@skill-map/cli 0.18.0 → 0.20.0

package/dist/kernel/index.d.ts

@@ -25,7 +25,7 @@
  *      implements `StoragePort`).
  *
  *   3. **Runtime extension contracts** — what a plugin author
- *      implements: `IProvider`, `IExtractor`, `IRule`, `IFormatter`,
+ *      implements: `IProvider`, `IExtractor`, `IAnalyzer`, `IFormatter`,
  *      `IExtensionBase`. **`I` prefix.** The prefix flags "this is a
  *      contract you supply, not a value the kernel hands you" — same
  *      reading as the rest of TypeScript's plugin ecosystems where a
@@ -151,17 +151,6 @@ interface Node {
     linksOutCount: number;
     linksInCount: number;
     externalRefsCount: number;
-    title?: string | null;
-    description?: string | null;
-    stability?: Stability | null;
-    /**
-     * Monotonic version counter sourced from the sidecar's
-     * `annotations.version` (Step 9.6.2). `null` when no sidecar accompanies
-     * the node, or when the sidecar omits `version`. Pre-9.6.2 the field
-     * was a semver string sourced from `frontmatter.metadata.version`;
-     * see migration `002_sidecar_columns.sql` and Decision #125.
-     */
-    version?: number | null;
     frontmatter?: Record<string, unknown>;
     tokens?: TripleSplit;
     /**
@@ -237,7 +226,7 @@ interface IssueFix {
     autofixable?: boolean;
 }
 interface Issue {
-    ruleId: string;
+    analyzerId: string;
     severity: Severity;
     nodeIds: string[];
     message: string;
@@ -381,12 +370,12 @@ interface ScanResult {
  * Extension registry — six kinds, first-class, loaded through a single API.
  *
  * The `Extension` shape is aligned with `spec/schemas/extensions/base.schema.json`.
- * Kind-specific manifests (provider / extractor / rule / action / formatter /
+ * Kind-specific manifests (provider / extractor / analyzer / action / formatter /
  * hook) extend this base structurally; the registry stores the base view
  * and each kind's code carries its own fuller type where needed.
  *
  * **Spec § A.6 — qualified ids.** Every extension is keyed in the registry
- * by `<pluginId>/<id>` (e.g. `core/frontmatter`, `claude/slash`,
+ * by `<pluginId>/<id>` (e.g. `core/annotations`, `core/slash`,
  * `hello-world/greet`). `Extension.id` carries the **short** id as authored;
  * `Extension.pluginId` carries the namespace; the registry composes the
  * qualifier internally and exposes lookup APIs that operate on either form
@@ -397,7 +386,7 @@ interface ScanResult {
  * `kernel-empty-boot` conformance contract.
  */
 
-type ExtensionKind = 'provider' | 'extractor' | 'rule' | 'action' | 'formatter' | 'hook';
+type ExtensionKind = 'provider' | 'extractor' | 'analyzer' | 'action' | 'formatter' | 'hook';
 declare const EXTENSION_KINDS: readonly ExtensionKind[];
 interface Extension {
     /** Short (unqualified) extension id as declared in the manifest. */
@@ -443,7 +432,7 @@ declare class Registry {
  * Step 9.6.6 — runtime annotation-contribution catalog types.
  *
  * Lives in its own module (rather than `kernel/index.ts`) so consumers
- * deep inside the kernel — `IRuleContext`, the BFF route factories,
+ * deep inside the kernel — `IAnalyzerContext`, the BFF route factories,
  * future Action contexts — can depend on the catalog shape without
  * dragging the whole kernel barrel and risking a cycle.
  */
@@ -463,6 +452,230 @@ interface IRegisteredAnnotationKey {
     schema: Record<string, unknown>;
 }
 
