by definition, so it can never be a hit.
-  hits=$(file_list 2>/dev/null | while read -r f; do
-           [ "$f" = "check-branding.sh" ] || { [ -f "$f" ] && grep -lF "$s" "$f" 2>/dev/null; }
-         done)
-  if [ -z "$hits" ]; then ok "no occurrences of \"$s\""
-  else bad "no occurrences of \"$s\"" "still present in: $(echo "$hits" | tr '\n' ' ')"; fi
-done <<STALE_LIST
-$STALE
-STALE_LIST
-
-# Template scaffolding, not drift: TODOs are legitimate while you are still
-# building. Reported so a finished plugin does not quietly ship with them.
-# `grep -c` prints 0 AND exits 1 when there are no matches, so `|| echo 0`
-# would append a second zero and make the count unparseable. Swallow the
-# status instead, and default an empty result (missing file) to zero.
-todos=$(grep -c 'TODO' src/lib.rs 2>/dev/null || :)
-[ -n "$todos" ] || todos=0
-printf '\nscaffolding\n'
-if [ "$todos" -eq 0 ]; then ok "no TODO markers left in src/lib.rs"
-else info "$todos TODO marker(s) still in src/lib.rs (not a failure)"; fi
-
-printf '\n%d passed, %d failed' "$pass" "$fail"
-[ "$skip" -gt 0 ] && printf ', %d skipped' "$skip"
-printf '\n'
-[ "$fail" -eq 0 ] || exit 1

tools/brand-plugin.sh

@@ -0,0 +1,303 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-3.0-or-later
+# brand-plugin.sh - rename this plugin, everywhere, in one go.
+#
+# check-branding.sh tells you what disagrees. This changes it. They share
+# branding.conf: this script rewrites that file and every copy of the old values
+# in tracked files, then runs the checker and reports what it says. A run that
+# ends with the checker green is a rename that landed.
+#
+# Dry run by default:
+#   sh brand-plugin.sh --display "Bari 206"
+#   sh brand-plugin.sh --display "Bari 206" --vendor Novoyuuparosk --apply
+#
+# Options:
+#   --display NAME    the product name, with spaces and capitals. Everything
+#                     else that can be derived, is derived from this.
+#   --pkg NAME        override the derived Cargo package name.
+#   --vendor NAME     --email ADDR    --homepage URL
+#   --description D   --clap-description D
+#   --struct NAME     override the derived Rust type name.
+#   --allow-identity-change   permit CLAP_ID / VST3_CLASS_ID to move. See below.
+#   --apply           actually write. Without it, nothing is modified.
+
+set -u
+# Resolve the repo root: these live in tools/, every path they touch is
+# repo-relative, and they must behave the same wherever they are invoked from.
+cd "$(dirname "$0")/.." || exit 1
+[ -f tools/branding.conf ] || { printf 'tools/branding.conf not found\n' >&2; exit 1; }
+# shellcheck disable=SC1091
+. ./tools/branding.conf
+
+OLD_PKG="$PKG"; OLD_DISPLAY="$DISPLAY"; OLD_PLUGIN_NAME="$PLUGIN_NAME"
+OLD_VENDOR="$VENDOR"; OLD_EMAIL="$EMAIL"; OLD_HOMEPAGE="$HOMEPAGE"
+OLD_DESCRIPTION="$DESCRIPTION"; OLD_CLAP_DESCRIPTION="$CLAP_DESCRIPTION"
+OLD_CLAP_ID="$CLAP_ID"; OLD_VST3="$VST3_CLASS_ID"
+OLD_STRUCT="$STRUCT"; OLD_PARAMS_STRUCT="$PARAMS_STRUCT"
+
+new_display=""; new_pkg=""; new_vendor=""; new_email=""; new_homepage=""
+new_description=""; new_clap_description=""; new_struct=""
+new_clap_id=""; new_vst3=""; apply=0; allow_identity=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --display)           new_display="${2:?}"; shift 2 ;;
+    --pkg)               new_pkg="${2:?}"; shift 2 ;;
+    --vendor)            new_vendor="${2:?}"; shift 2 ;;
+    --email)             new_email="${2:?}"; shift 2 ;;
+    --homepage)          new_homepage="${2:?}"; shift 2 ;;
+    --description)       new_description="${2:?}"; shift 2 ;;
+    --clap-description)  new_clap_description="${2:?}"; shift 2 ;;
+    --struct)            new_struct="${2:?}"; shift 2 ;;
+    --clap-id)           new_clap_id="${2:?}"; shift 2 ;;
+    --vst3-class-id)     new_vst3="${2:?}"; shift 2 ;;
+    --allow-identity-change) allow_identity=1; shift ;;
+    --apply)             apply=1; shift ;;
+    -h|--help)           sed -n '3,25p' "$0"; exit 0 ;;
+    *) printf 'unknown option: %s\n' "$1" >&2; exit 2 ;;
+  esac
+done
+
+# Interactive when nothing was passed and there is a terminal to ask at. Every
+# prompt offers the current value; Enter keeps it, so a run that answers nothing
+# is a no-op rather than a surprise. Optional fields additionally accept "-" to
+# clear them.
