emdash 0.37.0 → 0.39.0

package/src/emdash-runtime.ts

@@ -7,16 +7,30 @@
  * Created once per worker lifetime, cached and reused across requests.
  */
 
+import { getLocaleDir, resolveLocale } from "@emdash-cms/admin/locales";
 import { Permissions } from "@emdash-cms/auth";
 import type { Element } from "@emdash-cms/blocks";
+import {
+	normalizePluginPagePath,
+	validateBlockResponse,
+	validateContentEditorActionResponse,
+	type BlockValidationPolicy,
+	type PluginUiContext,
+} from "@emdash-cms/blocks/server";
+import { isJsonPostRouteContract } from "@emdash-cms/plugin-types";
 import { Kysely, type Dialect } from "kysely";
 import virtualConfig from "virtual:emdash/config";
 import { z } from "zod";
 
 import { ErrorCode } from "./api/errors.js";
 import { buildManifestCollections } from "./api/handlers/manifest.js";
+import {
+	handleMediaUpload as uploadMedia,
+	type MediaUploadInput,
+} from "./api/handlers/media-upload.js";
 import { assertMediaUsageActivationWriteAllowed } from "./api/media-usage-write-fence.js";
 import { validateRev } from "./api/rev.js";
+import { getSiteBaseUrl } from "./api/site-url.js";
 import type {
 	EmDashConfig,
 	PluginAdminPage,
@@ -25,7 +39,9 @@ import type {
 import type { EmDashManifest } from "./astro/types.js";
 import { getAuthMode } from "./auth/mode.js";
 import { getTrustedProxyHeaders } from "./auth/trusted-proxy.js";
+import { lookupContentAuthor, sendCommentNotification } from "./comments/notifications.js";
 import type { ContentFieldFilters } from "./content-list-query.js";
+import { keepKnownFields, staleStoredKeys } from "./content/known-fields.js";
 import { isSqlite } from "./database/dialect-helpers.js";
 import { kyselyLogOption } from "./database/instrumentation.js";
 import {
@@ -38,6 +54,8 @@ import {
 	MIGRATION_RACE_WAIT_MS,
 } from "./database/migrations/runner.js";
 import { AuditRepository } from "./database/repositories/audit.js";
+import { CommentRepository } from "./database/repositories/comment.js";
+import type { CommentStatus } from "./database/repositories/comment.js";
 import { ContentRepository } from "./database/repositories/content.js";
 import { RevisionRepository } from "./database/repositories/revision.js";
 import { ContentMutationConflictError } from "./database/repositories/types.js";
@@ -46,7 +64,7 @@ import type {
 	ContentDateField,
 } from "./database/repositories/types.js";
 import type { ImageValue } from "./fields/types.js";
-import { getI18nConfig } from "./i18n/config.js";
+import { getI18nConfig, resolveContentCreateLocale } from "./i18n/config.js";
 import { repairLocaleCasing } from "./i18n/repair-locale-casing.js";
 import { warnAboutUnconfiguredTaxonomyLocales } from "./i18n/taxonomy-locale-diagnostic.js";
 import { normalizeMediaValue } from "./media/normalize.js";
@@ -59,7 +77,17 @@ import {
 	refreshContentMediaUsageAfterWrite,
 } from "./media/usage/content-refresh.js";
 import { processMediaUsageWorkAfterWrite } from "./media/usage/work-processor.js";
-import { inspectSandboxHookResult } from "./plugins/sandbox/hook-result.js";
+import {
+	scheduledPolicyRejectionKey,
+	type ScheduledPolicyRejection,
+} from "./plugins/content-policy.js";
+import { createCommentAccess, createTaxonomyAccessWithWrite } from "./plugins/context.js";
+import type { ContentActionCallbacks } from "./plugins/context.js";
+import type { PluginContentCacheInvalidator } from "./plugins/routes.js";
+import {
+	createSandboxedPluginProxy,
+	getSandboxSaveRejectionDetails,
+} from "./plugins/sandbox/proxy.js";
 import { createSandboxRunnerOptions } from "./plugins/sandbox/runner-options.js";
 import { getSandboxRouteErrorDetails } from "./plugins/sandbox/types.js";
 import type {
@@ -68,13 +96,18 @@ import type {
 	SandboxRunnerFactory,
 } from "./plugins/sandbox/types.js";
 import type {
-	ContentHookEvent,
+	ActorInfo,
+	ContentActionOrigin,
+	ContentItem as PluginContentItem,
 	ResolvedPlugin,
 	MediaItem,
+	MediaMetadataPatch,
 	PluginManifest,
 	PluginCapability,
 	PluginStorageConfig,
 	PluginMcpManifestConfig,
+	PluginEditorAction,
+	PluginEditorPanel,
 	PublicPageContext,
 	PageMetadataContribution,
 	PageFragmentContribution,
@@ -82,8 +115,18 @@ import type {
 	FieldWidgetConfig,
 	SettingField,
 	UserInfo,
+	CollectionCommentSettings,
+	ModerationDecision,
+	PluginComment,
+	PluginCommentStatus,
+	ContentWriteInput,
+	PluginContentCreateCallback,
+	VersionedContentItem,
 } from "./plugins/types.js";
+import { normalizePluginCapabilities } from "./plugins/types.js";
 import { recordSchedulerHeartbeatSafely } from "./scheduler-health.js";
+import { primeRegisteredCollections } from "./schema/collection-slugs-cache.js";
+import type { CollectionWithFields } from "./schema/types.js";
 import { isMissingTableError } from "./utils/db-errors.js";
 import { hashString } from "./utils/hash.js";
 import { createInitLock, type InitLock, initWithLock } from "./utils/init-lock.js";
@@ -93,6 +136,19 @@ import { COMMIT, VERSION } from "./version.js";
 const LEADING_SLASH_PATTERN = /^\//;
 const LOCALE_CASING_REPAIR_OPTION = "emdash:repair_locale_casing";
 
+const PLUGIN_COMMENT_STATUSES = new Set<string>(["approved", "pending", "spam"]);
+
+function assertPluginCommentStatus(
+	value: string,
+	name: "status" | "expectedStatus",
+): asserts value is PluginCommentStatus {
+	if (!PLUGIN_COMMENT_STATUSES.has(value)) {
+		throw Object.assign(new Error(`${name} must be one of: approved, pending, spam`), {
+			code: "COMMENT_STATUS_INVALID",
+		});
+	}
+}
+
 function getLocaleCasingRepairVersion(locales: readonly string[]): string | null {
 	if (locales.length === 0) return null;
 	return `1:${locales.toSorted().join(",")}`;
@@ -112,50 +168,20 @@ function parseStringArray(raw: string | null | undefined): string[] {
 	return parsed.filter((v): v is string => typeof v === "string");
 }
 
+function isModerationDecision(value: unknown): value is ModerationDecision {
+	if (typeof value !== "object" || value === null || !("status" in value)) return false;
+	if (value.status !== "pending" && value.status !== "approved" && value.status !== "spam") {
+		return false;
+	}
+	return !("reason" in value) || value.reason === undefined || typeof value.reason === "string";
+}
+
 /** Combined result from a single-pass page contribution collection */
 interface PageContributions {
 	metadata: PageMetadataContribution[];
 	fragments: PageFragmentContribution[];
 }
 
-const VALID_METADATA_KINDS = new Set(["meta", "property", "link", "jsonld"]);
-
-/** Security-critical allowlist for link rel values from sandboxed plugins */
-const VALID_LINK_REL = new Set([
-	"canonical",
-	"alternate",
-	"author",
-	"license",
-	"nlweb",
-	"site.standard.document",
-]);
-
-/**
- * Runtime validation for sandboxed plugin metadata contributions.
- * Sandboxed plugins return `unknown` across the RPC boundary — we must
- * verify the shape before passing to the metadata collector.
- */
-function isValidMetadataContribution(c: unknown): c is PageMetadataContribution {
-	if (!c || typeof c !== "object" || !("kind" in c)) return false;
-	const obj = c as Record<string, unknown>;
-	if (typeof obj.kind !== "string" || !VALID_METADATA_KINDS.has(obj.kind)) return false;
-
-	switch (obj.kind) {
-		case "meta":
-			return typeof obj.name === "string" && typeof obj.content === "string";
-		case "property":
-			return typeof obj.property === "string" && typeof obj.content === "string";
-		case "link":
-			return (
-				typeof obj.href === "string" && typeof obj.rel === "string" && VALID_LINK_REL.has(obj.rel)
-			);
-		case "jsonld":
-			return obj.graph != null && typeof obj.graph === "object";
-		default:
-			return false;
-	}
-}
-
 import { after } from "./after.js";
 import { maybeRunScheduledBackup } from "./api/handlers/backup.js";
 import { loadBundleFromR2 } from "./api/handlers/marketplace.js";
@@ -164,6 +190,15 @@ import {
 	DEFAULT_COMMENT_MODERATOR_PLUGIN_ID,
 	defaultCommentModerate,
 } from "./comments/moderator.js";
+import { submitPublicComment } from "./comments/public-submission.js";
+import {
+	CommentStatusConflictError,
+	createComment,
+	moderateComment,
+	type CommentCreateInput,
+	type CommentCreateResult,
+	type CommentHookRunner,
+} from "./comments/service.js";
 import { validateEncryptionKeyAtStartup } from "./config/secrets.js";
 import { OptionsRepository } from "./database/repositories/options.js";
 import {
@@ -183,6 +218,7 @@ import {
 	handleContentUnpublish,
 	handleContentSchedule,
 	handleContentUnschedule,
+	handleScheduledPolicyRejection,
 	handleContentCountScheduled,
 	handleContentDiscardDraft,
 	handleContentCompare,
@@ -208,11 +244,15 @@ import { DEV_CONSOLE_EMAIL_PLUGIN_ID, devConsoleEmailDeliver } from "./plugins/e
 import { EmailPipeline } from "./plugins/email.js";
 import {
 	createHookPipeline,
+	getActiveContentSaveHookName,
 	resolveExclusiveHooks as resolveExclusiveHooksShared,
 	type HookPipeline,
 } from "./plugins/hooks.js";
-import { normalizeManifestRoute } from "./plugins/manifest-schema.js";
+import { disableRuntimePlugin, enableRuntimePlugin } from "./plugins/lifecycle.js";
+import { HOOK_NAMES, normalizeManifestRoute } from "./plugins/manifest-schema.js";
+import { updatePluginMediaMetadata } from "./plugins/media.js";
 import { extractRequestMeta, sanitizeHeadersForSandbox } from "./plugins/request-meta.js";
+import { PluginRouteRequestError } from "./plugins/route-wire.js";
 import {
 	buildRouteMeta,
 	parseRouteInput,
@@ -225,15 +265,41 @@ import { isContentSaveRejection } from "./plugins/save-rejection.js";
 import type { CronScheduler } from "./plugins/scheduler/types.js";
 import { PluginStateRepository } from "./plugins/state.js";
 import { syncDeclaredStorageIndexes } from "./plugins/storage-indexes.js";
-import { normalizeRegistryConfig } from "./registry/config.js";
+import {
+	getRegistryConfigInput,
+	resolveManifestRegistryConfig,
+	resolveRegistryConfigForSandbox,
+} from "./registry/config.js";
 import { requestCached } from "./request-cache.js";
 import { getRequestContext } from "./request-context.js";
 import { publishDueContent, type PublishedRef } from "./scheduled-publish.js";
 import { FTSManager } from "./search/fts-manager.js";
 import { invalidateSiteSettingsCache } from "./settings/index.js";
 
-const DRAFT_ONLY_UPDATE_KEYS = new Set(["data", "slug", "locale", "skipRevision"]);
+const DRAFT_ONLY_UPDATE_KEYS = new Set(["data", "slug", "locale", "skipRevision", "actor"]);
 const MAX_DRAFT_STAGE_ATTEMPTS = 32;
+const PLUGIN_INVOCATION_RELEASE_GRACE_MS = 60_000;
+
+type ContentPolicyHookName =
+	| "content:beforePublish"
+	| "content:beforeSchedule"
+	| "content:beforeUnpublish";
+
+interface ContentPolicyMutationOptions {
+	_rev?: string;
+	actor?: ActorInfo;
+	origin?: ContentActionOrigin;
+	pluginInvocationId?: string;
+}
+
+type ContentPolicyCheck =
+	| { allowed: true; revision: string }
+	| {
+			allowed: false;
+			revision: string;
+			error: { code: string; message: string };
+			cancellation?: { pluginId: string; reason: string };
+	  };
 
 /**
  * Sandboxed plugin entry from virtual module
@@ -259,6 +325,10 @@ export interface SandboxedPluginEntry {
 	adminPages?: Array<{ path: string; label?: string; icon?: string }>;
 	/** Dashboard widgets */
 	adminWidgets?: Array<{ id: string; title?: string; size?: string }>;
+	/** Saved-entry Block Kit panels. */
+	editorPanels?: PluginManifest["admin"]["editorPanels"];
+	/** Saved-entry host-rendered actions. */
+	editorActions?: PluginManifest["admin"]["editorActions"];
 	/** Settings schema for the auto-generated admin settings form */
 	settingsSchema?: Record<string, SettingField>;
 	/** Portable Text block types contributed to the editor (declarative Block Kit) */
@@ -274,6 +344,26 @@ export interface SandboxedPluginEntry {
 	preferred?: string[];
 }
 
+export type ResolvedPluginEditorExtension =
+	| {
+			kind: "panel";
+			extension: PluginEditorPanel;
+			policy: BlockValidationPolicy;
+			capabilities: readonly PluginCapability[];
+	  }
+	| {
+			kind: "action";
+			extension: PluginEditorAction;
+			policy: BlockValidationPolicy;
+			capabilities: readonly PluginCapability[];
+	  };
+
+export interface PluginEditorExtensionDispatch {
+	ui: PluginUiContext;
+	kind: "panel" | "action";
+	policy: BlockValidationPolicy;
+}
+
 /**
  * Media provider entry from virtual module
  */
@@ -350,6 +440,15 @@ export interface RuntimeDependencies {
 	sandboxedPluginEntries: SandboxedPluginEntry[];
 	/** Factory function supplied by the active platform adapter. */
 	createSandboxRunner: SandboxRunnerFactory | null;
+	/** Clock used by cron scheduling, task execution, and scheduled publishing. */
+	now?: () => Date;
+	/** Site values supplied by hosts that do not load Astro's virtual config. */
+	siteInfo?: {
+		name?: string;
+		url?: string;
+		locale?: string;
+		trailingSlash?: "always" | "never" | "ignore";
+	};
 }
 
 /**
@@ -385,7 +484,16 @@ export interface EmDashRuntimeParts {
 		db: Kysely<Database>;
 		getDb?: () => Kysely<Database>;
 		beforeContentWrite?: () => Promise<void>;
+		contentCreate?: PluginContentCreateCallback;
+		contentActions?: ContentActionCallbacks;
+		now?: () => Date;
 		storage?: Storage;
+		commentModerate?: (
+			pluginId: string,
+			id: string,
+			status: PluginCommentStatus,
+			expectedStatus: PluginCommentStatus,
+		) => Promise<PluginComment>;
 		siteInfo?: {
 			siteName?: string;
 			siteUrl?: string;
@@ -404,6 +512,17 @@ export interface EmDashRuntimeParts {
  */
 function beforeSaveFailure(error: unknown) {
 	if (isContentSaveRejection(error)) {
+		const sandbox = getSandboxSaveRejectionDetails(error);
+		if (sandbox) {
+			return {
+				success: false as const,
+				error: {
+					code: ErrorCode.SAVE_REJECTED,
+					message: error.message,
+					details: sandbox,
+				},
+			};
+		}
 		return {
 			success: false as const,
 			error: { code: ErrorCode.SAVE_REJECTED, message: error.message },
@@ -427,6 +546,27 @@ function contentItemToRecord(item: ContentItemInternal): Record<string, unknown>
 	return { ...item };
 }
 