+/**
+ * Step 11.x — runtime view-contribution catalog types.
+ *
+ * Lives in its own module (rather than `kernel/index.ts`) so consumers
+ * deep inside the kernel — `IAnalyzerContext`, the BFF route factories,
+ * future Action contexts — can depend on the catalog shape without
+ * dragging the whole kernel barrel and risking a cycle.
+ *
+ * Mirrors `annotation-catalog.ts` for the annotation contribution side
+ * (Step 9.6.6). The two systems share the "plugin contributes data,
+ * kernel exposes catalog, UI renders" pattern but never overlap in
+ * storage or routing — see `architecture.md` §View contribution system
+ * for the comparison table.
+ *
+ * **Closed catalog by design.** Both `TSlotName` and `TInputTypeName`
+ * mirror the closed enums in `spec/schemas/view-slots.schema.json`
+ * and `spec/schemas/input-types.schema.json`. Adding a member is a
+ * coordinated kernel + spec + UI + scaffolder change. The closed-enum
+ * shape lets TypeScript surface unknown slots at author time
+ * (in plugin authors' editors when their plugin imports `@skill-map/cli`)
+ * AND lets the runtime exhaustively dispatch slot → renderer in the
+ * UI without `default:` fallbacks.
+ */
+/**
+ * Closed enum of view slot names. Mirror of
+ * `spec/schemas/view-slots.schema.json#/$defs/SlotName`.
+ *
+ * Plugins pick one of these by name in their extension manifest's
+ * `viewContributions[<contributionId>].slot` field. The kernel
+ * validates each pick at load time (`invalid-manifest` on miss); the
+ * slot fixes both the renderer and the payload shape.
+ */
+type TSlotName = 'card.title.right' | 'card.subtitle.left' | 'card.footer.left.counter' | 'card.footer.right' | 'graph.node.alert' | 'inspector.header.badge.counter' | 'inspector.header.badge.tag' | 'inspector.body.panel.breakdown' | 'inspector.body.panel.records' | 'inspector.body.panel.tree' | 'inspector.body.panel.key-values' | 'inspector.body.panel.link-list' | 'inspector.body.panel.markdown' | 'topbar.actions.indicator';
+/**
+ * Closed enum of input-type names for plugin settings. Mirror of
+ * `spec/schemas/input-types.schema.json#/$defs/InputTypeName`.
+ *
+ * Plugins pick one of these by name in their plugin manifest's
+ * `settings[<settingId>].type` field. The kernel exposes the resolved
+ * value via `ctx.settings.<settingId>` typed per the input-type's
+ * value-type promise.
+ */
+type TInputTypeName = 'string-list' | 'single-string' | 'boolean-flag' | 'integer' | 'enum-pick' | 'enum-multipick' | 'path-glob' | 'regex' | 'secret' | 'key-value-list';
+/** Closed severity palette aligned with PrimeNG `<p-tag>` / `<p-message>`. */
+type TSeverity = 'info' | 'warn' | 'success' | 'danger';
+/**
+ * Manifest-side declaration of a single view contribution. The plugin
+ * author writes one of these per Record key in
+ * `IExtensionBase.viewContributions[<contributionId>]`.
+ *
+ * Mirror of `view-slots.schema.json#/$defs/IViewContribution`.
+ */
+interface IViewContribution {
+    /**
+     * Required. Closed-catalog slot name. Unknown name rejects the
+     * extension as `invalid-manifest` at load. The slot fixes both the
+     * renderer and the payload shape; there is no separate "contract"
+     * abstraction.
+     */
+    slot: TSlotName;
+    /**
+     * Optional human-readable label. English-only per `AGENTS.md`
+     * (`Externalized texts, not internationalized`).
+     */
+    label?: string;
+    /** Optional hover tooltip. English-only. */
+    tooltip?: string;
+    /**
+     * Optional emoji codepoint OR PrimeIcons class id (without the
+     * `pi-` prefix). The UI discriminates: matches Unicode
+     * `\p{Extended_Pictographic}` → emoji text, otherwise → PrimeIcon.
+     * Required for counter slots and `card.title.right` (enforced by
+     * the manifest-side conditional in `view-slots.schema.json`).
+     */
+    icon?: string;
+    /**
+     * Optional empty placeholder text shown when the payload is empty
+     * AND `emitWhenEmpty` is true. Falls back to a UI-supplied generic
+     * 'No data.' string. English-only.
+     */
+    emptyText?: string;
+    /**
+     * When false (default), the kernel drops emissions whose payload is
+     * structurally empty so the slot stays silent. When true, the
+     * renderer surfaces an empty placeholder. Per-slot definition of
+     * "empty" lives in the slot's payload schema.
+     */
+    emitWhenEmpty?: boolean;
+    /**
+     * Optional ordering hint (default 100). Slots configured with
+     * `order: 'priority'` sort contributions ASC by this value, with
+     * alphabetical tie-break by qualified id. The plugin uses this to
+     * suggest where its contribution belongs relative to others sharing
+     * the same slot — the slot has the final say.
+     */
+    priority?: number;
+}
+/**
+ * Single row of the runtime view-contribution catalog surfaced by
+ * `kernel.getRegisteredViewContributions()`. One row per
+ * `(pluginId × extensionId × contributionId)` tuple. Composed at boot
+ * by `loadPluginRuntime` from every loaded extension's
+ * `viewContributions` map.
+ *
+ * The qualified id is `<pluginId>/<extensionId>/<contributionId>` —
+ * matches the qualified id pattern used elsewhere in the kernel
+ * (`<pluginId>/<extensionId>` for extensions; this adds the third
+ * segment for per-contribution identity).
+ */
+interface IRegisteredViewContribution {
+    pluginId: string;
+    extensionId: string;
+    contributionId: string;
+    slot: TSlotName;
+    /** Optional manifest-declared label (English-only). */
+    label?: string;
+    tooltip?: string;
+    icon?: string;
+    emptyText?: string;
+    emitWhenEmpty: boolean;
+    /** Manifest-declared ordering hint (default 100). See `IViewContribution.priority`. */
+    priority?: number;
+}
+/**
+ * Common fields on every setting declaration. The discriminated union
+ * `ISettingDeclaration` extends one of these per `type` value.
+ */
+interface ISettingCommon {
+    /** Required. Short human-readable label. English-only. */
+    label: string;
+    /** Optional helper text shown below the control. English-only. */
+    description?: string;
+}
+interface ISetting_StringList extends ISettingCommon {
+    type: 'string-list';
+    default?: string[];
+    min?: number;
+    max?: number;
+    itemMaxLength?: number;
+}
+interface ISetting_SingleString extends ISettingCommon {
+    type: 'single-string';
+    default?: string;
+    minLength?: number;
+    maxLength?: number;
+    /** Optional ECMAScript regex pattern (no flags). */
+    pattern?: string;
+}
+interface ISetting_BooleanFlag extends ISettingCommon {
+    type: 'boolean-flag';
+    default?: boolean;
+}
+interface ISetting_Integer extends ISettingCommon {
+    type: 'integer';
+    default?: number;
+    min?: number;
+    max?: number;
+    step?: number;
+}
+interface ISetting_EnumOption {
+    value: string;
+    label: string;
+}
+interface ISetting_EnumPick extends ISettingCommon {
+    type: 'enum-pick';
+    options: ISetting_EnumOption[];
+    default?: string;
+}
+interface ISetting_EnumMultipick extends ISettingCommon {
+    type: 'enum-multipick';
+    options: ISetting_EnumOption[];
+    default?: string[];
+    min?: number;
+    max?: number;
+}
+interface ISetting_PathGlob extends ISettingCommon {
+    type: 'path-glob';
+    default?: string;
+    /** When true, accepts string[]; when false (default), single string. */
+    multiple?: boolean;
+}
+interface ISetting_Regex extends ISettingCommon {
+    type: 'regex';
+    default?: string;
+    /** Subset of `gimsuy`. Default `''`. */
+    flags?: string;
+}
+interface ISetting_Secret extends ISettingCommon {
+    type: 'secret';
+    /**
+     * Optional uppercase-ASCII identifier. When set in the process
+     * environment, that value wins over any stored value (lets CI
+     * inject without writing to disk).
+     */
+    envVar?: string;
+}
+interface ISetting_KeyValueListEntry {
+    key: string;
+    value: string;
+}
+interface ISetting_KeyValueList extends ISettingCommon {
+    type: 'key-value-list';
+    keyLabel?: string;
+    valueLabel?: string;
+    default?: ISetting_KeyValueListEntry[];
+    min?: number;
+    max?: number;
+}
+/**
+ * Discriminated union of every setting declaration shape. The plugin
+ * author NEVER writes JSON Schema for settings — they pick one of
+ * these `type` values and supply per-type parameters.
+ *
+ * Mirror of `input-types.schema.json#/$defs/ISettingDeclaration`.
+ */
+type ISettingDeclaration = ISetting_StringList | ISetting_SingleString | ISetting_BooleanFlag | ISetting_Integer | ISetting_EnumPick | ISetting_EnumMultipick | ISetting_PathGlob | ISetting_Regex | ISetting_Secret | ISetting_KeyValueList;
+/**
+ * Runtime value type for a setting, derived from its declaration. The
+ * kernel exposes settings to extractors as `Record<string, TSettingValue>`
+ * via `ctx.settings.<settingId>`; consumers that want narrow typing
+ * narrow at the call site by reading `manifest.settings[id].type`.
+ */
+type TSettingValue = string | string[] | boolean | number | ISetting_KeyValueListEntry[];
+
 /**
  * Base manifest shape shared by every extension kind. Mirrors
  * `spec/schemas/extensions/base.schema.json` at the TypeScript level.
@@ -529,6 +742,21 @@ interface IExtensionBase {
      * `plugin-author-guide.md` §Annotation contributions for examples.
      */
     annotationContributions?: Record<string, IAnnotationContribution>;
+    /**
+     * Plugin-contributed view contributions. Each entry maps a local
+     * contribution id (kebab-case, unique within the extension) to a
+     * `IViewContribution` declaration that picks a view slot by name
+     * from the closed kernel catalog (`view-catalog.ts#TSlotName`).
+     * The slot fixes both the renderer and the payload shape — there
+     * is no separate "contract" abstraction. The kernel validates each
+     * `slot` pick at load time (`invalid-manifest` on miss); the plugin
+     * emits per-node payloads via `ctx.emitContribution(<contributionId>,
+     * payload)` during scan; the runtime validates payloads against
+     * the slot's payload schema. The aggregate runtime catalog is
+     * exposed via `kernel.getRegisteredViewContributions()`. See
+     * `architecture.md` §View contribution system.
+     */
+    viewContributions?: Record<string, IViewContribution>;
 }
 
 /**
@@ -643,6 +871,16 @@ interface IPluginManifest {
     id: string;
     version: string;
     specCompat: string;
+    /**
+     * Optional semver range against the kernel's view-slots +
+     * input-types catalog version. Independent from `specCompat` because
+     * the catalog evolves on its own cadence (see `architecture.md`
+     * §View contribution system → Catalog versioning). Mismatch surfaces
+     * as `incompatible-catalog`. Absent = the plugin opts out of catalog
+     * checking; `sm plugins doctor` warns if such a plugin actually
+     * declares `viewContributions` or `settings`.
+     */
+    catalogCompat?: string;
     extensions: string[];
     description?: string;
     storage?: TPluginStorage;
@@ -652,6 +890,18 @@ interface IPluginManifest {
      * the default.
      */
     granularity?: TGranularity;
+    /**
+     * Plugin user-configurable settings. Each entry picks an `input-type`
+     * from the closed catalog at
+     * `spec/schemas/input-types.schema.json#/$defs/InputTypeName`.
+     * The plugin author NEVER writes JSON Schema — they pick `type` by
+     * name and supply per-type parameters. The kernel exposes resolved
+     * settings to extractors via `ctx.settings.<settingId>`; settings
+     * are read once at extractor invocation; changing a setting requires
+     * `sm scan` to re-emit. See `architecture.md` §View contribution
+     * system → Settings.
+     */
+    settings?: Record<string, ISettingDeclaration>;
     author?: string;
     license?: string;
     homepage?: string;
@@ -692,7 +942,7 @@ interface IPluginManifest {
  *                           precedence rule applies. The user resolves
  *                           by renaming one of them and rerunning.
  */
-type TPluginLoadStatus = 'enabled' | 'disabled' | 'incompatible-spec' | 'invalid-manifest' | 'load-error' | 'id-collision';
+type TPluginLoadStatus = 'enabled' | 'disabled' | 'incompatible-spec' | 'incompatible-catalog' | 'invalid-manifest' | 'load-error' | 'id-collision';
 interface ILoadedExtension {
     kind: ExtensionKind;
     id: string;
@@ -884,6 +1134,63 @@ declare function makePluginStore(opts: {
     persistDedicated?: IDedicatedStorePersist;
 }): IPluginStore | undefined;
 
