@skill-map/cli 0.52.0 → 0.53.1

package/dist/cli.js

@@ -1,6 +1,6 @@
 // cli/entry.ts
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="91ef81c7-e785-5818-839a-1f18ea093b57")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="dd2e1877-e17a-5d0b-86e5-6416814d7a78")}catch(e){}}();
 import { existsSync as existsSync33 } from "fs";
 import { Builtins, Cli as Cli2 } from "clipanion";
 
@@ -246,7 +246,7 @@ function bucketByKind(kind, instance, bag) {
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.52.0",
+  version: "0.53.1",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -304,15 +304,16 @@ var package_default = {
     prebuild: "pnpm build-built-ins",
     validate: "pnpm validate:compile && pnpm validate:test",
     "validate:compile": "pnpm typecheck && pnpm lint && pnpm build && pnpm built-ins:check && pnpm view-catalog:check",
-    "validate:test": "pnpm test:ci",
+    "validate:test": "pnpm test:ci && pnpm conformance",
+    conformance: "SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 node --import tsx cli/entry.ts conformance run",
     pretest: "tsup",
     "pretest:coverage": "tsup",
     "pretest:coverage:html": "tsup",
-    test: "tsc --noEmit && SKILL_MAP_TELEMETRY=0 node --import tsx --test --test-reporter=./scripts/test-reporter.js --test-reporter-destination=stdout '__tests__/**/*.spec.ts' 'kernel/**/__tests__/**/*.spec.ts' 'cli/**/__tests__/**/*.spec.ts' 'server/**/__tests__/**/*.spec.ts' 'plugins/**/__tests__/**/*.spec.ts' 'core/**/__tests__/**/*.spec.ts' 'conformance/**/__tests__/**/*.spec.ts'",
-    "test:ci": "FORCE_COLOR=1 SKILL_MAP_TELEMETRY=0 node --import tsx --test --test-reporter=./scripts/test-reporter.js --test-reporter-destination=stdout '__tests__/**/*.spec.ts' 'kernel/**/__tests__/**/*.spec.ts' 'cli/**/__tests__/**/*.spec.ts' 'server/**/__tests__/**/*.spec.ts' 'plugins/**/__tests__/**/*.spec.ts' 'core/**/__tests__/**/*.spec.ts' 'conformance/**/__tests__/**/*.spec.ts'",
-    "test:spec": "SKILL_MAP_TELEMETRY=0 node --import tsx --test --test-reporter=spec '__tests__/**/*.spec.ts' 'kernel/**/__tests__/**/*.spec.ts' 'cli/**/__tests__/**/*.spec.ts' 'server/**/__tests__/**/*.spec.ts' 'plugins/**/__tests__/**/*.spec.ts' 'core/**/__tests__/**/*.spec.ts' 'conformance/**/__tests__/**/*.spec.ts'",
-    "test:coverage": "tsc --noEmit && SKILL_MAP_TELEMETRY=0 SKILL_MAP_SKIP_BENCHMARK=1 node --experimental-default-config-file --import tsx --test --experimental-test-coverage '__tests__/**/*.spec.ts' 'kernel/**/__tests__/**/*.spec.ts' 'cli/**/__tests__/**/*.spec.ts' 'server/**/__tests__/**/*.spec.ts' 'plugins/**/__tests__/**/*.spec.ts' 'core/**/__tests__/**/*.spec.ts' 'conformance/**/__tests__/**/*.spec.ts'",
-    "test:coverage:html": "tsc --noEmit && SKILL_MAP_TELEMETRY=0 SKILL_MAP_SKIP_BENCHMARK=1 c8 node --import tsx --test '__tests__/**/*.spec.ts' 'kernel/**/__tests__/**/*.spec.ts' 'cli/**/__tests__/**/*.spec.ts' 'server/**/__tests__/**/*.spec.ts' 'plugins/**/__tests__/**/*.spec.ts' 'core/**/__tests__/**/*.spec.ts' 'conformance/**/__tests__/**/*.spec.ts'",
+    test: "tsc --noEmit && SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 node --import tsx --test --test-reporter=./scripts/test-reporter.js --test-reporter-destination=stdout '__tests__/**/*.spec.ts' 'kernel/**/__tests__/**/*.spec.ts' 'cli/**/__tests__/**/*.spec.ts' 'server/**/__tests__/**/*.spec.ts' 'plugins/**/__tests__/**/*.spec.ts' 'core/**/__tests__/**/*.spec.ts' 'conformance/**/__tests__/**/*.spec.ts'",
+    "test:ci": "FORCE_COLOR=1 SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 node --import tsx --test --test-reporter=./scripts/test-reporter.js --test-reporter-destination=stdout '__tests__/**/*.spec.ts' 'kernel/**/__tests__/**/*.spec.ts' 'cli/**/__tests__/**/*.spec.ts' 'server/**/__tests__/**/*.spec.ts' 'plugins/**/__tests__/**/*.spec.ts' 'core/**/__tests__/**/*.spec.ts' 'conformance/**/__tests__/**/*.spec.ts'",
+    "test:spec": "SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 node --import tsx --test --test-reporter=spec '__tests__/**/*.spec.ts' 'kernel/**/__tests__/**/*.spec.ts' 'cli/**/__tests__/**/*.spec.ts' 'server/**/__tests__/**/*.spec.ts' 'plugins/**/__tests__/**/*.spec.ts' 'core/**/__tests__/**/*.spec.ts' 'conformance/**/__tests__/**/*.spec.ts'",
+    "test:coverage": "tsc --noEmit && SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 SKILL_MAP_SKIP_BENCHMARK=1 node --experimental-default-config-file --import tsx --test --experimental-test-coverage '__tests__/**/*.spec.ts' 'kernel/**/__tests__/**/*.spec.ts' 'cli/**/__tests__/**/*.spec.ts' 'server/**/__tests__/**/*.spec.ts' 'plugins/**/__tests__/**/*.spec.ts' 'core/**/__tests__/**/*.spec.ts' 'conformance/**/__tests__/**/*.spec.ts'",
+    "test:coverage:html": "tsc --noEmit && SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 SKILL_MAP_SKIP_BENCHMARK=1 c8 node --import tsx --test '__tests__/**/*.spec.ts' 'kernel/**/__tests__/**/*.spec.ts' 'cli/**/__tests__/**/*.spec.ts' 'server/**/__tests__/**/*.spec.ts' 'plugins/**/__tests__/**/*.spec.ts' 'core/**/__tests__/**/*.spec.ts' 'conformance/**/__tests__/**/*.spec.ts'",
     clean: "rm -rf dist coverage"
   },
   dependencies: {
@@ -344,6 +345,7 @@ var package_default = {
     c8: "11.0.0",
     eslint: "10.2.1",
     "eslint-plugin-import-x": "4.16.2",
+    "json-schema-to-typescript": "15.0.4",
     tsup: "8.5.1",
     tsx: "4.22.3",
     typescript: "5.9.3",
@@ -1449,6 +1451,13 @@ function stringArray(value) {
 
 // plugins/core/extractors/external-url-counter/index.ts
 var ID4 = "external-url-counter";
+var count = {
+  slot: "card.footer.left",
+  icon: "pi-link",
+  label: "urls",
+  emitWhenEmpty: false,
+  priority: 30
+};
 var URL_RE = /https?:\/\/[^\s<>"'`)\]]+/g;
 var TRAILING_PUNCT = /[.,;:!?]+$/;
 var externalUrlCounterExtractor = {
@@ -1473,15 +1482,7 @@ var externalUrlCounterExtractor = {
    * inherited from the footer `.sm-gnode__stat` styles cloned by
    * the `NodeCounter` renderer.
    */
-  ui: {
-    count: {
-      slot: "card.footer.left",
-      icon: "pi-link",
-      label: "urls",
-      emitWhenEmpty: false,
-      priority: 30
-    }
-  },
+  ui: { count },
   extract(ctx) {
     const seen = /* @__PURE__ */ new Set();
     const body = stripCodeBlocks(ctx.body);
@@ -1516,7 +1517,7 @@ var externalUrlCounterExtractor = {
       });
     }
     if (seen.size > 0) {
-      ctx.emitContribution("count", { value: seen.size });
+      ctx.emitContribution(count, { value: seen.size });
     }
   }
 };
@@ -1660,6 +1661,13 @@ function collectMcpServers(tools) {
 
 // plugins/core/extractors/tools-counter/index.ts
 var ID7 = "tools-counter";
+var count2 = {
+  slot: "card.footer.left",
+  icon: "pi-wrench",
+  label: "tools",
+  emitWhenEmpty: false,
+  priority: 40
+};
 var TOOLTIP_MAX = 255;
 var toolsCounterExtractor = {
   id: ID7,
@@ -1668,15 +1676,7 @@ var toolsCounterExtractor = {
   description: "Counts the tools an agent declares in its frontmatter and shows the count on the agent card.",
   scope: "frontmatter",
   precondition: { kind: ["claude/agent"] },
-  ui: {
-    count: {
-      slot: "card.footer.left",
-      icon: "pi-wrench",
-      label: "tools",
-      emitWhenEmpty: false,
-      priority: 40
-    }
-  },
+  ui: { count: count2 },
   extract(ctx) {
     const raw = ctx.frontmatter["tools"];
     if (!Array.isArray(raw)) return;
@@ -1685,7 +1685,7 @@ var toolsCounterExtractor = {
       if (typeof t === "string" && t.length > 0) names.push(t);
     }
     if (names.length === 0) return;
-    ctx.emitContribution("count", {
+    ctx.emitContribution(count2, {
       value: names.length,
       tooltip: buildTooltip(names)
     });
@@ -1923,64 +1923,91 @@ var ANNOTATION_STALE_TEXTS = {
   // a literal placeholder the operator substitutes.
   bodyTooltip: "Sidecar drift since last bump:\n  \u2022 body\nRun `sm bump <path>` to refresh.",
   frontmatterTooltip: "Sidecar drift since last bump:\n  \u2022 frontmatter\nRun `sm bump <path>` to refresh.",
-  bothTooltip: "Sidecar drift since last bump:\n  \u2022 body\n  \u2022 frontmatter\nRun `sm bump <path>` to refresh."
+  bothTooltip: "Sidecar drift since last bump:\n  \u2022 body\n  \u2022 frontmatter\nRun `sm bump <path>` to refresh.",
+  /** Label of the inspector action button that dispatches a bump. */
+  bumpLabel: "Bump",
+  /** Tooltip shown when the bump button is disabled (the node is fresh, no drift). */
+  bumpDisabledReason: "No drift to bump."
 };
 
 // plugins/core/analyzers/annotation-stale/index.ts
 var ID10 = "annotation-stale";
+var staleIcon = {
+  slot: "card.footer.right",
+  icon: "pi-clock",
+  emitWhenEmpty: true,
+  priority: 20
+};
+var staleBadge = {
+  slot: "inspector.header.badge",
+  emitWhenEmpty: false,
+  priority: 20
+};
+var bumpButton = {
+  slot: "inspector.action.button",
+  priority: 10
+};
 var annotationStaleAnalyzer = {
   id: ID10,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   description: "Marks sidecars (`.sm`) that are out of date with their `.md`.",
   mode: "deterministic",
-  // The natural fix is to bump the node: refreshes `for` hashes,
+  // The natural fix is to bump the node: refreshes the sidecar hashes,
   // increments `annotations.version`, and stamps the audit block. The
-  // UI surfaces `core/node-bump` in the node inspector under "Recommended
-  // for issues" whenever this analyzer fires.
-  ui: {
-    // A `pi-clock` chip in the footer-right cluster so the operator
-    // spots drift in the list / inspector view (and on the graph card
-    // body). Emitted with `value: 0` and `emitWhenEmpty: true` so the
-    // renderer treats it as icon-only, drift severity is binary at
-    // this surface (the tooltip carries the per-face detail body /
-    // frontmatter / both). The corner badge on `graph.node.alert` was
-    // dropped on purpose: a tooltip on the footer chip is enough, and
-    // the corner badge stacked on top of broken-ref / unknown-field
-    // alerts produced visual noise.
-    staleIcon: {
-      slot: "card.footer.right",
-      icon: "pi-clock",
-      emitWhenEmpty: true,
-      // Sits right after the stability badge and before the severity
-      // counters: stability is the node's declared lifecycle state,
-      // drift is "this node disagrees with its sidecar", then the
-      // warn / error counts anchor the right edge.
-      priority: 20
-    }
-  },
+  // inspector surfaces `core/node-bump` as the `bumpButton` contribution.
+  ui: { staleIcon, staleBadge, bumpButton },
   evaluate(ctx) {
     const issues = [];
     for (const node of ctx.nodes) {
-      const status = node.sidecar?.status;
-      if (status === void 0 || status === null) continue;
-      if (status === "fresh") continue;
-      const message = status === "stale-body" ? tx(ANNOTATION_STALE_TEXTS.bodyDrift, { path: node.path }) : status === "stale-frontmatter" ? tx(ANNOTATION_STALE_TEXTS.frontmatterDrift, { path: node.path }) : tx(ANNOTATION_STALE_TEXTS.bothDrift, { path: node.path });
+      const status = staleStatus(node.sidecar);
+      if (node.sidecar?.present === true) {
+        emitBumpButton(ctx, node.path, status !== null);
+      }
+      if (status === null) continue;
       issues.push({
         analyzerId: ID10,
         severity: "info",
         nodeIds: [node.path],
-        message,
+        message: messageFor(status, node.path),
         data: { status }
       });
-      ctx.emitContribution(node.path, "staleIcon", {
+      ctx.emitContribution(node.path, staleIcon, {
         value: 0,
         tooltip: tooltipFor(status)
       });
+      ctx.emitContribution(node.path, staleBadge, {
+        icon: "pi-clock",
+        tooltip: tooltipFor(status)
+      });
     }
     return issues;
   }
 };
+function staleStatus(overlay) {
+  const status = overlay?.status;
+  if (status === void 0 || status === null || status === "fresh") return null;
+  return status;
+}
+function messageFor(status, path) {
+  switch (status) {
+    case "stale-body":
+      return tx(ANNOTATION_STALE_TEXTS.bodyDrift, { path });
+    case "stale-frontmatter":
+      return tx(ANNOTATION_STALE_TEXTS.frontmatterDrift, { path });
+    case "stale-both":
+      return tx(ANNOTATION_STALE_TEXTS.bothDrift, { path });
+  }
+}
+function emitBumpButton(ctx, nodePath, enabled) {
+  ctx.emitContribution(nodePath, bumpButton, {
+    actionId: "core/node-bump",
+    label: ANNOTATION_STALE_TEXTS.bumpLabel,
+    icon: "pi-arrow-up-right",
+    enabled,
+    ...enabled ? {} : { disabledReason: ANNOTATION_STALE_TEXTS.bumpDisabledReason }
+  });
+}
 function tooltipFor(status) {
   switch (status) {
     case "stale-body":
@@ -2015,6 +2042,18 @@ var ISSUE_COUNTER_TEXTS = {
 
 // plugins/core/analyzers/issue-counter/index.ts
 var ID12 = "issue-counter";
+var warnCount = {
+  slot: "card.footer.right",
+  icon: "pi-exclamation-triangle",
+  emitWhenEmpty: false,
+  priority: 30
+};
+var errorCount = {
+  slot: "card.footer.right",
+  icon: "pi-times-circle",
+  emitWhenEmpty: false,
+  priority: 40
+};
 function countByTier(issues) {
   const errors = /* @__PURE__ */ new Map();
   const warns = /* @__PURE__ */ new Map();
@@ -2027,13 +2066,13 @@ function countByTier(issues) {
   }
   return { errors, warns };
 }
-function emitTierChips(ctx, contributionId, severity, counts, singleTooltip, manyTooltip) {
-  for (const [nodePath, count] of counts) {
-    const capped = Math.min(count, 99);
-    ctx.emitContribution(nodePath, contributionId, {
+function emitTierChips(ctx, ref, severity, counts, singleTooltip, manyTooltip) {
+  for (const [nodePath, count3] of counts) {
+    const capped = Math.min(count3, 99);
+    ctx.emitContribution(nodePath, ref, {
       value: capped,
       severity,
-      tooltip: count === 1 ? singleTooltip : tx(manyTooltip, { count })
+      tooltip: count3 === 1 ? singleTooltip : tx(manyTooltip, { count: count3 })
     });
   }
 }
@@ -2044,33 +2083,14 @@ var issueCounterAnalyzer = {
   description: "Emits one aggregate severity chip per node (error + warn counts) from the live issue accumulator.",
   mode: "deterministic",
   phase: "aggregate",
-  ui: {
-    // Third in the footer-right cluster, after the drift chip
-    // (priority 10) and the stability badge (priority 20). The warn
-    // counter sits before the error counter so the operator reads
-    // "advisory → blocking" left-to-right.
-    warnCount: {
-      slot: "card.footer.right",
-      icon: "pi-exclamation-triangle",
-      emitWhenEmpty: false,
-      priority: 30
-    },
-    // Last in the cluster, the red chip pins to the right edge so the
-    // most severe signal anchors the row's reading position.
-    errorCount: {
-      slot: "card.footer.right",
-      icon: "pi-times-circle",
-      emitWhenEmpty: false,
-      priority: 40
-    }
-  },
+  ui: { warnCount, errorCount },
   evaluate(ctx) {
     const accumulator = ctx.accumulatedIssues ?? [];
     if (accumulator.length === 0) return [];
     const { errors, warns } = countByTier(accumulator);
     emitTierChips(
       ctx,
-      "errorCount",
+      errorCount,
       "danger",
       errors,
       ISSUE_COUNTER_TEXTS.errorTooltipSingle,
@@ -2078,7 +2098,7 @@ var issueCounterAnalyzer = {
     );
     emitTierChips(
       ctx,
-      "warnCount",
+      warnCount,
       "warn",
       warns,
       ISSUE_COUNTER_TEXTS.warnTooltipSingle,
@@ -2246,28 +2266,27 @@ function resolveLinkTargetToPath(link, nameIndex) {
 
