@skill-map/cli 0.28.0 → 0.29.0

package/dist/kernel/index.d.ts

@@ -1,760 +1,767 @@
 /**
- * Domain types, byte-aligned with `spec/schemas/{node,link,issue,scan-result}.schema.json`.
- *
- * The kernel is the reference consumer of the spec; these types are therefore
- * derived from the schemas, not invented. When a schema changes, this file
- * follows. Until automatic AJV-driven derivation lands, the mapping is
- * hand-maintained and the release gate is the conformance suite.
- *
- * --- Naming convention (kernel-wide) -------------------------------------
- *
- * Five categories with distinct prefix rules; the rules are deliberate
- * even though they look mixed at first read:
- *
- *   1. **Domain types**, every shape that mirrors a `spec/schemas/*.json`
- *      file: `Node`, `Link`, `Issue`, `ScanResult`, `ScanStats`,
- *      `ExecutionRecord`, `HistoryStats`, …. **No prefix.** Names track
- *      the spec verbatim because the spec is the source of truth.
- *      Renaming any of these is a spec change.
- *
- *   2. **Hexagonal ports**, the abstract boundaries the kernel calls
- *      out to (`StoragePort`, `RunnerPort`, `ProgressEmitterPort`,
- *      `FilesystemPort`, `PluginLoaderPort`). **`Port` suffix.** The
- *      suffix calls out the architectural role and avoids name clashes
- *      with the concrete adapter classes (`SqliteStorageAdapter`
- *      implements `StoragePort`).
- *
- *   3. **Runtime extension contracts**, what a plugin author
- *      implements: `IProvider`, `IExtractor`, `IAnalyzer`, `IFormatter`,
- *      `IExtensionBase`. **`I` prefix.** The prefix flags "this is a
- *      contract you supply, not a value the kernel hands you", same
- *      reading as the rest of TypeScript's plugin ecosystems where a
- *      shape is implementable.
+ * Extension registry, six kinds, first-class, loaded through a single API.
  *
- *   4. **Internal interfaces**, option bags, result records, config
- *      slices, anything declared as `interface` and passed across
- *      function boundaries inside the kernel / CLI but not part of the
- *      spec: `IPluginRuntimeBundle`, `IPruneResult`, `IMigrationFile`,
- *      `IDbLocationOptions`. **`I` prefix.** The prefix matches
- *      category 3 because both are "shapes that live in TypeScript
- *      only, never in JSON".
+ * The `Extension` shape is aligned with `spec/schemas/extensions/base.schema.json`.
+ * Kind-specific manifests (provider / extractor / analyzer / action / formatter /
+ * hook) extend this base structurally; the registry stores the base view
+ * and each kind's code carries its own fuller type where needed.
  *
- *   5. **Internal type aliases**, anything declared as `type` (string-
- *      literal unions, function types, mapped/derived types) that lives
- *      only in TS: `TLogLevel`, `TLogMethodLevel`, `TProgressListener`,
- *      `TLogFormatter`, `TActionWrite`, `TExecutionMode`, `TGranularity`,
- *      `THookFilter`, `THookTrigger`, `TNodeChangeReason`,
- *      `TPluginLoadStatus`, `TPluginStorage`, `TWatchEventKind`. **`T`
- *      prefix.** Use this bucket when `interface` is the wrong shape
- *      (a union, a callback signature, an `Exclude<…>` derivation).
+ * **Spec § A.6, qualified ids.** Every extension is keyed in the registry
+ * by `<pluginId>/<id>` (e.g. `core/annotations`, `core/slash`,
+ * `hello-world/greet`). `Extension.id` carries the **short** id as authored;
+ * `Extension.pluginId` carries the namespace; the registry composes the
+ * qualifier internally and exposes lookup APIs that operate on either form
+ * (qualified for direct lookup, kind-scoped listing for enumeration).
  *
- * Edge cases worth knowing:
- *   - The following category-4 names lack the `I` prefix because
- *     they are part of the public kernel surface and renaming is a
- *     breaking change for downstream consumers. The list is closed:
- *       option bags / records: `RunScanOptions`, `RenameOp`;
- *       TS-only exports from `kernel/index.ts` / `kernel/ports/*`:
- *         `Kernel`, `ProgressEvent`, `LogRecord`, `NodeStat`.
- *     New public option bags MUST still use `I*`; new public type
- *     aliases MUST still use `T*`. Removing a name from this list is a
- *     breaking change.
- *   - `IDatabase` (SQLite schema) is category 4 but lives in
- *     `adapters/sqlite/schema.ts`, not here. Same rule applies.
+ * Boot invariant: `new Registry()` is empty. `registry.totalCount() === 0`
+ * when the kernel boots with zero extensions. This is the data side of the
+ * `kernel-empty-boot` conformance contract.
+ */
+type ExtensionKind = 'provider' | 'extractor' | 'analyzer' | 'action' | 'formatter' | 'hook';
+declare const EXTENSION_KINDS: readonly ExtensionKind[];
+interface Extension {
+    /** Short (unqualified) extension id, injected by the loader from the leaf folder name. */
+    id: string;
+    /** Owning plugin namespace, injected by the loader from the plugin folder name. */
+    pluginId: string;
+    kind: ExtensionKind;
+    version: string;
+    /** Required short description; surfaced in `sm <kind>s list` and the UI. */
+    description: string;
+    entry?: string;
+}
+/**
+ * Compose the qualified registry key for an extension. Single source of
+ * truth so callers don't reinvent the format and a future change (e.g. a
+ * different separator) lands in one place.
+ */
+declare function qualifiedExtensionId(pluginId: string, id: string): string;
+declare class DuplicateExtensionError extends Error {
+    constructor(kind: ExtensionKind, qualifiedId: string);
+}
+declare class Registry {
+    #private;
+    constructor();
+    register(ext: Extension): void;
+    /**
+     * Lookup by qualified id (`<pluginId>/<id>`). Returns `undefined` when
+     * no extension of that kind is registered under the qualifier.
+     */
+    get(kind: ExtensionKind, qualifiedId: string): Extension | undefined;
+    /**
+     * Convenience wrapper that composes the qualified id for the caller.
+     * Equivalent to `get(kind, qualifiedExtensionId(pluginId, id))`.
+     */
+    find(kind: ExtensionKind, pluginId: string, id: string): Extension | undefined;
+    all(kind: ExtensionKind): Extension[];
+    count(kind: ExtensionKind): number;
+    totalCount(): number;
+}
+
+/**
+ * Step 9.6.6, runtime annotation-contribution catalog types.
  *
- * If you find yourself wanting to add a new type and aren't sure which
- * bucket it falls in: ask "does this shape exist in the spec?". If
- * yes, no prefix and align the name with the schema. If no, `I` prefix
- * for `interface`, `T` prefix for `type` aliases.
+ * Lives in its own module (rather than `kernel/index.ts`) so consumers
+ * deep inside the kernel, `IAnalyzerContext`, the BFF route factories,
+ * future Action contexts, can depend on the catalog shape without
+ * dragging the whole kernel barrel and risking a cycle.
  */
 /**
- * The four node kinds the **built-in Claude Provider** declares, `skill`,
- * `agent`, `command`, `note`. **NOT** the kernel-wide kind type.
+ * Single row of the runtime annotation-contribution catalog surfaced by
+ * `kernel.getRegisteredAnnotationKeys()`. One row per (plugin × key)
+ * tuple. Built-in catalog keys from `annotations.schema.json` are NOT
+ * included, this catalog is plugin-only; the UI knows the built-in
+ * catalog via the schema bundle.
+ */
+interface IRegisteredAnnotationKey {
+    pluginId: string;
+    key: string;
+    location: 'namespaced' | 'root';
+    ownership: 'exclusive' | 'shared';
+    /** Inline JSON Schema as declared in the manifest (not the AJV compiled validator). */
+    schema: Record<string, unknown>;
+}
+
+/**
+ * Step 11.x, runtime view-contribution catalog types.
  *
- * `Node.kind` is `string`. An external Provider (Cursor, Obsidian, …)
- * MAY classify into its own kinds (e.g. `'cursorRule'`, `'daily'`); the
- * orchestrator, persistence layer, and AJV `node.schema.json` accept any
- * non-empty string. Per `spec/db-schema.md` § scan_nodes and
- * `node.schema.json#/properties/kind`, the contract is open-by-design
- * (matches `IProvider.kinds` "open by design" docstring).
+ * Lives in its own module (rather than `kernel/index.ts`) so consumers
+ * deep inside the kernel, `IAnalyzerContext`, the BFF route factories,
+ * future Action contexts, can depend on the catalog shape without
+ * dragging the whole kernel barrel and risking a cycle.
  *
- * Step 9.5 dropped `hook` from the catalog: `.claude/hooks/*.md` is NOT
- * an Anthropic-defined node type, hooks live in `settings.json` or as
- * sub-objects of agent / skill frontmatter (see
- * https://code.claude.com/docs/en/hooks.md). Files at the old path
- * classify as `markdown` via the Provider's fallback. The fallback is
- * named after the *format* because the file is generic markdown with
- * no specific role; format-named kinds apply only as the generic
- * fallback, a file that matches a specific role (agent / command /
- * skill) classifies under that role, not under `markdown`.
+ * Mirrors `annotation-catalog.ts` for the annotation contribution side
+ * (Step 9.6.6). The two systems share the "plugin contributes data,
+ * kernel exposes catalog, UI renders" pattern but never overlap in
+ * storage or routing, see `architecture.md` §View contribution system
+ * for the comparison table.
  *
- * This alias survives because:
- *   - claude-specific code legitimately wants to switch on the four
- *     hard-coded values (filter widgets, kind-aware UI cards, the
- *     `validate-all` built-in rule that maps each kind to its
- *     frontmatter schema);
- *   - sorting helpers want a stable `KIND_ORDER` for the canonical
- *     catalog;
- *   - tests expect to enumerate the four kinds when seeding fixtures.
+ * **Closed catalog by design.** Both `TSlotName` and `TInputTypeName`
+ * mirror the closed enums in `spec/schemas/view-slots.schema.json`
+ * and `spec/schemas/input-types.schema.json`. Adding a member is a
+ * coordinated kernel + spec + UI + scaffolder change. The closed-enum
+ * shape lets TypeScript surface unknown slots at author time
+ * (in plugin authors' editors when their plugin imports `@skill-map/cli`)
+ * AND lets the runtime exhaustively dispatch slot → renderer in the
+ * UI without `default:` fallbacks.
+ */
+/**
+ * Closed enum of view slot names. Mirror of
+ * `spec/schemas/view-slots.schema.json#/$defs/SlotName`.
  *
- * For "any kind a Provider could declare", use plain `string`. Only use
- * `NodeKind` when the code is intentionally claude-catalog-specific.
+ * Plugins pick one of these by name in their extension manifest's
+ * `viewContributions[<contributionId>].slot` field. The kernel
+ * validates each pick at load time (`invalid-manifest` on miss); the
+ * slot fixes both the renderer and the payload shape.
  */
-type NodeKind = 'skill' | 'agent' | 'command' | 'markdown';
-type LinkKind = 'invokes' | 'references' | 'mentions' | 'supersedes';
-type Confidence = 'high' | 'medium' | 'low';
-type Severity = 'error' | 'warn' | 'info';
-type Stability = 'experimental' | 'stable' | 'deprecated';
+type TSlotName = 'card.title.right' | 'card.subtitle.left' | 'card.footer.left' | 'card.footer.right' | 'graph.node.alert' | 'inspector.header.badge.counter' | 'inspector.header.badge.tag' | 'inspector.body.panel.breakdown' | 'inspector.body.panel.records' | 'inspector.body.panel.tree' | 'inspector.body.panel.key-values' | 'inspector.body.panel.link-list' | 'inspector.body.panel.markdown' | 'topbar.nav.start';
 /**
- * Execution mode of an analytical extension. Mirrors the per-kind capability
- * matrix in `spec/architecture.md` §Execution modes:
+ * Closed enum of input-type names for plugin settings. Mirror of
+ * `spec/schemas/input-types.schema.json#/$defs/InputTypeName`.
  *
- *   - `deterministic`, pure code, runs synchronously inside `sm scan` /
- *     `sm check`. Same input → same output, every run.
- *   - `probabilistic`, calls an LLM through `RunnerPort`, dispatches only
- *     as a queued job (`sm job submit <kind>:<id>`); never participates in
- *     scan-time pipelines.
+ * Plugins pick one of these by name in their plugin manifest's
+ * `settings[<settingId>].type` field. The kernel exposes the resolved
+ * value via `ctx.settings.<settingId>` typed per the input-type's
+ * value-type promise.
