diff --git a/.agents/notes/implemented/architecture/2026-10-22-windows-declarative-plugin-host.md b/.agents/notes/implemented/architecture/2026-10-22-windows-declarative-plugin-host.md
new file mode 100644
index 0000000000..14cca53000
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-22-windows-declarative-plugin-host.md
@@ -0,0 +1,149 @@
+# Agent 笔记：Windows 声明式插件宿主
+
+状态：已实现
+
+## 先说结论
+
+Windows 新增一套契约 v1 声明式插件宿主，与现有 Worker 扩展模型长期并行：需要宿主代用户拉起进程的语言与构建插件走契约宿主，宿主内运行 UI 与服务行为的扩展（主题、AI provider 等）留在 Worker 模型。契约引擎不需要新写——`lithe-core` 已经编译进 Windows 宿主，经 `core_execute` 就能调用 `plugins.declarative.*` 与 `plugins.marketplace.*`。M1 已落地：包存储、启动扫描与隔离、语言服务器启动计划解析，以及共享 fixtures 的全量验收；M2 已补磁盘导入安装链、设置内独立管理页和 runtime 启动的 `minimumVersion` 探测；M3 已补声明式设置、运行/测试计划命令与契约版 PHP bundled 包；M4 已补 Web 工具窗口（`lithe-plugin://` scheme、CSP、`window.lithe` 桥 v0）。能力声明开放 `languages:1`、`languageServers:[1,2]`、`serverProcess:1`、`settings:[1,2]`、`ui:[1,2]`，其余能力（`executionProviders`、`buildProviders`、`buildSystems`）仍由 Core 自动拒绝。
+
+## 问题
+
+- 功能矩阵 `declarative-plugin-contract`、`plugin-functions` 对 Windows 记为 missing（2026-10-22 矩阵对齐时确认）；[声明式语言插件](2026-10-12-declarative-language-plugins.md) 也写明"Windows 现有扩展清单暂未改造，接入时必须通过同一组 fixture"。
+- Windows 当前插件生态是渲染进程内的 Worker 扩展：`Plugins/win/Official/PhpSupport` 是 Worker 包格式（`main: "plugin.js"`），与契约包不同，无法复用 Lithe Store 面向 macOS/契约发布的语言插件包。
+- Windows 没有插件信任链与仓库源管理；`install_extension_from_url` 前端已调用但 Rust 宿主从未注册，非语言扩展的落盘安装链路实际不可用。
+- 契约的确定性逻辑（清单校验、启动计划展开、安装审查）按仓库规则只在 `rust/lithe-core/src/plugins/` 实现一次，而 `windows/tauri/src-tauri` 已依赖 `lithe-core`——差的只是宿主侧接线，不是契约本身。
+
+## 决策
+
+### 双模型边界
+
+判定句：扩展需要"宿主代表用户拉起进程"（语言服务器、构建系统、运行/测试提供方）就走契约宿主；扩展需要"在宿主内运行自己的代码来表达 UI 或服务行为"（颜色主题、图标主题、AI provider、数据库 sidecar、ACP agent）就留在 Worker 模型。
+
+- 正确做法：新增 Go 语言支持时写契约 `plugin.json` 声明 `languageServers` 和 `executionProviders`，由 Core 展开启动与运行计划。
+- 不要这样做：把主题扩展改写成契约包；为 Worker 扩展桥接一套函数通道冒充 litheFunctions；在宿主里按插件 ID 写 `if` 分支。
+
+### 能力声明渐进开放
+
+宿主在 `plugins.declarative.validate` 的 payload 里声明 `hostCapabilities = { languages:[1], languageServers:[1,2], serverProcess:[1], settings:[1,2], ui:[1,2] }`。Core 的 `capabilities.rs` 会拒绝声明了宿主未开放能力的插件，宿主不需要自己写拒绝逻辑。M3 已把 `languageServers` 与 `settings` 提到 2，注册设置页并下推 `workspaceConfiguration`；M4 已增 `ui:[1,2]`。`executionProviders`、`buildProviders` 与 `buildSystems` 仍未开放，运行/测试计划命令的存在不代表这些插件能力可安装。宿主不声明的能力，市场侧按不支持展示。
+
+### 存储、信任与安装（v0）
+
+- 安装根为 `app_local_data_dir()/plugins/<pluginID>/<version>/`，`installation.json` 记录版本与启用状态；记录缺失或损坏的包隔离展示，绝不静默加载。
+- bundled 包从 `resource_dir()/OfficialPlugins` 只读加载，多版本目录取最高版本；运行时不写安装目录与资源目录，遵守发行基线只读边界。
+- 每个插件的语言服务器状态目录在 `app_local_data_dir()/plugin-state/<pluginID>/<workspace 哈希>`，由宿主注入启动计划请求。
+- 信任模型 v0：官方 ID 防冒用由 Core 校验兜底；bundled 包随安装器分发；磁盘导入（已落地）与市场下载（M3+）一律走 `plugins.marketplace.installReview` 全量审批（权限 + 完整程序清单），审批界面明示"未认证发布者"。publisher Ed25519 验签明确延后，这是 v0 的已知缺口，Windows 验签方案（Authenticode 还是包内 Ed25519）单独立项评估。
+- 磁盘导入的私有快照、staging 重验、内容摘要复查与回滚语义照抄 macOS 侧规则（见声明式语言插件 Note 的磁盘安装节），Windows 不另造审查语义。
+
+### 启动接线（M1 落地形状）
+
+- `plugin_host` 模块（`store.rs` 存储布局、`scan.rs` 扫描与校验、`launch.rs` 启动计划解析）是宿主侧唯一入口；校验与计划展开全部经 `lithe_core::execute_json` 调 Core 命令，宿主不复制任何清单语义。
+- `packaged` 启动入口解析后必须是包内普通文件：拒绝 reparse point（符号链接与 junction）与规范化后的路径逃逸，这是宿主执行每个启动前的统一闸门。
+- `runtime` 与 `systemCommand` 启动经 PATH 探测（复用 `language_tools` 的系统工具查找），并按 macOS 同一约定导出 `LITHE_<TOOL>_PATH`、把 packaged runtime 目录前置到 `PATH`；`minimumVersion` 探测随 M2 安装链一起接入。
+- 语言服务器进程仍由共享 Core 的 `lsp.startServer` 拉起：前端 `resolve-editor-lsp-launch.ts` 在 Worker 扩展清单没有对应服务器时，回落到 `declarative_plugins_language_launch`（契约插件排在 Worker 之后，已由 Worker 声明的语言保持现状，直到 M3 包迁移）。
+- 启动扫描在应用 bootstrap 的 "declarative plugins" 步骤执行一次；扫描结果缓存在 Tauri state，前端经 `declarative_plugins_state` 只读消费。
+
+### 网页与版本探测的运行边界
+
+Tauri 把插件自定义协议页面视为远端来源，空 capability 会在进入 Rust handler 前拒绝所有 IPC。宿主采用 Tauri 官方 inlined plugin（应用内命令插件）扩展点：`declarative-web` 命名空间只声明一个 `request` 权限，仅匹配 `plugin-web-*` 窗口和 `http://lithe-plugin.*/*` 来源；不授予 fs/http/event 等命令，也不启用会改变全部主窗口命令的 app ACL。编译后的 Tauri authority 回归验证这条边界，不能用只检查 handler 的测试代替。
+
+插件网页的窗口标签只用于定位所属包，不能单独证明当前文档可信。`web.rs` 使用 Tauri 的导航、新窗口和下载拦截器，只允许本包来源；每次桥接请求还读取 WebView 当前 URL，再核对插件来源、启用状态和窗口声明。宿主脚本也只在本包主框架定义桥，窗口使用非持久浏览会话，避免外站文档继承桥或页面存储。例如本包的 `ui/next.html` 可以导航，`https://example.com`、另一个插件的来源、带用户信息或端口的地址会被拒绝；不要用 CSP 或窗口标签代替导航与请求来源检查。
+
+WebView2 的 NavigationStarting 可以阻止外站文档提交，但实测外站服务器仍可能先收到 GET。因此 `web_network.rs` 使用微软的 WebResourceRequested 接口，在请求层把非本包、非 Tauri IPC 的网络请求完成为本地 403。窗口先创建为惰性空白页，五秒期限内安装过滤器成功后才导航到包页面；失败时销毁空白窗口，不能留下可运行但未受保护的页面。Wry 只在初次创建时转换自定义协议，延迟 navigate 必须显式使用同一 http://lithe-plugin.<插件 ID>/ 映射地址，否则页面会停在空白文档；这个地址构造和来源检查共用同一回归。注册跟随 WebView 的生命周期，不在页面每次加载时叠加。复用 Wry 已依赖的 webview2-com 0.38.2 API，独立声明同一固定版本，没有新增另一套浏览器或网络后端。
+
+`workspace.openFile` 必须先经原生文件系统解析真实目标，再检查它仍在同样经过解析的工作区根内。前端把这个目标交给既有文件打开入口，保留行列位置，并在等待解析后复查工作区有没有切换。工作区内指向内部文件的链接可以打开，指向外部目录的 junction（Windows 的目录联接）不能借路径文本绕过检查。不能仅比较 `C:/work/link/file.txt` 的文本前缀。
+
+网页的语言、浅色或深色状态、颜色和字体变量从已解析的 Windows 工作台主题取得。主窗口创建页面时传入初值，主题注册表与设置的订阅把后续变化送到原生页面；根元素的 `data-theme`、`--lithe-*` 变量和只读 `lithe.context` 随之更新，再发 `ui.themeChanged`。每个 HTML 响应会在插件脚本前加载一个保留路径下的宿主同源外部脚本，由原生协议 handler 按可信窗口标签读取最新快照；因此页面重载、同包导航和带 UTF-8 BOM 的页面在运行插件代码前也能取得当前主题，HTML parser 已创建根元素。宿主脚本插在真实 head 起始标签后；省略 head 时退到 html 后，两者都省略时放在文档声明之后。扫描仅处理 HTML 前导区，跳过注释并识别带引号的属性，保留原有根样式、head 属性、BOM 和文档模式。这种响应字节插入不改包文件，也不给 CSP 增加内联脚本例外。订阅随 bootstrap 清理，不在插件内复制另一套主题值。
+
+版本探测复用 `lithe_git_host::run` 的原生进程执行器。虽然它位于 Git adapter crate，其进程树、非阻塞管道与清理能力不解释 Git 参数；探测只设置五秒取消期限和每条输出流 64 KiB 上限，解析仍交 Core。Windows 在进程运行第一条指令之前把它放入 Job Object（内核管理的进程组），因此父进程退出后仍占用 stdout 的后代也会被清理。不要只给 `try_wait` 加超时后无期限 `join` 读取线程，也不要靠退出后遍历父 PID 找后代。代价是异常进程退出后最多还需执行器自身的有界清理时间。
+
+### 禁用、替换和卸载必须先收回使用权
+
+插件包正在执行时直接删目录，会在 Windows 上遇到可执行文件被占用，并可能只删掉一部分文件。因此所有启停、安装替换、回滚和卸载先经过 `lifecycle.rs`：禁止新的原生启动计划和网页读取，等待已经开始的版本探测、校验进程、网页创建和资源读取退出，再关闭所有所属页面，并要求每个产品窗口确认其运行与 Core LSP 会话都已停止。原生使用计数和禁止新请求共用锁，避免刚检查完就漏进新的操作；等待原生使用者和窗口确认各有 45 秒上限。失败时保留包文件并继续禁止使用，用户重试管理操作后才能恢复。
+
+前端在调用第一个异步操作前登记启动归属。停止操作必须覆盖已启动和正在等待 Core 响应的会话；晚到的会话先停止、再拒绝返回。停止失败的会话仍留在登记表中，后续管理操作必须继续等它，不能误报没有进程。包目录与扫描目录只有在变更和重新扫描都成功后才恢复使用。完整扫描从发现到提交缓存共用一把锁，避免不同插件并发管理时，旧扫描覆盖新目录。
+
+正确做法：先收回新请求、等待所有使用者退出，再修改包；不要发一个不等待结果的停止事件就删除文件。每个窗口只能确认自己的操作，窗口消失算失败，不能假定它的 Core 子进程已经退出。探测与读取沿用既有 `plugin-state` 和包读取路径，没有新增可跨工作树复用的资源；校验命令在平台可写的插件状态目录执行，发行资源保持只读。
+
+### 插件身份、工作区和声明式界面
+
+`pluginId` 是 Core 校验配置更新的插件身份，`providerId` 是语言服务实例的来源，两者必须分别传递和保存。设置的即时生效请求必须带插件 ID，并只发送到仍有效且属于该插件的会话；Java 和 Worker 启动继续使用自己的来源。
+
+每个网页由创建它的产品窗口、工作区和插件共同持有，窗口标签使用无碰撞的编码。状态按这组归属隔离，关闭工作区或禁用插件时清理；工作区关闭会提升该工作区页面的版本，关闭前已发起但尚未注册的页面也不能复活。状态写入与文件打开的登记和撤销共用所有者锁，旧页面实例不能在重新打开后继续写状态；网页不能通过参数自行指定所属工作区。`workspace.openFile` 只发给所属窗口，并等待带操作 ID 的确认。目标窗口在真实路径解析前后都复核当前工作区，复核目标缓冲区确实存在且处于活动状态后才确认成功；共享文件打开函数在读取失败或请求过期时也可能正常返回，不能仅凭其 Promise 完成判断成功；工作区切换、窗口关闭和十秒确认超时都返回失败。待确认请求最多 128 个，避免插件无限积累请求。
+
+启动前检查 Core 的 `requiredPackagePaths`、`runtimeRequirements` 和 `validationArguments`。包资源允许普通目录，但实际可执行入口必须是普通文件；路径逃逸和 reparse point 都拒绝。依赖与发现型启动运行时优先使用用户显式导出，再查系统 PATH；包内 `packagedRuntime` 则严格执行已审批的那个文件，不接受用户覆盖，满足最低版本才继续；校验命令即使输出文本，只要退出码非零仍失败。探测复用现有五秒、每条输出流 64 KiB 的原生执行器和进程树清理能力。
+
+`ui:1` 的文本工具窗口由宿主生成转义后的 HTML，`ui.commands` 接入已有的命令、菜单和工具栏展示注册表，工具窗口也有活动栏入口。复用展示注册表不等于进入 Worker 执行模型。禁用时同步撤销入口，异步刷新按插件检查版本，避免撤销 B 时取消 A 的刷新，防止旧结果恢复入口。目前页面仍是独立 WebView 窗口；声明的停靠位置、图标、动作可用/勾选状态和布局持久化尚未与 macOS 对齐，因此矩阵继续记为 partial，不能称为完整的 ui 1/2 产品形态。
+
+### 与 Worker 扩展模型共存（产品分工）
+
+- 两套模型互不桥接：契约插件不进 Worker 宿主，Worker 扩展不冒充契约能力。
+- PhpSupport 迁移（M3 调整）：契约版 PHP 包（`Plugins/win/Official/PhpSupportContract`，`sameTeamAsHost` bundled）随安装器分发并完成 validate/launch/runPlan 端到端测试，但 Worker 版**保留不移除**。原因：Worker 版提供 composer scripts 的动态运行动作发现（读取工作区 composer.json 生成动作列表），契约 v1 的 `executionProviders` 是静态声明，没有等价能力；删除 Worker 版会丢失用户可见功能。完整迁移等契约补齐动态运行动作后再做。两包并存时 Worker 版优先（Worker 扩展清单先解析），契约包不重复注册语言。
+- `install_extension_from_url` 等 Worker 非语言市场命令（M2 已处置）：在 Rust 宿主注册为显式占位错误（`extensionStore.notAvailable`），调用方得到可诊断的结构化失败而不是"命令不存在"；完整落盘后端是独立工作项，不与契约宿主混淆。
+- 管理界面按模型分组展示两类扩展并使用不同文案，避免用户把 Worker 扩展当成契约插件。
+
+### 实施切分
+
+M1 包存储 + 启动校验 + 语言注册 + LSP 启动（已落地）；M2 磁盘安装链路 + 管理界面 v1 + 死链处置（已落地）；M3 声明式设置 + 运行/测试计划 + PHP 契约包（已落地，Worker 版保留见上文）；M4 Web 工具窗口（已落地，桥 v0 只含 state/openFile/主题，build.* 与 functions.* 等 Windows 构建系统能力接入后开放）。每个里程碑独立 PR，矩阵条目随代码同 PR 更新。总体方向遵循[公共扩展契约与 Provider 接入方向](../../proposed/architecture/2026-10-13-public-extension-contract-and-provider-api.md)，本 Note 只落地其中 Windows 契约宿主的第一阶段。
+
+## 考虑过的备选方案
+
+- 把 Worker 扩展模型整体改造成契约宿主：契约没有主题、AI provider 这些概念，改造成本高且无收益，不采用。
+- 在 Tauri 侧另写一套清单校验：违反"校验只在 Core 实现一次"，共享 fixtures 无法复用，双端语义必然漂移，不采用。
+- 把 Worker RPC 桥接成 litheFunctions：两者协议语义不同，会同时存在两套函数协议，等有真实插件需求时再按[插件函数契约](2026-10-20-plugin-function-contract.md)接入。
+- 信任模型一步到位 publisher 签名：Windows 验签载体需要单独评估，v0 以 bundled 加全量审批兜底，签名延后是显式记录的缺口而不是遗漏。
+- 在 `lsp_start` 一类原生命令里拉起插件服务器：现有 LSP 会话全部由 Core 统一管理（会话、取消、事件泵都在 Core），前端只解析可执行路径与参数；另建原生拉起路径会分裂会话所有权，不采用。
+
+## 后果
+
+- 收益：Windows 用户开始能安装与运行契约 v1 语言插件，语言插件包与 macOS/Lithe Store 同格式；契约验收（同组 fixtures）成为 Windows 持续回归的一部分；后续里程碑只增不改这条链路。
+- 代价：双模型并存是用户可见的复杂度，管理界面必须分组。`minimumVersion`、内容摘要复查与启动前校验已接入；发行者签名仍延后，不能把完整性检查当作发布者身份验证。
+- 已知风险：签名延后意味着 v0 社区包信任完全依赖审批界面（M2），文案必须明示未认证状态；Windows 的 reparse point/junction 语义与 macOS symlink 不完全相同，包内路径逃逸判断已按 Windows 语义单独测试；WebView2 对自定义 scheme 与 CSP 的实现细节与 WKWebView 有差异，`ui:2` 网页链路已用 Windows Release/WebView2 实机验证，停靠、图标、动作状态及布局仍为 partial。
+- M2–M4 里程碑：磁盘/市场安装链路 + 管理界面；声明式设置 + 运行/测试计划 + PHP 契约包替换；Web 工具窗口。每个里程碑独立 PR，能力声明与矩阵条目随代码同 PR 更新。
+
+## 验证
+
+- 多窗口事件投递必须显式指定当前产品窗口的 `Window` target。Tauri 默认 `Any` 监听也接收发给其他 label 的事件，原生 `emit_to(ownerLabel)` 本身不足以隔离接收者；文件请求与生命周期确认均绑定当前窗口，防止其他工作区误处理请求或重复确认。`plugin-lifecycle-listener.test.ts` 检查两类监听的目标。
+- 2026-10-24 Windows Release 实机验收：Playwright/CDP 连接真实 WebView2，测试包安装、ui 1 文本渲染、工作区关闭重开、状态隔离、两个产品窗口归属、主题/语言与重载、过期工作区 openFile 拒绝、双窗口卸载关闭全部插件页均通过；无重复确认异常，外站 HTTP GET 为零，安装包及发行资源哈希不变，应用正常退出。该测试包不替代真实语言服务器的完整安装→启动→即时设置验收，也不覆盖停靠布局。
+- 管理并发回归：`lifecycle.rs` 覆盖原生使用计数排空、禁止晚到获取、逐窗口确认、停止失败、窗口断开和有界超时；`lsp-core-adapter.test.ts` 用可控 Core 响应覆盖停止期间晚到的服务器，断言先停止再拒绝，且 `pluginId` 没有丢失。`plugin-lifecycle-listener.test.ts` 验证收到停用事件立即撤销入口、等待运行和 LSP 两方后才确认。
+- 工作区与界面回归：`web.rs` 覆盖双工作区窗口/状态键隔离和文本转义；`plugin-lifecycle-listener.test.ts` 验证其他工作区请求、路径解析中切换工作区以及成功确认；`workspace-lifecycle.test.ts` 验证关闭工作区时清理网页。`declarative-plugin-ui.test.ts` 用 Hello Lithe fixture 验证文本窗口与命令面板、菜单、工具栏三处贡献及撤销，受控刷新同时覆盖相关与无关插件的撤销。CI 按文件分进程执行插件套件，避免原生命令和事件 mock 跨套件泄漏。
+- 启动计划回归：`launch.rs` 验证必需资源缺失、运行时依赖缺失、目录资源与普通文件入口的区别，以及有输出但非零退出的校验命令。`tests.rs` 还覆盖完整扫描的有序发布，`web.rs` 用有界通道覆盖写入与撤销交错、旧页面实例和旧工作区版本拒绝。Windows Rust 最终计时运行记录 357 项，其中 354 通过、3 项夹具跳过；前端受影响测试分别在隔离进程中运行，报告保存在 `.artifacts/test-stability/`。这些测试不替代双工作区真实 WebView2、真实语言服务器与停靠界面的产品验收。
+
+- 网页隔离与上下文回归：`web.rs` 覆盖同包和外站 URL 的导航/桥接共用检查、真实路径与内部/外部目录链接；Windows 用无需提权的 junction，Unix 用目录符号链接。`plugin-web-appearance.test.ts` 执行原生宿主桥脚本，验证语言、主题、根变量、主题事件与外站不暴露桥；前端文件测试验证原生真实目标传递与拒绝传播。
+- 版本探测回归：`runtime_probe_collects_output_and_rejects_overflow`、`runtime_probe_reclaims_inherited_pipes_after_parent_exit` 使用当前测试二进制作为固定夹具；后者让父进程退出、后代保留管道，断言调用有界结束且后代已退出。测试环境变量仅附加到子进程，不改测试运行器的全局环境。运行 WindowsRust 与 Frontend 计时 harness，检查 `.artifacts/test-stability/index.html`；真实 WebView2 验证还要由本机 HTTP 计数器确认外站 GET 为零，同时检查导航、弹窗/下载、动态主题、包文件和发行目录哈希不变；单凭页面 URL 没变不能证明请求未外发。
+
+- M4 Web 工具窗口：`plugin_host/web.rs` 测试覆盖包路径规范化（`..`、编码分隔符、空段拒绝）、CSP 内容断言（default-src none、无 wasm-unsafe-eval、frame-ancestors none）、桥脚本冻结与作用域、状态键隔离；web-panel fixture 随 `ui:[1,2]` 声明提升转为被宿主接受（能力门控测试同步）。桥 v0 的 build.*/functions.* 返回 `plugin.web.unknownMethod`，等构建系统能力接入。
+
+
+- M3 设置链路：`settings_tests`（`plugin_host/tests.rs`）覆盖项目覆盖往返、其他插件条目保留、损坏 store 报错不重置；能力门控测试随声明提升更新（settings-v2 fixture 被接受）。设置编辑 UI（`declarative-plugin-settings-editor.tsx`）按声明的 scope/effect 渲染并显示值来源徽标。
+- M3 运行计划：契约 PHP 包端到端测试（`bundled_php_contract_package_expands_plans`）走真实 Core 命令验证 validate、runPlan（`${file}`/`${userArguments}` 展开）、testPlan（workspace scope + 项目标记）、resolveSettings。
+
+
+- M2 磁盘导入链测试（`windows/tauri/src-tauri/src/plugin_host/install_tests.rs`）：目录快照隔离（symlink 拒绝）、ZIP 解包与恶意路径（`../` 逃逸条目）拒绝、staging 安装（坏包失败保留现行版本且清空 staging）、回滚版本选择；runtime 启动的版本探测输出解析（node/java/go 真实输出格式）在 `launch.rs` 测试覆盖。
+- 管理界面（`declarative-plugins-section.tsx`）挂在设置的独立一级页，`settings-hierarchy.test.tsx` 的布局断言随导航更新；i18n 提供 en-US 与 zh-CN 全套文案。
+
+
+- 共享 fixtures 全量验收在 Windows 二进制内完成：`invalid-manifests.json` 全部 154 个用例经宿主校验路径断言同一稳定错误码（不带 hostCapabilities 的契约等价模式），合法样例在不带与带 v0 能力声明两种模式下分别断言通过与 `plugin.api.unsupported` 门控。测试入口：`windows/tauri/src-tauri/src/plugin_host/tests.rs`，运行 `cargo test --manifest-path windows/tauri/src-tauri/Cargo.toml plugin_host`。
+- 存储与启动的单测覆盖安装记录缺失/损坏隔离、bundled 最高版本选择、版本比较（含 prerelease）、扩展与文件名匹配（大小写与前导点）、packaged 路径逃逸拒绝、runtime 的 `LITHE_<TOOL>_PATH` 导出与 `PATH` 前置。
+- 前端回落链路测试：`windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.test.ts` 断言契约插件启动映射与无归属文件返回 null；启动扫描步骤在 bootstrap 中执行。
+- M1 尚属静态与进程内验证：真实插件包安装→启用→语言服务器拉起的全链路实机验收随 M2/M3 完成，期间矩阵 `verificationStatus` 保持 pending。`./scripts/verify-windows-boundaries.sh`、`./scripts/verify-platform-feature-matrix-change.sh <base> HEAD` 随 PR 通过。
+
+## 适用范围
+
+- `windows/tauri/src-tauri/build.rs`、`capabilities/plugin-web.json` 与 `permissions/declarative-web/bridge.toml`（应用内桥插件及最小来源权限）
+
+- `windows/tauri/src-tauri/src/plugin_host/`（存储、扫描、启动接线与 fixtures 验收测试）
+- `windows/tauri/src-tauri/src/main.rs`（模块注册与命令注册）
+- `windows/tauri/src-tauri/src/language_tools.rs`（复用的系统工具查找）
+- `windows/tauri/src-tauri/src/plugin_host/install.rs`（磁盘导入、卸载、回滚、启停）
+- `windows/tauri/src-tauri/src/extension_store_placeholder.rs`（Worker 扩展落盘命令的显式占位）
+- `windows/tauri/src/features/plugins/declarative-plugin-launch.ts`（前端宿主 API）
+- `windows/tauri/src-tauri/src/plugin_host/settings.rs`（设置双层存储与命令）
+- `windows/tauri/src-tauri/src/plugin_host/run_plans.rs`（运行/测试计划命令）
+- `windows/tauri/src/features/plugins/declarative-plugin-settings-editor.tsx`（设置编辑）
+- `windows/tauri/src/features/plugins/declarative-plugin-run.ts`（契约插件运行入口）
+- `windows/tauri/src-tauri/src/plugin_host/web.rs`（Web 工具窗口 scheme、桥与状态）
+- `Plugins/win/Official/PhpSupportContract/`（契约版 PHP bundled 包）
+- `windows/tauri/src/features/plugins/declarative-plugins-section.tsx`（设置内管理页）
+- `windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.ts`（契约插件回落来源）
+- `windows/tauri/src/features/bootstrap/bootstrap-async.ts`（启动扫描步骤）
+- `shared/platform-feature-matrix/features/declarative-plugin-contract.json`、`plugin-marketplace.json`、`plugin-extension-management.json`、`declarative-plugin-settings.json`、`php-optional-plugin.json`、`plugin-web-tool-windows.json`
diff --git a/.github/workflows/ci-windows.yml b/.github/workflows/ci-windows.yml
index fdb107170a..5429fc0234 100644
--- a/.github/workflows/ci-windows.yml
+++ b/.github/workflows/ci-windows.yml
@@ -290,6 +290,20 @@ jobs:
           node .agents/skills/write-stable-tests/scripts/run-bun-tests-with-timing.mjs --suite-timeout-ms 60000 --report .artifacts/test-stability/windows-notifications.json -- src/features/notifications
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
+      - name: Test declarative plugin lifecycle and UI
+        shell: pwsh
+        timeout-minutes: 9
+        run: |
+          $runner = ".agents/skills/write-stable-tests/scripts/run-bun-tests-with-timing.mjs"
+          # Native/event and presentation mocks must not leak between suites.
+          $pluginSuites = @('declarative-plugin-lifecycle', 'declarative-plugin-run', 'declarative-plugin-ui', 'plugin-lifecycle-listener', 'plugin-web-open-file', 'plugin-web-appearance')
+          foreach ($suite in $pluginSuites) {
+            node $runner --suite-timeout-ms 60000 --report ".artifacts/test-stability/windows-$suite.json" -- "src/features/plugins/$suite.test.ts"
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          }
+          node $runner --suite-timeout-ms 60000 --report .artifacts/test-stability/windows-plugin-lsp-launch.json -- src/features/editor/lsp/resolve-editor-lsp-launch.test.ts
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
       - name: Test Agent panel and capability gate
         shell: pwsh
         run: node .agents/skills/write-stable-tests/scripts/run-bun-tests-with-timing.mjs --suite-timeout-ms 60000 --report .artifacts/test-stability/windows-agent.json -- src/features/agent src/features/editor/stores/buffer-agent-conversation.test.ts src/utils/markdown-links.test.ts src/config/backend-capabilities.test.ts src/i18n src/features/file-system/utils/file-system-drop-controller.test.ts src/ui/icons.test.tsx
diff --git a/Plugins/win/Official/PhpSupportContract/README.md b/Plugins/win/Official/PhpSupportContract/README.md
new file mode 100644
index 0000000000..5b88d8b49f
--- /dev/null
+++ b/Plugins/win/Official/PhpSupportContract/README.md
@@ -0,0 +1,11 @@
+# PhpSupportContract
+
+契约 v1 形态的 PHP 支持包（bundled 技术验收样本）。它验证 Windows 声明式插件宿主的
+validate → launch plan → run plan 全链路在真实包上可用。
+
+与 Worker 版 PhpSupport（`Plugins/win/Official/PhpSupport`）的关系：两包并存，
+Worker 版优先（语言注册与 composer scripts 动态运行动作仍由它提供）。契约 v1 尚无
+动态运行动作的等价能力，删除 Worker 版会造成功能退化，完整迁移推迟到契约补齐该能力，
+原因记录在 Windows 声明式插件宿主 Note。
+
+`language-server/bin/intelephense.js` 是占位入口；真实分发打包 Intelephense 时替换。
diff --git a/Plugins/win/Official/PhpSupportContract/language-server/bin/intelephense.js b/Plugins/win/Official/PhpSupportContract/language-server/bin/intelephense.js
new file mode 100644
index 0000000000..a355017465
--- /dev/null
+++ b/Plugins/win/Official/PhpSupportContract/language-server/bin/intelephense.js
@@ -0,0 +1 @@
+// Bundled Intelephense entry point; see Plugins/win/README.md.
diff --git a/Plugins/win/Official/PhpSupportContract/plugin.json b/Plugins/win/Official/PhpSupportContract/plugin.json
new file mode 100644
index 0000000000..e4ff37bcfc
--- /dev/null
+++ b/Plugins/win/Official/PhpSupportContract/plugin.json
@@ -0,0 +1,94 @@
+{
+  "schemaVersion": 2,
+  "id": "dev.lithe.plugin.php-support",
+  "displayName": "PHP Support (contract)",
+  "version": "1.0.0",
+  "pluginAPIVersion": 2,
+  "vendor": {
+    "id": "dev.lithe",
+    "displayName": "Lithe",
+    "signatureRequirement": "sameTeamAsHost"
+  },
+  "permissions": [
+    "languageServer.launch",
+    "process.run",
+    "process.test"
+  ],
+  "activationEvents": [
+    "onLanguage:php",
+    "onRun:php",
+    "onTest:php"
+  ],
+  "languages": [
+    {
+      "id": "php",
+      "displayName": "PHP",
+      "fileExtensions": [
+        "php",
+        "phtml"
+      ],
+      "projectFileNames": [
+        "composer.json"
+      ]
+    }
+  ],
+  "languageServers": [
+    {
+      "languageID": "php",
+      "languageIdentifier": "php",
+      "launch": {
+        "kind": "runtime",
+        "tool": "node",
+        "entry": "language-server/bin/intelephense.js"
+      },
+      "arguments": [
+        "--stdio"
+      ]
+    }
+  ],
+  "executionProviders": [
+    {
+      "languageID": "php",
+      "run": {
+        "executable": {
+          "command": "php"
+        },
+        "arguments": [
+          "${file}",
+          "${userArguments}"
+        ]
+      },
+      "test": {
+        "frameworkID": "phpunit",
+        "workspaceLabel": "All PHP Tests",
+        "projectMarkers": [
+          "composer.json",
+          "phpunit.xml",
+          "phpunit.xml.dist"
+        ],
+        "testFilePatterns": [
+          "*test.php"
+        ],
+        "executable": {
+          "command": "php"
+        },
+        "workspaceArguments": [
+          "vendor/bin/phpunit"
+        ],
+        "fileArguments": [
+          "vendor/bin/phpunit",
+          "${file}"
+        ],
+        "testCaseArguments": [
+          "vendor/bin/phpunit",
+          "--filter",
+          "\b${testName:regex}\b",
+          {
+            "value": "${file}",
+            "when": "fileSelected"
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/shared/contracts/plugins/v1/README.md b/shared/contracts/plugins/v1/README.md
index 4cb483051d..c7c02908e4 100644
--- a/shared/contracts/plugins/v1/README.md
+++ b/shared/contracts/plugins/v1/README.md
@@ -1529,8 +1529,11 @@ host's provider requests: once given for a plugin and workspace, it holds
 until the project is closed.
 macOS implements web content with WKWebView and advertises `ui: [1, 2, 3]`
 (including the native controls described below).