 // plugins/core/analyzers/link-counter/index.ts
 var ID15 = "link-counter";
+var linksIn = {
+  slot: "card.footer.left",
+  icon: "pi-download",
+  label: "incoming links",
+  emitWhenEmpty: false,
+  priority: 10
+};
+var linksOut = {
+  slot: "card.footer.left",
+  icon: "pi-upload",
+  label: "outgoing links",
+  emitWhenEmpty: false,
+  priority: 20
+};
 var linkCounterAnalyzer = {
   id: ID15,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   description: "Counts incoming and outgoing links per node.",
   mode: "deterministic",
-  ui: {
-    linksIn: {
-      slot: "card.footer.left",
-      icon: "pi-download",
-      label: "incoming links",
-      emitWhenEmpty: false,
-      priority: 10
-    },
-    linksOut: {
-      slot: "card.footer.left",
-      icon: "pi-upload",
-      label: "outgoing links",
-      emitWhenEmpty: false,
-      priority: 20
-    }
-  },
+  ui: { linksIn, linksOut },
   evaluate(ctx) {
     const nameIndex = buildNameIndex(ctx.nodes);
     const perTarget = /* @__PURE__ */ new Map();
@@ -2279,8 +2298,8 @@ var linkCounterAnalyzer = {
       bump(perSource, link.source, link.kind);
     }
     for (const node of ctx.nodes) {
-      emitChip(ctx, node.path, "linksIn", perTarget.get(node.path));
-      emitChip(ctx, node.path, "linksOut", perSource.get(node.path));
+      emitChip(ctx, node.path, linksIn, "in", perTarget.get(node.path));
+      emitChip(ctx, node.path, linksOut, "out", perSource.get(node.path));
     }
     return [];
   }
@@ -2293,14 +2312,13 @@ function bump(map, key, kind) {
   }
   byKind.set(kind, (byKind.get(kind) ?? 0) + 1);
 }
-function emitChip(ctx, nodePath, contributionId, byKind) {
+function emitChip(ctx, nodePath, ref, direction, byKind) {
   if (!byKind) return;
   let total = 0;
   for (const n of byKind.values()) total += n;
   if (total === 0) return;
   const capped = Math.min(total, 99);
-  const direction = contributionId === "linksIn" ? "in" : "out";
-  ctx.emitContribution(nodePath, contributionId, {
+  ctx.emitContribution(nodePath, ref, {
     value: capped,
     tooltip: formatBreakdown(byKind, direction)
   });
@@ -2580,42 +2598,58 @@ function normaliseId(raw) {
   return raw.normalize("NFD").replace(new RegExp("\\p{Mn}+", "gu"), "").toLowerCase().replace(/[-_\s]+/g, " ").replace(/  +/g, " ").trim();
 }
 
+// plugins/core/analyzers/node-stability/text.ts
+var NODE_STABILITY_TEXTS = {
+  /** Label of the inspector action button that sets the lifecycle stage. */
+  setLabel: "Set stability",
+  /** Prompt label for the enum-pick stability input. */
+  promptLabel: "Stability",
+  /** Prompt option label for the `experimental` stage. */
+  optionExperimental: "Experimental",
+  /** Prompt option label for the `stable` stage. */
+  optionStable: "Stable",
+  /** Prompt option label for the `deprecated` stage. */
+  optionDeprecated: "Deprecated"
+};
+
 // plugins/core/analyzers/node-stability/index.ts
 var ID18 = "node-stability";
 var EXPERIMENTAL_TOOLTIP = "Experimental: API may change";
 var DEPRECATED_TOOLTIP = "Deprecated: avoid in new code";
+var experimental = {
+  slot: "card.footer.right",
+  icon: "fa-solid fa-flask",
+  label: "experimental",
+  emitWhenEmpty: false,
+  priority: 10
+};
+var deprecated = {
+  slot: "card.footer.right",
+  icon: "pi-ban",
+  label: "deprecated",
+  emitWhenEmpty: false,
+  priority: 10
+};
+var setStabilityButton = {
+  slot: "inspector.action.button",
+  priority: 15
+};
 var nodeStabilityAnalyzer = {
   id: ID18,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   description: "Reports a node's stability stage (`experimental`, `deprecated`) on the card.",
   mode: "deterministic",
-  ui: {
-    // First in the footer-right cluster: stability is the node's
-    // declared lifecycle state, so it leads, followed by the drift
-    // chip and then the severity counters. It's a state badge, not a
-    // count, so it stays left of the numeric zone.
-    experimental: {
-      slot: "card.footer.right",
-      icon: "fa-solid fa-flask",
-      label: "experimental",
-      emitWhenEmpty: false,
-      priority: 10
-    },
-    deprecated: {
-      slot: "card.footer.right",
-      icon: "pi-ban",
-      label: "deprecated",
-      emitWhenEmpty: false,
-      priority: 10
-    }
-  },
+  ui: { experimental, deprecated, setStabilityButton },
   evaluate(ctx) {
     const issues = [];
     for (const node of ctx.nodes) {
       const stability = readStability(node);
+      if (node.sidecar?.present === true) {
+        emitSetStabilityButton(ctx, node.path, stability ?? "stable");
+      }
       if (stability === "experimental") {
-        ctx.emitContribution(node.path, "experimental", {
+        ctx.emitContribution(node.path, experimental, {
           value: 0,
           tooltip: EXPERIMENTAL_TOOLTIP
         });
@@ -2627,7 +2661,7 @@ var nodeStabilityAnalyzer = {
           data: { stability }
         });
       } else if (stability === "deprecated") {
-        ctx.emitContribution(node.path, "deprecated", {
+        ctx.emitContribution(node.path, deprecated, {
           value: 0,
           tooltip: DEPRECATED_TOOLTIP,
           severity: "warn"
@@ -2659,6 +2693,25 @@ function readLegacyMetadataStability(fm) {
 function isStability(value) {
   return value === "experimental" || value === "deprecated" || value === "stable";
 }
+function emitSetStabilityButton(ctx, nodePath, current) {
+  ctx.emitContribution(nodePath, setStabilityButton, {
+    actionId: "core/node-set-stability",
+    label: NODE_STABILITY_TEXTS.setLabel,
+    icon: "pi-flag",
+    enabled: true,
+    prompt: {
+      inputType: "enum-pick",
+      paramKey: "stability",
+      label: NODE_STABILITY_TEXTS.promptLabel,
+      options: [
+        { value: "experimental", label: NODE_STABILITY_TEXTS.optionExperimental },
+        { value: "stable", label: NODE_STABILITY_TEXTS.optionStable },
+        { value: "deprecated", label: NODE_STABILITY_TEXTS.optionDeprecated }
+      ],
+      defaultValue: current
+    }
+  });
+}
 
 // plugins/core/analyzers/node-superseded/text.ts
 var NODE_SUPERSEDED_TEXTS = {
@@ -3021,8 +3074,8 @@ var ALL_SLOT_NAMES = [
   "card.footer.left",
   "card.footer.right",
   "graph.node.alert",
-  "inspector.header.badge.counter",
-  "inspector.header.badge.tag",
+  "inspector.header.badge",
+  "inspector.action.button",
   "inspector.body.panel.breakdown",
   "inspector.body.panel.records",
   "inspector.body.panel.tree",
@@ -3130,12 +3183,12 @@ function buildSchemaValidators() {
       const v = validators.get(name);
       if (!v) throw new Error(`Unknown schema: ${name}`);
       if (v(data)) return { ok: true, data };
-      const errors = (v.errors ?? []).map(formatError).join("; ");
+      const errors = formatAjvErrors(v.errors);
       return { ok: false, errors };
     },
     validatePluginManifest(data) {
       if (pluginManifestValidator(data)) return { ok: true, data };
-      const errors = (pluginManifestValidator.errors ?? []).map(formatError).join("; ");
+      const errors = formatAjvErrors(pluginManifestValidator.errors);
       return { ok: false, errors };
     },
     validateContributionPayload(slot, payload) {
@@ -3144,7 +3197,7 @@ function buildSchemaValidators() {
         return { ok: false, errors: "unknown-slot" };
       }
       if (validator(payload)) return { ok: true };
-      const errors = (validator.errors ?? []).map(formatError).join("; ");
+      const errors = formatAjvErrors(validator.errors);
       return { ok: false, errors };
     }
   };
@@ -3176,7 +3229,7 @@ function buildProviderFrontmatterValidator(providers) {
       const v = compiled.get(key);
       if (!v) return { ok: false, errors: "no-schema" };
       if (v(data)) return { ok: true };
-      const errors = (v.errors ?? []).map(formatError).join("; ");
+      const errors = formatAjvErrors(v.errors);
       return { ok: false, errors };
     }
   };
@@ -3185,6 +3238,47 @@ function formatError(err) {
   const path = err.instancePath || "(root)";
   return `${path} ${err.message ?? err.keyword}`;
 }
+function formatAjvErrors(errors) {
+  const list = errors ?? [];
+  if (list.length === 0) return "";
+  const byPath3 = /* @__PURE__ */ new Map();
+  for (const e of list) {
+    const path = e.instancePath || "(root)";
+    const bucket = byPath3.get(path);
+    if (bucket) bucket.push(e);
+    else byPath3.set(path, [e]);
+  }
+  const parts = [];
+  for (const [path, errs] of byPath3) parts.push(...formatPathErrors(path, errs));
+  return [...new Set(parts)].join("; ");
+}
+function constBranchValues(errs) {
+  let count3 = 0;
+  for (const e of errs) {
+    const isConst = e.keyword === "const" && typeof e.params === "object" && e.params !== null && "allowedValue" in e.params;
+    if (isConst) count3 += 1;
+  }
+  return count3;
+}
+function formatPathErrors(path, errs) {
+  if (constBranchValues(errs) >= 2) {
+    const parts2 = [`${path} is not a valid value`];
+    for (const e of errs) {
+      if (e.keyword !== "const" && e.keyword !== "oneOf") parts2.push(formatError(e));
+    }
+    return parts2;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const parts = [];
+  for (const e of errs) {
+    const msg = formatError(e);
+    if (!seen.has(msg)) {
+      seen.add(msg);
+      parts.push(msg);
+    }
+  }
+  return parts;
+}
 function registerProviderAuxiliarySchemas(ajv, providers) {
   for (const provider of providers) {
     if (!provider.schemas) continue;
@@ -3497,6 +3591,122 @@ function makeIssue(signal) {
   return null;
 }
 
+// plugins/core/analyzers/supersede/text.ts
+var SUPERSEDE_TEXTS = {
+  /** Label of the inspector action button that declares supersession. */
+  supersedeLabel: "Supersede",
+  /** Tooltip shown when the supersede button is disabled (already superseded). */
+  supersedeDisabledReason: "Already superseded.",
+  /** Tooltip shown when there is no other node to supersede this one. */
+  supersedeNoTargetsReason: "No other node to supersede this one.",
+  /** Prompt label for the target node-picker (enum-pick over the live node set). */
+  supersedePromptLabel: "Superseded by"
+};
+
+// plugins/core/analyzers/supersede/index.ts
+var ID24 = "supersede";
+var supersedeButton = {
+  slot: "inspector.action.button",
+  priority: 10
+};
+var supersedeAnalyzer = {
+  id: ID24,
+  pluginId: CORE_PLUGIN_ID,
+  kind: "analyzer",
+  description: 'Projects the inspector "Supersede" button (declares a node replaced by another).',
+  mode: "deterministic",
+  ui: { supersedeButton },
+  evaluate(ctx) {
+    const candidates = ctx.nodes.filter((n) => n.virtual !== true).map((n) => n.path);
+    for (const node of ctx.nodes) {
+      if (node.virtual === true) continue;
+      const options = candidates.filter((p) => p !== node.path).map((p) => ({ value: p, label: p }));
+      emitSupersedeButton(ctx, node, options);
+    }
+    return [];
+  }
+};
+function emitSupersedeButton(ctx, node, options) {
+  const disabledReason = resolveDisabledReason(node, options.length);
+  ctx.emitContribution(node.path, supersedeButton, {
+    actionId: "core/node-supersede",
+    label: SUPERSEDE_TEXTS.supersedeLabel,
+    icon: "pi-arrow-right-arrow-left",
+    enabled: disabledReason === void 0,
+    ...disabledReason === void 0 ? {} : { disabledReason },
+    prompt: {
+      inputType: "enum-pick",
+      paramKey: "supersededBy",
+      label: SUPERSEDE_TEXTS.supersedePromptLabel,
+      options
+    }
+  });
+}
+function resolveDisabledReason(node, optionCount) {
+  if (alreadySuperseded(node)) return SUPERSEDE_TEXTS.supersedeDisabledReason;
+  if (optionCount === 0) return SUPERSEDE_TEXTS.supersedeNoTargetsReason;
+  return void 0;
+}
+function alreadySuperseded(node) {
+  const sidecar = node.sidecar;
+  if (!sidecar || sidecar.present !== true) return false;
+  const ann = sidecar.annotations;
+  if (!ann || typeof ann !== "object" || Array.isArray(ann)) return false;
+  const value = ann["supersededBy"];
+  return typeof value === "string" && value.length > 0;
+}
+
+// plugins/core/analyzers/tags/text.ts
+var TAGS_TEXTS = {
+  /** Label of the inspector action button that edits the node's tags. */
+  editLabel: "Edit tags",
+  /** Prompt label for the string-list tags input. */
+  promptLabel: "Tags"
+};
+
+// plugins/core/analyzers/tags/index.ts
+var ID25 = "tags";
+var setTagsButton = {
+  slot: "inspector.action.button",
+  priority: 15
+};
+var tagsAnalyzer = {
+  id: ID25,
+  pluginId: CORE_PLUGIN_ID,
+  kind: "analyzer",
+  description: `Projects the inspector "Edit tags" button (edits a node's taxonomy tags).`,
+  mode: "deterministic",
+  ui: { setTagsButton },
+  evaluate(ctx) {
+    for (const node of ctx.nodes) {
+      if (node.sidecar?.present !== true) continue;
+      emitSetTagsButton(ctx, node);
+    }
+    return [];
+  }
+};
+function emitSetTagsButton(ctx, node) {
+  ctx.emitContribution(node.path, setTagsButton, {
+    actionId: "core/node-set-tags",
+    label: TAGS_TEXTS.editLabel,
+    icon: "pi-tags",
+    enabled: true,
+    prompt: {
+      inputType: "string-list",
+      paramKey: "tags",
+      label: TAGS_TEXTS.promptLabel,
+      defaultValue: currentTags(node)
+    }
+  });
+}
+function currentTags(node) {
+  const ann = node.sidecar?.annotations;
+  if (!ann || typeof ann !== "object" || Array.isArray(ann)) return [];
+  const value = ann["tags"];
+  if (!Array.isArray(value)) return [];
+  return value.filter((t) => typeof t === "string");
+}
+
 // plugins/core/analyzers/trigger-collision/text.ts
 var TRIGGER_COLLISION_TEXTS = {
   /**
@@ -3523,14 +3733,14 @@ var TRIGGER_COLLISION_TEXTS = {
 };
 
 // plugins/core/analyzers/trigger-collision/index.ts
-var ID24 = "trigger-collision";
+var ID26 = "trigger-collision";
 var ADVERTISING_KINDS = /* @__PURE__ */ new Set([
   "command",
   "skill",
   "agent"
 ]);
 var triggerCollisionAnalyzer = {
-  id: ID24,
+  id: ID26,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   mode: "deterministic",
@@ -3628,7 +3838,7 @@ function analyzeTriggerBucket(normalized, claims) {
     part: parts[0]
   });
   return {
-    analyzerId: ID24,
+    analyzerId: ID26,
     severity: "error",
     nodeIds,
     message,
@@ -3668,13 +3878,13 @@ var ASCII_FORMATTER_TEXTS = {
 };
 