+ */
+type TInputTypeName = 'string-list' | 'single-string' | 'boolean-flag' | 'integer' | 'enum-pick' | 'enum-multipick' | 'path-glob' | 'regex' | 'secret' | 'key-value-list';
+/** Closed severity palette aligned with PrimeNG `<p-tag>` / `<p-message>`. */
+type TSeverity = 'info' | 'warn' | 'success' | 'danger';
+/**
+ * Manifest-side declaration of a single view contribution. The plugin
+ * author writes one of these per Record key in
+ * `IExtensionBase.viewContributions[<contributionId>]`.
  *
- * Extractor / Rule / Action declare it directly (default `deterministic` when
- * omitted in the manifest). Provider / Formatter are deterministic-only and
- * MUST NOT carry the field.
+ * Mirror of `view-slots.schema.json#/$defs/IViewContribution`.
  */
-type TExecutionMode = 'deterministic' | 'probabilistic';
-interface TripleSplit {
-    frontmatter: number;
-    body: number;
-    total: number;
-}
-interface LinkTrigger {
-    originalTrigger: string;
-    normalizedTrigger: string;
-}
-interface LinkLocation {
-    line: number;
-    column?: number;
-    offset?: number;
-}
-interface Node {
-    path: string;
+interface IViewContribution {
+    /**
+     * Required. Closed-catalog slot name. Unknown name rejects the
+     * extension as `invalid-manifest` at load. The slot fixes both the
+     * renderer and the payload shape; there is no separate "contract"
+     * abstraction.
+     */
+    slot: TSlotName;
+    /**
+     * Optional human-readable label. English-only per `AGENTS.md`
+     * (`Externalized texts, not internationalized`).
+     */
+    label?: string;
+    /** Optional hover tooltip. English-only. */
+    tooltip?: string;
+    /**
+     * Optional emoji codepoint OR PrimeIcons class id (without the
+     * `pi-` prefix). The UI discriminates: matches Unicode
+     * `\p{Extended_Pictographic}` → emoji text, otherwise → PrimeIcon.
+     * Required for counter slots and `card.title.right` (enforced by
+     * the manifest-side conditional in `view-slots.schema.json`).
+     */
+    icon?: string;
     /**
-     * Provider-declared category. Open string (matches
-     * `node.schema.json#/properties/kind`): the built-in Claude Provider
-     * emits one of `NodeKind`'s values, but external Providers MAY emit
-     * their own. Code that intentionally switches on the claude catalog
-     * narrows via `if (kind === 'skill' \| ... )`; everything else
-     * accepts the open string and treats unknown values as opaque labels.
+     * Optional empty placeholder text shown when the payload is empty
+     * AND `emitWhenEmpty` is true. Falls back to a UI-supplied generic
+     * 'No data.' string. English-only.
      */
-    kind: string;
-    provider: string;
-    bodyHash: string;
-    frontmatterHash: string;
-    bytes: TripleSplit;
-    linksOutCount: number;
-    linksInCount: number;
-    externalRefsCount: number;
-    frontmatter?: Record<string, unknown>;
-    tokens?: TripleSplit;
+    emptyText?: string;
     /**
-     * Step 9.6.2, sidecar denormalisation surface. Populated by the
-     * orchestrator at scan time; absent when the orchestrator did not
-     * inspect sidecars (legacy code paths) or when no sidecar accompanies
-     * the node. Read by `annotation-stale` rule and the persistence layer.
+     * When false (default), the kernel drops emissions whose payload is
+     * structurally empty so the slot stays silent. When true, the
+     * renderer surfaces an empty placeholder. Per-slot definition of
+     * "empty" lives in the slot's payload schema.
      */
-    sidecar?: ISidecarOverlay | null;
+    emitWhenEmpty?: boolean;
     /**
-     * Per-user "favorite" flag, decorated by the BFF on `/api/nodes` and
-     * `/api/nodes/:pathB64` responses via in-memory `Set` lookup against
-     * `state_node_favorites`. Absent on emissions that don't carry per-user
-     * state (e.g. `sm export --json`); consumers that don't recognise the
-     * field MUST treat the absence as "unknown" rather than "false", a
-     * truthy `isFavorite` only ever lands when the BFF set it.
+     * Optional ordering hint (default 100). Slots configured with
+     * `order: 'priority'` sort contributions ASC by this value, with
+     * alphabetical tie-break by qualified id. The plugin uses this to
+     * suggest where its contribution belongs relative to others sharing
+     * the same slot, the slot has the final say.
      */
-    isFavorite?: boolean;
+    priority?: number;
 }
 /**
- * Drift status of a co-located `.sm` sidecar relative to the live
- * node hashes. Mirrors `TSidecarStatus` on the SQLite schema.
+ * Single row of the runtime view-contribution catalog surfaced by
+ * `kernel.getRegisteredViewContributions()`. One row per
+ * `(pluginId × extensionId × contributionId)` tuple. Composed at boot
+ * by `loadPluginRuntime` from every loaded extension's
+ * `viewContributions` map.
+ *
+ * The qualified id is `<pluginId>/<extensionId>/<contributionId>`,
+ * matches the qualified id pattern used elsewhere in the kernel
+ * (`<pluginId>/<extensionId>` for extensions; this adds the third
+ * segment for per-contribution identity).
  */
-type SidecarStatus = 'fresh' | 'stale-body' | 'stale-frontmatter' | 'stale-both';
+interface IRegisteredViewContribution {
+    pluginId: string;
+    extensionId: string;
+    contributionId: string;
+    slot: TSlotName;
+    /** Optional manifest-declared label (English-only). */
+    label?: string;
+    tooltip?: string;
+    icon?: string;
+    emptyText?: string;
+    emitWhenEmpty: boolean;
+    /** Manifest-declared ordering hint (default 100). See `IViewContribution.priority`. */
+    priority?: number;
+}
 /**
- * Sidecar overlay attached to a `Node` after the orchestrator parses
- * `<basename>.sm`. `present === false` is the empty overlay (no
- * sidecar accompanies the node); the other fields are absent or null
- * in that case. When `present === true` and parse + validation
- * succeeded, `status` carries the drift state and `annotations` carries
- * the parsed (typed) `annotations:` block.
+ * Common fields on every setting declaration. The discriminated union
+ * `ISettingDeclaration` extends one of these per `type` value.
  */
-interface ISidecarOverlay {
-    present: boolean;
-    status?: SidecarStatus | null;
-    /**
-     * Parsed `annotations:` block. Untyped object, schema lives in
-     * `spec/schemas/annotations.schema.json`. Null when no sidecar or
-     * the block is empty/absent.
-     */
-    annotations?: Record<string, unknown> | null;
-    /**
-     * R15 closure (2026-05-07), full parsed YAML root of the sidecar
-     * (the entire `.sm` payload, mirroring `sidecar.schema.json`). Surfaced
-     * so the UI inspector can render `for:`, `audit:`, `settings:`, and
-     * `<plugin-id>:` namespace blocks without re-reading the file. NULL
-     * when no sidecar is present, or when the sidecar exists but failed
-     * to parse / validate. The `annotations` field above stays, it
-     * duplicates `root.annotations` intentionally so existing consumers
-     * keep working unchanged.
-     */
-    root?: Record<string, unknown> | null;
+interface ISettingCommon {
+    /** Required. Short human-readable label. English-only. */
+    label: string;
+    /** Optional helper text shown below the control. English-only. */
+    description?: string;
 }
-interface Link {
-    /** The originating node, the path of the file the extractor was reading
-     *  when it emitted this link. Singular, NOT to be confused with
-     *  `sources` (plural) below. */
-    source: string;
-    target: string;
-    kind: LinkKind;
-    confidence: Confidence;
-    /** Identifiers of the extractors / extensions that contributed evidence
-     *  for this link (one link can be confirmed by multiple extractors).
-     *  Plural; NOT the same as `source` (singular) above, which is the
-     *  originating node path. Naming is unfortunate but spec-frozen. */
-    sources: string[];
-    trigger?: LinkTrigger | null;
-    location?: LinkLocation | null;
-    raw?: string | null;
+interface ISetting_StringList extends ISettingCommon {
+    type: 'string-list';
+    default?: string[];
+    min?: number;
+    max?: number;
+    itemMaxLength?: number;
 }
-interface IssueFix {
-    summary?: string;
-    autofixable?: boolean;
+interface ISetting_SingleString extends ISettingCommon {
+    type: 'single-string';
+    default?: string;
+    minLength?: number;
+    maxLength?: number;
+    /** Optional ECMAScript regex pattern (no flags). */
+    pattern?: string;
 }
-interface Issue {
-    analyzerId: string;
-    severity: Severity;
-    nodeIds: string[];
-    message: string;
-    linkIndices?: number[];
-    detail?: string | null;
-    fix?: IssueFix | null;
-    data?: Record<string, unknown>;
+interface ISetting_BooleanFlag extends ISettingCommon {
+    type: 'boolean-flag';
+    default?: boolean;
 }
-interface ScanStats {
-    /**
-     * Files visited by the Provider walkers. With a single Provider this
-     * matches `nodesCount`; with multiple Providers running on overlapping
-     * roots it can diverge (each yielded `IRawNode` is one walked file).
-     */
-    filesWalked: number;
-    /**
-     * Files walked but not classified by any Provider. Today every walked
-     * file is classified by its Provider (the `claude` Provider falls back to
-     * `'markdown'`), so this is always 0; the field will matter once
-     * multiple Providers can claim the same file.
-     */
-    filesSkipped: number;
-    nodesCount: number;
-    linksCount: number;
-    issuesCount: number;
-    durationMs: number;
+interface ISetting_Integer extends ISettingCommon {
+    type: 'integer';
+    default?: number;
+    min?: number;
+    max?: number;
+    step?: number;
 }
-interface ScanScannedBy {
-    name: string;
-    version: string;
-    specVersion: string;
+interface ISetting_EnumOption {
+    value: string;
+    label: string;
 }
-type ExecutionKind = 'action';
-type ExecutionStatus = 'completed' | 'failed' | 'cancelled';
-type ExecutionFailureReason = 'runner-error' | 'report-invalid' | 'timeout' | 'abandoned' | 'job-file-missing' | 'user-cancelled';
-type ExecutionRunner = 'cli' | 'skill' | 'in-process';
-/**
- * One row of execution history (`state_executions`). Matches
- * `spec/schemas/execution-record.schema.json`. `nodeIds` is the camelCased
- * domain field name; storage flattens it to `node_ids_json`.
- */
-interface ExecutionRecord {
-    id: string;
-    kind: ExecutionKind;
-    extensionId: string;
-    extensionVersion: string;
-    nodeIds?: string[];
-    contentHash?: string | null;
-    status: ExecutionStatus;
-    failureReason?: ExecutionFailureReason | null;
-    exitCode?: number | null;
-    runner?: ExecutionRunner | null;
-    startedAt: number;
-    finishedAt: number;
-    durationMs?: number | null;
-    tokensIn?: number | null;
-    tokensOut?: number | null;
-    reportPath?: string | null;
-    jobId?: string | null;
+interface ISetting_EnumPick extends ISettingCommon {
+    type: 'enum-pick';
+    options: ISetting_EnumOption[];
+    default?: string;
 }
-interface HistoryStatsTotals {
-    executionsCount: number;
-    completedCount: number;
-    failedCount: number;
-    tokensIn: number;
-    tokensOut: number;
-    durationMsTotal: number;
+interface ISetting_EnumMultipick extends ISettingCommon {
+    type: 'enum-multipick';
+    options: ISetting_EnumOption[];
+    default?: string[];
+    min?: number;
+    max?: number;
 }
-interface HistoryStatsTokensPerAction {
-    actionId: string;
-    actionVersion: string;
-    executionsCount: number;
-    tokensIn: number;
-    tokensOut: number;
-    durationMsMean: number | null;
-    durationMsMedian: number | null;
+interface ISetting_PathGlob extends ISettingCommon {
+    type: 'path-glob';
+    default?: string;
+    /** When true, accepts string[]; when false (default), single string. */
+    multiple?: boolean;
 }
-interface HistoryStatsExecutionsPerPeriod {
-    periodStart: string;
-    periodUnit: 'day' | 'week' | 'month';
-    executionsCount: number;
-    tokensIn: number;
-    tokensOut: number;
+interface ISetting_Regex extends ISettingCommon {
+    type: 'regex';
+    default?: string;
+    /** Subset of `gimsuy`. Default `''`. */
+    flags?: string;
 }
-interface HistoryStatsTopNode {
-    nodePath: string;
-    executionsCount: number;
-    lastExecutedAt: number;
+interface ISetting_Secret extends ISettingCommon {
+    type: 'secret';
+    /**
+     * Optional uppercase-ASCII identifier. When set in the process
+     * environment, that value wins over any stored value (lets CI
+     * inject without writing to disk).