+/**
+ * `scan_contributions` adapter — replace-all writer used by
+ * `persistScanResult`, plus read helpers consumed by the BFF
+ * (`/api/contributions/...`) and rules (`core/contribution-orphan`).
+ *
+ * One row per `(plugin_id, extension_id, node_path, contribution_id)`
+ * tuple. See `spec/architecture.md` § View contribution system →
+ * Persistence and `migrations/001_initial.sql` § View contribution
+ * layer for the normative shape.
+ *
+ * Replace-all semantics mirror the rest of the `scan_*` zone: every
+ * scan is a fresh snapshot, so prior rows are deleted before insert.
+ * Wrapped in the same transaction `persistScanResult` opens.
+ *
+ * The rename heuristic does NOT need to migrate `node_path` here —
+ * because of replace-all, every contribution is re-emitted on the new
+ * path automatically. Keeping the rename path lighter than `state_*`
+ * (which IS rename-migrated because state survives across scans).
+ */
+
+/**
+ * In-memory contribution record buffered during scan and flushed to
+ * `scan_contributions` by `persistScanResult`. One entry per accepted
+ * `ctx.emitContribution(id, payload)` call. Payload validation against
+ * the slot's payload schema happens at emit time (orchestrator);
+ * by the time records reach this adapter they are wire-shape clean.
+ */
+interface IContributionRecord {
+    pluginId: string;
+    extensionId: string;
+    nodePath: string;
+    contributionId: string;
+    /**
+     * Closed enum value mirroring `view-slots.schema.json#/$defs/SlotName`.
+     * Persisted as TEXT (no SQL CHECK by design — see migration comment).
+     */
+    slot: string;
+    /** Already-validated payload. Serialised via `JSON.stringify` at write. */
+    payload: unknown;
+    emittedAt: number;
+}
+/**
+ * Single contribution row as returned to callers. The payload is
+ * `unknown` because the slot space is open at the type layer (catalog
+ * evolution is a kernel + spec concern); narrow at the call site by
+ * reading `slot`.
+ */
+interface IPersistedContribution {
+    pluginId: string;
+    extensionId: string;
+    nodePath: string;
+    contributionId: string;
+    slot: string;
+    payload: unknown;
+    emittedAt: number;
+}
+
 /**
  * Provider runtime contract. Walks filesystem roots and emits raw node
  * records; classification maps path conventions to a node kind.
@@ -1157,6 +1464,11 @@ interface IProviderReadConfig {
  * a return value. Extractors run in isolation: they MUST NOT read other
  * nodes, the graph, or the DB. Cross-node reasoning lives in rules.
  *
+ * Extractors are deterministic-only. They run synchronously inside the
+ * scan loop; LLM-driven enrichment of a node is an Action concern, not
+ * an Extractor concern. The Extractor context therefore exposes no
+ * `RunnerPort` — see spec `architecture.md` §Execution modes.
+ *
  * Output channels (all on the context):
  *
  *   - `ctx.emitLink(link)` — persist a link in the kernel's `links` table.
@@ -1164,14 +1476,12 @@ interface IProviderReadConfig {
  *     kind drops the link and surfaces an `extension.error` event.
  *   - `ctx.enrichNode(partial)` — merge canonical, kernel-curated properties
  *     onto the node. Strictly separate from the author-supplied frontmatter
- *     (the latter remains immutable and survives verbatim). Persistence and
- *     stale-tracking are spec'd in § A.8.
+ *     (the latter remains immutable and survives verbatim). Persistence
+ *     is spec'd in § A.8.
  *   - `ctx.store` — plugin-scoped persistence. Present only when the
  *     plugin declares `storage.mode` in `plugin.json`; shape depends on the
  *     mode (`KvStore` for mode A, scoped `Database` for mode B). See
  *     `plugin-kv-api.md` for the contract.
- *   - `ctx.runner` — `RunnerPort` injection for `probabilistic` extractors.
- *     `undefined` for the default `deterministic` mode.
  *
  * The manifest's `scope` field tells the orchestrator which parts to feed:
  * `frontmatter` extractors receive an empty string for body and vice versa.
@@ -1202,6 +1512,22 @@ interface IExtractorCallbacks {
      * partials and `persistScanResult` upserts them.
      */
     enrichNode(partial: Partial<Node>): void;
+    /**
+     * Emit a per-node view contribution. The first argument is the
+     * extension-local Record key declared under
+     * `extension.viewContributions[<contributionId>]`; the second is a
+     * payload that conforms to the slot's payload schema in
+     * `spec/schemas/view-slots.schema.json#/$defs/payloads/<slot>` —
+     * where `<slot>` is the slot the manifest declared for this
+     * contribution. The orchestrator validates the payload against the
+     * slot's schema before persisting to `scan_contributions`; off-shape
+     * payloads are silently dropped with an `extension.error` event
+     * (mirror of `emitLink` rejecting off-`emitsLinkKinds` links).
+     * Calling `emitContribution` with a `contributionId` that is not
+     * declared in the manifest is also dropped with an `extension.error`.
+     * See `architecture.md` §View contribution system → Emit path.
+     */
+    emitContribution(contributionId: string, payload: unknown): void;
 }
 interface IExtractorContext extends IExtractorCallbacks {
     node: Node;
@@ -1222,33 +1548,17 @@ interface IExtractorContext extends IExtractorCallbacks {
      * it here.
      */
     store?: unknown;
-    /**
-     * `RunnerPort` injection for `probabilistic` extractors. `undefined`
-     * for `deterministic` mode (the default). The kernel rejects
-     * probabilistic extractors that try to register scan-time hooks at
-     * load time.
-     */
-    runner?: unknown;
 }
 interface IExtractor extends IExtensionBase {
     kind: 'extractor';
-    /**
-     * Execution mode. Optional in the manifest with a default of
-     * `deterministic` per `spec/schemas/extensions/extractor.schema.json`.
-     * `probabilistic` extractors invoke an LLM through the kernel's
-     * `RunnerPort` and never participate in scan-time pipelines —
-     * they dispatch only as queued jobs.
-     */
-    mode?: TExecutionMode;
     emitsLinkKinds: LinkKind[];
     defaultConfidence: Confidence;
     scope: 'frontmatter' | 'body' | 'both';
     /**
      * Optional opt-in filter on `node.kind`. When declared, the orchestrator
      * skips invocation of `extract()` for any node whose `kind` is NOT in
-     * this list — fail-fast, before context construction, so a
-     * probabilistic extractor wastes zero LLM cost on inapplicable nodes
-     * and a deterministic extractor wastes zero CPU.
+     * this list — fail-fast, before context construction, so the extractor
+     * wastes zero CPU on inapplicable nodes.
      *
      * Absent (`undefined`) is the default: the extractor applies to every
      * kind. There are no wildcards — the absence of the field already
@@ -1271,28 +1581,29 @@ interface IExtractor extends IExtensionBase {
 }
 
 /**
- * Rule runtime contract. Runs against the whole graph after every Provider
- * and extractor has completed; emits issues. Deterministic rules are pure
- * (same graph in → same issues out) and run synchronously inside `sm scan`
- * / `sm check`. Probabilistic rules invoke an LLM through the kernel's
- * `RunnerPort` and dispatch only as queued jobs — they never participate
- * in scan-time pipelines. Mode is declared in the manifest (default
- * `deterministic`).
+ * Analyzer runtime contract. Runs against the whole graph after every
+ * Provider and extractor has completed; emits issues and MAY project
+ * findings into the UI via view contributions. Deterministic analyzers
+ * are pure (same graph in → same issues out) and run synchronously
+ * inside `sm scan` / `sm check`. Probabilistic analyzers invoke an LLM
+ * through the kernel's `RunnerPort` and dispatch only as queued jobs —
+ * they never participate in scan-time pipelines. Mode is declared in
+ * the manifest (default `deterministic`).
  */
 