+ask() { # ask VARNAME PROMPT CURRENT
+  printf '  %s [%s]: ' "$2" "$3" > /dev/tty
+  IFS= read -r _reply < /dev/tty || _reply=""
+  [ -n "$_reply" ] || _reply="$3"
+  [ "$_reply" = "-" ] && _reply=""
+  eval "$1=\$_reply"
+}
+if [ -z "$new_display" ] && [ -t 0 ] && [ -c /dev/tty ]; then
+  printf 'branding this plugin - Enter keeps the current value, "-" clears an optional one\n\n'
+  ask new_display          "display name    " "$OLD_DISPLAY"
+  ask new_vendor           "vendor          " "$OLD_VENDOR"
+  ask new_email            "email           " "$OLD_EMAIL"
+  ask new_homepage         "homepage        " "$OLD_HOMEPAGE"
+  ask new_description      "cargo description" "$OLD_DESCRIPTION"
+  ask new_clap_description "clap description" "$OLD_CLAP_DESCRIPTION"
+  printf '\n'
+fi
+[ -n "$new_display" ] || { printf 'nothing to do: pass --display "New Name" (or run interactively)\n' >&2; exit 2; }
+
+# --- derivation -------------------------------------------------------------
+# Package name: lowercase, every run of non-alphanumerics becomes one separator,
+# ends trimmed. Cargo accepts both hyphens and underscores in a package name and
+# converts to underscores for the built artifact, which nih_plug_xtask already
+# accounts for; underscores are used here to match the Rust convention.
+derive_pkg() {
+  printf '%s' "$1" | tr '[:upper:]' '[:lower:]' \
+    | sed -e 's/[^a-z0-9]\{1,\}/_/g' -e 's/^_//' -e 's/_$//'
+}
+# Rust type name: CamelCase, non-alphanumerics dropped entirely.
+derive_struct() {
+  printf '%s' "$1" | sed -e 's/[^A-Za-z0-9]\{1,\}/ /g' \
+    | awk '{for(i=1;i<=NF;i++) printf "%s%s", toupper(substr($i,1,1)), substr($i,2); print ""}'
+}
+[ -n "$new_pkg" ]    || new_pkg=$(derive_pkg "$new_display")
+[ -n "$new_struct" ] || new_struct=$(derive_struct "$new_display")
+new_params_struct="${new_struct}Params"
+[ -n "$new_vendor" ]      || new_vendor="$OLD_VENDOR"
+[ -n "$new_email" ]       || new_email="$OLD_EMAIL"
+[ -n "$new_homepage" ]    || new_homepage="$OLD_HOMEPAGE"
+[ -n "$new_description" ] || new_description="$OLD_DESCRIPTION"
+[ -n "$new_clap_description" ] || new_clap_description="$OLD_CLAP_DESCRIPTION"
+
+# --- validation -------------------------------------------------------------
+fail=0
+die() { printf '  INVALID  %s\n' "$1"; fail=$((fail+1)); }
+
+case "$new_pkg" in
+  "")        die "derived package name is empty" ;;
+  [0-9]*)    die "package name \"$new_pkg\" starts with a digit - cargo rejects this outright" ;;
+esac
+case "$new_pkg" in
+  test|core|std|alloc|proc_macro)
+    die "package name \"$new_pkg\" collides with a built-in crate" ;;
+  as|break|const|continue|crate|dyn|else|enum|extern|false|fn|for|if|impl|in|let|loop|match|mod|move|mut|pub|ref|return|self|static|struct|super|trait|true|type|unsafe|use|where|while|async|await|box|do|final|macro|override|priv|typeof|unsized|virtual|yield|try)
+    die "package name \"$new_pkg\" is a Rust keyword - cargo rejects this" ;;
+esac
+# bundler.toml uses the package name as a TOML bare key.
+case "$new_pkg" in *[!a-zA-Z0-9_-]*) die "package name \"$new_pkg\" is not a valid TOML bare key" ;; esac
+case "$new_struct" in ""|[0-9]*) die "derived type name \"$new_struct\" is not a valid Rust identifier" ;; esac
+
+# --- frozen identity --------------------------------------------------------
+identity_note=""
+if [ -n "$new_clap_id" ] || [ -n "$new_vst3" ]; then
+  if [ "$allow_identity" -eq 0 ]; then
+    die "CLAP_ID / VST3_CLASS_ID are frozen identity; pass --allow-identity-change to move them"
+  fi
+fi
+[ -n "$new_clap_id" ] || new_clap_id="$OLD_CLAP_ID"
+[ -n "$new_vst3" ]    || new_vst3="$OLD_VST3"
+
+# VST3_CLASS_ID is a fixed 16-byte array, so it cannot simply be derived. Propose
+# one from the new name and let a human decide - it is frozen the moment it ships.
+proposed_vst3=$(printf '%s' "${new_struct}Plugin000000000000" | cut -c1-16)
+n=$(printf '%s' "$new_vst3" | wc -c | tr -d ' ')
+[ "$n" -eq 16 ] || die "VST3_CLASS_ID \"$new_vst3\" is $n bytes, must be exactly 16"
+
+case "$new_clap_id" in
+  *\ *|*[A-Z]*) die "CLAP_ID \"$new_clap_id\" must be lowercase with no spaces" ;;
+  *.*) ;;
+  *) die "CLAP_ID \"$new_clap_id\" should be dotted reverse-DNS" ;;
+esac
+
+# CLAP_DESCRIPTION is user-facing: keep development history out of it.