+function toPluginContentItem(item: ContentItemInternal): PluginContentItem {
+	return {
+		id: item.id,
+		type: item.type,
+		slug: item.slug,
+		status: item.status,
+		locale: item.locale,
+		data: item.data,
+		createdAt: item.createdAt,
+		updatedAt: item.updatedAt,
+		publishedAt: item.publishedAt,
+		scheduledAt: item.scheduledAt,
+		authorId: item.authorId,
+		translationGroup: item.translationGroup,
+		liveRevisionId: item.liveRevisionId,
+		draftRevisionId: item.draftRevisionId,
+		version: item.version,
+		...(item.seo === undefined ? {} : { seo: item.seo }),
+	};
+}
+
 /**
  * Db init lock reclaim deadline. Derived from the migration race wait so
  * they can't drift apart: a healthy init can legitimately block for the
@@ -507,6 +647,7 @@ function getSeedHolder(): SeedHolder {
 }
 const storageCache = new Map<string, Storage>();
 const sandboxedPluginCache = new Map<string, SandboxedPluginInstance>();
+const sandboxedManifestCache = new Map<string, PluginManifest>();
 /**
  * Per-tier sets of `${pluginId}:${version}` keys present in
  * `sandboxedPluginCache`. Used during sync to know which entries belong
@@ -529,15 +670,35 @@ const marketplaceManifestCache = new Map<
 			pages?: PluginAdminPage[];
 			widgets?: PluginDashboardWidget[];
 			settingsSchema?: Record<string, SettingField>;
+			editorPanels?: PluginManifest["admin"]["editorPanels"];
+			editorActions?: PluginManifest["admin"]["editorActions"];
 		};
 		mcp?: PluginMcpManifestConfig;
 		storage?: PluginManifest["storage"];
+		allowedHosts?: string[];
+		capabilities?: PluginCapability[];
 	}
 >();
 /** Route metadata for sandboxed plugins: pluginId -> routeName -> RouteMeta */
 const sandboxedRouteMetaCache = new Map<string, Map<string, RouteMeta>>();
 let sandboxRunner: SandboxRunner | null = null;
 
+function allowedBrowserImageHosts(
+	capabilities: readonly PluginCapability[],
+	allowedHosts: readonly string[],
+): readonly string[] {
+	if (
+		capabilities.includes("network:request:unrestricted") ||
+		capabilities.includes("network:fetch:any")
+	) {
+		return ["*"];
+	}
+	if (capabilities.includes("network:request") || capabilities.includes("network:fetch")) {
+		return allowedHosts;
+	}
+	return [];
+}
+
 /**
  * EmDashRuntime - singleton per worker
  */
@@ -576,6 +737,16 @@ export class EmDashRuntime {
 	private cronScheduler: CronScheduler | null;
 	private enabledPlugins: Set<string>;
 	private pluginStates: Map<string, string>;
+	private readonly activePluginContentActions = new Map<string, number>();
+	private readonly pendingPluginAfterHooks = new Map<string, Array<() => Promise<void>>>();
+	private readonly activePluginInvocations = new Set<string>();
+	/** Timed-out sandbox invocations whose later actions must schedule hooks without another flush. */
+	private readonly releasedPluginInvocations = new Set<string>();
+	private readonly pluginInvocationCacheInvalidators = new Map<
+		string,
+		PluginContentCacheInvalidator
+	>();
+	private pluginContentCacheInvalidator?: PluginContentCacheInvalidator;
 
 	/**
 	 * Isolate-lifetime guard so FTS indexes are verified at most once per
@@ -600,7 +771,16 @@ export class EmDashRuntime {
 		db: Kysely<Database>;
 		getDb?: () => Kysely<Database>;
 		beforeContentWrite?: () => Promise<void>;
+		contentCreate?: PluginContentCreateCallback;
+		contentActions?: ContentActionCallbacks;
+		now?: () => Date;
 		storage?: Storage;
+		commentModerate?: (
+			pluginId: string,
+			id: string,
+			status: PluginCommentStatus,
+			expectedStatus: PluginCommentStatus,
+		) => Promise<PluginComment>;
 		siteInfo?: {
 			siteName?: string;
 			siteUrl?: string;
@@ -612,6 +792,7 @@ export class EmDashRuntime {
 	private runtimeDeps: RuntimeDependencies;
 	/** Mutable ref for the cron invokeCronHook closure to read the current pipeline */
 	private pipelineRef!: { current: HookPipeline };
+	private readonly commentModerationInProgress = new Set<string>();
 
 	/**
 	 * Get the database instance for the current request.
@@ -629,6 +810,13 @@ export class EmDashRuntime {
 		return this._db;
 	}
 
+	/** Bind the platform cache provider used by plugin actions, including request-less cron hooks. */
+	setPluginContentCacheInvalidator(
+		invalidateContentCache: PluginContentCacheInvalidator | undefined,
+	): void {
+		this.pluginContentCacheInvalidator = invalidateContentCache;
+	}
+
 	constructor(parts: EmDashRuntimeParts) {
 		this._db = parts.db;
 		this.storage = parts.storage;
@@ -679,9 +867,15 @@ export class EmDashRuntime {
 		onPublished?: (refs: PublishedRef[]) => Promise<void>,
 	): Promise<PublishedRef[]> {
 		await assertMediaUsageActivationWriteAllowed(this.db);
+		const currentTime = this.runtimeDeps.now?.() ?? new Date();
 		return publishDueContent(this.db, {
-			publish: (collection, id, options) => this.handleContentPublish(collection, id, options),
+			publish: (collection, id, options) =>
+				this.handleContentPublish(collection, id, {
+					...options,
+					origin: { source: "scheduler" },
+				}),
 			onPublished,
+			currentTime,
 		});
 	}
 
@@ -702,11 +896,26 @@ export class EmDashRuntime {
 	async runScheduledTasks(
 		options: {
 			onPublished?: (refs: PublishedRef[]) => Promise<void>;
+			invalidateContentCache?: PluginContentCacheInvalidator;
 		} = {},
 	): Promise<{ published: PublishedRef[] }> {
+		const { published } = await this.runScheduledTasksWithStats(options);
+		return { published };
+	}
+
+	async runScheduledTasksWithStats(
+		options: {
+			onPublished?: (refs: PublishedRef[]) => Promise<void>;
+			invalidateContentCache?: PluginContentCacheInvalidator;
+		} = {},
+	): Promise<{ processed: number; published: PublishedRef[] }> {
+		if (options.invalidateContentCache) {
+			this.pluginContentCacheInvalidator = options.invalidateContentCache;
+		}
+		let processed = 0;
 		if (this.cronExecutor) {
 			try {
-				await this.cronExecutor.tick();
+				processed = await this.cronExecutor.tick();
 			} catch (error) {
 				console.error("[cron] Tick failed:", error);
 			}
@@ -740,7 +949,7 @@ export class EmDashRuntime {
 		await maybeRunScheduledBackup(this.db, this.storage ?? undefined);
 		await recordSchedulerHeartbeatSafely(this.db);
 
-		return { published };
+		return { processed, published };
 	}
 
 	/**
@@ -771,6 +980,20 @@ export class EmDashRuntime {
 		}
 	}
 
+	/** Stop background work and discard loaded sandbox isolates. */
+	async shutdown(): Promise<void> {
+		await this.stopCron();
+		sandboxRunner?.setCommentModerate?.(null);
+		await sandboxRunner?.terminateAll();
+		sandboxRunner = null;
+		sandboxedPluginCache.clear();
+		sandboxedManifestCache.clear();
+		sandboxedRouteMetaCache.clear();
+		marketplaceManifestCache.clear();
+		marketplacePluginKeys.clear();
+		registryPluginKeys.clear();
+	}
+
 	/**
 	 * Update in-memory plugin status and rebuild the hook pipeline.
 	 *
@@ -792,6 +1015,43 @@ export class EmDashRuntime {
 		}
 	}
 
+	async handlePluginEnable(pluginId: string) {
+		return enableRuntimePlugin(this, pluginId);
+	}
+
+	async handlePluginDisable(pluginId: string) {
+		return disableRuntimePlugin(this, pluginId);
+	}
+
+	/** Dispatch teardown lifecycle while the runtime-installed isolate is still loaded. */
+	async runPluginUninstallLifecycle(pluginId: string, deleteData: boolean): Promise<void> {
+		const active = this.isPluginEnabled(pluginId);
+		if (active) {
+			try {
+				await this._hooks.runPluginDeactivate(pluginId);
+			} catch (error) {
+				console.error(`EmDash: Plugin ${pluginId} deactivate hook failed during uninstall:`, error);
+			}
+		}
+
+		try {
+			const results = await this._hooks.runPluginUninstall(pluginId, deleteData);
+			if (results.length > 0) return;
+			await this.findSandboxedPlugin(pluginId)?.invokeHook("plugin:uninstall", { deleteData });
+		} catch (error) {
+			console.error(`EmDash: Plugin ${pluginId} uninstall hook failed:`, error);
+		}
+	}
+
+	async runPluginInstallLifecycle(pluginId: string): Promise<void> {
+		await this._hooks.runPluginInstall(pluginId);
+		await this._hooks.runPluginActivate(pluginId);
+	}
+
+	async runPluginActivateLifecycle(pluginId: string): Promise<void> {
+		await this._hooks.runPluginActivate(pluginId);
+	}
+
 	/**
 	 * Rebuild the hook pipeline from the current set of enabled plugins.
 	 *
@@ -864,7 +1124,7 @@ export class EmDashRuntime {
 	 * update, and uninstall handlers complete.
 	 */
 	async syncRegistryPlugins(): Promise<void> {
-		if (!this.config.experimental?.registry) return;
+		if (!getRegistryConfigInput(this.config.registry, this.config.experimental?.registry)) return;
 		await this.syncSandboxedSourcePlugins("registry");
 	}
 
@@ -882,6 +1142,7 @@ export class EmDashRuntime {
 		if (!sandboxRunner || !sandboxRunner.isAvailable()) return;
 
 		const keySet = source === "marketplace" ? marketplacePluginKeys : registryPluginKeys;
+		let pipelineChanged = false;
 
 		try {
 			const stateRepo = new PluginStateRepository(this.db);
@@ -935,8 +1196,11 @@ export class EmDashRuntime {
 				}
 
 				sandboxedPluginCache.delete(key);
+				sandboxedManifestCache.delete(key);
 				this.sandboxedPlugins.delete(key);
+				this.removePluginFromLists(pluginId);
 				keySet.delete(key);
+				pipelineChanged = true;
 				if (pluginId) {
 					sandboxedRouteMetaCache.delete(pluginId);
 					marketplaceManifestCache.delete(pluginId);
@@ -959,8 +1223,11 @@ export class EmDashRuntime {
 
 				const loaded = await sandboxRunner.load(bundle.manifest, bundle.backendCode);
 				sandboxedPluginCache.set(key, loaded);
+				sandboxedManifestCache.set(key, bundle.manifest);
 				this.sandboxedPlugins.set(key, loaded);
+				this.allPipelinePlugins.push(createSandboxedPluginProxy(bundle.manifest, loaded));
 				keySet.add(key);
+				pipelineChanged = true;
 
 				// Cache manifest admin config for getManifest()
 				marketplaceManifestCache.set(pluginId, {
@@ -969,6 +1236,8 @@ export class EmDashRuntime {
 					admin: bundle.manifest.admin,
 					mcp: bundle.manifest.mcp,
 					storage: bundle.manifest.storage,
+					allowedHosts: bundle.manifest.allowedHosts,
+					capabilities: bundle.manifest.capabilities,
 				});
 
 				// Cache route metadata from manifest for auth decisions
@@ -983,6 +1252,10 @@ export class EmDashRuntime {
 					sandboxedRouteMetaCache.delete(pluginId);
 				}
 			}
+
+			if (pipelineChanged) {
+				await this.rebuildHookPipeline();
+			}
 		} catch (error) {
 			console.error(`EmDash: Failed to sync ${source} plugins:`, error);
 		}
@@ -1085,6 +1358,8 @@ export class EmDashRuntime {
 					admin: bundle.manifest.admin,
 					mcp: bundle.manifest.mcp,
 					storage: bundle.manifest.storage,
+					allowedHosts: bundle.manifest.allowedHosts,
+					capabilities: bundle.manifest.capabilities,
 				});
 				if (bundle.manifest.routes.length > 0) {
 					const routeMetaMap = new Map<string, RouteMeta>();
@@ -1135,6 +1410,8 @@ export class EmDashRuntime {
 								w.size === "full" || w.size === "half" || w.size === "third" ? w.size : undefined,
 						})),
 						settingsSchema: bundle.manifest.admin?.settingsSchema,
+						editorPanels: bundle.manifest.admin?.editorPanels,
+						editorActions: bundle.manifest.admin?.editorActions,
 					});
 					newPlugins.push(adapted);
 					this.allPipelinePlugins.push(adapted);
@@ -1201,10 +1478,9 @@ export class EmDashRuntime {
 		};
 
 		// Validate EMDASH_ENCRYPTION_KEY once here so a malformed value
-		// surfaces in startup logs instead of as request-time 500s. The key
-		// itself is not yet consumed (a follow-up PR adds plugin-secret
-		// encryption); validating early just guards against silent
-		// misconfiguration.
+		// surfaces in startup logs. Plugin secret-setting operations re-read
+		// the key and fail closed at their own boundary, so validation here
+		// does not block unrelated request paths.
 		await phase("rt.secrets", "Validate encryption key", () => validateEncryptionKeyAtStartup());
 
 		// FTS verify/repair is deferred off the cold-start hot path.
@@ -1283,13 +1559,13 @@ export class EmDashRuntime {
 			]);
 			storedLocaleCasingRepairVersion = siteOpts.get(LOCALE_CASING_REPAIR_OPTION);
 			return {
-				siteName: siteOpts.get("emdash:site_title") ?? undefined,
-				siteUrl: siteOpts.get("emdash:site_url") ?? undefined,
-				locale: siteOpts.get("emdash:locale") ?? undefined,
+				siteName: deps.siteInfo?.name ?? siteOpts.get("emdash:site_title") ?? undefined,
+				siteUrl: deps.siteInfo?.url ?? siteOpts.get("emdash:site_url") ?? undefined,
+				locale: deps.siteInfo?.locale ?? siteOpts.get("emdash:locale") ?? undefined,
 				// trailingSlash is a build-time Astro routing decision, not a
 				// user-editable setting, so it comes from the Astro config
 				// (virtual:emdash/config), not the options table.
-				trailingSlash: virtualConfig?.trailingSlash,
+				trailingSlash: deps.siteInfo?.trailingSlash ?? virtualConfig?.trailingSlash,
 			};
 		};
 
@@ -1320,17 +1596,18 @@ export class EmDashRuntime {
 			coldStartReads.push(
 				phase("rt.seedcheck", "Auto-seed gate", async () => {
 					try {
-						const [collectionCount, setupOption] = await Promise.all([
-							readDb
-								.selectFrom("_emdash_collections")
-								.select((eb) => eb.fn.countAll<number>().as("count"))
-								.executeTakeFirstOrThrow(),
+						// Selecting the slugs instead of COUNT(*) costs the same
+						// round trip and primes the registered-collections cache,
+						// so the first render on this isolate skips its own lookup.
+						const [collectionRows, setupOption] = await Promise.all([
+							readDb.selectFrom("_emdash_collections").select("slug").execute(),
 							readDb
 								.selectFrom("options")
 								.select("value")
 								.where("name", "=", "emdash:setup_complete")
 								.executeTakeFirst(),
 						]);
+						primeRegisteredCollections(collectionRows.map((row) => row.slug));
 						const setupDone = (() => {
 							try {
 								return !!setupOption && JSON.parse(setupOption.value) === true;
@@ -1338,7 +1615,7 @@ export class EmDashRuntime {
 								return false;
 							}
 						})();
-						seedGate = { collectionCount: collectionCount.count, setupDone };
+						seedGate = { collectionCount: collectionRows.length, setupDone };
 					} catch (error) {
 						captureMissingManualSchema(error);
 						// Leave the "already set up" default so a read failure never
@@ -1532,26 +1809,8 @@ export class EmDashRuntime {
 			}
 		}
 