 /**
- * Step 9.6.2 — orphan sidecar entry surfaced to rules. A `.sm` file
+ * Step 9.6.2 — orphan sidecar entry surfaced to analyzers. A `.sm` file
  * whose sibling `.md` does not exist on disk; the `annotation-orphan`
- * built-in rule emits one warning per entry. Other rules that care
- * about orphan sidecars MAY consume the list too.
+ * built-in analyzer emits one warning per entry. Other analyzers that
+ * care about orphan sidecars MAY consume the list too.
  */
-interface IRuleOrphanSidecar {
+interface IAnalyzerOrphanSidecar {
     /** Relative path (POSIX-separated) of the orphan `.sm`. */
     relativePath: string;
     /** Absolute path of the missing `.md` the sidecar was anchored to. */
     expectedMdPath: string;
 }
-interface IRuleContext {
+interface IAnalyzerContext {
     nodes: Node[];
     links: Link[];
     /**
@@ -1300,35 +1611,101 @@ interface IRuleContext {
      * Empty when sidecar discovery did not run (legacy callers) or
      * when no orphans exist.
      */
-    orphanSidecars?: IRuleOrphanSidecar[];
+    orphanSidecars?: IAnalyzerOrphanSidecar[];
     /**
      * Step 9.6.6 — raw parsed sidecar root keyed by `node.path`. Populated
      * by the orchestrator alongside the public `Node.sidecar` overlay so
-     * rules that inspect plugin namespaces (e.g. the built-in
-     * `core/unknown-field` Rule) can walk the full tree without re-reading
-     * the file from disk. Absent (or `undefined` per node) when no
-     * sidecar accompanies the node, or when the sidecar failed to parse.
-     * Treat as read-only.
+     * analyzers that inspect plugin namespaces (e.g. the built-in
+     * `core/unknown-field` Analyzer) can walk the full tree without
+     * re-reading the file from disk. Absent (or `undefined` per node)
+     * when no sidecar accompanies the node, or when the sidecar failed
+     * to parse. Treat as read-only.
      */
     sidecarRoots?: ReadonlyMap<string, Record<string, unknown>>;
     /**
      * Step 9.6.6 — runtime catalog of plugin-contributed annotation keys,
      * as exposed by `kernel.getRegisteredAnnotationKeys()`. Threaded
-     * through so rules can reason about the registered-vs-unknown split
-     * without reaching back into the kernel. Empty array when no plugin
-     * declares contributions; absent for legacy callers (older runScan
-     * sites that never wired the catalog through).
+     * through so analyzers can reason about the registered-vs-unknown
+     * split without reaching back into the kernel. Empty array when no
+     * plugin declares contributions; absent for legacy callers (older
+     * runScan sites that never wired the catalog through).
      */
     annotationContributions?: readonly IRegisteredAnnotationKey[];
+    /**
+     * Step 11.x — runtime catalog of plugin-contributed view contributions,
+     * as exposed by `kernel.getRegisteredViewContributions()`. Threaded
+     * through so analyzers can reason about emissions without reaching
+     * back into the kernel: built-in `core/unknown-slot` walks this list
+     * to detect deprecated slots in use, and `core/contribution-orphan`
+     * joins it with the live node set to flag dangling emissions. Empty
+     * array when no extension declares view contributions; absent for
+     * legacy callers (older runScan sites that never wired the catalog
+     * through).
+     */
+    viewContributions?: readonly IRegisteredViewContribution[];
+    /**
+     * Absolute paths of `*.md` files under the project's
+     * `.skill-map/jobs/` that no `state_jobs.filePath` references — the
+     * built-in `core/job-orphan-file` analyzer projects each as a `warn`
+     * issue. Pre-computed by the driving adapter (CLI / BFF) inside its
+     * already-open storage transaction (mirrors the `orphanSidecars`
+     * pattern: detection lives outside the analyzer, the analyzer only
+     * projects). Absent (or empty) when the caller does not maintain a
+     * jobs directory, when the storage path is unavailable, or when no
+     * orphan files exist. Treat as read-only.
+     */
+    orphanJobFiles?: readonly string[];
+    /**
+     * Set of absolute file paths the operator has opted into for
+     * link-validation purposes via `scan.referencePaths`. The driving
+     * adapter walks each configured path before the scan and collects
+     * every existing file's absolute path here. Files in this set are
+     * NOT indexed as graph nodes — the only consumer is
+     * `core/broken-ref`, which suppresses its `warn` issue when a
+     * path-style link target falls into the set. Absent / empty when
+     * the operator left `scan.referencePaths` empty or when the
+     * adapter does not maintain the side index. Treat as read-only.
+     */
+    referenceablePaths?: ReadonlySet<string>;
+    /**
+     * Absolute path of the scan's project root (cwd of the invocation).
+     * Threaded into the analyzer pass so an analyzer that needs to
+     * resolve a relative `link.target` to an absolute filesystem path
+     * (today only `core/broken-ref`, when consulting
+     * `referenceablePaths`) does not have to derive it from
+     * `nodes[0].path` heuristics. Absent for legacy callers (older
+     * `runScan` sites that never wired the field through). Always an
+     * absolute path when present.
+     */
+    cwd?: string;
+    /**
+     * Emit a per-node view contribution declared in this analyzer's
+     * manifest `viewContributions` map. Sync, void return; the
+     * orchestrator validates the payload against the slot's schema at
+     * call time and silently drops invalid emissions with a logged
+     * `extension.error` event (parallel to
+     * `IExtractorCallbacks.emitContribution`).
+     *
+     * Unlike Extractor's emit (which binds `nodePath` from `ctx.node.path`
+     * implicitly because Extractors run per-node), Analyzer's `evaluate()`
+     * sees the full graph at once. The analyzer walks `ctx.nodes` itself
+     * and MUST supply the target node path explicitly per emission.
+     *
+     * Calling `emitContribution` with a `contributionId` that is not
+     * declared in the manifest is dropped with an `extension.error`. The
+     * kernel routes emitted contributions to the same persistence
+     * pipeline as Extractor emissions (`scan_contributions`).
+     */
+    emitContribution(nodePath: string, contributionId: string, payload: unknown): void;
 }
-interface IRule extends IExtensionBase {
-    kind: 'rule';
+interface IAnalyzer extends IExtensionBase {
+    kind: 'analyzer';
     /**
      * Execution mode. Optional in the manifest with a default of
-     * `deterministic` per `spec/schemas/extensions/rule.schema.json`.
+     * `deterministic` per `spec/schemas/extensions/analyzer.schema.json`.
      */
     mode?: TExecutionMode;
-    evaluate(ctx: IRuleContext): Issue[] | Promise<Issue[]>;
+    evaluate(ctx: IAnalyzerContext): Issue[] | Promise<Issue[]>;
 }
 