+     */
+    envVar?: string;
 }
-interface HistoryStatsPerActionRate {
-    actionId: string;
-    rate: number;
-    executionsCount: number;
-    failedCount: number;
+interface ISetting_KeyValueListEntry {
+    key: string;
+    value: string;
 }
-interface HistoryStatsErrorRates {
-    global: number;
-    perAction: HistoryStatsPerActionRate[];
-    perFailureReason: Record<ExecutionFailureReason, number>;
+interface ISetting_KeyValueList extends ISettingCommon {
+    type: 'key-value-list';
+    keyLabel?: string;
+    valueLabel?: string;
+    default?: ISetting_KeyValueListEntry[];
+    min?: number;
+    max?: number;
 }
 /**
- * `sm history stats --json` payload, conforming to
- * `spec/schemas/history-stats.schema.json`. `elapsedMs` is the command's
- * own wall-clock per `cli-contract.md` §Elapsed time.
+ * Discriminated union of every setting declaration shape. The plugin
+ * author NEVER writes JSON Schema for settings, they pick one of
+ * these `type` values and supply per-type parameters.
+ *
+ * Mirror of `input-types.schema.json#/$defs/ISettingDeclaration`.
  */
-interface HistoryStats {
-    schemaVersion: 1;
-    range: {
-        since: string | null;
-        until: string;
-    };
-    totals: HistoryStatsTotals;
-    tokensPerAction: HistoryStatsTokensPerAction[];
-    executionsPerPeriod: HistoryStatsExecutionsPerPeriod[];
-    topNodes: HistoryStatsTopNode[];
-    errorRates: HistoryStatsErrorRates;
-    elapsedMs: number;
-}
-interface ScanResult {
-    schemaVersion: 1;
-    /** Unix milliseconds when the scan started. */
-    scannedAt: number;
-    /**
-     * Filesystem roots that were walked during this scan. Spec requires
-     * `minItems: 1`, `runScan` throws if `roots: []` is supplied.
-     */
-    roots: string[];
-    /** Provider ids that participated in classification. Empty if no Provider matched. */
-    providers: string[];
-    /** Implementation metadata. Populated by `runScan` for self-describing output. */
-    scannedBy?: ScanScannedBy;
-    nodes: Node[];
-    links: Link[];
-    issues: Issue[];
-    stats: ScanStats;
-}
+type ISettingDeclaration = ISetting_StringList | ISetting_SingleString | ISetting_BooleanFlag | ISetting_Integer | ISetting_EnumPick | ISetting_EnumMultipick | ISetting_PathGlob | ISetting_Regex | ISetting_Secret | ISetting_KeyValueList;
+/**
+ * Runtime value type for a setting, derived from its declaration. The
+ * kernel exposes settings to extractors as `Record<string, TSettingValue>`
+ * via `ctx.settings.<settingId>`; consumers that want narrow typing
+ * narrow at the call site by reading `manifest.settings[id].type`.
+ */
+type TSettingValue = string | string[] | boolean | number | ISetting_KeyValueListEntry[];
 
 /**
- * Extension registry, six kinds, first-class, loaded through a single API.
- *
- * The `Extension` shape is aligned with `spec/schemas/extensions/base.schema.json`.
- * Kind-specific manifests (provider / extractor / analyzer / action / formatter /
- * hook) extend this base structurally; the registry stores the base view
- * and each kind's code carries its own fuller type where needed.
- *
- * **Spec § A.6, qualified ids.** Every extension is keyed in the registry
- * by `<pluginId>/<id>` (e.g. `core/annotations`, `core/slash`,
- * `hello-world/greet`). `Extension.id` carries the **short** id as authored;
- * `Extension.pluginId` carries the namespace; the registry composes the
- * qualifier internally and exposes lookup APIs that operate on either form
- * (qualified for direct lookup, kind-scoped listing for enumeration).
+ * Base extension shape shared by every kind. Mirrors
+ * `spec/schemas/extensions/base.schema.json` at the TypeScript level.
  *
- * Boot invariant: `new Registry()` is empty. `registry.totalCount() === 0`
- * when the kernel boots with zero extensions. This is the data side of the
- * `kernel-empty-boot` conformance contract.
+ * **Structure-as-truth**: the manifest authored on disk no longer carries
+ * `id` or `kind`. Both fields are derived from the filesystem path
+ * (`<plugin>/<kind-plural>/<id>/index.ts`, parent folder dictates kind, leaf
+ * folder dictates id). The loader strips/rejects any `id` / `kind` literals
+ * a hand-written manifest carries and injects the derived values into the
+ * runtime descriptor before it reaches the registry. The qualified registry
+ * key is `<pluginId>/<id>`; `pluginId` similarly comes from the plugin's
+ * folder name and is injected at load time.
  */
 
-type ExtensionKind = 'provider' | 'extractor' | 'analyzer' | 'action' | 'formatter' | 'hook';
-declare const EXTENSION_KINDS: readonly ExtensionKind[];
-interface Extension {
-    /** Short (unqualified) extension id as declared in the manifest. */
-    id: string;
-    /** Owning plugin namespace. Composed with `id` to form the qualified key. */
-    pluginId: string;
-    kind: ExtensionKind;
-    version: string;
-    description?: string;
-    stability?: Stability;
-    preconditions?: string[];
-    entry?: string;
-}
 /**
- * Compose the qualified registry key for an extension. Single source of
- * truth so callers don't reinvent the format and a future change (e.g. a
- * different separator) lands in one place.
+ * Single declaration of an extension's optional sidecar annotation
+ * contribution. The annotation key is the extension's id (the leaf folder
+ * name); to contribute additional keys, split into additional extensions.
+ * Mirrors `spec/schemas/extensions/base.schema.json#/properties/annotation`.
  */
-declare function qualifiedExtensionId(pluginId: string, id: string): string;
-declare class DuplicateExtensionError extends Error {
-    constructor(kind: ExtensionKind, qualifiedId: string);
-}
-declare class Registry {
-    #private;
-    constructor();
-    register(ext: Extension): void;
+interface IAnnotationContribution {
+    /** Inline JSON Schema describing the value written under this key. */
+    schema: Record<string, unknown>;
     /**
-     * Lookup by qualified id (`<pluginId>/<id>`). Returns `undefined` when
-     * no extension of that kind is registered under the qualifier.
+     * Conflict policy. `shared` (default): multiple plugins MAY write the
+     * key; `exclusive`: only this plugin may. REQUIRED to be `'exclusive'`
+     * when `location: 'root'`.
      */
-    get(kind: ExtensionKind, qualifiedId: string): Extension | undefined;
+    ownership?: 'exclusive' | 'shared';
     /**
-     * Convenience wrapper that composes the qualified id for the caller.
-     * Equivalent to `get(kind, qualifiedExtensionId(pluginId, id))`.
+     * Where the key lands. `namespaced` (default): under the plugin's
+     * `<plugin-id>:` block; `root`: top-level, alongside `for` /
+     * `annotations` / `settings` / `audit`. Cross-plugin root-key
+     * collisions on `exclusive` are a fatal startup error.
      */
-    find(kind: ExtensionKind, pluginId: string, id: string): Extension | undefined;
-    all(kind: ExtensionKind): Extension[];
-    count(kind: ExtensionKind): number;
-    totalCount(): number;
+    location?: 'namespaced' | 'root';
 }
-
-/**
- * Step 9.6.6, runtime annotation-contribution catalog types.
- *
- * Lives in its own module (rather than `kernel/index.ts`) so consumers
- * deep inside the kernel, `IAnalyzerContext`, the BFF route factories,
- * future Action contexts, can depend on the catalog shape without
- * dragging the whole kernel barrel and risking a cycle.
- */
 /**
- * Single row of the runtime annotation-contribution catalog surfaced by
- * `kernel.getRegisteredAnnotationKeys()`. One row per (plugin × key)
- * tuple. Built-in catalog keys from `annotations.schema.json` are NOT
- * included, this catalog is plugin-only; the UI knows the built-in
- * catalog via the schema bundle.
+ * Runtime extension descriptor as seen by the registry / orchestrator.
+ * Authors writing a manifest on disk do NOT declare `id`, `kind`, or
+ * `pluginId`; the loader injects all three from the filesystem layout.
  */
-interface IRegisteredAnnotationKey {
+interface IExtensionBase {
+    /**
+     * Short id, the leaf folder name of the extension. Injected by the
+     * loader. Hand-authored manifests carrying an `id` literal are
+     * rejected as `invalid-manifest`.
+     */
+    id: string;
+    /**
+     * Owning plugin namespace, the plugin folder name. Composed with `id`
+     * to produce the qualified registry key `<pluginId>/<id>`. Injected
+     * by the loader.
+     */
     pluginId: string;
-    key: string;
-    location: 'namespaced' | 'root';
-    ownership: 'exclusive' | 'shared';
-    /** Inline JSON Schema as declared in the manifest (not the AJV compiled validator). */
-    schema: Record<string, unknown>;
+    version: string;
+    /** Required short description shown by `sm <kind>s list` / UI. */
+    description: string;
+    /**
+     * Optional opt-in single annotation contribution. Renamed from
+     * `annotationContributions` (mapa) with the structure-as-truth
+     * refactor; the key is the extension's id, so only the schema +
+     * ownership + location triple lives in the manifest.
+     */
+    annotation?: IAnnotationContribution;
+    /**
+     * Optional extension-scoped user settings. Moved here from
+     * `plugin.json` with the structure-as-truth refactor: settings now
+     * live with the extension that consumes them, exposed at runtime as
+     * `ctx.settings.<settingId>`. Settings are read once at extension
+     * invocation; changing a setting requires `sm scan` to re-emit.
+     */
+    settings?: Record<string, ISettingDeclaration>;
+    /**
+     * Resolved values of the settings declared above, populated by the
+     * orchestrator from project config + user overrides. Runtime-only,
+     * never written to disk by authors.
+     */
+    resolvedSettings?: Record<string, TSettingValue>;
+    /**
+     * Optional plugin-contributed view contributions. Renamed from
+     * `viewContributions` with the structure-as-truth refactor. Each
+     * entry maps a local contribution id (kebab-case, unique within the
+     * extension) to an `IViewContribution` that picks a view slot by
+     * name from the closed catalog. Only `extractor` and `analyzer` kinds
+     * may declare this field.
+     */
+    ui?: Record<string, IViewContribution>;
+    /** Runtime-only, absolute path of the extension entry file. */
+    entry?: string;
 }
 
 /**
- * Step 11.x, runtime view-contribution catalog types.
+ * Domain types, byte-aligned with `spec/schemas/{node,link,issue,scan-result}.schema.json`.
  *
- * Lives in its own module (rather than `kernel/index.ts`) so consumers
- * deep inside the kernel, `IAnalyzerContext`, the BFF route factories,
- * future Action contexts, can depend on the catalog shape without
- * dragging the whole kernel barrel and risking a cycle.
+ * The kernel is the reference consumer of the spec; these types are therefore
+ * derived from the schemas, not invented. When a schema changes, this file
+ * follows. Until automatic AJV-driven derivation lands, the mapping is
+ * hand-maintained and the release gate is the conformance suite.
  *
- * Mirrors `annotation-catalog.ts` for the annotation contribution side
- * (Step 9.6.6). The two systems share the "plugin contributes data,
- * kernel exposes catalog, UI renders" pattern but never overlap in
- * storage or routing, see `architecture.md` §View contribution system
- * for the comparison table.
+ * --- Naming convention (kernel-wide) -------------------------------------
+ *
+ * Five categories with distinct prefix rules; the rules are deliberate
+ * even though they look mixed at first read:
+ *
+ *   1. **Domain types**, every shape that mirrors a `spec/schemas/*.json`
+ *      file: `Node`, `Link`, `Issue`, `ScanResult`, `ScanStats`,
+ *      `ExecutionRecord`, `HistoryStats`, …. **No prefix.** Names track
+ *      the spec verbatim because the spec is the source of truth.
+ *      Renaming any of these is a spec change.
+ *
+ *   2. **Hexagonal ports**, the abstract boundaries the kernel calls
+ *      out to (`StoragePort`, `RunnerPort`, `ProgressEmitterPort`,
+ *      `FilesystemPort`, `PluginLoaderPort`). **`Port` suffix.** The
+ *      suffix calls out the architectural role and avoids name clashes
+ *      with the concrete adapter classes (`SqliteStorageAdapter`
+ *      implements `StoragePort`).
+ *
+ *   3. **Runtime extension contracts**, what a plugin author
+ *      implements: `IProvider`, `IExtractor`, `IAnalyzer`, `IFormatter`,
+ *      `IExtensionBase`. **`I` prefix.** The prefix flags "this is a
+ *      contract you supply, not a value the kernel hands you", same
+ *      reading as the rest of TypeScript's plugin ecosystems where a
+ *      shape is implementable.
+ *
+ *   4. **Internal interfaces**, option bags, result records, config
+ *      slices, anything declared as `interface` and passed across
+ *      function boundaries inside the kernel / CLI but not part of the
+ *      spec: `IPluginRuntimeBundle`, `IPruneResult`, `IMigrationFile`,
+ *      `IDbLocationOptions`. **`I` prefix.** The prefix matches
+ *      category 3 because both are "shapes that live in TypeScript
+ *      only, never in JSON".