-		// Filter to currently enabled plugins for the initial pipeline
-		const enabledPluginList = allPipelinePlugins.filter((p) => enabledPlugins.has(p.id));
-
-		// Create hook pipeline. getDb travels here (not just via the email
-		// setContextFactory call below) so it survives rebuildHookPipeline(),
-		// which reconstructs the factory from pipelineFactoryOptions. Without it,
-		// toggling a plugin on an email-less deployment would silently revert
-		// plugin contexts to the singleton db — re-breaking connection-backed
-		// adapters. See #1622.
-		const pipelineFactoryOptions = {
-			db,
-			getDb: resolveDb,
-			beforeContentWrite: () => assertMediaUsageActivationWriteAllowed(resolveDb()),
-			storage: storage ?? undefined,
-			siteInfo,
-		};
-		const pipeline = createHookPipeline(enabledPluginList, pipelineFactoryOptions);
-
 		// Load sandboxed plugins (build-time, sandbox runner path)
-		const sandboxedPlugins = await phase("rt.sandbox", "Sandboxed plugins", () =>
+		const sandboxedPluginPool = await phase("rt.sandbox", "Sandboxed plugins", () =>
 			EmDashRuntime.loadSandboxedPlugins(deps, db, storage, siteInfo),
 		);
 
@@ -1569,7 +1828,7 @@ export class EmDashRuntime {
 						db,
 						storage,
 						deps,
-						sandboxedPlugins,
+						sandboxedPluginPool,
 						siteInfo,
 					),
 				),
@@ -1577,7 +1836,10 @@ export class EmDashRuntime {
 		}
 
 		// Cold-start: load registry-installed plugins from site R2
-		if (deps.config.experimental?.registry && storage) {
+		if (
+			getRegistryConfigInput(deps.config.registry, deps.config.experimental?.registry) &&
+			storage
+		) {
 			installedTierPhases.push(
 				phase("rt.registry", "Registry plugins", () =>
 					EmDashRuntime.loadInstalledSandboxedPlugins(
@@ -1585,7 +1847,7 @@ export class EmDashRuntime {
 						db,
 						storage,
 						deps,
-						sandboxedPlugins,
+						sandboxedPluginPool,
 						siteInfo,
 					),
 				),
@@ -1595,6 +1857,113 @@ export class EmDashRuntime {
 			await Promise.all(installedTierPhases);
 		}
 
+		const configuredSandboxIds = new Set(deps.sandboxedPluginEntries.map((entry) => entry.id));
+		const sandboxedPlugins = new Map(
+			[...sandboxedPluginPool].filter(([pluginKey]) => {
+				const pluginId = pluginKey.slice(0, pluginKey.lastIndexOf(":"));
+				return configuredSandboxIds.has(pluginId) || pluginStates.get(pluginId) === "active";
+			}),
+		);
+
+		// Add isolate-backed proxies to the same host pipeline as trusted
+		// plugins. The proxy carries only manifest metadata and RPC handlers;
+		// plugin code remains inside the configured runner.
+		for (const [pluginKey, instance] of sandboxedPlugins) {
+			const manifest = sandboxedManifestCache.get(pluginKey);
+			if (!manifest) continue;
+			allPipelinePlugins.push(createSandboxedPluginProxy(manifest, instance));
+			const status = pluginStates.get(manifest.id);
+			if (status === undefined || status === "active") enabledPlugins.add(manifest.id);
+		}
+
+		// Create hook pipeline. getDb travels here (not just via the email
+		// setContextFactory call below) so it survives rebuildHookPipeline(),
+		// which reconstructs the factory from pipelineFactoryOptions. Without it,
+		// toggling a plugin on an email-less deployment would silently revert
+		// plugin contexts to the singleton db — re-breaking connection-backed
+		// adapters. See #1622.
+		const runtimeRef: { current: EmDashRuntime | null } = { current: null };
+		const requireRuntime = (): EmDashRuntime => {
+			if (!runtimeRef.current) throw new Error("EmDash runtime is not ready");
+			return runtimeRef.current;
+		};
+		const contentActions: ContentActionCallbacks = {
+			begin: (pluginId, invocationId, invalidateContentCache) =>
+				requireRuntime().beginPluginInvocation(pluginId, invocationId, invalidateContentCache),
+			flush: (pluginId, invocationId, final) =>
+				requireRuntime().flushPluginAfterHooks(pluginId, invocationId, final),
+			getVersioned: (pluginId, collection, id) =>
+				requireRuntime().pluginGetVersioned(pluginId, collection, id),
+			publish: (pluginId, collection, id, options, invocationId, invalidateContentCache) =>
+				requireRuntime().pluginPublish(
+					pluginId,
+					collection,
+					id,
+					options,
+					invocationId,
+					invalidateContentCache,
+				),
+			unpublish: (pluginId, collection, id, options, invocationId, invalidateContentCache) =>
+				requireRuntime().pluginUnpublish(
+					pluginId,
+					collection,
+					id,
+					options,
+					invocationId,
+					invalidateContentCache,
+				),
+			schedule: (pluginId, collection, id, options, invocationId, invalidateContentCache) =>
+				requireRuntime().pluginSchedule(
+					pluginId,
+					collection,
+					id,
+					options,
+					invocationId,
+					invalidateContentCache,
+				),
+			unschedule: (pluginId, collection, id, options, invocationId, invalidateContentCache) =>
+				requireRuntime().pluginUnschedule(
+					pluginId,
+					collection,
+					id,
+					options,
+					invocationId,
+					invalidateContentCache,
+				),
+			getTrashedVersioned: (pluginId, collection, id) =>
+				requireRuntime().pluginGetTrashedVersioned(pluginId, collection, id),
+			restore: (pluginId, collection, id, options, invocationId, invalidateContentCache) =>
+				requireRuntime().pluginRestore(
+					pluginId,
+					collection,
+					id,
+					options,
+					invocationId,
+					invalidateContentCache,
+				),
+		};
+		const pipelineFactoryOptions = {
+			db,
+			getDb: resolveDb,
+			beforeContentWrite: () => assertMediaUsageActivationWriteAllowed(resolveDb()),
+			contentActions,
+			now: deps.now,
+			storage: storage ?? undefined,
+			siteInfo,
+			commentModerate: (
+				pluginId: string,
+				id: string,
+				status: PluginCommentStatus,
+				expectedStatus: PluginCommentStatus,
+			) => {
+				const current = runtimeRef.current;
+				if (!current) throw new Error("Comment moderation is unavailable during runtime startup");
+				return current.handlePluginCommentModerate(pluginId, id, status, expectedStatus);
+			},
+		};
+		const enabledPluginList = allPipelinePlugins.filter((p) => enabledPlugins.has(p.id));
+		const pipeline = createHookPipeline(enabledPluginList, pipelineFactoryOptions);
+
 		// Initialize media providers
 		const mediaProviders = new Map<string, MediaProvider>();
 		const mediaProviderEntries = deps.mediaProviderEntries ?? [];
@@ -1650,11 +2019,9 @@ export class EmDashRuntime {
 		// so the timer scheduler's cleanup can route scheduled publishing through
 		// the runtime wrapper (firing content:afterPublish hooks). The first tick
 		// is ≥1s out, well after the synchronous assignment below.
-		const runtimeRef: { current: EmDashRuntime | null } = { current: null };
-
 		await phase("rt.cron", "Cron init (recovery deferred post-response)", async () => {
 			try {
-				cronExecutor = new CronExecutor(resolveDb, invokeCronHook);
+				cronExecutor = new CronExecutor(resolveDb, invokeCronHook, deps.now);
 				// Plugin schedules are always database-backed. On long-lived runtimes this
 				// callback also wakes the timer; on Cloudflare the external Cron Trigger
 				// drives execution, so rescheduling is intentionally a no-op.
@@ -1733,6 +2100,7 @@ export class EmDashRuntime {
 				// Non-fatal — CMS works without cron
 			}
 		});
+		sandboxRunner?.setCronReschedule?.(() => cronScheduler?.reschedule());
 
 		const runtime = new EmDashRuntime({
 			db,
@@ -1757,9 +2125,46 @@ export class EmDashRuntime {
 			runtimeDeps: deps,
 			pipelineRef,
 		});
+		const contentCreate: PluginContentCreateCallback = async (
+			_pluginId,
+			collection,
+			input,
+			options,
+		) => {
+			const { seo, ...data } = input;
+			const result = await runtime.handleContentCreate(
+				collection,
+				{
+					data,
+					seo,
+					locale: resolveContentCreateLocale(options?.locale),
+					translationOf: options?.translationOf,
+				},
+				{
+					skipSaveHooks: options?.sandboxOrigin
+						? options.originHook !== undefined
+						: getActiveContentSaveHookName() != null,
+					excludeAfterSavePluginId: _pluginId,
+				},
+			);
+			if (!result.success) {
+				throw Object.assign(new Error(result.error.message), {
+					name: result.error.code,
+					code: result.error.code,
+				});
+			}
+			return result.data.item;
+		};
+		runtime.pipelineFactoryOptions.contentCreate = contentCreate;
+		pipeline.setContextFactory({ contentCreate });
+		sandboxRunner?.setContentCreate?.(contentCreate);
 		// Hand the constructed instance to the scheduler-cleanup closure so the
 		// timer-driven sweep can fire publish hooks (see runtimeRef above).
 		runtimeRef.current = runtime;
+		sandboxRunner?.setCommentModerate?.((pluginId, id, status, expectedStatus) =>
+			runtime.handlePluginCommentModerate(pluginId, id, status, expectedStatus),
+		);
+		sandboxRunner?.setContentActions?.(contentActions);
 		return runtime;
 	}
 
@@ -1987,6 +2392,8 @@ export class EmDashRuntime {
 					settingsSchema: entry.settingsSchema,
 					portableTextBlocks: entry.portableTextBlocks,
 					fieldWidgets: entry.fieldWidgets,
+					editorPanels: entry.editorPanels,
+					editorActions: entry.editorActions,
 				});
 				plugins.push(resolved);
 				console.log(
@@ -2013,11 +2420,6 @@ export class EmDashRuntime {
 			trailingSlash?: "always" | "never" | "ignore";
 		},
 	): Promise<Map<string, SandboxedPluginInstance>> {
-		// Return cached plugins if already loaded
-		if (sandboxedPluginCache.size > 0) {
-			return sandboxedPluginCache;
-		}
-
 		// Check if sandboxing is enabled
 		if (!deps.sandboxEnabled) {
 			return sandboxedPluginCache;
@@ -2030,6 +2432,8 @@ export class EmDashRuntime {
 					{
 						db,
 						beforeContentWrite: () => assertMediaUsageActivationWriteAllowed(db),
+						taxonomyWrite: createTaxonomyAccessWithWrite(db),
+						now: deps.now,
 						mediaStorage: mediaStorage
 							? {
 									upload: (opts) =>
@@ -2038,6 +2442,7 @@ export class EmDashRuntime {
 											body: opts.body,
 											contentType: opts.contentType,
 										}),
+									download: (key) => mediaStorage.download(key),
 									delete: (key) => mediaStorage.delete(key),
 								}
 							: undefined,
@@ -2055,10 +2460,14 @@ export class EmDashRuntime {
 		// Warn regardless of whether there are plugins to load, so operators
 		// see the issue even if no marketplace plugins are installed yet.
 		if (!sandboxRunner.isAvailable()) {
+			const reason = sandboxRunner.unavailableReason?.();
 			console.warn(
-				"EmDash: Plugin sandbox is configured but not available on this platform. " +
-					"Sandboxed plugins will not be loaded. " +
-					"If using @emdash-cms/sandbox-workerd/sandbox, ensure workerd is installed.",
+				reason
+					? `EmDash: Plugin sandbox is configured but not available on this platform: ${reason}. ` +
+							"Sandboxed plugins will not be loaded."
+					: "EmDash: Plugin sandbox is configured but not available on this platform. " +
+							"Sandboxed plugins will not be loaded. " +
+							"If using @emdash-cms/sandbox-workerd/sandbox, ensure workerd is installed.",
 			);
 			return sandboxedPluginCache;
 		}
@@ -2082,21 +2491,49 @@ export class EmDashRuntime {
 			}
 
 			try {
+				const adminPages = entry.adminPages?.map((page) => ({
+					path: page.path,
+					label: page.label ?? page.path,
+					icon: page.icon,
+				}));
+				const adminWidgets: PluginDashboardWidget[] | undefined = entry.adminWidgets?.map(
+					(widget) => ({
+						id: widget.id,
+						title: widget.title,
+						size:
+							widget.size === "full" || widget.size === "half" || widget.size === "third"
+								? widget.size
+								: undefined,
+					}),
+				);
+				const capabilities = normalizePluginCapabilities(entry.capabilities ?? []);
+
 				// Build manifest from entry's declared config
 				const manifest: PluginManifest = {
 					id: entry.id,
 					version: entry.version,
-					capabilities: entry.capabilities ?? [],
+					capabilities,
 					allowedHosts: entry.allowedHosts ?? [],
 					storage: entry.storage ?? {},
-					hooks: entry.hooks ?? [],
+					// Descriptors built before hook metadata was emitted must keep
+					// working. Invoking an absent hook is a no-op in both runners.
+					hooks: entry.hooks ?? [...HOOK_NAMES],
 					routes: entry.routes ?? [],
-					admin: {},
+					admin: {
+						pages: adminPages,
+						widgets: adminWidgets,
+						settingsSchema: entry.settingsSchema,
+						portableTextBlocks: entry.portableTextBlocks,
+						fieldWidgets: entry.fieldWidgets,
+						editorPanels: entry.editorPanels,
+						editorActions: entry.editorActions,
+					},
 					mcp: entry.mcp,
 				};
 
 				const plugin = await sandboxRunner.load(manifest, entry.code);
 				sandboxedPluginCache.set(pluginKey, plugin);
+				sandboxedManifestCache.set(pluginKey, manifest);
 				console.log(
 					`EmDash: Loaded sandboxed plugin ${pluginKey} with capabilities: [${manifest.capabilities.join(", ")}]`,
 				);
@@ -2154,6 +2591,8 @@ export class EmDashRuntime {
 					{
 						db,
 						beforeContentWrite: () => assertMediaUsageActivationWriteAllowed(db),
+						taxonomyWrite: createTaxonomyAccessWithWrite(db),
+						now: deps.now,
 						mediaStorage: {
 							upload: (opts) =>
 								storage.upload({
@@ -2161,6 +2600,7 @@ export class EmDashRuntime {
 									body: opts.body,
 									contentType: opts.contentType,
 								}),
+							download: (key) => storage.download(key),
 							delete: (key) => storage.delete(key),
 						},
 					},
@@ -2206,6 +2646,7 @@ export class EmDashRuntime {
 
 					const loaded = await sandboxRunner.load(bundle.manifest, bundle.backendCode);
 					cache.set(pluginKey, loaded);
+					sandboxedManifestCache.set(pluginKey, bundle.manifest);
 					keySet.add(pluginKey);
 