 /**
@@ -1558,12 +1935,16 @@ interface IFormatter extends IExtensionBase {
  * are notification (Slack on `job.completed`), integration glue (CI
  * webhook on `job.failed`), and bookkeeping (per-extractor metrics).
  *
- * The hookable trigger set is INTENTIONALLY SMALL — eight events. The
- * full `ProgressEmitterPort` catalog (per-node `scan.progress`,
- * `model.delta`, `run.*`, internal job lifecycle) is deliberately not
- * hookable: too verbose for a reactive surface, internal to the runner,
- * or covered elsewhere. Declaring a trigger outside the curated set
- * yields `invalid-manifest` at load time.
+ * The hookable trigger set is INTENTIONALLY SMALL — ten events. Eight
+ * are pipeline-driven (emitted from inside `runScan`); two
+ * (`boot`, `shutdown`) are CLI-process-driven (emitted by the driving
+ * binary before / after the verb runs, fire-and-forget so
+ * `process.exit` is never blocked). The full `ProgressEmitterPort`
+ * catalog (per-node `scan.progress`, `model.delta`, `run.*`, internal
+ * job lifecycle) is deliberately not hookable: too verbose for a
+ * reactive surface, internal to the runner, or covered elsewhere.
+ * Declaring a trigger outside the curated set yields
+ * `invalid-manifest` at load time.
  *
  * Dual-mode (declared in manifest):
  *
@@ -1578,27 +1959,35 @@ interface IFormatter extends IExtensionBase {
  *
  * Curated trigger set (per spec § A.11):
  *
+ *   0. `boot`                 — once per CLI process, before verb routing.
  *   1. `scan.started`         — pre-scan setup (one per scan).
  *   2. `scan.completed`       — post-scan reaction (one per scan).
  *   3. `extractor.completed`  — aggregated per-Extractor outputs.
- *   4. `rule.completed`       — aggregated per-Rule outputs.
+ *   4. `analyzer.completed`       — aggregated per-Rule outputs.
  *   5. `action.completed`     — Action executed on a node.
  *   6. `job.spawning`         — pre-spawn of runner subprocess.
  *   7. `job.completed`        — most common trigger.
  *   8. `job.failed`           — alerts, retry triggers.
+ *   9. `shutdown`             — once per CLI process, after the verb's
+ *                                exit code resolves and before
+ *                                `process.exit`.
  */
 
 /**
- * The eight hookable lifecycle events. Mirrors the `triggers[]` enum in
- * `spec/schemas/extensions/hook.schema.json`. Anything outside this set
- * is rejected at load time as `invalid-manifest`.
+ * The ten hookable lifecycle events. Mirrors the `triggers[]` enum in
+ * `spec/schemas/extensions/hook.schema.json`. Eight are pipeline-driven
+ * (emitted from inside `runScan`); two (`boot`, `shutdown`) are
+ * CLI-process-driven (emitted by the driving binary before / after the
+ * verb runs). Anything outside this set is rejected at load time as
+ * `invalid-manifest`.
  */
-type THookTrigger = 'scan.started' | 'scan.completed' | 'extractor.completed' | 'rule.completed' | 'action.completed' | 'job.spawning' | 'job.completed' | 'job.failed';
+type THookTrigger = 'boot' | 'scan.started' | 'scan.completed' | 'extractor.completed' | 'analyzer.completed' | 'action.completed' | 'job.spawning' | 'job.completed' | 'job.failed' | 'shutdown';
 /**
  * Frozen list mirror of `THookTrigger` for runtime introspection. The
  * loader validates `manifest.triggers[]` against this set; the
- * orchestrator's dispatcher iterates it in order when fanning an event
- * out to subscribed hooks.
+ * dispatcher iterates it in order when fanning an event out to
+ * subscribed hooks. `boot` first / `shutdown` last so a debug log of
+ * the array reads in lifecycle order.
  */
 declare const HOOK_TRIGGERS: readonly THookTrigger[];
 /**
@@ -1607,7 +1996,7 @@ declare const HOOK_TRIGGERS: readonly THookTrigger[];
  *
  * The `event` carries the raw `ProgressEvent` envelope (type, timestamp,
  * runId/jobId when applicable, data). Optional `node` / `extractorId`
- * / `ruleId` / `actionId` are extracted from the event payload by the
+ * / `analyzerId` / `actionId` are extracted from the event payload by the
  * dispatcher when present so authors don't have to walk `event.data`.
  *
  * Probabilistic hooks additionally receive `runner` for LLM dispatch.
@@ -1634,9 +2023,9 @@ interface IHookContext {
      */
     extractorId?: string;
     /**
-     * Set on `rule.completed` events. Qualified extension id of the Rule.
+     * Set on `analyzer.completed` events. Qualified extension id of the Rule.
      */
-    ruleId?: string;
+    analyzerId?: string;
     /**
      * Set on `action.completed` events. Qualified extension id of the
      * Action that just ran.
@@ -1704,7 +2093,7 @@ interface IHook extends IExtensionBase {
 }
 
 /**
- * Scan orchestrator — runs the Provider → extractor → rule pipeline across
+ * Scan orchestrator — runs the Provider → extractor → analyzer pipeline across
  * every registered extension and emits `ProgressEmitterPort` events in
  * canonical order. The callable extension set is injected via
  * `RunScanOptions.extensions` — the Registry holds manifest metadata, the
@@ -1757,7 +2146,7 @@ interface IHook extends IExtensionBase {
 interface IScanExtensions {
     providers: IProvider[];
     extractors: IExtractor[];
-    rules: IRule[];
+    analyzers: IAnalyzer[];
     /**
      * Optional hooks (spec § A.11). When supplied, the orchestrator's
      * lifecycle dispatcher invokes deterministic hooks subscribed to one
@@ -1800,6 +2189,20 @@ interface RunScanOptions {
      * inside the rule.
      */
     annotationContributions?: readonly IRegisteredAnnotationKey[];
+    /**
+     * Runtime catalog of plugin-contributed view contributions (the same
+     * shape `kernel.getRegisteredViewContributions()` returns). Threaded
+     * into the rule pass so:
+     *   - `core/unknown-slot` and `core/contribution-orphan` can
+     *     introspect the catalog (read-only).
+     *   - The orchestrator's per-rule emit closure can look up each
+     *     declared `(contributionId → slot)` pairing for AJV
+     *     payload validation.
+     * Absent → empty catalog. Rules that emit contributions silently
+     * drop emissions when the catalog has no entry for the rule's
+     * declared contributionId.
+     */
+    viewContributions?: readonly IRegisteredViewContribution[];
     /**
      * Scan scope. Defaults to `'project'`. The CLI flag wiring lands in
      * the config layer wiring; `runScan` already accepts the override
@@ -1893,6 +2296,40 @@ interface RunScanOptions {
      * mock without spinning up a DB.
      */
     pluginStores?: ReadonlyMap<string, IPluginStore>;
+    /**
+     * Pre-computed absolute paths of orphan job MD files (files under
+     * `.skill-map/jobs/` whose absolute path appears nowhere in
+     * `state_jobs.filePath`). Threaded into the rule pass so the
+     * built-in `core/job-orphan-file` rule can project each as a `warn`
+     * issue without the kernel reaching for the storage port or doing
+     * its own FS walk. The driving adapter (CLI, BFF) computes this
+     * inside its already-open storage transaction via
+     * `findOrphanJobFiles(jobsDir, await port.jobs.listReferencedFilePaths())`
+     * — mirrors the `orphanSidecars` model where detection lives
+     * outside the rule and the rule only projects. Absent / empty when
+     * the caller has no jobs context (out-of-band tests, fresh DB,
+     * `--no-built-ins`).
+     */
+    orphanJobFiles?: readonly string[];
+    /**
+     * Side set of absolute file paths the operator opted into for
+     * link-validation purposes via `scan.referencePaths`. Threaded
+     * through to `IAnalyzerContext.referenceablePaths` so the built-in
+     * `core/broken-ref` rule can suppress its `warn` for path-style
+     * links whose target lands in the set. Files are NOT walked by
+     * the kernel — the driving adapter populates the set before
+     * calling `runScan`. Absent / empty when the operator left
+     * `scan.referencePaths` unconfigured.
+     */
+    referenceablePaths?: ReadonlySet<string>;
+    /**
+     * Absolute path of the scan's cwd / project root. Threaded onto
+     * `IAnalyzerContext.cwd` so rules that need to resolve a relative
+     * `link.target` to an absolute filesystem path can do so without
+     * heuristics. Absent for callers that don't track a cwd
+     * concept (out-of-band tests, embedders).
+     */
+    cwd?: string;
 }
 /**
  * Spec § A.9 — runs to persist into `scan_extractor_runs`. One entry
@@ -1919,8 +2356,6 @@ interface IExtractorRunRecord {
  *
  *   - upsert a single row per pair (stable PRIMARY KEY conflict on
  *     re-extract);
- *   - flag probabilistic rows `stale = 1` when the body changes between
- *     scans (preserving the prior LLM cost);
  *   - feed `mergeNodeWithEnrichments` with `enrichedAt`-sorted partials
  *     for last-write-wins per field at read time.
  *
@@ -1930,10 +2365,12 @@ interface IExtractorRunRecord {
  * fold into a single row, but two different Extractors hitting the
  * same node yield two distinct rows.
  *
- * `isProbabilistic` is denormalised so the persistence layer's stale
- * flag query stays a single-table read; recomputing from the live
- * registry would force every read-path to thread the runtime extension
- * set through.
+ * `isProbabilistic` is reserved: Extractors are deterministic-only, so
+ * every record produced by the orchestrator sets it to `false`. The
+ * field is kept on the record (and the row in `node_enrichments`) so a
+ * future Action-issued enrichment can populate it without reshaping
+ * the persistence contract — see spec `architecture.md`
+ * §Extractor · enrichment layer.
  */
 interface IEnrichmentRecord {
     nodePath: string;
@@ -1961,6 +2398,8 @@ declare function runScanWithRenames(_kernel: Kernel, options: RunScanOptions): P
     renameOps: RenameOp[];
     extractorRuns: IExtractorRunRecord[];
     enrichments: IEnrichmentRecord[];
+    contributions: IContributionRecord[];
+    freshlyRunTuples: ReadonlySet<string>;
 }>;
 declare function runScan(_kernel: Kernel, options: RunScanOptions): Promise<ScanResult>;
 /**
@@ -1997,6 +2436,7 @@ declare function runExtractorsForNode(opts: {
     internalLinks: Link[];
     externalLinks: Link[];
     enrichments: IEnrichmentRecord[];
+    contributions: IContributionRecord[];
 }>;
 /**
  * Pure rename / orphan classification per `spec/db-schema.md` §Rename
@@ -2037,10 +2477,11 @@ declare function detectRenamesAndOrphans(prior: ScanResult, current: Node[], iss
  * Algorithm:
  *
  *   1. Filter `enrichments` down to rows targeting this node AND not
- *      flagged `stale`. Stale rows (probabilistic enrichments whose
- *      body changed since their last run) are excluded by default —
- *      stale visibility belongs to the UI layer where the marker is
- *      shown next to the value.
+ *      flagged `stale`. With Extractors deterministic-only no row is
+ *      stale-flagged in this revision; the filter is preserved for the
+ *      future Action-issued enrichment revision (queued LLM jobs whose
+ *      output must survive body changes), where stale visibility
+ *      belongs to the UI layer next to the value.
  *   2. Sort the survivors by `enrichedAt` ASC so iteration order is
  *      "oldest first". This makes the spread merge below
  *      last-write-wins per field — the freshest Extractor's value
@@ -2208,7 +2649,7 @@ declare function createChokidarWatcher(opts: ICreateFsWatcherOptions): IFsWatche
  *     are presentation facets that can churn without making the link
  *     "different" for delta purposes.
  *
- *   - **Issue**: `(ruleId, sorted nodeIds, message)`. Mirrors
+ *   - **Issue**: `(analyzerId, sorted nodeIds, message)`. Mirrors
  *     `spec/job-events.md` §issue.* — same key → same issue, even when
  *     `data` / `severity` / `linkIndices` shift. A meaningful change in
  *     `message` (or a different set of node ids) is a different issue.
@@ -2334,6 +2775,72 @@ declare function applyExportQuery(scan: {
     issues: Issue[];
 }, query: IExportQuery): IExportSubset;
 