+for hist in "$CODENAME" "$OLD_DISPLAY" "$OLD_PKG"; do
+  case "$new_clap_description" in
+    *"$hist"*) die "CLAP_DESCRIPTION still mentions \"$hist\" - it is shown to users, who never knew the development name" ;;
+  esac
+done
+
+# --- plan -------------------------------------------------------------------
+printf 'rename plan\n\n'
+row() { [ "$2" = "$3" ] && printf '  %-18s %s (unchanged)\n' "$1" "$2" || printf '  %-18s %s  ->  %s\n' "$1" "$2" "$3"; }
+row "package"        "$OLD_PKG"             "$new_pkg"
+row "display"        "$OLD_DISPLAY"         "$new_display"
+row "Plugin::NAME"   "$OLD_PLUGIN_NAME"     "$new_display"
+row "vendor"         "$OLD_VENDOR"          "$new_vendor"
+row "email"          "$OLD_EMAIL"           "$new_email"
+row "homepage"       "$OLD_HOMEPAGE"        "$new_homepage"
+row "description"    "$OLD_DESCRIPTION"     "$new_description"
+row "clap desc"      "$OLD_CLAP_DESCRIPTION" "$new_clap_description"
+row "struct"         "$OLD_STRUCT"          "$new_struct"
+row "params struct"  "$OLD_PARAMS_STRUCT"   "$new_params_struct"
+row "CLAP_ID"        "$OLD_CLAP_ID"         "$new_clap_id"
+row "VST3_CLASS_ID"  "$OLD_VST3"            "$new_vst3"
+printf '\n  repo codename stays %s - fixed at creation, never renamed\n' "$CODENAME"
+if [ "$new_vst3" = "$OLD_VST3" ]; then
+  printf '  suggested VST3_CLASS_ID for this name (16 bytes): "%s"\n' "$proposed_vst3"
+  printf '    apply with --vst3-class-id "%s" --allow-identity-change, and only before first release\n' "$proposed_vst3"
+fi
+
+if [ "$fail" -ne 0 ]; then
+  printf '\n%d problem(s); nothing written.\n' "$fail"
+  exit 1
+fi
+
+if [ "$apply" -eq 0 ]; then
+  printf '\nDry run. Re-run with --apply to write these changes.\n'
+  exit 0
+fi
+
+# --- apply ------------------------------------------------------------------
+# Longest values first: a shorter spelling can be a substring of a longer one
+# (the package name inside a URL, say), and replacing it first would corrupt the
+# longer match. branding.conf is excluded and rewritten wholesale below, so its
+# STALE list is never rewritten into meaninglessness.
+subst_file="$(mktemp)"
+trap 'rm -f "$subst_file"' EXIT
+{
+  printf '%s\t%s\n' "$OLD_CLAP_ID" "$new_clap_id"
+  printf '%s\t%s\n' "$OLD_HOMEPAGE" "$new_homepage"
+  printf '%s\t%s\n' "$OLD_CLAP_DESCRIPTION" "$new_clap_description"
+  printf '%s\t%s\n' "$OLD_DESCRIPTION" "$new_description"
+  printf '%s\t%s\n' "$OLD_PARAMS_STRUCT" "$new_params_struct"
+  printf '%s\t%s\n' "$OLD_VST3" "$new_vst3"
+  printf '%s\t%s\n' "$OLD_PLUGIN_NAME" "$new_display"
+  printf '%s\t%s\n' "$OLD_DISPLAY" "$new_display"
+  printf '%s\t%s\n' "$OLD_STRUCT" "$new_struct"
+  printf '%s\t%s\n' "$OLD_EMAIL" "$new_email"
+  printf '%s\t%s\n' "$OLD_VENDOR" "$new_vendor"
+  printf '%s\t%s\n' "$OLD_PKG" "$new_pkg"
+} | awk -F'\t' '$1 != $2 { print length($1)"\t"$0 }' | sort -rn | cut -f2- > "$subst_file"
+
+changed=0
+git ls-files 2>/dev/null | while IFS= read -r f; do
+  [ -f "$f" ] || continue
+  # branding.conf alone is excluded: it is rewritten wholesale below, and its
+  # STALE list names every retired spelling by design. The site table IS
+  # substituted, so hand-added custom rows track the rename; owned rows are
+  # regenerated afterwards regardless.
+  case "$f" in tools/branding.conf) continue ;; esac
+  before=$(cat "$f")
+  after="$before"
+  while IFS="$(printf '\t')" read -r old new; do
+    [ -n "$old" ] || continue
+    after=$(printf '%s' "$after" | sed "s|$(printf '%s' "$old" | sed 's/[][\.*^$/|&]/\\&/g')|$(printf '%s' "$new" | sed 's/[\\/&|]/\\&/g')|g")
+  done < "$subst_file"
+  if [ "$before" != "$after" ]; then printf '%s\n' "$after" > "$f"; printf '  rewrote %s\n' "$f"; fi
+done
+
+# branding.conf last, with the retired spellings appended to STALE so the next
+# run of the checker sweeps for anything this pass missed.