+ *
+ *   5. **Internal type aliases**, anything declared as `type` (string-
+ *      literal unions, function types, mapped/derived types) that lives
+ *      only in TS: `TLogLevel`, `TLogMethodLevel`, `TProgressListener`,
+ *      `TLogFormatter`, `TActionWrite`, `TExecutionMode`, `TGranularity`,
+ *      `THookFilter`, `THookTrigger`, `TNodeChangeReason`,
+ *      `TPluginLoadStatus`, `TPluginStorage`, `TWatchEventKind`. **`T`
+ *      prefix.** Use this bucket when `interface` is the wrong shape
+ *      (a union, a callback signature, an `Exclude<…>` derivation).
+ *
+ * Edge cases worth knowing:
+ *   - The following category-4 names lack the `I` prefix because
+ *     they are part of the public kernel surface and renaming is a
+ *     breaking change for downstream consumers. The list is closed:
+ *       option bags / records: `RunScanOptions`, `RenameOp`;
+ *       TS-only exports from `kernel/index.ts` / `kernel/ports/*`:
+ *         `Kernel`, `ProgressEvent`, `LogRecord`, `NodeStat`.
+ *     New public option bags MUST still use `I*`; new public type
+ *     aliases MUST still use `T*`. Removing a name from this list is a
+ *     breaking change.
+ *   - `IDatabase` (SQLite schema) is category 4 but lives in
+ *     `adapters/sqlite/schema.ts`, not here. Same rule applies.
+ *
+ * If you find yourself wanting to add a new type and aren't sure which
+ * bucket it falls in: ask "does this shape exist in the spec?". If
+ * yes, no prefix and align the name with the schema. If no, `I` prefix
+ * for `interface`, `T` prefix for `type` aliases.
+ */
+/**
+ * The four node kinds the **built-in Claude Provider** declares, `skill`,
+ * `agent`, `command`, `note`. **NOT** the kernel-wide kind type.
+ *
+ * `Node.kind` is `string`. An external Provider (Cursor, Obsidian, …)
+ * MAY classify into its own kinds (e.g. `'cursorRule'`, `'daily'`); the
+ * orchestrator, persistence layer, and AJV `node.schema.json` accept any
+ * non-empty string. Per `spec/db-schema.md` § scan_nodes and
+ * `node.schema.json#/properties/kind`, the contract is open-by-design
+ * (matches `IProvider.kinds` "open by design" docstring).
+ *
+ * Step 9.5 dropped `hook` from the catalog: `.claude/hooks/*.md` is NOT
+ * an Anthropic-defined node type, hooks live in `settings.json` or as
+ * sub-objects of agent / skill frontmatter (see
+ * https://code.claude.com/docs/en/hooks.md). Files at the old path
+ * classify as `markdown` via the Provider's fallback. The fallback is
+ * named after the *format* because the file is generic markdown with
+ * no specific role; format-named kinds apply only as the generic
+ * fallback, a file that matches a specific role (agent / command /
+ * skill) classifies under that role, not under `markdown`.
  *
- * **Closed catalog by design.** Both `TSlotName` and `TInputTypeName`
- * mirror the closed enums in `spec/schemas/view-slots.schema.json`
- * and `spec/schemas/input-types.schema.json`. Adding a member is a
- * coordinated kernel + spec + UI + scaffolder change. The closed-enum
- * shape lets TypeScript surface unknown slots at author time
- * (in plugin authors' editors when their plugin imports `@skill-map/cli`)
- * AND lets the runtime exhaustively dispatch slot → renderer in the
- * UI without `default:` fallbacks.
- */
-/**
- * Closed enum of view slot names. Mirror of
- * `spec/schemas/view-slots.schema.json#/$defs/SlotName`.
+ * This alias survives because:
+ *   - claude-specific code legitimately wants to switch on the four
+ *     hard-coded values (filter widgets, kind-aware UI cards, the
+ *     `validate-all` built-in rule that maps each kind to its
+ *     frontmatter schema);
+ *   - sorting helpers want a stable `KIND_ORDER` for the canonical
+ *     catalog;
+ *   - tests expect to enumerate the four kinds when seeding fixtures.
  *
- * Plugins pick one of these by name in their extension manifest's
- * `viewContributions[<contributionId>].slot` field. The kernel
- * validates each pick at load time (`invalid-manifest` on miss); the
- * slot fixes both the renderer and the payload shape.
+ * For "any kind a Provider could declare", use plain `string`. Only use
+ * `NodeKind` when the code is intentionally claude-catalog-specific.
  */
-type TSlotName = 'card.title.right' | 'card.subtitle.left' | 'card.footer.left' | 'card.footer.right' | 'graph.node.alert' | 'inspector.header.badge.counter' | 'inspector.header.badge.tag' | 'inspector.body.panel.breakdown' | 'inspector.body.panel.records' | 'inspector.body.panel.tree' | 'inspector.body.panel.key-values' | 'inspector.body.panel.link-list' | 'inspector.body.panel.markdown' | 'topbar.nav.start';
+type NodeKind = 'skill' | 'agent' | 'command' | 'markdown';
+type LinkKind = 'invokes' | 'references' | 'mentions' | 'supersedes';
+type Confidence = 'high' | 'medium' | 'low';
+type Severity = 'error' | 'warn' | 'info';
+type Stability = 'experimental' | 'stable' | 'deprecated';
 /**
- * Closed enum of input-type names for plugin settings. Mirror of
- * `spec/schemas/input-types.schema.json#/$defs/InputTypeName`.
+ * Execution mode of an analytical extension. Mirrors the per-kind capability
+ * matrix in `spec/architecture.md` §Execution modes:
  *
- * Plugins pick one of these by name in their plugin manifest's
- * `settings[<settingId>].type` field. The kernel exposes the resolved
- * value via `ctx.settings.<settingId>` typed per the input-type's
- * value-type promise.
- */
-type TInputTypeName = 'string-list' | 'single-string' | 'boolean-flag' | 'integer' | 'enum-pick' | 'enum-multipick' | 'path-glob' | 'regex' | 'secret' | 'key-value-list';
-/** Closed severity palette aligned with PrimeNG `<p-tag>` / `<p-message>`. */
-type TSeverity = 'info' | 'warn' | 'success' | 'danger';
-/**
- * Manifest-side declaration of a single view contribution. The plugin
- * author writes one of these per Record key in
- * `IExtensionBase.viewContributions[<contributionId>]`.
+ *   - `deterministic`, pure code, runs synchronously inside `sm scan` /
+ *     `sm check`. Same input → same output, every run.
+ *   - `probabilistic`, calls an LLM through `RunnerPort`, dispatches only
+ *     as a queued job (`sm job submit <kind>:<id>`); never participates in
+ *     scan-time pipelines.
  *
- * Mirror of `view-slots.schema.json#/$defs/IViewContribution`.
+ * Extractor / Rule / Action declare it directly (default `deterministic` when
+ * omitted in the manifest). Provider / Formatter are deterministic-only and
+ * MUST NOT carry the field.
  */
-interface IViewContribution {
-    /**
-     * Required. Closed-catalog slot name. Unknown name rejects the
-     * extension as `invalid-manifest` at load. The slot fixes both the
-     * renderer and the payload shape; there is no separate "contract"
-     * abstraction.
-     */
-    slot: TSlotName;
-    /**
-     * Optional human-readable label. English-only per `AGENTS.md`
-     * (`Externalized texts, not internationalized`).
-     */
-    label?: string;
-    /** Optional hover tooltip. English-only. */
-    tooltip?: string;
-    /**
-     * Optional emoji codepoint OR PrimeIcons class id (without the
-     * `pi-` prefix). The UI discriminates: matches Unicode
-     * `\p{Extended_Pictographic}` → emoji text, otherwise → PrimeIcon.
-     * Required for counter slots and `card.title.right` (enforced by
-     * the manifest-side conditional in `view-slots.schema.json`).
-     */
-    icon?: string;
+type TExecutionMode = 'deterministic' | 'probabilistic';
+interface TripleSplit {
+    frontmatter: number;
+    body: number;
+    total: number;
+}
+interface LinkTrigger {
+    originalTrigger: string;
+    normalizedTrigger: string;
+}
+interface LinkLocation {
+    line: number;
+    column?: number;
+    offset?: number;
+}
+interface Node {
+    path: string;
     /**
-     * Optional empty placeholder text shown when the payload is empty
-     * AND `emitWhenEmpty` is true. Falls back to a UI-supplied generic
-     * 'No data.' string. English-only.
+     * Provider-declared category. Open string (matches
+     * `node.schema.json#/properties/kind`): the built-in Claude Provider
+     * emits one of `NodeKind`'s values, but external Providers MAY emit
+     * their own. Code that intentionally switches on the claude catalog
+     * narrows via `if (kind === 'skill' \| ... )`; everything else
+     * accepts the open string and treats unknown values as opaque labels.
      */
-    emptyText?: string;
+    kind: string;
+    provider: string;
+    bodyHash: string;
+    frontmatterHash: string;
+    bytes: TripleSplit;
+    linksOutCount: number;
+    linksInCount: number;
+    externalRefsCount: number;
+    frontmatter?: Record<string, unknown>;
+    tokens?: TripleSplit;
     /**
-     * When false (default), the kernel drops emissions whose payload is
-     * structurally empty so the slot stays silent. When true, the
-     * renderer surfaces an empty placeholder. Per-slot definition of
-     * "empty" lives in the slot's payload schema.
+     * Step 9.6.2, sidecar denormalisation surface. Populated by the
+     * orchestrator at scan time; absent when the orchestrator did not
+     * inspect sidecars (legacy code paths) or when no sidecar accompanies
+     * the node. Read by `annotation-stale` rule and the persistence layer.
      */
-    emitWhenEmpty?: boolean;
+    sidecar?: ISidecarOverlay | null;
     /**
-     * Optional ordering hint (default 100). Slots configured with
-     * `order: 'priority'` sort contributions ASC by this value, with
-     * alphabetical tie-break by qualified id. The plugin uses this to
-     * suggest where its contribution belongs relative to others sharing
-     * the same slot, the slot has the final say.
+     * Per-user "favorite" flag, decorated by the BFF on `/api/nodes` and
+     * `/api/nodes/:pathB64` responses via in-memory `Set` lookup against
+     * `state_node_favorites`. Absent on emissions that don't carry per-user
+     * state (e.g. `sm export --json`); consumers that don't recognise the
+     * field MUST treat the absence as "unknown" rather than "false", a
+     * truthy `isFavorite` only ever lands when the BFF set it.
      */
-    priority?: number;
+    isFavorite?: boolean;
 }
 /**
- * Single row of the runtime view-contribution catalog surfaced by
- * `kernel.getRegisteredViewContributions()`. One row per
- * `(pluginId × extensionId × contributionId)` tuple. Composed at boot
- * by `loadPluginRuntime` from every loaded extension's
- * `viewContributions` map.
- *
- * The qualified id is `<pluginId>/<extensionId>/<contributionId>`,
- * matches the qualified id pattern used elsewhere in the kernel
- * (`<pluginId>/<extensionId>` for extensions; this adds the third
- * segment for per-contribution identity).
+ * Drift status of a co-located `.sm` sidecar relative to the live
+ * node hashes. Mirrors `TSidecarStatus` on the SQLite schema.
  */
-interface IRegisteredViewContribution {
-    pluginId: string;
-    extensionId: string;
-    contributionId: string;
-    slot: TSlotName;
-    /** Optional manifest-declared label (English-only). */
-    label?: string;
-    tooltip?: string;
-    icon?: string;
-    emptyText?: string;
-    emitWhenEmpty: boolean;
-    /** Manifest-declared ordering hint (default 100). See `IViewContribution.priority`. */
-    priority?: number;
-}
+type SidecarStatus = 'fresh' | 'stale-body' | 'stale-frontmatter' | 'stale-both';
 /**
- * Common fields on every setting declaration. The discriminated union
- * `ISettingDeclaration` extends one of these per `type` value.
+ * Sidecar overlay attached to a `Node` after the orchestrator parses
+ * `<basename>.sm`. `present === false` is the empty overlay (no
+ * sidecar accompanies the node); the other fields are absent or null
+ * in that case. When `present === true` and parse + validation
+ * succeeded, `status` carries the drift state and `annotations` carries
+ * the parsed (typed) `annotations:` block.
  */
-interface ISettingCommon {
-    /** Required. Short human-readable label. English-only. */
-    label: string;
-    /** Optional helper text shown below the control. English-only. */
-    description?: string;
+interface ISidecarOverlay {
+    present: boolean;
+    status?: SidecarStatus | null;
+    /**
+     * Parsed `annotations:` block. Untyped object, schema lives in
+     * `spec/schemas/annotations.schema.json`. Null when no sidecar or
+     * the block is empty/absent.