+/**
+ * `scan_node_tags` adapter — tags · dual-source persistence layer.
+ *
+ * One row per `(node_path, tag, source)` triple. Projected at persist
+ * time from BOTH `frontmatter.tags` (with `source='author'`) and
+ * `sidecar.annotations.tags` (with `source='user'`). The same tag
+ * string MAY appear under both sources for the same node — the PK
+ * accepts the pair; search returns the node once via DISTINCT, the
+ * UI renders both chips with their attribution.
+ *
+ * Belongs to the `scan_*` family — replaced wholesale per scan.
+ * Cached nodes' tag rows are projected from the cached
+ * `node.frontmatter.tags` / `node.sidecar.annotations.tags` (both
+ * already in memory at persist time), so the rebuild is cheap
+ * regardless of cache hit / miss. See `spec/db-schema.md`
+ * § scan_node_tags for the normative shape and replace-all semantics.
+ */
+
+/**
+ * In-memory tag record buffered during scan and flushed to
+ * `scan_node_tags` by `persistScanResult`. One entry per
+ * `(node_path, tag, source)` projected from a node's frontmatter tags
+ * (`source: 'author'`) or sidecar annotations tags
+ * (`source: 'user'`).
+ */
+interface ITagRecord {
+    nodePath: string;
+    tag: string;
+    source: 'author' | 'user';
+}
+
+/**
+ * Pure helpers for the "update available" notification feature.
+ *
+ * Three responsibilities:
+ *   - `fetchLatestVersion`  — query `https://registry.npmjs.org/<pkg>/latest`
+ *                             with `AbortController` + timeout. Throws on
+ *                             non-200 / parse failure / abort.
+ *   - `compareVersions`     — semver compare (-1 / 0 / 1). Pre-1.0 aware:
+ *                             treats prereleases via the standard rules
+ *                             (release > prerelease at the same triple).
+ *   - `isOutdated`          — sugar over `compareVersions` for the common
+ *                             "is `latest` strictly greater than `current`"
+ *                             check the banner runs against.
+ *
+ * Pure kernel module — NO `process.env` reads, NO Node globals beyond the
+ * built-in `fetch` / `AbortController` (Node 22+). Every env / settings
+ * lookup happens in `src/cli/util/update-check-banner.ts`, the CLI-side
+ * adapter that owns side effects.
+ *
+ * The shared cache type (`IUpdateCheckCache`) is used by the storage
+ * helpers under `kernel/storage/update-check.ts` and by the BFF's
+ * `GET /api/update-status` projection. A second type
+ * (`IUpdateStatus`) shapes the BFF response — it merges `current`
+ * (from `VERSION`) into the cache so the UI can render without a
+ * second lookup. Both stay flat — no nested objects — so JSON
+ * serialization is trivial.
+ */
+interface IUpdateCheckCache {
+    latestVersion: string;
+    /** Epoch ms — when the registry was last successfully probed. */
+    checkedAt: number;
+    /** Epoch ms — when the banner was last printed; null = never shown yet. */
+    shownAt: number | null;
+}
+
 /**
  * `PluginLoaderPort` — discovers plugin directories and loads their
  * extensions. The shape mirrors what the concrete loader actually
@@ -2427,6 +2934,44 @@ interface IPersistOptions {
     renameOps?: RenameOp[];
     extractorRuns?: IExtractorRunRecord[];
     enrichments?: IEnrichmentRecord[];
+    contributions?: IContributionRecord[];
+    /**
+     * Phase 3 / View contribution system — active runtime catalog of
+     * registered view contributions, keyed by qualified id
+     * `<pluginId>/<extensionId>/<contributionId>`. Passed to the
+     * `scan_contributions` upsert so the catalog sweep can drop rows
+     * belonging to plugins / extensions that are no longer in the
+     * catalog (uninstalled plugins, disabled bundles, removed
+     * contributions). Empty / absent set = no catalog sweep (legacy
+     * behaviour, leaves disabled-plugin rows stale per design F24
+     * pre-fix).
+     */
+    registeredContributionKeys?: ReadonlySet<string>;
+    /**
+     * Phase 3 / View contribution system — set of `(plugin, extension,
+     * node)` tuples where the extension actually RAN against that node
+     * in this scan. Format: `<pluginId>/<extensionId>/<nodePath>` (no
+     * contribution-id segment — the sweep operates at the (plugin,
+     * extension, node) level and inspects the buffer to decide which
+     * contribution-ids survive).
+     *
+     * Membership rules:
+     *   - Extractor + cache miss: tuple INCLUDED (extract() ran).
+     *   - Extractor + cache hit: tuple OMITTED (extract() skipped, prior
+     *     rows must be preserved).
+     *   - Rule, every node in `ctx.nodes`: tuple INCLUDED (rules always
+     *     run and see the full graph).
+     *
+     * Drives the per-tuple sweep documented in `spec/architecture.md`
+     * §View contribution system → Persistence (sweep #3): rows whose
+     * `(plugin_id, extension_id, node_path)` is in this set but whose
+     * `(plugin_id, extension_id, node_path, contribution_id)` is NOT in
+     * the buffer get DELETEd before the upsert. Catches the "extractor
+     * used to emit, now does not" case (e.g. body change removes the
+     * trigger). Empty / absent set = no per-tuple sweep (legacy
+     * callers preserve the pre-fix behaviour where stale rows linger).
+     */
+    freshlyRunTuples?: ReadonlySet<string>;
 }
 /**
  * Issue row as the storage layer sees it — paired with its DB-assigned
@@ -2567,28 +3112,6 @@ interface IPluginApplyResult {
     intrusions: string[];
 }
 