 					// Cache manifest admin config for getManifest()
@@ -2215,6 +2656,8 @@ export class EmDashRuntime {
 						admin: bundle.manifest.admin,
 						mcp: bundle.manifest.mcp,
 						storage: bundle.manifest.storage,
+						allowedHosts: bundle.manifest.allowedHosts,
+						capabilities: bundle.manifest.capabilities,
 					});
 
 					// Cache route metadata from manifest for auth decisions
@@ -2288,6 +2731,8 @@ export class EmDashRuntime {
 						admin: bundle.manifest.admin,
 						mcp: bundle.manifest.mcp,
 						storage: bundle.manifest.storage,
+						allowedHosts: bundle.manifest.allowedHosts,
+						capabilities: bundle.manifest.capabilities,
 					});
 					if (bundle.manifest.routes.length > 0) {
 						const routeMeta = new Map<string, RouteMeta>();
@@ -2324,6 +2769,8 @@ export class EmDashRuntime {
 								w.size === "full" || w.size === "half" || w.size === "third" ? w.size : undefined,
 						})),
 						settingsSchema: bundle.manifest.admin?.settingsSchema,
+						editorPanels: bundle.manifest.admin?.editorPanels,
+						editorActions: bundle.manifest.admin?.editorActions,
 					});
 					resolved.push(adapted);
 					console.log(
@@ -2457,6 +2904,8 @@ export class EmDashRuntime {
 					fieldTypes: string[];
 					elements?: Element[];
 				}>;
+				editorPanels?: PluginManifest["admin"]["editorPanels"];
+				editorActions?: PluginManifest["admin"]["editorActions"];
 			}
 		> = {};
 
@@ -2468,10 +2917,13 @@ export class EmDashRuntime {
 			const hasAdminEntry = !!plugin.admin?.entry;
 			const hasAdminPages = (plugin.admin?.pages?.length ?? 0) > 0;
 			const hasWidgets = (plugin.admin?.widgets?.length ?? 0) > 0;
+			const hasEditorExtensions =
+				(plugin.admin?.editorPanels?.length ?? 0) > 0 ||
+				(plugin.admin?.editorActions?.length ?? 0) > 0;
 			let adminMode: "react" | "blocks" | "none" = "none";
 			if (hasAdminEntry) {
 				adminMode = "react";
-			} else if (hasAdminPages || hasWidgets) {
+			} else if (hasAdminPages || hasWidgets || hasEditorExtensions) {
 				adminMode = "blocks";
 			}
 
@@ -2483,6 +2935,8 @@ export class EmDashRuntime {
 				dashboardWidgets: plugin.admin?.widgets ?? [],
 				portableTextBlocks: plugin.admin?.portableTextBlocks,
 				fieldWidgets: plugin.admin?.fieldWidgets,
+				editorPanels: plugin.admin?.editorPanels,
+				editorActions: plugin.admin?.editorActions,
 			};
 		}
 
@@ -2493,6 +2947,8 @@ export class EmDashRuntime {
 
 			const hasAdminPages = (entry.adminPages?.length ?? 0) > 0;
 			const hasWidgets = (entry.adminWidgets?.length ?? 0) > 0;
+			const hasEditorExtensions =
+				(entry.editorPanels?.length ?? 0) > 0 || (entry.editorActions?.length ?? 0) > 0;
 
 			manifestPlugins[entry.id] = {
 				version: entry.version,
@@ -2502,11 +2958,13 @@ export class EmDashRuntime {
 				// contribute portableTextBlocks/fieldWidgets with adminMode "none" —
 				// the admin reads those from the manifest regardless, so don't gate
 				// admin contributions on `adminMode`.
-				adminMode: hasAdminPages || hasWidgets ? "blocks" : "none",
+				adminMode: hasAdminPages || hasWidgets || hasEditorExtensions ? "blocks" : "none",
 				adminPages: entry.adminPages ?? [],
 				dashboardWidgets: entry.adminWidgets ?? [],
 				portableTextBlocks: entry.portableTextBlocks,
 				fieldWidgets: entry.fieldWidgets,
+				editorPanels: entry.editorPanels,
+				editorActions: entry.editorActions,
 			};
 		}
 
@@ -2522,14 +2980,18 @@ export class EmDashRuntime {
 			const widgets = meta.admin?.widgets;
 			const hasAdminPages = (pages?.length ?? 0) > 0;
 			const hasWidgets = (widgets?.length ?? 0) > 0;
+			const hasEditorExtensions =
+				(meta.admin?.editorPanels?.length ?? 0) > 0 || (meta.admin?.editorActions?.length ?? 0) > 0;
 
 			manifestPlugins[pluginId] = {
 				version: meta.version,
 				enabled,
 				sandboxed: true,
-				adminMode: hasAdminPages || hasWidgets ? "blocks" : "none",
+				adminMode: hasAdminPages || hasWidgets || hasEditorExtensions ? "blocks" : "none",
 				adminPages: pages ?? [],
 				dashboardWidgets: widgets ?? [],
+				editorPanels: meta.admin?.editorPanels,
+				editorActions: meta.admin?.editorActions,
 			};
 		}
 
@@ -2599,11 +3061,19 @@ export class EmDashRuntime {
 					}
 				: undefined;
 
-		// Normalize the experimental registry config for browser consumption.
-		// Validation errors here surface as 500s from the manifest endpoint
-		// rather than being silently dropped -- a misconfigured registry
-		// should be loud, not invisible.
-		const registry = normalizeRegistryConfig(this.config.experimental?.registry) ?? undefined;
+		const registryConfig = resolveRegistryConfigForSandbox({
+			registry: this.config.registry,
+			experimentalRegistry: this.config.experimental?.registry,
+		});
+		const { registry, error: registryConfigurationError } = resolveManifestRegistryConfig(
+			registryConfig.input,
+			{ fieldPrefix: registryConfig.fieldPrefix },
+		);
+		if (registryConfigurationError) {
+			console.error(
+				`EmDash registry configuration error in ${registryConfigurationError.field} (${registryConfigurationError.code})`,
+			);
+		}
 
 		return {
 			version: VERSION,
@@ -2621,6 +3091,7 @@ export class EmDashRuntime {
 			},
 			marketplace: !!this.config.marketplace,
 			registry,
+			registryConfigurationError,
 		};
 	}
 
@@ -2729,7 +3200,10 @@ export class EmDashRuntime {
 	 *
 	 * No-op when no draft exists or the response is an error.
 	 */
-	private async hydrateDraftData<T>(result: T): Promise<T> {
+	private async hydrateDraftData<T>(
+		result: T,
+		options: { includeStagedSlug?: boolean; strict?: boolean } = {},
+	): Promise<T> {
 		if (!result || typeof result !== "object") return result;
 		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- shape probed below
 		const r = result as {
@@ -2742,7 +3216,10 @@ export class EmDashRuntime {
 		if (!draftRevisionId) return result;
 		try {
 			const revision = await new RevisionRepository(this.db).findById(draftRevisionId);
-			if (!revision) return result;
+			if (!revision) {
+				if (options.strict) throw new Error(`Draft revision not found: ${draftRevisionId}`);
+				return result;
+			}
 			const liveData =
 				item.data && typeof item.data === "object"
 					? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed to object above
@@ -2769,10 +3246,18 @@ export class EmDashRuntime {
 				// eslint-disable-next-line typescript/no-unsafe-type-assertion -- shape preserved; result has been narrowed to the {success,data:{item}} envelope
 				data: {
 					...r.data,
-					item: { ...item, data: mergedData, liveData },
+					item: {
+						...item,
+						...(options.includeStagedSlug && typeof revision.data._slug === "string"
+							? { slug: revision.data._slug }
+							: {}),
+						data: mergedData,
+						liveData,
+					},
 				},
 			};
 		} catch (error) {
+			if (options.strict) throw error;
 			// Non-fatal — fall back to the unhydrated response. Log so the
 			// failure isn't completely silent (the response will look stale
 			// to the caller but no error is raised).
@@ -2785,6 +3270,7 @@ export class EmDashRuntime {
 		collection: string,
 		body: {
 			data: Record<string, unknown>;
+			seo?: ContentWriteInput["seo"];
 			slug?: string | null;
 			status?: string;
 			authorId?: string;
@@ -2792,23 +3278,87 @@ export class EmDashRuntime {
 			locale?: string;
 			translationOf?: string;
 			taxonomies?: Record<string, string[]>;
+			actor?: ActorInfo;
 		},
+		options: { skipSaveHooks?: boolean; excludeAfterSavePluginId?: string } = {},
 	) {
+		const actor = body.actor ? { ...body.actor } : undefined;
+		let locale: string;
+		try {
+			locale = resolveContentCreateLocale(body.locale);
+		} catch (error) {
+			return {
+				success: false as const,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: error instanceof Error ? error.message : "Invalid locale",
+				},
+			};
+		}
+
+		let translationSource: ContentItemInternal | null = null;
+		let sharedFieldSlugs: string[] = [];
+		if (body.translationOf) {
+			const repo = new ContentRepository(this.db);
+			const source = await repo.findById(collection, body.translationOf);
+			if (!source) {
+				return {
+					success: false as const,
+					error: { code: "NOT_FOUND", message: "Translation source content not found" },
+				};
+			}
+			translationSource = source;
+			sharedFieldSlugs = (
+				await this.db
+					.selectFrom("_emdash_fields as field")
+					.innerJoin("_emdash_collections as collection", "collection.id", "field.collection_id")
+					.select("field.slug")
+					.where("collection.slug", "=", collection)
+					.where("field.translatable", "=", 0)
+					.execute()
+			).map((field) => field.slug);
+			const siblings = await repo.findTranslations(
+				collection,
+				source.translationGroup ?? source.id,
+			);
+			if (siblings.some((sibling) => sibling.locale?.toLowerCase() === locale.toLowerCase())) {
+				return {
+					success: false as const,
+					error: {
+						code: "CONFLICT",
+						message: `Translation already exists in locale "${locale}" for this content item`,
+					},
+				};
+			}
+		}
+
 		// Run beforeSave hooks (trusted plugins)
 		let processedData = body.data;
-		if (this.hooks.hasHooks("content:beforeSave")) {
+		if (!options.skipSaveHooks && this.hooks.hasHooks("content:beforeSave")) {
 			try {
-				const hookResult = await this.hooks.runContentBeforeSave(body.data, collection, true);
+				const hookResult = await this.hooks.runContentBeforeSave(
+					body.data,
+					collection,
+					true,
+					undefined,
+					actor,
+				);
 				processedData = hookResult.content;
 			} catch (error) {
 				return beforeSaveFailure(error);
 			}
 		}
 
-		// Run beforeSave hooks (sandboxed plugins)
-		const sandboxResult = await this.runSandboxedBeforeSave(processedData, collection, true);
-		if (!sandboxResult.success) return sandboxResult;
-		processedData = sandboxResult.data;
+		if (translationSource) {
+			processedData = { ...processedData };
+			for (const slug of sharedFieldSlugs) {
+				if (Object.hasOwn(translationSource.data, slug)) {
+					processedData[slug] = translationSource.data[slug];
+				} else {
+					delete processedData[slug];
+				}
+			}
+		}
 
 		// Normalize media fields (fill dimensions, storageKey, etc.)
 		processedData = await this.normalizeMediaFields(collection, processedData);
@@ -2831,6 +3381,7 @@ export class EmDashRuntime {
 		const result = await handleContentCreate(this.db, collection, {
 			...body,
 			data: processedData,
+			locale,
 			authorId: body.authorId,
 			bylines: body.bylines,
 		});
@@ -2839,8 +3390,14 @@ export class EmDashRuntime {
 		}
 
 		// Run afterSave hooks (fire-and-forget)
-		if (result.success && result.data) {
-			this.runAfterSaveHooks(contentItemToRecord(result.data.item), collection, true);
+		if (!options.skipSaveHooks && result.success && result.data) {
+			this.runAfterSaveHooks(
+				contentItemToRecord(result.data.item),
+				collection,
+				true,
+				actor,
+				options.excludeAfterSavePluginId,
+			);
 		}
 
 		return result;
@@ -2868,8 +3425,15 @@ export class EmDashRuntime {
 			/** Replace the previous autosave revision after staging this save. */
 			skipRevision?: boolean;
 			_rev?: string;
+			/**
+			 * Acting user for this save. Used for revision attribution and
+			 * passed to content hooks; never changes entry ownership.
+			 */
+			actor?: ActorInfo;
 		},
 	) {
+		const actor = body.actor ? { ...body.actor } : undefined;
+
 		// Resolve slug → ID if needed (before any lookups)
 		const repo = new ContentRepository(this.db);
 		const resolvedItem = await repo.findByIdOrSlug(collection, id, body.locale);
@@ -2893,7 +3457,14 @@ export class EmDashRuntime {
 				};
 			}
 		}
-		const { _rev: _discardedRev, ...bodyWithoutRev } = body;
+		const { _rev: _discardedRev, actor: _discardedActor, ...bodyWithoutRev } = body;
+
+		// Loaded once and threaded through normalization, the stale-key drop and the draft
+		// merge below: each of those needs the field list and the registry does not cache.
+		const collectionInfo = bodyWithoutRev.data
+			? await this.schemaRegistry.getCollectionWithFields(collection).catch(() => null)
+			: null;
+		const knownFieldSlugs = new Set((collectionInfo?.fields ?? []).map((f) => f.slug));
 
 		// Run beforeSave hooks if data is provided
 		let processedData = bodyWithoutRev.data;
@@ -2905,6 +3476,7 @@ export class EmDashRuntime {
 						collection,
 						false,
 						resolvedItem?.id,
+						actor,
 					);
 					processedData = hookResult.content;
 				} catch (error) {
@@ -2912,18 +3484,19 @@ export class EmDashRuntime {
 				}
 			}
 
-			// Run sandboxed beforeSave hooks
-			const sandboxResult = await this.runSandboxedBeforeSave(
-				processedData!,
-				collection,
-				false,
-				resolvedItem?.id,
-			);
-			if (!sandboxResult.success) return sandboxResult;
-			processedData = sandboxResult.data;
-
 			// Normalize media fields (fill dimensions, storageKey, etc.)
-			processedData = await this.normalizeMediaFields(collection, processedData);
+			processedData = await this.normalizeMediaFields(collection, processedData!, collectionInfo);
+
+			// Drop unknown field keys the entry already stores (e.g. a deleted field
+			// stranded in a draft revision) before validation, while still rejecting
+			// unknown keys the entry has never stored.
+			if (collectionInfo?.fields) {
+				processedData = await this.dropUnknownKeysAlreadyStored(
+					processedData,
+					resolvedItem,
+					knownFieldSlugs,
+				);
+			}
 
 			// Validate field-level shape BEFORE the draft-revision write so
 			// invalid updates can't silently land in revision history.
@@ -2945,7 +3518,6 @@ export class EmDashRuntime {
 		let usesDraftRevisions = false;
 		let draftStorageChanged = false;
 		if (processedData) {
-			const collectionInfo = await this.schemaRegistry.getCollectionWithFields(collection);
 			if (collectionInfo?.supports?.includes("revisions")) {
 				usesDraftRevisions = true;
 				const revisionRepo = new RevisionRepository(this.db);
@@ -2960,7 +3532,12 @@ export class EmDashRuntime {
 						baseData = existing.data;
 					}
 