+# Deduplicated: two fields can retire to the same spelling - DISPLAY and
+# PLUGIN_NAME are commonly identical - and listing it twice makes the checker
+# report the same drift twice. Note that neither this script nor the checker
+# contains a branding literal anywhere: both read every name from
+# branding.conf, so a rename never has to rewrite its own tooling.
+retired=$(cut -f1 "$subst_file" | awk '!seen[$0]++')
+sed -e "s|^PKG=.*|PKG=\"$new_pkg\"|" \
+    -e "s|^DISPLAY=.*|DISPLAY=\"$new_display\"|" \
+    -e "s|^PLUGIN_NAME=.*|PLUGIN_NAME=\"$new_display\"|" \
+    -e "s|^VENDOR=.*|VENDOR=\"$new_vendor\"|" \
+    -e "s|^EMAIL=.*|EMAIL=\"$new_email\"|" \
+    -e "s|^HOMEPAGE=.*|HOMEPAGE=\"$new_homepage\"|" \
+    -e "s|^DESCRIPTION=.*|DESCRIPTION=\"$new_description\"|" \
+    -e "s|^CLAP_DESCRIPTION=.*|CLAP_DESCRIPTION=\"$new_clap_description\"|" \
+    -e "s|^CLAP_ID=.*|CLAP_ID=\"$new_clap_id\"|" \
+    -e "s|^VST3_CLASS_ID=.*|VST3_CLASS_ID=\"$new_vst3\"|" \
+    -e "s|^STRUCT=.*|STRUCT=\"$new_struct\"|" \
+    -e "s|^PARAMS_STRUCT=.*|PARAMS_STRUCT=\"$new_params_struct\"|" \
+    tools/branding.conf > tools/branding.conf.new
+{ sed '$ s/"$//' tools/branding.conf.new; printf '%s"\n' "$retired"; } > tools/branding.conf
+rm -f tools/branding.conf.new
+printf '  rewrote tools/branding.conf (retired spellings appended to STALE)\n'
+
+# Regenerate the site table. Rows whose owner this script recognises are
+# rewritten with the new resolved literals; every other row - anything marked
+# custom, or added by hand for a file this template does not ship - is carried
+# through untouched. Clobbering those silently is how a tool stops being trusted.
+sites="tools/branding-sites.tsv"
+gen="$(mktemp)"; keep="$(mktemp)"
+trap 'rm -f "$subst_file" "$gen" "$keep"' EXIT
+T="$(printf '\t')"
+{
+  printf 'req%spkg.cargo%sCargo.toml%sname = "%s"\n'            "$T" "$T" "$T" "$new_pkg"
+  printf 'req%spkg.bundler%sbundler.toml%s[%s]\n'               "$T" "$T" "$T" "$new_pkg"
+  printf 'opt%spkg.lock%sCargo.lock%sname = "%s"\n'             "$T" "$T" "$T" "$new_pkg"
+  printf 'opt%spkg.ci%s.github/workflows/ci.yaml%scargo xtask bundle %s\n' "$T" "$T" "$T" "$new_pkg"
+  printf 'opt%spkg.readme%sREADME.md%scargo xtask bundle %s\n'  "$T" "$T" "$T" "$new_pkg"
+  printf 'req%sdisplay.bundler%sbundler.toml%sname = "%s"\n'    "$T" "$T" "$T" "$new_display"
+  printf 'opt%sdisplay.notice%sNOTICE%s%s\n'                    "$T" "$T" "$T" "$new_display"
+  printf 'req%sname.plugin%s%s%sconst NAME: &'"'"'static str = "%s"\n'        "$T" "$T" "$LIB_FILE" "$T" "$new_display"
+  printf 'req%svendor.plugin%s%s%sconst VENDOR: &'"'"'static str = "%s"\n'    "$T" "$T" "$LIB_FILE" "$T" "$new_vendor"
+  printf 'req%semail.plugin%s%s%sconst EMAIL: &'"'"'static str = "%s"\n'      "$T" "$T" "$LIB_FILE" "$T" "$new_email"
+  printf 'req%sauthors.cargo%sCargo.toml%sauthors = ["%s <%s>"]\n' "$T" "$T" "$T" "$new_vendor" "$new_email"
+  printf 'req%shomepage.cargo%sCargo.toml%shomepage = "%s"\n'   "$T" "$T" "$T" "$new_homepage"
+  printf 'req%surl.plugin%s%s%sconst URL: &'"'"'static str = env!("CARGO_PKG_HOMEPAGE")\n' "$T" "$T" "$LIB_FILE" "$T"
+  printf 'req%sdescription.cargo%sCargo.toml%sdescription = "%s"\n' "$T" "$T" "$T" "$new_description"
+  printf 'req%sdescription.clap%s%s%sconst CLAP_DESCRIPTION: Option<&'"'"'static str> = Some("%s")\n' "$T" "$T" "$LIB_FILE" "$T" "$new_clap_description"
+  printf 'req%sclapid.plugin%s%s%sconst CLAP_ID: &'"'"'static str = "%s"\n'  "$T" "$T" "$LIB_FILE" "$T" "$new_clap_id"
+  printf 'req%svst3id.plugin%s%s%sconst VST3_CLASS_ID: [u8; 16] = *b"%s"\n'  "$T" "$T" "$LIB_FILE" "$T" "$new_vst3"
+  printf 'req%sstruct.def%s%s%sstruct %s {\n'                   "$T" "$T" "$LIB_FILE" "$T" "$new_struct"
+  printf 'req%sstruct.plugin%s%s%simpl Plugin for %s {\n'       "$T" "$T" "$LIB_FILE" "$T" "$new_struct"