+     */
+    annotations?: Record<string, unknown> | null;
+    /**
+     * R15 closure (2026-05-07), full parsed YAML root of the sidecar
+     * (the entire `.sm` payload, mirroring `sidecar.schema.json`). Surfaced
+     * so the UI inspector can render `for:`, `audit:`, `settings:`, and
+     * `<plugin-id>:` namespace blocks without re-reading the file. NULL
+     * when no sidecar is present, or when the sidecar exists but failed
+     * to parse / validate. The `annotations` field above stays, it
+     * duplicates `root.annotations` intentionally so existing consumers
+     * keep working unchanged.
+     */
+    root?: Record<string, unknown> | null;
 }
-interface ISetting_StringList extends ISettingCommon {
-    type: 'string-list';
-    default?: string[];
-    min?: number;
-    max?: number;
-    itemMaxLength?: number;
+interface Link {
+    /** The originating node, the path of the file the extractor was reading
+     *  when it emitted this link. Singular, NOT to be confused with
+     *  `sources` (plural) below. */
+    source: string;
+    target: string;
+    kind: LinkKind;
+    confidence: Confidence;
+    /** Identifiers of the extractors / extensions that contributed evidence
+     *  for this link (one link can be confirmed by multiple extractors).
+     *  Plural; NOT the same as `source` (singular) above, which is the
+     *  originating node path. Naming is unfortunate but spec-frozen. */
+    sources: string[];
+    trigger?: LinkTrigger | null;
+    location?: LinkLocation | null;
+    raw?: string | null;
 }
-interface ISetting_SingleString extends ISettingCommon {
-    type: 'single-string';
-    default?: string;
-    minLength?: number;
-    maxLength?: number;
-    /** Optional ECMAScript regex pattern (no flags). */
-    pattern?: string;
+interface IssueFix {
+    summary?: string;
+    autofixable?: boolean;
 }
-interface ISetting_BooleanFlag extends ISettingCommon {
-    type: 'boolean-flag';
-    default?: boolean;
+interface Issue {
+    analyzerId: string;
+    severity: Severity;
+    nodeIds: string[];
+    message: string;
+    linkIndices?: number[];
+    detail?: string | null;
+    fix?: IssueFix | null;
+    data?: Record<string, unknown>;
 }
-interface ISetting_Integer extends ISettingCommon {
-    type: 'integer';
-    default?: number;
-    min?: number;
-    max?: number;
-    step?: number;
+interface ScanStats {
+    /**
+     * Files visited by the Provider walkers. With a single Provider this
+     * matches `nodesCount`; with multiple Providers running on overlapping
+     * roots it can diverge (each yielded `IRawNode` is one walked file).
+     */
+    filesWalked: number;
+    /**
+     * Files walked but not classified by any Provider. Today every walked
+     * file is classified by its Provider (the `claude` Provider falls back to
+     * `'markdown'`), so this is always 0; the field will matter once
+     * multiple Providers can claim the same file.
+     */
+    filesSkipped: number;
+    nodesCount: number;
+    linksCount: number;
+    issuesCount: number;
+    durationMs: number;
 }
-interface ISetting_EnumOption {
-    value: string;
-    label: string;
+interface ScanScannedBy {
+    name: string;
+    version: string;
+    specVersion: string;
 }
-interface ISetting_EnumPick extends ISettingCommon {
-    type: 'enum-pick';
-    options: ISetting_EnumOption[];
-    default?: string;
+type ExecutionKind = 'action';
+type ExecutionStatus = 'completed' | 'failed' | 'cancelled';
+type ExecutionFailureReason = 'runner-error' | 'report-invalid' | 'timeout' | 'abandoned' | 'job-file-missing' | 'user-cancelled';
+type ExecutionRunner = 'cli' | 'skill' | 'in-process';
+/**
+ * One row of execution history (`state_executions`). Matches
+ * `spec/schemas/execution-record.schema.json`. `nodeIds` is the camelCased
+ * domain field name; storage flattens it to `node_ids_json`.
+ */
+interface ExecutionRecord {
+    id: string;
+    kind: ExecutionKind;
+    extensionId: string;
+    extensionVersion: string;
+    nodeIds?: string[];
+    contentHash?: string | null;
+    status: ExecutionStatus;
+    failureReason?: ExecutionFailureReason | null;
+    exitCode?: number | null;
+    runner?: ExecutionRunner | null;
+    startedAt: number;
+    finishedAt: number;
+    durationMs?: number | null;
+    tokensIn?: number | null;
+    tokensOut?: number | null;
+    reportPath?: string | null;
+    jobId?: string | null;
 }
-interface ISetting_EnumMultipick extends ISettingCommon {
-    type: 'enum-multipick';
-    options: ISetting_EnumOption[];
-    default?: string[];
-    min?: number;
-    max?: number;
+interface HistoryStatsTotals {
+    executionsCount: number;
+    completedCount: number;
+    failedCount: number;
+    tokensIn: number;
+    tokensOut: number;
+    durationMsTotal: number;
 }
-interface ISetting_PathGlob extends ISettingCommon {
-    type: 'path-glob';
-    default?: string;
-    /** When true, accepts string[]; when false (default), single string. */
-    multiple?: boolean;
+interface HistoryStatsTokensPerAction {
+    actionId: string;
+    actionVersion: string;
+    executionsCount: number;
+    tokensIn: number;
+    tokensOut: number;
+    durationMsMean: number | null;
+    durationMsMedian: number | null;
 }
-interface ISetting_Regex extends ISettingCommon {
-    type: 'regex';
-    default?: string;
-    /** Subset of `gimsuy`. Default `''`. */
-    flags?: string;
+interface HistoryStatsExecutionsPerPeriod {
+    periodStart: string;
+    periodUnit: 'day' | 'week' | 'month';
+    executionsCount: number;
+    tokensIn: number;
+    tokensOut: number;
 }
-interface ISetting_Secret extends ISettingCommon {
-    type: 'secret';
-    /**
-     * Optional uppercase-ASCII identifier. When set in the process
-     * environment, that value wins over any stored value (lets CI
-     * inject without writing to disk).
-     */
-    envVar?: string;
+interface HistoryStatsTopNode {
+    nodePath: string;
+    executionsCount: number;
+    lastExecutedAt: number;
 }
-interface ISetting_KeyValueListEntry {
-    key: string;
-    value: string;
+interface HistoryStatsPerActionRate {
+    actionId: string;
+    rate: number;
+    executionsCount: number;
+    failedCount: number;
 }
-interface ISetting_KeyValueList extends ISettingCommon {
-    type: 'key-value-list';
-    keyLabel?: string;
-    valueLabel?: string;
-    default?: ISetting_KeyValueListEntry[];
-    min?: number;
-    max?: number;
+interface HistoryStatsErrorRates {
+    global: number;
+    perAction: HistoryStatsPerActionRate[];
+    perFailureReason: Record<ExecutionFailureReason, number>;
 }
 /**
- * Discriminated union of every setting declaration shape. The plugin
- * author NEVER writes JSON Schema for settings, they pick one of
- * these `type` values and supply per-type parameters.
- *
- * Mirror of `input-types.schema.json#/$defs/ISettingDeclaration`.
- */
-type ISettingDeclaration = ISetting_StringList | ISetting_SingleString | ISetting_BooleanFlag | ISetting_Integer | ISetting_EnumPick | ISetting_EnumMultipick | ISetting_PathGlob | ISetting_Regex | ISetting_Secret | ISetting_KeyValueList;
-/**
- * Runtime value type for a setting, derived from its declaration. The
- * kernel exposes settings to extractors as `Record<string, TSettingValue>`
- * via `ctx.settings.<settingId>`; consumers that want narrow typing
- * narrow at the call site by reading `manifest.settings[id].type`.
- */
-type TSettingValue = string | string[] | boolean | number | ISetting_KeyValueListEntry[];
-
-/**
- * Base manifest shape shared by every extension kind. Mirrors
- * `spec/schemas/extensions/base.schema.json` at the TypeScript level.
- *
- * Spec § A.6, every extension is identified in the registry by the
- * qualified id `<pluginId>/<id>`. The `pluginId` field is required at the
- * runtime / TS level: built-ins declare it directly in
- * `src/extensions/built-ins.ts`; user plugins have it injected by the
- * `PluginLoader` from `plugin.json#/id` before the extension reaches the
- * registry. A plugin author who hand-codes a `pluginId` that disagrees
- * with the manifest's `id` is rejected as `invalid-manifest`.
- *
- * The JSON Schema deliberately does NOT model `pluginId`, the qualifier
- * is a runtime concern composed by the loader, not a manifest field
- * authors are expected to set. Stripping it before AJV validation in
- * the loader keeps the spec contract clean ("authors declare only the
- * short id").
- */
-
-/**
- * Step 9.6.6, single entry of an extension's `annotationContributions`
- * map. Mirrors `spec/schemas/extensions/base.schema.json#/properties/annotationContributions/additionalProperties`.
- *
- * `schema` is an INLINE JSON Schema (object literal in the manifest),
- * not a `$ref` to a file. The kernel compiles it at load time; an
- * invalid schema rejects the extension as `invalid-manifest`.
+ * `sm history stats --json` payload, conforming to
+ * `spec/schemas/history-stats.schema.json`. `elapsedMs` is the command's
+ * own wall-clock per `cli-contract.md` §Elapsed time.
  */
-interface IAnnotationContribution {
-    /** Inline JSON Schema describing the value written under this key. */
-    schema: Record<string, unknown>;
-    /**
-     * Conflict policy. `shared` (default), multiple plugins MAY write
-     * the key; `exclusive`, only this plugin may. REQUIRED to be
-     * `'exclusive'` when `location: 'root'`.
-     */
-    ownership?: 'exclusive' | 'shared';
-    /**
-     * Where the key lands. `namespaced` (default), under the plugin's
-     * `<plugin-id>:` block; `root`, top-level, alongside `for` /
-     * `annotations` / `settings` / `audit`. Cross-plugin root-key
-     * collisions on `exclusive` are a fatal startup error.
-     */
-    location?: 'namespaced' | 'root';
+interface HistoryStats {
+    schemaVersion: 1;
+    range: {
+        since: string | null;
+        until: string;
+    };
+    totals: HistoryStatsTotals;
+    tokensPerAction: HistoryStatsTokensPerAction[];
+    executionsPerPeriod: HistoryStatsExecutionsPerPeriod[];
+    topNodes: HistoryStatsTopNode[];
+    errorRates: HistoryStatsErrorRates;
+    elapsedMs: number;
 }
-interface IExtensionBase {
-    id: string;
+interface ScanResult {
+    schemaVersion: 1;
+    /** Unix milliseconds when the scan started. */
+    scannedAt: number;
     /**
-     * Owning plugin namespace. Composed with `id` to produce the
-     * qualified registry key `<pluginId>/<id>`. Built-ins declare this
-     * directly; user plugins have it injected by the `PluginLoader`
-     * from `plugin.json#/id`.
+     * Filesystem roots that were walked during this scan. Spec requires
+     * `minItems: 1`, `runScan` throws if `roots: []` is supplied.
      */
-    pluginId: string;
-    version: string;
-    description?: string;
-    stability?: Stability;
-    preconditions?: string[];
-    entry?: string;
-    /**
-     * Step 9.6.6, plugin-contributed annotation keys. Each entry maps a
-     * key name to an inline JSON Schema + ownership + location triple.
-     * The kernel surfaces the aggregate via `kernel.getRegisteredAnnotationKeys()`.
-     * See `IAnnotationContribution` for the field semantics and
-     * `plugin-author-guide.md` §Annotation contributions for examples.
-     */
-    annotationContributions?: Record<string, IAnnotationContribution>;
-    /**
-     * Plugin-contributed view contributions. Each entry maps a local
-     * contribution id (kebab-case, unique within the extension) to a
-     * `IViewContribution` declaration that picks a view slot by name
-     * from the closed kernel catalog (`view-catalog.ts#TSlotName`).
-     * The slot fixes both the renderer and the payload shape, there
-     * is no separate "contract" abstraction. The kernel validates each
-     * `slot` pick at load time (`invalid-manifest` on miss); the plugin
-     * emits per-node payloads via `ctx.emitContribution(<contributionId>,
-     * payload)` during scan; the runtime validates payloads against
-     * the slot's payload schema. The aggregate runtime catalog is
-     * exposed via `kernel.getRegisteredViewContributions()`. See
-     * `architecture.md` §View contribution system.
-     */
-    viewContributions?: Record<string, IViewContribution>;
+    roots: string[];
+    /** Provider ids that participated in classification. Empty if no Provider matched. */
+    providers: string[];
+    /** Implementation metadata. Populated by `runScan` for self-describing output. */
+    scannedBy?: ScanScannedBy;
+    nodes: Node[];
+    links: Link[];
+    issues: Issue[];
+    stats: ScanStats;
 }
 
 /**
@@ -815,42 +822,35 @@ type TPluginStorage = {
  *                   capabilities a user might reasonably want piecemeal.