-					const mergedData = { ...baseData, ...processedData };
+					// Written without the keys the collection has no field for, so an entry
+					// carrying a deleted field's value sheds it on its next save instead of
+					// carrying it through every revision that follows.
+					const mergedData = collectionInfo?.fields
+						? keepKnownFields({ ...baseData, ...processedData }, knownFieldSlugs)
+						: { ...baseData, ...processedData };
 					if (bodyWithoutRev.slug !== undefined) {
 						mergedData._slug = bodyWithoutRev.slug;
 					}
@@ -2969,7 +3546,7 @@ export class EmDashRuntime {
 						collection,
 						entryId: resolvedId,
 						data: mergedData,
-						authorId: bodyWithoutRev.authorId ?? undefined,
+						authorId: actor?.id,
 					});
 
 					let staged: boolean;
@@ -3070,31 +3647,14 @@ export class EmDashRuntime {
 		if (hydrated.success && hydrated.data) {
 			const contentIdsToRefresh = [resolvedId];
 			if (!usesDraftRevisions && processedData) {
-				try {
-					contentIdsToRefresh.push(
-						...(await findNonTranslatableSiblingContentIds(
-							this.db,
-							collection,
-							resolvedId,
-							hydrated.data.item.translationGroup,
-							processedData,
-						)),
-					);
-				} catch (error) {
-					console.error(
-						`[media-usage] Failed to discover synced i18n siblings for ${collection}/${resolvedId}:`,
-						error,
-					);
-					try {
-						await markContentMediaUsageCollectionStale(
-							this.db,
-							collection,
-							"CONTENT_USAGE_REFRESH_ERROR",
-						);
-					} catch (staleError) {
-						console.error(`[media-usage] Failed to mark ${collection} stale:`, staleError);
-					}
-				}
+				contentIdsToRefresh.push(
+					...(await this.findSyncedSiblingsForUsageRefresh(
+						collection,
+						resolvedId,
+						hydrated.data.item.translationGroup,
+						processedData,
+					)),
+				);
 			}
 			await this.refreshContentUsageAfterSuccessfulWrite(collection, contentIdsToRefresh);
 		} else if (draftStorageChanged) {
@@ -3107,7 +3667,7 @@ export class EmDashRuntime {
 
 		// Run afterSave hooks (fire-and-forget)
 		if (hydrated.success && hydrated.data) {
-			this.runAfterSaveHooks(contentItemToRecord(hydrated.data.item), collection, false);
+			this.runAfterSaveHooks(contentItemToRecord(hydrated.data.item), collection, false, actor);
 		}
 
 		if (hydrated.success) {
@@ -3131,21 +3691,12 @@ export class EmDashRuntime {
 			}
 		}
 
-		// Run sandboxed beforeDelete hooks
-		const sandboxAllowed = await this.runSandboxedBeforeDelete(id, collection);
-		if (!sandboxAllowed) {
-			return {
-				success: false,
-				error: {
-					code: "DELETE_BLOCKED",
-					message: "Delete blocked by sandboxed plugin hook",
-				},
-			};
-		}
+		const policyRejectionRevision = await this.getScheduledPolicyRejectionRevision(collection, id);
 
 		// Delete the content
 		const result = await handleContentDelete(this.db, collection, id);
 		if (result.success) {
+			await this.clearScheduledPolicyRejection(collection, result.data.id, policyRejectionRevision);
 			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.id]);
 		}
 
@@ -3168,23 +3719,38 @@ export class EmDashRuntime {
 		return handleContentListTrashed(this.db, collection, params);
 	}
 
-	async handleContentRestore(collection: string, id: string) {
-		const result = await handleContentRestore(this.db, collection, id);
+	async handleContentRestore(
+		collection: string,
+		id: string,
+		options: {
+			_rev?: string;
+			origin?: ContentActionOrigin;
+			pluginInvocationId?: string;
+		} = {},
+	) {
+		const result = await handleContentRestore(this.db, collection, id, { _rev: options._rev });
 		if (result.success && result.data) {
 			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
 		}
 
 		// Run afterRestore hooks (fire-and-forget)
 		if (result.success) {
-			this.runAfterRestoreHooks(contentItemToRecord(result.data.item), collection);
+			this.runAfterRestoreHooks(
+				contentItemToRecord(result.data.item),
+				collection,
+				options.origin?.source === "plugin" ? options.origin.pluginId : undefined,
+				options.pluginInvocationId,
+			);
 		}
 
 		return result;
 	}
 
 	async handleContentPermanentDelete(collection: string, id: string) {
+		const policyRejectionRevision = await this.getScheduledPolicyRejectionRevision(collection, id);
 		const result = await handleContentPermanentDelete(this.db, collection, id);
 		if (result.success) {
+			await this.clearScheduledPolicyRejection(collection, result.data.id, policyRejectionRevision);
 			await this.deleteContentUsageAfterSuccessfulPermanentDelete(collection, result.data.id);
 		}
 
@@ -3212,66 +3778,565 @@ export class EmDashRuntime {
 	// Publishing & Scheduling Handlers
 	// =========================================================================
 
-	async handleContentPublish(
+	private pluginVersionedResult(
+		result:
+			| { success: true; data: { item: ContentItemInternal; _rev?: string } }
+			| { success: false; error: { code: string; message: string } },
+	): VersionedContentItem {
+		if (!result.success) {
+			throw Object.assign(new Error(result.error.message), { code: result.error.code });
+		}
+		if (!result.data._rev) throw new Error("Content action returned no revision");
+		return { item: toPluginContentItem(result.data.item), _rev: result.data._rev };
+	}
+
+	private async runPluginContentAction<T>(
+		pluginId: string,
+		action: string,
 		collection: string,
 		id: string,
-		options: {
-			publishedAt?: string;
-			requireScheduledDue?: boolean;
-			expectedScheduledAt?: string;
-			_rev?: string;
-		} = {},
-	) {
-		const result = await handleContentPublish(this.db, collection, id, options);
-		if (result.success && result.data) {
-			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+		fn: (resolvedId: string) => Promise<T>,
+		invocationId?: string,
+		invalidateContentCache?: PluginContentCacheInvalidator,
+	): Promise<T> {
+		let invocationInvalidator: PluginContentCacheInvalidator | undefined;
+		if (invocationId) {
+			const invocationKey = this.pluginInvocationKey(pluginId, invocationId);
+			if (
+				!this.activePluginInvocations.has(invocationKey) &&
+				!this.releasedPluginInvocations.has(invocationKey)
+			) {
+				throw Object.assign(new Error("Plugin content action invocation has expired"), {
+					code: "CONTENT_ACTION_INVOCATION_EXPIRED",
+				});
+			}
+			invocationInvalidator = this.pluginInvocationCacheInvalidators.get(invocationKey);
 		}
-
-		// Run afterPublish hooks (fire-and-forget)
-		if (result.success && result.data) {
-			this.runAfterPublishHooks(contentItemToRecord(result.data.item), collection);
+		await assertMediaUsageActivationWriteAllowed(this.db);
+		const repo = new ContentRepository(this.db);
+		const item =
+			action === "restore"
+				? await repo.findByIdOrSlugIncludingTrashed(collection, id)
+				: await repo.findByIdOrSlug(collection, id);
+		const resolvedId = item?.id ?? id;
+		const key = this.pluginContentActionKey(collection, resolvedId);
+		if ((this.activePluginContentActions.get(key) ?? 0) > 0) {
+			throw Object.assign(new Error("Plugin content action re-entered itself"), {
+				code: "CONTENT_ACTION_REENTRANT",
+			});
 		}
-
-		return result;
+		this.retainPluginContentAction(key);
+		try {
+			const result = await fn(resolvedId);
+			const invalidator =
+				invalidateContentCache ?? invocationInvalidator ?? this.pluginContentCacheInvalidator;
+			if (invalidator) {
+				try {
+					await invalidator([collection, resolvedId]);
+				} catch (error) {
+					console.error(
+						`[plugin-content-action] Cache invalidation failed for ${collection}/${resolvedId}:`,
+						error,
+					);
+				}
+			}
+			return result;
+		} finally {
+			this.releasePluginContentAction(key);
+		}
+	}
+
+	private pluginContentActionKey(collection: string, id: string): string {
+		return JSON.stringify([collection, id]);
+	}
+
+	private retainPluginContentAction(key: string): void {
+		this.activePluginContentActions.set(key, (this.activePluginContentActions.get(key) ?? 0) + 1);
+	}
+
+	private releasePluginContentAction(key: string): void {
+		const remaining = (this.activePluginContentActions.get(key) ?? 1) - 1;
+		if (remaining > 0) this.activePluginContentActions.set(key, remaining);
+		else this.activePluginContentActions.delete(key);
 	}
 
-	async handleContentUnpublish(collection: string, id: string, options: { _rev?: string } = {}) {
-		const result = await handleContentUnpublish(this.db, collection, id, options);
+	private async pluginGetVersioned(
+		_pluginId: string,
+		collection: string,
+		id: string,
+	): Promise<VersionedContentItem | null> {
+		const result = await this.handleContentGet(collection, id);
+		if (!result.success) {
+			if (result.error.code === "NOT_FOUND") return null;
+			throw Object.assign(new Error(result.error.message), { code: result.error.code });
+		}
+		if (!result.data._rev) throw new Error("Content read returned no revision");
+		return { item: toPluginContentItem(result.data.item), _rev: result.data._rev };
+	}
+
+	private async pluginGetTrashedVersioned(
+		_pluginId: string,
+		collection: string,
+		id: string,
+	): Promise<VersionedContentItem | null> {
+		const result = await this.handleContentGetIncludingTrashed(collection, id);
+		if (!result.success) {
+			if (result.error.code === "NOT_FOUND") return null;
+			throw Object.assign(new Error(result.error.message), { code: result.error.code });
+		}
+		if (!(await new ContentRepository(this.db).isTrashed(collection, result.data.item.id))) {
+			return null;
+		}
+		if (!result.data._rev) throw new Error("Trashed content read returned no revision");
+		return { item: toPluginContentItem(result.data.item), _rev: result.data._rev };
+	}
+
+	private pluginPublish(
+		pluginId: string,
+		collection: string,
+		id: string,
+		options: { _rev: string },
+		invocationId?: string,
+		invalidateContentCache?: PluginContentCacheInvalidator,
+	): Promise<VersionedContentItem> {
+		return this.runPluginContentAction(
+			pluginId,
+			"publish",
+			collection,
+			id,
+			async (resolvedId) =>
+				this.pluginVersionedResult(
+					await this.handleContentPublish(collection, resolvedId, {
+						_rev: options._rev,
+						origin: { source: "plugin", pluginId },
+						pluginInvocationId: invocationId,
+					}),
+				),
+			invocationId,
+			invalidateContentCache,
+		);
+	}
+
+	private pluginUnpublish(
+		pluginId: string,
+		collection: string,
+		id: string,
+		options: { _rev: string },
+		invocationId?: string,
+		invalidateContentCache?: PluginContentCacheInvalidator,
+	): Promise<VersionedContentItem> {
+		return this.runPluginContentAction(
+			pluginId,
+			"unpublish",
+			collection,
+			id,
+			async (resolvedId) =>
+				this.pluginVersionedResult(
+					await this.handleContentUnpublish(collection, resolvedId, {
+						_rev: options._rev,
+						origin: { source: "plugin", pluginId },
+						pluginInvocationId: invocationId,
+					}),
+				),
+			invocationId,
+			invalidateContentCache,
+		);
+	}
+
+	private pluginSchedule(
+		pluginId: string,
+		collection: string,
+		id: string,
+		options: { scheduledAt: string; _rev: string },
+		invocationId?: string,
+		invalidateContentCache?: PluginContentCacheInvalidator,
+	): Promise<VersionedContentItem> {
+		return this.runPluginContentAction(
+			pluginId,
+			"schedule",
+			collection,
+			id,
+			async (resolvedId) =>
+				this.pluginVersionedResult(
+					await this.handleContentSchedule(collection, resolvedId, options.scheduledAt, {
+						_rev: options._rev,
+						origin: { source: "plugin", pluginId },
+						pluginInvocationId: invocationId,
+					}),
+				),
+			invocationId,
+			invalidateContentCache,
+		);
+	}
+
+	private pluginUnschedule(
+		pluginId: string,
+		collection: string,
+		id: string,
+		options: { _rev: string },
+		invocationId?: string,
+		invalidateContentCache?: PluginContentCacheInvalidator,
+	): Promise<VersionedContentItem> {
+		return this.runPluginContentAction(
+			pluginId,
+			"unschedule",
+			collection,
+			id,
+			async (resolvedId) =>
+				this.pluginVersionedResult(
+					await this.handleContentUnschedule(collection, resolvedId, {
+						...options,
+						origin: { source: "plugin", pluginId },
+						pluginInvocationId: invocationId,
+					}),
+				),
+			invocationId,
+			invalidateContentCache,
+		);
+	}
+
+	private pluginRestore(
+		pluginId: string,
+		collection: string,
+		id: string,
+		options: { _rev: string },
+		invocationId?: string,
+		invalidateContentCache?: PluginContentCacheInvalidator,
+	): Promise<VersionedContentItem> {
+		return this.runPluginContentAction(
+			pluginId,
+			"restore",
+			collection,
+			id,
+			async (resolvedId) =>
+				this.pluginVersionedResult(
+					await this.handleContentRestore(collection, resolvedId, {
+						...options,
+						origin: { source: "plugin", pluginId },
+						pluginInvocationId: invocationId,
+					}),
+				),
+			invocationId,
+			invalidateContentCache,
+		);
+	}
+
+	private async checkContentPolicy(
+		name: ContentPolicyHookName,
+		collection: string,
+		id: string,
+		options: ContentPolicyMutationOptions,
+		rejectionCode: "PUBLISH_REJECTED" | "SCHEDULE_REJECTED" | "UNPUBLISH_REJECTED",
+		failureCode: "CONTENT_PUBLISH_ERROR" | "CONTENT_SCHEDULE_ERROR" | "CONTENT_UNPUBLISH_ERROR",
+		scheduledAt?: string,
+	): Promise<ContentPolicyCheck> {
+		let current = await handleContentGet(this.db, collection, id);
+		if (!current.success) {
+			return {
+				allowed: false,
+				revision: options._rev ?? "",
+				error: current.error,
+			};
+		}
+
+		const revision = current.data._rev;
+		if (!revision) {
+			return {
+				allowed: false,
+				revision: options._rev ?? "",
+				error: { code: failureCode, message: "Failed to read content revision" },
+			};
+		}
+		if (options._rev !== undefined && options._rev !== revision) {
+			return {
+				allowed: false,
+				revision,
+				error: { code: "CONFLICT", message: "Revision precondition did not match" },
+			};
+		}
+
+		if (!this.hooks.hasHooks(name)) return { allowed: true, revision };
+		if (name !== "content:beforeUnpublish") {
+			try {
+				current = await this.hydrateDraftData(current, {
+					includeStagedSlug: true,
+					strict: true,
+				});
+			} catch (error) {
+				console.error(`[content-policy] ${name} draft hydration failed:`, error);
+				return {
+					allowed: false,
+					revision,
+					error: { code: failureCode, message: `Failed to read content for ${name} policy` },
+				};
+			}
+		}
+
+		const origin = options.origin ?? { source: "system" };
+		const actor =
+			options.actor &&
+			(origin.source === "api" || origin.source === "mcp" || origin.source === "visual-editor")
+				? { ...options.actor, source: origin.source }
+				: undefined;
+		try {
+			const decision = await this.hooks.runContentPolicy(name, {
+				content: contentItemToRecord(current.data.item),
+				collection,
+				origin,
+				actor,
+				...(scheduledAt === undefined ? {} : { scheduledAt }),
+			});
+			if (decision.cancellation) {
+				return {
+					allowed: false,
+					revision,
+					error: { code: rejectionCode, message: decision.cancellation.reason },
+					cancellation: decision.cancellation,
+				};
+			}
+			return { allowed: true, revision };
+		} catch (error) {
+			console.error(`[content-policy] ${name} failed:`, error);
+			return {
+				allowed: false,
+				revision,
+				error: { code: failureCode, message: `Failed to run ${name} policy` },
+			};
+		}
+	}
+
+	private async getScheduledPolicyRejectionRevision(
+		collection: string,
+		id: string,
+	): Promise<string | undefined> {
+		try {
+			return (
+				await new OptionsRepository(this.db).getVersioned(
+					scheduledPolicyRejectionKey(collection, id),
+				)
+			)?.revision;
+		} catch (error) {
+			console.error(
+				`[content-policy] Failed to read scheduled rejection for ${collection}/${id}:`,
+				error,
+			);
+			return undefined;
+		}
+	}
+
+	private async clearScheduledPolicyRejection(
+		collection: string,
+		id: string,
+		expectedRevision: string | undefined,
+	): Promise<void> {
+		if (expectedRevision === undefined) return;
+		try {
+			await new OptionsRepository(this.db).compareAndDelete(
+				scheduledPolicyRejectionKey(collection, id),
+				expectedRevision,
+			);
+		} catch (error) {
+			console.error(
+				`[content-policy] Failed to clear scheduled rejection for ${collection}/${id}:`,
+				error,
+			);
+		}
+	}
+
+	private createScheduledPolicyRejection(
+		collection: string,
+		id: string,
+		cancellation: { pluginId: string; reason: string },
+	): ScheduledPolicyRejection {
+		return {
+			collection,
+			id,
+			pluginId: cancellation.pluginId,
+			reason: cancellation.reason,
+			rejectedAt: (this.runtimeDeps.now?.() ?? new Date()).toISOString(),
+		};
+	}
+
+	async handleContentPublish(
+		collection: string,
+		id: string,
+		options: {
+			publishedAt?: string;
+			requireScheduledDue?: boolean;
+			expectedScheduledAt?: string;
+			_rev?: string;
+			currentTime?: Date;
+			actor?: ActorInfo;
+			origin?: ContentActionOrigin;
+			pluginInvocationId?: string;
+		} = {},
+	) {
+		const policy = await this.checkContentPolicy(
+			"content:beforePublish",
+			collection,
+			id,
+			options,
+			"PUBLISH_REJECTED",
+			"CONTENT_PUBLISH_ERROR",
+		);
+		if (!policy.allowed) {
+			if (policy.cancellation && options.origin?.source === "scheduler") {
+				const unscheduled = await handleScheduledPolicyRejection(this.db, collection, id, {
+					_rev: policy.revision,
+					rejection: this.createScheduledPolicyRejection(collection, id, policy.cancellation),
+				});
+				if (!unscheduled.success) return unscheduled;
+				await this.refreshContentUsageAfterSuccessfulWrite(collection, [unscheduled.data.item.id]);
+				this.runAfterUnscheduleHooks(contentItemToRecord(unscheduled.data.item), collection);
+			}
+			return { success: false as const, error: policy.error };
+		}
+		const policyRejectionRevision = await this.getScheduledPolicyRejectionRevision(collection, id);
+		const {
+			actor: _actor,
+			origin: _origin,
+			pluginInvocationId: _pluginInvocationId,
+			...handlerOptions
+		} = options;
+		const result = await handleContentPublish(this.db, collection, id, {
+			...handlerOptions,
+			_rev: policy.revision,
+		});
+		if (result.success && result.data) {
+			await this.clearScheduledPolicyRejection(
+				collection,
+				result.data.item.id,
+				policyRejectionRevision,
+			);
+			const { item } = result.data;
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, [
+				item.id,
+				...(await this.findSyncedSiblingsForUsageRefresh(
+					collection,
+					item.id,
+					item.translationGroup,
+					item.data,
+					{ absentAsCleared: true },
+				)),
+			]);
+		}
+
+		// Run afterPublish hooks (fire-and-forget)
+		if (result.success && result.data) {
+			this.runAfterPublishHooks(
+				contentItemToRecord(result.data.item),
+				collection,
+				options.origin?.source === "plugin" ? options.origin.pluginId : undefined,
+				options.pluginInvocationId,
+			);
+		}
+
+		return result;
+	}
+
+	async handleContentUnpublish(
+		collection: string,
+		id: string,
+		options: ContentPolicyMutationOptions = {},
+	) {
+		const policy = await this.checkContentPolicy(
+			"content:beforeUnpublish",
+			collection,
+			id,
+			options,
+			"UNPUBLISH_REJECTED",
+			"CONTENT_UNPUBLISH_ERROR",
+		);
+		if (!policy.allowed) return { success: false as const, error: policy.error };
+		const result = await handleContentUnpublish(this.db, collection, id, {
+			_rev: policy.revision,
+		});
 		if (result.success && result.data) {
 			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
 		}
 