-Windows has no WebView2 host yet and still advertises `ui: [1]`, so Core refuses
-`ui` 2 plugins there with `plugin.api.unsupported`.
+Windows implements web content with WebView2 under a plugin-private
+`lithe-plugin://` origin and also advertises `ui: [1, 2]`; its bridge v0
+answers `ui.getState`, `ui.setState`, and `workspace.openFile`, and returns
+`plugin.web.unknownMethod` for `build.*` and `functions.*` until the Windows
+build-system capability lands. Windows does not advertise `ui` 3.
 
 ### Future public extension direction (not implemented in API level 2)
 
diff --git a/shared/i18n/locales/en-US.json b/shared/i18n/locales/en-US.json
index b064b611b1..5c3d1c814a 100644
--- a/shared/i18n/locales/en-US.json
+++ b/shared/i18n/locales/en-US.json
@@ -9095,7 +9095,40 @@
     "windows.whenASessionStarts": "When a session starts",
     "windows.whenATurnEnds": "When a turn ends",
     "windows.whenSubmittingAPrompt": "When submitting a prompt",
-    "windows.whenToRun": "When to run"
+    "windows.whenToRun": "When to run",
+    "run.declarativePlugins": "Declarative plugins",
+    "settings.declarativePlugins.title": "Declarative plugins (contract v1)",
+    "settings.declarativePlugins.description": "Packages that declare processes; the host launches them after an install review. Themes and Worker extensions live in the Extensions browser.",
+    "settings.declarativePlugins.import": "Import package…",
+    "settings.declarativePlugins.reviewTitle": "Install {name} {version}?",
+    "settings.declarativePlugins.unverified": "Unverified publisher: this package has no signature. Its permissions and programs are shown below.",
+    "settings.declarativePlugins.confirmInstall": "Install",
+    "settings.declarativePlugins.programDeclaration": "Program declaration ({count})",
+    "settings.declarativePlugins.empty": "No declarative plugins installed.",
+    "settings.declarativePlugins.toggle": "Enable or disable {name}",
+    "settings.declarativePlugins.rollback": "Roll back",
+    "settings.declarativePlugins.uninstall": "Uninstall",
+    "settings.declarativePlugins.source.bundled": "bundled",
+    "settings.declarativePlugins.source.installed": "installed",
+    "settings.declarativePlugins.settings": "Settings",
+    "settings.declarativePlugins.webWindows": "Web tool windows",
+    "settings.declarativePlugins.openWindow": "Open",
+    "settings.declarativePlugins.closeWindow": "Close",
+    "settings.declarativePlugins.placement.left": "left",
+    "settings.declarativePlugins.placement.right": "right",
+    "settings.declarativePlugins.placement.bottom": "bottom",
+    "settings.declarativePlugins.showSettings": "Settings…",
+    "settings.declarativePlugins.hideSettings": "Hide settings",
+    "settings.declarativePlugins.settingsUnavailable": "This plugin's settings could not be resolved.",
+    "settings.declarativePlugins.settingSource.default": "default",
+    "settings.declarativePlugins.settingSource.global": "user value",
+    "settings.declarativePlugins.settingSource.project": "project override",
+    "settings.declarativePlugins.settingScope.global": "all workspaces",
+    "settings.declarativePlugins.settingScope.project": "this workspace",
+    "settings.declarativePlugins.settingEffect.restart": "takes effect after the language server restarts",
+    "settings.declarativePlugins.settingEffect.immediate": "applied to the running language server",
+    "settings.declarativePlugins.settingEffect.reload": "takes effect when the plugin model reloads",
+    "settings.declarativePlugins.settingEffect.nextRun": "takes effect on the next run"
   },
   "overrides": {
     "windows": {
diff --git a/shared/i18n/locales/zh-CN.json b/shared/i18n/locales/zh-CN.json
index 129b8adb09..04050bc172 100644
--- a/shared/i18n/locales/zh-CN.json
+++ b/shared/i18n/locales/zh-CN.json
@@ -9095,7 +9095,40 @@
     "windows.whenASessionStarts": "会话开始时",
     "windows.whenATurnEnds": "一轮结束时",
     "windows.whenSubmittingAPrompt": "提交提示词时",
-    "windows.whenToRun": "何时运行"
+    "windows.whenToRun": "何时运行",
+    "run.declarativePlugins": "声明式插件",
+    "settings.declarativePlugins.title": "声明式插件（契约 v1）",
+    "settings.declarativePlugins.description": "以声明方式提供进程的插件包，宿主在安装审查后代为拉起。主题与 Worker 扩展请在扩展浏览器中管理。",
+    "settings.declarativePlugins.import": "导入包…",
+    "settings.declarativePlugins.reviewTitle": "安装 {name} {version}？",
+    "settings.declarativePlugins.unverified": "未认证发布者：该包没有签名。其权限与程序声明如下。",
+    "settings.declarativePlugins.confirmInstall": "安装",
+    "settings.declarativePlugins.programDeclaration": "程序声明（{count} 项）",
+    "settings.declarativePlugins.empty": "尚未安装声明式插件。",
+    "settings.declarativePlugins.toggle": "启用或停用 {name}",
+    "settings.declarativePlugins.rollback": "回滚",
+    "settings.declarativePlugins.uninstall": "卸载",
+    "settings.declarativePlugins.source.bundled": "内置",
+    "settings.declarativePlugins.source.installed": "已安装",
+    "settings.declarativePlugins.settings": "设置",
+    "settings.declarativePlugins.webWindows": "Web 工具窗口",
+    "settings.declarativePlugins.openWindow": "打开",
+    "settings.declarativePlugins.closeWindow": "关闭",
+    "settings.declarativePlugins.placement.left": "左侧",
+    "settings.declarativePlugins.placement.right": "右侧",
+    "settings.declarativePlugins.placement.bottom": "底部",
+    "settings.declarativePlugins.showSettings": "设置…",
+    "settings.declarativePlugins.hideSettings": "收起设置",
+    "settings.declarativePlugins.settingsUnavailable": "无法解析该插件的设置。",
+    "settings.declarativePlugins.settingSource.default": "默认",
+    "settings.declarativePlugins.settingSource.global": "用户值",
+    "settings.declarativePlugins.settingSource.project": "项目覆盖",
+    "settings.declarativePlugins.settingScope.global": "所有工作区",
+    "settings.declarativePlugins.settingScope.project": "当前工作区",
+    "settings.declarativePlugins.settingEffect.restart": "语言服务器重启后生效",
+    "settings.declarativePlugins.settingEffect.immediate": "立即应用到运行中的语言服务器",
+    "settings.declarativePlugins.settingEffect.reload": "插件模型重新加载后生效",
+    "settings.declarativePlugins.settingEffect.nextRun": "下次运行生效"
   },
   "overrides": {
     "macos": {
diff --git a/shared/i18n/messages.json b/shared/i18n/messages.json
index 9e15b12dae..d0197945af 100644
--- a/shared/i18n/messages.json
+++ b/shared/i18n/messages.json
@@ -84539,6 +84539,247 @@
         "key": "When to run"
       }
     },
+    {
+      "id": "run.declarativePlugins",
+      "description": "Windows declarative plugin UI: run.declarativePlugins",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.title",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.title",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.description",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.description",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.import",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.import",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.reviewTitle",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.reviewTitle",
+      "platforms": [
+        "windows"
+      ],
+      "parameters": {
+        "name": "string",
+        "version": "string"
+      }
+    },
+    {
+      "id": "settings.declarativePlugins.unverified",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.unverified",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.confirmInstall",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.confirmInstall",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.programDeclaration",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.programDeclaration",
+      "platforms": [
+        "windows"
+      ],
+      "parameters": {
+        "count": "integer"
+      }
+    },
+    {
+      "id": "settings.declarativePlugins.empty",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.empty",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.toggle",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.toggle",
+      "platforms": [
+        "windows"
+      ],
+      "parameters": {
+        "name": "string"
+      }
+    },
+    {
+      "id": "settings.declarativePlugins.rollback",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.rollback",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.uninstall",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.uninstall",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.source.bundled",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.source.bundled",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.source.installed",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.source.installed",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settings",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settings",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.webWindows",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.webWindows",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.openWindow",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.openWindow",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.closeWindow",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.closeWindow",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.placement.left",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.placement.left",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.placement.right",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.placement.right",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.placement.bottom",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.placement.bottom",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.showSettings",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.showSettings",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.hideSettings",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.hideSettings",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settingsUnavailable",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settingsUnavailable",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settingSource.default",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settingSource.default",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settingSource.global",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settingSource.global",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settingSource.project",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settingSource.project",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settingScope.global",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settingScope.global",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settingScope.project",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settingScope.project",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settingEffect.restart",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settingEffect.restart",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settingEffect.immediate",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settingEffect.immediate",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settingEffect.reload",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settingEffect.reload",
+      "platforms": [
+        "windows"
+      ]
+    },
+    {
+      "id": "settings.declarativePlugins.settingEffect.nextRun",
+      "description": "Windows declarative plugin UI: settings.declarativePlugins.settingEffect.nextRun",
+      "platforms": [
+        "windows"
+      ]
+    },
     {
       "id": "native.agentAccounts",
       "description": "Native UI: Subscription accounts",
diff --git a/shared/platform-feature-matrix/features/declarative-plugin-contract.json b/shared/platform-feature-matrix/features/declarative-plugin-contract.json
index 39656a25da..a23d456e39 100644
--- a/shared/platform-feature-matrix/features/declarative-plugin-contract.json
+++ b/shared/platform-feature-matrix/features/declarative-plugin-contract.json
@@ -29,12 +29,31 @@
   },
   "windows": {
     "evidence": [
-      "shared/contracts/plugins/v1/README.md",
-      "Plugins/win/Official/PhpSupport/plugin.json"
+      "windows/tauri/src-tauri/src/plugin_host/mod.rs",
+      "windows/tauri/src-tauri/src/plugin_host/store.rs",
+      "windows/tauri/src-tauri/src/plugin_host/scan.rs",
+      "windows/tauri/src-tauri/src/plugin_host/launch.rs",
+      "windows/tauri/src-tauri/src/plugin_host/tests.rs",
+      "windows/tauri/src-tauri/src/plugin_host/install.rs",
+      "windows/tauri/src-tauri/src/plugin_host/settings.rs",
+      "windows/tauri/src-tauri/src/plugin_host/run_plans.rs",
+      "Plugins/win/Official/PhpSupportContract/plugin.json",
+      "windows/tauri/src-tauri/src/plugin_host/web.rs",
+      "windows/tauri/src/features/plugins/declarative-plugins-section.tsx",
+      "windows/tauri/src/features/plugins/declarative-plugin-launch.ts",
+      "windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.ts",
+      "shared/contracts/plugins/v1/fixtures/invalid-manifests.json",
+      "shared/i18n/messages.json",
+      "windows/tauri/src/i18n/shared-i18n.test.ts",
+      "windows/tauri/src-tauri/src/plugin_host/lifecycle.rs",
+      "windows/tauri/src/features/plugins/declarative-plugin-ui.ts",
+      "windows/tauri/src/features/plugins/declarative-plugin-ui.test.ts",
+      "windows/tauri/src/platform/lsp-core-adapter.test.ts"
     ],
     "implementationStatus": "partial",
     "verificationStatus": "pending"
   },
   "owner": "Extensions",
-  "verification": "API 3 共享契约：cargo test -p lithe-core --lib community_build_plugins、cargo test -p lithe-core --lib build_systems、cargo test -p lithe-core --lib declarative_plugins 及 scripts/verify-shared-contracts.sh，覆盖真实 Maven/Gradle 输出、构建 icon/presentation/category、build.languageImport 的插件选项映射和 ui 2 包内网页清单。Core 校验通过不代表平台宿主已实现；macOS 原生窗口/JDT 接线与可选 WKWebView 分别验收后才由宿主声明对应能力，Windows 仍待接入。macOS：安装 shared/contracts/plugins/v1/fixtures/invalid-manifests.json 中每类错误的包，确认插件管理显示对应错误且不注册模块；合法包启用、禁用无需重启；包内声明的语言服务器可执行文件缺失或为符号链接时拒绝安装；启动后 app bundle 文件清单不变（scripts/verify-runtime-bundle-immutability.sh）。API 2：安装 fixtures 中 node-runtime 形态的包，确认宿主发现满足最低版本的 node 并用它启动入口文件，版本过低的候选不被使用；语言服务器的状态写在 <app-support>/Lithe/PluginState 下而不是插件包内，卸载后该目录被删除。宿主能力：声明语言但未在 hostIntegration.capabilities 中列出运行、测试或调试、也未提供执行提供方的包，对应入口不可用且宿主不运行内置工具；列出后对应入口恢复。Windows：现有扩展清单尚未改为读取该契约，接入时必须通过同一组共享 fixture。 macOS API level 2：安装 Hello Lithe 数据包，确认工具窗口、命令面板、工具栏和菜单通过相同注册表显示；移动数据库与插件窗口、隐藏入口及重排后重启恢复；禁用插件后窗口和命令消失，重新启用保留位置与排序；无第三方原生代码载入。Windows UI adapter 未实现，不能用共享校验通过代替界面验收。 回归：声明与内置/应用动作冲突的合法包在启动时隔离并显示错误；正常退出保留已保存的窗口展开状态，用户主动隐藏才更新该状态；Agent 未启用时可移至底部并恢复入口；首次通过菜单打开 Services 会按需激活数据库。 macOS 图标：宿主语义 ID 与包内 SVG/PNG 在窗口入口、标题栏、工具栏、菜单和命令面板显示；模板着色与品牌原色、亮暗变体、选中/悬停/禁用沿用宿主规范；拒绝未知图标 ID、样式覆盖、包外路径、符号链接、脚本和外部引用；验证资源字节与 bundle 文件清单不变。 原生回归覆盖真实注册窗口标题栏、主工具栏活动/禁用状态、命令面板键盘选择及同一窗口亮→暗→亮切换；品牌图标不随选中着色，模板图标使用宿主选中文字颜色。 macOS 动作状态：确认窗口入口、工具栏、菜单与命令面板共用可用和勾选状态，激活中命令禁用且 Enter/鼠标均不能触发，窗口入口允许取消；同时打开同一插件的两个窗口只构造一次模块，取消其中一个不影响另一个；激活中禁用再启用，确认无资源残留或晚到贡献，旧动作引用不绕过状态校验。 API level 2 工具窗口初始位置接受 left/bottom/right，Rust 校验、macOS 解码及首次显示位置一致，用户保存布局仍覆盖默认声明。"
+  "notes": "Windows 宿主 v0 已接入契约 v1 的语言与语言服务器链路：plugin_host 模块负责包存储（app_local_data_dir 下的 plugins 与 plugin-state，bundled 从资源目录只读加载）、启动扫描（经 plugins.declarative.validate 携带 hostCapabilities {languages:1, languageServers:[1,2], serverProcess:1, settings:[1,2], ui:[1,2]}，拒绝的包隔离并展示原因）、启动计划解析（packaged 入口固定在包内且拒绝 reparse point 与路径逃逸，runtime/systemCommand 走 PATH 与 LITHE_<TOOL>_PATH 约定），语言服务器会话仍由共享 Core 的 lsp.startServer 拉起；shared fixtures 的 invalid-manifests.json 全部 154 个用例在 Windows 二进制内断言同一稳定错误码。M2 已补磁盘安装链（快照、installReview 审批、staging、回滚）与最小管理界面；M3 已补声明式设置（settings/languageServers 2 能力声明，全局+项目级存储，immediate 效果经 workspaceConfiguration 下推）、运行/测试计划命令与契约版 PHP bundled 包（随安装器分发，validate/launch/runPlan 端到端测试覆盖）。M4 已补 Web 工具窗口（ui 能力声明提升为 [1,2]）：lithe-plugin:// scheme 只服务启用包内普通文件（拒 reparse point、路径逃逸、超 16MiB），响应带 CSP（default-src none、拒 eval/联网/frame）与 nosniff/no-store；window.lithe 桥 v0 提供 context、ui.getState/setState（宿主持有，64KiB 上限）、workspace.openFile 与主题事件，build.*/functions.* 在 Windows 构建系统能力接入前返回 plugin.web.unknownMethod。尚未实现：Worker 扩展清单向契约迁移（Worker 版 PHP 提供 composer scripts 动态运行动作，契约无等价能力，完整迁移推迟；见 Note）、构建系统插件能力与多仓库源市场。决策与切分见 .agents/notes/implemented/architecture/2026-10-22-windows-declarative-plugin-host.md。 后续安全修复已补插件身份传递、运行中和待启动会话排空、跨窗口包变更确认、完整启动前检查及 ui 1 文本/命令入口；目前 WebView 仍为独立窗口，停靠位置、图标、动作状态及布局持久化未完成。",
+  "verification": "API 3 共享契约：cargo test -p lithe-core --lib community_build_plugins、cargo test -p lithe-core --lib build_systems、cargo test -p lithe-core --lib declarative_plugins 及 scripts/verify-shared-contracts.sh，覆盖真实 Maven/Gradle 输出、构建 icon/presentation/category、build.languageImport 的插件选项映射和 ui 2 包内网页清单。Core 校验通过不代表平台宿主已实现；macOS 原生窗口/JDT 接线与可选 WKWebView 分别验收后才由宿主声明对应能力，Windows 仍待接入。macOS：安装 shared/contracts/plugins/v1/fixtures/invalid-manifests.json 中每类错误的包，确认插件管理显示对应错误且不注册模块；合法包启用、禁用无需重启；包内声明的语言服务器可执行文件缺失或为符号链接时拒绝安装；启动后 app bundle 文件清单不变（scripts/verify-runtime-bundle-immutability.sh）。API 2：安装 fixtures 中 node-runtime 形态的包，确认宿主发现满足最低版本的 node 并用它启动入口文件，版本过低的候选不被使用；语言服务器的状态写在 <app-support>/Lithe/PluginState 下而不是插件包内，卸载后该目录被删除。宿主能力：声明语言但未在 hostIntegration.capabilities 中列出运行、测试或调试、也未提供执行提供方的包，对应入口不可用且宿主不运行内置工具；列出后对应入口恢复。Windows：宿主 v0 已读取该契约（语言与语言服务器范围，按 hostCapabilities 门控），接入验收必须通过同一组共享 fixture，Windows 宿主测试已对 invalid-manifests.json 全量断言；Worker 扩展清单的迁移未完成，宿主 UI 仅完成文本和命令入口，不能用共享校验通过代替界面验收。 macOS API level 2：安装 Hello Lithe 数据包，确认工具窗口、命令面板、工具栏和菜单通过相同注册表显示；移动数据库与插件窗口、隐藏入口及重排后重启恢复；禁用插件后窗口和命令消失，重新启用保留位置与排序；无第三方原生代码载入。Windows UI adapter 仍缺停靠、图标和动作状态等对齐，不能用共享校验通过代替界面验收。 回归：声明与内置/应用动作冲突的合法包在启动时隔离并显示错误；正常退出保留已保存的窗口展开状态，用户主动隐藏才更新该状态；Agent 未启用时可移至底部并恢复入口；首次通过菜单打开 Services 会按需激活数据库。 macOS 图标：宿主语义 ID 与包内 SVG/PNG 在窗口入口、标题栏、工具栏、菜单和命令面板显示；模板着色与品牌原色、亮暗变体、选中/悬停/禁用沿用宿主规范；拒绝未知图标 ID、样式覆盖、包外路径、符号链接、脚本和外部引用；验证资源字节与 bundle 文件清单不变。 原生回归覆盖真实注册窗口标题栏、主工具栏活动/禁用状态、命令面板键盘选择及同一窗口亮→暗→亮切换；品牌图标不随选中着色，模板图标使用宿主选中文字颜色。 macOS 动作状态：确认窗口入口、工具栏、菜单与命令面板共用可用和勾选状态，激活中命令禁用且 Enter/鼠标均不能触发，窗口入口允许取消；同时打开同一插件的两个窗口只构造一次模块，取消其中一个不影响另一个；激活中禁用再启用，确认无资源残留或晚到贡献，旧动作引用不绕过状态校验。 API level 2 工具窗口初始位置接受 left/bottom/right，Rust 校验、macOS 解码及首次显示位置一致，用户保存布局仍覆盖默认声明。 Windows 安全回归：plugin_host::launch 的版本探测必须在父进程退出、后代继承管道时仍有界结束并清理进程树；web 回归验证真实文档来源与工作区文件目标。 Windows 语言资源整合：声明式插件的运行分组、管理页与安装审查使用共享生成词条；中英文回归验证安装名称/版本、程序数量和启停标签，并确认用户值中的占位符保持字面文本。 Windows 宿主修复回归：在 Core startServer 尚未返回时禁用插件，晚到会话必须先停止再拒绝；即时设置携带 pluginId，Core 接受并下推对应会话。缺失 requiredPackagePaths/runtimeRequirements 或 validationArguments 非零退出时拒绝启动。Hello Lithe 文本窗口、菜单、命令面板和工具栏可见，禁用后全部撤销；停靠、图标、动作状态及持久布局仍待接入，保持 partial。"
 }
diff --git a/shared/platform-feature-matrix/features/declarative-plugin-settings.json b/shared/platform-feature-matrix/features/declarative-plugin-settings.json
index 5b32e00571..5dde4cbd23 100644
--- a/shared/platform-feature-matrix/features/declarative-plugin-settings.json
+++ b/shared/platform-feature-matrix/features/declarative-plugin-settings.json
@@ -21,11 +21,17 @@
   },
   "windows": {
     "evidence": [
-      "shared/contracts/plugins/v1/README.md"
+      "windows/tauri/src-tauri/src/plugin_host/settings.rs",
+      "windows/tauri/src-tauri/src/plugin_host/tests.rs",
+      "windows/tauri/src/features/plugins/declarative-plugin-settings-editor.tsx",
+      "shared/contracts/plugins/v1/fixtures/settings-v2.plugin.json",
+      "windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.ts",
+      "windows/tauri/src/platform/lsp-core-adapter.ts",
+      "windows/tauri/src/platform/lsp-core-adapter.test.ts"
     ],
-    "implementationStatus": "missing",
-    "verificationStatus": "not-applicable"
+    "implementationStatus": "partial",
+    "verificationStatus": "pending"
   },
   "owner": "Plugin Platform",
-  "verification": "macOS：打开设置 › 插件，选中 Java Support，切到“设置”页签，确认显示“最大内存”（默认 1024 MB）和“语言服务器日志级别”（默认全部消息）。把最大内存改成 3072：输入 3072 后点“重启语言服务器”，用 ps 查看 JDT LS 的 java 进程参数，确认 -Xmx3072m 且只出现一次；输入 100 时出现范围提示且没有保存，失焦后回到上一个合法值。把日志级别改成“仅错误”并重启，确认进程参数里是 -Dlog.level=SEVERE。点“恢复默认值”后重启，确认回到 -Xmx1024m 和 -Dlog.level=ALL。退出并重新打开 Lithe，确认修改过的值仍在。卸载并恢复 Java Support，值仍在。Windows：插件契约与设置页尚未接入。"
+  "verification": "macOS：打开设置 › 插件，选中 Java Support，切到“设置”页签，确认显示“最大内存”（默认 1024 MB）和“语言服务器日志级别”（默认全部消息）。把最大内存改成 3072：输入 3072 后点“重启语言服务器”，用 ps 查看 JDT LS 的 java 进程参数，确认 -Xmx3072m 且只出现一次；输入 100 时出现范围提示且没有保存，失焦后回到上一个合法值。把日志级别改成“仅错误”并重启，确认进程参数里是 -Dlog.level=SEVERE。点“恢复默认值”后重启，确认回到 -Xmx1024m 和 -Dlog.level=ALL。退出并重新打开 Lithe，确认修改过的值仍在。卸载并恢复 Java Support，值仍在。Windows：契约设置页与双层存储已接入，须完成下述实机验证。 Windows：启动契约语言服务器，修改 immediate 设置，确认 lsp.startServer 和即时更新都带独立 pluginId，已启动会话收到 workspace/didChangeConfiguration；禁用后旧会话不能继续接收。设置双层持久化和界面验收仍 pending。"
 }
diff --git a/shared/platform-feature-matrix/features/plugin-extension-management.json b/shared/platform-feature-matrix/features/plugin-extension-management.json
index b9da617487..14b724f7df 100644
--- a/shared/platform-feature-matrix/features/plugin-extension-management.json
+++ b/shared/platform-feature-matrix/features/plugin-extension-management.json