+  printf 'req%sstruct.clap%s%s%simpl ClapPlugin for %s {\n'     "$T" "$T" "$LIB_FILE" "$T" "$new_struct"
+  printf 'req%sstruct.vst3%s%s%simpl Vst3Plugin for %s {\n'     "$T" "$T" "$LIB_FILE" "$T" "$new_struct"
+  printf 'req%sstruct.exportclap%s%s%snih_export_clap!(%s);\n'  "$T" "$T" "$LIB_FILE" "$T" "$new_struct"
+  printf 'req%sstruct.exportvst3%s%s%snih_export_vst3!(%s);\n'  "$T" "$T" "$LIB_FILE" "$T" "$new_struct"
+  printf 'req%sparams.def%s%s%sstruct %s {\n'                   "$T" "$T" "$PARAMS_FILE" "$T" "$new_params_struct"
+  printf 'req%sparams.default%s%s%simpl Default for %s {\n'     "$T" "$T" "$PARAMS_FILE" "$T" "$new_params_struct"
+  printf 'req%sparams.field%s%s%sparams: Arc<%s>,\n'            "$T" "$T" "$LIB_FILE" "$T" "$new_params_struct"
+  printf 'opt%sdeploy.pkg%sdeploy.ps1%s$Package = "%s"\n'       "$T" "$T" "$T" "$new_pkg"
+  printf 'opt%sdeploy.vst3%sdeploy.ps1%s$vst3Name = "%s.vst3"\n' "$T" "$T" "$T" "$new_display"
+  printf 'opt%sdeploy.clap%sdeploy.ps1%s$clapName = "%s.clap"\n' "$T" "$T" "$T" "$new_display"
+} > "$gen"
+
+owned=$(cut -f2 "$gen")
+if [ -f "$sites" ]; then
+  grep '^#' "$sites" > "$keep" 2>/dev/null || : > "$keep"
+  while IFS="$T" read -r k o f pat; do
+    case "$k" in ''|\#*) continue ;; esac
+    printf '%s\n' "$owned" | grep -qxF "$o" || printf '%s%s%s%s%s%s%s\n' "$k" "$T" "$o" "$T" "$f" "$T" "$pat" >> "$keep"
+  done < "$sites"
+else
+  : > "$keep"
+fi
+{ cat "$keep"; cat "$gen"; } > "$sites"
+printf '  rewrote %s (%s owned rows, %s preserved)\n' "$sites" "$(wc -l < "$gen" | tr -d ' ')" "$(grep -cv '^#' "$keep" 2>/dev/null || echo 0)"
+
+printf '\nverifying with check-branding.sh\n\n'
+sh tools/check-branding.sh

tools/branding-sites.tsv

@@ -0,0 +1,45 @@
+# branding-sites.tsv - every place a canonical name has to appear, and in what form.
+#
+# Generated and refreshed by tools/brand-plugin.sh; read by tools/check-branding.sh,
+# which asserts each pattern is present in its file. Tab-separated, four columns:
+#
+#   kind    req = a missing file is a failure; opt = a missing file is a skip
+#   owner   the brand-plugin.sh rule that manages this row, or "custom" for rows
+#           you added by hand. Custom rows are preserved across regeneration;
+#           owned rows are overwritten, so do not hand-edit those.
+#   file    repo-relative path
+#   pattern literal text that must appear in that file, already resolved
+#
+# Adding a site for something the template does not ship is a one-line edit here
+# with owner "custom" - no shell to change, and it survives the next rename.
+#
+#kind	owner	file	pattern
+req	pkg.cargo	Cargo.toml	name = "nih_plug_template"
+req	pkg.bundler	bundler.toml	[nih_plug_template]
+opt	pkg.lock	Cargo.lock	name = "nih_plug_template"
+opt	pkg.ci	.github/workflows/ci.yaml	cargo xtask bundle nih_plug_template
+opt	pkg.readme	README.md	cargo xtask bundle nih_plug_template
+req	display.bundler	bundler.toml	name = "Plugin Name"
+opt	display.notice	NOTICE	Plugin Name
+req	name.plugin	src/lib.rs	const NAME: &'static str = "Plugin Name"
+req	vendor.plugin	src/lib.rs	const VENDOR: &'static str = "Your Name"
+req	email.plugin	src/lib.rs	const EMAIL: &'static str = "your@email.com"
+req	authors.cargo	Cargo.toml	authors = ["Your Name <your@email.com>"]
+req	homepage.cargo	Cargo.toml	homepage = "https://github.com/YOUR-USERNAME/YOUR-PLUGIN-NAME"
+req	url.plugin	src/lib.rs	const URL: &'static str = env!("CARGO_PKG_HOMEPAGE")
+req	description.cargo	Cargo.toml	description = "A minimal NIH-plug audio plugin"
+req	description.clap	src/lib.rs	const CLAP_DESCRIPTION: Option<&'static str> = Some("Your plugin description")
+req	clapid.plugin	src/lib.rs	const CLAP_ID: &'static str = "com.your-domain.plugin-name"
+req	vst3id.plugin	src/lib.rs	const VST3_CLASS_ID: [u8; 16] = *b"Unique16CharId!!"