-/**
- * `StoragePort` — the kernel's persistence boundary. Driving adapters
- * (CLI, future server, in-memory test harness) consume this surface
- * exclusively; nothing in `cli/**` should reach into the SQLite
- * adapter's internal helpers (free functions on
- * `kernel/adapters/sqlite/*`) directly. Phase F of the
- * storage-port-promotion refactor finishes that hardening; A-E grow
- * the port enough that the CLI has somewhere to land.
- *
- * The port is namespaced by domain (`scans`, `issues`, `enrichments`,
- * etc.) — explicitly NOT a generic `port.query<T>(sql)`. Each
- * namespace's methods name an operation the kernel cares about; the
- * adapter translates to its persistence engine's idioms.
- *
- * Phase A lands the **scans / issues / enrichments / transaction**
- * namespaces — the core scan pipeline. The remaining namespaces
- * (history / jobs / pluginConfig / migrations / pluginMigrations)
- * arrive in subsequent phases. The port shape declared here is the
- * Phase A subset; later phases extend it without reshaping what
- * lands today.
- */
-
 /**
  * Subset of `StoragePort` exposed inside a `transaction(fn)` callback.
  * Lifecycle methods are intentionally omitted — a transaction that
@@ -2665,12 +3188,56 @@ interface StoragePort {
          */
         findNode(path: string): Promise<INodeBundle | null>;
     };
+    /**
+     * Phase 3 / View contribution system — read access to
+     * `scan_contributions`. Writes happen exclusively via
+     * `scans.persist({ contributions })` to keep the replace-all
+     * semantics intact; this namespace is read-only.
+     */
+    contributions: {
+        /** Every contribution row for a single node. Stable order. */
+        listForNode(nodePath: string): Promise<IPersistedContribution[]>;
+        /**
+         * Bulk variant for the BFF nodes-list route. Returns rows for
+         * every path in `paths`, sorted `nodePath` ASC, then qualified-id
+         * ASC. Empty `paths` returns `[]` without a query.
+         */
+        listForPaths(paths: readonly string[]): Promise<IPersistedContribution[]>;
+        /**
+         * Lookup by qualified id + path. Used by
+         * `GET /api/contributions/:pluginId/:contributionId?path=...`.
+         */
+        lookup(pluginId: string, contributionId: string, nodePath: string, extensionId?: string): Promise<IPersistedContribution[]>;
+    };
+    /**
+     * Read-only access to `scan_node_tags`. Writes happen exclusively
+     * via `scans.persist({...})` (the persistence layer projects from
+     * `node.frontmatter.tags` and `node.sidecar.annotations.tags`); this
+     * namespace is read-only.
+     */
+    tags: {
+        /** Every tag row for a single node. Author entries first, then user. */
+        listForNode(nodePath: string): Promise<ITagRecord[]>;
+        /**
+         * Bulk variant for the BFF nodes-list route. Returns rows for every
+         * path in `paths`, sorted `nodePath` ASC, then `source` ASC, then
+         * `tag` ASC. Empty `paths` returns `[]` without a query.
+         */
+        listForPaths(paths: readonly string[]): Promise<ITagRecord[]>;
+        /**
+         * Find every node carrying `tag`. Optional `source` narrows to one
+         * side of the dual surface (matches `sm list --tag <name>
+         * --tag-source author|user`); absent matches the union (default
+         * `sm list --tag`).
+         */
+        findNodes(tag: string, source?: 'author' | 'user'): Promise<string[]>;
+    };
     issues: {
         /** Every issue from the latest scan, in insertion order. */
         listAll(): Promise<Issue[]>;
         /**
          * Issue rows whose runtime `Issue` shape passes `predicate`.
-         * `port.issues.findActive((i) => i.ruleId === 'orphan')` is the
+         * `port.issues.findActive((i) => i.analyzerId === 'orphan')` is the
          * canonical use; `sm orphans` consumes this. The returned shape
          * carries the DB-assigned `id` so a follow-up
          * `transaction(tx => tx.issues.deleteById(row.id))` can target
@@ -2721,6 +3288,36 @@ interface StoragePort {
          */
         listReferencedFilePaths(): Promise<Set<string>>;
     };
+    /**
+     * Generic key/value preferences keyed by a stable string. Backs the
+     * `config_preferences` table — one row per `key`, `value_json` is a
+     * single JSON blob the caller serialises. Keys with the `_kernel.`
+     * prefix are reserved for kernel-managed entries (today: the
+     * update-check cache); user-set preferences land under unprefixed
+     * keys when those ship.
+     *
+     * Read-only by design at the port level — the only writer is the
+     * CLI's post-run hook (`cli/util/update-check-banner.ts`), which
+     * reaches the persistence helpers directly. The port surfaces the
+     * read so the BFF's `GET /api/update-status` projection can stay
+     * inside the abstract contract.
+     */
+    preferences: {
+        /**
+         * Load the update-check cache row. Returns `null` when the row
+         * is absent, malformed JSON, or fails the shape guard. Never
+         * throws — read failures degrade silently because the banner is
+         * a non-essential surface.
+         */
+        loadUpdateCheckCache(): Promise<IUpdateCheckCache | null>;
+        /**
+         * Upsert the update-check cache row. Always overwrites the
+         * existing JSON blob in place. `updated_at` tracks wall-clock
+         * now — separate from the embedded `checkedAt` field, which
+         * the caller controls.
+         */
+        saveUpdateCheckCache(cache: IUpdateCheckCache): Promise<void>;
+    };
     favorites: {
         /**
          * Mark `path` as favorited. Idempotent — a second call refreshes
@@ -2940,6 +3537,51 @@ declare function resetLogger(): void;
 /** Inspect the active logger. Test-only — production code uses `log`. */
 declare function getActiveLogger(): LoggerPort;
 