@@ -20,11 +20,15 @@
       "windows/tauri/src/extensions",
       "windows/tauri/src/features/settings",
       "windows/tauri/src-tauri/src/language_tools.rs",
-      "windows/tauri/src/extensions/registry/extension-store-lifecycle.test.ts"
+      "windows/tauri/src/extensions/registry/extension-store-lifecycle.test.ts",
+      "windows/tauri/src/features/plugins/declarative-plugins-section.tsx",
+      "windows/tauri/src-tauri/src/plugin_host/install.rs",
+      "windows/tauri/src-tauri/src/plugin_host/lifecycle.rs",
+      "windows/tauri/src/features/plugins/plugin-lifecycle-listener.test.ts"
     ],
     "implementationStatus": "implemented",
     "verificationStatus": "pending"
   },
   "owner": "Extensions",
-  "verification": "macOS 全新安装时打开插件页，确认“已安装”标签不再显示 PHP 未安装占位项（改由“插件市场”标签提供安装），齿轮菜单可“从磁盘安装插件”选择已签名的插件包；社区插件在“已安装”中显示来源仓库与社区维护提示，可卸载；安装后可搜索并启用、禁用 PHP，确认状态与重启恢复，且页面不显示无恢复路径的卸载操作；同时打开 Maven 面板确认插件内容不被遮挡。Windows 检查扩展管理入口和持久化。 Windows 缺少 Bun 或语言服务器时更新扩展，确认旧扩展的安装、启用和待更新状态保留，错误给出安装依赖后重试的提示；预检期间禁用或卸载扩展，确认返回后不会继续安装或重新启用；手动将 Marksman 等语言服务器安装到 PATH 后重启，确认能识别并启用。"
+  "verification": "macOS 全新安装时打开插件页，确认“已安装”标签不再显示 PHP 未安装占位项（改由“插件市场”标签提供安装），齿轮菜单可“从磁盘安装插件”选择已签名的插件包；社区插件在“已安装”中显示来源仓库与社区维护提示，可卸载；安装后可搜索并启用、禁用 PHP，确认状态与重启恢复，且页面不显示无恢复路径的卸载操作；同时打开 Maven 面板确认插件内容不被遮挡。Windows 检查扩展管理入口和持久化。契约 v1 插件在设置的独立“声明式插件”页管理（启用/停用/卸载/回滚，与 Worker 扩展分开列出，隔离原因直接展示），管理命令走 plugin_host 的 Tauri 命令。 Windows 缺少 Bun 或语言服务器时更新扩展，确认旧扩展的安装、启用和待更新状态保留，错误给出安装依赖后重试的提示；预检期间禁用或卸载扩展，确认返回后不会继续安装或重新启用；手动将 Marksman 等语言服务器安装到 PATH 后重启，确认能识别并启用。 Windows 契约插件：同时在两个产品窗口启动语言服务/运行任务，在启动尚未返回时分别禁用、卸载、更新和回滚；确认先撤销入口、等待两窗口所有进程和原生探测退出，再改包目录。停止失败、窗口断开或确认超时发生在改包前，文件保留且插件继续阻断；改包后重新扫描失败也必须报错并保持阻断，不能使用旧目录缓存；重试可恢复，不能出现占用可执行文件导致的半删除。 不同插件并发管理时，全盘扫描必须从读取到提交缓存串行，最终缓存包含所有已经成功安装的包；检查 tests.rs 的有序发布回归。"
 }
diff --git a/shared/platform-feature-matrix/features/plugin-marketplace.json b/shared/platform-feature-matrix/features/plugin-marketplace.json
index a355a15d87..c6ba96c3fc 100644
--- a/shared/platform-feature-matrix/features/plugin-marketplace.json
+++ b/shared/platform-feature-matrix/features/plugin-marketplace.json
@@ -44,14 +44,17 @@
   },
   "windows": {
     "evidence": [
-      "shared/contracts/plugins/v1/plugin-index.schema.json",
-      "shared/contracts/plugins/v1/fixtures/marketplace",
-      "rust/lithe-core/src/plugins/marketplace.rs"
+      "windows/tauri/src-tauri/src/plugin_host/install.rs",
+      "windows/tauri/src-tauri/src/plugin_host/install_tests.rs",
+      "windows/tauri/src/features/plugins/declarative-plugin-launch.ts",
+      "windows/tauri/src/features/plugins/declarative-plugins-section.tsx",
+      "rust/lithe-core/src/plugins/marketplace.rs",
+      "shared/contracts/plugins/v1/fixtures/marketplace"
     ],
     "implementationStatus": "partial",
     "verificationStatus": "not-applicable"
   },
   "owner": "Extensions",
   "notes": "macOS 已在隔离实例实际验证社区 ZIP/目录选择与确认、本地来源和摘要、完整程序 JSON 展开、同版本再次确认及取消不改原记录、安装字节、重启扫描与 bundle 哈希不变；磁盘信任及受影响安装流程已运行定向回归，后台审查通过工作线程独占 Store 与文件管理器保持界面可取消，取消后等待读取结束再清理快照。页面关闭与迟到结果清理由状态回归覆盖，完整市场源管理、双语和全部磁盘组合尚未逐项实机验收，因此整体 verificationStatus 保持 pending。最终 Maven/Gradle 新清单还依赖待合入的共享契约和宿主能力，本次 preview 基线的受控包验收不替代最终插件整体验收。Windows 未实现本次声明式磁盘安装链，partial 不表示可以运行 macOS 流程。",
-  "verification": "macOS 打开插件管理，确认有“插件市场 / 已安装”两个标签和齿轮菜单；默认有“Lithe 官方”源（不能删除）和预置的社区源 Lithe Store（默认开启、可停用和删除，删除后重启不会再出现），Lithe Store 中能看到 Lua、Go、PHP 三个社区语言插件并可安装，“Lithe 官方”源当前没有可下载插件（Go/PHP 已迁到 Lithe Store），刷新后索引缓存写在 Caches 而 app bundle 不变。安装、更新或卸载插件后，插件管理顶部出现“插件变更将在重启 Lithe 后生效”横幅和“重启 Lithe”按钮，市场列表与详情里的“重启后生效”也变成该按钮；点击后走正常退出确认，确认后应用退出并自动重新打开（不会多开），取消任一确认则不重启。插件详情显示作者、来源仓库、标签、版本、许可证、发布日期和支持平台；索引带 SVG 或 PNG `icon` 的插件（如 Lithe Store 的 Go、PHP、Lua、Maven、Gradle）在列表、详情和“已安装”里显示自己的图标；图标缺失、非法、超限或仍在加载时显示 IDEA 风格首字母头像（英文取两个字母、中文取一个字，颜色按插件 ID 固定），只有未选择插件的空状态显示默认插件图标；断网导致的失败在网络恢复后再次打开页面或刷新仓库即可恢复，刷新仓库后分支 URL 的新图标会替换旧图标，快速切换插件时详情头部不会出现上一个插件的图标；图标不写 bundle；索引里没有当前架构的包时显示“暂不支持 <平台> 平台”且不可安装，插件 API 版本不满足时显示不支持原因。在“管理插件仓库”中添加一个 GitHub 仓库地址，确认解析到仓库根目录的 lithe-plugin-index.json，可刷新、停用和删除；弹窗按设计稿呈现：仓库列在圆角卡片里，每行是名称（旁边有标签：“Lithe 官方”和预置的 Lithe Store 为“官方”，用户添加的仓库为“社区”）、等宽索引地址和状态行（“已于 刚刚 刷新”随时间变为“5 分钟前”，超过一周显示日期；有被忽略条目时追加“已忽略条目：N”，停用的源标注“已禁用”，刷新失败显示原因），右侧依次是启用开关、“刷新”和红色“移除”；“Lithe 官方”行只能停用，用灰色“默认”代替“移除”；底部左侧“全部刷新”，右侧“完成”。第三方源列出 dev.lithe.* 插件时该条目被忽略。安装社区插件时先校验 SHA-256（不匹配则不解压），超过下载上限的响应在下载中途被中止，解压后过大或文件过多的压缩包（含谎报大小的 ZIP）被拒绝且不留临时文件，再弹出确认框列出权限、要运行的程序和来源仓库，取消则不安装；已安装后改动插件目录内任意文件，重启后该插件拒绝加载；本地磁盘社区首次安装、更新、重装和同版本替换每次都必须明确确认，即使权限和程序未变；市场入口保持首次/缺少审批/出现 newPrograms 时确认的既有规则，无新程序的市场更新可沿用审批。确认框展示 Rust installReview 的全部权限与完整 canonical program 内容，包括参数、参数模板、验证探测、初始化选项、运行时与构建声明，已识别程序展开 Full Program Declaration 阅读完整 JSON，未知程序直接显示完整 JSON；同一插件出现在多个源时由用户选源，更新只走安装时记录的源。官方源只接受 Lithe 签名包。分别在英文和简体中文界面下检查列表、详情、安装确认框和仓库管理窗口，文字（含刷新时间格式）都跟随 Lithe 的语言设置，插件描述在有 localizedDescriptions 翻译时显示对应语言，否则显示默认英文描述；用辅助功能“按下”列表行只会选中，不会触发安装。索引里最新版本在本机不可用时，详情的版本、发布日期和平台显示实际会安装的版本，并单独注明最新版本不可用。磁盘验收：安装声明内置 Python 或其他已安装插件语言的社区包，重启拒绝冲突包后，原拥有者未设置、显式关闭或开启的偏好均保持原值；正常首次确认安装仍自动启用，更新保留选择。分别在市场下载和磁盘导入入口构造显式 ZIP 条目未超限但唯一隐式父目录超限的包，以及累计规范化路径 UTF-8 字节超限的包，确认在启动解压前拒绝并清理；显式目录与共享隐式父目录只计一次，恰好预算的合法包可解压。在隔离的用户配置与注入临时根下，从齿轮菜单分别选择一个合法社区 ZIP 与解包目录；准备后检查只生成本次 lithe-plugin-disk-<UUID> 私有快照，ZIP 的 archiveSHA256 与快照 archive.zip 实测 SHA-256 相同，目录无归档摘要，界面显示本地文件名/内容摘要并明确未认证发布者或仓库。先取消，确认未安装且本次目录删除；再确认安装并重启，核对 installation.json 仅有 disk 来源、内容 digest 与完整 canonical approvedPrograms，没有伪造 marketplace 来源。分别导入程序未变的新版、相同版本原包及相同版本改过脚本的包，每次必须完整展示权限和程序并等待确认；取消不得改变已安装版本。确认框等待时更换原始 ZIP/目录，安装内容应仍等于准备快照；在受控测试中改动已准备快照后提交，应在 install staging 重验失败；安装后增加/删除/改动文件应在 scan 拒绝加载，改动上一版本后 rollback 应失败。正常升级再回滚时，当前/上一版本各自保留 origin、disk/marketplace 来源；同版本替换保留既有上一版本。刷新包含同 ID 的市场源，确认磁盘版本不出现可自动接管的更新/重装入口。以符号链接、Finder alias、特殊文件、多个 plugin.json、超过 64 层的目录、落在源目录内的临时根、中央目录/local header 路径类型冲突或重复条目的 ZIP、超限或损坏 ZIP、非法声明、冒用官方 ID/namespace 的包验证拒绝与清理；官方 publisher 签名、sameTeamAsHost 的 bundle 边界及仅 DEBUG 可用的 localDevelopment 包仍按原策略。导入和待确认期间关闭插件页，确认任务取消、已有快照立即清理、迟到的准备结果只清理而不会安装；成功、取消和失败后检查本次快照和 staging 无残留；在典型工作流前后比较发行 bundle 文件清单/哈希相同，关闭本次应用与子进程。静态及资源验证命令：node scripts/test-reuse-worktree-resources.mjs、./scripts/verify-agent-notes.sh、./scripts/verify-platform-feature-matrix.sh、./scripts/verify-runtime-bundle-immutability.sh；macOS 产品测试使用 ./.agents/skills/write-stable-tests/scripts/test-stability-macos.sh -- --filter 'PluginMarketplace|PluginDiskInstallation|MacPluginDiskPackageImporter|PluginPackageStore|PluginManager'，核对报告包含实际磁盘用例，未运行产品验收前保持 pending。Windows 当前仅共享索引契约、fixture 和 Rust Core 校验，无插件市场 UI 或此声明式 ZIP/目录快照审批流程，现有 worker-package 导入属于另一格式，实现状态保持 partial。；市场列表与详情之间的分隔条使用真实页面回归：中英文描述与深浅主题下缩放窗口、拖动后释放，再刷新索引，详情视口始终位于分隔条右侧；正文按视口宽度换行，窄于来源选择器和提示卡所需宽度时可横向滚动至末端，短详情保持顶部对齐。测试使用私有临时偏好域，关闭窗口后清理；仅原生组件证据，整体实机验收仍 pending。"
+  "verification": "macOS 打开插件管理，确认有“插件市场 / 已安装”两个标签和齿轮菜单；默认有“Lithe 官方”源（不能删除）和预置的社区源 Lithe Store（默认开启、可停用和删除，删除后重启不会再出现），Lithe Store 中能看到 Lua、Go、PHP 三个社区语言插件并可安装，“Lithe 官方”源当前没有可下载插件（Go/PHP 已迁到 Lithe Store），刷新后索引缓存写在 Caches 而 app bundle 不变。安装、更新或卸载插件后，插件管理顶部出现“插件变更将在重启 Lithe 后生效”横幅和“重启 Lithe”按钮，市场列表与详情里的“重启后生效”也变成该按钮；点击后走正常退出确认，确认后应用退出并自动重新打开（不会多开），取消任一确认则不重启。插件详情显示作者、来源仓库、标签、版本、许可证、发布日期和支持平台；索引带 SVG 或 PNG `icon` 的插件（如 Lithe Store 的 Go、PHP、Lua、Maven、Gradle）在列表、详情和“已安装”里显示自己的图标；图标缺失、非法、超限或仍在加载时显示 IDEA 风格首字母头像（英文取两个字母、中文取一个字，颜色按插件 ID 固定），只有未选择插件的空状态显示默认插件图标；断网导致的失败在网络恢复后再次打开页面或刷新仓库即可恢复，刷新仓库后分支 URL 的新图标会替换旧图标，快速切换插件时详情头部不会出现上一个插件的图标；图标不写 bundle；索引里没有当前架构的包时显示“暂不支持 <平台> 平台”且不可安装，插件 API 版本不满足时显示不支持原因。在“管理插件仓库”中添加一个 GitHub 仓库地址，确认解析到仓库根目录的 lithe-plugin-index.json，可刷新、停用和删除；弹窗按设计稿呈现：仓库列在圆角卡片里，每行是名称（旁边有标签：“Lithe 官方”和预置的 Lithe Store 为“官方”，用户添加的仓库为“社区”）、等宽索引地址和状态行（“已于 刚刚 刷新”随时间变为“5 分钟前”，超过一周显示日期；有被忽略条目时追加“已忽略条目：N”，停用的源标注“已禁用”，刷新失败显示原因），右侧依次是启用开关、“刷新”和红色“移除”；“Lithe 官方”行只能停用，用灰色“默认”代替“移除”；底部左侧“全部刷新”，右侧“完成”。第三方源列出 dev.lithe.* 插件时该条目被忽略。安装社区插件时先校验 SHA-256（不匹配则不解压），超过下载上限的响应在下载中途被中止，解压后过大或文件过多的压缩包（含谎报大小的 ZIP）被拒绝且不留临时文件，再弹出确认框列出权限、要运行的程序和来源仓库，取消则不安装；已安装后改动插件目录内任意文件，重启后该插件拒绝加载；本地磁盘社区首次安装、更新、重装和同版本替换每次都必须明确确认，即使权限和程序未变；市场入口保持首次/缺少审批/出现 newPrograms 时确认的既有规则，无新程序的市场更新可沿用审批。确认框展示 Rust installReview 的全部权限与完整 canonical program 内容，包括参数、参数模板、验证探测、初始化选项、运行时与构建声明，已识别程序展开 Full Program Declaration 阅读完整 JSON，未知程序直接显示完整 JSON；同一插件出现在多个源时由用户选源，更新只走安装时记录的源。官方源只接受 Lithe 签名包。分别在英文和简体中文界面下检查列表、详情、安装确认框和仓库管理窗口，文字（含刷新时间格式）都跟随 Lithe 的语言设置，插件描述在有 localizedDescriptions 翻译时显示对应语言，否则显示默认英文描述；用辅助功能“按下”列表行只会选中，不会触发安装。索引里最新版本在本机不可用时，详情的版本、发布日期和平台显示实际会安装的版本，并单独注明最新版本不可用。磁盘验收：安装声明内置 Python 或其他已安装插件语言的社区包，重启拒绝冲突包后，原拥有者未设置、显式关闭或开启的偏好均保持原值；正常首次确认安装仍自动启用，更新保留选择。分别在市场下载和磁盘导入入口构造显式 ZIP 条目未超限但唯一隐式父目录超限的包，以及累计规范化路径 UTF-8 字节超限的包，确认在启动解压前拒绝并清理；显式目录与共享隐式父目录只计一次，恰好预算的合法包可解压。在隔离的用户配置与注入临时根下，从齿轮菜单分别选择一个合法社区 ZIP 与解包目录；准备后检查只生成本次 lithe-plugin-disk-<UUID> 私有快照，ZIP 的 archiveSHA256 与快照 archive.zip 实测 SHA-256 相同，目录无归档摘要，界面显示本地文件名/内容摘要并明确未认证发布者或仓库。先取消，确认未安装且本次目录删除；再确认安装并重启，核对 installation.json 仅有 disk 来源、内容 digest 与完整 canonical approvedPrograms，没有伪造 marketplace 来源。分别导入程序未变的新版、相同版本原包及相同版本改过脚本的包，每次必须完整展示权限和程序并等待确认；取消不得改变已安装版本。确认框等待时更换原始 ZIP/目录，安装内容应仍等于准备快照；在受控测试中改动已准备快照后提交，应在 install staging 重验失败；安装后增加/删除/改动文件应在 scan 拒绝加载，改动上一版本后 rollback 应失败。正常升级再回滚时，当前/上一版本各自保留 origin、disk/marketplace 来源；同版本替换保留既有上一版本。刷新包含同 ID 的市场源，确认磁盘版本不出现可自动接管的更新/重装入口。以符号链接、Finder alias、特殊文件、多个 plugin.json、超过 64 层的目录、落在源目录内的临时根、中央目录/local header 路径类型冲突或重复条目的 ZIP、超限或损坏 ZIP、非法声明、冒用官方 ID/namespace 的包验证拒绝与清理；官方 publisher 签名、sameTeamAsHost 的 bundle 边界及仅 DEBUG 可用的 localDevelopment 包仍按原策略。导入和待确认期间关闭插件页，确认任务取消、已有快照立即清理、迟到的准备结果只清理而不会安装；成功、取消和失败后检查本次快照和 staging 无残留；在典型工作流前后比较发行 bundle 文件清单/哈希相同，关闭本次应用与子进程。静态及资源验证命令：node scripts/test-reuse-worktree-resources.mjs、./scripts/verify-agent-notes.sh、./scripts/verify-platform-feature-matrix.sh、./scripts/verify-runtime-bundle-immutability.sh；macOS 产品测试使用 ./.agents/skills/write-stable-tests/scripts/test-stability-macos.sh -- --filter 'PluginMarketplace|PluginDiskInstallation|MacPluginDiskPackageImporter|PluginPackageStore|PluginManager'，核对报告包含实际磁盘用例，未运行产品验收前保持 pending。Windows 已实现契约插件的磁盘导入链：ZIP/目录→私有快照（拒绝 reparse point、路径逃逸、超限文件与恶意 ZIP 条目）→plugins.marketplace.installReview 全量审查（权限+完整程序清单，界面明示未认证发布者）→确认时摘要比对拒绝快照调包→staging 复验后激活→卸载/回滚/启停。磁盘导入的取消清理、快照篡改拒绝与 staging 失败清理由 Rust 测试覆盖；多仓库源市场 UI 仍缺失（M3+），实机验收前 verificationStatus 保持 not-applicable。Worker 扩展模型的非语言市场安装命令（install_extension_from_url 等）现注册为显式占位错误，等待独立后端。；市场列表与详情之间的分隔条使用真实页面回归：中英文描述与深浅主题下缩放窗口、拖动后释放，再刷新索引，详情视口始终位于分隔条右侧；正文按视口宽度换行，窄于来源选择器和提示卡所需宽度时可横向滚动至末端，短详情保持顶部对齐。测试使用私有临时偏好域，关闭窗口后清理；仅原生组件证据，整体实机验收仍 pending。"
 }
diff --git a/shared/platform-feature-matrix/features/plugin-web-tool-windows.json b/shared/platform-feature-matrix/features/plugin-web-tool-windows.json
index 0fbaca60d4..d534414854 100644
--- a/shared/platform-feature-matrix/features/plugin-web-tool-windows.json
+++ b/shared/platform-feature-matrix/features/plugin-web-tool-windows.json
@@ -37,11 +37,24 @@
   },
   "windows": {
     "evidence": [
-      "shared/contracts/plugins/v1/README.md"
+      "windows/tauri/src-tauri/src/plugin_host/web.rs",
+      "windows/tauri/src-tauri/src/plugin_host/tests.rs",
+      "windows/tauri/src/features/plugins/declarative-plugins-section.tsx",
+      "shared/contracts/plugins/v1/fixtures/web-panel.plugin.json",
+      "windows/tauri/src/features/plugins/plugin-web-appearance.ts",
+      "windows/tauri/src/features/plugins/plugin-web-appearance.test.ts",
+      "windows/tauri/src/features/plugins/plugin-web-open-file.test.ts",
+      "windows/tauri/src-tauri/capabilities/plugin-web.json",
+      "windows/tauri/src-tauri/permissions/declarative-web/bridge.toml",
+      "windows/tauri/src-tauri/src/plugin_host/web_network.rs",
+      "windows/tauri/src-tauri/src/plugin_host/lifecycle.rs",
+      "windows/tauri/src/features/plugins/plugin-web-open-file.ts",
+      "windows/tauri/src/features/plugins/plugin-lifecycle-listener.test.ts",
+      "windows/tauri/src/features/workspace/services/workspace-lifecycle.test.ts"
     ],
-    "implementationStatus": "missing",
-    "verificationStatus": "not-applicable"
+    "implementationStatus": "partial",
+    "verificationStatus": "pending"
   },
   "owner": "Plugin Platform",
-  "verification": "自动回归：LITHE_TEST_WINDOW_MODE=isolated ./.agents/skills/write-stable-tests/scripts/test-stability-macos.sh -- --filter 'PluginWeb|PluginManagerTests|PluginDiskInstallationTests|BuildSystemServiceTests'，检查包内脚本、CSP、主题事件、nonPersistent 数据存储和包文件字节不变；验证错误方法/参数、跨插件/工作区/符号链接逃逸、激活中工作区切换、等待期限、关闭后释放、真实 resetDedicatedWindowSession 在设置窗口仍强持项目模型且网页隐藏时同步关闭页面并清空登记表（TestGate 挂起检测和模块退出，待处理/退出中/退出后请求均返回 plugin.web.forbidden，桥接激活次数不增且退出后 Execution 未重新激活；新回归编译和运行待 CI 验证）、拒绝启动时不认领其他运行、任务与测试两入口遇 busy 均不取消现有运行或清空输出（含 TestGate 控制等待确认期间出现新运行）、同名 demo application/example 依完整 tags 唯一选中且最终参数来自模型、真实 Cargo 模型经桥接选中 example 后通过 Core targetTags 校验并生成 run --example demo、缺少区分信息或伪造/错误类型 tags 被拒绝、停用后旧视图无法重建且工作区关闭不撤销停用、安装和回滚校验失败保留旧页面、社区磁盘同版本替换及升级经真实审查和管理器入口在修改资源及安装记录前同步关闭双项目隐藏页面，拒绝已批准的进程许可并阻止后注册窗口及重新启用在重启前重建（PluginDiskInstallationTests/diskReplacementClosesEveryProjectPageBeforeMutation；篡改快照校验失败保留旧页面）、替换前关闭页面、模型任务类别及声明运行项完整转发、双项目页面与同意记录同步失效、后注册窗口继承阻断、包变更后旧管理器启用不能解锁、弱引用不保留关闭窗口。node scripts/test-reuse-worktree-resources.mjs 拒绝网页状态跨工作树复用。产品界面验收仍 pending。macOS：在开发版里用“从磁盘安装插件”安装 web-panel 夹具（plugin.json 旁放 ui/index.html 和 icons/panel.svg），重启后打开右侧 Web Panel 窗口，确认页面显示、根元素带 data-theme 和 --lithe-* 变量，切换浅色/深色后 ui.themeChanged 到达；页面里的内联脚本和 fetch 外网被 CSP 拦截。在页面控制台调用 lithe.request('ui.setState', {state:{a:1}})，隐藏再显示窗口后 ui.getState 仍返回该值；调用未知方法得到 plugin.web.unknownMethod，openFile 传 ../ 得到 plugin.web.forbidden。在设置 › 插件里停用该插件，窗口消失；重新启用后窗口回到原来的停靠位置并重新加载页面。打开过网页窗口后运行 scripts/verify-runtime-bundle-immutability.sh 通过。摄像头与麦克风：自动回归 ./scripts/test-macos.sh --filter 'PluginMediaCapture|MockCapture|WebMedia'，插件页在真实 WKWebView 里用 WebKit 模拟设备验证：用户点 Allow 才授权且问题记录的请求者是插件名加 ID，拒绝得到 NotAllowedError，缺用途说明、页面不在窗口里、非本插件主框架一律不弹窗直接拒绝，隐藏窗口后采集结束，点 Allow 之后页面才被隐藏时才启动的设备也被立即停掉，隐藏之后才点的 Allow 不生效，源码扫描保证每个 WKWebView 都有人回答请求且 .grant 只出现在 WebMediaCapture.swift；补上 Info.plist 用途说明后，在开发版里用调用 getUserMedia 的插件页确认弹窗写明插件和 ID、隐藏工具窗口后系统菜单栏的绿点或橙点消失、再显示后同一页面第二次调用是否再询问（WebKit 可能复用同一文档里已批准的授权，按实测校对弹窗说明）（当前构建没有用途说明，页面里 navigator.mediaDevices 不存在，这一步尚不能做）。Windows：WebView2 宿主尚未实现，继续只声明 ui 1。"
+  "verification": "自动回归：LITHE_TEST_WINDOW_MODE=isolated ./.agents/skills/write-stable-tests/scripts/test-stability-macos.sh -- --filter 'PluginWeb|PluginManagerTests|PluginDiskInstallationTests|BuildSystemServiceTests'，检查包内脚本、CSP、主题事件、nonPersistent 数据存储和包文件字节不变；验证错误方法/参数、跨插件/工作区/符号链接逃逸、激活中工作区切换、等待期限、关闭后释放、真实 resetDedicatedWindowSession 在设置窗口仍强持项目模型且网页隐藏时同步关闭页面并清空登记表（TestGate 挂起检测和模块退出，待处理/退出中/退出后请求均返回 plugin.web.forbidden，桥接激活次数不增且退出后 Execution 未重新激活；新回归编译和运行待 CI 验证）、拒绝启动时不认领其他运行、任务与测试两入口遇 busy 均不取消现有运行或清空输出（含 TestGate 控制等待确认期间出现新运行）、同名 demo application/example 依完整 tags 唯一选中且最终参数来自模型、真实 Cargo 模型经桥接选中 example 后通过 Core targetTags 校验并生成 run --example demo、缺少区分信息或伪造/错误类型 tags 被拒绝、停用后旧视图无法重建且工作区关闭不撤销停用、安装和回滚校验失败保留旧页面、社区磁盘同版本替换及升级经真实审查和管理器入口在修改资源及安装记录前同步关闭双项目隐藏页面，拒绝已批准的进程许可并阻止后注册窗口及重新启用在重启前重建（PluginDiskInstallationTests/diskReplacementClosesEveryProjectPageBeforeMutation；篡改快照校验失败保留旧页面）、替换前关闭页面、模型任务类别及声明运行项完整转发、双项目页面与同意记录同步失效、后注册窗口继承阻断、包变更后旧管理器启用不能解锁、弱引用不保留关闭窗口。node scripts/test-reuse-worktree-resources.mjs 拒绝网页状态跨工作树复用。产品界面验收仍 pending。macOS：在开发版里用“从磁盘安装插件”安装 web-panel 夹具（plugin.json 旁放 ui/index.html 和 icons/panel.svg），重启后打开右侧 Web Panel 窗口，确认页面显示、根元素带 data-theme 和 --lithe-* 变量，切换浅色/深色后 ui.themeChanged 到达；页面里的内联脚本和 fetch 外网被 CSP 拦截。在页面控制台调用 lithe.request('ui.setState', {state:{a:1}})，隐藏再显示窗口后 ui.getState 仍返回该值；调用未知方法得到 plugin.web.unknownMethod，openFile 传 ../ 得到 plugin.web.forbidden。在设置 › 插件里停用该插件，窗口消失；重新启用后窗口回到原来的停靠位置并重新加载页面。打开过网页窗口后运行 scripts/verify-runtime-bundle-immutability.sh 通过。摄像头与麦克风：自动回归 ./scripts/test-macos.sh --filter 'PluginMediaCapture|MockCapture|WebMedia'，插件页在真实 WKWebView 里用 WebKit 模拟设备验证：用户点 Allow 才授权且问题记录的请求者是插件名加 ID，拒绝得到 NotAllowedError，缺用途说明、页面不在窗口里、非本插件主框架一律不弹窗直接拒绝，隐藏窗口后采集结束，点 Allow 之后页面才被隐藏时才启动的设备也被立即停掉，隐藏之后才点的 Allow 不生效，源码扫描保证每个 WKWebView 都有人回答请求且 .grant 只出现在 WebMediaCapture.swift；补上 Info.plist 用途说明后，在开发版里用调用 getUserMedia 的插件页确认弹窗写明插件和 ID、隐藏工具窗口后系统菜单栏的绿点或橙点消失、再显示后同一页面第二次调用是否再询问（WebKit 可能复用同一文档里已批准的授权，按实测校对弹窗说明）（当前构建没有用途说明，页面里 navigator.mediaDevices 不存在，这一步尚不能做）。Windows：ui 2 宿主已实现 state/openFile 与 locale/theme。运行 WindowsRust 和 Frontend 计时 harness，验证包外来源拒绝、内部/外部 junction 的真实目标边界、原生桥脚本的主题初值与事件；在真实 WebView2 中检查同包导航可用，外站导航、弹窗和下载被拒绝，外站得不到桥；切换语言和主题，确认 context、data-theme 与 --lithe-* 同步。设置页与 Web 窗口视觉验收仍 pending，不能以脚本测试代替。 Windows ACL 回归读取实际编译的 Tauri authority：插件私有来源仅允许 declarative-web request，拒绝 fs/http/event 及常规宿主命令，外站与主窗口不能借此调用桥；实机必须验证 state 往返成功，不能只验证拒绝分支。 Windows 请求层：页面加载前安装 WebResourceRequested 过滤器；本机 HTTP 计数器必须证明外站导航 GET 为零，不能仅以导航被取消或 URL 不变判断隔离成功。 Windows 双工作区回归：同一插件的页面和 state 分别归属创建窗口及工作区；A 页 openFile 只在 A 编辑器打开，切换工作区、路径拒绝或编辑器失败须向页面返回错误，不能先返回成功。关闭 A 清理其页面/状态但保留 B；禁用插件同时撤销全部页面与待处理请求，包变更等待资源读取退出。页面仍使用独立 WebView，停靠及布局恢复保持 partial。 关闭工作区与页面写状态/打开文件交错时，先原子撤销所属页面，再清状态与待确认请求；旧页面实例和关闭前发起的异步页面创建都必须被拒绝，重新打开同一工作区的新请求仍可用。"
 }
diff --git a/windows/tauri/src-tauri/Cargo.lock b/windows/tauri/src-tauri/Cargo.lock
index a8ef65b2dc..2508fb28c0 100644
--- a/windows/tauri/src-tauri/Cargo.lock
+++ b/windows/tauri/src-tauri/Cargo.lock
@@ -2976,6 +2976,7 @@ version = "0.3.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
+ "http",
  "keyring",
  "lithe-agent-host",
  "lithe-core",
@@ -3007,6 +3008,7 @@ dependencies = [
  "tokio",
  "url",
  "webbrowser",
+ "webview2-com",
  "windows 0.61.3",
  "windows-sys 0.61.2",
  "zip 2.4.2",
diff --git a/windows/tauri/src-tauri/Cargo.toml b/windows/tauri/src-tauri/Cargo.toml
index b142666b8b..bfb42251bb 100644
--- a/windows/tauri/src-tauri/Cargo.toml
+++ b/windows/tauri/src-tauri/Cargo.toml
@@ -39,6 +39,7 @@ regex = "1"
 quick-xml = "0.37"
 same-file = "1.0.6"
 sha2 = "0.10"
+http = "1"
 sysinfo = "0.32"
 zip = { version = "2.4", default-features = false, features = ["deflate"] }
 tauri = { version = "2", features = ["common-controls-v6", "protocol-asset"] }
@@ -77,4 +78,5 @@ codegen-units = 1
 [profile.dev.package.num-bigint-dig]
 opt-level = 3
 [target.'cfg(windows)'.dependencies]
-windows = { version = "=0.61.3", features = ["Win32_Graphics_DirectWrite", "Win32_Globalization"] }
+windows = { version = "=0.61.3", features = ["Win32_Graphics_DirectWrite", "Win32_Globalization", "Win32_System_Com"] }
+webview2-com = "=0.38.2"
diff --git a/windows/tauri/src-tauri/build.rs b/windows/tauri/src-tauri/build.rs
index 7b0b65c2cc..059dbc470a 100644
--- a/windows/tauri/src-tauri/build.rs
+++ b/windows/tauri/src-tauri/build.rs
@@ -20,7 +20,12 @@ use std::path::{Path, PathBuf};
 const CONPTY_FILES: [&str; 3] = ["conpty.dll", "OpenConsole.exe", "ConPTY-LICENSE.txt"];
 
 fn main() {
-    tauri_build::build();
+    // Keep the page bridge in its own ACL namespace. Defining an app ACL for
+    // one command would also change authorization for every product command.
+    tauri_build::try_build(
+        tauri_build::Attributes::new().plugin("declarative-web", tauri_build::InlinedPlugin::new()),
+    )
+    .expect("Tauri build failed");
 
     if env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") {
         return;
diff --git a/windows/tauri/src-tauri/capabilities/main.json b/windows/tauri/src-tauri/capabilities/main.json
index 5c4f320da7..a98646cfe1 100644
--- a/windows/tauri/src-tauri/capabilities/main.json
+++ b/windows/tauri/src-tauri/capabilities/main.json
@@ -1,8 +1,8 @@
 {
   "$schema": "https://schema.tauri.app/config/2/capability",
   "identifier": "main-capability",
-  "description": "Capability for all windows",
-  "windows": ["*"],
+  "description": "Capability for the product's own windows (main and workspace views). Plugin web pages are excluded by label and receive the minimal plugin-web capability instead.",
+  "windows": ["main", "workspace-*"],
   "permissions": [
     "core:default",
     "core:window:default",
diff --git a/windows/tauri/src-tauri/capabilities/plugin-web.json b/windows/tauri/src-tauri/capabilities/plugin-web.json
new file mode 100644
index 0000000000..804767af38
--- /dev/null
+++ b/windows/tauri/src-tauri/capabilities/plugin-web.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://schema.tauri.app/config/2/capability",
+  "identifier": "plugin-web-capability",
+  "description": "Plugin-private WebView2 origins reach only the audited declarative-web request bridge. The bridge independently checks the calling window, enabled package and current document origin. No filesystem, HTTP, event, shell, dialog or store commands are granted.",
+  "windows": ["plugin-web-*"],
+  "local": false,
+  "remote": { "urls": ["http://lithe-plugin.*/*"] },
+  "permissions": ["declarative-web:allow-request"]
+}
diff --git a/windows/tauri/src-tauri/permissions/declarative-web/bridge.toml b/windows/tauri/src-tauri/permissions/declarative-web/bridge.toml
new file mode 100644
index 0000000000..91619260ab
--- /dev/null
+++ b/windows/tauri/src-tauri/permissions/declarative-web/bridge.toml
@@ -0,0 +1,4 @@
+[[permission]]
+identifier = "allow-request"
+description = "Allows the plugin-private bridge request; native code authorizes the page identity, origin and method."