+req	struct.def	src/lib.rs	struct MyPlugin {
+req	struct.plugin	src/lib.rs	impl Plugin for MyPlugin {
+req	struct.clap	src/lib.rs	impl ClapPlugin for MyPlugin {
+req	struct.vst3	src/lib.rs	impl Vst3Plugin for MyPlugin {
+req	struct.exportclap	src/lib.rs	nih_export_clap!(MyPlugin);
+req	struct.exportvst3	src/lib.rs	nih_export_vst3!(MyPlugin);
+req	params.def	src/lib.rs	struct PluginParams {
+req	params.default	src/lib.rs	impl Default for PluginParams {
+req	params.field	src/lib.rs	params: Arc<PluginParams>,
+opt	deploy.pkg	deploy.ps1	$Package = "nih_plug_template"
+opt	deploy.vst3	deploy.ps1	$vst3Name = "Plugin Name.vst3"
+opt	deploy.clap	deploy.ps1	$clapName = "Plugin Name.clap"

tools/branding.conf

@@ -0,0 +1,90 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+# branding.conf - this plugin's canonical identity.
+#
+# Managed by tools/brand-plugin.sh, read by tools/check-branding.sh. Hand-editing
+# works and is sometimes the quickest thing, but the helper is what keeps this
+# file, the source tree and tools/branding-sites.tsv agreeing with each other.
+# Edit here and you are on the hook for running the checker afterwards.
+
+# --- derivations ------------------------------------------------------------
+# Defined before the values so the defaults below can use them.
+# Package name: lowercased, every run of non-alphanumerics becomes one
+# underscore. Cargo accepts hyphens too and maps them to underscores for the
+# built artifact, which nih_plug_xtask already handles; underscores are used to
+# match the Rust convention.
+_derive_pkg() {
+  printf '%s' "$1" | tr '[:upper:]' '[:lower:]' \
+    | sed -e 's/[^a-z0-9]\{1,\}/_/g' -e 's/^_//' -e 's/_$//'
+}
+# Rust type name: CamelCase, non-alphanumerics dropped.
+_derive_struct() {
+  printf '%s' "$1" | sed -e 's/[^A-Za-z0-9]\{1,\}/ /g' \
+    | awk '{for(i=1;i<=NF;i++) printf "%s%s", toupper(substr($i,1,1)), substr($i,2); print ""}'
+}
+
+# --- the names ---------------------------------------------------------------
+PLUGIN_NAME="Plugin Name"               # the one name everything else derives from
+VENDOR="Your Name"                      # Plugin::VENDOR - the org, not the person
+EMAIL="your@email.com"                  # Plugin::EMAIL
+HOMEPAGE="https://github.com/YOUR-USERNAME/YOUR-PLUGIN-NAME"   # -> Plugin::URL
+DESCRIPTION="A minimal NIH-plug audio plugin"                  # Cargo description
+
+# What the plugin does *now*. No codename, no "prototype", no "v2 rewrite" -
+# hosts show this to users who never knew any of that. check-branding.sh
+# enforces the mechanical half by rejecting retired names and the repo codename.
+CLAP_DESCRIPTION="Your plugin description"
+
+# --- frozen identity ---------------------------------------------------------
+# Hosts key saved projects and presets off these two. Change either and every
+# existing session silently loses the plugin: the track comes up empty, with no
+# error. Choose once before the first release, then never again.
+# brand-plugin.sh refuses to move them without --allow-identity-change.
+CLAP_ID="com.your-domain.plugin-name"   # reverse-DNS, lowercase, no spaces
+VST3_CLASS_ID="Unique16CharId!!"        # MUST be exactly 16 bytes
+
+# --- fixed at repo creation --------------------------------------------------
+# The repository's own name. Deliberately NOT renamed when the plugin is: the
+# repo keeps its development codename while the plugin gets a product name.
+# Recorded only so it can be kept out of user-facing text.
+CODENAME="nih-plug-template"
+
+# Where the two Rust types are defined. A plugin whose params outgrow lib.rs
+# points PARAMS_FILE at src/params.rs.
+LIB_FILE="src/lib.rs"
+PARAMS_FILE="src/lib.rs"
+
+# --- derived unless overridden -----------------------------------------------
+# Set one only when the derivation is wrong or rejected - a name like
+# "206 Prototype" derives to "206_prototype", which cargo refuses because a
+# package name cannot start with a digit.
+#
+# This template overrides three of them, which a real plugin usually will not:
+# its package and type names are the template's own rather than derived from a
+# product name. Delete these three lines after renaming and the derivations
+# from PLUGIN_NAME take over.