 // plugins/core/formatters/ascii/index.ts
-var ID25 = "ascii";
+var ID27 = "ascii";
 var KIND_ORDER = ["agent", "command", "skill", "markdown"];
 var asciiFormatter = {
-  id: ID25,
+  id: ID27,
   pluginId: CORE_PLUGIN_ID,
   kind: "formatter",
-  formatId: ID25,
+  formatId: ID27,
   description: "Renders the scan as plain text in three sections: nodes (grouped by kind), arrows, and issues. Used by `sm scan --format ascii`.",
   // ASCII tree formatter, header + per-kind sections + per-issue
   // section. Each section iterates and renders; splitting per section
@@ -3768,13 +3978,13 @@ function renderSection(out, kind, group) {
 }
 
 // plugins/core/formatters/json/index.ts
-var ID26 = "json";
+var ID28 = "json";
 var jsonFormatter = {
-  id: ID26,
+  id: ID28,
   pluginId: CORE_PLUGIN_ID,
   kind: "formatter",
   description: "Renders the persisted scan as JSON (conforms to `scan-result.schema.json`). Used by `sm graph --format json` and `GET /api/graph?format=json`.",
-  formatId: ID26,
+  formatId: ID28,
   format(ctx) {
     if (ctx.scanResult !== void 0) {
       return JSON.stringify(ctx.scanResult);
@@ -3913,9 +4123,9 @@ function resolveSpecRoot2() {
 }
 
 // plugins/core/actions/node-bump/index.ts
-var ID27 = "node-bump";
+var ID29 = "node-bump";
 var nodeBumpAction = {
-  id: ID27,
+  id: ID29,
   pluginId: CORE_PLUGIN_ID,
   kind: "action",
   description: "Marks a node as updated: bumps `annotations.version`, refreshes sidecar hashes, and records the timestamp.",
@@ -3972,45 +4182,166 @@ function pickCurrentVersion(overlay) {
   return typeof v === "number" && Number.isFinite(v) ? v : 0;
 }
 
+// plugins/core/actions/node-set-stability/index.ts
+var STABILITY_VALUES = ["experimental", "stable", "deprecated"];
+var ID30 = "node-set-stability";
+var nodeSetStabilityAction = {
+  id: ID30,
+  pluginId: CORE_PLUGIN_ID,
+  kind: "action",
+  description: "Sets the lifecycle stage of the current node (writes `stability` to the sidecar).",
+  mode: "deterministic",
+  // The runtime contract uses generic <TInput, TReport>; this narrows
+  // both. The cast is the standard pattern for built-ins that want
+  // typed local I/O while staying compatible with the open generic.
+  invoke(rawInput, ctx) {
+    const input = rawInput ?? {};
+    return invokeSetStability(input, ctx);
+  }
+};
+function invokeSetStability(input, ctx) {
+  const stability = input.stability;
+  if (!STABILITY_VALUES.includes(stability)) {
+    return { report: { ok: false, reason: "invalid" } };
+  }
+  const timestamp = ctx.now().toISOString();
+  const write = {
+    kind: "sidecar",
+    path: sidecarPathFor(ctx.nodeAbsolutePath),
+    changes: {
+      identity: {
+        path: ctx.node.path,
+        bodyHash: ctx.node.bodyHash,
+        frontmatterHash: ctx.node.frontmatterHash
+      },
+      annotations: { stability },
+      audit: {
+        lastBumpedAt: timestamp,
+        lastBumpedBy: ctx.invoker
+      }
+    }
+  };
+  const report = { ok: true, stability };
+  return { report, writes: [write] };
+}
+
+// plugins/core/actions/node-set-tags/index.ts
+var ID31 = "node-set-tags";
+var nodeSetTagsAction = {
+  id: ID31,
+  pluginId: CORE_PLUGIN_ID,
+  kind: "action",
+  description: "Sets the taxonomy tags of the current node (writes `tags` to the sidecar; whole-array replace).",
+  mode: "deterministic",
+  // The runtime contract uses generic <TInput, TReport>; this narrows
+  // both. The cast is the standard pattern for built-ins that want
+  // typed local I/O while staying compatible with the open generic.
+  invoke(rawInput, ctx) {
+    const input = rawInput ?? {};
+    return invokeSetTags(input, ctx);
+  }
+};
+function invokeSetTags(input, ctx) {
+  const tags = Array.isArray(input.tags) ? input.tags : [];
+  const timestamp = ctx.now().toISOString();
+  const write = {
+    kind: "sidecar",
+    path: sidecarPathFor(ctx.nodeAbsolutePath),
+    changes: {
+      identity: {
+        path: ctx.node.path,
+        bodyHash: ctx.node.bodyHash,
+        frontmatterHash: ctx.node.frontmatterHash
+      },
+      annotations: { tags },
+      audit: {
+        lastBumpedAt: timestamp,
+        lastBumpedBy: ctx.invoker
+      }
+    }
+  };
+  const report = { ok: true, tags };
+  return { report, writes: [write] };
+}
+
 // plugins/core/actions/node-supersede/index.ts
-var ID28 = "node-supersede";
+var ID32 = "node-supersede";
 var nodeSupersedeAction = {
-  id: ID28,
+  id: ID32,
   pluginId: CORE_PLUGIN_ID,
   kind: "action",
   description: "Declares the current node as superseded by another (writes `supersededBy` to the sidecar).",
   mode: "deterministic",
-  invoke(_input, _ctx) {
-    const report = { ok: true, noop: true };
-    return { report };
+  // The runtime contract uses generic <TInput, TReport>; supersede
+  // narrows both. The cast is the standard pattern for built-ins that
+  // want typed local I/O while staying compatible with the open generic.
+  invoke(rawInput, ctx) {
+    const input = rawInput ?? {};
+    return invokeSupersede(input, ctx);
   }
 };
+function invokeSupersede(input, ctx) {
+  const supersededBy = input.supersededBy;
+  if (supersededBy === ctx.node.path) {
+    return { report: { ok: false, reason: "self" } };
+  }
+  const timestamp = ctx.now().toISOString();
+  const write = {
+    kind: "sidecar",
+    path: sidecarPathFor(ctx.nodeAbsolutePath),
+    changes: {
+      identity: {
+        path: ctx.node.path,
+        bodyHash: ctx.node.bodyHash,
+        frontmatterHash: ctx.node.frontmatterHash
+      },
+      annotations: { supersededBy },
+      audit: {
+        lastBumpedAt: timestamp,
+        lastBumpedBy: ctx.invoker
+      }
+    }
+  };
+  const report = { ok: true, supersededBy };
+  return { report, writes: [write] };
+}
 
 // kernel/update-check/index.ts
 var SEMVER_SHAPE_RE = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 async function fetchLatestVersion(pkg, opts) {
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), opts.timeoutMs);
+  const abortTimer = setTimeout(() => controller.abort(), opts.timeoutMs);
+  let capTimer;
+  const hardCap = new Promise((_resolve, reject) => {
+    capTimer = setTimeout(
+      () => reject(new Error(`update check timed out after ${opts.timeoutMs}ms`)),
+      opts.timeoutMs
+    );
+  });
   try {
-    const url = `https://registry.npmjs.org/${pkg}/latest`;
-    const response = await fetch(url, {
-      signal: controller.signal,
-      headers: { accept: "application/json" }
-    });
-    if (!response.ok) {
-      throw new Error(`registry returned status ${response.status}`);
-    }
-    const payload = await response.json();
-    if (typeof payload.version !== "string" || payload.version.length === 0) {
-      throw new Error("registry payload missing string `version`");
-    }
-    if (!SEMVER_SHAPE_RE.test(payload.version)) {
-      throw new Error("registry payload `version` is not a semver-shaped string");
-    }
-    return payload.version;
+    return await Promise.race([fetchVersion(pkg, controller.signal), hardCap]);
   } finally {
-    clearTimeout(timer);
+    clearTimeout(abortTimer);
+    if (capTimer !== void 0) clearTimeout(capTimer);
+  }
+}
+async function fetchVersion(pkg, signal) {
+  const url = `https://registry.npmjs.org/${pkg}/latest`;
+  const response = await fetch(url, {
+    signal,
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok) {
+    throw new Error(`registry returned status ${response.status}`);
+  }
+  const payload = await response.json();
+  if (typeof payload.version !== "string" || payload.version.length === 0) {
+    throw new Error("registry payload missing string `version`");
   }
+  if (!SEMVER_SHAPE_RE.test(payload.version)) {
+    throw new Error("registry payload `version` is not a semver-shaped string");
+  }
+  return payload.version;
 }
 function compareVersions(a, b) {
   const pa = parseSemver(a);
@@ -4479,10 +4810,14 @@ var referenceBrokenAnalyzer2 = { ...referenceBrokenAnalyzer, pluginId: "core", v
 var referenceRedundantAnalyzer2 = { ...referenceRedundantAnalyzer, pluginId: "core", version: VERSION };
 var schemaViolationAnalyzer2 = { ...schemaViolationAnalyzer, pluginId: "core", version: VERSION };
 var signalCollisionAnalyzer2 = { ...signalCollisionAnalyzer, pluginId: "core", version: VERSION };
+var supersedeAnalyzer2 = { ...supersedeAnalyzer, pluginId: "core", version: VERSION };
+var tagsAnalyzer2 = { ...tagsAnalyzer, pluginId: "core", version: VERSION };
 var triggerCollisionAnalyzer2 = { ...triggerCollisionAnalyzer, pluginId: "core", version: VERSION };
 var asciiFormatter2 = { ...asciiFormatter, pluginId: "core", version: VERSION };
 var jsonFormatter2 = { ...jsonFormatter, pluginId: "core", version: VERSION };
 var nodeBumpAction2 = { ...nodeBumpAction, pluginId: "core", version: VERSION };
+var nodeSetStabilityAction2 = { ...nodeSetStabilityAction, pluginId: "core", version: VERSION };
+var nodeSetTagsAction2 = { ...nodeSetTagsAction, pluginId: "core", version: VERSION };
 var nodeSupersedeAction2 = { ...nodeSupersedeAction, pluginId: "core", version: VERSION };
 var updateCheckHook2 = { ...updateCheckHook, pluginId: "core", version: VERSION };
 var builtInPlugins = [
@@ -4542,10 +4877,14 @@ var builtInPlugins = [
       referenceRedundantAnalyzer2,
       schemaViolationAnalyzer2,
       signalCollisionAnalyzer2,
+      supersedeAnalyzer2,
+      tagsAnalyzer2,
       triggerCollisionAnalyzer2,
       asciiFormatter2,
       jsonFormatter2,
       nodeBumpAction2,
+      nodeSetStabilityAction2,
+      nodeSetTagsAction2,
       nodeSupersedeAction2,
       updateCheckHook2
     ]
@@ -5802,13 +6141,16 @@ function ensureSidecarWritesAllowed(opts) {
     default: false
   });
   if (allowed === true) return;
-  if (opts.confirm === true) {
+  if (opts.always === true) {
     writeConfigValue("allowEditSmFiles", true, {
       target: "project-local",
       cwd: opts.cwd
     });
     return;
   }
+  if (opts.confirm === true) {
+    return;
+  }
   throw new EConsentRequiredError({
     key: "allowEditSmFiles",
     hintTarget: "project-local"
@@ -7433,7 +7775,7 @@ async function loadPluginOverrideMap(db) {
 }
 
 // kernel/util/enum-parsers.ts
-var STABILITY_VALUES = Object.freeze([
+var STABILITY_VALUES2 = Object.freeze([
   "experimental",
   "stable",
   "deprecated"
@@ -7756,6 +8098,41 @@ async function replaceAllScanContributions(trx, contributions, livePaths = /* @_
   await sweepPerTupleContributions(trx, contributions, freshlyRunTuples);
   await upsertContributionsBuffer(trx, contributions);
 }
+async function replaceAllScanContributionErrors(trx, contributionErrors) {
+  await trx.deleteFrom("scan_contribution_errors").execute();
+  if (contributionErrors.length === 0) return;
+  const CHUNK = 400;
+  for (let i = 0; i < contributionErrors.length; i += CHUNK) {
+    const slice = contributionErrors.slice(i, i + CHUNK);
+    const rows = slice.map((e) => ({
+      pluginId: e.pluginId,
+      extensionId: e.extensionId,
+      nodePath: e.nodePath,
+      reason: e.reason,
+      message: e.message,
+      contributionId: e.contributionId ?? null,
+      slot: e.slot ?? null,
+      emittedAt: e.emittedAt
+    }));
+    await trx.insertInto("scan_contribution_errors").values(rows).execute();
+  }
+}
+async function listAllContributionErrors(db) {
+  const rows = await db.selectFrom("scan_contribution_errors").selectAll().orderBy("pluginId", "asc").orderBy("extensionId", "asc").orderBy("nodePath", "asc").orderBy("emittedAt", "asc").execute();
+  return rows.map(rowToContributionError);
+}
+function rowToContributionError(row) {
+  return {
+    pluginId: row.pluginId,
+    extensionId: row.extensionId,
+    nodePath: row.nodePath,
+    reason: row.reason,
+    message: row.message,
+    ...row.contributionId !== null ? { contributionId: row.contributionId } : {},
+    ...row.slot !== null ? { slot: row.slot } : {},
+    emittedAt: row.emittedAt
+  };
+}
 async function sweepOrphanContributions(trx, livePaths) {
   if (livePaths.size > 0) {
     await trx.deleteFrom("scan_contributions").where("nodePath", "not in", [...livePaths]).execute();
@@ -7965,7 +8342,7 @@ async function findNodesByTag(db, tag) {
 }
 
 // kernel/adapters/sqlite/scan-persistence.ts
-async function persistScanResult(db, result, renameOps = [], extractorRuns = [], enrichments = [], contributions = [], registeredContributionKeys = /* @__PURE__ */ new Set(), freshlyRunTuples = /* @__PURE__ */ new Set()) {
+async function persistScanResult(db, result, renameOps = [], extractorRuns = [], enrichments = [], contributions = [], registeredContributionKeys = /* @__PURE__ */ new Set(), freshlyRunTuples = /* @__PURE__ */ new Set(), contributionErrors = []) {
   const scannedAt = validateScannedAt(result.scannedAt);
   const renames = [];
   await db.transaction().execute(async (trx) => {
@@ -7980,6 +8357,7 @@ async function persistScanResult(db, result, renameOps = [], extractorRuns = [],
       registeredContributionKeys,
       freshlyRunTuples
     );
+    await replaceAllScanContributionErrors(trx, contributionErrors);
     const tagRecords = nodesToTagRecords(result.nodes);
     await replaceAllScanTags(trx, tagRecords, livePathsForContrib);
     await upsertEnrichmentLayer(trx, result, renameOps, enrichments);
@@ -8424,7 +8802,8 @@ var SqliteStorageAdapter = class {
       listForNode: (nodePath) => loadContributionsForNode(this.db, nodePath),
       listForPaths: (paths) => loadContributionsForPaths(this.db, paths),
       lookup: (pluginId, contributionId, nodePath, extensionId) => loadContributionLookup(this.db, pluginId, contributionId, nodePath, extensionId),
-      purgeByPlugin: (pluginId, extensionId) => purgeContributionsByPlugin(this.db, pluginId, extensionId)
+      purgeByPlugin: (pluginId, extensionId) => purgeContributionsByPlugin(this.db, pluginId, extensionId),
+      listAllErrors: () => listAllContributionErrors(this.db)
     };
     this.tags = {
       listForNode: (nodePath) => loadTagsForNode(this.db, nodePath),
@@ -8497,7 +8876,8 @@ async function persistScansThroughNonTx(db, result, opts) {
     defaults.enrichments,
     defaults.contributions,
     defaults.registeredContributionKeys,
-    defaults.freshlyRunTuples
+    defaults.freshlyRunTuples,
+    defaults.contributionErrors
   );
 }
 function applyPersistDefaults(opts) {
@@ -8508,6 +8888,7 @@ function applyPersistDefaults(opts) {
     contributions: [],
     registeredContributionKeys: /* @__PURE__ */ new Set(),
     freshlyRunTuples: /* @__PURE__ */ new Set(),
+    contributionErrors: [],
     ...opts
   };
 }
@@ -8672,7 +9053,8 @@ function buildTxSubset(trx) {
           d.enrichments,
           d.contributions,
           d.registeredContributionKeys,
-          d.freshlyRunTuples
+          d.freshlyRunTuples,
+          d.contributionErrors
         ).then(() => void 0);
       }
     },
@@ -9167,10 +9549,11 @@ var BumpCommand = class extends SmCommand {
    * `EConsentRequiredError` thrown by `FilesystemSidecarStore.applyPatch`
    * (via `ensureSidecarWritesAllowed`), prompt the operator if stdin is
    * a TTY and `--yes` was not passed. On accept, flip `this.yes` to
-   * true and re-run `dispatch` (the second pass passes `confirm: true`
-   * to the store and the gate persists the flag to project-local).
-   * On decline or non-TTY without `--yes`, print a directed message
-   * and return `ExitCode.Error`.
+   * true and re-run `dispatch` (the second pass passes `always: true`
+   * to the store and the gate persists the flag to project-local, the
+   * CLI's documented "never asked again" contract, Step 17 consent
+   * split). On decline or non-TTY without `--yes`, print a directed
+   * message and return `ExitCode.Error`.
    */
   async #runWithConsent(ansi, dispatch) {
     try {
@@ -9269,7 +9652,11 @@ var BumpCommand = class extends SmCommand {
   async #applyBumpedSingle(item, node, ansi) {
     const ctx = defaultRuntimeContext();
     const consent = {
+      // Step 17 split: the CLI's accept / `--yes` persists the grant
+      // (its documented "never asked again" contract), so it threads
+      // `always`, not the new one-shot `confirm`.
       confirm: this.yes,
+      always: this.yes,
       cwd: ctx.cwd
     };
     const applied = await applyBumpWrites(item, consent);
@@ -9359,7 +9746,9 @@ var BumpCommand = class extends SmCommand {
     const store = new FilesystemSidecarStore(ensureSidecarWritesAllowed);
     const ctx = defaultRuntimeContext();
     const consent = {
+      // Step 17 split: CLI accept / `--yes` persists (see #runSingle).
       confirm: this.yes,
+      always: this.yes,
       cwd: ctx.cwd
     };
     const outcomes = [];
@@ -9588,16 +9977,23 @@ function readConformanceKillSwitches(env = process.env) {
 }
 