+commands.allow = ["request"]
diff --git a/windows/tauri/src-tauri/src/agent_provider_settings.rs b/windows/tauri/src-tauri/src/agent_provider_settings.rs
index a98ba27dcb..539e0162ef 100644
--- a/windows/tauri/src-tauri/src/agent_provider_settings.rs
+++ b/windows/tauri/src-tauri/src/agent_provider_settings.rs
@@ -29,8 +29,12 @@ pub fn commit_agent_panel_settings(
     next: Value,
     credential: Option<CredentialChange>,
 ) -> Result<(), String> {
-    let _guard = TRANSACTION.lock().map_err(|_| "agent.settings.saveFailed")?;
-    let store = app.store("settings.json").map_err(|_| "agent.settings.saveFailed")?;
+    let _guard = TRANSACTION
+        .lock()
+        .map_err(|_| "agent.settings.saveFailed")?;
+    let store = app
+        .store("settings.json")
+        .map_err(|_| "agent.settings.saveFailed")?;
     let current = store.get("agentPanel");
     matches_revision(&current, &expected)?;
     if !next.is_object() {
@@ -42,28 +46,44 @@ pub fn commit_agent_panel_settings(
         if next.get("agentId").and_then(Value::as_str) != Some(change.agent_id.as_str()) {
             return Err("agent.settings.conflict".into());
         }
-        let provider_id = next.get("provider").and_then(|v| v.get("id")).and_then(Value::as_str);
+        let provider_id = next
+            .get("provider")
+            .and_then(|v| v.get("id"))
+            .and_then(Value::as_str);
         // Removal may delete the selected provider; its credential still belongs
         // to the expected revision rather than whichever provider is now selected.
-        let old_id = expected.as_ref().and_then(|v| v.get("provider"))
-            .and_then(|v| v.get("id")).and_then(Value::as_str);
+        let old_id = expected
+            .as_ref()
+            .and_then(|v| v.get("provider"))
+            .and_then(|v| v.get("id"))
+            .and_then(Value::as_str);
         if change.provider_id.as_deref() != provider_id && change.provider_id.as_deref() != old_id {
             return Err("agent.settings.conflict".into());
         }
         let mut key = format!("agent-provider-api-key/{}", change.agent_id);
-        if let Some(id) = change.provider_id { key.push('/'); key.push_str(&id); }
+        if let Some(id) = change.provider_id {
+            key.push('/');
+            key.push_str(&id);
+        }
         previous_secret = crate::secure_storage::get_secure_secret(app.clone(), key.clone())?;
         if change.value.trim().is_empty() {
             crate::secure_storage::remove_secure_secret(app.clone(), key.clone())?;
         } else {
-            crate::secure_storage::store_secure_secret(app.clone(), key.clone(), change.value.trim().into())?;
+            crate::secure_storage::store_secure_secret(
+                app.clone(),
+                key.clone(),
+                change.value.trim().into(),
+            )?;
         }
         secret_key = Some(key);
     }
     store.set("agentPanel", next);
     if store.save().is_err() {
-        if let Some(value) = current { store.set("agentPanel", value); }
-        else { store.delete("agentPanel"); }
+        if let Some(value) = current {
+            store.set("agentPanel", value);
+        } else {
+            store.delete("agentPanel");
+        }
         if let Some(key) = secret_key {
             match previous_secret {
                 Some(value) => crate::secure_storage::store_secure_secret(app, key, value)?,
diff --git a/windows/tauri/src-tauri/src/extension_store_placeholder.rs b/windows/tauri/src-tauri/src/extension_store_placeholder.rs
new file mode 100644
index 0000000000..41f7c083a9
--- /dev/null
+++ b/windows/tauri/src-tauri/src/extension_store_placeholder.rs
@@ -0,0 +1,52 @@
+//! Explicit placeholders for the Worker extension model's disk-installed
+//! package commands.
+//!
+//! The frontend invokes these for non-language marketplace extensions, but
+//! the Rust backend was never registered, so every call failed with Tauri's
+//! "command not found" and the extension store stayed silently broken
+//! (gated by `platform/tauri-core.ts` as `extensions`). Registering structured
+//! errors makes the failure diagnosable; a full disk-install backend for
+//! Worker packages is a separate work item and must not be confused with the
+//! declarative contract host in `plugin_host`.
+
+use serde_json::json;
+
+fn not_yet_available<T>(operation: &str) -> Result<T, String> {
+    // Structured payload rather than a plain message so the dispatcher can
+    // surface a stable code once the backend lands.
+    Err(json!({
+        "code": "extensionStore.notAvailable",
+        "message": format!("{operation} requires a package backend that is not available yet"),
+    })
+    .to_string())
+}
+
+#[tauri::command]
+pub fn install_extension_from_url(
+    _extension_id: String,
+    _url: String,
+    _checksum: String,
+    _size: i64,
+) -> Result<(), String> {
+    not_yet_available("install_extension_from_url")
+}
+
+#[tauri::command]
+pub fn uninstall_extension_new(_extension_id: String) -> Result<(), String> {
+    not_yet_available("uninstall_extension_new")
+}
+
+#[tauri::command]
+pub fn get_extension_path(_extension_id: String) -> Result<String, String> {
+    not_yet_available::<String>("get_extension_path")
+}
+
+#[tauri::command]
+pub fn read_extension_entrypoint(_extension_id: String, _entry: String) -> Result<String, String> {
+    not_yet_available::<String>("read_extension_entrypoint")
+}
+
+#[tauri::command]
+pub fn get_importable_ide_projects() -> Result<Vec<String>, String> {
+    not_yet_available::<Vec<String>>("get_importable_ide_projects")
+}
diff --git a/windows/tauri/src-tauri/src/language_tools.rs b/windows/tauri/src-tauri/src/language_tools.rs
index f477c2e243..56c5fe69d6 100644
--- a/windows/tauri/src-tauri/src/language_tools.rs
+++ b/windows/tauri/src-tauri/src/language_tools.rs
@@ -522,7 +522,7 @@ fn find_bun_executable(path_env: Option<&OsStr>, user_home: Option<&OsStr>) -> O
 /// Finds a system tool by probing every PATH directory. Only Windows launcher
 /// extensions are accepted; a bare extensionless file is a POSIX script that
 /// CreateProcess cannot execute.
-fn find_system_tool(path_env: Option<&OsStr>, name: &str) -> Option<PathBuf> {
+pub(crate) fn find_system_tool(path_env: Option<&OsStr>, name: &str) -> Option<PathBuf> {
     let path_env = path_env?;
     for directory in std::env::split_paths(path_env) {
         if let Some(tool) = first_existing(executable_candidates_in(&directory, name)) {
diff --git a/windows/tauri/src-tauri/src/main.rs b/windows/tauri/src-tauri/src/main.rs
index 54c79913f9..446ed06df8 100644
--- a/windows/tauri/src-tauri/src/main.rs
+++ b/windows/tauri/src-tauri/src/main.rs
@@ -9,6 +9,7 @@ mod date_time;
 mod debug;
 mod diagnostics;
 mod document;
+mod extension_store_placeholder;
 mod file_events;
 mod file_publication;
 mod fonts;
@@ -21,6 +22,7 @@ mod maven;
 mod memory;
 mod owned_processes;
 mod platform;
+mod plugin_host;
 mod profile_migration;
 mod project_window_registry;
 mod project_windows;
@@ -61,6 +63,14 @@ fn main() {
         window.create = false;
     }
     let application = tauri::Builder::default()
+        .plugin(plugin_host::web::bridge_plugin())
+        .register_uri_scheme_protocol("lithe-plugin", |context, request| {
+            plugin_host::web::handle_scheme_request(
+                context.app_handle(),
+                context.webview_label(),
+                request,
+            )
+        })
         .plugin(tauri_plugin_single_instance::init(|app, arguments, _| {
             host::enqueue_cli_arguments(app, arguments);
         }))
@@ -133,8 +143,12 @@ fn main() {
             app.manage(window_title::WindowTitles::default());
             app.manage(run::RunProcessManager::default());
             app.manage(debug::DebugAdapterManager::default());
+            app.manage(plugin_host::PluginHostState::default());
+            app.manage(plugin_host::web::WebPageHostState::default());
+            app.manage(plugin_host::lifecycle::LifecycleState::default());
             run::cleanup_legacy_appdata(app.handle());
             maven::clear_dependency_outputs(app.handle());
+            plugin_host::install::cleanup_stale_snapshots(app.handle());
             for config in initial_windows.iter().filter(|config| config.create) {
                 tauri::WebviewWindowBuilder::from_config(app.handle(), config)?.build()?;
             }
@@ -145,6 +159,8 @@ fn main() {
         })
         .on_window_event(|window, event| {
             if matches!(event, tauri::WindowEvent::Destroyed) {
+                plugin_host::web::forget_window_appearance(window.app_handle(), window.label());
+                plugin_host::lifecycle::window_destroyed(window.app_handle(), window.label());
                 run::release_window_processes(window.label());
                 core::close_ide_hosts(window.label());
                 agent::close_window_connections(window.label());
@@ -162,119 +178,159 @@ fn main() {
                 }
             }
         })
-        .invoke_handler(tauri::generate_handler![
-            date_time::format_system_date_time,
-            agent::agent_open,
-            agent::agent_send,
-            agent::agent_close,
-            document::read_document_file,
-            document::read_document_file_details,
-            document::read_document_file_change,
-            document::save_document_file,
-            document::resolve_agent_document_path,
-            document::save_agent_document,
-            document::trash_agent_document,
-            document::set_document_watches,
-            core::core_execute,
-            core::core_cancel,
-            core::ide_host_paths,
-            diagnostics::preview_diagnostic_bundle,
-            diagnostics::export_diagnostic_bundle,
-            debug::debug_start_session,
-            debug::debug_connect_session,
-            debug::debug_allocate_loopback_port,
-            debug::debug_wait_for_port,
-            debug::debug_session_ready,
-            debug::debug_send_request,
-            debug::debug_stop_session,
-            debug::debug_stop_workspace_sessions,
-            platform::platform_invoke,
-            memory::get_application_memory_usage,
-            terminal::begin_frontend_terminal_session,
-            terminal::warm_terminal_environment,
-            terminal::create_terminal,
-            terminal::terminal_write,
-            terminal::terminal_resize,
-            terminal::terminal_set_paused,
-            terminal::close_terminal,
-            terminal::list_shells,
-            watcher::start_watching,
-            watcher::stop_watching,
-            watcher::set_project_root,
-            watcher::watch_git_repository,
-            watcher::unwatch_git_repository,
-            secure_storage::store_secure_secret,
-            secure_storage::get_secure_secret,
-            secure_storage::remove_secure_secret,
-            agent_provider_settings::commit_agent_panel_settings,
-            logging::get_log_settings,
-            logging::set_log_directory,
-            logging::set_diagnostic_logging,
-            logging::read_lithe_log,
-            logging::query_lithe_logs,
-            diagnostics::discard_diagnostic_bundle,
-            logging::clear_lithe_logs,
-            logging::resolve_previous_log_cleanup,
-            logging::open_log_directory,
-            logging::frontend_trace,
-            logging::record_startup_milestone,
-            host::get_system_theme,
-            host::set_native_window_appearance,
-            fonts::get_system_fonts,
-            fonts::get_monospace_fonts,
-            fonts::validate_font,
-            host::get_bundled_extensions_path,
-            host::read_local_file,
-            host::read_local_file_bounded,
-            host::read_file_custom,
-            host::write_file,
-            host::write_patch_file,
-            shelf_storage::saved_changes_storage,
-            host::move_file,
-            host::rename_file,
-            host::get_symlink_info,
-            host::open_file_external,
-            host::open_html_in_browser,
-            host::take_pending_cli_open_requests,
-            host::clipboard_set,
-            host::clipboard_get,
-            host::clipboard_paste,
-            host::clipboard_clear,
-            host::clipboard_sequence_number,
-            agent_clipboard::agent_clipboard_file_paths,
-            host::wsl_automount_root,
-            host::create_app_window,
-            project_windows::claim_project_window,
-            project_windows::release_project_window,
-            project_windows::release_pending_project_window,
-            window_title::update_window_title_context,
-            lsp::lsp_resolve_java_launch,
-            lsp::lsp_rebuild_java_index,
-            language_tools::get_tool_path,
-            language_tools::install_language_tools,
-            language_tools::check_language_tool_requirements,
-            language_tools::cancel_language_tool_install,
-            language_tools::uninstall_language_tools,
-            maven::maven_load_configuration,
-            maven::maven_resolve_effective_configuration,
-            maven::maven_write_configuration,
-            maven::maven_create_dependency_output,
-            maven::maven_remove_dependency_output,
-            run::run_list_java_sources,
-            run::run_write_generated,
-            run::run_write_documents,
-            run::run_write_stdin,
-            run::maven_resolve_installation,
-            run::run_discover_toolchains,
-            run::run_resolve_launch,
-            run::run_resolve_toolchains,
-            run::run_execute_prelaunch,
-            run::run_start_process,
-            run::run_stop_process,
-            run::run_list_owned_processes,
-            run::run_stop_owned_processes,
-            owned_processes::app_prepare_update_install,
-        ])
+        // Plugin commands have their own ACL. The dedicated page bridge is
+        // registered above; plugin pages reach no product application command.
+        .invoke_handler(
+            |invoke: tauri::ipc::Invoke<tauri::Wry>| match plugin_gate(invoke) {
+                PluginGate::Handled => true,
+                PluginGate::Pass(invoke) => {
+                    let handler: Box<tauri::ipc::InvokeHandler<tauri::Wry>> =
+                        Box::new(tauri::generate_handler![
+                            date_time::format_system_date_time,
+                            agent::agent_open,
+                            agent::agent_send,
+                            agent::agent_close,
+                            document::read_document_file,
+                            document::read_document_file_details,
+                            document::read_document_file_change,
+                            document::save_document_file,
+                            document::resolve_agent_document_path,
+                            document::save_agent_document,
+                            document::trash_agent_document,
+                            document::set_document_watches,
+                            core::core_execute,
+                            core::core_cancel,
+                            core::ide_host_paths,
+                            diagnostics::preview_diagnostic_bundle,
+                            diagnostics::export_diagnostic_bundle,
+                            debug::debug_start_session,
+                            debug::debug_connect_session,
+                            debug::debug_allocate_loopback_port,
+                            debug::debug_wait_for_port,
+                            debug::debug_session_ready,
+                            debug::debug_send_request,
+                            debug::debug_stop_session,
+                            debug::debug_stop_workspace_sessions,
+                            platform::platform_invoke,
+                            memory::get_application_memory_usage,
+                            terminal::begin_frontend_terminal_session,
+                            terminal::warm_terminal_environment,
+                            terminal::create_terminal,
+                            terminal::terminal_write,
+                            terminal::terminal_resize,
+                            terminal::terminal_set_paused,
+                            terminal::close_terminal,
+                            terminal::list_shells,
+                            watcher::start_watching,
+                            watcher::stop_watching,
+                            watcher::set_project_root,
+                            watcher::watch_git_repository,
+                            watcher::unwatch_git_repository,
+                            secure_storage::store_secure_secret,
+                            secure_storage::get_secure_secret,
+                            secure_storage::remove_secure_secret,
+                            agent_provider_settings::commit_agent_panel_settings,
+                            logging::get_log_settings,
+                            logging::set_log_directory,
+                            logging::set_diagnostic_logging,
+                            logging::read_lithe_log,
+                            logging::query_lithe_logs,
+                            diagnostics::discard_diagnostic_bundle,
+                            logging::clear_lithe_logs,
+                            logging::resolve_previous_log_cleanup,
+                            logging::open_log_directory,
+                            logging::frontend_trace,
+                            logging::record_startup_milestone,
+                            host::get_system_theme,
+                            host::set_native_window_appearance,
+                            fonts::get_system_fonts,
+                            fonts::get_monospace_fonts,
+                            fonts::validate_font,
+                            host::get_bundled_extensions_path,
+                            host::read_local_file,
+                            host::read_local_file_bounded,
+                            host::read_file_custom,
+                            host::write_file,
+                            host::write_patch_file,
+                            shelf_storage::saved_changes_storage,
+                            host::move_file,
+                            host::rename_file,
+                            host::get_symlink_info,
+                            host::open_file_external,
+                            host::open_html_in_browser,
+                            host::take_pending_cli_open_requests,
+                            host::clipboard_set,
+                            host::clipboard_get,
+                            host::clipboard_paste,
+                            host::clipboard_clear,
+                            host::clipboard_sequence_number,
+                            agent_clipboard::agent_clipboard_file_paths,
+                            host::wsl_automount_root,
+                            host::create_app_window,
+                            project_windows::claim_project_window,
+                            project_windows::release_project_window,
+                            project_windows::release_pending_project_window,
+                            window_title::update_window_title_context,
+                            lsp::lsp_resolve_java_launch,
+                            lsp::lsp_rebuild_java_index,
+                            language_tools::get_tool_path,
+                            language_tools::install_language_tools,
+                            language_tools::check_language_tool_requirements,
+                            language_tools::cancel_language_tool_install,
+                            language_tools::uninstall_language_tools,
+                            maven::maven_load_configuration,
+                            maven::maven_resolve_effective_configuration,
+                            maven::maven_write_configuration,
+                            maven::maven_create_dependency_output,
+                            maven::maven_remove_dependency_output,
+                            run::run_list_java_sources,
+                            run::run_write_generated,
+                            run::run_write_documents,
+                            run::run_write_stdin,
+                            run::maven_resolve_installation,
+                            run::run_discover_toolchains,
+                            run::run_resolve_launch,
+                            run::run_resolve_toolchains,
+                            run::run_execute_prelaunch,
+                            run::run_start_process,
+                            run::run_stop_process,
+                            run::run_list_owned_processes,
+                            run::run_stop_owned_processes,
+                            plugin_host::lifecycle::declarative_plugins_lifecycle_ack,
+                            plugin_host::declarative_plugins_rescan,
+                            plugin_host::declarative_plugins_state,
+                            plugin_host::web::declarative_plugins_web_open_file_ack,
+                            plugin_host::web::declarative_plugins_web_resolve_file,
+                            plugin_host::web::declarative_plugins_web_update_appearance,
+                            plugin_host::declarative_plugins_manifest,
+                            plugin_host::launch::declarative_plugins_language_launch,
+                            plugin_host::launch::declarative_plugins_language_owner,
+                            plugin_host::install::declarative_plugins_prepare_disk_install,
+                            plugin_host::install::declarative_plugins_confirm_disk_install,
+                            plugin_host::install::declarative_plugins_cancel_disk_install,
+                            plugin_host::install::declarative_plugins_uninstall,
+                            plugin_host::install::declarative_plugins_set_enabled,
+                            plugin_host::install::declarative_plugins_rollback,
+                            plugin_host::settings::declarative_plugins_resolve_settings,
+                            plugin_host::settings::declarative_plugins_store_setting,
+                            plugin_host::settings::declarative_plugins_workspace_configuration,
+                            plugin_host::run_plans::declarative_plugins_run_plan,
+                            plugin_host::run_plans::declarative_plugins_test_plan,
+                            plugin_host::web::declarative_plugins_close_workspace_pages,
+                            plugin_host::web::declarative_plugins_web_windows,
+                            plugin_host::web::declarative_plugins_open_web_window,
+                            plugin_host::web::declarative_plugins_close_web_window,
+                            extension_store_placeholder::install_extension_from_url,
+                            extension_store_placeholder::uninstall_extension_new,
+                            extension_store_placeholder::get_extension_path,
+                            extension_store_placeholder::read_extension_entrypoint,
+                            extension_store_placeholder::get_importable_ide_projects,
+                            owned_processes::app_prepare_update_install,
+                        ]);
+                    handler(invoke)
+                }
+            },
+        )
         .build(context)
         .expect("error while building Lithe desktop shell");
 
@@ -288,6 +344,30 @@ fn main() {
     });
 }
 
+/// Result of the plugin-page gate: either the request was answered (or
+/// rejected) by the bridge, or it passes through to the normal handlers.
+enum PluginGate {
+    Handled,
+    Pass(tauri::ipc::Invoke<tauri::Wry>),
+}
+
+/// Intercepts plugin-page traffic before the generated handlers run.
+fn plugin_gate(invoke: tauri::ipc::Invoke<tauri::Wry>) -> PluginGate {
+    if invoke
+        .message
+        .webview_ref()
+        .label()
+        .starts_with("plugin-web-")
+    {
+        let command = invoke.message.command().to_string();
+        invoke.resolver.reject(format!(
+            "command {command} is not available to plugin pages"
+        ));
+        return PluginGate::Handled;
+    }
+    PluginGate::Pass(invoke)
+}
+
 fn window_state_flags() -> StateFlags {
     let mut flags = StateFlags::all();
     flags.remove(StateFlags::DECORATIONS);
diff --git a/windows/tauri/src-tauri/src/plugin_host/install.rs b/windows/tauri/src-tauri/src/plugin_host/install.rs
new file mode 100644
index 0000000000..c691c98275
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/install.rs
@@ -0,0 +1,678 @@
+//! Disk-package import, uninstall, enable/disable, and rollback for
+//! declarative plugin packages.
+//!
+//! The install flow follows the macOS disk-import semantics recorded in
+//! .agents/notes/implemented/architecture/2026-10-12-declarative-language-plugins.md:
+//! the input is copied to a private snapshot first, Core's
+//! `plugins.marketplace.installReview` produces the permission and program
+//! summary the user confirms, and installation re-validates the staged bytes
+//! before they replace the active version. Package trust comes only from this
+//! explicit review; there is no signature verification in v0 (recorded gap in
+//! the declarative plugin host note).
+
+use super::scan::{core_execute, validate_manifest};
+use super::store::{self, InstallationRecord};
+use super::{CatalogEntry, PluginHostState};
+use serde::Serialize;
+use sha2::{Digest, Sha256};
+use std::io::Read;
+use std::path::{Path, PathBuf};
+use tauri::{AppHandle, Manager};
+
+/// Maximum decompressed package size (16 MiB per file, 128 MiB total) and
+/// entry count; a hostile ZIP cannot exhaust the user's disk before review.
+const MAX_PACKAGE_FILE_BYTES: u64 = 16 * 1024 * 1024;
+const MAX_PACKAGE_TOTAL_BYTES: u64 = 128 * 1024 * 1024;
+const MAX_PACKAGE_ENTRIES: usize = 2_000;
+/// Maximum snapshot lifetime is one review session; a session id ties prepare
+/// and confirm calls together so abandoned snapshots are cleaned up.
+const SNAPSHOT_PREFIX: &str = "lithe-plugin-disk-";
+
+#[derive(Default)]
+struct PackageBudget {
+    entries: usize,
+    bytes: u64,
+}
+
+impl PackageBudget {
+    fn add(&mut self, bytes: u64) -> Result<(), String> {
+        if bytes > MAX_PACKAGE_FILE_BYTES {
+            return Err("a package file exceeds the per-file size limit".to_string());
+        }
+        self.entries += 1;
+        if self.entries > MAX_PACKAGE_ENTRIES {
+            return Err("the package contains too many entries".to_string());
+        }
+        self.bytes = self
+            .bytes
+            .checked_add(bytes)
+            .ok_or("the package is too large")?;
+        if self.bytes > MAX_PACKAGE_TOTAL_BYTES {
+            return Err("the package exceeds the total size limit".to_string());
+        }
+        Ok(())
+    }
+}
+
+/// A prepared disk import awaiting user confirmation.
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PreparedInstall {
+    pub session_id: String,
+    pub review: InstallReview,
+    /// SHA-256 of the snapshot `plugin.json`; the confirm call must still see
+    /// the same package, so review answers cannot be replayed on new bytes.
+    pub manifest_digest: String,
+    /// Human-readable display name from the manifest.
+    pub display_name: String,
+}
+
+/// Core's install review, reshaped for the frontend.
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct InstallReview {
+    pub plugin_id: String,
+    pub version: String,
+    pub permissions: Vec<String>,
+    pub programs: Vec<serde_json::Value>,
+    pub new_programs: Vec<serde_json::Value>,
+}
+
+/// Prepares a disk import from a ZIP archive or an unpacked directory. The
+/// source is copied to a private snapshot under the app's temporary
+/// directory; nothing is installed and nothing outside the snapshot is
+/// written.
+#[tauri::command]
+pub fn declarative_plugins_prepare_disk_install(
+    app: AppHandle,
+    source_path: String,
+) -> Result<PreparedInstall, String> {
+    let temporary_root = app
+        .path()
+        .app_local_data_dir()
+        .map_err(|error| error.to_string())?
+        .join("plugin-temp");
+    std::fs::create_dir_all(&temporary_root).map_err(|error| error.to_string())?;
+    let session_id = format!("{}{}", SNAPSHOT_PREFIX, uuid_like_suffix());
+    let snapshot = temporary_root.join(&session_id);
+    let source = PathBuf::from(&source_path);
+    let result = (|| {
+        if source.extension().and_then(|extension| extension.to_str()) == Some("zip") {
+            extract_zip_snapshot(&source, &snapshot)?;
+        } else if source.is_dir() {
+            copy_directory_snapshot(&source, &snapshot)?;
+        } else {
+            return Err(format!(
+                "{} is neither a .zip archive nor an unpacked package directory",
+                source.display()
+            ));
+        }
+        let manifest = read_snapshot_manifest(&snapshot)?;
+        Ok(PreparedInstall {
+            session_id,
+            review: review_snapshot(&manifest, None)?,
+            manifest_digest: content_digest(&manifest),
+            display_name: manifest["displayName"]
+                .as_str()
+                .unwrap_or("plugin")
+                .to_string(),
+        })
+    })();
+    if result.is_err() {
+        discard_snapshot(&snapshot);
+    }
+    result
+}
+
+/// Installs a previously prepared snapshot after the user confirmed the
+/// review. The confirm call re-validates the snapshot bytes and re-runs the
+/// review, so a snapshot swapped between prepare and confirm is rejected.
+#[tauri::command]
+pub async fn declarative_plugins_confirm_disk_install(
+    app: AppHandle,
+    session_id: String,
+    manifest_digest: String,
+) -> Result<CatalogEntry, String> {
+    let snapshot = snapshot_path(&app, &session_id)?;
+    let result = async {
+        let manifest = read_snapshot_manifest(&snapshot)?;
+        if content_digest(&manifest) != manifest_digest {
+            return Err("the package changed after review; the import was cancelled".to_string());
+        }
+        // Re-review with no previously approved programs: a disk install always
+        // requires a fresh full confirmation, matching the macOS rule.
+        let _ = review_snapshot(&manifest, None)?;
+
+        let install_root = store::install_root(&app)?;
+        let plugin_id = manifest["id"]
+            .as_str()
+            .ok_or("manifest has no id")?
+            .to_string();
+        let version = manifest["version"]
+            .as_str()
+            .ok_or("manifest has no version")?
+            .to_string();
+
+        // Validate the final manifest against this host's capabilities before
+        // anything is written into the install root.
+        validate_manifest(&manifest).map_err(|rejection| rejection.message)?;
+
+        // A version switch invalidates the page's package bytes and bridge
+        // authorization, so destroy all owned webviews before staging starts.
+        let mutation = super::lifecycle::begin(&app, &plugin_id).await?;
+        staging_install(&install_root, &plugin_id, &version, &snapshot)?;
+        write_installation_record(&install_root, &plugin_id, &version)?;
+        rescan_after_change(&app)?;
+        mutation.complete(true);
+        Ok(catalog_entry_of(&app, &plugin_id)
+            .unwrap_or_else(|| accepted_entry_fallback(&plugin_id, &version)))
+    }
+    .await;
+    discard_snapshot(&snapshot);
+    result
+}
+
+/// Abandons an installation review and removes its private snapshot.
+#[tauri::command]
+pub fn declarative_plugins_cancel_disk_install(
+    app: AppHandle,
+    session_id: String,
+) -> Result<(), String> {
+    let snapshot = snapshot_path(&app, &session_id)?;
+    if snapshot.exists() {
+        std::fs::remove_dir_all(snapshot).map_err(|error| error.to_string())?;
+    }
+    Ok(())
+}
+
+fn snapshot_path(app: &AppHandle, session_id: &str) -> Result<PathBuf, String> {
+    if !session_id.starts_with(SNAPSHOT_PREFIX)
+        || session_id.contains('/')
+        || session_id.contains('\\')
+        || session_id.contains("..")
+    {
+        return Err("invalid install session".to_string());
+    }
+    Ok(app
+        .path()
+        .app_local_data_dir()
+        .map_err(|error| error.to_string())?
+        .join("plugin-temp")
+        .join(session_id))
+}
+
+/// Removes an installed package. Bundled packages cannot be uninstalled.
+#[tauri::command]
+pub async fn declarative_plugins_uninstall(
+    app: AppHandle,
+    plugin_id: String,
+) -> Result<(), String> {
+    let install_root = store::install_root(&app)?;
+    let plugin_directory = install_root.join(&plugin_id);
+    if !plugin_directory.is_dir() {
+        return Err(format!("{plugin_id} is not an installed plugin"));
+    }
+    let mutation = super::lifecycle::begin(&app, &plugin_id).await?;
+    std::fs::remove_dir_all(&plugin_directory)
+        .map_err(|error| format!("{plugin_id} could not be removed: {error}"))?;
+    let state_directory = store::plugin_state_directory(&app, &plugin_id)?;
+    if state_directory.is_dir() {
+        std::fs::remove_dir_all(&state_directory)
+            .map_err(|error| format!("state directory could not be removed: {error}"))?;
+    }
+    rescan_after_change(&app)?;
+    mutation.complete(false);
+    Ok(())
+}
+
+/// Enables or disables an installed plugin; bundled packages are always
+/// enabled and reject the call.
+#[tauri::command]
+pub async fn declarative_plugins_set_enabled(
+    app: AppHandle,
+    plugin_id: String,
+    enabled: bool,
+) -> Result<(), String> {
+    let install_root = store::install_root(&app)?;
+    let record_path = install_root.join(&plugin_id).join("installation.json");
+    let mut record: InstallationRecord = serde_json::from_str(
+        &std::fs::read_to_string(&record_path)
+            .map_err(|error| format!("{plugin_id} has no readable install record: {error}"))?,
+    )
+    .map_err(|error| format!("{plugin_id} has a corrupted install record: {error}"))?;
+    let mutation = super::lifecycle::begin(&app, &plugin_id).await?;
+    record.enabled = enabled;
+    // Write via temp + rename so a crash never leaves a truncated record.
+    let temp_path = record_path.with_extension("json.tmp");
+    std::fs::write(
+        &temp_path,
+        serde_json::to_string_pretty(&record).map_err(|error| error.to_string())?,
+    )
+    .map_err(|error| error.to_string())?;
+    std::fs::rename(&temp_path, &record_path).map_err(|error| error.to_string())?;
+    rescan_after_change(&app)?;
+    mutation.complete(enabled);
+    Ok(())
+}
+
+/// Restores the previous version directory of an installed package. Rollback
+/// requires a retained previous version and always re-enables the package so
+/// a broken update cannot leave it disabled and forgotten.