  */
 type TGranularity = 'bundle' | 'extension';
-/** Raw `plugin.json` shape after successful AJV validation. */
+/**
+ * Raw `plugin.json` shape after successful AJV validation.
+ *
+ * **Structure-as-truth**: the plugin id comes from the directory name
+ * (`<root>/<id>/plugin.json`); it is NOT a manifest field. The loader
+ * rejects manifests carrying an `id` literal. Settings moved out of
+ * `plugin.json` into each extension's own manifest with the same refactor.
+ */
 interface IPluginManifest {
-    id: string;
     version: string;
     specCompat: string;
     /**
-     * Optional semver range against the kernel's view-slots +
-     * input-types catalog version. Independent from `specCompat` because
-     * the catalog evolves on its own cadence (see `architecture.md`
-     * §View contribution system → Catalog versioning). Mismatch surfaces
-     * as `incompatible-catalog`. Absent = the plugin opts out of catalog
-     * checking; `sm plugins doctor` warns if such a plugin actually
-     * declares `viewContributions` or `settings`.
+     * Required semver range against the kernel's view-slots + input-types
+     * catalog version. Mismatch surfaces as `incompatible-catalog`. Promoted
+     * from optional to required with the structure-as-truth refactor,
+     * declaring compat is part of the plugin contract regardless of which
+     * catalog surfaces it actually consumes.
      */
-    catalogCompat?: string;
-    extensions: string[];
-    description?: string;
+    catalogCompat: string;
+    /** Required short description shown in `sm plugins list` and the UI. */
+    description: string;
     storage?: TPluginStorage;
     /**
-     * Toggle granularity for this plugin. Default `'bundle'`. See
-     * `TGranularity` for the trade-off; in practice 95% of plugins want
-     * the default.
+     * Toggle granularity for this plugin. Optional with default
+     * `'extension'` since the structure-as-truth refactor (more
+     * permissive default: each extension is independently toggleable
+     * unless the author opts into bundle-level coupling).
      */
     granularity?: TGranularity;
-    /**
-     * Plugin user-configurable settings. Each entry picks an `input-type`
-     * from the closed catalog at
-     * `spec/schemas/input-types.schema.json#/$defs/InputTypeName`.
-     * The plugin author NEVER writes JSON Schema, they pick `type` by
-     * name and supply per-type parameters. The kernel exposes resolved
-     * settings to extractors via `ctx.settings.<settingId>`; settings
-     * are read once at extractor invocation; changing a setting requires
-     * `sm scan` to re-emit. See `architecture.md` §View contribution
-     * system → Settings.
-     */
-    settings?: Record<string, ISettingDeclaration>;
     author?: string;
     license?: string;
     homepage?: string;
@@ -1566,12 +1566,14 @@ interface IParseIssue {
  * the path relative to the scan root; the kernel computes hashes, bytes,
  * and tokens on top.
  *
- * **Spec 0.8.0**. Per-kind frontmatter schemas relocated from the spec
- * to the Provider that owns them. The flat
- * `defaultRefreshAction` map collapsed into the new `kinds` map: every
- * kind the Provider emits gets one entry that declares both its schema
- * and its refresh action. Spec keeps only `frontmatter/base.schema.json`
- * (universal); per-kind schemas live with the Provider.
+ * **Structure-as-truth**: each plugin carries at most one Provider, declared
+ * as `<plugin>/provider.ts`. The kinds catalog lives as folders under
+ * `<plugin>/kinds/<kindName>/`; each kind folder contains `schema.json`
+ * (the frontmatter JSON Schema) and `kind.json` (UI metadata). The loader
+ * discovers each entry by walking the directory and populates the runtime
+ * `kinds` map below. The manifest itself NO LONGER carries a `kinds` map
+ * or a `defaultRefreshAction` field (the UI's Refresh button consumer was
+ * retired alongside it; the replacement TBD).
  */
 
 interface IRawNode {
@@ -1593,51 +1595,36 @@ interface IRawNode {
     parseIssues?: readonly IParseIssue[];
 }
 /**
- * One entry in a Provider's `kinds` map. Declares both the per-kind
- * frontmatter schema (path relative to the Provider's package dir, plus
- * the loaded JSON object the kernel passes to AJV) and the qualified
- * default refresh action id the UI dispatches for nodes of this kind.
- *
- * The split between `schema` (manifest-level path) and `schemaJson`
- * (runtime-loaded JSON) keeps the manifest shape spec-conformant while
- * letting the runtime instance carry the parsed schema without a second
- * filesystem read at scan time. Built-in Providers populate `schemaJson`
- * via `import schema from './schemas/skill.schema.json' with { type: 'json' }`;
- * user-plugin Providers loaded by `PluginLoader` will have it filled in
- * by the loader after manifest validation.
+ * Runtime descriptor of one Provider kind, populated by the loader from
+ * the structure under `<plugin>/kinds/<kindName>/`. The loader reads
+ * `schema.json` from the kind folder, parses it once, attaches the path
+ * (for diagnostics) and the parsed object (for AJV registration), and
+ * reads `kind.json` for the UI metadata. The runtime descriptor lives in
+ * memory; no field in this shape comes from the Provider manifest itself
+ * since the structure-as-truth refactor.
  */
 interface IProviderKind {
     /**
-     * Path to the kind's frontmatter JSON Schema, relative to the
-     * Provider's package directory. Mirrors the spec field of the same
-     * name in `extensions/provider.schema.json#/properties/kinds/.../schema`.
+     * Path to the kind's frontmatter JSON Schema, relative to the Provider's
+     * package directory. Always `kinds/<kindName>/schema.json` under the new
+     * layout. Kept on the descriptor for diagnostics (file references in
+     * error messages, doctor reports).
      */
     schema: string;
     /**
      * Loaded JSON Schema document for the kind. The kernel registers this
      * with AJV at scan boot and validates each node's frontmatter against
      * it. The schema MUST extend the spec's
-     * `frontmatter/base.schema.json` via `allOf` + `$ref` to base's
-     * `$id`; the loader registers base into the same AJV instance so
-     * cross-package `$ref`-by-`$id` resolves transparently.
-     *
-     * `unknown` rather than a stronger type because AJV consumes any JSON
-     * Schema object; tightening to a concrete shape would require mirroring
-     * the JSON Schema vocabulary in TypeScript.
+     * `frontmatter/base.schema.json` via `allOf` + `$ref` to base's `$id`;
+     * the loader registers base into the same AJV instance so cross-package
+     * `$ref`-by-`$id` resolves transparently.
      */
     schemaJson: unknown;
-    /**
-     * Qualified action id (`<plugin-id>/<action-id>`) the probabilistic-
-     * refresh UI dispatches for nodes of this kind. The kernel resolves
-     * the id against its qualified action registry; a dangling reference
-     * disables the Provider with status `invalid-manifest`.
-     */
-    defaultRefreshAction: string;
     /**
      * Presentation metadata the UI consumes to render nodes of this kind
-     * (palette swatches, list tags, graph nodes, filter chips). Required
-     * so the UI never has to invent visuals for a Provider-declared kind.
-     * Mirrors `extensions/provider.schema.json#/properties/kinds/.../ui`.
+     * (palette swatches, list tags, graph nodes, filter chips). Read from
+     * `kinds/<kindName>/kind.json#/ui`. Required so the UI never has to
+     * invent visuals for a Provider-declared kind.
      */
     ui: IProviderKindUi;
 }
@@ -1699,23 +1686,30 @@ type TProviderKindIcon = {
     path: string;
 };
 interface IProvider extends IExtensionBase {
+    /** Discriminant injected by the loader from the folder structure. */
     kind: 'provider';
     /**
-     * Catalog of node kinds this Provider emits. Keyed by kind name. Every
-     * kind the Provider can `classify()` MUST have an entry; an entry is
-     * the union of the kind's frontmatter schema and its default refresh
-     * action.
+     * Catalog of node kinds this Provider emits. Populated by the loader
+     * from the `<plugin>/kinds/<kindName>/` directory layout: each subfolder
+     * becomes one entry, with `schema.json` parsed into `schemaJson` and
+     * `kind.json#/ui` projected into `ui`. Authors do NOT write this map by
+     * hand any more, it is a runtime descriptor only.
      *
      * The string keys are typed loosely (`string`) rather than `NodeKind`
      * because the value space is open by design: a future Cursor Provider
      * could declare `rule`, an Obsidian Provider could declare `daily`.
-     * The kernel's hard-coded `NodeKind` union represents the kinds the
-     * built-in Claude Provider emits; it is NOT the kernel-wide kind type
-     * (see `kernel/types.ts:NodeKind` docstring). `Node.kind`, the AJV
-     * `node.schema.json` validator, and the SQLite `scan_nodes.kind`
-     * column all accept any non-empty string an enabled Provider returns.
      */
     kinds: Record<string, IProviderKind>;
+    /**
+     * Optional path globs the Provider claims. Enforcement-grade since
+     * structure-as-truth: a Provider declaring `roots` only receives files
+     * matching at least one glob; a Provider without `roots` acts as a
+     * fallback for files unmatched by every other Provider's roots. Two
+     * Providers whose `roots` both match the same file produce a
+     * `provider-ambiguous` issue and the file stays unclassified. Mirrors
+     * `extensions/provider.schema.json#/properties/roots`.
+     */
+    roots?: string[];
     /**
      * Optional auxiliary JSON Schemas this Provider's per-kind schemas
      * `$ref` by `$id`. Registered with AJV via `addSchema` BEFORE the
@@ -1817,72 +1811,48 @@ interface IProviderReadConfig {
 
 /**
  * Extractor runtime contract. Consumes a single node (frontmatter + body)
- * and emits its output through three context-supplied callbacks rather than
- * a return value. Extractors run in isolation: they MUST NOT read other
- * nodes, the graph, or the DB. Cross-node reasoning lives in rules.
+ * and emits its output through context-supplied callbacks rather than a
+ * return value. Extractors run in isolation: they MUST NOT read other
+ * nodes, the graph, or the DB. Cross-node reasoning lives in Analyzers.
  *
  * Extractors are deterministic-only. They run synchronously inside the
  * scan loop; LLM-driven enrichment of a node is an Action concern, not
  * an Extractor concern. The Extractor context therefore exposes no
  * `RunnerPort`, see spec `architecture.md` §Execution modes.
  *
- * Output channels (all on the context):
- *
- *   - `ctx.emitLink(link)`, persist a link in the kernel's `links` table.
- *     Validated against `emitsLinkKinds` before insertion; an off-contract
- *     kind drops the link and surfaces an `extension.error` event.
- *   - `ctx.enrichNode(partial)`, merge canonical, kernel-curated properties
- *     onto the node. Strictly separate from the author-supplied frontmatter
- *     (the latter remains immutable and survives verbatim). Persistence
- *     is spec'd in § A.8.
- *   - `ctx.store`, plugin-scoped persistence. Present only when the
- *     plugin declares `storage.mode` in `plugin.json`; shape depends on the
- *     mode (`KvStore` for mode A, scoped `Database` for mode B). See
- *     `plugin-kv-api.md` for the contract.
- *
- * The manifest's `scope` field tells the orchestrator which parts to feed:
- * `frontmatter` extractors receive an empty string for body and vice versa.
- *
- * Renamed from `Detector` in spec 0.8.x. The previous `detect(ctx) → Link[]`
- * signature is gone; everything now flows through `extract(ctx) → void`
- * and the callbacks above.
+ * **Structure-as-truth**: the extension's `id` and `kind` come from the
+ * filesystem (`<plugin>/extractors/<id>/index.ts`); the manifest does NOT
+ * declare them. The `emitsLinkKinds` allowlist was retired with the same
+ * refactor: the global closed enum of link kinds is the contract, and an
+ * extractor emitting an off-enum kind keeps surfacing `extension.error`.
+ * Confidence is per-emit (no manifest-level default).
  */
 
 /**
  * Output callbacks supplied by the kernel on the extractor context.
- * Split out so plugin authors can name the callback shape if they
- * want to mock it in unit tests without depending on the wider
- * `IExtractorContext`.
  */
 interface IExtractorCallbacks {
     /**
-     * Emit a single Link. The orchestrator validates the link against the
-     * extractor's declared `emitsLinkKinds` before inserting it; off-contract
-     * links are silently dropped with an `extension.error` event.
+     * Emit a single Link. Validated against the global closed enum of
+     * link kinds (`invokes`, `references`, `mentions`, `supersedes`)
+     * before insertion; off-enum kinds drop silently with an
+     * `extension.error` event.
      */
     emitLink(link: Link): void;
     /**
      * Merge canonical, kernel-curated properties onto the current node's
      * enrichment layer. The author-supplied frontmatter stays untouched
-     * (Decision #109 in `ROADMAP.md`). Persistence and stale-tracking
-     * semantics live in spec § A.8; the orchestrator already buffers the
-     * partials and `persistScanResult` upserts them.