 // kernel/i18n/plugin-loader.texts.ts
+var SPEC_GITHUB_BASE = "https://github.com/crystian/skill-map/blob/main";
 var PLUGIN_LOADER_TEXTS = {
   invalidManifestJsonParse: "{{manifestPath}}: {{errDescription}}. Validate the JSON (e.g. `npx jsonlint plugin.json`).",
-  invalidManifestAjv: "{{manifestPath}}: {{errors}}. See spec/schemas/plugins-registry.schema.json#/$defs/PluginManifest.",
+  invalidManifestAjv: `{{manifestPath}}: {{errors}}. See ${SPEC_GITHUB_BASE}/spec/schemas/plugins-registry.schema.json#/$defs/PluginManifest.`,
   invalidSpecCompat: 'specCompat "{{specCompat}}" is not a valid semver range. Use a range like "^1.0.0".',
   incompatibleSpec: `@skill-map/spec {{installedSpecVersion}} does not satisfy specCompat "{{specCompat}}". Either update the plugin's specCompat (and re-test) or pin sm to a compatible spec version.`,
   loadErrorFileNotFound: "extension file not found: {{relEntry}} (resolved to {{abs}}). Check plugin.json#/extensions paths.",
   loadErrorImportFailed: "{{relEntry}}: import failed: {{errDescription}}",
   loadErrorMissingKind: "{{relEntry}}: default export missing a string `kind` field. Expected one of: {{knownKindsList}}.",
   loadErrorUnknownKind: '{{relEntry}}: unknown extension kind "{{kindReceived}}". Expected one of: {{knownKindsList}}.',
-  invalidManifestExtensionShape: "{{relEntry}}: {{kind}} manifest invalid: {{errors}}. See spec/schemas/extensions/{{kind}}.schema.json.",
+  // No "manifest invalid" framing here: the warning wrapper already
+  // carries the `(invalid-manifest)` status, so this reason is just the
+  // file + the specific error + the doc link. `{{docUrl}}` is chosen by
+  // the caller: a bad view-slot value points to the slot catalog
+  // (`spec/view-slots.md`), every other manifest-shape error to the kind
+  // schema. Both are GitHub blob URLs.
+  invalidManifestExtensionShape: "{{relEntry}}: {{errors}}. See {{docUrl}}.",
   importExceededTimeout: "import exceeded {{timeoutMs}}ms; likely a top-level side effect (network call, infinite loop, large blocking work). Move side effects into the runtime methods (`detect` / `evaluate` / `render` / etc.).",
   disabledByConfig: "disabled by config_plugins or settings.json",
   invalidManifestDirMismatch: "directory name '{{dirName}}' does not match manifest id '{{manifestId}}'. Rename the directory to match the id, or update the manifest id to match the directory.",
@@ -9929,7 +10325,7 @@ function loadOneProviderKind(opts) {
           opts.pluginPath,
           opts.pluginId,
           "invalid-manifest",
-          `Provider kind \`${opts.entry}\` (declared at \`${opts.relEntry}\`) failed validation in \`kinds/${opts.entry}/kind.json\`: ${validation.errors}. See spec/schemas/extensions/provider-kind.schema.json.`
+          `Provider kind \`${opts.entry}\` (declared at \`${opts.relEntry}\`) failed validation in \`kinds/${opts.entry}/kind.json\`: ${validation.errors}. See ${SPEC_GITHUB_BASE}/spec/schemas/extensions/provider-kind.schema.json.`
         ),
         manifest: opts.manifest
       }
@@ -10351,13 +10747,17 @@ var PluginLoader = class {
     }
     const extValidator = this.#options.validators.validatorForExtension(kind);
     if (!extValidator(manifestView)) {
-      const errors = (extValidator.errors ?? []).map((e) => `${e.instancePath || "(root)"} ${e.message ?? e.keyword}`).join("; ");
+      const errors = formatAjvErrors(extValidator.errors);
+      const slotError = (extValidator.errors ?? []).some(
+        (e) => (e.instancePath ?? "").endsWith("/slot")
+      );
+      const docUrl = slotError ? `${SPEC_GITHUB_BASE}/spec/view-slots.md` : `${SPEC_GITHUB_BASE}/spec/schemas/extensions/${kind}.schema.json`;
       return { ok: false, failure: {
         ...fail(
           pluginPath,
           pluginId,
           "invalid-manifest",
-          tx(PLUGIN_LOADER_TEXTS.invalidManifestExtensionShape, { relEntry, kind, errors })
+          tx(PLUGIN_LOADER_TEXTS.invalidManifestExtensionShape, { relEntry, errors, docUrl })
         ),
         manifest
       } };
@@ -10835,6 +11235,9 @@ function collectViewContributions(pluginId, extensionId, instance, out, options
   const raw = instance["ui"];
   if (typeof raw !== "object" || raw === null) return;
   const exclude = options.excludeQualifiedIds;
+  const pluginOrder = options.pluginOrder;
+  const extOrder = instance["order"];
+  const extensionOrder = typeof extOrder === "number" ? extOrder : void 0;
   for (const [contributionId, value] of Object.entries(raw)) {
     if (typeof value !== "object" || value === null) continue;
     const entry = value;
@@ -10853,13 +11256,15 @@ function collectViewContributions(pluginId, extensionId, instance, out, options
       ...typeof entry.icon === "string" ? { icon: entry.icon } : {},
       ...typeof entry.emptyText === "string" ? { emptyText: entry.emptyText } : {},
       ...typeof entry.priority === "number" ? { priority: entry.priority } : {},
+      ...typeof pluginOrder === "number" ? { pluginOrder } : {},
+      ...typeof extensionOrder === "number" ? { extensionOrder } : {},
       emitWhenEmpty: entry.emitWhenEmpty === true
     });
   }
 }
 