 		// Run afterUnpublish hooks (deferred past the response via after())
 		if (result.success && result.data) {
-			this.runAfterUnpublishHooks(contentItemToRecord(result.data.item), collection);
+			this.runAfterUnpublishHooks(
+				contentItemToRecord(result.data.item),
+				collection,
+				options.origin?.source === "plugin" ? options.origin.pluginId : undefined,
+				options.pluginInvocationId,
+			);
 		}
 
 		return result;
 	}
 
-	async handleContentSchedule(collection: string, id: string, scheduledAt: string) {
-		const result = await handleContentSchedule(this.db, collection, id, scheduledAt);
+	async handleContentSchedule(
+		collection: string,
+		id: string,
+		scheduledAt: string,
+		options: ContentPolicyMutationOptions = {},
+	) {
+		const policy = await this.checkContentPolicy(
+			"content:beforeSchedule",
+			collection,
+			id,
+			options,
+			"SCHEDULE_REJECTED",
+			"CONTENT_SCHEDULE_ERROR",
+			scheduledAt,
+		);
+		if (!policy.allowed) return { success: false as const, error: policy.error };
+		const policyRejectionRevision = await this.getScheduledPolicyRejectionRevision(collection, id);
+		const result = await handleContentSchedule(
+			this.db,
+			collection,
+			id,
+			scheduledAt,
+			this.runtimeDeps.now?.() ?? new Date(),
+			policy.revision,
+		);
 		if (result.success && result.data) {
+			await this.clearScheduledPolicyRejection(
+				collection,
+				result.data.item.id,
+				policyRejectionRevision,
+			);
 			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
 		}
 
 		// Run afterSchedule hooks (fire-and-forget)
 		if (result.success && result.data) {
-			this.runAfterScheduleHooks(contentItemToRecord(result.data.item), collection);
+			this.runAfterScheduleHooks(
+				contentItemToRecord(result.data.item),
+				collection,
+				options.origin?.source === "plugin" ? options.origin.pluginId : undefined,
+				options.pluginInvocationId,
+			);
 		}
 
 		return result;
 	}
 
-	async handleContentUnschedule(collection: string, id: string) {
-		const result = await handleContentUnschedule(this.db, collection, id);
+	async handleContentUnschedule(
+		collection: string,
+		id: string,
+		options: {
+			_rev?: string;
+			origin?: ContentActionOrigin;
+			pluginInvocationId?: string;
+		} = {},
+	) {
+		const result = await handleContentUnschedule(this.db, collection, id, { _rev: options._rev });
 		if (result.success && result.data) {
 			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
 		}
 
 		// Run afterUnschedule hooks (fire-and-forget)
 		if (result.success && result.data) {
-			this.runAfterUnscheduleHooks(contentItemToRecord(result.data.item), collection);
+			this.runAfterUnscheduleHooks(
+				contentItemToRecord(result.data.item),
+				collection,
+				options.origin?.source === "plugin" ? options.origin.pluginId : undefined,
+				options.pluginInvocationId,
+			);
 		}
 
 		return result;
@@ -3316,6 +4381,33 @@ export class EmDashRuntime {
 		return handleMediaGet(this.db, id);
 	}
 
+	async handleMediaUpload(input: MediaUploadInput) {
+		if (!this.storage) {
+			return {
+				success: false as const,
+				error: { code: "NO_STORAGE", message: "Storage not configured" },
+			};
+		}
+		const result = await uploadMedia(this.db, this.storage, input, {
+			beforeUpload: async (file) => {
+				if (!this.hooks.hasHooks("media:beforeUpload")) return file;
+				return (await this.hooks.runMediaBeforeUpload(file)).file;
+			},
+		});
+		if (result.success && !result.data.deduplicated && this.hooks.hasHooks("media:afterUpload")) {
+			const item = result.data.item;
+			await this.hooks.runMediaAfterUpload({
+				id: item.id,
+				filename: item.filename,
+				mimeType: item.mimeType,
+				size: item.size,
+				url: item.url,
+				createdAt: item.createdAt,
+			});
+		}
+		return result;
+	}
+
 	async handleMediaCreate(input: {
 		filename: string;
 		mimeType: string;
@@ -3392,6 +4484,10 @@ export class EmDashRuntime {
 		return result;
 	}
 
+	async handlePluginMediaMetadataUpdate(id: string, patch: MediaMetadataPatch) {
+		return updatePluginMediaMetadata(this.db, id, patch);
+	}
+
 	async handleMediaReplaceMetadata(
 		id: string,
 		expectedStorageKey: string,
@@ -3416,6 +4512,163 @@ export class EmDashRuntime {
 		return result;
 	}
 
+	private commentHooks(): CommentHookRunner {
+		return {
+			runBeforeCreate: (event) => this.hooks.runCommentBeforeCreate(event),
+			runModerate: async (event) => {
+				const result = await this.hooks.invokeExclusiveHook("comment:moderate", event);
+				if (!result) return { status: "pending", reason: "No moderator configured" };
+				if (result.error) {
+					console.error(`[comments] Moderation error (${result.pluginId}):`, result.error.message);
+					return { status: "pending", reason: "Moderation error" };
+				}
+				if (!isModerationDecision(result.result)) {
+					return { status: "pending", reason: "Invalid moderation result" };
+				}
+				return result.result;
+			},
+			fireAfterCreate: (event) => {
+				void this.hooks
+					.runCommentAfterCreate(event)
+					.catch((error) =>
+						console.error(
+							"[comments] afterCreate error:",
+							error instanceof Error ? error.message : error,
+						),
+					);
+			},
+			fireAfterModerate: (event) => {
+				return this.hooks
+					.runCommentAfterModerate(event)
+					.catch((error) =>
+						console.error(
+							"[comments] afterModerate error:",
+							error instanceof Error ? error.message : error,
+						),
+					);
+			},
+		};
+	}
+
+	async handleCommentCreate(
+		input: CommentCreateInput,
+		settings: CollectionCommentSettings,
+		contentInfo?: Parameters<typeof createComment>[4],
+	): Promise<CommentCreateResult | null> {
+		return createComment(this.db, input, settings, this.commentHooks(), contentInfo);
+	}
+
+	async handlePublicCommentSubmission(
+		collection: string,
+		contentId: string,
+		request: Request,
+		user?: UserInfo,
+	): Promise<Response> {
+		return submitPublicComment(this, collection, contentId, request, user);
+	}
+
+	private async sendCommentApproval(
+		comment: Awaited<ReturnType<CommentRepository["findById"]>>,
+		request?: Request,
+	) {
+		if (!comment || !this.email) return;
+		try {
+			const adminBaseUrl = await getSiteBaseUrl(
+				this.db,
+				request ?? new Request("https://plugin.invalid/"),
+				this.config,
+			);
+			const content = await lookupContentAuthor(this.db, comment.collection, comment.contentId);
+			if (content?.author) {
+				await sendCommentNotification({
+					email: this.email,
+					comment,
+					contentAuthor: content.author,
+					adminBaseUrl,
+				});
+			}
+		} catch (error) {
+			console.error(
+				"[comments] notification error:",
+				error instanceof Error ? error.message : error,
+			);
+		}
+	}
+
+	private async moderateCommentWithOrigin(
+		id: string,
+		status: CommentStatus,
+		expectedStatus: CommentStatus,
+		origin:
+			| { source: "admin"; userId: string; name: string | null }
+			| { source: "plugin"; pluginId: string },
+		request?: Request,
+	) {
+		if (this.commentModerationInProgress.has(id)) {
+			const current = await new CommentRepository(this.db).findById(id);
+			if (current && current.status !== expectedStatus) {
+				throw new CommentStatusConflictError(current.status);
+			}
+			throw Object.assign(new Error("Comment moderation is already in progress"), {
+				code: "COMMENT_MODERATION_IN_PROGRESS",
+			});
+		}
+		this.commentModerationInProgress.add(id);
+		try {
+			return await moderateComment(
+				this.db,
+				id,
+				status,
+				expectedStatus,
+				origin,
+				this.commentHooks(),
+				(comment) => this.sendCommentApproval(comment, request),
+			);
+		} finally {
+			this.commentModerationInProgress.delete(id);
+		}
+	}
+
+	async handleCommentModerate(
+		id: string,
+		status: CommentStatus,
+		moderator: { id: string; name: string | null },
+		expectedStatus?: CommentStatus,
+		request?: Request,
+	) {
+		let expected = expectedStatus;
+		if (!expected) {
+			const current = await new CommentRepository(this.db).findById(id);
+			if (!current || current.status === "trash") return null;
+			expected = current.status;
+		}
+		return this.moderateCommentWithOrigin(
+			id,
+			status,
+			expected,
+			{ source: "admin", userId: moderator.id, name: moderator.name },
+			request,
+		);
+	}
+
+	async handlePluginCommentModerate(
+		pluginId: string,
+		id: string,
+		status: PluginCommentStatus,
+		expectedStatus: PluginCommentStatus,
+	): Promise<PluginComment> {
+		assertPluginCommentStatus(status, "status");
+		assertPluginCommentStatus(expectedStatus, "expectedStatus");
+		const updated = await this.moderateCommentWithOrigin(id, status, expectedStatus, {
+			source: "plugin",
+			pluginId,
+		});
+		if (!updated) throw new Error(`Comment not found: ${id}`);
+		const result = await createCommentAccess(this.db).get(id);
+		if (!result) throw new Error(`Comment not found: ${id}`);
+		return result;
+	}
+
 	// =========================================================================
 	// Revision Handlers
 	// =========================================================================
@@ -3467,8 +4720,13 @@ export class EmDashRuntime {
 		// live, matching the documented tool contract.
 		try {
 			const contentRepo = new ContentRepository(this.db);
-			const existing = await contentRepo.findById(revision.collection, revision.entryId);
-			if (!existing) {
+			const newDraftId = await contentRepo.restoreDraftRevision(
+				revision.collection,
+				revision.entryId,
+				revision.data,
+				callerUserId,
+			);
+			if (!newDraftId) {
 				return {
 					success: false as const,
 					error: {
@@ -3478,43 +4736,12 @@ export class EmDashRuntime {
 				};
 			}
 
-			const newDraft = await revisionRepo.create({
-				collection: revision.collection,
-				entryId: revision.entryId,
-				data: revision.data,
-				authorId: callerUserId,
-			});
-
-			try {
-				const staged = await contentRepo.replaceDraftRevision(
-					revision.collection,
-					revision.entryId,
-					newDraft.id,
-					existing,
-				);
-				if (!staged) throw new ContentMutationConflictError();
-			} catch (error) {
-				try {
-					await revisionRepo.deleteIfUnreferenced(
-						revision.collection,
-						revision.entryId,
-						newDraft.id,
-					);
-				} catch (cleanupError) {
-					console.error(
-						`[emdash] Failed to clean up unrestored revision ${newDraft.id}:`,
-						cleanupError,
-					);
-				}
-				throw error;
-			}
-
 			after(async () => {
 				try {
 					await revisionRepo.pruneQueuedEntry(
 						revision.collection,
 						revision.entryId,
-						newDraft.id,
+						newDraftId,
 						50,
 					);
 				} catch (error) {
@@ -3553,6 +4780,40 @@ export class EmDashRuntime {
 		}
 	}
 