+PKG="nih_plug_template"
+STRUCT="MyPlugin"
+PARAMS_STRUCT="PluginParams"
+# DISPLAY="Plugin Name"      # defaults to PLUGIN_NAME
+: "${DISPLAY:=$PLUGIN_NAME}"
+: "${PKG:=$(_derive_pkg "$PLUGIN_NAME")}"
+: "${STRUCT:=$(_derive_struct "$PLUGIN_NAME")}"
+: "${PARAMS_STRUCT:=${STRUCT}Params}"
+
+# --- retired spellings -------------------------------------------------------
+# Must no longer appear in tracked files. An entry is skipped while it is still
+# part of a canonical value above and arms the moment it stops being one, so a
+# rename is self-checking in both directions. brand-plugin.sh appends here.
+STALE="nih_plug_template
+MyPlugin
+PluginParams
+A minimal NIH-plug audio plugin
+Your plugin description
+Plugin Name
+Your Name
+your@email.com
+com.your-domain.plugin-name
+Unique16CharId!!
+YOUR-USERNAME
+YOUR-PLUGIN-NAME
+your-domain"

tools/check-branding.sh

@@ -0,0 +1,188 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-3.0-or-later
+# check-branding.sh - verify the plugin's branding/identity strings agree everywhere.
+#
+# Plugin branding is duplicated across the build manifest, the bundler manifest,
+# the source, the docs and (once you add one) the deploy script. Nothing makes
+# them agree, so a rename drifts silently: the bundle builds under one name and
+# the deploy script looks for another. This asserts they match, and that the
+# identity constants are legal.
+#
+# In a template this matters more than usual: renaming is the first thing you do
+# with this repo, and it touches every file below. Run this immediately after,
+# and the STALE machinery will list whatever you missed.
+#
+# Usage: sh tools/check-branding.sh          (exit 0 = consistent, 1 = drift found)
+#
+# The canonical identity lives in branding.conf, shared with brand-plugin.sh.
+# Edit it there, then run this to find every copy that still holds the old value.
+
+set -u
+# Resolve the repo root: these live in tools/, every path they touch is
+# repo-relative, and they must behave the same wherever they are invoked from.
+cd "$(dirname "$0")/.." || exit 1
+
+if [ ! -f tools/branding.conf ]; then
+  printf 'tools/branding.conf not found\n' >&2
+  exit 1
+fi
+# shellcheck disable=SC1091
+. ./tools/branding.conf
+
+# Every canonical spelling concatenated, for the substring test below.
+CANONICAL_BLOB="$PKG
+$DESCRIPTION
+$CLAP_DESCRIPTION
+$STRUCT
+$PARAMS_STRUCT
+$DISPLAY
+$PLUGIN_NAME
+$VENDOR
+$EMAIL
+$HOMEPAGE
+$CLAP_ID
+$VST3_CLASS_ID"
+
+pass=0; fail=0; skip=0
+ok()   { pass=$((pass+1)); printf '  ok    %s\n' "$1"; }
+bad()  { fail=$((fail+1)); printf '  FAIL  %s\n' "$1"; [ $# -gt 1 ] && printf '        %s\n' "$2"; return 0; }
+note() { skip=$((skip+1)); printf '  skip  %s\n' "$1"; }
+# Reported for awareness only - never counted, never fails the run.
+info() { printf '  --    %s\n' "$1"; }
+
+# has FILE PATTERN -> fixed-string search
+has() { grep -qF "$2" "$1" 2>/dev/null; }
+
+check() { # check LABEL FILE LITERAL
+  if [ ! -f "$2" ]; then bad "$1" "missing file: $2"; return; fi
+  if has "$2" "$3"; then ok "$1"; else bad "$1" "$2 does not contain: $3"; fi
+}
+
+# Same as check, but a missing file is "not applicable yet" rather than drift.
+# The template ships without a deploy script; this starts checking once you add one.
+opt_check() { # opt_check LABEL FILE LITERAL
+  if [ ! -f "$2" ]; then note "$1 ($2 not present)"; return; fi
+  if has "$2" "$3"; then ok "$1"; else bad "$1" "$2 does not contain: $3"; fi
+}
+
+printf 'branding check (canonical: %s / "%s")\n\n' "$PKG" "$DISPLAY"
+
+# --- consistency: every site in the table holds its resolved literal ----------
+# The table is data, so adding a site is a row rather than a shell edit, and the
+# same script runs unmodified across every plugin built from this template.
+SITES="tools/branding-sites.tsv"
+if [ ! -f "$SITES" ]; then
+  bad "site table" "$SITES not found - run tools/brand-plugin.sh to generate it"
+else
+  printf 'sites\n'
+  while IFS="$(printf '\t')" read -r kind owner file pattern; do
+    case "$kind" in ''|\#*) continue ;; esac
+    [ -n "$pattern" ] || continue
+    label="$owner"
+    if [ ! -f "$file" ]; then
+      case "$kind" in
+        opt) note "$label ($file not present)" ;;
+        *)   bad  "$label" "missing file: $file" ;;
+      esac
+      continue
+    fi
+    if has "$file" "$pattern"; then ok "$label"
+    else bad "$label" "$file does not contain: $pattern"; fi
+  done < "$SITES"
+fi
+
+# --- validity: rules the table cannot express --------------------------------
+printf '\nvalidity\n'
+
+# VST3 class IDs are a fixed 16-byte array. A wrong length is a compile error,
+# but saying so here is clearer than reading rustc on it.