 // core/runtime/plugin-runtime/bucketing.ts
-function bucketLoaded(loaded, runtime) {
+function bucketLoaded(loaded, runtime, pluginOrder) {
   for (const ext of loaded) {
     const instance = ext.instance;
     if (!isExtensionInstance(instance)) continue;
@@ -10880,7 +11285,9 @@ function bucketLoaded(loaded, runtime) {
       ...ext.entryPath ? { entry: ext.entryPath } : {}
     });
     collectAnnotationContributions(ext.pluginId, instance, runtime.annotationContributions);
-    collectViewContributions(ext.pluginId, ext.id, instance, runtime.viewContributions);
+    collectViewContributions(ext.pluginId, ext.id, instance, runtime.viewContributions, {
+      ...typeof pluginOrder === "number" ? { pluginOrder } : {}
+    });
   }
 }
 function collectAnnotationContributions(pluginId, instance, out) {
@@ -10926,11 +11333,14 @@ function truncateTail(s, max) {
 // core/runtime/i18n/plugin-runtime.texts.ts
 var PLUGIN_RUNTIME_TEXTS = {
   /**
-   * Stderr-ready warning for one non-loaded plugin. Format keeps the
-   * status word and the reason scannable so a user can grep
-   * `incompatible-spec` / `invalid-manifest` / `load-error`.
+   * Stderr-ready warning for one non-loaded plugin. The status in parens
+   * stays greppable (`invalid-manifest` / `incompatible-spec` /
+   * `load-error`); `all extensions skipped` states the consequence (the
+   * loader rejects the plugin whole, aborting on the first bad
+   * extension). The reason carries the specifics, so it must NOT restate
+   * the status (no second "manifest invalid").
    */
-  warningRow: "plugin {{id}}: {{status}}, {{reason}}",
+  warningRow: "plugin {{id}} ({{status}}), all extensions skipped: {{reason}}",
   /** Placeholder when a non-loaded plugin record carries no `reason`. */
   warningReasonMissing: "(no reason recorded)"
 };
@@ -10992,7 +11402,7 @@ async function loadPluginRuntime(opts = {}) {
   };
   for (const plugin of discovered) {
     if (plugin.status === "enabled") {
-      bucketLoaded(plugin.extensions ?? [], runtime);
+      bucketLoaded(plugin.extensions ?? [], runtime, plugin.manifest?.order);
       continue;
     }
     if (plugin.status === "disabled") continue;
@@ -13330,8 +13740,8 @@ var DbResetCommand = class extends SmCommand {
           return ExitCode.Ok;
         }
         const withCounts = rows.map((r) => {
-          const count = db.prepare(`SELECT COUNT(*) AS c FROM "${r.name}"`).get();
-          return { name: r.name, rowCount: Number(count.c) };
+          const count3 = db.prepare(`SELECT COUNT(*) AS c FROM "${r.name}"`).get();
+          return { name: r.name, rowCount: Number(count3.c) };
         });
         const totalRows = withCounts.reduce((acc, r) => acc + r.rowCount, 0);
         const lines = withCounts.map((r) => `  - ${r.name}: ${r.rowCount} row(s)`).join("\n");
@@ -15148,7 +15558,7 @@ var ORCHESTRATOR_TEXTS = {
   frontmatterMalformedMissingClose: "Frontmatter in {{path}} opens with `---` but never closes (no matching `---` line at column 0 was found). The file was scanned as body-only and every metadata field was silently lost. Add a closing `---` line below the metadata block.",
   extensionErrorLinkKindNotDeclared: 'Extractor "{{extractorId}}" emitted a link of kind "{{linkKind}}" outside its declared `emitsLinkKinds` set [{{declaredKinds}}]. Link dropped.',
   extensionErrorIssueInvalidSeverity: `Rule "{{analyzerId}}" emitted an issue with invalid severity {{severity}} (allowed: 'error' | 'warn' | 'info'). Issue dropped.`,
-  extensionErrorContributionUnknownId: 'Extractor "{{extractorId}}" emitted contribution "{{contributionId}}" on {{nodePath}} but did not declare it in its `viewContributions` map. Contribution dropped.',
+  extensionErrorContributionUndeclaredRef: 'Extension "{{extractorId}}" emitted a view contribution on {{nodePath}} whose object is not one declared in its `ui` map (pass the declared const by reference, do not spread or inline it). Contribution dropped.',
   extensionErrorContributionPayloadInvalid: 'Extractor "{{extractorId}}" emitted contribution "{{contributionId}}" on {{nodePath}}; payload failed the "{{slot}}" schema: {{errors}}. Contribution dropped.',
   extensionErrorRecommendedActionMissing: 'Analyzer "{{analyzerId}}" declares recommendedAction "{{actionId}}" but no Action is registered under that qualified id. The analyzer stays registered; the recommendation will not surface in the inspector.',
   runScanRootEmptyArray: "runScan: roots must contain at least one path (spec requires minItems: 1)",
@@ -15168,6 +15578,7 @@ async function runExtractorsForNode(opts) {
   const externalLinks = [];
   const enrichmentBuffer = /* @__PURE__ */ new Map();
   const contributions = [];
+  const contributionErrors = [];
   const signals = [];
   const virtualNodes = [];
   const virtualNodePaths = /* @__PURE__ */ new Set();
@@ -15199,36 +15610,54 @@ async function runExtractorsForNode(opts) {
         });
       }
     };
-    const declaredContributions = readDeclaredContributions(extractor);
-    const emitContribution = (contributionId, payload) => {
-      const declared = declaredContributions.get(contributionId);
+    const declaredContributions = readDeclaredContributionRefs(extractor);
+    const emitContribution = (ref, payload) => {
+      const declared = typeof ref === "object" && ref !== null ? declaredContributions.get(ref) : void 0;
       if (!declared) {
+        const message = tx(ORCHESTRATOR_TEXTS.extensionErrorContributionUndeclaredRef, {
+          extractorId: qualifiedId2,
+          nodePath: opts.node.path
+        });
         emitExtensionError(opts.emitter, qualifiedId2, opts.node.path, {
           phase: "emitContribution",
-          contributionId,
-          reason: "unknown-contribution-id",
-          message: tx(ORCHESTRATOR_TEXTS.extensionErrorContributionUnknownId, {
-            extractorId: qualifiedId2,
-            contributionId,
-            nodePath: opts.node.path
-          })
+          reason: "undeclared-contribution-ref",
+          message
+        });
+        contributionErrors.push({
+          pluginId: extractor.pluginId,
+          extensionId: extractor.id,
+          nodePath: opts.node.path,
+          reason: "undeclared-contribution-ref",
+          message,
+          emittedAt: Date.now()
         });
         return;
       }
       const result = validators.validateContributionPayload(declared.slot, payload);
       if (!result.ok) {
+        const message = tx(ORCHESTRATOR_TEXTS.extensionErrorContributionPayloadInvalid, {
+          extractorId: qualifiedId2,
+          contributionId: declared.id,
+          nodePath: opts.node.path,
+          slot: declared.slot,
+          errors: result.errors
+        });
         emitExtensionError(opts.emitter, qualifiedId2, opts.node.path, {
           phase: "emitContribution",
-          contributionId,
+          contributionId: declared.id,
           slot: declared.slot,
           reason: result.errors,
-          message: tx(ORCHESTRATOR_TEXTS.extensionErrorContributionPayloadInvalid, {
-            extractorId: qualifiedId2,
-            contributionId,
-            nodePath: opts.node.path,
-            slot: declared.slot,
-            errors: result.errors
-          })
+          message
+        });
+        contributionErrors.push({
+          pluginId: extractor.pluginId,
+          extensionId: extractor.id,
+          nodePath: opts.node.path,
+          reason: result.errors,
+          message,
+          contributionId: declared.id,
+          slot: declared.slot,
+          emittedAt: Date.now()
         });
         return;
       }
@@ -15236,7 +15665,7 @@ async function runExtractorsForNode(opts) {
         pluginId: extractor.pluginId,
         extensionId: extractor.id,
         nodePath: opts.node.path,
-        contributionId,
+        contributionId: declared.id,
         slot: declared.slot,
         payload,
         emittedAt: Date.now()
@@ -15274,11 +15703,12 @@ async function runExtractorsForNode(opts) {
     externalLinks,
     enrichments: Array.from(enrichmentBuffer.values()),
     contributions,
+    contributionErrors,
     signals,
     virtualNodes
   };
 }
-function readDeclaredContributions(extension) {
+function readDeclaredContributionRefs(extension) {
   const out = /* @__PURE__ */ new Map();
   const raw = extension.ui;
   if (typeof raw !== "object" || raw === null) return out;
@@ -15286,7 +15716,7 @@ function readDeclaredContributions(extension) {
     if (typeof value !== "object" || value === null) continue;
     const slot = value.slot;
     if (typeof slot !== "string") continue;
-    out.set(id, { slot });
+    out.set(value, { id, slot });
   }
   return out;
 }
@@ -15534,6 +15964,7 @@ function isExternalUrlLink(link) {
 async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, registeredActionIds, emitter, hookDispatcher, reservedNodePaths, signals, seedIssues = []) {
   const issues = [...seedIssues];
   const contributions = [];
+  const contributionErrors = [];
   const validators = loadSchemaValidators();
   void registeredActionIds;
   const analyzerOrphans = orphanSidecars.map((o) => ({
@@ -15543,36 +15974,54 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
   const scheduled = orderAnalyzersByPhase(analyzers);
   for (const analyzer of scheduled) {
     const qualifiedId2 = qualifiedExtensionId(analyzer.pluginId, analyzer.id);
-    const declaredContributions = readDeclaredContributions(analyzer);
-    const emitContribution = (nodePath, contributionId, payload) => {
-      const declared = declaredContributions.get(contributionId);
+    const declaredContributions = readDeclaredContributionRefs(analyzer);
+    const emitContribution = (nodePath, ref, payload) => {
+      const declared = typeof ref === "object" && ref !== null ? declaredContributions.get(ref) : void 0;
       if (!declared) {
+        const message = tx(ORCHESTRATOR_TEXTS.extensionErrorContributionUndeclaredRef, {
+          extractorId: qualifiedId2,
+          nodePath
+        });
         emitExtensionError(emitter, qualifiedId2, nodePath, {
           phase: "emitContribution",
-          contributionId,
-          reason: "unknown-contribution-id",
-          message: tx(ORCHESTRATOR_TEXTS.extensionErrorContributionUnknownId, {
-            extractorId: qualifiedId2,
-            contributionId,
-            nodePath
-          })
+          reason: "undeclared-contribution-ref",
+          message
+        });
+        contributionErrors.push({
+          pluginId: analyzer.pluginId,
+          extensionId: analyzer.id,
+          nodePath,
+          reason: "undeclared-contribution-ref",
+          message,
+          emittedAt: Date.now()
         });
         return;
       }
       const result = validators.validateContributionPayload(declared.slot, payload);
       if (!result.ok) {
+        const message = tx(ORCHESTRATOR_TEXTS.extensionErrorContributionPayloadInvalid, {
+          extractorId: qualifiedId2,
+          contributionId: declared.id,
+          nodePath,
+          slot: declared.slot,
+          errors: result.errors
+        });
         emitExtensionError(emitter, qualifiedId2, nodePath, {
           phase: "emitContribution",
-          contributionId,
+          contributionId: declared.id,
           slot: declared.slot,
           reason: result.errors,
-          message: tx(ORCHESTRATOR_TEXTS.extensionErrorContributionPayloadInvalid, {
-            extractorId: qualifiedId2,
-            contributionId,
-            nodePath,
-            slot: declared.slot,
-            errors: result.errors
-          })
+          message
+        });
+        contributionErrors.push({
+          pluginId: analyzer.pluginId,
+          extensionId: analyzer.id,
+          nodePath,
+          reason: result.errors,
+          message,
+          contributionId: declared.id,
+          slot: declared.slot,
+          emittedAt: Date.now()
         });
         return;
       }
@@ -15580,7 +16029,7 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
         pluginId: analyzer.pluginId,
         extensionId: analyzer.id,
         nodePath,
-        contributionId,
+        contributionId: declared.id,
         slot: declared.slot,
         payload,
         emittedAt: Date.now()
@@ -15613,7 +16062,7 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
     emitter.emit(evt);
     await hookDispatcher.dispatch("analyzer.completed", evt);
   }
-  return { issues, contributions };
+  return { issues, contributions, contributionErrors };
 }
 function orderAnalyzersByPhase(analyzers) {
   return analyzers.slice().sort((a, b) => phaseRank(a) - phaseRank(b));
@@ -16501,6 +16950,7 @@ async function walkAndExtract(opts) {
     enrichments: [...accum.enrichmentBuffer.values()],
     extractorRuns: accum.extractorRuns,
     contributions: accum.contributionsBuffer,
+    contributionErrors: accum.contributionErrorsBuffer,
     freshlyRunTuples: accum.freshlyRunTuples,
     orphanSidecars,
     sidecarRoots: accum.sidecarRoots,
@@ -16517,6 +16967,7 @@ function createWalkAccumulators() {
     frontmatterIssues: [],
     enrichmentBuffer: /* @__PURE__ */ new Map(),
     contributionsBuffer: [],
+    contributionErrorsBuffer: [],
     freshlyRunTuples: /* @__PURE__ */ new Set(),
     extractorRuns: [],
     sidecarRoots: /* @__PURE__ */ new Map()
@@ -16667,7 +17118,11 @@ function mergeExtractResult(extractResult, accum) {
     accum.enrichmentBuffer.set(`${enr.nodePath}\0${enr.extractorId}`, enr);
   }
   for (const c of extractResult.contributions) accum.contributionsBuffer.push(c);
-  for (const vn of extractResult.virtualNodes) {
+  for (const e of extractResult.contributionErrors) accum.contributionErrorsBuffer.push(e);
+  mergeVirtualNodes(extractResult.virtualNodes, accum);
+}
+function mergeVirtualNodes(virtualNodes, accum) {
+  for (const vn of virtualNodes) {
     if (accum.nodes.some((n) => n.path === vn.path)) continue;
     accum.nodes.push(vn);
   }
@@ -16943,6 +17398,7 @@ async function dispatchExtractorCompleted(extractors, emitter, hookDispatcher) {
 }
 function mergeAnalyzerEmissions(walked, analyzerResult, analyzers) {
   for (const c of analyzerResult.contributions) walked.contributions.push(c);
+  for (const e of analyzerResult.contributionErrors) walked.contributionErrors.push(e);
   for (const analyzer of analyzers ?? []) {
     if (analyzer.ui === void 0) continue;
     for (const node of walked.nodes) {
@@ -16988,6 +17444,7 @@ function buildScanReturn(walked, issues, renameOps, stats, options, setup) {
     extractorRuns: walked.extractorRuns,
     enrichments: walked.enrichments,
     contributions: walked.contributions,
+    contributionErrors: walked.contributionErrors,
     freshlyRunTuples: walked.freshlyRunTuples
   };
 }
@@ -17656,12 +18113,12 @@ var DB_DRIFT_TEXTS = {
   // `{{reason}}` is one of the `driftReason*` strings below so the
   // operator sees WHY the cache is being rebuilt (version skew vs an
   // inline schema change the version did not bump).
-  driftPrompt: "{{glyph}}  The local cache was built by skill-map {{dbVersion}} and you are on {{currentVersion}} ({{reason}}).\n   {{hint}}\n",
-  driftPromptHint: "Pre-1.0 the DB is a derived cache (your .sm sidecars hold the real data); it cannot be carried across a schema change and has to be rebuilt.",
-  driftPromptQuestion: "Delete the local cache and rebuild it on this scan? [y/N] ",
+  driftPrompt: "{{glyph}}  Local cache is from skill-map {{dbVersion}}, you are on {{currentVersion}} ({{reason}}).\n   {{hint}}\n",
+  driftPromptHint: "It will be rebuilt from your .sm files on this scan; nothing of yours is touched.",
+  driftPromptQuestion: "Rebuild the local cache now? [y/N] ",
   // Receipt after the rebuild (printed by the scan / refresh path).
-  driftReset: "{{glyph}}  Local cache rebuilt ({{reason}}): it was written by skill-map {{dbVersion}}, you are on {{currentVersion}}.\n   {{hint}}\n",
-  driftResetHint: "The DB was deleted and is being regenerated by this scan; .sm sidecars were not touched.",
+  driftReset: "{{glyph}}  Local cache rebuilt: was from skill-map {{dbVersion}}, you are on {{currentVersion}}.\n   {{hint}}\n",
+  driftResetHint: "Rebuilt from your .sm files; nothing of yours was touched.",
   // Abort headline when the operator declines (wrapped by the caller's
   // `sm scan: {message}` shell, so it carries no glyph / verb prefix).
   driftAborted: "cache rebuild declined: the {{dbVersion}} cache cannot be reused on {{currentVersion}} ({{reason}}). {{hint}}",
@@ -17679,12 +18136,13 @@ async function maybeResetOnDrift(dbPath, policy) {
   const reason = detectDriftReason(dbPath, policy.currentVersion);
   if (reason === null) return { kind: "no-drift" };
   const dbVersion = readScannedByVersion(dbPath) ?? "unknown";
-  const confirmed = await confirmDriftReset(dbVersion, reason, policy);
+  const prompted = shouldPromptForReset(policy);
+  const confirmed = prompted ? await askDriftReset(dbVersion, reason, policy) : true;
   if (!confirmed) {
     return { kind: "aborted", dbVersion, currentVersion: policy.currentVersion, reason };
   }
   await removeDbFiles(dbPath);
-  renderResetReceipt(dbVersion, reason, policy);
+  if (!prompted) renderResetReceipt(dbVersion, policy);
   return { kind: "reset", dbVersion, currentVersion: policy.currentVersion, reason };
 }
 function detectDriftReason(dbPath, currentVersion) {
@@ -17709,10 +18167,6 @@ function readScannedByVersion(dbPath) {
     raw?.close();
   }
 }
-async function confirmDriftReset(dbVersion, reason, policy) {
-  if (!shouldPromptForReset(policy)) return true;
-  return askDriftReset(dbVersion, reason, policy);
-}
 function reasonText(reason) {
   return reason === "version" ? DB_DRIFT_TEXTS.driftReasonVersion : DB_DRIFT_TEXTS.driftReasonSchema;
 }
@@ -17743,7 +18197,7 @@ async function askDriftReset(dbVersion, reason, policy) {
     rl.close();
   }
 }
-function renderResetReceipt(dbVersion, reason, policy) {
+function renderResetReceipt(dbVersion, policy) {
   if (!policy.printer) return;
   const warnGlyph = policy.style?.warnGlyph ?? "\u26A0";
   const dim = policy.style?.dim ?? ((s) => s);
@@ -17752,7 +18206,6 @@ function renderResetReceipt(dbVersion, reason, policy) {
       glyph: warnGlyph,
       dbVersion,
       currentVersion: policy.currentVersion,
-      reason: reasonText(reason),
       hint: dim(DB_DRIFT_TEXTS.driftResetHint)
     })
   );
@@ -18017,6 +18470,7 @@ async function runPersistPath(opts, dbPath, jobsDir, strict, loadPrior, runScanW
         extractorRuns: scanned.extractorRuns,
         enrichments: scanned.enrichments,
         contributions: scanned.contributions,
+        contributionErrors: scanned.contributionErrors,
         registeredContributionKeys: collectRegisteredContributionKeys(extensions),
         freshlyRunTuples: scanned.freshlyRunTuples
       });
@@ -18873,11 +19327,11 @@ function renderStatsFailures(failures, ansi) {
     tx(HISTORY_TEXTS.statsSectionHeader, { title: HISTORY_TEXTS.statsSectionTitleFailures })
   ];
   const reasonWidth = Math.max(...failures.map(([reason]) => reason.length));
-  for (const [reason, count] of failures) {
+  for (const [reason, count3] of failures) {
     lines.push(
       tx(HISTORY_TEXTS.statsFailuresRow, {
         reason: sanitizeForTerminal(reason).padEnd(reasonWidth),
-        count: ansi.red(String(count))
+        count: ansi.red(String(count3))
       })
     );
   }
@@ -19579,14 +20033,14 @@ var OrphansReconcileCommand = class extends SmCommand {
         tx(ORPHANS_TEXTS.reconcileSuccessBody, { breakdown: ansi.dim(breakdown) })
       );
       if (summary.collisions.length > 0) {
-        const count = summary.collisions.length;
+        const count3 = summary.collisions.length;
         this.printer.info(
           tx(
             dryRun ? ORPHANS_TEXTS.reconcileCollisionsNoteDryRun : ORPHANS_TEXTS.reconcileCollisionsNote,
             {
               glyph: ansi.yellow("\u26A0"),
-              count,
-              plural: count === 1 ? "" : "s"
+              count: count3,
+              plural: count3 === 1 ? "" : "s"
             }
           )
         );
@@ -19903,6 +20357,23 @@ var PLUGINS_TEXTS = {
   doctorIssuesHeader: "\n  Issues ({{count}})\n",
   doctorIssueEntry: "    {{glyph}}  {{id}}  {{status}}\n",
   doctorIssueBody: "       {{line}}\n",
+  // --- runtime contribution errors (last scan) -------------------------
+  /**
+   * "off-shape visible" follow-up. Section heading for view
+   * contributions the last scan REJECTED at emit time (undeclared ref,
+   * or payload failed the slot's AJV schema). Rendered only when at
+   * least one error was persisted; promotes the exit code to 1.
+   * `count` is the total error row count across every plugin.
+   */
+  doctorContribErrorsHeader: "\n  Runtime contribution errors (last scan) ({{count}})\n",
+  /** Per-plugin group header: red glyph + plugin id + this plugin's error count. */
+  doctorContribErrorEntry: "    {{glyph}}  {{pluginId}}  ({{count}})\n",
+  /** Sample line under a plugin group: wrapped, dimmed diagnostic message. */
+  doctorContribErrorBody: "       {{line}}\n",
+  /** Trailing dimmed note when a plugin has more errors than the sample cap shows. */
+  doctorContribErrorMore: "       {{line}}\n",
+  /** Body of the "more" note: the count of samples omitted under this plugin. */
+  doctorContribErrorMoreText: "... and {{count}} more",
   // --- enable / disable -----------------------------------------------
   /**
    * §3.1b two-line block. Mutex between explicit ids and `--all`; the
@@ -20406,7 +20877,7 @@ function sortExtensionsCanonical(exts) {
 }
 function renderBuiltInDetail(b, ansi) {
   const glyph = b.enabled ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : ansi.red(PLUGINS_TEXTS.rowGlyphOff);
-  const count = b.extensions.length;
+  const count3 = b.extensions.length;
   const sorted = sortExtensionsCanonical(b.extensions);
   const items = sorted.map((ext) => ({
     glyph: ext.enabled ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : ansi.red(PLUGINS_TEXTS.rowGlyphOff),
@@ -20417,8 +20888,8 @@ function renderBuiltInDetail(b, ansi) {
     glyph,
     id: b.id,
     source: ansi.dim(PLUGINS_TEXTS.sourceBuiltIn),
-    count,
-    plural: count === 1 ? "" : "s"
+    count: count3,
+    plural: count3 === 1 ? "" : "s"
   }) + PLUGINS_TEXTS.detailExtensionsBlock + renderExtensionItems(items);
 }
 function renderPluginDetail(match, ansi) {
@@ -20600,6 +21071,7 @@ function renderExtensionFields(meta) {
 