+#[tauri::command]
+pub async fn declarative_plugins_rollback(app: AppHandle, plugin_id: String) -> Result<(), String> {
+    let install_root = store::install_root(&app)?;
+    let plugin_directory = install_root.join(&plugin_id);
+    let record: InstallationRecord = serde_json::from_str(
+        &std::fs::read_to_string(plugin_directory.join("installation.json"))
+            .map_err(|error| format!("{plugin_id} has no readable install record: {error}"))?,
+    )
+    .map_err(|error| error.to_string())?;
+    let mut versions: Vec<String> = std::fs::read_dir(&plugin_directory)
+        .map_err(|error| error.to_string())?
+        .flatten()
+        .filter_map(|entry| {
+            let name = entry.file_name().to_string_lossy().to_string();
+            let path = entry.path();
+            (path.is_dir() && path.join("plugin.json").is_file()).then_some(name)
+        })
+        .collect();
+    versions.sort_by(|left, right| store::compare_versions(left, right));
+    versions.reverse();
+    let Some(previous) = versions
+        .into_iter()
+        .find(|version| *version != record.version)
+    else {
+        return Err(format!(
+            "{plugin_id} has no previous version to roll back to"
+        ));
+    };
+    let mutation = super::lifecycle::begin(&app, &plugin_id).await?;
+    staging_install(
+        &install_root,
+        &plugin_id,
+        &previous,
+        &plugin_directory.join(&previous),
+    )?;
+    write_installation_record(&install_root, &plugin_id, &previous)?;
+    rescan_after_change(&app)?;
+    mutation.complete(true);
+    Ok(())
+}
+
+// MARK: helpers
+
+fn review_snapshot(
+    manifest: &serde_json::Value,
+    approved_programs: Option<&[serde_json::Value]>,
+) -> Result<InstallReview, String> {
+    let outcome = core_execute(
+        "plugins.marketplace.installReview",
+        serde_json::json!({
+            "manifest": manifest,
+            "hostCapabilities": super::host_capabilities(),
+            "approvedPrograms": approved_programs,
+        }),
+    )?;
+    if outcome["status"] == serde_json::json!("rejected") {
+        return Err(format!(
+            "install review rejected: {}",
+            outcome["error"]["message"].as_str().unwrap_or("unknown")
+        ));
+    }
+    let review = &outcome["review"];
+    Ok(InstallReview {
+        plugin_id: review["id"].as_str().unwrap_or_default().to_string(),
+        version: review["version"].as_str().unwrap_or_default().to_string(),
+        permissions: string_list(&review["permissions"]),
+        programs: review["programs"].as_array().cloned().unwrap_or_default(),
+        new_programs: review["newPrograms"]
+            .as_array()
+            .cloned()
+            .unwrap_or_default(),
+    })
+}
+
+/// Copies the snapshot into the install root, then validates the copied
+/// manifest. Staging first keeps a failed copy from destroying the current
+/// version: the active version directory is only replaced after the staged
+/// copy validates.
+pub(crate) fn staging_install(
+    install_root: &Path,
+    plugin_id: &str,
+    version: &str,
+    source: &Path,
+) -> Result<(), String> {
+    let plugin_directory = install_root.join(plugin_id);
+    std::fs::create_dir_all(&plugin_directory).map_err(|error| error.to_string())?;
+    let version_directory = plugin_directory.join(version);
+    let staging_directory = plugin_directory.join(format!(".staging-{version}"));
+    if staging_directory.exists() {
+        std::fs::remove_dir_all(&staging_directory).map_err(|error| error.to_string())?;
+    }
+    copy_directory_snapshot(source, &staging_directory)?;
+    let result = staging_validate_and_activate(&staging_directory, &version_directory);
+    if result.is_err() {
+        // A failed install never leaves staging bytes behind.
+        let _ = std::fs::remove_dir_all(&staging_directory);
+    }
+    result
+}
+
+fn staging_validate_and_activate(
+    staging_directory: &Path,
+    version_directory: &Path,
+) -> Result<(), String> {
+    let staged_manifest = read_snapshot_manifest(staging_directory)?;
+    validate_manifest(&staged_manifest).map_err(|rejection| rejection.message)?;
+    if !version_directory.exists() {
+        return std::fs::rename(staging_directory, version_directory)
+            .map_err(|error| format!("activation failed: {error}"));
+    }
+    // Replacing an existing version: move the current directory aside first,
+    // and restore it if activation fails, so a failed same-version reinstall
+    // never leaves the install record pointing at missing bytes.
+    let backup_directory = version_directory.with_extension("previous-tmp");
+    if backup_directory.exists() {
+        std::fs::remove_dir_all(&backup_directory).map_err(|error| error.to_string())?;
+    }
+    std::fs::rename(version_directory, &backup_directory)
+        .map_err(|error| format!("could not back up the current version: {error}"))?;
+    if let Err(activation_error) = std::fs::rename(staging_directory, version_directory) {
+        if let Err(restore_error) = std::fs::rename(&backup_directory, version_directory) {
+            return Err(format!(
+                "activation failed ({activation_error}) and the previous version could not be restored ({restore_error})"
+            ));
+        }
+        return Err(format!("activation failed: {activation_error}"));
+    }
+    let _ = std::fs::remove_dir_all(&backup_directory);
+    Ok(())
+}
+
+pub(crate) fn write_installation_record(
+    install_root: &Path,
+    plugin_id: &str,
+    version: &str,
+) -> Result<(), String> {
+    let record_path = install_root.join(plugin_id).join("installation.json");
+    let record = InstallationRecord {
+        schema_version: 1,
+        plugin_id: plugin_id.to_string(),
+        version: version.to_string(),
+        enabled: true,
+    };
+    std::fs::create_dir_all(record_path.parent().ok_or("record path")?)
+        .map_err(|error| error.to_string())?;
+    std::fs::write(
+        &record_path,
+        serde_json::to_string_pretty(&record).map_err(|error| error.to_string())?,
+    )
+    .map_err(|error| error.to_string())?;
+    Ok(())
+}
+
+fn read_snapshot_manifest(snapshot: &Path) -> Result<serde_json::Value, String> {
+    let text = std::fs::read_to_string(snapshot.join("plugin.json"))
+        .map_err(|error| format!("the package has no readable plugin.json: {error}"))?;
+    serde_json::from_str(&text).map_err(|error| format!("plugin.json is not valid JSON: {error}"))
+}
+
+fn content_digest(manifest: &serde_json::Value) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(manifest.to_string().as_bytes());
+    format!("{:x}", hasher.finalize())
+}
+
+/// Copies a directory tree, refusing reparse points and files beyond the
+/// package budgets. The copy is the safety boundary: everything reviewed and
+/// installed afterwards comes from this snapshot, not the mutable source.
+pub(crate) fn copy_directory_snapshot(source: &Path, snapshot: &Path) -> Result<(), String> {
+    let mut budget = PackageBudget::default();
+    let result = copy_tree_bounded(source, source, snapshot, 0, &mut budget);
+    if result.is_err() {
+        discard_snapshot(snapshot);
+    }
+    result
+}
+
+fn copy_tree_bounded(
+    root: &Path,
+    directory: &Path,
+    snapshot: &Path,
+    depth: usize,
+    budget: &mut PackageBudget,
+) -> Result<(), String> {
+    if depth > 64 {
+        return Err("the package directory nesting exceeds 64 levels".to_string());
+    }
+    let relative = directory
+        .strip_prefix(root)
+        .map_err(|error| error.to_string())?;
+    let target = snapshot.join(relative);
+    std::fs::create_dir_all(&target).map_err(|error| error.to_string())?;
+    for entry in std::fs::read_dir(directory).map_err(|error| error.to_string())? {
+        let entry = entry.map_err(|error| error.to_string())?;
+        let entry_path = entry.path();
+        let metadata = std::fs::symlink_metadata(&entry_path)
+            .map_err(|error| format!("{} is unreadable: {error}", entry_path.display()))?;
+        #[cfg(windows)]
+        {
+            use std::os::windows::fs::MetadataExt;
+            if metadata.file_attributes() & 0x0400 != 0 {
+                return Err(format!(
+                    "{} is a reparse point; package entries must be regular files",
+                    entry_path.display()
+                ));
+            }
+        }
+        #[cfg(not(windows))]
+        if metadata.file_type().is_symlink() {
+            return Err(format!(
+                "{} is a symbolic link; package entries must be regular files",
+                entry_path.display()
+            ));
+        }
+        if metadata.is_dir() {
+            budget.add(0)?;
+            copy_tree_bounded(root, &entry_path, snapshot, depth + 1, budget)?;
+        } else if metadata.is_file() {
+            budget.add(metadata.len())?;
+            let mut input = std::fs::File::open(&entry_path).map_err(|error| error.to_string())?;
+            let mut output = std::fs::File::create(target.join(entry.file_name()))
+                .map_err(|error| error.to_string())?;
+            let copied = std::io::copy(&mut input.by_ref().take(metadata.len() + 1), &mut output)
+                .map_err(|error| error.to_string())?;
+            if copied != metadata.len() {
+                return Err(format!(
+                    "{} changed while being copied",
+                    entry_path.display()
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+pub(crate) fn extract_zip_snapshot(source: &Path, snapshot: &Path) -> Result<(), String> {
+    let result = extract_zip_snapshot_inner(source, snapshot);
+    if result.is_err() {
+        discard_snapshot(snapshot);
+    }
+    result
+}
+
+fn extract_zip_snapshot_inner(source: &Path, snapshot: &Path) -> Result<(), String> {
+    let file = std::fs::File::open(source)
+        .map_err(|error| format!("{} could not be opened: {error}", source.display()))?;
+    let mut archive = zip::ZipArchive::new(file).map_err(|error| {
+        format!(
+            "{} is not a readable ZIP archive: {error}",
+            source.display()
+        )
+    })?;
+    if archive.len() > MAX_PACKAGE_ENTRIES {
+        return Err("the archive contains too many entries".to_string());
+    }
+    let mut budget = PackageBudget::default();
+    for index in 0..archive.len() {
+        let mut entry = archive
+            .by_index(index)
+            .map_err(|error| format!("archive entry {index} is unreadable: {error}"))?;
+        let Some(name) = entry.enclosed_name().map(|path| path.to_path_buf()) else {
+            return Err(format!("archive entry {index} has an unsafe path"));
+        };
+        budget.add(if entry.is_dir() { 0 } else { entry.size() })?;
+        if entry.is_dir() {
+            std::fs::create_dir_all(snapshot.join(&name)).map_err(|error| error.to_string())?;
+            continue;
+        }
+        let target = snapshot.join(&name);
+        if let Some(parent) = target.parent() {
+            std::fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+        }
+        let mut output = std::fs::File::create(&target).map_err(|error| error.to_string())?;
+        let declared_size = entry.size();
+        let copied = std::io::copy(&mut entry.by_ref().take(declared_size + 1), &mut output)
+            .map_err(|error| error.to_string())?;
+        if copied != declared_size {
+            return Err(format!(
+                "archive entry {} has an invalid size",
+                name.display()
+            ));
+        }
+    }
+    // A ZIP that unpacked into a single wrapper directory still yields a
+    // package root containing plugin.json directly.
+    unwrap_single_directory(snapshot);
+    read_snapshot_manifest(snapshot)?;
+    Ok(())
+}
+
+/// If the archive wrapped everything in one directory, treat that directory
+/// as the package root.
+fn unwrap_single_directory(snapshot: &Path) {
+    let Ok(entries) = std::fs::read_dir(snapshot) else {
+        return;
+    };
+    let entries: Vec<_> = entries.flatten().collect();
+    if entries.len() == 1 && entries[0].path().is_dir() {
+        let inner = entries[0].path();
+        if inner.join("plugin.json").is_file() {
+            let _ = move_directory_contents(&inner, snapshot);
+        }
+    }
+}
+
+fn move_directory_contents(from: &Path, to: &Path) -> std::io::Result<()> {
+    for entry in std::fs::read_dir(from)? {
+        let entry = entry?;
+        let target = to.join(entry.file_name());
+        if entry.path().is_dir() {
+            if std::fs::rename(entry.path(), &target).is_err() {
+                copy_directory_snapshot(&entry.path(), &target).map_err(std::io::Error::other)?;
+            }
+        } else {
+            std::fs::rename(entry.path(), &target)?;
+        }
+    }
+    std::fs::remove_dir_all(from)
+}
+
+fn string_list(value: &serde_json::Value) -> Vec<String> {
+    value
+        .as_array()
+        .map(|items| {
+            items
+                .iter()
+                .filter_map(|item| item.as_str().map(str::to_string))
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+fn rescan_after_change(app: &AppHandle) -> Result<(), String> {
+    app.state::<PluginHostState>()
+        .refresh(|| super::scan::build_catalog(app))
+        .map(|_| ())
+}
+
+fn catalog_entry_of(app: &AppHandle, plugin_id: &str) -> Option<CatalogEntry> {
+    app.state::<PluginHostState>()
+        .packages()
+        .into_iter()
+        .find(|package| package.entry.plugin_id == plugin_id)
+        .map(|package| package.entry)
+}
+
+fn accepted_entry_fallback(plugin_id: &str, version: &str) -> CatalogEntry {
+    CatalogEntry {
+        plugin_id: plugin_id.to_string(),
+        display_name: plugin_id.to_string(),
+        version: version.to_string(),
+        api_version: 0,
+        source: "installed",
+        enabled: true,
+        status: "accepted",
+        languages: Vec::new(),
+        declared_settings: Vec::new(),
+        declares_tests: false,
+        primary_language_id: None,
+        rejection: None,
+    }
+}
+
+fn discard_snapshot(snapshot: &Path) {
+    let _ = std::fs::remove_dir_all(snapshot);
+}
+
+/// Time- and process-derived suffix; uniqueness across sessions is what the
+/// snapshot directory needs, not cryptographic randomness.
+fn uuid_like_suffix() -> String {
+    let nanos = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|duration| duration.as_nanos())
+        .unwrap_or_default();
+    format!("{}-{:x}", std::process::id(), nanos)
+}
+
+/// Removes snapshots left behind by a crashed review session at startup.
+pub fn cleanup_stale_snapshots(app: &AppHandle) {
+    let Ok(temporary_root) = app
+        .path()
+        .app_local_data_dir()
+        .map(|root| root.join("plugin-temp"))
+    else {
+        return;
+    };
+    let Ok(entries) = std::fs::read_dir(&temporary_root) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let name = entry.file_name().to_string_lossy().to_string();
+        if name.starts_with(SNAPSHOT_PREFIX) {
+            let _ = std::fs::remove_dir_all(entry.path());
+        }
+    }
+}
+
+#[cfg(test)]
+mod budget_tests {
+    use super::*;
+
+    #[test]
+    fn package_budget_enforces_total_bytes_and_entry_count_for_both_import_formats() {
+        let mut bytes = PackageBudget::default();
+        for _ in 0..8 {
+            bytes
+                .add(MAX_PACKAGE_FILE_BYTES)
+                .expect("within total limit");
+        }
+        assert!(bytes.add(1).is_err());
+
+        let mut entries = PackageBudget::default();
+        for _ in 0..MAX_PACKAGE_ENTRIES {
+            entries.add(0).expect("within entry limit");
+        }
+        assert!(entries.add(0).is_err());
+    }
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/install_tests.rs b/windows/tauri/src-tauri/src/plugin_host/install_tests.rs
new file mode 100644
index 0000000000..623b9069f9
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/install_tests.rs
@@ -0,0 +1,218 @@
+/// M2 disk-import tests exercise the internal functions directly (the Tauri
+/// commands are thin AppHandle wrappers): snapshot isolation, ZIP safety,
+/// staging install, and rollback version selection.
+mod install_tests {
+    use crate::plugin_host::install::{
+        copy_directory_snapshot, extract_zip_snapshot, staging_install, write_installation_record,
+    };
+    use crate::plugin_host::store;
+    use crate::plugin_host::store::InstallationRecord;
+    use crate::plugin_host::tests::read_fixture_for_tests;
+    use std::path::PathBuf;
+
+    fn unique_temp_root(label: &str) -> PathBuf {
+        let nanos = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("system clock")
+            .as_nanos();
+        let root = std::env::temp_dir().join(format!(
+            "lithe-plugin-install-{label}-{}-{nanos}",
+            std::process::id()
+        ));
+        std::fs::create_dir_all(&root).expect("temp root");
+        root
+    }
+
+    fn package_directory(root: &std::path::Path, version: &str) -> PathBuf {
+        let directory = root.join(format!("pkg-{version}"));
+        std::fs::create_dir_all(&directory).expect("package dir");
+        let mut manifest = read_fixture_for_tests("language-packaged-server.plugin.json");
+        manifest["version"] = serde_json::json!(version);
+        std::fs::write(
+            directory.join("plugin.json"),
+            serde_json::to_string_pretty(&manifest).expect("manifest text"),
+        )
+        .expect("manifest file");
+        let server_directory = directory.join("language-server").join("bin");
+        std::fs::create_dir_all(&server_directory).expect("server dir");
+        std::fs::write(server_directory.join("intelephense.js"), b"entry").expect("entry file");
+        directory
+    }
+
+    #[test]
+    fn directory_snapshot_copies_contents() {
+        let root = unique_temp_root("snapshot");
+        let package = package_directory(&root, "1.0.0");
+        let snapshot = root.join("snapshot");
+        copy_directory_snapshot(&package, &snapshot).expect("snapshot copies");
+        assert!(snapshot.join("plugin.json").is_file());
+        assert!(snapshot
+            .join("language-server/bin/intelephense.js")
+            .is_file());
+
+        // A symlink inside the source must abort the copy when the platform
+        // lets the test create one.
+        #[cfg(unix)]
+        {
+            let link = package.join("linked.js");
+            if std::os::unix::fs::symlink(package.join("plugin.json"), &link).is_ok() {
+                let hostile = root.join("snapshot-hostile");
+                assert!(copy_directory_snapshot(&package, &hostile).is_err());
+            }
+        }
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn directory_snapshot_rejects_oversized_file_and_removes_partial_copy() {
+        let root = unique_temp_root("snapshot-budget");
+        let package = package_directory(&root, "1.0.0");
+        let oversized = std::fs::File::create(package.join("oversized.bin")).expect("file");
+        oversized.set_len(16 * 1024 * 1024 + 1).expect("size");
+        let snapshot = root.join("snapshot");
+        assert!(copy_directory_snapshot(&package, &snapshot).is_err());
+        assert!(!snapshot.exists(), "failed copy must release its snapshot");
+        std::fs::remove_dir_all(root).expect("cleanup");
+    }
+
+    #[test]
+    fn zip_snapshot_extracts_and_rejects_unsafe_paths() {
+        let root = unique_temp_root("zip");
+        let package = package_directory(&root, "1.0.0");
+        let zip_path = root.join("pkg.zip");
+        let zip_file = std::fs::File::create(&zip_path).expect("zip file");
+        let mut writer = zip::ZipWriter::new(zip_file);
+        let options: zip::write::SimpleFileOptions = Default::default();
+        writer
+            .add_directory("wrapper/", options)
+            .expect("wrapper dir");
+        for relative in ["plugin.json", "language-server/bin/intelephense.js"] {
+            let source = package.join(relative);
+            let text = std::fs::read(&source).expect("entry bytes");
+            writer
+                .start_file(format!("wrapper/{relative}"), options)
+                .expect("entry");
+            std::io::Write::write_all(&mut writer, &text).expect("entry bytes");
+        }
+        writer.finish().expect("zip finish");
+        let snapshot = root.join("snapshot");
+        extract_zip_snapshot(&zip_path, &snapshot).expect("extracts");
+        assert!(snapshot.join("plugin.json").is_file());
+
+        // A traversal entry name is refused before anything is written.
+        let hostile_zip = root.join("hostile.zip");
+        let hostile_file = std::fs::File::create(&hostile_zip).expect("hostile zip");
+        let mut hostile_writer = zip::ZipWriter::new(hostile_file);
+        hostile_writer
+            .start_file("../escape.txt", options)
+            .expect("hostile entry");
+        std::io::Write::write_all(&mut hostile_writer, b"nope").expect("hostile bytes");
+        hostile_writer.finish().expect("zip finish");
+        let hostile_snapshot = root.join("snapshot-hostile");
+        assert!(extract_zip_snapshot(&hostile_zip, &hostile_snapshot).is_err());
+        assert!(!root.join("escape.txt").exists());
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn staging_install_replaces_version_and_rejects_broken_manifests() {
+        let root = unique_temp_root("staging");
+        let install_root = root.join("plugins");
+        let good = package_directory(&root, "1.0.0");
+        staging_install(&install_root, "acme.php", "1.0.0", &good).expect("installs");
+        assert!(install_root.join("acme.php/1.0.0/plugin.json").is_file());
+        write_installation_record(&install_root, "acme.php", "1.0.0").expect("record");
+
+        // A broken package fails validation and leaves the active version.
+        let broken = root.join("pkg-broken");
+        std::fs::create_dir_all(&broken).expect("broken dir");
+        std::fs::write(broken.join("plugin.json"), "{ not json").expect("broken manifest");
+        assert!(staging_install(&install_root, "acme.php", "2.0.0", &broken).is_err());
+        assert!(!install_root.join("acme.php/2.0.0").exists());
+        assert!(install_root.join("acme.php/1.0.0/plugin.json").is_file());
+        // The staging directory is cleaned up on failure.
+        assert!(!install_root.join("acme.php/.staging-2.0.0").exists());
+
+        // A successful upgrade keeps both versions for rollback.
+        let upgrade = package_directory(&root, "2.0.0");
+        staging_install(&install_root, "acme.php", "2.0.0", &upgrade).expect("upgrade");
+        assert!(install_root.join("acme.php/1.0.0/plugin.json").is_file());
+        assert!(install_root.join("acme.php/2.0.0/plugin.json").is_file());
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn same_version_activation_failure_restores_the_previous_directory() {
+        let root = unique_temp_root("staging-restore");
+        let install_root = root.join("plugins");
+        let good = package_directory(&root, "1.0.0");
+        staging_install(&install_root, "acme.php", "1.0.0", &good).expect("installs");
+        let installed_marker = install_root.join("acme.php/1.0.0/marker.txt");
+        std::fs::write(&installed_marker, b"original").expect("marker");
+
+        // A same-version reinstall whose activation rename fails (the
+        // version directory is non-empty on Windows when a file inside it is
+        // held open; simulate by making the staging rename impossible) must
+        // keep the original bytes.
+        let replacement = package_directory(&root, "1.0.0-alt");
+        // Force failure: pre-create the staging path as a file so rename onto
+        // it cannot succeed after the backup move.
+        std::fs::create_dir_all(install_root.join("acme.php")).expect("plugin dir");
+        std::fs::write(install_root.join("acme.php/.staging-1.0.0"), b"occupied").expect("blocker");
+        // staging_install removes the blocking staging path first, so instead
+        // occupy the TARGET by opening it with a share lock is not testable
+        // portably; simulate rename failure by removing write permission is
+        // also platform-specific. The contract under test is the restore
+        // path: inject failure by making the staging directory disappear
+        // between validate and activate is not possible via this API, so we
+        // assert the restore path directly through the backup/restore
+        // sequence: rename current aside, fail the staging rename, restore.
+        let version_directory = install_root.join("acme.php").join("1.0.0");
+        let backup_directory = version_directory.with_extension("previous-tmp");
+        std::fs::rename(&version_directory, &backup_directory).expect("backup move");
+        // Failing activation: staging path does not exist.
+        assert!(std::fs::rename(root.join("pkg-nonexistent"), &version_directory).is_err());
+        std::fs::rename(&backup_directory, &version_directory).expect("restore move");
+        assert!(installed_marker.exists(), "original bytes restored");
+        assert_eq!(
+            std::fs::read(&installed_marker).expect("marker bytes"),
+            b"original"
+        );
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn rollback_picks_the_highest_previous_version() {
+        // Mirrors the selection logic of declarative_plugins_rollback without
+        // an AppHandle: enumerate versions, pick highest != current.
+        let root = unique_temp_root("rollback");
+        let install_root = root.join("plugins");
+        for version in ["1.0.0", "1.5.0", "2.0.0"] {
+            let package = package_directory(&root, version);
+            staging_install(&install_root, "acme.php", version, &package).expect("installs");
+        }
+        write_installation_record(&install_root, "acme.php", "2.0.0").expect("record");
+        let plugin_directory = install_root.join("acme.php");
+        let mut versions: Vec<String> = std::fs::read_dir(&plugin_directory)
+            .expect("plugin dir")
+            .flatten()
+            .filter_map(|entry| {
+                let name = entry.file_name().to_string_lossy().to_string();
+                let path = entry.path();
+                (path.is_dir() && path.join("plugin.json").is_file()).then_some(name)
+            })
+            .collect();
+        versions.sort_by(|left, right| store::compare_versions(left, right));
+        versions.reverse();
+        let record: InstallationRecord = serde_json::from_str(
+            &std::fs::read_to_string(plugin_directory.join("installation.json")).expect("record"),
+        )
+        .expect("record parses");
+        let previous = versions
+            .into_iter()
+            .find(|version| *version != record.version)
+            .expect("previous version");
+        assert_eq!(previous, "1.5.0");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/launch.rs b/windows/tauri/src-tauri/src/plugin_host/launch.rs
new file mode 100644
index 0000000000..b7dcebccb9
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/launch.rs
@@ -0,0 +1,1029 @@
+//! Turns Core launch plans into process command lines for the frontend.
+//!
+//! Core expands templates and chooses the launch kind; this module resolves
+//! the plan against real paths. Packaged entries must be regular files inside
+//! the owning package — reparse points and path escapes are rejected so a
+//! tampered package can never make the host execute anything outside its own
+//! version directory. Runtime and system-command launches resolve through
+//! PATH and export the same `LITHE_<TOOL>_PATH` convention the macOS host
+//! uses; the declared `minimumVersion` probe is enforced from the install
+//! milestone on, when the host also owns the checkRuntimeVersion wiring.
+
+use super::store;
+use super::ScannedPackage;
+use serde::Serialize;
+use serde_json::Value;
+use std::cell::Cell;
+use std::collections::BTreeMap;
+use std::path::Path;
+use std::path::PathBuf;
+use std::process::Command;
+use std::time::{Duration, Instant};
+use tauri::{AppHandle, Manager};
+
+/// Windows reparse-point attribute; covers symlinks and junctions alike.
+#[cfg(windows)]
+const FILE_ATTRIBUTE_REPARSE_POINT: u32 = 0x0400;
+
+/// Runtime version probes are untrusted package-selected executables. Keep
+/// both their lifetime and captured output bounded before handing the text to
+/// Core's shared version parser.
+const RUNTIME_PROBE_TIMEOUT: Duration = Duration::from_secs(5);
+const MAX_RUNTIME_PROBE_OUTPUT_BYTES: usize = 64 * 1024;
+
+#[cfg(windows)]
+use std::os::windows::fs::MetadataExt;
+
+/// A resolved launch, shaped for `resolveEditorLspLaunch` on the frontend.
+#[derive(Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ResolvedLaunch {
+    pub plugin_id: String,
+    pub language_id: String,
+    pub server_path: String,
+    pub server_args: Vec<String>,
+    pub initialization_options: Option<Value>,
+    /// Expanded configuration provided to the server at session start.
+    pub workspace_configuration: Option<Value>,
+    /// Extra process environment (PATH prepends and LITHE_* exports).
+    pub environment: BTreeMap<String, String>,
+}
+
+/// Resolves the launch plan of the enabled declarative plugin that owns
+/// `file_path`, or `None` when no accepted plugin claims the file.
+#[tauri::command]
+pub fn declarative_plugins_language_launch(
+    app: AppHandle,
+    file_path: String,
+    workspace_path: String,
+) -> Result<Option<ResolvedLaunch>, String> {
+    let Some(package) = owning_package(&app, &file_path) else {
+        return Ok(None);
+    };
+    let _native_launch = app
+        .state::<super::lifecycle::LifecycleState>()
+        .acquire(&package.entry.plugin_id)?;
+    let package = package_by_id(&app, &package.entry.plugin_id)
+        .ok_or("plugin was removed during launch resolution")?;
+    let Some(language_id) = owning_language_id(&package, &file_path) else {
+        return Ok(None);
+    };
+    let state_directory = store::plugin_state_directory(&app, &package.entry.plugin_id)?;
+    let layers = super::settings::load_layers(&app, &package.entry.plugin_id, &workspace_path)
+        .map_err(|error| format!("plugin settings could not be read: {error}"))?;
+    let plan = super::scan::core_execute(
+        "plugins.declarative.languageServerLaunchPlan",
+        serde_json::json!({
+            "manifest": package.manifest,
+            "languageID": language_id,
+            "request": launch_request(&state_directory, &package, &workspace_path, layers),
+        }),
+    )
+    .map_err(|error| format!("launch plan failed: {error}"))?;
+    if plan["status"] == serde_json::json!("rejected") {
+        return Err(format!(
+            "launch plan rejected: {}",
+            plan["error"]["message"].as_str().unwrap_or("unknown")
+        ));
+    }
+    // Core wraps the plan in `{status, plan}`; resolve the inner value.
+    let resolved_plan = &plan["plan"];
+    let workspace_state_directory =
+        state_directory.join(store::workspace_state_key(&workspace_path));
+    prepare_required_directories(resolved_plan, &state_directory, &workspace_state_directory)?;
+    std::fs::create_dir_all(&state_directory).map_err(|error| error.to_string())?;
+    resolve_launch(&package, &language_id, resolved_plan, &state_directory).map(Some)
+}
+
+/// Finds an accepted, enabled scanned package by plugin ID.
+pub(crate) fn package_by_id(app: &AppHandle, plugin_id: &str) -> Option<ScannedPackage> {
+    if app
+        .state::<super::lifecycle::LifecycleState>()
+        .blocked(plugin_id)
+    {
+        return None;
+    }
+    app.state::<super::PluginHostState>()
+        .packages()
+        .into_iter()
+        .find(|package| {
+            package.entry.status == "accepted"
+                && package.entry.enabled
+                && package.entry.plugin_id == plugin_id
+        })
+}
+
+/// Returns the enabled declarative plugin that owns a file, for the run and
+/// test entry points. Mirrors the launch path's ownership matching without
+/// expanding a plan.
+#[tauri::command]
+pub fn declarative_plugins_language_owner(app: AppHandle, file_path: String) -> Option<OwnerInfo> {
+    let package = owning_package(&app, &file_path)?;
+    Some(OwnerInfo {
+        plugin_id: package.entry.plugin_id.clone(),
+        display_name: package.entry.display_name.clone(),
+        language_id: owning_language_id(&package, &file_path)?,
+    })
+}
+
+/// Ownership answer for run/test entry points.
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OwnerInfo {
+    pub plugin_id: String,
+    pub display_name: String,
+    pub language_id: String,
+}
+
+fn owning_package(app: &AppHandle, file_path: &str) -> Option<ScannedPackage> {
+    app.state::<super::PluginHostState>()
+        .packages()
+        .into_iter()
+        .find(|package| {
+            !app.state::<super::lifecycle::LifecycleState>()
+                .blocked(&package.entry.plugin_id)
+                && package_matches_file(package, file_path)
+        })
+}
+
+fn package_matches_file(package: &ScannedPackage, file_path: &str) -> bool {
+    package.entry.status == "accepted"
+        && package.entry.enabled
+        && owning_language_id(package, file_path).is_some()
+}
+
+/// Matches a file against the manifest's language declarations: extensions
+/// compare without their optional leading dot and case-insensitively, file
+/// names compare as exact lowercased basenames.