+	private async findSyncedSiblingsForUsageRefresh(
+		collection: string,
+		contentId: string,
+		translationGroup: string | null | undefined,
+		data: Record<string, unknown>,
+		options: { absentAsCleared?: boolean } = {},
+	): Promise<string[]> {
+		try {
+			return await findNonTranslatableSiblingContentIds(
+				this.db,
+				collection,
+				contentId,
+				translationGroup,
+				data,
+				options,
+			);
+		} catch (error) {
+			console.error(
+				`[media-usage] Failed to discover synced i18n siblings for ${collection}/${contentId}:`,
+				error,
+			);
+			try {
+				await markContentMediaUsageCollectionStale(
+					this.db,
+					collection,
+					"CONTENT_USAGE_REFRESH_ERROR",
+				);
+			} catch (staleError) {
+				console.error(`[media-usage] Failed to mark ${collection} stale:`, staleError);
+			}
+			return [];
+		}
+	}
+
 	private async refreshContentUsageAfterSuccessfulWrite(
 		collection: string,
 		contentIds: readonly string[],
@@ -3597,6 +4858,211 @@ export class EmDashRuntime {
 	// Plugin Routes
 	// =========================================================================
 
+	private getSandboxedAdminDefinition(pluginId: string): {
+		pages: string[];
+		widgets: string[];
+		policy: BlockValidationPolicy;
+	} | null {
+		const entry = this.sandboxedPluginEntries.find((candidate) => candidate.id === pluginId);
+		if (entry) {
+			const pages = (entry.adminPages ?? []).map((page) => normalizePluginPagePath(page.path));
+			const imageHosts = allowedBrowserImageHosts(entry.capabilities, entry.allowedHosts);
+			return {
+				pages,
+				widgets: (entry.adminWidgets ?? []).map((widget) => widget.id),
+				policy: { pluginPagePaths: pages, allowedImageHosts: imageHosts },
+			};
+		}
+
+		const manifest = marketplaceManifestCache.get(pluginId);
+		if (!manifest) return null;
+		const pages = (manifest.admin?.pages ?? []).map((page) => normalizePluginPagePath(page.path));
+		const imageHosts = allowedBrowserImageHosts(
+			manifest.capabilities ?? [],
+			manifest.allowedHosts ?? [],
+		);
+		return {
+			pages,
+			widgets: (manifest.admin?.widgets ?? []).map((widget) => widget.id),
+			policy: { pluginPagePaths: pages, allowedImageHosts: imageHosts },
+		};
+	}
+
+	private resolvePluginUiContext(
+		definition: { pages: string[]; widgets: string[] },
+		body: unknown,
+		request: Request,
+	): { context?: PluginUiContext; error?: { code: string; message: string } } {
+		if (typeof body !== "object" || body === null || !("page" in body)) return {};
+		const page = body.page;
+		if (typeof page !== "string") {
+			return {
+				error: { code: "INVALID_PLUGIN_UI_CONTEXT", message: "Plugin UI page must be a string" },
+			};
+		}
+
+		let surface: PluginUiContext["surface"];
+		if (page.startsWith("widget:")) {
+			if (!definition.widgets.includes(page.slice("widget:".length))) {
+				return {
+					error: {
+						code: "INVALID_PLUGIN_UI_CONTEXT",
+						message: "Plugin dashboard widget is not declared",
+					},
+				};
+			}
+			surface = "dashboard-widget";
+		} else {
+			if (!definition.pages.includes(normalizePluginPagePath(page))) {
+				return {
+					error: {
+						code: "INVALID_PLUGIN_UI_CONTEXT",
+						message: "Plugin admin page is not declared",
+					},
+				};
+			}
+			surface = "admin-page";
+		}
+
+		const locale = resolveLocale(request);
+		return { context: { surface, locale, direction: getLocaleDir(locale) } };
+	}
+
+	private validateSandboxedAdminResponse(
+		pluginId: string,
+		definition: { policy: BlockValidationPolicy },
+		result: {
+			success: boolean;
+			data?: unknown;
+			error?: { code: string; message: string };
+			status?: number;
+		},
+	) {
+		if (!result.success) return result;
+		const validation = validateBlockResponse(result.data, definition.policy);
+		if (validation.valid) return result;
+
+		console.error(
+			`EmDash: Sandboxed plugin ${pluginId} returned invalid Block Kit content:`,
+			validation.errors,
+		);
+		return {
+			success: false,
+			status: 502,
+			error: {
+				code: "INVALID_BLOCK_RESPONSE",
+				message: "Plugin returned invalid Block Kit content",
+			},
+		};
+	}
+
+	getPluginEditorExtension(
+		pluginId: string,
+		kind: "panel" | "action",
+		extensionId: string,
+		collection: string,
+	): ResolvedPluginEditorExtension | null {
+		if (!this.isPluginEnabled(pluginId)) return null;
+
+		let panels: PluginEditorPanel[] | undefined;
+		let actions: PluginEditorAction[] | undefined;
+		let pages: string[] = [];
+		let capabilities: readonly PluginCapability[] = [];
+		let allowedHosts: readonly string[] = [];
+
+		const configured = this.configuredPlugins.find((plugin) => plugin.id === pluginId);
+		if (configured) {
+			if (configured.admin.entry) return null;
+			panels = configured.admin.editorPanels;
+			actions = configured.admin.editorActions;
+			pages = (configured.admin.pages ?? []).map((page) => page.path);
+			capabilities = configured.capabilities;
+			allowedHosts = configured.allowedHosts;
+		} else {
+			const entry = this.sandboxedPluginEntries.find((candidate) => candidate.id === pluginId);
+			if (entry) {
+				panels = entry.editorPanels;
+				actions = entry.editorActions;
+				pages = (entry.adminPages ?? []).map((page) => page.path);
+				capabilities = entry.capabilities;
+				allowedHosts = entry.allowedHosts;
+			} else {
+				const manifest = marketplaceManifestCache.get(pluginId);
+				if (!manifest) return null;
+				panels = manifest.admin?.editorPanels;
+				actions = manifest.admin?.editorActions;
+				pages = (manifest.admin?.pages ?? []).map((page) => page.path);
+				capabilities = manifest.capabilities ?? [];
+				allowedHosts = manifest.allowedHosts ?? [];
+			}
+		}
+
+		const normalizedCapabilities = normalizePluginCapabilities(capabilities);
+		const policy = {
+			pluginPagePaths: pages,
+			allowedImageHosts: allowedBrowserImageHosts(capabilities, allowedHosts),
+		};
+		if (kind === "panel") {
+			const matches = panels?.filter((panel) => panel.id === extensionId) ?? [];
+			const extension = matches[0];
+			if (
+				matches.length !== 1 ||
+				!extension ||
+				(extension.collections && !extension.collections.includes(collection))
+			) {
+				return null;
+			}
+			return { kind, extension, policy, capabilities: normalizedCapabilities };
+		}
+		const matches = actions?.filter((action) => action.id === extensionId) ?? [];
+		const extension = matches[0];
+		if (
+			matches.length !== 1 ||
+			!extension ||
+			(extension.collections && !extension.collections.includes(collection)) ||
+			(extension.style === "danger" && !extension.confirm)
+		) {
+			return null;
+		}
+		return { kind, extension, policy, capabilities: normalizedCapabilities };
+	}
+
+	async getPluginEditorDraftSchema(collection: string) {
+		return this.schemaRegistry.getCollectionWithFields(collection);
+	}
+
+	private validatePluginEditorExtensionResponse(
+		pluginId: string,
+		dispatch: PluginEditorExtensionDispatch,
+		result: {
+			success: boolean;
+			data?: unknown;
+			error?: { code: string; message: string };
+			status?: number;
+		},
+	) {
+		if (!result.success) return result;
+		const validation =
+			dispatch.kind === "panel"
+				? validateBlockResponse(result.data, dispatch.policy)
+				: validateContentEditorActionResponse(result.data, dispatch.policy);
+		if (validation.valid) return result;
+
+		console.error(
+			`EmDash: Plugin ${pluginId} returned an invalid content editor ${dispatch.kind} response:`,
+			validation.errors,
+		);
+		return {
+			success: false,
+			status: 502,
+			error: {
+				code:
+					dispatch.kind === "panel" ? "INVALID_BLOCK_RESPONSE" : "INVALID_EDITOR_ACTION_RESPONSE",
+				message: "Plugin returned an invalid editor extension response",
+			},
+		};
+	}
+
 	/**
 	 * Get route metadata for a plugin route without invoking the handler.
 	 * Used by the catch-all route to decide auth before dispatch.
@@ -3660,10 +5126,12 @@ export class EmDashRuntime {
 
 	async handlePluginApiRoute(
 		pluginId: string,
-		_method: string,
+		method: string,
 		path: string,
 		request: Request,
 		user?: RouteCallerInput | null,
+		invalidateContentCache?: PluginContentCacheInvalidator,
+		editorDispatch?: PluginEditorExtensionDispatch,
 	) {
 		if (!this.isPluginEnabled(pluginId)) {
 			return {
@@ -3671,11 +5139,40 @@ export class EmDashRuntime {
 				error: { code: "NOT_FOUND", message: `Plugin not enabled: ${pluginId}` },
 			};
 		}
+		const normalizedMethod = method.toUpperCase();
+		const routeMeta = this.getPluginRouteMeta(pluginId, path);
+		if (routeMeta?.methods && !routeMeta.methods.some((allowed) => allowed === normalizedMethod)) {
+			return {
+				success: false,
+				status: 405,
+				error: { code: "METHOD_NOT_ALLOWED", message: "Method not allowed" },
+			};
+		}
 
 		// Authenticated caller for `ctx.user`. Undefined for public routes
 		// (the catch-all only forwards the caller after private-route auth)
 		// and for machine tokens with no bound user.
 		const caller = user ? toRouteCallerInfo(user) : undefined;
+		let body: unknown;
+		try {
+			body = await parseRouteInput(request, routeMeta?.request);
+		} catch (error) {
+			if (error instanceof PluginRouteRequestError) {
+				return {
+					success: false,
+					status: error.status,
+					error: { code: "INVALID_PLUGIN_REQUEST", message: error.message },
+				};
+			}
+			throw error;
+		}
+		const routeKey = path.replace(LEADING_SLASH_PATTERN, "");
+		const adminDefinition =
+			!editorDispatch && routeKey === "admin" ? this.getSandboxedAdminDefinition(pluginId) : null;
+		const uiResult = adminDefinition
+			? this.resolvePluginUiContext(adminDefinition, body, request)
+			: {};
+		if (uiResult.error) return { success: false, status: 400, error: uiResult.error };
 
 		// Check trusted (configured) plugins first — this must match the
 		// resolution order in getPluginRouteMeta to avoid auth/execution mismatches.
@@ -3683,24 +5180,44 @@ export class EmDashRuntime {
 		if (trustedPlugin && this.enabledPlugins.has(trustedPlugin.id)) {
 			const routeRegistry = new PluginRouteRegistry({
 				...this.pipelineFactoryOptions,
+				contentActions: this.contentActionsWithInvalidator(invalidateContentCache),
 				emailPipeline: this.email ?? undefined,
 				cronReschedule: () => this.cronScheduler?.reschedule(),
 				trustedProxyHeaders: getTrustedProxyHeaders(this.config),
 			});
 			routeRegistry.register(trustedPlugin);
 
-			const routeKey = path.replace(LEADING_SLASH_PATTERN, "");
-
-			// Body methods parse JSON; GET/HEAD/DELETE parse the query string (#2146).
-			const body = await parseRouteInput(request);
-
-			return routeRegistry.invoke(pluginId, routeKey, { request, body, user: caller });
+			const result = await routeRegistry.invoke(pluginId, routeKey, {
+				request,
+				body,
+				user: caller,
+				ui: editorDispatch?.ui ?? uiResult.context,
+			});
+			return editorDispatch
+				? this.validatePluginEditorExtensionResponse(pluginId, editorDispatch, result)
+				: adminDefinition
+					? this.validateSandboxedAdminResponse(pluginId, adminDefinition, result)
+					: result;
 		}
 
 		// Check sandboxed (marketplace) plugins second
 		const sandboxedPlugin = this.findSandboxedPlugin(pluginId);
 		if (sandboxedPlugin) {
-			return this.handleSandboxedRoute(sandboxedPlugin, path, request, caller);
+			const result = await this.handleSandboxedRoute(
+				sandboxedPlugin,
+				path,
+				request,
+				body,
+				routeMeta ?? { public: false },
+				caller,
+				editorDispatch?.ui ?? uiResult.context,
+				invalidateContentCache,
+			);
+			return editorDispatch
+				? this.validatePluginEditorExtensionResponse(pluginId, editorDispatch, result)
+				: adminDefinition
+					? this.validateSandboxedAdminResponse(pluginId, adminDefinition, result)
+					: result;
 		}
 
 		return {
@@ -3709,6 +5226,28 @@ export class EmDashRuntime {
 		};
 	}
 
+	private contentActionsWithInvalidator(
+		invalidateContentCache?: PluginContentCacheInvalidator,
+	): ContentActionCallbacks | undefined {
+		const actions = this.pipelineFactoryOptions.contentActions;
+		if (!actions || !invalidateContentCache) return actions;
+		return {
+			...actions,
+			begin: (pluginId, invocationId, invocationInvalidator) =>
+				actions.begin?.(pluginId, invocationId, invocationInvalidator ?? invalidateContentCache),
+			publish: (pluginId, collection, id, options, invocationId) =>
+				actions.publish(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			unpublish: (pluginId, collection, id, options, invocationId) =>
+				actions.unpublish(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			schedule: (pluginId, collection, id, options, invocationId) =>
+				actions.schedule(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			unschedule: (pluginId, collection, id, options, invocationId) =>
+				actions.unschedule(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			restore: (pluginId, collection, id, options, invocationId) =>
+				actions.restore(pluginId, collection, id, options, invocationId, invalidateContentCache),
+		};
+	}
+
 	async getPluginMcpTools(pluginId?: string) {
 		const tools: Array<{
 			pluginId: string;
@@ -3726,7 +5265,14 @@ export class EmDashRuntime {
 			if (pluginId && plugin.id !== pluginId) continue;
 			for (const [name, tool] of Object.entries(plugin.mcp?.tools ?? {})) {
 				const route = plugin.routes[tool.route];
-				if (!route || route.public || !route.permission || !(route.permission in Permissions))
+				if (
+					!route ||
+					route.public ||
+					route.response === "raw" ||
+					!isJsonPostRouteContract(route) ||
+					!route.permission ||
+					!Object.hasOwn(Permissions, route.permission)
+				)
 					continue;
 				const key = `${plugin.id}__${name}`;
 				if (seen.has(key)) continue;
@@ -3753,8 +5299,10 @@ export class EmDashRuntime {
 					seen.has(key) ||
 					!routeMeta ||
 					routeMeta.public ||
+					routeMeta.response === "raw" ||
+					!isJsonPostRouteContract(routeMeta) ||
 					routeMeta.permission !== tool.permission ||
-					!(tool.permission in Permissions)
+					!Object.hasOwn(Permissions, tool.permission)
 				) {
 					continue;
 				}
@@ -3828,6 +5376,7 @@ export class EmDashRuntime {
 		actorId: string,
 		request: Request,
 		caller?: RouteCallerInput | null,
+		invalidateContentCache?: PluginContentCacheInvalidator,
 	) {
 		const requestMeta = extractRequestMeta(request, getTrustedProxyHeaders(this.config));
 		const audit = new AuditRepository(this.db);
@@ -3845,6 +5394,7 @@ export class EmDashRuntime {
 			route,
 			internalRequest,
 			caller,
+			invalidateContentCache,
 		);
 		await audit.log({
 			actorId,
@@ -3891,6 +5441,37 @@ export class EmDashRuntime {
 		return undefined;
 	}
 