 // cli/commands/plugins/doctor.ts
 import { Command as Command24, Option as Option23 } from "clipanion";
+var CONTRIB_ERROR_SAMPLE_CAP = 3;
 var STATUS_ORDER = [
   "enabled",
   "disabled",
@@ -20625,6 +21097,8 @@ var PluginsDoctorCommand = class extends SmCommand {
     const knownKinds = collectKnownKinds(plugins);
     const applicableKindWarnings = collectApplicableKindWarnings(plugins, knownKinds);
     const unknownSlotWarnings = collectUnknownSlotWarnings(plugins, KNOWN_SLOT_NAMES);
+    const contribErrors = await loadContributionErrors();
+    const contribErrorGroups = groupContributionErrorsByPlugin(contribErrors);
     const bad = plugins.filter((p) => p.status !== "enabled" && p.status !== "disabled");
     const totalWarnings = applicableKindWarnings.length + unknownSlotWarnings.length;
     if (this.json) {
@@ -20634,23 +21108,51 @@ var PluginsDoctorCommand = class extends SmCommand {
         applicableKindWarnings,
         unknownSlotWarnings,
         totalWarnings,
+        contribErrors,
         elapsedMs: this.elapsed.ms()
       });
       this.printer.data(JSON.stringify(envelope) + "\n");
-      return bad.length > 0 ? ExitCode.Issues : ExitCode.Ok;
-    }
+      return bad.length > 0 || contribErrors.length > 0 ? ExitCode.Issues : ExitCode.Ok;
+    }
+    this.#renderHumanReport({
+      counts,
+      builtInCount: builtIns2.length,
+      userCount: plugins.length,
+      applicableKindWarnings,
+      unknownSlotWarnings,
+      totalWarnings,
+      bad,
+      contribErrorGroups,
+      contribErrorCount: contribErrors.length
+    });
+    return bad.length > 0 || contribErrors.length > 0 ? ExitCode.Issues : ExitCode.Ok;
+  }
+  /**
+   * Render the full human-mode report in section order: summary header,
+   * source + status tables, then the gated warnings / issues / runtime
+   * contribution-error sections. Pulled out of `run` so the verb body
+   * stays a linear pipeline (load → aggregate → render → exit code)
+   * under the complexity cap.
+   */
+  #renderHumanReport(args2) {
     const ansi = this.ansiFor("stdout");
-    this.#renderSummaryHeader(counts.enabled, bad.length, totalWarnings);
-    this.#renderSourceBreakdown(builtIns2.length, plugins.length);
-    this.#renderStatusBreakdown(counts, ansi);
-    if (totalWarnings > 0) {
-      this.#renderWarnings(applicableKindWarnings, unknownSlotWarnings, totalWarnings, ansi);
+    this.#renderSummaryHeader(args2.counts.enabled, args2.bad.length, args2.totalWarnings);
+    this.#renderSourceBreakdown(args2.builtInCount, args2.userCount);
+    this.#renderStatusBreakdown(args2.counts, ansi);
+    if (args2.totalWarnings > 0) {
+      this.#renderWarnings(
+        args2.applicableKindWarnings,
+        args2.unknownSlotWarnings,
+        args2.totalWarnings,
+        ansi
+      );
     }
-    if (bad.length > 0) {
-      this.#renderIssues(bad, ansi);
-      return ExitCode.Issues;
+    if (args2.bad.length > 0) {
+      this.#renderIssues(args2.bad, ansi);
+    }
+    if (args2.contribErrorCount > 0) {
+      this.#renderContributionErrors(args2.contribErrorGroups, args2.contribErrorCount, ansi);
     }
-    return ExitCode.Ok;
   }
   #renderSummaryHeader(enabled, badCount, warnings) {
     this.printer.data(
@@ -20687,10 +21189,10 @@ var PluginsDoctorCommand = class extends SmCommand {
     const statusLabelWidth = Math.max(...STATUS_ORDER.map((s) => s.length));
     this.printer.data(PLUGINS_TEXTS.doctorStatusHeader);
     for (const status of STATUS_ORDER) {
-      const count = counts[status];
-      const isProblem = status !== "enabled" && status !== "disabled" && count > 0;
+      const count3 = counts[status];
+      const isProblem = status !== "enabled" && status !== "disabled" && count3 > 0;
       const label = status.padEnd(statusLabelWidth);
-      const formattedCount = isProblem ? ansi.red(String(count)) : String(count);
+      const formattedCount = isProblem ? ansi.red(String(count3)) : String(count3);
       this.printer.data(
         tx(PLUGINS_TEXTS.doctorStatusRow, {
           label: isProblem ? ansi.red(label) : label,
@@ -20753,6 +21255,42 @@ var PluginsDoctorCommand = class extends SmCommand {
       }
     }
   }
+  /**
+   * "off-shape visible" follow-up. Render the last scan's runtime
+   * contribution rejections grouped by plugin: one red entry per plugin
+   * (id + this plugin's error count), then up to
+   * `CONTRIB_ERROR_SAMPLE_CAP` wrapped sample messages, then a dimmed
+   * "... and N more" note when the group overflows the cap. The full
+   * set is always available via `--json`.
+   */
+  #renderContributionErrors(groups, total, ansi) {
+    this.printer.data(tx(PLUGINS_TEXTS.doctorContribErrorsHeader, { count: total }));
+    const glyph = ansi.red(PLUGINS_TEXTS.rowGlyphOff);
+    for (const group of groups) {
+      this.printer.data(
+        tx(PLUGINS_TEXTS.doctorContribErrorEntry, {
+          glyph,
+          pluginId: sanitizeForTerminal(group.pluginId),
+          count: group.errors.length
+        })
+      );
+      for (const err of group.errors.slice(0, CONTRIB_ERROR_SAMPLE_CAP)) {
+        for (const line of wrapText(sanitizeForTerminal(err.message), 64)) {
+          this.printer.data(
+            tx(PLUGINS_TEXTS.doctorContribErrorBody, { line: ansi.dim(line) })
+          );
+        }
+      }
+      const hidden = group.errors.length - CONTRIB_ERROR_SAMPLE_CAP;
+      if (hidden > 0) {
+        this.printer.data(
+          tx(PLUGINS_TEXTS.doctorContribErrorMore, {
+            line: ansi.dim(tx(PLUGINS_TEXTS.doctorContribErrorMoreText, { count: hidden }))
+          })
+        );
+      }
+    }
+  }
 };
 function countByStatus(builtIns2, plugins, resolveEnabled) {
   const counts = {
@@ -20949,6 +21487,15 @@ function buildDoctorJsonEnvelope(args2) {
       })
     });
   }
+  const contributionErrors = args2.contribErrors.map((e) => ({
+    pluginId: sanitizeForTerminal(e.pluginId),
+    extensionId: sanitizeForTerminal(e.extensionId),
+    nodePath: sanitizeForTerminal(e.nodePath),
+    reason: sanitizeForTerminal(e.reason),
+    message: sanitizeForTerminal(e.message),
+    ...e.contributionId !== void 0 ? { contributionId: sanitizeForTerminal(e.contributionId) } : {},
+    ...e.slot !== void 0 ? { slot: sanitizeForTerminal(e.slot) } : {}
+  }));
   return {
     ok: true,
     kind: "plugins.doctor",
@@ -20963,9 +21510,35 @@ function buildDoctorJsonEnvelope(args2) {
     },
     issues,
     warnings,
+    contributionErrors,
     elapsedMs: args2.elapsedMs
   };
 }
+async function loadContributionErrors() {
+  const ctx = defaultRuntimeContext();
+  const dbPath = resolveDbPath({ db: void 0, cwd: ctx.cwd });
+  try {
+    const rows = await tryWithSqlite(
+      { databasePath: dbPath, autoBackup: false },
+      (adapter) => adapter.contributions.listAllErrors()
+    );
+    return rows ?? [];
+  } catch {
+    return [];
+  }
+}
+function groupContributionErrorsByPlugin(errors) {
+  const byPlugin = /* @__PURE__ */ new Map();
+  for (const err of errors) {
+    let group = byPlugin.get(err.pluginId);
+    if (!group) {
+      group = { pluginId: err.pluginId, errors: [] };
+      byPlugin.set(err.pluginId, group);
+    }
+    group.errors.push(err);
+  }
+  return [...byPlugin.values()];
+}
 
 // cli/commands/plugins/toggle.ts
 import { Command as Command25, Option as Option24 } from "clipanion";
@@ -21481,9 +22054,22 @@ function stub2(extId) {
  * Declared settings (\`settings\`):
  *   - 'keywords' (${DEFAULT_INPUT_TYPE}) \u2192 exposed as ctx.settings.keywords
  *
+ * View contributions: declare each one as a const, list it in \`ui\` by
+ * shorthand, and pass that SAME const (by reference, not a string id) to
+ * \`ctx.emitContribution\`. The kernel recovers the contribution from the
+ * object identity. (Write the plugin in TypeScript and add
+ * \`satisfies IViewContribution\` from '@skill-map/cli' to get a typed payload.)
+ *
  * See: spec/plugin-author-guide.md \xA7View contributions
  *      spec/view-slots.md
  */
+const count = {
+  slot: '${DEFAULT_SLOT}',
+  icon: '\u{1F50D}',
+  label: 'kw',
+  emitWhenEmpty: false,
+};
+
 export default {
   version: '0.1.0',
   description: 'Counts configured keywords per node.',
@@ -21499,14 +22085,7 @@ export default {
     },
   },
 
-  ui: {
-    count: {
-      slot: '${DEFAULT_SLOT}',
-      icon: '\u{1F50D}',
-      label: 'kw',
-      emitWhenEmpty: false,
-    },
-  },
+  ui: { count },
 
   extract(ctx) {
     const keywords = (ctx.settings && ctx.settings.keywords) || ['TODO', 'FIXME'];
@@ -21516,7 +22095,7 @@ export default {
       total += (ctx.body.match(re) || []).length;
     }
     if (total > 0) {
-      ctx.emitContribution('count', { value: total });
+      ctx.emitContribution(count, { value: total });
     }
   },
 };
@@ -21810,8 +22389,8 @@ var VIEW_SLOTS_CATALOG = [
   { id: "card.footer.left", summary: "Counter chip in the left footer of the card." },
   { id: "card.footer.right", summary: "Counter chip in the right footer of the card." },
   { id: "graph.node.alert", summary: 'Reserved corner badge on the graph node, special-case signals only. No core analyzer emits here; routine "this node has a problem" findings belong in `card.footer.right`.' },
-  { id: "inspector.header.badge.counter", summary: "Counter chip in the inspector header badge cluster." },
-  { id: "inspector.header.badge.tag", summary: "Qualitative tag chip in the inspector header badge cluster." },
+  { id: "inspector.header.badge", summary: "Unified badge in the inspector header cluster: icon and/or label and/or count, optional severity. Multi-cardinality, priority order, modeled on card.footer.left. Replaces the retired inspector.header.badge.counter and inspector.header.badge.tag sub-slots." },
+  { id: "inspector.action.button", summary: "Action button in the inspector. Click dispatches a kernel Action by qualified id via POST /api/actions/:id. Always emitted; the payload `enabled` flag carries the dynamic condition (e.g. isStale for the bump button)." },
   { id: "inspector.body.panel.breakdown", summary: "Top-N labeled values rendered as a bar chart in the inspector body." },
   { id: "inspector.body.panel.records", summary: "Tabular data (rows \xD7 columns \u2264 50 \xD7 6) in the inspector body." },
   { id: "inspector.body.panel.tree", summary: "Recursive label/children hierarchy (depth \u2264 6, total \u2264 200) in the inspector body." },
@@ -22109,15 +22688,15 @@ var RefreshCommand = class extends SmCommand {
       return ExitCode.Ok;
     }
     const glyph = ansi.green("\u2713");
-    const count = freshEnrichments.length;
-    const noun = count === 1 ? REFRESH_TEXTS.refreshNounSingular : REFRESH_TEXTS.refreshNounPlural;
+    const count3 = freshEnrichments.length;
+    const noun = count3 === 1 ? REFRESH_TEXTS.refreshNounSingular : REFRESH_TEXTS.refreshNounPlural;
     if (this.stale) {
       const nodeCount = targetNodes.length;
       const nodeNoun = nodeCount === 1 ? REFRESH_TEXTS.refreshNodeNounSingular : REFRESH_TEXTS.refreshNodeNounPlural;
       this.printer.data(
         tx(REFRESH_TEXTS.refreshSuccessStale, {
           glyph,
-          count,
+          count: count3,
           noun,
           nodeCount,
           nodeNoun
@@ -22127,7 +22706,7 @@ var RefreshCommand = class extends SmCommand {
       this.printer.data(
         tx(REFRESH_TEXTS.refreshSuccessSingle, {
           glyph,
-          count,
+          count: count3,
           noun,
           nodePath: this.nodePath
         })
@@ -22604,7 +23183,15 @@ function createWatcherRuntime(opts) {
         runOptions.priorExtractorRuns = priorState.extractorRuns;
       }
       const ran = await runScanWithRenames(kernel, runOptions);
-      const { result, renameOps, extractorRuns, enrichments, contributions, freshlyRunTuples } = ran;
+      const {
+        result,
+        renameOps,
+        extractorRuns,
+        enrichments,
+        contributions,
+        contributionErrors,
+        freshlyRunTuples
+      } = ran;
       await withSqlite(
         { databasePath: opts.dbPath },
         (writer) => writer.scans.persist(result, {
@@ -22612,6 +23199,7 @@ function createWatcherRuntime(opts) {
           extractorRuns,
           enrichments,
           contributions,
+          contributionErrors,
           registeredContributionKeys: collectRegisteredContributionKeys(composed),
           freshlyRunTuples
         })
@@ -22940,11 +23528,11 @@ async function runWatchLoop(opts) {
         }
         void info;
       },
-      onBreakerTripped: (count, message) => {
+      onBreakerTripped: (count3, message) => {
         context.stderr.write(
           tx(WATCH_TEXTS.breakerTripped, {
             glyph: errGlyph,
-            count,
+            count: count3,
             hint: stderrAnsi.dim(tx(WATCH_TEXTS.breakerTrippedHint, { message }))
           })
         );
@@ -23486,8 +24074,8 @@ function formatScanCounts(opts) {
   }
   return parts.join(" \xB7 ");
 }
-function countNoun(count, singular, plural) {
-  return count === 1 ? singular : plural;
+function countNoun(count3, singular, plural) {
+  return count3 === 1 ? singular : plural;
 }
 
 // cli/commands/scan-compare.ts
@@ -23769,7 +24357,7 @@ import { WebSocketServer } from "ws";
 // server/app.ts
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
-import { HTTPException as HTTPException16 } from "hono/http-exception";
+import { HTTPException as HTTPException17 } from "hono/http-exception";
 
 // core/config/service.ts
 var ConfigService = class {
@@ -23932,33 +24520,33 @@ var SERVER_TEXTS = {
   // Hono's `app.notFound` fallback, every other unmatched path funnels
   // here (after static + SPA fallback have had their turn).
   unknownPath: "Not found: {{path}}.",
-  // ---- sidecar bump route (routes/sidecar.ts) ------------------------------
-  // 409 refusal when a fresh node is bumped without `force`. Dispatch
-  // is via the typed `ConflictError` (`code: 'sidecar-fresh'`), so the
-  // `sidecar-fresh:` prefix is NOT load-bearing; it stays only for
-  // log-grep affinity with the CLI's bump verb.
-  sidecarFreshRefusal: "sidecar-fresh: Node is fresh; pass force:true to bump anyway.",
+  // ---- generic action-dispatch route (routes/actions.ts, Step 17) ----------
+  //
+  // POST /api/actions/:qualifiedId. Generalises the legacy bump route:
+  // resolve the qualified action id off the kernel registry, invoke it,
+  // materialise any sidecar writes through the same consent-gated store,
+  // broadcast `action.applied`. Each error keeps its own message key so
+  // the UI / log can disambiguate without regex on the message.
   // 400 envelopes thrown by `parseBody` when the request payload is
-  // malformed. Each branch has its own key so the UI / log can
-  // disambiguate without regex on the message.
-  sidecarBodyNotJson: "Request body must be valid JSON.",
-  sidecarBodyNotObject: "Request body must be a JSON object.",
-  sidecarNodePathRequired: "`nodePath` is required and must be a non-empty string.",
-  sidecarForceMustBeBoolean: "`force` must be a boolean when present.",
-  sidecarConfirmMustBeBoolean: "`confirm` must be a boolean when present.",
-  /**
-   * 412 envelope when `POST /api/sidecar/bump` would create a `.sm`
-   * file but `allowEditSmFiles` is still false. The UI's bump
-   * call-path catches `code: 'confirm-required'` and opens a
-   * `ConfirmationService` dialog explaining `.sm` writes; on accept
-   * it retries with `confirm: true` in the body.
-   */
-  sidecarConsentRequired: "consent required to write .sm sidecar files in this project. Retry with `confirm: true` to grant (writes to .skill-map/settings.local.json, gitignored).",
-  // 500 envelope when the built-in bump action ships without an
-  // `invoke()`, should be impossible in production but the route
-  // throws a typed envelope rather than a bare `Error` so the global
-  // `app.onError` can format it.
-  sidecarBumpInvokeMissing: "built-in bump action is missing its invoke().",
+  // malformed.
+  actionBodyNotJson: "Request body must be valid JSON.",
+  actionBodyNotObject: "Request body must be a JSON object.",
+  actionNodePathRequired: "`nodePath` is required and must be a non-empty string.",
+  actionInputMustBeObject: "`input` must be an object when present.",
+  actionConfirmMustBeBoolean: "`confirm` must be a boolean when present.",
+  actionAlwaysMustBeBoolean: "`always` must be a boolean when present.",
+  // 404 envelope when `:qualifiedId` does not resolve to a registered
+  // action with an `invoke()`. Covers both "no such action" and "action
+  // exists but ships no deterministic entry point" (a probabilistic
+  // action that cannot be dispatched over this synchronous route). The
+  // id is sanitised before interpolation.
+  actionUnknown: 'No invokable action with id "{{actionId}}".',
+  // 409 envelope when an action's report comes back `ok: false`. The
+  // refusal `reason` (when the report carries one) becomes the envelope
+  // `code`; the fallback `action-refused` covers reports that refuse
+  // without naming a reason. Dispatch is via the typed
+  // `ActionRefusedError`; the message is informational only.
+  actionRefused: 'Action "{{actionId}}" refused to run on "{{nodePath}}".',
   // ---- POST /api/scan (manual refresh) ------------------------------------
   // 400, runtime cannot persist a meaningful scan because the boot
   // dropped half the pipeline. Same gate the `?fresh=1` GET applies.
@@ -25029,6 +25617,8 @@ function registerPluginsRoute(app, deps) {
   app.get("/api/plugins", async (c) => {
     const resolveEnabled = await buildFreshResolver2(deps);
     const items = listItems(deps, resolveEnabled);
+    const errorsByPlugin = await loadRuntimeContributionErrors(deps);
+    attachRuntimeContributionErrors(items, errorsByPlugin);
     return c.json(
       buildListEnvelope({
         kind: "plugins",
@@ -25203,6 +25793,41 @@ function firstVersion(extensions) {
 function classifyPluginSource(_pluginPath, _deps) {
   return "project";
 }
+async function loadRuntimeContributionErrors(deps) {
+  try {
+    const rows = await tryWithSqlite(
+      { databasePath: deps.options.dbPath, autoBackup: false },
+      (adapter) => adapter.contributions.listAllErrors()
+    );
+    if (rows === null) return /* @__PURE__ */ new Map();
+    return groupContributionErrorsByPlugin2(rows);
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+function groupContributionErrorsByPlugin2(rows) {
+  const out = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const projected = {
+      extensionId: row.extensionId,
+      nodePath: row.nodePath,
+      reason: row.reason,
+      message: row.message,
+      ...row.contributionId !== void 0 ? { contributionId: row.contributionId } : {},
+      ...row.slot !== void 0 ? { slot: row.slot } : {}
+    };
+    const list = out.get(row.pluginId);
+    if (list) list.push(projected);
+    else out.set(row.pluginId, [projected]);
+  }
+  return out;
+}
+function attachRuntimeContributionErrors(items, errorsByPlugin) {
+  for (const item of items) {
+    const errors = errorsByPlugin.get(item.id);
+    if (errors && errors.length > 0) item.runtimeContributionErrors = errors;
+  }
+}
 async function persistAndProject(c, deps, configKey, enabled) {
   const overrides = await tryWithSqlite(
     { databasePath: deps.options.dbPath, autoBackup: false },
@@ -25892,8 +26517,168 @@ var parsePatchBody5 = makeBodyValidator(PATCH_BODY_SCHEMA4, {
   }
 });
 