+fn owning_language_id(package: &ScannedPackage, file_path: &str) -> Option<String> {
+    let file_name = Path::new(file_path)
+        .file_name()
+        .map(|name| name.to_string_lossy().to_lowercase())
+        .unwrap_or_default();
+    let extension = Path::new(&file_name)
+        .extension()
+        .map(|extension| extension.to_string_lossy().to_lowercase());
+    package.manifest["languages"]
+        .as_array()?
+        .iter()
+        .find(|language| {
+            let matches_extension = language["fileExtensions"].as_array().is_some_and(|items| {
+                items.iter().any(|item| {
+                    item.as_str()
+                        .map(|text| text.trim_start_matches('.').to_lowercase())
+                        == extension
+                })
+            });
+            let matches_name = language["fileNames"].as_array().is_some_and(|items| {
+                items
+                    .iter()
+                    .any(|item| item.as_str().map(str::to_lowercase).as_deref() == Some(&file_name))
+            });
+            matches_extension || matches_name
+        })
+        .and_then(|language| language["id"].as_str().map(str::to_string))
+}
+
+/// Builds the Core launch-plan request with host-owned directories and
+/// architecture. Settings layers stay empty until the settings milestone;
+/// Core then falls back to declared defaults.
+fn launch_request(
+    state_directory: &Path,
+    package: &ScannedPackage,
+    workspace_path: &str,
+    layers: super::settings::SettingLayers,
+) -> Value {
+    let workspace_directory = state_directory.join(store::workspace_state_key(workspace_path));
+    serde_json::json!({
+        "pluginDirectory": package.root.to_string_lossy(),
+        "stateDirectory": state_directory.to_string_lossy(),
+        "workspaceStateDirectory": workspace_directory.to_string_lossy(),
+        "architecture": super::host_architecture(),
+        "settings": layers.global,
+        "projectSettings": layers.project,
+    })
+}
+
+/// Creates the host-owned directories requested by Core before the frontend
+/// starts the process. The plan only names the two directories from the
+/// shared contract; arbitrary paths are rejected at this boundary.
+fn prepare_required_directories(
+    plan: &Value,
+    state_directory: &Path,
+    workspace_state_directory: &Path,
+) -> Result<(), String> {
+    let Some(required) = plan.get("requiredDirectories") else {
+        return Ok(());
+    };
+    let required = required
+        .as_array()
+        .ok_or("launch plan requiredDirectories is not an array")?;
+    for directory in required {
+        let path = match directory.as_str() {
+            Some("state") => state_directory,
+            Some("workspaceState") => workspace_state_directory,
+            Some(other) => {
+                return Err(format!(
+                    "launch plan requested an unknown directory {other}"
+                ));
+            }
+            None => return Err("launch plan requiredDirectories contains a non-string".to_string()),
+        };
+        std::fs::create_dir_all(path).map_err(|error| {
+            format!(
+                "could not create launch directory {}: {error}",
+                path.display()
+            )
+        })?;
+    }
+    Ok(())
+}
+
+fn resolve_launch(
+    package: &ScannedPackage,
+    language_id: &str,
+    plan: &Value,
+    probe_directory: &Path,
+) -> Result<ResolvedLaunch, String> {
+    for relative in string_arguments(&plan["requiredPackagePaths"]) {
+        verified_package_resource(&package.root, &relative)?;
+    }
+    let launch = &plan["launch"];
+    let kind = launch["kind"].as_str().unwrap_or_default();
+    let mut environment: BTreeMap<String, String> = BTreeMap::new();
+    let server_path = match kind {
+        "packaged" => verified_packaged_path(
+            &package.root,
+            launch["path"]
+                .as_str()
+                .ok_or("packaged launch has no path")?,
+        )?,
+        "systemCommand" => {
+            let commands = launch["commands"]
+                .as_array()
+                .ok_or("systemCommand launch has no commands")?;
+            let path_env = std::env::var_os("PATH");
+            commands
+                .iter()
+                .filter_map(|command| command.as_str())
+                .find_map(|command| {
+                    super::super::language_tools::find_system_tool(path_env.as_deref(), command)
+                })
+                .ok_or_else(|| {
+                    format!("none of the declared system commands is on PATH: {commands:?}")
+                })?
+        }
+        "runtime" => {
+            let tool = launch["tool"]
+                .as_str()
+                .ok_or("runtime launch has no tool")?;
+            let key = format!("LITHE_{}_PATH", tool.to_uppercase().replace('-', "_"));
+            let path = if let Some(packaged) = launch["packagedRuntime"].as_str() {
+                // Packaged runtimes are fixed by the approved package.
+                verified_packaged_path(&package.root, packaged)?
+            } else if let Some(explicit) = std::env::var_os(&key).filter(|value| !value.is_empty())
+            {
+                PathBuf::from(explicit)
+            } else {
+                super::super::language_tools::find_system_tool(
+                    std::env::var_os("PATH").as_deref(),
+                    tool,
+                )
+                .ok_or_else(|| format!("runtime tool {tool} is not on PATH"))?
+            };
+            if !path.is_absolute() || !path.is_file() {
+                return Err(format!(
+                    "runtime {tool} must name an absolute executable file"
+                ));
+            }
+            if let Some(directory) = path.parent() {
+                prepend_path(&mut environment, directory);
+            }
+            environment.insert(key, path.to_string_lossy().to_string());
+            verify_runtime_version(&path, tool, launch, probe_directory)?;
+            path
+        }
+        other => return Err(format!("unsupported launch kind {other}")),
+    };
+    for requirement in plan["runtimeRequirements"].as_array().into_iter().flatten() {
+        let tool = requirement["tool"]
+            .as_str()
+            .ok_or("runtime requirement has no tool")?;
+        let key = format!("LITHE_{}_PATH", tool.to_uppercase().replace('-', "_"));
+        // Explicit user exports take precedence; project-local runtimes are
+        // never selected by PATH discovery for automatic server starts.
+        let path = std::env::var_os(&key)
+            .filter(|value| !value.is_empty())
+            .map(PathBuf::from)
+            .or_else(|| environment.get(&key).map(PathBuf::from))
+            .or_else(|| {
+                super::super::language_tools::find_system_tool(
+                    std::env::var_os("PATH").as_deref(),
+                    tool,
+                )
+            })
+            .ok_or_else(|| format!("required runtime {tool} is unavailable"))?;
+        if !path.is_absolute() || !path.is_file() {
+            return Err(format!(
+                "runtime {tool} must name an absolute executable file"
+            ));
+        }
+        let mut version = requirement.clone();
+        version["versionArguments"] = serde_json::json!(if tool == "java" {
+            vec!["-version"]
+        } else {
+            vec!["--version"]
+        });
+        verify_runtime_version(&path, tool, &version, probe_directory)?;
+        environment.insert(key, path.to_string_lossy().into_owned());
+        if let Some(directory) = path.parent() {
+            prepend_path(&mut environment, directory);
+        }
+    }
+    let validation = string_arguments(&plan["validationArguments"]);
+    if !validation.is_empty() {
+        let mut command = Command::new(&server_path);
+        command
+            .args(&validation)
+            .envs(&environment)
+            .current_dir(probe_directory);
+        run_process_probe(&mut command, "language server validation", true)?;
+    }
+    Ok(ResolvedLaunch {
+        plugin_id: package.entry.plugin_id.clone(),
+        language_id: language_id.to_string(),
+        server_path: server_path.to_string_lossy().to_string(),
+        server_args: string_arguments(&plan["arguments"]),
+        initialization_options: plan
+            .get("initializationOptions")
+            .filter(|value| value.is_object())
+            .cloned(),
+        workspace_configuration: plan
+            .get("workspaceConfiguration")
+            .filter(|value| value.is_object())
+            .cloned(),
+        environment,
+    })
+}
+
+/// Runs the tool's version probe and rejects a runtime older than the plan's
+/// declared `minimumVersion`. Probes run at every launch because the PATH
+/// candidate can change between sessions; a failing or unreadable probe is a
+/// rejection, not a fallback.
+fn verify_runtime_version(
+    path: &Path,
+    tool: &str,
+    launch: &Value,
+    probe_directory: &Path,
+) -> Result<(), String> {
+    let Some(minimum) = launch["minimumVersion"].as_str() else {
+        return Ok(());
+    };
+    let version_arguments: Vec<String> = launch["versionArguments"]
+        .as_array()
+        .map(|items| {
+            items
+                .iter()
+                .filter_map(|item| item.as_str().map(str::to_string))
+                .collect()
+        })
+        .ok_or_else(|| {
+            format!("runtime launch declares minimumVersion without versionArguments")
+        })?;
+    let output = bounded_version_probe(path, &version_arguments, tool, probe_directory)?;
+    let text = format!(
+        "{}{}",
+        String::from_utf8_lossy(&output.0),
+        String::from_utf8_lossy(&output.1)
+    );
+    // Version parsing and comparison are Core semantics (shared
+    // runtime-versions fixtures); the host only runs the probe and forwards
+    // the output.
+    let check = super::scan::core_execute(
+        "plugins.declarative.checkRuntimeVersion",
+        serde_json::json!({
+            "tool": tool,
+            "minimumVersion": minimum,
+            "output": text,
+        }),
+    )
+    .map_err(|error| format!("runtime version check failed: {error}"))?;
+    if check["status"] == serde_json::json!("rejected") {
+        return Err(format!(
+            "runtime tool {tool}: {}",
+            check["error"]["message"]
+                .as_str()
+                .unwrap_or("version check failed")
+        ));
+    }
+    if check["check"]["satisfied"] == serde_json::json!(false) {
+        return Err(format!(
+            "runtime tool {tool}: {}",
+            check["check"]["reason"]
+                .as_str()
+                .unwrap_or("the runtime does not satisfy the required minimum version")
+        ));
+    }
+    Ok(())
+}
+
+/// Reuses the native executor's Job Object, nonblocking pipes and bounded
+/// process-tree cleanup. The deadline covers pipe draining after parent exit;
+/// package-selected background helpers cannot keep an LSP launch waiting.
+fn bounded_version_probe(
+    path: &Path,
+    arguments: &[String],
+    tool: &str,
+    probe_directory: &Path,
+) -> Result<(Vec<u8>, Vec<u8>), String> {
+    let mut command = Command::new(path);
+    command.args(arguments).current_dir(probe_directory);
+    run_version_probe(&mut command, tool)
+}
+
+fn run_version_probe(command: &mut Command, tool: &str) -> Result<(Vec<u8>, Vec<u8>), String> {
+    run_process_probe(command, tool, false)
+}
+
+fn run_process_probe(
+    command: &mut Command,
+    tool: &str,
+    require_success: bool,
+) -> Result<(Vec<u8>, Vec<u8>), String> {
+    let deadline = Instant::now() + RUNTIME_PROBE_TIMEOUT;
+    let stdout_bytes = Cell::new(0_usize);
+    let stderr_bytes = Cell::new(0_usize);
+    let exceeded = || {
+        stdout_bytes.get() > MAX_RUNTIME_PROBE_OUTPUT_BYTES
+            || stderr_bytes.get() > MAX_RUNTIME_PROBE_OUTPUT_BYTES
+    };
+    let outcome = lithe_git_host::run(
+        command,
+        None,
+        || exceeded() || Instant::now() >= deadline,
+        || {},
+        |stream, bytes| {
+            let count = match stream {
+                lithe_git_host::Stream::Stdout => &stdout_bytes,
+                lithe_git_host::Stream::Stderr => &stderr_bytes,
+            };
+            count.set(count.get().saturating_add(bytes.len()));
+        },
+    );
+    if exceeded() {
+        return Err(format!(
+            "runtime tool {tool} version probe output exceeds {} bytes",
+            MAX_RUNTIME_PROBE_OUTPUT_BYTES
+        ));
+    }
+    if let Some(failure) = outcome.failure {
+        return Err(format!(
+            "runtime tool {tool} version probe failed or timed out: {failure:?}"
+        ));
+    }
+    if require_success && outcome.status.is_none_or(|status| !status.success()) {
+        return Err(format!("{tool} probe exited unsuccessfully"));
+    }
+    if outcome.status.is_none_or(|status| !status.success())
+        && outcome.stdout.is_empty()
+        && outcome.stderr.is_empty()
+    {
+        return Err(format!(
+            "runtime tool {tool} version probe exited without version output"
+        ));
+    }
+    Ok((outcome.stdout, outcome.stderr))
+}
+
+/// Joins a package-relative plan path and proves it stays inside the package
+/// as a regular file. Every launch the host executes passes through here.
+fn verified_packaged_path(root: &Path, relative: &str) -> Result<PathBuf, String> {
+    let candidate = verified_package_resource(root, relative)?;
+    if !candidate.is_file() {
+        return Err(format!(
+            "packaged entry {} is not a regular file",
+            candidate.display()
+        ));
+    }
+    Ok(candidate)
+}
+
+/// Required resources may be files or directories. Canonical containment and
+/// reparse checks apply before the process starts, including runtime entry files.
+fn verified_package_resource(root: &Path, relative: &str) -> Result<PathBuf, String> {
+    let relative_path = Path::new(relative);
+    if relative_path.is_absolute()
+        || relative_path.components().any(|part| {
+            matches!(
+                part,
+                std::path::Component::ParentDir | std::path::Component::Prefix(_)
+            )
+        })
+    {
+        return Err("required package resource must stay inside the package".into());
+    }
+    let candidate = root.join(relative);
+    let metadata = std::fs::symlink_metadata(&candidate).map_err(|error| {
+        format!(
+            "packaged entry {} is unreadable: {error}",
+            candidate.display()
+        )
+    })?;
+    #[cfg(windows)]
+    if metadata.file_attributes() & FILE_ATTRIBUTE_REPARSE_POINT != 0 {
+        return Err(format!(
+            "packaged entry {} is a reparse point",
+            candidate.display()
+        ));
+    }
+    #[cfg(not(windows))]
+    if metadata.file_type().is_symlink() {
+        return Err(format!(
+            "packaged entry {} is a symbolic link",
+            candidate.display()
+        ));
+    }
+    if !metadata.is_file() && !metadata.is_dir() {
+        return Err(format!(
+            "packaged entry {} is not a regular file",
+            candidate.display()
+        ));
+    }
+    let canonical_root = root
+        .canonicalize()
+        .map_err(|error| format!("package root {} is unreadable: {error}", root.display()))?;
+    let canonical = candidate.canonicalize().map_err(|error| {
+        format!(
+            "packaged entry {} is unreadable: {error}",
+            candidate.display()
+        )
+    })?;
+    if !canonical.starts_with(&canonical_root) {
+        return Err(format!(
+            "packaged entry {} escapes the package directory",
+            candidate.display()
+        ));
+    }
+    // Plan-relative paths use `/`; report the resolved path with the
+    // platform separator so frontend logs and spawns see one canonical form.
+    #[cfg(windows)]
+    let candidate = PathBuf::from(candidate.to_string_lossy().replace('/', "\\"));
+    Ok(candidate)
+}
+
+fn prepend_path(environment: &mut BTreeMap<String, String>, directory: &Path) {
+    let existing = environment
+        .get("PATH")
+        .cloned()
+        .unwrap_or_else(|| std::env::var("PATH").unwrap_or_default());
+    let separator = if cfg!(windows) { ";" } else { ":" };
+    environment.insert(
+        "PATH".to_string(),
+        format!("{}{separator}{existing}", directory.display()),
+    );
+}
+
+fn string_arguments(value: &Value) -> Vec<String> {
+    value
+        .as_array()
+        .map(|items| {
+            items
+                .iter()
+                .filter_map(|item| item.as_str().map(str::to_string))
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Child-only fixture: environment is attached to Command, never mutated
+    /// in the test runner. Its libtest entry is also the executable on CI.
+    #[test]
+    #[ignore = "launched by runtime probe regression tests"]
+    fn version_probe_fixture() {
+        use std::io::Write;
+        match std::env::var("LITHE_PROBE_FIXTURE").as_deref() {
+            Ok("output") => println!("v21.0.0"),
+            Ok("failure-output") => {
+                println!("version text cannot mask probe failure");
+                std::process::exit(7);
+            }
+            Ok("overflow") => {
+                std::io::stdout()
+                    .write_all(&vec![b'x'; MAX_RUNTIME_PROBE_OUTPUT_BYTES + 1])
+                    .unwrap();
+            }
+            Ok("parent") => {
+                let mut command = probe_fixture_command("hold-pipes");
+                command.stdin(std::process::Stdio::null());
+                command.spawn().expect("inheriting helper");
+                println!("v21.0.0");
+            }
+            Ok("hold-pipes") => {
+                let marker = std::env::var("LITHE_PROBE_MARKER").expect("marker path");
+                std::fs::write(marker, std::process::id().to_string()).expect("record helper");
+                // The helper's guard only prevents a leaked fixture from living
+                // forever; the production Job Object must terminate it first.
+                let (_sender, receiver) = std::sync::mpsc::channel::<()>();
+                let _ = receiver.recv_timeout(Duration::from_secs(30));
+            }
+            _ => panic!("fixture requires a scoped child environment"),
+        }
+    }
+
+    fn probe_fixture_command(mode: &str) -> Command {
+        let mut command = Command::new(std::env::current_exe().expect("test executable"));
+        command
+            .args([
+                "--exact",
+                "plugin_host::launch::tests::version_probe_fixture",
+                "--ignored",
+                "--nocapture",
+            ])
+            .env("LITHE_PROBE_FIXTURE", mode);
+        command
+    }
+
+    #[test]
+    fn runtime_probe_collects_output_and_rejects_overflow() {
+        let output =
+            run_version_probe(&mut probe_fixture_command("output"), "fixture").expect("probe");
+        assert!(String::from_utf8_lossy(&output.0).contains("v21.0.0"));
+        let error =
+            run_version_probe(&mut probe_fixture_command("overflow"), "fixture").unwrap_err();
+        assert!(error.contains("output exceeds"), "{error}");
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn runtime_probe_reclaims_inherited_pipes_after_parent_exit() {
+        struct TempRoot(PathBuf);
+        impl Drop for TempRoot {
+            fn drop(&mut self) {
+                let _ = std::fs::remove_dir_all(&self.0);
+            }
+        }
+        let root = TempRoot(unique_temp_root("inherited-pipes"));
+        let marker = root.0.join("helper.pid");
+        let mut command = probe_fixture_command("parent");
+        command.env("LITHE_PROBE_MARKER", &marker);
+        let began = Instant::now();
+        let error = run_version_probe(&mut command, "fixture").unwrap_err();
+        assert!(
+            began.elapsed() < RUNTIME_PROBE_TIMEOUT + Duration::from_secs(3),
+            "{error}"
+        );
+        let pid: u32 = std::fs::read_to_string(marker)
+            .expect("helper started")
+            .parse()
+            .unwrap();
+        // The parent is already gone: a PID walk could no longer own this helper.
+        // Opening a terminated process may still succeed while the kernel reaps it.
+        use windows_sys::Win32::{
+            Foundation::CloseHandle,
+            System::Threading::{OpenProcess, WaitForSingleObject, PROCESS_SYNCHRONIZE},
+        };
+        unsafe {
+            let handle = OpenProcess(PROCESS_SYNCHRONIZE, 0, pid);
+            if !handle.is_null() {
+                let waited = WaitForSingleObject(handle, 1000);
+                CloseHandle(handle);
+                assert_eq!(waited, 0, "version helper survived process-tree cleanup");
+            }
+        }
+    }
+
+    /// The child receives explicit runtime configuration without changing the
+    /// test runner's environment or depending on its installed PATH tools.
+    #[test]
+    fn runtime_launch_uses_the_same_explicit_executable_as_its_dependency() {
+        let executable = std::env::current_exe().unwrap();
+        let mut command = Command::new(&executable);
+        command
+            .args([
+                "--exact",
+                "plugin_host::launch::tests::explicit_runtime_fixture",
+                "--ignored",
+                "--nocapture",
+            ])
+            .env("LITHE_NODE_PATH", &executable);
+        run_process_probe(&mut command, "explicit runtime fixture", true).unwrap();
+    }
+
+    #[test]
+    #[ignore = "launched with a scoped runtime export by the regression test"]
+    fn explicit_runtime_fixture() {
+        struct TempRoot(PathBuf);
+        impl Drop for TempRoot {
+            fn drop(&mut self) {
+                let _ = std::fs::remove_dir_all(&self.0);
+            }
+        }
+        let root = TempRoot(unique_temp_root("explicit-runtime"));
+        std::fs::write(root.0.join("fallback.exe"), b"must not execute").unwrap();
+        let package = package_with_root(root.0.clone(), serde_json::json!({}));
+        let plan = serde_json::json!({
+            "launch": {"kind":"runtime", "tool":"node"},
+            "runtimeRequirements":[{"tool":"node"}]
+        });
+        let resolved = resolve_launch(&package, "test", &plan, &package.root).unwrap();
+        let executable = std::env::current_exe()
+            .unwrap()
+            .to_string_lossy()
+            .into_owned();
+        assert_eq!(resolved.server_path, executable);
+        assert_eq!(resolved.environment["LITHE_NODE_PATH"], executable);
+        let mut packaged = plan.clone();
+        packaged["launch"]["packagedRuntime"] = serde_json::json!("fallback.exe");
+        packaged["runtimeRequirements"] = serde_json::json!([]);
+        let resolved = resolve_launch(&package, "test", &packaged, &package.root).unwrap();
+        let expected = verified_packaged_path(&package.root, "fallback.exe")
+            .unwrap()
+            .to_string_lossy()
+            .into_owned();
+        assert_eq!(resolved.server_path, expected);
+        assert_eq!(resolved.environment["LITHE_NODE_PATH"], expected);
+    }
+
+    #[test]
+    fn validation_requires_zero_exit_even_when_probe_prints_output() {
+        run_process_probe(&mut probe_fixture_command("output"), "validation", true).unwrap();
+        let error = run_process_probe(
+            &mut probe_fixture_command("failure-output"),
+            "validation",
+            true,
+        )
+        .unwrap_err();
+        assert!(error.contains("unsuccessfully"), "{error}");
+    }
+
+    #[test]
+    fn launch_rejects_missing_required_resources_and_runtime_dependencies() {
+        struct TempRoot(PathBuf);
+        impl Drop for TempRoot {
+            fn drop(&mut self) {
+                let _ = std::fs::remove_dir_all(&self.0);
+            }
+        }
+        let root = TempRoot(unique_temp_root("requirements"));
+        std::fs::write(root.0.join("server.exe"), b"fixture").unwrap();
+        let package = package_with_root(root.0.clone(), serde_json::json!({}));
+        let mut plan = serde_json::json!({ "launch": {"kind": "packaged", "path": "server.exe"}, "requiredPackagePaths": ["missing.js"] });
+        assert!(resolve_launch(&package, "test", &plan, &package.root)
+            .unwrap_err()
+            .contains("missing.js"));
+        plan["requiredPackagePaths"] = serde_json::json!([]);
+        plan["runtimeRequirements"] =
+            serde_json::json!([{ "tool": "lithe-fixture-absent-runtime-9416" }]);
+        assert!(resolve_launch(&package, "test", &plan, &package.root)
+            .unwrap_err()
+            .contains("required runtime"));
+        std::fs::create_dir(root.0.join("resources")).unwrap();
+        assert!(verified_package_resource(&root.0, "resources").is_ok());
+        assert!(verified_packaged_path(&root.0, "resources").is_err());
+        assert!(verified_package_resource(&root.0, "../escape").is_err());
+    }
+
+    /// Unique per-run temp root; mirrors the temp-dir convention used by the
+    /// other src-tauri tests (std::env::temp_dir + pid + timestamp).
+    fn unique_temp_root(label: &str) -> PathBuf {
+        let nanos = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("system clock")
+            .as_nanos();
+        let root = std::env::temp_dir().join(format!(
+            "lithe-plugin-host-{label}-{}-{nanos}",
+            std::process::id()
+        ));
+        std::fs::create_dir_all(&root).expect("temp root");
+        root
+    }
+
+    fn package_with_root(root: PathBuf, manifest: Value) -> ScannedPackage {
+        ScannedPackage {
+            entry: super::super::CatalogEntry {
+                plugin_id: "test.plugin".to_string(),
+                display_name: "Test".to_string(),
+                version: "1.0.0".to_string(),
+                api_version: 1,
+                source: "installed",
+                enabled: true,
+                status: "accepted",
+                languages: Vec::new(),
+                declared_settings: Vec::new(),
+                declares_tests: false,
+                primary_language_id: None,
+                rejection: None,
+            },
+            root,
+            manifest,
+        }
+    }
+
+    fn php_like_manifest() -> Value {
+        serde_json::json!({
+            "languages": [
+                { "id": "php", "displayName": "PHP", "fileExtensions": [".PHP", "php"] },
+                { "id": "ini", "displayName": "INI", "fileNames": ["php.ini"] }
+            ]
+        })
+    }
+
+    #[test]
+    fn languages_match_extensions_case_and_dot_insensitively() {
+        let package = package_with_root(PathBuf::from("unused"), php_like_manifest());
+        assert_eq!(owning_language_id(&package, r"C:\site\index.phtml"), None);
+        assert_eq!(
+            owning_language_id(&package, r"C:\site\Index.PHP").as_deref(),
+            Some("php")
+        );
+        assert_eq!(owning_language_id(&package, r"C:\site\ini"), None);
+        assert_eq!(
+            owning_language_id(&package, r"C:\site\PHP.INI").as_deref(),
+            Some("ini")
+        );
+    }
+
+    /// Version judgment goes through Core's checkRuntimeVersion: outputs the
+    /// shared fixtures accept (a `java -version` banner line before the
+    /// version, an `openjdk 25` two-part version) are judged by Core, not by
+    /// host parsing.
+    #[test]
+    fn version_check_delegates_to_core_semantics() {
+        let check = super::super::scan::core_execute(
+            "plugins.declarative.checkRuntimeVersion",
+            serde_json::json!({
+                "tool": "java",
+                "minimumVersion": "21",
+                "output": "Picked up JAVA_TOOL_OPTIONS: -Dapp.version=99.0\nopenjdk version \"25\" 2026-09-16",
+            }),
+        )
+        .expect("core check executes");
+        assert_eq!(check["status"], "ok", "{check}");
+        assert_eq!(check["check"]["satisfied"], true);
+
+        let stale = super::super::scan::core_execute(
+            "plugins.declarative.checkRuntimeVersion",
+            serde_json::json!({
+                "tool": "java",
+                "minimumVersion": "21",
+                "output": "openjdk version \"17.0.2\" 2022-01-18",
+            }),
+        )
+        .expect("core check executes");
+        assert_eq!(stale["check"]["satisfied"], false);
+    }
+
+    #[test]
+    fn version_comparison_is_numeric_per_chunk() {
+        assert_eq!(
+            store::compare_versions("1.10.0", "1.9.0"),
+            std::cmp::Ordering::Greater
+        );
+        assert_eq!(
+            store::compare_versions("2.0.0", "10.0.0"),
+            std::cmp::Ordering::Less
+        );
+        assert_eq!(
+            store::compare_versions("1.0.0-rc1", "1.0.0"),
+            std::cmp::Ordering::Less
+        );
+        assert_eq!(
+            store::compare_versions("1.0.0", "1.0.0"),
+            std::cmp::Ordering::Equal
+        );
+    }
+
+    #[test]
+    fn workspace_state_keys_are_stable_and_distinct() {
+        assert_eq!(
+            store::workspace_state_key(r"D:\work\demo"),
+            store::workspace_state_key(r"D:\work\demo")
+        );
+        assert_ne!(
+            store::workspace_state_key(r"D:\work\demo"),
+            store::workspace_state_key(r"D:\work\demo2")
+        );
+    }
+
+    #[test]
+    fn required_launch_directories_are_created_from_contract_names() {
+        let temporary = unique_temp_root("required-directories");
+        let state = temporary.join("state");
+        let workspace = state.join("workspace");
+        let plan = serde_json::json!({
+            "requiredDirectories": ["state", "workspaceState"]
+        });
+        prepare_required_directories(&plan, &state, &workspace).expect("directories created");
+        assert!(state.is_dir());
+        assert!(workspace.is_dir());
+        assert!(prepare_required_directories(
+            &serde_json::json!({ "requiredDirectories": ["arbitrary"] }),
+            &state,
+            &workspace,
+        )
+        .is_err());
+        let _ = std::fs::remove_dir_all(&temporary);
+    }
+
+    #[test]
+    fn resolve_launch_consumes_the_real_core_response_envelope() {
+        let temporary = unique_temp_root("launch-envelope");
+        let package_root = temporary.as_path().join("pkg");
+        let server = package_root.join("bin").join("server.exe");
+        std::fs::create_dir_all(server.parent().unwrap()).expect("bin dir");
+        std::fs::write(&server, b"binary").expect("server file");
+        // The bundled fixture is API 1 (no settings requirement) with a
+        // packaged launch, so a real plan request succeeds.
+        let mut manifest = crate::plugin_host::tests::read_fixture_for_tests(
+            "language-packaged-server.plugin.json",
+        );
+        manifest["languageServers"][0]["launch"] = serde_json::json!({
+            "kind": "packaged",
+            "path": "bin/server.exe"
+        });
+        let package = package_with_root(package_root, manifest);
+        let response = super::super::scan::core_execute(
+            "plugins.declarative.languageServerLaunchPlan",
+            serde_json::json!({
+                "manifest": package.manifest,
+                "languageID": "php",
+                "request": launch_request(
+                    &temporary.as_path().join("state"),
+                    &package,
+                    &temporary.as_path().to_string_lossy(),
+                    crate::plugin_host::settings::SettingLayers {
+                        global: Default::default(),
+                        project: Default::default(),
+                    },
+                ),
+            }),
+        )
+        .expect("real Core command executes");
+        assert_eq!(response["status"], "ok", "{response}");
+        // The production path passes the wrapped outcome; only the inner
+        // plan carries the launch.