+     * (Decision #109 in `ROADMAP.md`).
      */
     enrichNode(partial: Partial<Node>): void;
     /**
-     * Emit a per-node view contribution. The first argument is the
-     * extension-local Record key declared under
-     * `extension.viewContributions[<contributionId>]`; the second is a
-     * payload that conforms to the slot's payload schema in
-     * `spec/schemas/view-slots.schema.json#/$defs/payloads/<slot>`,
-     * where `<slot>` is the slot the manifest declared for this
-     * contribution. The orchestrator validates the payload against the
-     * slot's schema before persisting to `scan_contributions`; off-shape
-     * payloads are silently dropped with an `extension.error` event
-     * (mirror of `emitLink` rejecting off-`emitsLinkKinds` links).
-     * Calling `emitContribution` with a `contributionId` that is not
-     * declared in the manifest is also dropped with an `extension.error`.
-     * See `architecture.md` §View contribution system → Emit path.
+     * Emit a per-node view contribution. `contributionId` MUST be a key
+     * declared under the manifest's `ui` map; the payload MUST conform to
+     * the slot's payload schema in
+     * `spec/schemas/view-slots.schema.json#/$defs/payloads/<slot>`. Off-shape
+     * payloads (or unknown contribution ids) drop silently with an
+     * `extension.error`. Renamed from `viewContributions` with the
+     * structure-as-truth refactor.
      */
     emitContribution(contributionId: string, payload: unknown): void;
 }
@@ -1890,49 +1860,48 @@ interface IExtractorContext extends IExtractorCallbacks {
     node: Node;
     body: string;
     frontmatter: Record<string, unknown>;
+    /**
+     * Resolved values of the extension's declared `settings`, populated
+     * from project config + user overrides. Empty object when no settings
+     * are declared.
+     */
+    settings: Record<string, unknown>;
     /**
      * Plugin-scoped persistence. Optional because not every plugin declares
-     * a `storage.mode` in `plugin.json`. Shape: `KvStoreWrapper` for mode A
-     * (`set(key, value)`), `DedicatedStoreWrapper` for mode B
-     * (`write(table, row)`). See `spec/plugin-kv-api.md`.
-     *
-     * Typed as `unknown` so this contract module stays free of any
-     * adapter-side imports, the concrete `IPluginStore` lives in
-     * `kernel/adapters/plugin-store.js`. Plugin authors narrow at the
-     * call site based on the storage mode declared in their manifest.
-     * The orchestrator looks up the wrapper per-extractor in
-     * `RunScanOptions.pluginStores` (keyed by `pluginId`) and attaches
-     * it here.
+     * a `storage.mode` in `plugin.json`. See `spec/plugin-kv-api.md`.
      */
     store?: unknown;
 }
+/**
+ * Optional declarative filter shared with Analyzer and Action. The kernel
+ * applies a single matcher: every declared sub-filter must hold for the
+ * extension to be invoked on the candidate node.
+ */
+interface IExtensionPrecondition {
+    /**
+     * Qualified node kinds the extension accepts, written as
+     * `<provider-plugin>/<kindName>` (e.g. `claude/agent`). Unknown
+     * qualified kinds load OK but surface a `precondition-kind-unknown`
+     * warning in `sm plugins doctor`.
+     */
+    kind?: string[];
+    /** Provider ids whose nodes the extension accepts. */
+    provider?: string[];
+}
 interface IExtractor extends IExtensionBase {
+    /** Discriminant injected by the loader from the folder structure. */
     kind: 'extractor';
-    emitsLinkKinds: LinkKind[];
-    defaultConfidence: Confidence;
-    scope: 'frontmatter' | 'body' | 'both';
-    /**
-     * Optional opt-in filter on `node.kind`. When declared, the orchestrator
-     * skips invocation of `extract()` for any node whose `kind` is NOT in
-     * this list, fail-fast, before context construction, so the extractor
-     * wastes zero CPU on inapplicable nodes.
-     *
-     * Absent (`undefined`) is the default: the extractor applies to every
-     * kind. There are no wildcards, the absence of the field already
-     * encodes "every kind". An empty array (`[]`) is rejected at load
-     * time by AJV (`minItems: 1` in the schema).
-     *
-     * Unknown kinds (no installed Provider declares them) do NOT block
-     * the load: the extractor keeps `loaded` status and `sm plugins doctor`
-     * surfaces a warning. The Provider that declares the kind may arrive
-     * later (e.g. a user installs the corresponding plugin).
-     *
-     * Spec: `spec/schemas/extensions/extractor.schema.json#/properties/applicableKinds`.
+    /** Which slice of the node the orchestrator feeds. Defaults to `both`. */
+    scope?: 'frontmatter' | 'body' | 'both';
+    /**
+     * Optional precondition that gates `extract()` invocation. Replaces
+     * the old `applicableKinds` field; same shape used by Analyzer and
+     * Action so the kernel ships a single matcher.
      */
-    applicableKinds?: string[];
+    precondition?: IExtensionPrecondition;
     /**
      * Extractor entry point. Returns nothing; output flows through
-     * `ctx.emitLink`, `ctx.enrichNode`, and `ctx.store`.
+     * `ctx.emitLink`, `ctx.enrichNode`, `ctx.emitContribution`, `ctx.store`.
      */
     extract(ctx: IExtractorContext): void | Promise<void>;
 }
@@ -2056,26 +2025,26 @@ interface IAnalyzerContext {
     emitContribution(nodePath: string, contributionId: string, payload: unknown): void;
 }
 interface IAnalyzer extends IExtensionBase {
+    /** Discriminant injected by the loader from the folder structure. */
     kind: 'analyzer';
     /**
      * Execution mode. Optional in the manifest with a default of
-     * `deterministic` per `spec/schemas/extensions/analyzer.schema.json`.
+     * `deterministic`. `probabilistic` analyzers run only as queued jobs.
      */
     mode?: TExecutionMode;
     /**
-     * Qualified `<pluginId>/<id>` Action ids the analyzer recommends to
-     * resolve its findings. Distinct from `Action.precondition` (which
-     * declares which nodes an Action applies to from the Action side);
-     * this field declares which Actions are relevant when this
-     * Analyzer fires from the Analyzer side. Actions are per-node by
-     * design (project-level cleanup verbs like orphan file prune or
-     * contribution relink are CLI verbs, not Actions) and are NOT
-     * surfaced through this field. The UI consumes it in the node
-     * inspector under "Recommended for issues". Optional; omit when no
-     * Action resolves the finding (e.g. `core/superseded` surfaces
-     * deliberate user declarations, not problems).
-     */
-    recommendedActions?: readonly string[];
+     * Optional declarative precondition. Same shape used by Extractor and
+     * Action. The analyzer is invoked only when the graph contains at
+     * least one node matching every declared sub-filter.
+     *
+     * The reverse relationship (which Actions resolve this analyzer's
+     * findings) is now declared on the Action side via
+     * `precondition.analyzerIds` (Modelo B). The old
+     * `recommendedActions` field was retired with the structure-as-truth
+     * refactor; the UI matches against Action manifests when surfacing
+     * "Resolve this issue" affordances.
+     */
+    precondition?: IExtensionPrecondition;
     evaluate(ctx: IAnalyzerContext): Issue[] | Promise<Issue[]>;
 }
 
@@ -2085,182 +2054,107 @@ interface IAnalyzer extends IExtensionBase {
  *
  * Actions operate on one or more nodes in one of two execution modes:
  *
- *   - `deterministic`, code runs in-process; the action computes the
- *     report synchronously and returns it. No job file, no runner.
- *   - `probabilistic`, the kernel renders a prompt + preamble into a
- *     job file; a runner executes it via `RunnerPort` against an LLM;
- *     `sm record` closes the job and validates the report against
- *     `reportSchemaRef`.
- *
- * **Deferred runtime invocation.** The dispatcher (`Action.run(ctx)` for
- * deterministic; the `RunnerPort` + `sm record` round-trip for
- * probabilistic) lands with the job subsystem (Decision #114 in
- * `ROADMAP.md`). Today the loader still validates `kind: 'action'`
- * manifests against `extension-action.schema.json` and the registry
- * holds them, `sm actions show` and the precondition gating UI consume
- * the manifest data. The runtime entry point is intentionally absent
- * from `IAction` so plugin authors don't ship a method the kernel will
- * not call until the job subsystem is in place; when it ships, the
- * method shape will land here without breaking the manifest contract.
- *
- * Mirrors `extensions/action.schema.json`:
- *
- *   - `mode` (required), discriminator between the two modes.
- *   - `reportSchemaRef` (required), JSON Schema reference the report
- *     MUST validate against. MUST extend `report-base.schema.json`.
- *   - `promptTemplateRef`, REQUIRED when `mode: 'probabilistic'`,
- *     FORBIDDEN when `mode: 'deterministic'`. The schema's conditional
- *     `allOf` enforces both directions; the runtime contract simply
- *     surfaces the field as optional and lets the loader catch shape
- *     violations at AJV time.
- *   - `expectedDurationSeconds`, REQUIRED for probabilistic (drives
- *     TTL); advisory for deterministic.
- *   - `precondition`, declarative filter consumed by `--all` fan-out,
- *     UI button gating, `sm actions show`.
- *   - `expectedTools`, hint to Skill / CLI runners about expected
- *     tools (no normative enforcement in v0).
- *   - `fanOutPolicy`, `'per-node'` (default) vs `'batch'`.
+ *   - `deterministic` (default), code runs in-process; the action computes
+ *     the report synchronously and returns it. No job file, no runner.
+ *   - `probabilistic`, the kernel renders `<action-dir>/prompt.md` + preamble
+ *     into a job file; a runner executes it via `RunnerPort` against an
+ *     LLM; `sm record` closes the job and validates the report against
+ *     `<action-dir>/report.schema.json`.
+ *
+ * **Structure-as-truth file conventions**: every Action carries
+ * `<action-dir>/report.schema.json` (the JSON Schema for the report, MUST
+ * extend `report-base.schema.json`). Probabilistic Actions additionally
+ * carry `<action-dir>/prompt.md` (the prompt template). The loader resolves
+ * both by convention; missing or mis-placed files surface as `load-error`.
+ * The `reportSchemaRef` / `promptTemplateRef` manifest fields were retired
+ * with the same refactor.
+ *
+ * **`prob*` prefix convention**: manifest fields that only apply when
+ * `mode=probabilistic` start with `prob`. Today only
+ * `probExpectedDurationSeconds` follows this convention.
+ *
+ * **Deferred runtime invocation**: the dispatcher (`Action.invoke(input, ctx)`
+ * for deterministic; the `RunnerPort` + `sm record` round-trip for
+ * probabilistic) lands fully with the job subsystem (Decision #114 in
+ * `ROADMAP.md`). The kernel today still validates manifests and surfaces
+ * the precondition gating to the UI; the runtime entry point stays
+ * optional until the job subsystem ships.
  */
 
-/**
- * Single sidecar write payload an Action can return. Discriminated union so
- * future write kinds (storage rows, plugin KV, etc.) can land additively
- * without breaking consumers that only handle `kind: 'sidecar'`.
- *
- *   - `path`, absolute path to the `.sm` file the kernel must materialise
- *     the change into. Resolved by the Action from the node's absolute
- *     path via `sidecarPathFor()`.
- *   - `changes`, partial sidecar root used as a deep-merge patch (NOT a
- *     full replacement). Arrays REPLACE; objects RECURSE. Reason:
- *     sidecars are shared-write between skill-map core and plugins;
- *     a full replace would clobber `<plugin-id>:` namespaced blocks.
- */
 type TActionWrite = {
     kind: 'sidecar';
     path: string;
     changes: Record<string, unknown>;
 };
-/**
- * Result envelope returned by deterministic Actions. The `report` field
- * carries the typed report payload (each Action declares its shape via
- * `reportSchemaRef`); `writes` is opt-in, Actions that do not mutate
- * persistent state simply omit it.
- */
 interface IActionResult<TReport = unknown> {
     report: TReport;
     writes?: TActionWrite[];
 }
-/**
- * Runtime context passed to a deterministic Action's `invoke()` method.
- * Minimal surface, Actions stay pure (no IO inside `invoke`); the kernel
- * materialises any returned `writes` after the call.
- *
- *   - `node`, the target `Node` the Action operates on. Open-by-design;
- *     batch / fan-out flows pick the matching nodes upstream.
- *   - `nodeAbsolutePath`, absolute path to the node's `.md` file on
- *     disk. The Action uses this to compute the sidecar path it returns
- *     in a `TActionWrite`. Surfaced separately from `node.path` (which is
- *     the relative scope-root form) so Actions never compose absolute
- *     paths from `node.path` themselves.
- *   - `invoker`, identity of the caller; written into the sidecar's
- *     `audit.lastBumpedBy` when the Action chooses to. CLI invocations
- *     pass `'cli'`; plugin-driven invocations pass `'plugin:<plugin-id>'`.