-// server/routes/scan.ts
+// server/routes/actions.ts
+import { HTTPException as HTTPException15 } from "hono/http-exception";
+import { resolve as resolve36 } from "path";
+
+// server/routes/node-loader.ts
 import { HTTPException as HTTPException14 } from "hono/http-exception";
+async function loadNode(deps, nodePath) {
+  const persisted = await tryWithSqlite(
+    { databasePath: deps.options.dbPath, autoBackup: false },
+    async (adapter) => adapter.scans.load()
+  );
+  const node = persisted?.nodes.find((n) => n.path === nodePath);
+  if (!node) {
+    throw new HTTPException14(404, {
+      message: tx(SERVER_TEXTS.nodeNotFound, { path: sanitizeForTerminal(nodePath) })
+    });
+  }
+  return node;
+}
+
+// server/routes/actions.ts
+var ENVELOPE_KIND2 = "action.applied";
+var REFUSED_CODE = "action-refused";
+var INVOKER_FALLBACK = "ui";
+var QUALIFIED_ID_SEGMENT2 = /^[A-Za-z0-9._-]+$/;
+var ACTION_BODY_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: ["nodePath"],
+  properties: {
+    nodePath: { type: "string", minLength: 1 },
+    input: { type: "object" },
+    confirm: { type: "boolean" },
+    always: { type: "boolean" }
+  }
+};
+var parseBody = makeBodyValidator(ACTION_BODY_SCHEMA, {
+  notJson: SERVER_TEXTS.actionBodyNotJson,
+  notObject: SERVER_TEXTS.actionBodyNotObject,
+  invalid: SERVER_TEXTS.actionBodyNotObject,
+  mapping: {
+    "/nodePath:required": SERVER_TEXTS.actionNodePathRequired,
+    ":type:object": SERVER_TEXTS.actionBodyNotObject,
+    "/nodePath:type:string": SERVER_TEXTS.actionNodePathRequired,
+    "/nodePath:minLength": SERVER_TEXTS.actionNodePathRequired,
+    "/input:type:object": SERVER_TEXTS.actionInputMustBeObject,
+    "/confirm:type:boolean": SERVER_TEXTS.actionConfirmMustBeBoolean,
+    "/always:type:boolean": SERVER_TEXTS.actionAlwaysMustBeBoolean
+  }
+});
+function registerActionsRoutes(app, deps) {
+  app.post("/api/actions/:pluginId/:actionId", async (c) => {
+    const startedAt = Date.now();
+    const pluginId = parseSegment(c.req.param("pluginId"), "pluginId");
+    const shortId = parseSegment(c.req.param("actionId"), "actionId");
+    const actionId = qualifiedExtensionId(pluginId, shortId);
+    const action = resolveInvokableAction(deps.kernel, actionId);
+    const body = await parseBody(c.req.raw);
+    const node = await loadNode(deps, body.nodePath);
+    let absPath;
+    try {
+      assertContained(deps.runtimeContext.cwd, node.path);
+      absPath = resolve36(deps.runtimeContext.cwd, node.path);
+    } catch (err) {
+      throw new HTTPException15(400, { message: formatErrorMessage(err) });
+    }
+    const result = invokeAction(action, absPath, node, body, deps.runtimeContext.cwd);
+    const report = result.report;
+    if (report.ok === false) {
+      const reason = typeof report.reason === "string" && report.reason.length > 0 ? sanitizeForTerminal(report.reason) : REFUSED_CODE;
+      throw new ActionRefusedError({
+        code: reason,
+        message: tx(SERVER_TEXTS.actionRefused, {
+          actionId: sanitizeForTerminal(actionId),
+          nodePath: sanitizeForTerminal(node.path)
+        }),
+        actionId,
+        nodePath: node.path,
+        report: result.report
+      });
+    }
+    if (report.ok === true && report.noop === true) {
+      return c.json(buildEnvelope5(actionId, node.path, result.report, startedAt));
+    }
+    await materializeWrites(result.writes, body, deps.runtimeContext.cwd);
+    if (body.always === true) {
+      deps.configService.reload();
+    }
+    const eventData = {
+      actionId,
+      nodePath: node.path,
+      report: result.report
+    };
+    const wsEnvelope = {
+      type: ENVELOPE_KIND2,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      data: eventData
+    };
+    deps.broadcaster.broadcast(wsEnvelope);
+    return c.json(buildEnvelope5(actionId, node.path, result.report, startedAt));
+  });
+}
+function parseSegment(value, name) {
+  if (!QUALIFIED_ID_SEGMENT2.test(value)) {
+    throw new HTTPException15(400, {
+      message: tx(SERVER_TEXTS.qualifiedIdMalformed, {
+        name,
+        value: sanitizeForTerminal(value)
+      })
+    });
+  }
+  return value;
+}
+function resolveInvokableAction(kernel, actionId) {
+  const ext = kernel.registry.get("action", actionId);
+  const action = ext;
+  if (!action || typeof action.invoke !== "function") {
+    throw new HTTPException15(404, {
+      message: tx(SERVER_TEXTS.actionUnknown, { actionId: sanitizeForTerminal(actionId) })
+    });
+  }
+  return action;
+}
+function invokeAction(action, absPath, node, body, cwd) {
+  const invoke = action.invoke;
+  const ctx = {
+    node,
+    nodeAbsolutePath: absPath,
+    invoker: resolveGitAuthorName(cwd) ?? INVOKER_FALLBACK,
+    now: () => /* @__PURE__ */ new Date(),
+    settings: {}
+  };
+  return invoke(body.input ?? {}, ctx);
+}
+async function materializeWrites(writes, body, cwd) {
+  const store = new FilesystemSidecarStore(ensureSidecarWritesAllowed);
+  try {
+    for (const w of writes ?? []) {
+      if (w.kind === "sidecar") {
+        await store.applyPatch(w.path, w.changes, {
+          confirm: body.confirm === true,
+          always: body.always === true,
+          cwd
+        });
+      }
+    }
+  } catch (err) {
+    if (err instanceof EConsentRequiredError) throw err;
+    throw new HTTPException15(500, { message: formatErrorMessage(err) });
+  }
+}
+function buildEnvelope5(actionId, nodePath, report, startedAt) {
+  return {
+    schemaVersion: "1",
+    kind: ENVELOPE_KIND2,
+    value: { actionId, nodePath, report },
+    elapsedMs: Date.now() - startedAt
+  };
+}
+
+// server/routes/scan.ts
+import { HTTPException as HTTPException16 } from "hono/http-exception";
 
 // server/scan-mutex.ts
 var inFlight = null;
@@ -26072,7 +26857,7 @@ function registerScanRoute(app, deps) {
 }
 async function runPersistedScan(c, deps) {
   if (deps.options.noBuiltIns || deps.options.noPlugins) {
-    throw new HTTPException14(400, { message: SERVER_TEXTS.scanPostRequiresFullPipeline });
+    throw new HTTPException16(400, { message: SERVER_TEXTS.scanPostRequiresFullPipeline });
   }
   const dbExists = await tryWithSqlite(
     { databasePath: deps.options.dbPath, autoBackup: false },
@@ -26109,7 +26894,7 @@ async function runPersistedScan(c, deps) {
         ...deps.options.maxNodes !== void 0 ? { maxNodes: deps.options.maxNodes } : {}
       });
       if (outcome.kind !== "ok") {
-        throw new HTTPException14(500, {
+        throw new HTTPException16(500, {
           message: outcome.kind === "guard-trip" ? tx(SERVER_TEXTS.scanGuardTrip, { existing: outcome.existing }) : outcome.message
         });
       }
@@ -26187,7 +26972,7 @@ function groupTagsByPath2(rows) {
 }
 async function runFreshScan(deps) {
   if (deps.options.noBuiltIns || deps.options.noPlugins) {
-    throw new HTTPException14(400, { message: SERVER_TEXTS.freshScanRequiresPipeline });
+    throw new HTTPException16(400, { message: SERVER_TEXTS.freshScanRequiresPipeline });
   }
   const resolveEnabledOverride = await buildBffResolverOverride(deps);
   const outcome = await runScanForCommand({
@@ -26222,7 +27007,7 @@ async function runFreshScan(deps) {
     ...deps.options.maxNodes !== void 0 ? { maxNodes: deps.options.maxNodes } : {}
   });
   if (outcome.kind !== "ok") {
-    throw new HTTPException14(500, {
+    throw new HTTPException16(500, {
       message: outcome.kind === "guard-trip" ? tx(SERVER_TEXTS.freshScanGuardTrip, { existing: outcome.existing }) : outcome.message
     });
   }
@@ -26268,141 +27053,6 @@ function emptyScanResult() {
   };
 }
 
-// server/routes/sidecar.ts
-import { HTTPException as HTTPException15 } from "hono/http-exception";
-import { resolve as resolve36 } from "path";
-var STATUS_FRESH = "fresh";
-var ENVELOPE_KIND2 = "sidecar.bumped";
-var BUMP_BODY_SCHEMA = {
-  type: "object",
-  additionalProperties: false,
-  required: ["nodePath"],
-  properties: {
-    nodePath: { type: "string", minLength: 1 },
-    force: { type: "boolean" },
-    confirm: { type: "boolean" }
-  }
-};
-var parseBody = makeBodyValidator(BUMP_BODY_SCHEMA, {
-  notJson: SERVER_TEXTS.sidecarBodyNotJson,
-  notObject: SERVER_TEXTS.sidecarBodyNotObject,
-  invalid: SERVER_TEXTS.sidecarBodyNotObject,
-  mapping: {
-    "/nodePath:required": SERVER_TEXTS.sidecarNodePathRequired,
-    ":type:object": SERVER_TEXTS.sidecarBodyNotObject,
-    "/nodePath:type:string": SERVER_TEXTS.sidecarNodePathRequired,
-    "/nodePath:minLength": SERVER_TEXTS.sidecarNodePathRequired,
-    "/force:type:boolean": SERVER_TEXTS.sidecarForceMustBeBoolean,
-    "/confirm:type:boolean": SERVER_TEXTS.sidecarConfirmMustBeBoolean
-  }
-});
-function registerSidecarRoutes(app, deps) {
-  app.post("/api/sidecar/bump", async (c) => {
-    const startedAt = Date.now();
-    const body = await parseBody(c.req.raw);
-    const node = await loadNode(deps, body.nodePath);
-    let absPath;
-    try {
-      assertContained(deps.runtimeContext.cwd, node.path);
-      absPath = resolve36(deps.runtimeContext.cwd, node.path);
-    } catch (err) {
-      throw new HTTPException15(400, { message: formatErrorMessage(err) });
-    }
-    const result = invokeBump2(node, absPath, body, deps.runtimeContext.cwd);
-    if (result.report.ok === false && result.report.reason === "fresh") {
-      throw new ConflictError({ code: "sidecar-fresh", message: SERVER_TEXTS.sidecarFreshRefusal });
-    }
-    if (result.report.ok === true && result.report.noop === true) {
-      const envelope2 = {
-        schemaVersion: "1",
-        kind: ENVELOPE_KIND2,
-        value: {
-          nodePath: node.path,
-          version: pickExistingVersion(node),
-          status: STATUS_FRESH
-        },
-        elapsedMs: Date.now() - startedAt
-      };
-      return c.json(envelope2);
-    }
-    const store = new FilesystemSidecarStore(ensureSidecarWritesAllowed);
-    try {
-      for (const w of result.writes ?? []) {
-        if (w.kind === "sidecar") {
-          await store.applyPatch(w.path, w.changes, {
-            confirm: body.confirm === true,
-            cwd: deps.runtimeContext.cwd
-          });
-        }
-      }
-    } catch (err) {
-      if (err instanceof EConsentRequiredError) throw err;
-      throw new HTTPException15(500, { message: formatErrorMessage(err) });
-    }
-    if (body.confirm === true) {
-      deps.configService.reload();
-    }
-    const newVersion = result.report.version ?? null;
-    const eventData = {
-      nodePath: node.path,
-      version: newVersion,
-      status: STATUS_FRESH
-    };
-    const wsEnvelope = {
-      type: ENVELOPE_KIND2,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      data: eventData
-    };
-    deps.broadcaster.broadcast(wsEnvelope);
-    const envelope = {
-      schemaVersion: "1",
-      kind: ENVELOPE_KIND2,
-      value: {
-        nodePath: node.path,
-        version: newVersion,
-        status: STATUS_FRESH
-      },
-      elapsedMs: Date.now() - startedAt
-    };
-    return c.json(envelope);
-  });
-}
-async function loadNode(deps, nodePath) {
-  const persisted = await tryWithSqlite(
-    { databasePath: deps.options.dbPath, autoBackup: false },
-    async (adapter) => adapter.scans.load()
-  );
-  const node = persisted?.nodes.find((n) => n.path === nodePath);
-  if (!node) {
-    throw new HTTPException15(404, {
-      message: tx(SERVER_TEXTS.nodeNotFound, { path: sanitizeForTerminal(nodePath) })
-    });
-  }
-  return node;
-}
-function invokeBump2(node, absPath, body, cwd) {
-  if (!nodeBumpAction.invoke) {
-    throw new HTTPException15(500, { message: SERVER_TEXTS.sidecarBumpInvokeMissing });
-  }
-  const input = {};
-  if (body.force === true) input.force = true;
-  return nodeBumpAction.invoke(input, {
-    node,
-    nodeAbsolutePath: absPath,
-    invoker: resolveGitAuthorName(cwd) ?? "ui",
-    now: () => /* @__PURE__ */ new Date(),
-    settings: {}
-  });
-}
-function pickExistingVersion(node) {
-  const overlay = node.sidecar;
-  if (!overlay || overlay.present !== true) return null;
-  const annotations = overlay.annotations;
-  if (!annotations) return null;
-  const v = annotations["version"];
-  return typeof v === "number" && Number.isFinite(v) ? v : null;
-}
-
 // server/routes/update-status.ts
 function registerUpdateStatusRoute(app, deps) {
   app.get("/api/update-status", async (c) => {
@@ -26569,13 +27219,13 @@ function attachBroadcasterRoute(app, broadcaster) {
 