+n=$(printf '%s' "$VST3_CLASS_ID" | wc -c | tr -d ' ')
+if [ "$n" -eq 16 ]; then ok "VST3_CLASS_ID is 16 bytes"
+else bad "VST3_CLASS_ID is 16 bytes" "got $n bytes: \"$VST3_CLASS_ID\""; fi
+
+# CLAP IDs are reverse-DNS by convention and compared verbatim by hosts, so a
+# stray space or capital is a silent identity change between machines.
+case "$CLAP_ID" in
+  *\ *|*[A-Z]*) bad "CLAP_ID is reverse-DNS safe" "no spaces or capitals allowed: \"$CLAP_ID\"" ;;
+  *.*)          ok  "CLAP_ID is reverse-DNS safe" ;;
+  *)            bad "CLAP_ID is reverse-DNS safe" "expected dotted reverse-DNS, got: \"$CLAP_ID\"" ;;
+esac
+
+# An overridden package name is legitimate - the derivation is sometimes invalid
+# - but a display rename that forgot the package is not, and looks identical
+# from here. Reported, never failed.
+derived_pkg=$(_derive_pkg "$PLUGIN_NAME")
+[ "$PKG" = "$derived_pkg" ] || info "PKG \"$PKG\" differs from the derivation of PLUGIN_NAME (\"$derived_pkg\") - fine if deliberate"
+
+# CLAP_DESCRIPTION is shown to users in a host's plugin browser. "Free of
+# development history" is a judgement a script cannot make, but the failure it
+# produces is mechanical: a retired name or the repo codename surviving in it.
+hygiene_hits=""
+while IFS= read -r s_entry; do
+  [ -n "$s_entry" ] || continue
+  case "$CANONICAL_BLOB" in *"$s_entry"*) continue ;; esac
+  case "$CLAP_DESCRIPTION" in *"$s_entry"*) hygiene_hits="$hygiene_hits \"$s_entry\"" ;; esac
+done <<HYGIENE_LIST
+$STALE
+$CODENAME
+HYGIENE_LIST
+if [ -z "$hygiene_hits" ]; then ok "CLAP_DESCRIPTION carries no retired name or codename"
+else bad "CLAP_DESCRIPTION carries no retired name or codename" "found:$hygiene_hits"; fi
+
+printf '\nstale spellings\n'
+# File list for the scan below. Prefer git, so build output and any vendored
+# tree stay out of it. Fall back to find when this is not a checkout - an
+# exported tarball, or a CI step that fetched without git metadata - because
+# `git ls-files` there returns nothing, and an empty list would report every
+# stale spelling as absent. A check that passes hardest when it can see least
+# is worse than no check.
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  file_list() { git ls-files; }
+  scan_source="git"
+else
+  file_list() { find . -path ./.git -prune -o -path ./target -prune -o -type f -print | sed 's|^\./||'; }
+  scan_source="find (not a git checkout)"
+fi
+info "scanning tracked files via $scan_source"
+# Fed by here-doc rather than a pipe on purpose: a piped `while` runs in a
+# subshell, and the pass/fail counters it increments would be discarded.
+while IFS= read -r s; do
+  [ -n "$s" ] || continue
+
+  # Still part of a canonical value? Then it is current branding, not a leftover.
+  # This is what lets the list ship pre-seeded: entries arm themselves as you
+  # rename. Substring, not equality, because placeholders nest - "your-domain"
+  # lives inside the canonical CLAP_ID, and "YOUR-USERNAME" inside the homepage.
+  # Over-skipping is the safe direction: a false FAIL on a name you still use
+  # would train you to ignore this section.
+  case "$CANONICAL_BLOB" in
+    *"$s"*) note "\"$s\" (still canonical)"; continue ;;
+  esac
+
+  # These two name every retired spelling by definition - the STALE list lives in
+  # branding.conf and this script reads it - so neither can ever be a real hit.
+  hits=$(file_list 2>/dev/null | while read -r f; do
+           case "$f" in tools/check-branding.sh|tools/branding.conf) continue ;; esac
+           [ -f "$f" ] && grep -lF "$s" "$f" 2>/dev/null
+         done)
+  if [ -z "$hits" ]; then ok "no occurrences of \"$s\""
+  else bad "no occurrences of \"$s\"" "still present in: $(echo "$hits" | tr '\n' ' ')"; fi
+done <<STALE_LIST
+$STALE
+STALE_LIST
+
+# Template scaffolding, not drift: TODOs are legitimate while you are still
+# building. Reported so a finished plugin does not quietly ship with them.
+# `grep -c` prints 0 AND exits 1 when there are no matches, so `|| echo 0`
+# would append a second zero and make the count unparseable. Swallow the
+# status instead, and default an empty result (missing file) to zero.
+todos=$(grep -c 'TODO' src/lib.rs 2>/dev/null || :)
+[ -n "$todos" ] || todos=0
+printf '\nscaffolding\n'
+if [ "$todos" -eq 0 ]; then ok "no TODO markers left in src/lib.rs"
+else info "$todos TODO marker(s) still in src/lib.rs (not a failure)"; fi
+
+printf '\n%d passed, %d failed' "$pass" "$fail"
+[ "$skip" -gt 0 ] && printf ', %d skipped' "$skip"
+printf '\n'
+[ "$fail" -eq 0 ] || exit 1