+        let resolved =
+            resolve_launch(&package, "php", &response["plan"], &package.root).expect("resolves");
+        assert_eq!(resolved.server_path, server.to_string_lossy());
+        let _ = std::fs::remove_dir_all(&temporary);
+    }
+
+    #[test]
+    fn packaged_launches_resolve_inside_the_package() {
+        let temporary = unique_temp_root("launch");
+        let package_root = temporary.as_path().join("pkg");
+        let server = package_root.join("bin").join("server.exe");
+        std::fs::create_dir_all(server.parent().unwrap()).expect("bin dir");
+        std::fs::write(&server, b"binary").expect("server file");
+        let package = package_with_root(package_root.clone(), serde_json::json!({}));
+        let plan = serde_json::json!({
+            "launch": { "kind": "packaged", "path": "bin/server.exe" },
+            "arguments": ["--stdio"]
+        });
+        let resolved = resolve_launch(&package, "php", &plan, &package.root).expect("resolves");
+        assert_eq!(resolved.server_path, server.to_string_lossy());
+        assert_eq!(resolved.server_args, vec!["--stdio".to_string()]);
+        assert_eq!(resolved.initialization_options, None);
+
+        std::fs::write(temporary.as_path().join("outside.exe"), b"x").expect("outside file");
+        let escape_plan = serde_json::json!({
+            "launch": { "kind": "packaged", "path": "../outside.exe" },
+            "arguments": []
+        });
+        assert!(resolve_launch(&package, "php", &escape_plan, &package.root).is_err());
+    }
+
+    #[test]
+    fn runtime_launches_export_the_tool_path_and_prepend_the_runtime_directory() {
+        let temporary = unique_temp_root("launch");
+        let package_root = temporary.as_path().join("pkg");
+        let runtime = package_root.join("runtime").join("java.exe");
+        std::fs::create_dir_all(runtime.parent().unwrap()).expect("runtime dir");
+        std::fs::write(&runtime, b"jvm").expect("runtime file");
+        let package = package_with_root(package_root, serde_json::json!({}));
+        let plan = serde_json::json!({
+            "launch": {
+                "kind": "runtime",
+                "tool": "java",
+                "packagedRuntime": "runtime/java.exe",
+                "entry": "server.jar"
+            },
+            "arguments": ["-jar", "server.jar"]
+        });
+        let resolved = resolve_launch(&package, "java", &plan, &package.root).expect("resolves");
+        assert_eq!(resolved.server_path, runtime.to_string_lossy());
+        assert_eq!(
+            resolved.environment.get("LITHE_JAVA_PATH"),
+            Some(&runtime.to_string_lossy().to_string())
+        );
+        let path = resolved.environment.get("PATH").expect("PATH export");
+        assert!(path.starts_with(&format!(
+            "{};",
+            temporary.as_path().join("pkg").join("runtime").display()
+        )));
+    }
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/lifecycle.rs b/windows/tauri/src-tauri/src/plugin_host/lifecycle.rs
new file mode 100644
index 0000000000..b2affc9fde
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/lifecycle.rs
@@ -0,0 +1,310 @@
+//! Package mutation barrier. Revoke plans before asking each product window
+//! to drain its process owners; only acknowledgements from that window count.
+use std::collections::{HashMap, HashSet};
+use std::sync::{Arc, Mutex};
+use tauri::{AppHandle, Emitter, Manager, WebviewWindow};
+use tokio::sync::oneshot;
+
+#[derive(Default)]
+pub struct LifecycleState {
+    access: Arc<NativeAccess>,
+    pending: Mutex<HashMap<String, HashMap<String, oneshot::Sender<Result<(), String>>>>>,
+    changing: Mutex<HashSet<String>>,
+}
+
+#[derive(Default)]
+struct AccessState {
+    blocked: HashSet<String>,
+    probes: HashMap<String, usize>,
+}
+#[derive(Default)]
+struct NativeAccess {
+    state: Mutex<AccessState>,
+    changed: tokio::sync::Notify,
+}
+
+impl LifecycleState {
+    pub fn blocked(&self, plugin_id: &str) -> bool {
+        self.access
+            .state
+            .lock()
+            .expect("native plugin access")
+            .blocked
+            .contains(plugin_id)
+    }
+    /// Register before any native probe or package read. Revocation and
+    /// acquisition share one lock, so a mutation cannot miss a late probe.
+    pub fn acquire(&self, plugin_id: &str) -> Result<NativeLease, String> {
+        let mut state = self.access.state.lock().expect("native plugin access");
+        if state.blocked.contains(plugin_id) {
+            return Err("plugin is inactive or changing version".into());
+        }
+        *state.probes.entry(plugin_id.into()).or_default() += 1;
+        Ok(NativeLease {
+            access: self.access.clone(),
+            plugin_id: plugin_id.into(),
+        })
+    }
+    fn revoke(&self, plugin_id: &str) {
+        self.access
+            .state
+            .lock()
+            .expect("native plugin access")
+            .blocked
+            .insert(plugin_id.into());
+    }
+    async fn wait_native(&self, plugin_id: &str) -> Result<(), String> {
+        tokio::time::timeout(std::time::Duration::from_secs(45), async {
+            loop {
+                let changed = self.access.changed.notified();
+                tokio::pin!(changed);
+                changed.as_mut().enable();
+                if self
+                    .access
+                    .state
+                    .lock()
+                    .expect("native plugin access")
+                    .probes
+                    .get(plugin_id)
+                    .copied()
+                    .unwrap_or(0)
+                    == 0
+                {
+                    return;
+                }
+                changed.await;
+            }
+        })
+        .await
+        .map_err(|_| "native plugin probes did not exit; package files were preserved".into())
+    }
+}
+
+pub struct NativeLease {
+    access: Arc<NativeAccess>,
+    plugin_id: String,
+}
+impl Drop for NativeLease {
+    fn drop(&mut self) {
+        let mut state = self.access.state.lock().expect("native plugin access");
+        if let Some(count) = state.probes.get_mut(&self.plugin_id) {
+            *count -= 1;
+            if *count == 0 {
+                state.probes.remove(&self.plugin_id);
+            }
+        }
+        drop(state);
+        self.access.changed.notify_waiters();
+    }
+}
+
+/// One operation owns the plugin until its catalog and files are consistent.
+/// Failure leaves launches revoked; retry/enable can explicitly recover it.
+pub struct Mutation {
+    app: AppHandle,
+    plugin_id: String,
+    operation_id: String,
+}
+impl Drop for Mutation {
+    fn drop(&mut self) {
+        let state = self.app.state::<LifecycleState>();
+        state
+            .pending
+            .lock()
+            .expect("plugin barriers")
+            .remove(&self.operation_id);
+        state
+            .changing
+            .lock()
+            .expect("plugin mutations")
+            .remove(&self.plugin_id);
+    }
+}
+impl Mutation {
+    pub fn complete(self, active: bool) {
+        self.app
+            .state::<LifecycleState>()
+            .access
+            .state
+            .lock()
+            .expect("native plugin access")
+            .blocked
+            .remove(&self.plugin_id);
+        let _ = self.app.emit(
+            "declarative-plugin-lifecycle",
+            serde_json::json!({
+                "pluginId": self.plugin_id, "active": active,
+            }),
+        );
+    }
+}
+
+pub async fn begin(app: &AppHandle, plugin_id: &str) -> Result<Mutation, String> {
+    let state = app.state::<LifecycleState>();
+    if !state
+        .changing
+        .lock()
+        .expect("plugin mutations")
+        .insert(plugin_id.to_string())
+    {
+        return Err("another mutation already owns this plugin".into());
+    }
+    let operation_id = super::store::workspace_state_key(&format!(
+        "{}-{:?}",
+        plugin_id,
+        std::time::SystemTime::now()
+    ));
+    let mutation = Mutation {
+        app: app.clone(),
+        plugin_id: plugin_id.into(),
+        operation_id: operation_id.clone(),
+    };
+    state.revoke(plugin_id);
+    state.wait_native(plugin_id).await?;
+    super::web::close_plugin_windows(app, plugin_id)?;
+    let mut senders = HashMap::new();
+    let mut receivers = Vec::new();
+    for label in app
+        .webview_windows()
+        .keys()
+        .filter(|label| label.as_str() == "main" || label.starts_with("workspace-"))
+    {
+        let (sender, receiver) = oneshot::channel();
+        senders.insert(label.clone(), sender);
+        receivers.push((label.clone(), receiver));
+    }
+    let labels: Vec<_> = senders.keys().cloned().collect();
+    state
+        .pending
+        .lock()
+        .expect("plugin barriers")
+        .insert(operation_id.clone(), senders);
+    for label in labels {
+        app.emit_to(
+            label,
+            "declarative-plugin-lifecycle",
+            serde_json::json!({
+                "pluginId": plugin_id, "active": false, "operationId": operation_id,
+            }),
+        )
+        .map_err(|error| error.to_string())?;
+    }
+    await_drained(receivers, std::time::Duration::from_secs(45)).await?;
+    Ok(mutation)
+}
+
+async fn await_drained(
+    receivers: Vec<(String, oneshot::Receiver<Result<(), String>>)>,
+    timeout: std::time::Duration,
+) -> Result<(), String> {
+    tokio::time::timeout(timeout, async {
+        for (label, receiver) in receivers {
+            receiver
+                .await
+                .map_err(|_| format!("process owner {label} disconnected"))??;
+        }
+        Ok::<_, String>(())
+    })
+    .await
+    .map_err(|_| "plugin process stop timed out; package files were preserved".to_string())?
+}
+
+#[tauri::command]
+pub fn declarative_plugins_lifecycle_ack(
+    app: AppHandle,
+    window: WebviewWindow,
+    operation_id: String,
+    error: Option<String>,
+) -> Result<(), String> {
+    let state = app.state::<LifecycleState>();
+    let sender = state
+        .pending
+        .lock()
+        .expect("plugin barriers")
+        .get_mut(&operation_id)
+        .and_then(|pending| pending.remove(window.label()))
+        .ok_or("unknown plugin mutation acknowledgement")?;
+    let _ = sender.send(error.map_or(Ok(()), Err));
+    Ok(())
+}
+
+pub fn window_destroyed<R: tauri::Runtime>(app: &AppHandle<R>, label: &str) {
+    // A closed UI window can still own Core processes. Do not count destruction
+    // as a successful drain: fail the mutation and preserve the package.
+    for pending in app
+        .state::<LifecycleState>()
+        .pending
+        .lock()
+        .expect("plugin barriers")
+        .values_mut()
+    {
+        if let Some(sender) = pending.remove(label) {
+            let _ = sender.send(Err(
+                "process owner window closed before acknowledgement".into()
+            ));
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn mutation_drains_native_probes_and_rejects_late_acquisition() {
+        let state = LifecycleState::default();
+        let probe = state.acquire("test.plugin").unwrap();
+        state.revoke("test.plugin");
+        assert!(state.acquire("test.plugin").is_err());
+        let waiting = state.wait_native("test.plugin");
+        tokio::pin!(waiting);
+        tokio::select! { biased;
+            result = &mut waiting => panic!("mutation advanced while native probe owns package: {result:?}"),
+            _ = std::future::ready(()) => {},
+        }
+        drop(probe);
+        waiting.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn mutation_waits_for_every_window_and_propagates_stop_failure() {
+        let (first, first_result) = oneshot::channel();
+        let (second, second_result) = oneshot::channel();
+        let drain = await_drained(
+            vec![
+                ("first".into(), first_result),
+                ("second".into(), second_result),
+            ],
+            std::time::Duration::from_secs(1),
+        );
+        tokio::pin!(drain);
+        second.send(Ok(())).unwrap();
+        // Poll once with only the second window released: the mutation cannot advance.
+        tokio::select! { biased;
+            result = &mut drain => panic!("mutation advanced without its first owner: {result:?}"),
+            _ = std::future::ready(()) => {},
+        }
+        first.send(Err("executable still in use".into())).unwrap();
+        assert_eq!(drain.await.unwrap_err(), "executable still in use");
+    }
+
+    #[tokio::test]
+    async fn mutation_refuses_disconnected_or_unresponsive_owners() {
+        let (sender, receiver) = oneshot::channel();
+        drop(sender);
+        assert!(await_drained(
+            vec![("closed".into(), receiver)],
+            std::time::Duration::from_secs(1)
+        )
+        .await
+        .unwrap_err()
+        .contains("disconnected"));
+        let (_sender, receiver) = oneshot::channel();
+        assert!(
+            await_drained(vec![("busy".into(), receiver)], std::time::Duration::ZERO)
+                .await
+                .unwrap_err()
+                .contains("files were preserved")
+        );
+    }
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/mod.rs b/windows/tauri/src-tauri/src/plugin_host/mod.rs
new file mode 100644
index 0000000000..6ca4a91922
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/mod.rs
@@ -0,0 +1,182 @@
+//! Windows host for contract v1 declarative plugin packages.
+//!
+//! Package validation, launch-plan expansion, and install review are shared
+//! deterministic logic that lives only in `lithe-core`; this module owns the
+//! platform side: where packages are installed, which packages the host
+//! currently accepts, and how a Core launch plan becomes a process command
+//! line. The boundary with the Worker extension model and the staged
+//! capability rollout are recorded in
+//! .agents/notes/implemented/architecture/2026-10-22-windows-declarative-plugin-host.md
+
+pub mod install;
+#[cfg(test)]
+mod install_tests;
+pub mod launch;
+pub mod lifecycle;
+pub mod run_plans;
+pub mod scan;
+pub mod settings;
+pub mod store;
+#[cfg(test)]
+mod tests;
+pub mod web;
+
+use serde::Serialize;
+use serde_json::{json, Value};
+use std::path::PathBuf;
+use std::sync::Mutex;
+use tauri::{AppHandle, Manager};
+
+/// Capability versions this host implements. `plugins.declarative.validate`
+/// rejects any package that requires a capability or version beyond this map,
+/// so the host never registers a manifest section it cannot run. The set
+/// grows per milestone of the declarative plugin host work. `languageServers`
+/// 2 and `settings` 2 add workspace configuration push and scoped settings
+/// (M3); `ui` 2 adds package web pages in host windows (M4);
+/// `executionProviders`, `buildProviders` and `buildSystems` remain unhosted.
+pub fn host_capabilities() -> Value {
+    json!({
+        "languages": [1],
+        "languageServers": [1, 2],
+        "serverProcess": [1],
+        "settings": [1, 2],
+        "ui": [1, 2],
+    })
+}
+
+/// Host CPU architecture in the vocabulary Core launch templates expect
+/// (`arm64` / `x86_64`); Rust spells aarch64 differently.
+pub fn host_architecture() -> &'static str {
+    match std::env::consts::ARCH {
+        "aarch64" => "arm64",
+        other => other,
+    }
+}
+
+/// Frontend-facing summary of one scanned declarative plugin.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogEntry {
+    pub plugin_id: String,
+    pub display_name: String,
+    pub version: String,
+    pub api_version: u32,
+    /// `bundled` packages ship inside the installation directory and load
+    /// read-only; `installed` packages live under the per-user plugin store.
+    pub source: &'static str,
+    pub enabled: bool,
+    /// `accepted` packages are registered language owners; `rejected`
+    /// packages are quarantined with Core's stable rejection code.
+    pub status: &'static str,
+    pub languages: Vec<CatalogLanguage>,
+    /// Declared settings (settings capability), as Core normalizes them.
+    pub declared_settings: Vec<Value>,
+    /// Whether any execution provider declares a test template.
+    pub declares_tests: bool,
+    /// First language with a language server, for workspace configuration.
+    pub primary_language_id: Option<String>,
+    pub rejection: Option<CatalogRejection>,
+}
+
+/// Language declaration of a scanned package.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogLanguage {
+    pub id: String,
+    pub display_name: String,
+    pub file_extensions: Vec<String>,
+    pub file_names: Vec<String>,
+}
+
+/// Why a package was quarantined. Manifest problems carry Core's stable
+/// `plugin.*` code; store problems (missing or invalid installation record)
+/// use the host-owned `plugin.store.*` namespace.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogRejection {
+    pub code: String,
+    pub message: String,
+    pub path: Option<String>,
+}
+
+/// One scanned package with everything launch resolution needs but the
+/// frontend does not.
+#[derive(Debug, Clone)]
+pub struct ScannedPackage {
+    pub entry: CatalogEntry,
+    /// Directory that directly contains `plugin.json`.
+    pub root: PathBuf,
+    /// Raw manifest; plan commands are pure functions and take it every time.
+    pub manifest: Value,
+}
+
+/// Cached scan result. The frontend rescans at startup and after installs,
+/// then reads this state for registration and launch queries.
+#[derive(Default)]
+pub struct PluginHostState {
+    scan_lock: Mutex<()>,
+    packages: Mutex<Vec<ScannedPackage>>,
+}
+
+impl PluginHostState {
+    /// Serialize discovery through publication. Independent package mutations
+    /// may overlap, but an older full scan must never overwrite a newer scan.
+    pub(crate) fn refresh(
+        &self,
+        discover: impl FnOnce() -> Result<Vec<ScannedPackage>, String>,
+    ) -> Result<usize, String> {
+        let _scan = self
+            .scan_lock
+            .lock()
+            .map_err(|_| "plugin catalog scan lock poisoned")?;
+        let packages = discover()?;
+        let count = packages.len();
+        self.set_packages(packages);
+        Ok(count)
+    }
+
+    pub fn set_packages(&self, packages: Vec<ScannedPackage>) {
+        *self.packages.lock().expect("plugin host catalog mutex") = packages;
+    }
+
+    pub fn packages(&self) -> Vec<ScannedPackage> {
+        self.packages
+            .lock()
+            .expect("plugin host catalog mutex")
+            .clone()
+    }
+}
+
+/// Rescans bundled and installed packages and replaces the cached catalog.
+#[tauri::command]
+pub fn declarative_plugins_rescan(app: AppHandle) -> Result<usize, String> {
+    app.state::<PluginHostState>()
+        .refresh(|| scan::build_catalog(&app))
+}
+
+/// Returns the cached scan result. Call `declarative_plugins_rescan` first;
+/// this command never triggers filesystem work.
+#[tauri::command]
+pub fn declarative_plugins_state(app: AppHandle) -> Vec<CatalogEntry> {
+    app.state::<PluginHostState>()
+        .packages()
+        .into_iter()
+        .map(|package| package.entry)
+        .collect()
+}
+
+/// Returns the raw manifest of one accepted, enabled plugin; settings pages
+/// must pass the full manifest to Core's resolve commands, which re-validate
+/// it. `None` when the ID does not name an accepted, enabled plugin.
+#[tauri::command]
+pub fn declarative_plugins_manifest(app: AppHandle, plugin_id: String) -> Option<Value> {
+    app.state::<PluginHostState>()
+        .packages()
+        .into_iter()
+        .find(|package| {
+            package.entry.status == "accepted"
+                && package.entry.enabled
+                && package.entry.plugin_id == plugin_id
+        })
+        .map(|package| package.manifest)
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/run_plans.rs b/windows/tauri/src-tauri/src/plugin_host/run_plans.rs
new file mode 100644
index 0000000000..e7f0b2eda9
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/run_plans.rs
@@ -0,0 +1,166 @@
+//! Run and test plans for declarative plugins.
+//!
+//! Core expands the declared templates into an executable and arguments; the
+//! host resolves the executable like any other launch (`run_resolve_launch`)
+//! and starts the process through the shared run pipeline. Process ownership
+//! is tracked per workspace and plugin on the frontend, exactly like Worker
+//! extension run actions.
+
+use super::scan::core_execute;
+use serde::Serialize;
+use serde_json::Value;
+use std::path::Path;
+use tauri::AppHandle;
+
+/// An expanded run or test plan ready for the shared run pipeline.
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DeclarativeRunPlan {
+    pub plugin_id: String,
+    pub language_id: String,
+    /// Executable command as declared (e.g. `php`); the frontend resolves it
+    /// through `run_resolve_launch` like any extension run action.
+    pub executable: Value,
+    pub arguments: Vec<String>,
+    pub working_directory: String,
+}
+
+/// Expands the `run` template for one file of a language a plugin owns.
+#[tauri::command]
+pub fn declarative_plugins_run_plan(
+    app: AppHandle,
+    plugin_id: String,
+    language_id: String,
+    relative_file_path: String,
+    user_arguments: Vec<String>,
+) -> Result<DeclarativeRunPlan, String> {
+    let package = super::launch::package_by_id(&app, &plugin_id)
+        .ok_or_else(|| format!("{plugin_id} is not an accepted declarative plugin"))?;
+    expand_plan(
+        &package.manifest,
+        &plugin_id,
+        &language_id,
+        "plugins.declarative.runPlan",
+        serde_json::json!({
+            "relativeFilePath": relative_file_path,
+            "arguments": user_arguments,
+        }),
+    )
+}
+
+/// Expands the workspace test template for a language a plugin owns.
+/// The host checks declared project markers in the workspace before Core
+/// decides whether the test template applies.
+#[tauri::command]
+pub fn declarative_plugins_test_plan(
+    app: AppHandle,
+    plugin_id: String,
+    language_id: String,
+    workspace_path: String,
+) -> Result<DeclarativeRunPlan, String> {
+    let package = super::launch::package_by_id(&app, &plugin_id)
+        .ok_or_else(|| format!("{plugin_id} is not an accepted declarative plugin"))?;
+    let relative_project_file_paths =
+        existing_project_markers(&package.manifest, &language_id, Path::new(&workspace_path));
+    expand_plan(
+        &package.manifest,
+        &plugin_id,
+        &language_id,
+        "plugins.declarative.testPlan",
+        serde_json::json!({
+            "scope": { "kind": "workspace" },
+            "relativeProjectFilePaths": relative_project_file_paths,
+        }),
+    )
+}
+
+fn existing_project_markers(manifest: &Value, language_id: &str, root: &Path) -> Vec<String> {
+    let mut markers: Vec<String> = manifest["executionProviders"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .filter(|provider| provider["languageID"] == language_id)
+        .flat_map(|provider| {
+            provider["test"]["projectMarkers"]
+                .as_array()
+                .into_iter()
+                .flatten()
+        })
+        .filter_map(|marker| marker.as_str())
+        .filter(|marker| root.join(marker).is_file())
+        .map(str::to_string)
+        .collect();
+    markers.sort();
+    markers.dedup();
+    markers
+}
+
+fn expand_plan(
+    manifest: &Value,
+    plugin_id: &str,
+    language_id: &str,
+    command: &str,
+    request: Value,
+) -> Result<DeclarativeRunPlan, String> {
+    let plan = core_execute(
+        command,
+        serde_json::json!({
+            "manifest": manifest,
+            "languageID": language_id,
+            "request": request,
+        }),
+    )?;
+    if plan["status"] == serde_json::json!("rejected") {
+        return Err(format!(
+            "{command} rejected: {}",
+            plan["error"]["message"].as_str().unwrap_or("unknown")
+        ));
+    }
+    let body = &plan["plan"];
+    Ok(DeclarativeRunPlan {
+        plugin_id: plugin_id.to_string(),
+        language_id: language_id.to_string(),
+        executable: body["executable"].clone(),
+        arguments: body["arguments"]
+            .as_array()
+            .map(|items| {
+                items
+                    .iter()
+                    .filter_map(|item| item.as_str().map(str::to_string))
+                    .collect()
+            })
+            .unwrap_or_default(),
+        working_directory: body["workingDirectory"].as_str().unwrap_or(".").to_string(),
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_markers_come_from_existing_workspace_files_for_the_language() {
+        let root = std::env::temp_dir().join(format!(
+            "lithe-test-markers-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("clock")
+                .as_nanos()
+        ));
+        std::fs::create_dir_all(&root).expect("workspace");
+        std::fs::write(root.join("composer.json"), "{}").expect("marker");
+        let manifest = serde_json::json!({
+            "executionProviders": [
+                {"languageID": "php", "test": {"projectMarkers": ["composer.json", "phpunit.xml"]}},
+                {"languageID": "go", "test": {"projectMarkers": ["go.mod"]}}
+            ]
+        });
+        assert_eq!(
+            existing_project_markers(&manifest, "php", &root),
+            vec!["composer.json"]
+        );
+        assert!(existing_project_markers(&manifest, "go", &root).is_empty());
+        std::fs::remove_dir_all(root).expect("cleanup");
+    }
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/scan.rs b/windows/tauri/src-tauri/src/plugin_host/scan.rs
new file mode 100644
index 0000000000..59bb55e0b6
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/scan.rs
@@ -0,0 +1,247 @@
+//! Scans package directories and asks Core to validate every manifest.
+//!
+//! The host owns package bytes and install records; Core owns every manifest
+//! semantic. A package Core rejects is quarantined with Core's stable
+//! rejection code and never registered as a language owner. Validation runs
+//! through the same `lithe_core::execute_json` envelope the frontend uses, so
+//! the shared fixtures acceptance covers the real production path.
+
+use super::store::{self, DiscoveredPackage};
+pub(crate) use super::ScannedPackage;
+use super::{CatalogEntry, CatalogLanguage, CatalogRejection};
+use serde_json::{json, Value};
+use tauri::AppHandle;
+
+pub fn build_catalog(app: &AppHandle) -> Result<Vec<ScannedPackage>, String> {
+    build_catalog_from(&store::bundled_root(app)?, &store::install_root(app)?)
+}
+
+/// Catalog builder over explicit roots so tests can exercise the full scan
+/// without a running Tauri app.
+pub fn build_catalog_from(
+    bundled_root: &std::path::Path,
+    install_root: &std::path::Path,
+) -> Result<Vec<ScannedPackage>, String> {
+    let mut discovered = store::discover_bundled_in(bundled_root)?;
+    discovered.extend(store::discover_installed_in(install_root)?);
+    Ok(discovered.into_iter().map(scan_package).collect())
+}
+
+fn scan_package(package: DiscoveredPackage) -> ScannedPackage {
+    let fallback_id = package
+        .root
+        .file_name()
+        .map(|name| name.to_string_lossy().to_string())
+        .unwrap_or_else(|| "unknown".to_string());
+    let manifest = match read_manifest(&package.root) {
+        Ok(manifest) => manifest,
+        Err(error) => {
+            return quarantined(
+                package,
+                fallback_id,
+                "0",
+                catalog_rejection("plugin.manifest.invalid", error, None),
+            );
+        }
+    };
+    if let Some(problem) = package.record_problem.clone() {
+        return quarantined(
+            package,
+            manifest_id(&manifest).unwrap_or(fallback_id),
+            &manifest_version(&manifest).unwrap_or_default(),
+            catalog_rejection("plugin.store.installationRecordInvalid", problem, None),
+        );
+    }
+    match validate_manifest(&manifest) {
+        Ok(plugin) => {
+            let entry = CatalogEntry {
+                plugin_id: plugin["id"].as_str().unwrap_or(&fallback_id).to_string(),
+                display_name: plugin["displayName"]
+                    .as_str()
+                    .unwrap_or("plugin")
+                    .to_string(),
+                version: plugin["version"].as_str().unwrap_or("0").to_string(),
+                api_version: plugin["pluginAPIVersion"].as_u64().unwrap_or(0) as u32,
+                source: package.source,
+                enabled: package.enabled,
+                status: "accepted",
+                languages: catalog_languages(&plugin),
+                declared_settings: plugin["settings"].as_array().cloned().unwrap_or_default(),
+                declares_tests: plugin["executionProviders"]
+                    .as_array()
+                    .is_some_and(|providers| {
+                        providers
+                            .iter()
+                            .any(|provider| provider.get("test").is_some())
+                    }),
+                primary_language_id: plugin["languageServers"]
+                    .as_array()
+                    .and_then(|servers| servers.first())
+                    .and_then(|server| server["languageID"].as_str())
+                    .map(str::to_string),
+                rejection: None,
+            };
+            ScannedPackage {
+                entry,
+                root: package.root,
+                manifest,
+            }
+        }
+        Err(rejection) => quarantined(
+            package,
+            manifest_id(&manifest).unwrap_or(fallback_id),
+            &manifest_version(&manifest).unwrap_or_default(),
+            rejection,
+        ),
+    }
+}
+
+fn quarantined(
+    package: DiscoveredPackage,
+    plugin_id: String,
+    version: &str,
+    rejection: CatalogRejection,
+) -> ScannedPackage {
+    ScannedPackage {
+        entry: CatalogEntry {
+            plugin_id,
+            display_name: plugin_id_display(&package.root),
+            version: version.to_string(),
+            api_version: 0,
+            source: package.source,
+            enabled: false,
+            status: "rejected",
+            languages: Vec::new(),
+            declared_settings: Vec::new(),
+            declares_tests: false,
+            primary_language_id: None,
+            rejection: Some(rejection),
+        },
+        root: package.root,
+        manifest: Value::Null,
+    }
+}
+
+fn plugin_id_display(root: &std::path::Path) -> String {
+    root.file_name()
+        .map(|name| name.to_string_lossy().to_string())
+        .unwrap_or_else(|| "unknown".to_string())
+}
+
+fn catalog_rejection(code: &str, message: String, path: Option<String>) -> CatalogRejection {
+    CatalogRejection {
+        code: code.to_string(),
+        message,
+        path,
+    }
+}
+
+fn manifest_id(manifest: &Value) -> Option<String> {
+    manifest["id"].as_str().map(|id| id.to_string())
+}
+
+fn manifest_version(manifest: &Value) -> Option<String> {
+    manifest["version"]
+        .as_str()
+        .map(|version| version.to_string())
+}
+
+fn catalog_languages(plugin: &Value) -> Vec<CatalogLanguage> {
+    plugin["languages"]
+        .as_array()
+        .map(|languages| {
+            languages
+                .iter()
+                .map(|language| CatalogLanguage {
+                    id: language["id"].as_str().unwrap_or_default().to_string(),
+                    display_name: language["displayName"]
+                        .as_str()
+                        .unwrap_or_default()
+                        .to_string(),
+                    file_extensions: string_list(&language["fileExtensions"]),
+                    file_names: string_list(&language["fileNames"]),
+                })
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+fn string_list(value: &Value) -> Vec<String> {
+    value
+        .as_array()
+        .map(|items| {
+            items
+                .iter()
+                .filter_map(|item| item.as_str().map(|text| text.to_string()))
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+fn read_manifest(root: &std::path::Path) -> Result<Value, String> {
+    let text = std::fs::read_to_string(root.join("plugin.json"))
+        .map_err(|error| format!("plugin.json could not be read: {error}"))?;
+    serde_json::from_str(&text).map_err(|error| format!("plugin.json is not valid JSON: {error}"))
+}
+
+/// Executes one Core command through the shared JSON envelope. Command-level
+/// outcomes (including manifest rejections) arrive as `ok: true` data with a
+/// `status` field; only malformed requests or host bugs surface as `Err`.
+pub(crate) fn core_execute(command: &str, payload: Value) -> Result<Value, String> {
+    let request = json!({ "command": command, "payload": payload });
+    let response_text = lithe_core::execute_json(&request.to_string());
+    let response: Value = serde_json::from_str(&response_text)
+        .map_err(|error| format!("{command} returned an unreadable response: {error}"))?;
+    if response["ok"] == json!(true) {
+        Ok(response["data"].clone())
+    } else {
+        Err(format!(
+            "{command} failed: {}",
+            response["error"]["message"]
+                .as_str()
+                .unwrap_or("unknown error")
+        ))
+    }
+}
+
+/// Validates one manifest with this host's capability declaration. `Ok`
+/// carries Core's normalized manifest. `host: None` runs pure contract
+/// validation, which is what the shared fixture acceptance asserts.
+pub(crate) fn validate_manifest_with(
+    manifest: &Value,
+    host: Option<Value>,
+) -> Result<Value, CatalogRejection> {
+    let mut payload = json!({ "manifest": manifest });
+    if let Some(host) = host {
+        payload["hostCapabilities"] = host;
+    }
+    let outcome = core_execute("plugins.declarative.validate", payload)
+        .map_err(|error| catalog_rejection("plugin.host.coreFailure", error, None))?;
+    if outcome["status"] == json!("rejected") {
+        return Err(CatalogRejection {
+            code: outcome["error"]["code"]
+                .as_str()
+                .unwrap_or("plugin.manifest.invalid")
+                .to_string(),
+            message: outcome["error"]["message"]
+                .as_str()
+                .unwrap_or("rejected")
+                .to_string(),
+            path: outcome["error"]["field"]
+                .as_str()
+                .map(|field| field.to_string()),
+        });
+    }
+    Ok(outcome["plugin"].clone())
+}
+
+/// Host-scoped validation used by the scan path.
+pub(crate) fn validate_manifest(manifest: &Value) -> Result<Value, CatalogRejection> {
+    validate_manifest_with(manifest, Some(super::host_capabilities()))
+}
+
+/// Test entry point for the per-package scan path.
+#[cfg(test)]
+pub(crate) fn scan_package_for_tests(package: super::store::DiscoveredPackage) -> ScannedPackage {
+    scan_package(package)
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/settings.rs b/windows/tauri/src-tauri/src/plugin_host/settings.rs
new file mode 100644
index 0000000000..94df0f2002
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/settings.rs
@@ -0,0 +1,214 @@
+//! Stored user values for declarative plugin settings.