 // server/app.ts
 var BODY_LIMIT_BYTES = 1024 * 1024;
-var DbMissingError = class extends HTTPException16 {
+var DbMissingError = class extends HTTPException17 {
   constructor(message) {
     super(500, { message });
     this.name = "DbMissingError";
   }
 };
-var BulkValidationError = class extends HTTPException16 {
+var BulkValidationError = class extends HTTPException17 {
   id;
   code;
   constructor(init) {
@@ -26585,7 +27235,7 @@ var BulkValidationError = class extends HTTPException16 {
     this.code = init.code;
   }
 };
-var LoopbackGateError = class extends HTTPException16 {
+var LoopbackGateError = class extends HTTPException17 {
   code;
   constructor(init) {
     super(403, { message: init.message });
@@ -26593,7 +27243,7 @@ var LoopbackGateError = class extends HTTPException16 {
     this.code = init.code;
   }
 };
-var ConflictError = class extends HTTPException16 {
+var ConflictError = class extends HTTPException17 {
   code;
   constructor(init) {
     super(409, { message: init.message });
@@ -26601,6 +27251,21 @@ var ConflictError = class extends HTTPException16 {
     this.code = init.code;
   }
 };
+var ActionRefusedError = class extends HTTPException17 {
+  /** Refusal code: the report's `reason` when present, else `'action-refused'`. */
+  code;
+  details;
+  constructor(init) {
+    super(409, { message: init.message });
+    this.name = "ActionRefusedError";
+    this.code = init.code;
+    this.details = {
+      actionId: init.actionId,
+      nodePath: init.nodePath,
+      report: init.report
+    };
+  }
+};
 function createApp(deps) {
   const app = new Hono();
   const configService = new ConfigService({
@@ -26614,7 +27279,7 @@ function createApp(deps) {
     bodyLimit({
       maxSize: BODY_LIMIT_BYTES,
       onError: () => {
-        throw new HTTPException16(413, { message: tx(SERVER_TEXTS.bodyTooLarge, { maxBytes: String(BODY_LIMIT_BYTES) }) });
+        throw new HTTPException17(413, { message: tx(SERVER_TEXTS.bodyTooLarge, { maxBytes: String(BODY_LIMIT_BYTES) }) });
       }
     })
   );
@@ -26650,7 +27315,7 @@ function createApp(deps) {
   registerGraphRoute(app, routeDeps);
   registerConfigRoute(app, routeDeps);
   registerPluginsRoute(app, routeDeps);
-  registerSidecarRoutes(app, { ...routeDeps, broadcaster: deps.broadcaster });
+  registerActionsRoutes(app, { ...routeDeps, broadcaster: deps.broadcaster, kernel: deps.kernel });
   registerFavoritesRoutes(app, routeDeps);
   registerAnnotationsRoute(app, { kernel: deps.kernel });
   registerContributionsRoutes(app, { ...routeDeps, kernel: deps.kernel });
@@ -26660,7 +27325,7 @@ function createApp(deps) {
   registerActiveProviderRoute(app, routeDeps);
   registerProjectIgnoreRoute(app, routeDeps);
   app.all("/api/*", (c) => {
-    throw new HTTPException16(404, {
+    throw new HTTPException17(404, {
       message: tx(SERVER_TEXTS.unknownApiEndpoint, { path: sanitizeForTerminal(c.req.path) })
     });
   });
@@ -26668,7 +27333,7 @@ function createApp(deps) {
   app.use("*", createStaticHandler({ uiDist: deps.options.uiDist, noUi: deps.options.noUi }));
   app.get("*", createSpaFallback({ uiDist: deps.options.uiDist, noUi: deps.options.noUi }));
   app.notFound((c) => {
-    throw new HTTPException16(404, {
+    throw new HTTPException17(404, {
       message: tx(SERVER_TEXTS.unknownPath, { path: sanitizeForTerminal(c.req.path) })
     });
   });
@@ -26719,18 +27384,9 @@ function formatError2(err, c) {
     };
     return c.json(envelope, 403);
   }
-  if (err instanceof ConflictError) {
-    const envelope = {
-      ok: false,
-      error: {
-        code: err.code,
-        message: err.message,
-        details: null
-      }
-    };
-    return c.json(envelope, 409);
-  }
-  if (err instanceof HTTPException16) {
+  const conflict = formatConflict(err, c);
+  if (conflict) return conflict;
+  if (err instanceof HTTPException17) {
     const status = err.status;
     const envelope = {
       ok: false,
@@ -26766,6 +27422,23 @@ function formatError2(err, c) {
   }
   return formatInternalErrorFallThrough(err, c);
 }
+function formatConflict(err, c) {
+  if (err instanceof ActionRefusedError) {
+    const envelope = {
+      ok: false,
+      error: { code: err.code, message: err.message, details: err.details }
+    };
+    return c.json(envelope, 409);
+  }
+  if (err instanceof ConflictError) {
+    const envelope = {
+      ok: false,
+      error: { code: err.code, message: err.message, details: null }
+    };
+    return c.json(envelope, 409);
+  }
+  return null;
+}
 function formatInternalErrorFallThrough(err, c) {
   const detail = formatErrorMessage(err);
   const stack = err instanceof Error && typeof err.stack === "string" ? err.stack : void 0;
@@ -26991,6 +27664,8 @@ function entryFromRegistered(c) {
   if (c.icon !== void 0) entry.icon = c.icon;
   if (c.emptyText !== void 0) entry.emptyText = c.emptyText;
   if (c.priority !== void 0) entry.priority = c.priority;
+  if (c.pluginOrder !== void 0) entry.pluginOrder = c.pluginOrder;
+  if (c.extensionOrder !== void 0) entry.extensionOrder = c.extensionOrder;
   return entry;
 }
 
@@ -27248,8 +27923,10 @@ async function createServer(options, extra = {}) {
 }
 async function assemblePluginRuntime(options, runtimeContext) {
   const pluginRuntime = options.noPlugins ? emptyPluginRuntime() : await loadPluginRuntime({ runtimeContext });
-  for (const warn of pluginRuntime.warnings) {
-    log.warn(sanitizeForTerminal(warn));
+  if (options.noWatcher) {
+    for (const warn of pluginRuntime.warnings) {
+      log.warn(sanitizeForTerminal(warn));
+    }
   }
   const builtInProviders = options.noBuiltIns ? [] : collectBuiltInProviders();
   const allProviders = [...builtInProviders, ...pluginRuntime.extensions.providers];
@@ -27260,6 +27937,11 @@ async function assemblePluginRuntime(options, runtimeContext) {
 function assembleKernel(pluginRuntime, noBuiltIns) {
   const kernel = createKernel();
   kernel.setRegisteredAnnotationKeys(pluginRuntime.annotationContributions);
+  if (!noBuiltIns) {
+    for (const action of builtIns().actions) {
+      kernel.registry.register(action);
+    }
+  }
   const mergedViewContributions = [...pluginRuntime.viewContributions];
   if (!noBuiltIns) {
     const userKey = new Set(
@@ -28129,13 +28811,13 @@ var ShowCommand = class extends SmCommand {
   }
 };
 function renderHuman2(doc, ansi) {
-  const { node, linksOut, linksIn, issues } = doc;
+  const { node, linksOut: linksOut2, linksIn: linksIn2, issues } = doc;
   const out = [];
   out.push(renderHeader(node, ansi));
   out.push(renderFieldBlock(node, ansi));
   out.push(renderFrontmatter(node, ansi));
-  if (linksOut.length > 0) out.push(renderLinksSection("out", linksOut, ansi));
-  if (linksIn.length > 0) out.push(renderLinksSection("in", linksIn, ansi));
+  if (linksOut2.length > 0) out.push(renderLinksSection("out", linksOut2, ansi));
+  if (linksIn2.length > 0) out.push(renderLinksSection("in", linksIn2, ansi));
   if (issues.length > 0) out.push(renderIssuesSection(issues, node.path, ansi));
   return out.join("");
 }
@@ -28527,7 +29209,9 @@ var SidecarRefreshCommand = class extends SmCommand {
             frontmatterHash: node.frontmatterHash
           }
         },
-        { confirm: this.yes, cwd: ctx.cwd }
+        // Step 17 split: CLI accept / `--yes` persists the grant, so it
+        // threads `always`, not the new one-shot `confirm`.
+        { confirm: this.yes, always: this.yes, cwd: ctx.cwd }
       );
     } catch (err) {
       if (err instanceof EConsentRequiredError) throw err;
@@ -28808,7 +29492,9 @@ var SidecarAnnotateCommand = class extends SmCommand {
       await store.applyPatch(
         sidecarAbsPath,
         scaffoldSidecarObject(node),
-        { confirm: this.yes, cwd: ctx.cwd }
+        // Step 17 split: CLI accept / `--yes` persists the grant, so it
+        // threads `always`, not the new one-shot `confirm`.
+        { confirm: this.yes, always: this.yes, cwd: ctx.cwd }
       );
     } catch (err) {
       if (err instanceof EConsentRequiredError) throw err;
@@ -29069,11 +29755,13 @@ var TUTORIAL_TEXTS = {
   // the error shape: glyph + headline + dim hint.
   notEmpty: "{{glyph}}  sm tutorial: the current directory is not empty (found {{entries}})\n   {{hint}}\n",
   notEmptyHint: "sm tutorial seeds a self-contained scenario; run it in a fresh empty directory, or pass `--force` to use this one anyway.",
-  // Invalid `variant` positional argument. Goes to stderr, exit code 2.
-  // Mirrors the error shape: glyph + headline + dim hint enumerating the
-  // valid values.
-  invalidVariant: "{{glyph}}  sm tutorial: unknown variant '{{variant}}'\n   {{hint}}\n",
-  invalidVariantHint: "Valid values: tutorial (default), master.",
+  // Legacy positional argument (e.g. a stale `sm tutorial master`). The
+  // verb no longer takes a positional: there is a single umbrella skill
+  // and the advanced walkthrough is a menu choice inside it, not a
+  // separate install. Goes to stderr, exit code 2. Mirrors the error
+  // shape: glyph + headline + dim hint.
+  legacyPositional: "{{glyph}}  sm tutorial: unexpected argument '{{arg}}'\n   {{hint}}\n",
+  legacyPositionalHint: "sm tutorial takes no positional argument. The master walkthrough is no longer a separate install; run `sm tutorial` and pick the advanced parts from the in-skill menu.",
   // I/O failure on write or on reading the bundled skill source.
   writeFailed: "{{glyph}}  sm tutorial: failed to write {{target}}: {{message}}\n",
   sourceMissing: "{{glyph}}  sm tutorial: could not read the bundled skill payload for {{target}} from the install.\n   {{hint}}\n",
@@ -29081,47 +29769,36 @@ var TUTORIAL_TEXTS = {
 };
 
 // cli/commands/tutorial.ts
-var VALID_VARIANTS = ["tutorial", "master"];
-var DEFAULT_VARIANT = "tutorial";
-var VARIANT_SPECS = {
-  tutorial: {
-    slug: "sm-tutorial",
-    sourceDir: ".claude/skills/sm-tutorial",
-    triggerEn: "run the tutorial",
-    triggerEs: "ejecuta el tutorial"
-  },
-  master: {
-    slug: "sm-master",
-    sourceDir: ".claude/skills/sm-master",
-    triggerEn: "run the master tutorial",
-    triggerEs: "ejecuta el tutorial maestro"
-  }
-};
+var SKILL_SLUG = "sm-tutorial";
+var SKILL_SOURCE_DIR = ".claude/skills/sm-tutorial";
+var TRIGGER_EN = "run the tutorial";
+var TRIGGER_ES = "ejecuta el tutorial";
 var TutorialCommand = class extends SmCommand {
   static paths = [["tutorial"]];
   static usage = Command37.Usage({
     category: "Setup",
     description: "Materialize an interactive tester tutorial as a Claude Code skill folder under `<cwd>/.claude/skills/`.",
     details: `
-      Drops the canonical skill directory (SKILL.md + any references/
-      sub-folder) under \`<cwd>/.claude/skills/sm-tutorial/\` (default)
-      or \`<cwd>/.claude/skills/sm-master/\` (when invoked as \`sm
-      tutorial master\`). Claude Code auto-discovers the skill the
-      next time it boots in this directory; the tester invokes it by
-      speaking one of its trigger phrases.
+      Drops the canonical skill directory (SKILL.md + its references/
+      sub-folder) under \`<cwd>/.claude/skills/sm-tutorial/\`. Claude
+      Code auto-discovers the skill the next time it boots in this
+      directory; the tester invokes it by speaking one of its trigger
+      phrases and picks the advanced parts from the in-skill menu.
 
       Does NOT require an initialized .skill-map/ project. Refuses to
-      overwrite the target directory unless --force is passed. Valid
-      values for the positional argument are: tutorial (default),
-      master.
+      overwrite the target directory unless --force is passed. Takes no
+      positional argument.
     `,
     examples: [
-      ["Materialize the basic tutorial skill in the cwd", "$0 tutorial"],
-      ["Materialize the advanced tutorial skill in the cwd", "$0 tutorial master"],
+      ["Materialize the tutorial skill in the cwd", "$0 tutorial"],
       ["Overwrite an existing target directory", "$0 tutorial --force"]
     ]
   });
-  variant = Option35.String({ required: false });
+  // Legacy positional catcher: the verb takes no positional argument any
+  // more. Accept one so a stale `sm tutorial master` lands on a friendly
+  // usage error (guarded in `run()`) instead of clipanion's generic
+  // "extraneous argument" message.
+  legacyPositional = Option35.String({ required: false });
   // Named `forProvider`, NOT `for` (reserved word). The CLI surface stays
   // `--for`; selects the destination Provider whose `scaffold.skillDir`
   // the skill is materialised under, skipping the interactive prompt.
@@ -29137,9 +29814,16 @@ var TutorialCommand = class extends SmCommand {
     const stderr = this.context.stderr;
     const stderrAnsi = this.ansiFor("stderr");
     const errGlyph = stderrAnsi.red("\u2715");
-    const variant = this.resolveVariantArg(errGlyph, stderrAnsi);
-    if (variant === null) return ExitCode.Error;
-    const spec = VARIANT_SPECS[variant];
+    if (this.legacyPositional !== void 0) {
+      this.printer.error(
+        tx(TUTORIAL_TEXTS.legacyPositional, {
+          glyph: errGlyph,
+          arg: this.legacyPositional,
+          hint: stderrAnsi.dim(TUTORIAL_TEXTS.legacyPositionalHint)
+        })
+      );
+      return ExitCode.Error;
+    }
     if (!this.force && !isDirEmpty(ctx.cwd)) {
       this.printer.error(
         tx(TUTORIAL_TEXTS.notEmpty, {
@@ -29153,11 +29837,11 @@ var TutorialCommand = class extends SmCommand {
     const targets = listScaffoldTargets();
     const target = await this.resolveScaffoldTarget(targets, stderrAnsi, errGlyph);
     if (target === null) return ExitCode.Error;
-    const targetDir = join21(ctx.cwd, target.skillDir, spec.slug);
-    const targetDisplay = `${target.skillDir}/${spec.slug}/`;
+    const targetDir = join21(ctx.cwd, target.skillDir, SKILL_SLUG);
+    const targetDisplay = `${target.skillDir}/${SKILL_SLUG}/`;
     let sourceDir;
     try {
-      sourceDir = resolveSkillSourceDir(variant);
+      sourceDir = resolveSkillSourceDir();
     } catch {
       this.printer.error(
         tx(TUTORIAL_TEXTS.sourceMissing, {
@@ -29192,38 +29876,18 @@ var TutorialCommand = class extends SmCommand {
     this.printer.data(
       tx(TUTORIAL_TEXTS.written, {
         glyph: ansi.green("\u2713"),
-        slug: spec.slug,
+        slug: SKILL_SLUG,
         target: targetDisplay,
         provider: ansi.dim(target.label),
         cwd: ansi.dim(displayCwd(ctx.cwd)),
         enLabel: ansi.dim(TUTORIAL_TEXTS.writtenLabelEn),
         esLabel: ansi.dim(TUTORIAL_TEXTS.writtenLabelEs),
-        enTrigger: spec.triggerEn,
-        esTrigger: spec.triggerEs
+        enTrigger: TRIGGER_EN,
+        esTrigger: TRIGGER_ES
       })
     );
     return ExitCode.Ok;
   }
-  /**
-   * Validate the positional `variant` arg against the closed catalog.
-   * Returns the resolved variant, or `null` after printing the
-   * `invalidVariant` error (caller exits non-zero). Extracted from
-   * `run()` to keep its cyclomatic complexity within the lint budget.
-   */
-  resolveVariantArg(errGlyph, stderrAnsi) {
-    const rawVariant = this.variant;
-    if (rawVariant !== void 0 && !isTutorialVariant(rawVariant)) {
-      this.printer.error(
-        tx(TUTORIAL_TEXTS.invalidVariant, {
-          glyph: errGlyph,
-          variant: rawVariant,
-          hint: stderrAnsi.dim(TUTORIAL_TEXTS.invalidVariantHint)
-        })
-      );
-      return null;
-    }
-    return rawVariant ?? DEFAULT_VARIANT;
-  }
   /**
    * Resolve the destination Provider. Precedence:
    *   1. `--for <id>` (validated against the scaffold-capable catalog).
@@ -29283,9 +29947,6 @@ var TutorialCommand = class extends SmCommand {
     return picked;
   }
 };
-function isTutorialVariant(value) {
-  return VALID_VARIANTS.includes(value);
-}
 function toScaffoldTarget(provider) {
   const scaffold = provider.scaffold;
   if (!scaffold || !scaffold.skillDir) return null;
@@ -29352,23 +30013,21 @@ function listCwdEntries(dir) {
   const more = entries.length > shown.length ? ", ..." : "";
   return shown.join(", ") + more;
 }
-var cachedSourceDirs = /* @__PURE__ */ new Map();
-function resolveSkillSourceDir(variant) {
-  const cached = cachedSourceDirs.get(variant);
-  if (cached !== void 0) return cached;
-  const spec = VARIANT_SPECS[variant];
+var cachedSourceDir;
+function resolveSkillSourceDir() {
+  if (cachedSourceDir !== void 0) return cachedSourceDir;
   const here = dirname20(fileURLToPath7(import.meta.url));
   const candidates = [
-    // dev: src/cli/commands/ → repo-root .claude/skills/<slug>/
-    resolve39(here, "../../..", spec.sourceDir),
-    // bundled: dist/cli.js → dist/cli/tutorial/<slug> (sibling)
-    resolve39(here, "cli/tutorial", spec.slug),
-    // bundled fallback: any-depth → cli/tutorial/<slug>
-    resolve39(here, "../cli/tutorial", spec.slug)
+    // dev: src/cli/commands/ → repo-root .claude/skills/sm-tutorial/
+    resolve39(here, "../../..", SKILL_SOURCE_DIR),
+    // bundled: dist/cli.js → dist/cli/tutorial/sm-tutorial (sibling)
+    resolve39(here, "cli/tutorial", SKILL_SLUG),
+    // bundled fallback: any-depth → cli/tutorial/sm-tutorial
+    resolve39(here, "../cli/tutorial", SKILL_SLUG)
   ];
   for (const candidate of candidates) {
     if (existsSync32(candidate) && statSync11(candidate).isDirectory()) {
-      cachedSourceDirs.set(variant, candidate);
+      cachedSourceDir = candidate;
       return candidate;
     }
   }
@@ -29592,4 +30251,4 @@ function resolveBareDefault() {
   process.exit(ExitCode.Error);
 }
 //# sourceMappingURL=cli.js.map
-//# debugId=91ef81c7-e785-5818-839a-1f18ea093b57
+//# debugId=dd2e1877-e17a-5d0b-86e5-6416814d7a78