+/**
+ * Hook lifecycle dispatcher (spec § A.11). Indexes the supplied hooks
+ * by trigger and fans the matching event out to every subscribed
+ * deterministic hook in registration order. Probabilistic hooks are
+ * skipped here with a stderr advisory; they will dispatch via the job
+ * subsystem once it ships (Decision #114).
+ *
+ * Filter handling: when the hook declares a `filter` map, the dispatcher
+ * walks `event.data` for each declared key and short-circuits the
+ * invocation when any value disagrees. Top-level fields only in v0.x
+ * (deep-path matching is deferred until a real use case justifies the
+ * complexity).
+ *
+ * Error policy: a hook that throws is caught here, logged through a
+ * synthetic `extension.error` event with kind `hook-error`, and the
+ * caller continues. A buggy hook MUST NOT block the main pipeline (or
+ * the CLI exit path) — that would invert the design intent (hooks
+ * REACT to events, they never steer them).
+ *
+ * The module lives under `kernel/extensions/` (alongside the `IHook`
+ * contract itself) so two callers share it: `runScan` for the eight
+ * pipeline-driven triggers (`scan.*`, `extractor.completed`,
+ * `analyzer.completed`, `action.completed`, `job.*`) and the CLI entry
+ * for the two CLI-process-driven triggers (`boot`, `shutdown`).
+ * Pulling the dispatcher out of the orchestrator keeps both consumers
+ * symmetric — same indexing, same filter semantics, same error
+ * policy.
+ */
+
+interface IHookDispatcher {
+    /**
+     * Fan the event out to every hook subscribed to `trigger`. Awaits each
+     * hook's `on(ctx)` in registration order. Errors are caught and
+     * logged via `extension.error`; they never propagate.
+     */
+    dispatch(trigger: THookTrigger, event: ProgressEvent): Promise<void>;
+}
+/**
+ * Build a dispatcher over the given hooks. Empty `hooks` returns a
+ * cheap no-op shape so the call sites can dispatch unconditionally.
+ */
+declare function makeHookDispatcher(hooks: IHook[], emitter: ProgressEmitterPort): IHookDispatcher;
+/** Construct a `ProgressEvent` envelope. Mirrors the orchestrator helper. */
+declare function makeEvent(type: string, data: unknown): ProgressEvent;
+
 /**
  * Kernel entry point. `createKernel()` returns a shell with an empty registry
  * and no bound ports. Driving adapters (CLI, Server, Skill) are expected to
@@ -2961,7 +3603,22 @@ interface Kernel {
      * MUST treat the resulting array as immutable.
      */
     setRegisteredAnnotationKeys: (entries: readonly IRegisteredAnnotationKey[]) => void;
+    /**
+     * Step 11.x — read-only catalog of plugin-contributed view
+     * contributions, keyed by `(pluginId, extensionId, contributionId)`.
+     * Populated at plugin-load time; pure read with no side effects.
+     * Mirror of `getRegisteredAnnotationKeys` for the view contribution
+     * surface (see `architecture.md` §View contribution system →
+     * Runtime catalog).
+     */
+    getRegisteredViewContributions: () => readonly IRegisteredViewContribution[];
+    /**
+     * Internal — replace the frozen view-contribution catalog. Called
+     * once by the plugin runtime composer after every plugin has loaded;
+     * consumers MUST treat the resulting array as immutable.
+     */
+    setRegisteredViewContributions: (entries: readonly IRegisteredViewContribution[]) => void;
 }
 declare function createKernel(): Kernel;
 
-export { type Confidence, DuplicateExtensionError, EXTENSION_KINDS, type ExecutionFailureReason, type ExecutionKind, type ExecutionRecord, type ExecutionRunner, type ExecutionStatus, ExportQueryError, type Extension, type ExtensionKind, type FilesystemPort, HOOK_TRIGGERS, type HistoryStats, type HistoryStatsErrorRates, type HistoryStatsExecutionsPerPeriod, type HistoryStatsPerActionRate, type HistoryStatsTokensPerAction, type HistoryStatsTopNode, type HistoryStatsTotals, type IAction, type IActionContext, type IActionPrecondition, type IActionResult, type IAnnotationContribution, type ICreateFsWatcherOptions, type IDedicatedStorePersist, type IDedicatedStoreWrapper, type IDiscoveredPlugin, type IEnrichmentRecord, type IExportQuery, type IExportSubset, type IExtensionBase, type IExtractor, type IExtractorCallbacks, type IExtractorContext, type IExtractorRunRecord, type IFormatter, type IFormatterContext, type IFsWatcher, type IHook, type IHookContext, type IIssueRow, type IKvStorePersist, type IKvStoreWrapper, type ILoadedExtension, type INodeBundle, type INodeChange, type INodeCounts, type INodeFilter, type IPersistOptions, type IPersistedEnrichment, type IPluginManifest, type IPluginStorageSchema, type IPluginStore, type IProvider, type IRawNode, type IRegisteredAnnotationKey, type IRule, type IRuleContext, type IRunOptions, type IRunResult, type IScanDelta, type ITransactionalStorage, type IWalkOptions, type IWatchBatch, type IWatchEvent, InMemoryProgressEmitter, type Issue, type IssueFix, KV_SCHEMA_KEY, type Kernel, LOG_LEVELS, type Link, type LinkKind, type LinkLocation, type LinkTrigger, type LogRecord, type LoggerPort, type Node, type NodeKind, type NodeStat, type PluginLoaderPort, type ProgressEmitterPort, type ProgressEvent, Registry, type RenameOp, type RunScanOptions, type RunnerPort, type ScanResult, type ScanScannedBy, type ScanStats, type Severity, SilentLogger, type Stability, type StoragePort, type TActionWrite, type TExecutionMode, type TGranularity, type THookFilter, type THookTrigger, type TLogLevel, type TLogMethodLevel, type TNodeChangeReason, type TPluginLoadStatus, type TPluginStorage, type TProgressListener, type TWatchEventKind, type TripleSplit, applyExportQuery, computeScanDelta, configureLogger, createChokidarWatcher, createKernel, detectRenamesAndOrphans, getActiveLogger, isEmptyDelta, isLogLevel, log, logLevelRank, makeDedicatedStoreWrapper, makeKvStoreWrapper, makePluginStore, mergeNodeWithEnrichments, parseExportQuery, parseLogLevel, qualifiedExtensionId, resetLogger, runExtractorsForNode, runScan, runScanWithRenames };
+export { type Confidence, DuplicateExtensionError, EXTENSION_KINDS, type ExecutionFailureReason, type ExecutionKind, type ExecutionRecord, type ExecutionRunner, type ExecutionStatus, ExportQueryError, type Extension, type ExtensionKind, type FilesystemPort, HOOK_TRIGGERS, type HistoryStats, type HistoryStatsErrorRates, type HistoryStatsExecutionsPerPeriod, type HistoryStatsPerActionRate, type HistoryStatsTokensPerAction, type HistoryStatsTopNode, type HistoryStatsTotals, type IAction, type IActionContext, type IActionPrecondition, type IActionResult, type IAnalyzer, type IAnalyzerContext, type IAnnotationContribution, type ICreateFsWatcherOptions, type IDedicatedStorePersist, type IDedicatedStoreWrapper, type IDiscoveredPlugin, type IEnrichmentRecord, type IExportQuery, type IExportSubset, type IExtensionBase, type IExtractor, type IExtractorCallbacks, type IExtractorContext, type IExtractorRunRecord, type IFormatter, type IFormatterContext, type IFsWatcher, type IHook, type IHookContext, type IHookDispatcher, type IIssueRow, type IKvStorePersist, type IKvStoreWrapper, type ILoadedExtension, type INodeBundle, type INodeChange, type INodeCounts, type INodeFilter, type IPersistOptions, type IPersistedEnrichment, type IPluginManifest, type IPluginStorageSchema, type IPluginStore, type IProvider, type IRawNode, type IRegisteredAnnotationKey, type IRegisteredViewContribution, type IRunOptions, type IRunResult, type IScanDelta, type ISettingDeclaration, type ITransactionalStorage, type IViewContribution, type IWalkOptions, type IWatchBatch, type IWatchEvent, InMemoryProgressEmitter, type Issue, type IssueFix, KV_SCHEMA_KEY, type Kernel, LOG_LEVELS, type Link, type LinkKind, type LinkLocation, type LinkTrigger, type LogRecord, type LoggerPort, type Node, type NodeKind, type NodeStat, type PluginLoaderPort, type ProgressEmitterPort, type ProgressEvent, Registry, type RenameOp, type RunScanOptions, type RunnerPort, type ScanResult, type ScanScannedBy, type ScanStats, type Severity, SilentLogger, type Stability, type StoragePort, type TActionWrite, type TExecutionMode, type TGranularity, type THookFilter, type THookTrigger, type TInputTypeName, type TLogLevel, type TLogMethodLevel, type TNodeChangeReason, type TPluginLoadStatus, type TPluginStorage, type TProgressListener, type TSettingValue, type TSeverity, type TSlotName, type TWatchEventKind, type TripleSplit, applyExportQuery, computeScanDelta, configureLogger, createChokidarWatcher, createKernel, detectRenamesAndOrphans, getActiveLogger, isEmptyDelta, isLogLevel, log, logLevelRank, makeDedicatedStoreWrapper, makeEvent, makeHookDispatcher, makeKvStoreWrapper, makePluginStore, mergeNodeWithEnrichments, parseExportQuery, parseLogLevel, qualifiedExtensionId, resetLogger, runExtractorsForNode, runScan, runScanWithRenames };