- *   - `now`, clock function; tests inject a deterministic source.
- *     Defaults to `() => new Date()` at the composition root.
- */
 interface IActionContext {
     node: Node;
     nodeAbsolutePath: string;
     invoker: string;
     now: () => Date;
+    /**
+     * Resolved values of the Action's declared `settings`. Empty when no
+     * settings are declared on the manifest.
+     */
+    settings: Record<string, unknown>;
 }
 /**
  * Declarative filter applied by `--all` fan-out, UI button gating, and
- * `sm actions show`. All fields optional, an empty precondition matches
- * every node.
+ * `sm actions show`. Same shape used by Extractor and Analyzer so the
+ * kernel ships a single matcher; the `analyzerIds` field is unique to
+ * Action and powers Modelo B (Action declares which Analyzer findings
+ * it resolves; replaces the deprecated `Analyzer.recommendedActions`).
  */
 interface IActionPrecondition {
     /**
-     * Node kinds this action accepts. Open-by-design (matches
-     * `node.schema.json#/properties/kind`): an action declared with
-     * `kind: ['cursorRule']` is valid as long as some Provider classifies
-     * into `cursorRule`. Omitted → any kind.
+     * Qualified node kinds this action accepts, written as
+     * `<provider-plugin>/<kindName>` (e.g. `claude/agent`). Unknown
+     * qualified kinds load OK but surface a `precondition-kind-unknown`
+     * warning in `sm plugins doctor`.
      */
     kind?: string[];
-    /** Provider ids whose nodes this action accepts. Omitted → any Provider. */
+    /** Provider ids whose nodes this action accepts. */
     provider?: string[];
-    /** Node stability filter. */
-    stability?: Array<'experimental' | 'stable' | 'deprecated'>;
     /**
-     * Free-form precondition strings the kernel forwards to the action for
-     * runtime evaluation (example: `frontmatter.metadata.source != null`).
+     * Qualified analyzer ids whose findings this action resolves
+     * (`<plugin>/<analyzer>` or `<plugin>/<analyzer>:<sub-id>` when the
+     * analyzer emits sub-typed issues). The UI matches against this list
+     * to surface "Resolve this issue" affordances. Dangling references
+     * warn via `recommended-action-missing` in `sm plugins doctor` but
+     * do NOT block load.
      */
-    custom?: string[];
+    analyzerIds?: string[];
 }
 interface IAction extends IExtensionBase {
+    /** Discriminant injected by the loader from the folder structure. */
     kind: 'action';
     /**
-     * Execution mode discriminator. Required per
-     * `extensions/action.schema.json`.
-     */
-    mode: TExecutionMode;
-    /**
-     * Reference to the JSON Schema the report MUST validate against. MUST
-     * extend `report-base.schema.json` (directly or transitively).
-     * Validation failure → job transitions to `failed` with reason
-     * `report-invalid`.
+     * Execution mode. Optional with default `deterministic` since the
+     * structure-as-truth refactor.
      */
-    reportSchemaRef: string;
-    /**
-     * Best-effort estimate of wall-clock duration in seconds. Drives TTL
-     * (`ttl = max(expectedDurationSeconds × graceMultiplier,
-     * minimumTtlSeconds)`). Required for `probabilistic`; advisory for
-     * `deterministic`.
-     */
-    expectedDurationSeconds?: number;
+    mode?: TExecutionMode;
     /**
-     * Path (relative to the extension file) to the prompt template the
-     * kernel renders at `sm job submit`. REQUIRED when `mode:
-     * 'probabilistic'`; FORBIDDEN when `mode: 'deterministic'`. The
-     * conditional shape is enforced by AJV at load time; the runtime
-     * contract carries the field as optional so both modes share one
-     * interface.
+     * Best-effort estimate of wall-clock duration in seconds when
+     * `mode=probabilistic`. Drives TTL
+     * (`ttl = max(probExpectedDurationSeconds × graceMultiplier,
+     * minimumTtlSeconds)`). Required by the schema's conditional for
+     * probabilistic Actions; ignored otherwise. Renamed from
+     * `expectedDurationSeconds` with the `prob*` prefix convention.
      */
-    promptTemplateRef?: string;
+    probExpectedDurationSeconds?: number;
     /**
      * Optional declarative filter; absent → applies to every node.
      */
     precondition?: IActionPrecondition;
     /**
-     * Hint to Skill / CLI runners about what tools the rendered prompt
-     * expects access to (`Bash`, `Read`, `WebSearch`, …). No normative
-     * enforcement in v0.
-     */
-    expectedTools?: string[];
-    /**
-     * `'per-node'` (default): `sm job submit --all` produces one job per
-     * matching node. `'batch'`: one job whose prompt template receives the
-     * full list. Batch actions tend to hit context limits; use sparingly.
-     */
-    fanOutPolicy?: 'per-node' | 'batch';
-    /**
-     * Deterministic invocation entry point. OPTIONAL on the runtime
-     * contract for backward compatibility with the manifest-only era
-     * (Decision #114), actions that ship for the future probabilistic
-     * runner / record path leave it absent and the kernel never calls it.
-     * Step 9.6.3 (Decision #125) introduces the first concrete consumer:
-     * the built-in `bump` Action implements `invoke()` and returns a
-     * `writes: [{ kind: 'sidecar', ... }]` payload that the kernel
-     * materialises through `ISidecarStore`.
-     *
-     * Implementations MUST stay pure, no IO inside `invoke()`. The Action
-     * computes the patch and returns it; the kernel reads the on-disk
-     * sidecar, deep-merges, validates, and writes back inside its critical
-     * section.
-     *
-     * `TInput` is action-specific; the built-in `bump` Action declares
-     * `{ force?: boolean; reason?: string }`. The signature stays generic
-     * so each Action narrows it locally without forcing a common base.
+     * Deterministic invocation entry point. Optional on the runtime
+     * contract until the job subsystem ships; Actions that ship for the
+     * future probabilistic runner / record path leave it absent.
+     * Implementations MUST stay pure (no IO inside `invoke()`); the
+     * kernel materialises any returned `writes` after the call.
      */
     invoke?: <TInput, TReport>(input: TInput, ctx: IActionContext) => IActionResult<TReport>;
 }
@@ -2269,19 +2163,14 @@ interface IAction extends IExtensionBase {
  * Formatter runtime contract. Turns the (nodes, links, issues) graph into
  * a textual representation for `sm graph --format <name>`.
  *
- * Two adjacent names live on the same instance:
- *
- *   - `formatId: string`, the manifest field consumed by the
- *     `--format <name>` CLI flag. The kernel's lookup is
- *     `formatters.find((f) => f.formatId === flag)`.
- *   - `format(ctx) → string`, the runtime method. Receives the full
- *     graph and returns the serialized output. Output MUST be
- *     byte-deterministic for the same input (the snapshot-test suite
- *     relies on this).
+ * **Structure-as-truth**: the format id comes from the formatter's folder
+ * name (`<plugin>/formatters/<formatId>/index.ts`); it is injected by the
+ * loader into `id` and surfaced here as `formatId` for the existing CLI
+ * lookup (`formatters.find((f) => f.formatId === flag)`). Manifests carrying
+ * a `formatId` literal are rejected as `invalid-manifest`.
  *
- * The split (`formatId` vs `format`) is deliberate: it keeps the method
- * named after the kind (`Formatter.format()` reads naturally) while the
- * field carries the identifier the user types on the command line.
+ * All formatters accept the `--filter` expression; opting out is no longer
+ * supported (the old `supportsFilter` field was retired).
  */
 
 interface IFormatterContext {
@@ -2290,19 +2179,28 @@ interface IFormatterContext {
     issues: Issue[];
     /**
      * Full persisted scan, when the caller has it on hand. Optional so
-     * existing formatters that only consume (nodes, links, issues) keep
-     * working unchanged; formatters whose output mirrors a `ScanResult`
-     * envelope (today: the built-in `json` formatter under
-     * `built-in-plugins/formatters/json/`) read this to project the
-     * canonical document verbatim. `undefined` when the caller has only
-     * the three primary arrays (back-compat with older drivers).
+     * formatters that only consume (nodes, links, issues) keep working
+     * unchanged; formatters whose output mirrors a `ScanResult` envelope
+     * (today: the built-in `json` formatter) read this to project the
+     * canonical document verbatim.
      */
     scanResult?: ScanResult;
 }
 interface IFormatter extends IExtensionBase {
+    /** Discriminant injected by the loader from the folder structure. */
     kind: 'formatter';
-    /** Format identifier consumed by `sm graph --format <name>`. */
+    /**
+     * Format identifier consumed by `sm graph --format <name>`. Injected
+     * by the loader from the formatter folder name. Surfaced as a top-level
+     * field (rather than reusing `id`) so the existing CLI lookup keeps its
+     * domain-specific name.
+     */
     formatId: string;
+    /**
+     * MIME-like hint surfaced when streaming over HTTP. Advisory; default
+     * `'text/plain'`.
+     */
+    contentType?: string;
     /** Serialize the graph into a string. Deterministic-only. */
     format(ctx: IFormatterContext): string;
 }
@@ -2327,16 +2225,14 @@ interface IFormatter extends IExtensionBase {
  * Declaring a trigger outside the curated set yields
  * `invalid-manifest` at load time.
  *
- * Dual-mode (declared in manifest):
- *
- *   - `deterministic` (default): `on(ctx)` runs in-process during the
- *     dispatch of the matching event, synchronously between the
- *     event's emission and the next pipeline step. Errors are caught
- *     by the dispatcher, logged via `extension.error`, and never
- *     block the main flow.
- *   - `probabilistic`: the hook is enqueued as a job. Until the job
- *     subsystem ships, probabilistic hooks load but skip dispatch
- *     with a stderr advisory (Decision #114 in `ROADMAP.md`).
+ * **Deterministic-only since the structure-as-truth refactor**: the
+ * `mode` field was removed from the manifest. `on(ctx)` runs in-process
+ * during the dispatch of the matching event, synchronously between the
+ * event's emission and the next pipeline step. Errors are caught by
+ * the dispatcher, logged via `extension.error`, and never block the
+ * main flow. To react to a lifecycle event with an LLM call, write a
+ * deterministic Hook that enqueues a probabilistic Action via
+ * `ctx.queue('<plugin>/<action>', payload)`.
  *
  * Curated trigger set (per spec § A.11):
  *
@@ -2419,12 +2315,12 @@ interface IHookContext {
      */
     jobResult?: unknown;
     /**
-     * `RunnerPort` injection for `probabilistic` hooks. `undefined` for
-     * `deterministic` mode (the default). Probabilistic hooks land with
-     * the job subsystem; the field is reserved here so the runtime
-     * contract is forward-compatible without a major bump.
+     * Enqueue a probabilistic Action as a deferred job. The Hook stays
+     * deterministic; LLM dispatch happens via the job subsystem the
+     * Action drives. Available when the job subsystem is wired in;
+     * placeholder `undefined` for legacy callers.
      */
-    runner?: unknown;
+    queue?: (actionId: string, payload: unknown) => void;
 }
 /**
  * Optional declarative filter applied by the dispatcher BEFORE
@@ -2444,14 +2340,8 @@ interface IHookContext {
  */
 type THookFilter = Record<string, string | number | boolean>;
 interface IHook extends IExtensionBase {
+    /** Discriminant injected by the loader from the folder structure. */
     kind: 'hook';
-    /**
-     * Execution mode. Optional in the manifest with a default of
-     * `deterministic` per `spec/schemas/extensions/hook.schema.json`.
-     * Probabilistic hooks load but skip dispatch with a stderr advisory
-     * until the job subsystem ships (Decision #114).
-     */
-    mode?: TExecutionMode;
     /**
      * Subset of the curated lifecycle trigger set this hook subscribes
      * to. MUST be non-empty; every entry MUST be a member of
@@ -2646,8 +2536,17 @@ interface RenameOp {
  * order so the same input always produces the same matches,
  * required for reproducible tests and conformance fixtures (the spec
  * does not prescribe an order, but stability is the obvious contract).
+ *
+ * `silenced` (optional): predicate that returns true when a path
+ * disappeared from the current scan because the project's
+ * `.skillmapignore` (or any other ignore source) started excluding
+ * it, not because the file was actually deleted from disk. The
+ * orphan flagger uses it to skip the info-severity issue for those
+ * paths: silencing a node intentionally is not the same as losing
+ * one without a rename match. Callers that don't pass it preserve
+ * the previous behaviour (treat every disappearance as an orphan).
  */
-declare function detectRenamesAndOrphans(prior: ScanResult, current: Node[], issues: Issue[]): RenameOp[];
+declare function detectRenamesAndOrphans(prior: ScanResult, current: Node[], issues: Issue[], silenced?: (path: string) => boolean): RenameOp[];
 
 /**
  * Scan orchestrator, runs the Provider → extractor → analyzer pipeline across