+	/**
+	 * Drop incoming keys that have no matching collection field when the entry
+	 * already stores them in its live data or current draft revision.
+	 *
+	 * Draft revisions keep the full `data` JSON, so deleting a field can strand
+	 * the old value; this lets a read-then-write save succeed without allowing
+	 * genuinely unknown keys.
+	 */
+	private async dropUnknownKeysAlreadyStored(
+		data: Record<string, unknown>,
+		existing: { data: Record<string, unknown>; draftRevisionId?: string | null } | null,
+		knownFieldSlugs: ReadonlySet<string>,
+	): Promise<Record<string, unknown>> {
+		if (!existing) return data;
+
+		let stored: Record<string, unknown> = existing.data ?? {};
+		if (existing.draftRevisionId) {
+			const draft = await new RevisionRepository(this.db)
+				.findById(existing.draftRevisionId)
+				.catch(() => null);
+			if (draft?.data) stored = draft.data;
+		}
+
+		const stale = staleStoredKeys(data, stored, knownFieldSlugs);
+		if (stale.length === 0) return data;
+
+		const result = { ...data };
+		for (const key of stale) delete result[key];
+		return result;
+	}
+
 	/**
 	 * Normalize image/file fields in content data.
 	 * Fills missing dimensions, storageKey, mimeType, and filename from providers.
@@ -3898,12 +5479,15 @@ export class EmDashRuntime {
 	private async normalizeMediaFields(
 		collection: string,
 		data: Record<string, unknown>,
+		preloaded?: CollectionWithFields | null,
 	): Promise<Record<string, unknown>> {
-		let collectionInfo;
-		try {
-			collectionInfo = await this.schemaRegistry.getCollectionWithFields(collection);
-		} catch {
-			return data;
+		let collectionInfo = preloaded;
+		if (collectionInfo === undefined) {
+			try {
+				collectionInfo = await this.schemaRegistry.getCollectionWithFields(collection);
+			} catch {
+				return data;
+			}
 		}
 		if (!collectionInfo?.fields) return data;
 
@@ -3973,119 +5557,22 @@ export class EmDashRuntime {
 		return result;
 	}
 
-	private async runSandboxedBeforeSave(
-		content: Record<string, unknown>,
-		collection: string,
-		isNew: boolean,
-		contentId?: string,
-	) {
-		let result = content;
-
-		for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-			const [id] = pluginKey.split(":");
-			if (!id || !this.isPluginEnabled(id)) continue;
-
-			try {
-				const event: ContentHookEvent = { content: result, collection, isNew };
-				if (contentId !== undefined) event.id = contentId;
-				const hookResult = await plugin.invokeHook("content:beforeSave", event);
-				const inspection = inspectSandboxHookResult(hookResult);
-				if (inspection.kind === "error") {
-					return {
-						success: false as const,
-						error: {
-							code: ErrorCode.SAVE_REJECTED,
-							message: "Save rejected by a sandboxed plugin",
-							details: { pluginId: id, reason: inspection.error.reason },
-						},
-					};
-				}
-				if (inspection.kind === "malformed") {
-					console.error(`EmDash: Sandboxed plugin ${id} returned an invalid hook result`);
-					return {
-						success: false as const,
-						error: {
-							code: ErrorCode.CONTENT_HOOK_ERROR,
-							message: "A plugin hook failed while saving content",
-						},
-					};
-				}
-				if (hookResult && typeof hookResult === "object" && !Array.isArray(hookResult)) {
-					// Sandbox returns unknown; convert to record by iterating own properties
-					const record: Record<string, unknown> = {};
-					for (const [k, v] of Object.entries(hookResult)) {
-						record[k] = v;
-					}
-					result = record;
-				}
-			} catch (error) {
-				console.error(`EmDash: Sandboxed plugin ${id} beforeSave hook failed:`, error);
-				return {
-					success: false as const,
-					error: {
-						code: ErrorCode.CONTENT_HOOK_ERROR,
-						message: "A plugin hook failed while saving content",
-					},
-				};
-			}
-		}
-
-		return { success: true as const, data: result };
-	}
-
-	private async runSandboxedBeforeDelete(id: string, collection: string): Promise<boolean> {
-		for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-			const [pluginId] = pluginKey.split(":");
-			if (!pluginId || !this.isPluginEnabled(pluginId)) continue;
-
-			try {
-				const result = await plugin.invokeHook("content:beforeDelete", {
-					id,
-					collection,
-				});
-				if (result === false) {
-					return false;
-				}
-			} catch (error) {
-				console.error(`EmDash: Sandboxed plugin ${pluginId} beforeDelete hook error:`, error);
-			}
-		}
-
-		return true;
-	}
-
 	private runAfterSaveHooks(
 		content: Record<string, unknown>,
 		collection: string,
 		isNew: boolean,
+		actor?: ActorInfo,
+		excludePluginId?: string,
 	): void {
 		after(async () => {
 			// Trusted plugins
 			if (this.hooks.hasHooks("content:afterSave")) {
 				try {
-					await this.hooks.runContentAfterSave(content, collection, isNew);
+					await this.hooks.runContentAfterSave(content, collection, isNew, actor, excludePluginId);
 				} catch (err) {
 					console.error("EmDash afterSave hook error:", err);
 				}
 			}
-
-			// Sandboxed plugins
-			const tasks: Promise<void>[] = [];
-			for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-				const [id] = pluginKey.split(":");
-				if (!id || !this.isPluginEnabled(id)) continue;
-
-				tasks.push(
-					(async () => {
-						try {
-							await plugin.invokeHook("content:afterSave", { content, collection, isNew });
-						} catch (err) {
-							console.error(`EmDash: Sandboxed plugin ${id} afterSave error:`, err);
-						}
-					})(),
-				);
-			}
-			await Promise.allSettled(tasks);
 		});
 	}
 
@@ -4099,24 +5586,6 @@ export class EmDashRuntime {
 					console.error("EmDash afterDelete hook error:", err);
 				}
 			}
-
-			// Sandboxed plugins
-			const tasks: Promise<void>[] = [];
-			for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-				const [pluginId] = pluginKey.split(":");
-				if (!pluginId || !this.isPluginEnabled(pluginId)) continue;
-
-				tasks.push(
-					(async () => {
-						try {
-							await plugin.invokeHook("content:afterDelete", { id, collection, permanent });
-						} catch (err) {
-							console.error(`EmDash: Sandboxed plugin ${pluginId} afterDelete error:`, err);
-						}
-					})(),
-				);
-			}
-			await Promise.allSettled(tasks);
 		});
 	}
 
@@ -4129,10 +5598,12 @@ export class EmDashRuntime {
 			| "content:afterUnschedule",
 		content: Record<string, unknown>,
 		collection: string,
+		afterPluginId?: string,
+		pluginInvocationId?: string,
 	): void {
 		const label = name.slice("content:".length);
 
-		after(async () => {
+		const invoke = async () => {
 			// Trusted plugins
 			if (this.hooks.hasHooks(name)) {
 				try {
@@ -4157,52 +5628,160 @@ export class EmDashRuntime {
 					console.error(`EmDash ${label} hook error:`, err);
 				}
 			}
+		};
+		const contentId = typeof content.id === "string" ? content.id : undefined;
+		const guardKey =
+			afterPluginId && contentId ? this.pluginContentActionKey(collection, contentId) : undefined;
+		const invokeWithGuard = async () => {
+			if (guardKey) this.retainPluginContentAction(guardKey);
+			try {
+				await invoke();
+			} finally {
+				if (guardKey) this.releasePluginContentAction(guardKey);
+			}
+		};
+		if (afterPluginId && pluginInvocationId && this.findSandboxedPlugin(afterPluginId)) {
+			const key = this.pluginInvocationKey(afterPluginId, pluginInvocationId);
+			if (!this.activePluginInvocations.has(key) || this.releasedPluginInvocations.has(key)) {
+				after(invokeWithGuard);
+				return;
+			}
+			const pending = this.pendingPluginAfterHooks.get(key) ?? [];
+			pending.push(invokeWithGuard);
+			this.pendingPluginAfterHooks.set(key, pending);
+			return;
+		}
+		after(invokeWithGuard);
+	}
 
-			// Sandboxed plugins
-			const tasks: Promise<void>[] = [];
-			for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-				const [pluginId] = pluginKey.split(":");
-				if (!pluginId || !this.isPluginEnabled(pluginId)) continue;
+	private pluginInvocationKey(pluginId: string, invocationId: string): string {
+		return JSON.stringify([pluginId, invocationId]);
+	}
 
-				tasks.push(
-					(async () => {
-						try {
-							await plugin.invokeHook(name, { content, collection });
-						} catch (err) {
-							console.error(`EmDash: Sandboxed plugin ${pluginId} ${label} error:`, err);
-						}
-					})(),
-				);
-			}
-			await Promise.allSettled(tasks);
-		});
+	private beginPluginInvocation(
+		pluginId: string,
+		invocationId: string,
+		invalidateContentCache?: PluginContentCacheInvalidator,
+	): void {
+		const key = this.pluginInvocationKey(pluginId, invocationId);
+		this.pendingPluginAfterHooks.delete(key);
+		this.releasedPluginInvocations.delete(key);
+		if (invalidateContentCache)
+			this.pluginInvocationCacheInvalidators.set(key, invalidateContentCache);
+		else this.pluginInvocationCacheInvalidators.delete(key);
+		this.activePluginInvocations.add(key);
+	}
+
+	private flushPluginAfterHooks(
+		pluginId: string,
+		invocationId?: string,
+		final = true,
+	): Promise<void> {
+		if (!invocationId) return Promise.resolve();
+		const key = this.pluginInvocationKey(pluginId, invocationId);
+		this.releasedPluginInvocations.add(key);
+		const pending = this.pendingPluginAfterHooks.get(key) ?? [];
+		this.pendingPluginAfterHooks.delete(key);
+		for (const invoke of pending) after(invoke);
+		if (final) {
+			this.releasedPluginInvocations.delete(key);
+			this.activePluginInvocations.delete(key);
+			this.pluginInvocationCacheInvalidators.delete(key);
+		} else {
+			const timer = setTimeout(() => {
+				this.releasedPluginInvocations.delete(key);
+				this.activePluginInvocations.delete(key);
+				this.pluginInvocationCacheInvalidators.delete(key);
+			}, PLUGIN_INVOCATION_RELEASE_GRACE_MS);
+			if (typeof timer === "object") timer.unref();
+		}
+		return Promise.resolve();
 	}
 
-	private runAfterPublishHooks(content: Record<string, unknown>, collection: string): void {
-		this.runDeferredContentHook("content:afterPublish", content, collection);
+	private runAfterPublishHooks(
+		content: Record<string, unknown>,
+		collection: string,
+		afterPluginId?: string,
+		pluginInvocationId?: string,
+	): void {
+		this.runDeferredContentHook(
+			"content:afterPublish",
+			content,
+			collection,
+			afterPluginId,
+			pluginInvocationId,
+		);
 	}
 
-	private runAfterUnpublishHooks(content: Record<string, unknown>, collection: string): void {
-		this.runDeferredContentHook("content:afterUnpublish", content, collection);
+	private runAfterUnpublishHooks(
+		content: Record<string, unknown>,
+		collection: string,
+		afterPluginId?: string,
+		pluginInvocationId?: string,
+	): void {
+		this.runDeferredContentHook(
+			"content:afterUnpublish",
+			content,
+			collection,
+			afterPluginId,
+			pluginInvocationId,
+		);
 	}
 
-	private runAfterRestoreHooks(content: Record<string, unknown>, collection: string): void {
-		this.runDeferredContentHook("content:afterRestore", content, collection);
+	private runAfterRestoreHooks(
+		content: Record<string, unknown>,
+		collection: string,
+		afterPluginId?: string,
+		pluginInvocationId?: string,
+	): void {
+		this.runDeferredContentHook(
+			"content:afterRestore",
+			content,
+			collection,
+			afterPluginId,
+			pluginInvocationId,
+		);
 	}
 
-	private runAfterScheduleHooks(content: Record<string, unknown>, collection: string): void {
-		this.runDeferredContentHook("content:afterSchedule", content, collection);
+	private runAfterScheduleHooks(
+		content: Record<string, unknown>,
+		collection: string,
+		afterPluginId?: string,
+		pluginInvocationId?: string,
+	): void {
+		this.runDeferredContentHook(
+			"content:afterSchedule",
+			content,
+			collection,
+			afterPluginId,
+			pluginInvocationId,
+		);
 	}
 
-	private runAfterUnscheduleHooks(content: Record<string, unknown>, collection: string): void {
-		this.runDeferredContentHook("content:afterUnschedule", content, collection);
+	private runAfterUnscheduleHooks(
+		content: Record<string, unknown>,
+		collection: string,
+		afterPluginId?: string,
+		pluginInvocationId?: string,
+	): void {
+		this.runDeferredContentHook(
+			"content:afterUnschedule",
+			content,
+			collection,
+			afterPluginId,
+			pluginInvocationId,
+		);
 	}
 
 	private async handleSandboxedRoute(
 		plugin: SandboxedPluginInstance,
 		path: string,
 		request: Request,
+		body: unknown,
+		routeMeta: RouteMeta,
 		user?: UserInfo,
+		ui?: PluginUiContext,
+		invalidateContentCache?: PluginContentCacheInvalidator,
 	): Promise<{
 		success: boolean;
 		data?: unknown;
@@ -4211,21 +5790,32 @@ export class EmDashRuntime {
 	}> {
 		const routeName = path.replace(LEADING_SLASH_PATTERN, "");
 
-		// Body methods parse JSON; GET/HEAD/DELETE parse the query string (#2146).
-		const body = await parseRouteInput(request);
-
 		try {
-			const headers = sanitizeHeadersForSandbox(request.headers);
+			const declaredHeaders = routeMeta.request ? (routeMeta.request.headers ?? []) : undefined;
+			const headers = sanitizeHeadersForSandbox(request.headers, declaredHeaders);
 			const meta = extractRequestMeta(request, this.config);
-			const result = await plugin.invokeRoute(routeName, body, {
-				url: request.url,
-				method: request.method,
-				headers,
-				meta,
-				user,
-			});
+			const result = await plugin.invokeRoute(
+				routeName,
+				body,
+				{
+					url: request.url,
+					method: request.method,
+					headers,
+					meta,
+					user,
+					ui,
+				},
+				{ invalidateContentCache },
+			);
 			return { success: true, data: result };
 		} catch (error) {
+			if (error instanceof PluginRouteRequestError) {
+				return {
+					success: false,
+					status: error.status,
+					error: { code: "INVALID_PLUGIN_REQUEST", message: error.message },
+				};
+			}
 			console.error(`EmDash: Sandboxed plugin route error:`, error);
 			const sandboxRouteError = getSandboxRouteErrorDetails(error);
 			if (sandboxRouteError) {
@@ -4292,26 +5882,6 @@ export class EmDashRuntime {
 			}
 		}
 
-		// Sandboxed plugins — metadata only, never fragments
-		for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-			const [id] = pluginKey.split(":");
-			if (!id || !this.isPluginEnabled(id)) continue;
-
-			try {
-				const result = await plugin.invokeHook("page:metadata", { page });
-				if (result != null) {
-					const items = Array.isArray(result) ? result : [result];
-					for (const item of items) {
-						if (isValidMetadataContribution(item)) {
-							metadata.push(item);
-						}
-					}
-				}
-			} catch (error) {
-				console.error(`EmDash: Sandboxed plugin ${id} page:metadata error:`, error);
-			}
-		}
-
 		return { metadata, fragments };
 	}