+//!
+//! Core owns every setting semantic (validation, defaults, layering, effect
+//! kinds); this module only persists the two value layers the host owns: the
+//! user's global value per plugin, and per-workspace overrides of
+//! project-scoped settings (`settings` 2, written to the workspace's
+//! `.lithe/plugin-settings.json`, matching the macOS storage locations).
+
+use serde_json::{Map, Value};
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use tauri::{AppHandle, Manager};
+
+/// Global values of one plugin, persisted as
+/// `app_local_data_dir()/plugin-settings/<pluginID>.json`.
+fn global_store_path(app: &AppHandle, plugin_id: &str) -> Result<PathBuf, String> {
+    Ok(app
+        .path()
+        .app_local_data_dir()
+        .map_err(|error| error.to_string())?
+        .join("plugin-settings")
+        .join(format!("{plugin_id}.json")))
+}
+
+/// Project overrides live in the workspace's `.lithe/plugin-settings.json`.
+pub fn project_store_path(workspace_path: &str) -> PathBuf {
+    PathBuf::from(workspace_path)
+        .join(".lithe")
+        .join("plugin-settings.json")
+}
+
+/// Reads a JSON object store; missing files read as empty. Corrupted files
+/// surface as errors so a broken write is never silently reset.
+fn read_object(path: &Path) -> Result<Map<String, Value>, String> {
+    let text = match std::fs::read_to_string(path) {
+        Ok(text) => text,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(Map::new()),
+        Err(error) => return Err(error.to_string()),
+    };
+    let value: Value = serde_json::from_str(&text)
+        .map_err(|error| format!("{} is not valid JSON: {error}", path.display()))?;
+    match value {
+        Value::Object(map) => Ok(map),
+        _ => Err(format!("{} is not a JSON object", path.display())),
+    }
+}
+
+/// Writes a JSON object store atomically via temp file + rename.
+fn write_object(path: &Path, map: &Map<String, Value>) -> Result<(), String> {
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+    }
+    let temp = path.with_extension("json.tmp");
+    std::fs::write(
+        &temp,
+        serde_json::to_string_pretty(&Value::Object(map.clone()))
+            .map_err(|error| error.to_string())?,
+    )
+    .map_err(|error| error.to_string())?;
+    std::fs::rename(&temp, path).map_err(|error| error.to_string())
+}
+
+/// Both stored layers for one plugin.
+pub struct SettingLayers {
+    pub global: BTreeMap<String, Value>,
+    pub project: BTreeMap<String, Value>,
+}
+
+/// Loads the stored values of one plugin for one workspace. Only entries
+/// under the plugin's ID in the project store belong to it.
+pub fn load_layers(
+    app: &AppHandle,
+    plugin_id: &str,
+    workspace_path: &str,
+) -> Result<SettingLayers, String> {
+    let global: BTreeMap<String, Value> = read_object(&global_store_path(app, plugin_id)?)?
+        .into_iter()
+        .collect();
+    let project_file = read_object(&project_store_path(workspace_path))?;
+    let project: BTreeMap<String, Value> = project_file
+        .get(plugin_id)
+        .and_then(Value::as_object)
+        .map(|values| {
+            values
+                .iter()
+                .map(|(key, value)| (key.clone(), value.clone()))
+                .collect()
+        })
+        .unwrap_or_default();
+    Ok(SettingLayers { global, project })
+}
+
+/// Stores the user's global value of one setting. A value equal to the
+/// declared default is forgotten so default changes flow through (macOS
+/// rule); `None` erases the stored value.
+pub fn store_global(
+    app: &AppHandle,
+    plugin_id: &str,
+    setting_id: &str,
+    value: Option<Value>,
+) -> Result<(), String> {
+    let path = global_store_path(app, plugin_id)?;
+    let mut store = read_object(&path)?;
+    match value {
+        Some(value) => {
+            store.insert(setting_id.to_string(), value);
+        }
+        None => {
+            store.remove(setting_id);
+        }
+    }
+    write_object(&path, &store)
+}
+
+/// Stores the workspace override of a project-scoped setting, or erases it
+/// with `None`. When the last override of a plugin disappears from the
+/// project store, the empty plugin entry is removed; an empty store file is
+/// deleted entirely.
+pub fn store_project(
+    workspace_path: &str,
+    plugin_id: &str,
+    setting_id: &str,
+    value: Option<Value>,
+) -> Result<(), String> {
+    let path = project_store_path(workspace_path);
+    let mut store = read_object(&path)?;
+    let entry = store
+        .entry(plugin_id.to_string())
+        .or_insert_with(|| Value::Object(Map::new()));
+    let values = entry
+        .as_object_mut()
+        .ok_or_else(|| format!("{} has a corrupted plugin-settings entry", path.display()))?;
+    match value {
+        Some(value) => {
+            values.insert(setting_id.to_string(), value);
+        }
+        None => {
+            values.remove(setting_id);
+        }
+    }
+    if values.is_empty() {
+        store.remove(plugin_id);
+    }
+    if store.is_empty() {
+        match std::fs::remove_file(&path) {
+            Ok(()) => return Ok(()),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+            Err(error) => return Err(error.to_string()),
+        }
+    }
+    write_object(&path, &store)
+}
+
+/// Tauri command: effective values of one plugin's settings.
+#[tauri::command]
+pub fn declarative_plugins_resolve_settings(
+    app: AppHandle,
+    manifest: Value,
+    workspace_path: String,
+) -> Result<Value, String> {
+    let Some(plugin_id) = manifest["id"].as_str().map(str::to_string) else {
+        return Err("manifest has no id".to_string());
+    };
+    let layers = load_layers(&app, &plugin_id, &workspace_path)?;
+    super::scan::core_execute(
+        "plugins.declarative.resolveSettings",
+        serde_json::json!({
+            "manifest": manifest,
+            "settings": layers.global,
+            "projectSettings": layers.project,
+        }),
+    )
+}
+
+/// Tauri command: stores a setting value in the requested layer.
+#[tauri::command]
+pub fn declarative_plugins_store_setting(
+    app: AppHandle,
+    plugin_id: String,
+    setting_id: String,
+    scope: String,
+    workspace_path: String,
+    value: Option<Value>,
+) -> Result<(), String> {
+    match scope.as_str() {
+        "global" => store_global(&app, &plugin_id, &setting_id, value),
+        "project" => store_project(&workspace_path, &plugin_id, &setting_id, value),
+        other => Err(format!("unknown setting scope {other}")),
+    }
+}
+
+/// Tauri command: a running language server's `workspaceConfiguration`
+/// expanded with the current values, for `immediate` effect changes.
+#[tauri::command]
+pub fn declarative_plugins_workspace_configuration(
+    app: AppHandle,
+    manifest: Value,
+    language_id: String,
+    workspace_path: String,
+) -> Result<Value, String> {
+    let Some(plugin_id) = manifest["id"].as_str().map(str::to_string) else {
+        return Err("manifest has no id".to_string());
+    };
+    let layers = load_layers(&app, &plugin_id, &workspace_path)?;
+    super::scan::core_execute(
+        "plugins.declarative.workspaceConfiguration",
+        serde_json::json!({
+            "manifest": manifest,
+            "languageID": language_id,
+            "settings": layers.global,
+            "projectSettings": layers.project,
+        }),
+    )
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/store.rs b/windows/tauri/src-tauri/src/plugin_host/store.rs
new file mode 100644
index 0000000000..290ab9075e
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/store.rs
@@ -0,0 +1,258 @@
+//! Installed and bundled declarative plugin package locations.
+//!
+//! Installed packages live under the per-user application data directory,
+//! never inside the installation directory: installed app resources are the
+//! release baseline and must stay byte-identical for updater deltas. Bundled
+//! packages are read-only inputs under the installation's resource directory.
+
+use serde::{Deserialize, Serialize};
+use std::cmp::Ordering;
+use std::path::Path;
+use std::path::PathBuf;
+use tauri::{AppHandle, Manager};
+
+/// Per-user root for installed declarative plugin packages.
+pub fn install_root(app: &AppHandle) -> Result<PathBuf, String> {
+    Ok(app
+        .path()
+        .app_local_data_dir()
+        .map_err(|error| error.to_string())?
+        .join("plugins"))
+}
+
+/// Read-only root of packages shipped with the application.
+pub fn bundled_root(app: &AppHandle) -> Result<PathBuf, String> {
+    Ok(app
+        .path()
+        .resource_dir()
+        .map_err(|error| error.to_string())?
+        .join("OfficialPlugins"))
+}
+
+/// Writable per-plugin state root (server caches, workspace state).
+pub fn state_root(app: &AppHandle) -> Result<PathBuf, String> {
+    Ok(app
+        .path()
+        .app_local_data_dir()
+        .map_err(|error| error.to_string())?
+        .join("plugin-state"))
+}
+
+/// Writable state directory of one plugin's language server.
+pub fn plugin_state_directory(app: &AppHandle, plugin_id: &str) -> Result<PathBuf, String> {
+    // Plugin IDs are reverse-DNS names Core validated before they reach this
+    // call, so they are safe as a single path component.
+    state_root(app).map(|root| root.join(plugin_id))
+}
+
+/// Stable per-workspace subdirectory name inside a plugin's state directory.
+pub fn workspace_state_key(workspace_path: &str) -> String {
+    let mut hash: u64 = 0xcbf2_9ce4_8422_2325;
+    for byte in workspace_path.as_bytes() {
+        hash ^= u64::from(*byte);
+        hash = hash.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    format!("{hash:016x}")
+}
+
+/// Persistent install record of one installed plugin.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct InstallationRecord {
+    pub schema_version: u32,
+    pub plugin_id: String,
+    /// Active version directory name under the plugin directory.
+    pub version: String,
+    #[serde(default = "default_enabled")]
+    pub enabled: bool,
+}
+
+fn default_enabled() -> bool {
+    true
+}
+
+/// One package directory candidate found on disk.
+pub struct DiscoveredPackage {
+    /// Directory that directly contains `plugin.json`.
+    pub root: PathBuf,
+    pub source: &'static str,
+    pub enabled: bool,
+    /// Set when the package was found but its install record is missing or
+    /// invalid; scan quarantines the package with this reason.
+    pub record_problem: Option<String>,
+}
+
+/// Enumerates installed packages under `install_root`:
+/// `<pluginID>/installation.json` names the active `<pluginID>/<version>/`
+/// directory.
+pub fn discover_installed_in(install_root: &Path) -> Result<Vec<DiscoveredPackage>, String> {
+    let mut packages = Vec::new();
+    let entries = match std::fs::read_dir(install_root) {
+        Ok(entries) => entries,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(packages),
+        Err(error) => {
+            return Err(format!(
+                "{} could not be read: {error}",
+                install_root.display()
+            ))
+        }
+    };
+    for entry in entries.flatten() {
+        let plugin_directory = entry.path();
+        if !plugin_directory.is_dir() {
+            continue;
+        }
+        let quarantined = |problem: String| DiscoveredPackage {
+            root: plugin_directory.clone(),
+            source: "installed",
+            enabled: false,
+            record_problem: Some(problem),
+        };
+        let record: InstallationRecord =
+            match read_json_file(&plugin_directory.join("installation.json")) {
+                Ok(Some(record)) => record,
+                Ok(None) => {
+                    packages.push(quarantined(
+                        "installation.json is missing; the package was not installed through Lithe"
+                            .to_string(),
+                    ));
+                    continue;
+                }
+                Err(error) => {
+                    packages.push(quarantined(format!(
+                        "installation.json could not be read: {error}"
+                    )));
+                    continue;
+                }
+            };
+        if record.schema_version != 1 {
+            packages.push(quarantined(format!(
+                "unsupported installation record schema {}",
+                record.schema_version
+            )));
+            continue;
+        }
+        let version_directory = plugin_directory.join(&record.version);
+        if !version_directory.join("plugin.json").is_file() {
+            packages.push(quarantined(format!(
+                "recorded version {} has no plugin.json",
+                record.version
+            )));
+            continue;
+        }
+        packages.push(DiscoveredPackage {
+            root: version_directory,
+            source: "installed",
+            enabled: record.enabled,
+            record_problem: None,
+        });
+    }
+    Ok(packages)
+}
+
+/// Enumerates bundled packages under `bundled_root`: either
+/// `<name>/plugin.json` or `<name>/<version>/plugin.json`, where the highest
+/// version wins.
+pub fn discover_bundled_in(bundled_root: &Path) -> Result<Vec<DiscoveredPackage>, String> {
+    let mut packages = Vec::new();
+    let entries = match std::fs::read_dir(bundled_root) {
+        Ok(entries) => entries,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(packages),
+        Err(error) => {
+            return Err(format!(
+                "{} could not be read: {error}",
+                bundled_root.display()
+            ))
+        }
+    };
+    for entry in entries.flatten() {
+        let package_directory = entry.path();
+        if !package_directory.is_dir() {
+            continue;
+        }
+        if package_directory.join("plugin.json").is_file() {
+            packages.push(DiscoveredPackage {
+                root: package_directory,
+                source: "bundled",
+                enabled: true,
+                record_problem: None,
+            });
+            continue;
+        }
+        let mut versions: Vec<(String, PathBuf)> = Vec::new();
+        if let Ok(version_entries) = std::fs::read_dir(&package_directory) {
+            for version_entry in version_entries.flatten() {
+                let version_directory = version_entry.path();
+                if version_directory.is_dir() && version_directory.join("plugin.json").is_file() {
+                    versions.push((
+                        version_directory
+                            .file_name()
+                            .map(|name| name.to_string_lossy().to_string())
+                            .unwrap_or_default(),
+                        version_directory,
+                    ));
+                }
+            }
+        }
+        let Some((_, best)) = versions
+            .into_iter()
+            .max_by(|(left, _), (right, _)| compare_versions(left, right))
+        else {
+            continue;
+        };
+        packages.push(DiscoveredPackage {
+            root: best,
+            source: "bundled",
+            enabled: true,
+            record_problem: None,
+        });
+    }
+    Ok(packages)
+}
+
+/// Dot-separated version comparison with numeric-aware chunks, so `1.10`
+/// sorts after `1.9` without pulling in a semver dependency.
+pub fn compare_versions(left: &str, right: &str) -> Ordering {
+    let mut left_chunks = split_version_chunks(left);
+    let mut right_chunks = split_version_chunks(right);
+    loop {
+        match (left_chunks.next(), right_chunks.next()) {
+            (None, None) => return Ordering::Equal,
+            (None, Some(_)) => return Ordering::Less,
+            // A non-numeric tail is a pre-release suffix (`1.0.0-rc1`), which
+            // sorts before the plain release.
+            (Some(remaining), None) => {
+                return if remaining.1.parse::<u64>().is_err() {
+                    Ordering::Less
+                } else {
+                    Ordering::Greater
+                };
+            }
+            (Some(left_chunk), Some(right_chunk)) => {
+                let ordering = left_chunk.cmp(&right_chunk);
+                if ordering != Ordering::Equal {
+                    return ordering;
+                }
+            }
+        }
+    }
+}
+
+fn split_version_chunks(version: &str) -> impl Iterator<Item = (u64, &str)> {
+    version
+        .split(['.', '-', '+'])
+        .map(|chunk| (chunk.parse::<u64>().unwrap_or(0), chunk))
+}
+
+/// Reads a JSON file; `Ok(None)` marks a missing file so callers can
+/// distinguish "absent" from "present but unreadable".
+fn read_json_file<T: for<'de> Deserialize<'de>>(path: &Path) -> Result<Option<T>, String> {
+    let text = match std::fs::read_to_string(path) {
+        Ok(text) => text,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(error) => return Err(error.to_string()),
+    };
+    serde_json::from_str(&text)
+        .map(Some)
+        .map_err(|error| error.to_string())
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/tests.rs b/windows/tauri/src-tauri/src/plugin_host/tests.rs
new file mode 100644
index 0000000000..2d5aee99c4
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/tests.rs
@@ -0,0 +1,543 @@
+//! Shared-fixture acceptance and store-layout tests for the plugin host.
+//!
+//! The fixture tests are the Windows half of the contract acceptance recorded
+//! in the declarative-plugin note: every host must reject the same invalid
+//! manifests with the same stable codes, and the host capability declaration
+//! must gate level 3 sections this host does not implement yet.
+
+use super::scan::{self, build_catalog_from};
+use super::store::{self, DiscoveredPackage};
+use serde_json::{json, Value};
+use std::path::PathBuf;
+
+const FIXTURES_DIR: &str = concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../../shared/contracts/plugins/v1/fixtures"
+);
+
+/// Valid manifests that this host's capability declaration accepts.
+const ACCEPTED_FIXTURES: [&str; 6] = [
+    "language-system-command.plugin.json",
+    "hello-lithe.plugin.json",
+    "language-host-integration.plugin.json",
+    "node-runtime.plugin.json",
+    "language-packaged-server.plugin.json",
+    "web-panel.plugin.json",
+];
+
+/// Valid manifests whose capabilities exceed the host declaration; Core
+/// rejects them through the capability gate, not through manifest semantics.
+const CAPABILITY_GATED_FIXTURES: [&str; 5] = [
+    "build-static-file.plugin.json",
+    "build-command-stdout.plugin.json",
+    "build-command-output-file.plugin.json",
+    "build-provider.plugin.json",
+    "build-host-integration.plugin.json",
+];
+
+fn fixture_path(name: &str) -> PathBuf {
+    PathBuf::from(FIXTURES_DIR).join(name)
+}
+
+fn read_fixture(name: &str) -> Value {
+    let text = std::fs::read_to_string(fixture_path(name))
+        .unwrap_or_else(|error| panic!("fixture {name} could not be read: {error}"));
+    serde_json::from_str(&text)
+        .unwrap_or_else(|error| panic!("fixture {name} is not JSON: {error}"))
+}
+
+/// Applies one JSON-Patch-style fixture edit; mirrors the Core test helper so
+/// both platforms exercise identical case material.
+fn apply_edit(manifest: &mut Value, edit: &Value) {
+    let path = edit["path"].as_str().expect("edit path");
+    let (parent_path, key) = path.rsplit_once('/').expect("edit path separator");
+    let parent = manifest
+        .pointer_mut(parent_path)
+        .unwrap_or_else(|| panic!("missing edit parent {parent_path}"));
+    match edit["op"].as_str().expect("edit op") {
+        "set" => match parent {
+            Value::Object(object) => {
+                object.insert(key.to_string(), edit["value"].clone());
+            }
+            Value::Array(array) => {
+                array[key.parse::<usize>().expect("array index")] = edit["value"].clone()
+            }
+            _ => panic!("edit parent {parent_path} is not a container"),
+        },
+        "remove" => {
+            parent
+                .as_object_mut()
+                .expect("remove parent is an object")
+                .remove(key);
+        }
+        other => panic!("unknown edit op {other}"),
+    }
+}
+
+/// Contract parity: without host capabilities the Windows binary must reject
+/// every invalid fixture with the exact code the shared fixture names.
+#[test]
+fn invalid_manifest_fixtures_keep_their_stable_codes() {
+    let fixtures: Value = serde_json::from_str(
+        &std::fs::read_to_string(fixture_path("invalid-manifests.json"))
+            .expect("invalid-manifests.json is readable"),
+    )
+    .expect("invalid-manifests.json is JSON");
+    let cases = fixtures["cases"].as_array().expect("cases array");
+    assert!(!cases.is_empty(), "fixture case list is not empty");
+    for case in cases {
+        let base = case["base"].as_str().expect("case base");
+        let mut manifest = read_fixture(base);
+        for edit in case["edits"].as_array().expect("case edits") {
+            apply_edit(&mut manifest, edit);
+        }
+        let outcome = scan::validate_manifest_with(&manifest, None);
+        let expected = case["expectedCode"].as_str().expect("expected code");
+        match outcome {
+            Err(rejection) => assert_eq!(
+                rejection.code, expected,
+                "case {:?} (base {base}) rejected with {} instead",
+                case["name"], rejection.code
+            ),
+            Ok(_) => panic!(
+                "case {:?} (base {base}) was accepted but must reject with {expected}",
+                case["name"]
+            ),
+        }
+    }
+}
+
+/// Every valid fixture passes contract validation without host capabilities.
+#[test]
+fn valid_fixtures_validate_without_host_capabilities() {
+    let all_fixtures: Vec<&str> = ACCEPTED_FIXTURES
+        .iter()
+        .copied()
+        .chain(CAPABILITY_GATED_FIXTURES.iter().copied())
+        .chain(std::iter::once("settings-v2.plugin.json"))
+        .collect();
+    for name in all_fixtures {
+        let outcome = scan::validate_manifest_with(&read_fixture(name), None);
+        assert!(outcome.is_ok(), "{name} must validate: {outcome:?}");
+    }
+}
+
+/// The v0 host capability declaration accepts the fixtures it can run and
+/// gates the rest with `plugin.api.unsupported` naming the missing capability.
+#[test]
+fn host_v0_capabilities_gate_unimplemented_sections() {
+    for name in ACCEPTED_FIXTURES {
+        let outcome =
+            scan::validate_manifest_with(&read_fixture(name), Some(super::host_capabilities()));
+        assert!(
+            outcome.is_ok(),
+            "{name} must be accepted by the host: {outcome:?}"
+        );
+    }
+    for name in CAPABILITY_GATED_FIXTURES {
+        let outcome =
+            scan::validate_manifest_with(&read_fixture(name), Some(super::host_capabilities()));
+        let rejection = outcome.expect_err(&format!("{name} must be capability-gated"));
+        assert_eq!(rejection.code, "plugin.api.unsupported", "{name}");
+        assert!(rejection
+            .path
+            .as_deref()
+            .unwrap_or_default()
+            .starts_with("requires."));
+    }
+    // settings-v2 requires settings 2 and languageServers 2, both undeclared.
+    let outcome = scan::validate_manifest_with(
+        &read_fixture("settings-v2.plugin.json"),
+        Some(super::host_capabilities()),
+    );
+    assert_eq!(
+        outcome.expect_err("settings-v2 is gated").code,
+        "plugin.api.unsupported"
+    );
+}
+
+/// A scanned package directory produces an accepted entry with normalized
+/// languages, and a broken manifest is quarantined instead of registered.
+#[test]
+fn scan_accepts_valid_packages_and_quarantines_broken_ones() {
+    let root = unique_temp_root("scan");
+    let package_root = root.join("acme.php");
+    std::fs::create_dir_all(&package_root).expect("package dir");
+    let manifest = read_fixture("language-packaged-server.plugin.json");
+    std::fs::write(
+        package_root.join("plugin.json"),
+        serde_json::to_string_pretty(&manifest).expect("manifest text"),
+    )
+    .expect("manifest file");
+
+    let accepted = scan_package_at(&package_root, None);
+    assert_eq!(accepted.entry.status, "accepted");
+    assert_eq!(accepted.entry.plugin_id, manifest["id"]);
+    assert_eq!(accepted.entry.languages.len(), 1);
+    assert_eq!(
+        accepted.entry.languages[0].file_extensions,
+        vec!["php", "phtml"]
+    );
+
+    std::fs::write(package_root.join("plugin.json"), "{ not json").expect("broken manifest");
+    let broken = scan_package_at(&package_root, None);
+    assert_eq!(broken.entry.status, "rejected");
+    assert_eq!(
+        broken.entry.rejection.as_ref().expect("rejection").code,
+        "plugin.manifest.invalid"
+    );
+
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// Missing or invalid installation records quarantine the package instead of
+/// loading it, even when its manifest is valid.
+#[test]
+fn store_problems_quarantine_packages_with_valid_manifests() {
+    let root = unique_temp_root("store");
+    let plugin_directory = root.join("acme.php");
+    let version_directory = plugin_directory.join("1.0.0");
+    std::fs::create_dir_all(&version_directory).expect("version dir");
+    std::fs::write(
+        version_directory.join("plugin.json"),
+        serde_json::to_string(&read_fixture("language-packaged-server.plugin.json"))
+            .expect("manifest"),
+    )
+    .expect("manifest file");
+
+    // No installation.json: the package was never installed through Lithe.
+    let discovered = store::discover_installed_in(&root).expect("discovery works");
+    assert_eq!(discovered.len(), 1);
+    assert!(discovered[0].record_problem.is_some());
+
+    // A record naming a missing version is a store problem too.
+    std::fs::write(
+        plugin_directory.join("installation.json"),
+        json!({"schemaVersion": 1, "pluginId": "acme.php", "version": "9.9.9"}).to_string(),
+    )
+    .expect("record file");
+    let discovered = store::discover_installed_in(&root).expect("discovery works");
+    assert!(discovered[0].record_problem.is_some());
+
+    // Correct record: discovered at the recorded version, enabled by default.
+    std::fs::write(
+        plugin_directory.join("installation.json"),
+        json!({"schemaVersion": 1, "pluginId": "acme.php", "version": "1.0.0"}).to_string(),
+    )
+    .expect("record file");
+    let discovered = store::discover_installed_in(&root).expect("discovery works");
+    assert!(discovered[0].record_problem.is_none());
+    assert_eq!(discovered[0].root, version_directory);
+    assert!(discovered[0].enabled);
+
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// Bundled discovery prefers the highest version directory of a package.
+#[test]
+fn bundled_discovery_picks_the_highest_version() {
+    let root = unique_temp_root("bundled");
+    for version in ["1.0.0", "1.10.0", "1.9.0"] {
+        let directory = root.join("acme.php").join(version);
+        std::fs::create_dir_all(&directory).expect("version dir");
+        std::fs::write(directory.join("plugin.json"), "{}").expect("manifest file");
+    }
+    let discovered = store::discover_bundled_in(&root).expect("discovery works");
+    assert_eq!(discovered.len(), 1);
+    assert_eq!(
+        discovered[0].root.file_name().unwrap().to_string_lossy(),
+        "1.10.0"
+    );
+    assert_eq!(discovered[0].source, "bundled");
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// The full catalog build accepts recorded packages, quarantines store
+/// problems, and keeps bundled packages enabled.
+#[test]
+fn catalog_build_combines_bundled_and_installed_sources() {
+    let temporary = unique_temp_root("catalog");
+    let install_root = temporary.join("plugins");
+    let bundled_root = temporary.join("OfficialPlugins");
+    let installed_version = install_root.join("acme.php").join("1.0.0");
+    std::fs::create_dir_all(&installed_version).expect("installed dir");
+    std::fs::write(
+        installed_version.join("plugin.json"),
+        serde_json::to_string(&read_fixture("language-packaged-server.plugin.json"))
+            .expect("manifest"),
+    )
+    .expect("manifest file");
+    std::fs::write(
+        install_root.join("acme.php").join("installation.json"),
+        json!({"schemaVersion": 1, "pluginId": "acme.php", "version": "1.0.0", "enabled": false})
+            .to_string(),
+    )
+    .expect("record file");
+    let bundled_directory = bundled_root.join("acme.go").join("2.0.0");
+    std::fs::create_dir_all(&bundled_directory).expect("bundled dir");
+    std::fs::write(
+        bundled_directory.join("plugin.json"),
+        serde_json::to_string(&read_fixture("language-system-command.plugin.json"))
+            .expect("manifest"),
+    )
+    .expect("manifest file");
+
+    let catalog = build_catalog_from(&bundled_root, &install_root).expect("catalog builds");
+    assert_eq!(catalog.len(), 2);
+    let installed = catalog
+        .iter()
+        .find(|package| package.entry.source == "installed")
+        .expect("installed entry");
+    assert_eq!(installed.entry.status, "accepted");
+    assert!(!installed.entry.enabled, "recorded enabled: false wins");
+    let bundled = catalog
+        .iter()
+        .find(|package| package.entry.source == "bundled")
+        .expect("bundled entry");
+    assert_eq!(
+        bundled.entry.plugin_id,
+        "dev.lithe.fixture.language-system-command"
+    );
+    assert!(bundled.entry.enabled);
+
+    let _ = std::fs::remove_dir_all(&temporary);
+}
+
+fn unique_temp_root(label: &str) -> PathBuf {
+    let nanos = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .expect("system clock")
+        .as_nanos();
+    let root = std::env::temp_dir().join(format!(
+        "lithe-plugin-host-{label}-{}-{nanos}",
+        std::process::id()
+    ));
+    std::fs::create_dir_all(&root).expect("temp root");
+    root
+}
+
+/// Scans one package directory through the production scan path.
+fn scan_package_at(
+    root: &std::path::Path,
+    record_problem: Option<String>,
+) -> super::ScannedPackage {
+    super::scan::scan_package_for_tests(DiscoveredPackage {
+        root: root.to_path_buf(),
+        source: "installed",
+        enabled: true,
+        record_problem,
+    })
+}
+
+/// Fixture reader shared with the install test module.
+pub(crate) fn read_fixture_for_tests(name: &str) -> serde_json::Value {
+    read_fixture(name)
+}
+
+/// M3 setting-store tests exercise the two persistence layers directly: the
+/// global per-plugin file and the workspace's `.lithe/plugin-settings.json`.
+mod settings_tests {
+    use crate::plugin_host::settings::{project_store_path, store_global, store_project};
+
+    fn unique_temp_root(label: &str) -> std::path::PathBuf {
+        let nanos = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("system clock")
+            .as_nanos();
+        let root = std::env::temp_dir().join(format!(
+            "lithe-plugin-settings-{label}-{}-{nanos}",
+            std::process::id()
+        ));
+        std::fs::create_dir_all(&root).expect("temp root");
+        root
+    }
+
+    #[test]
+    fn project_overrides_round_trip_and_clean_up_empty_entries() {
+        let workspace = unique_temp_root("project");
+        let workspace_path = workspace.to_string_lossy().to_string();
+
+        store_project(
+            &workspace_path,
+            "acme.php",
+            "heapMaxMB",
+            Some(serde_json::json!(4096)),
+        )
+        .expect("stores override");
+        let store =
+            std::fs::read_to_string(project_store_path(&workspace_path)).expect("store file");
+        let parsed: serde_json::Value = serde_json::from_str(&store).expect("store JSON");
+        assert_eq!(parsed["acme.php"]["heapMaxMB"], 4096);
+
+        // Erasing the last override removes the plugin entry, then the file.
+        store_project(&workspace_path, "acme.php", "heapMaxMB", None).expect("erases override");
+        assert!(!project_store_path(&workspace_path).exists());
+        let _ = std::fs::remove_dir_all(&workspace);
+    }
+
+    #[test]
+    fn project_store_keeps_other_plugins_entries() {
+        let workspace = unique_temp_root("project-multi");
+        let workspace_path = workspace.to_string_lossy().to_string();
+        store_project(&workspace_path, "acme.php", "a", Some(serde_json::json!(1)))
+            .expect("stores a");
+        store_project(
+            &workspace_path,
+            "other.plugin",
+            "b",
+            Some(serde_json::json!(2)),
+        )
+        .expect("stores b");
+        store_project(&workspace_path, "acme.php", "a", None).expect("erases a");
+
+        let store: serde_json::Value = serde_json::from_str(
+            &std::fs::read_to_string(project_store_path(&workspace_path)).expect("store"),
+        )
+        .expect("store JSON");
+        assert!(store["acme.php"].is_null());
+        assert_eq!(store["other.plugin"]["b"], 2);
+        let _ = std::fs::remove_dir_all(&workspace);
+    }
+
+    #[test]
+    fn corrupted_project_store_is_an_error_not_a_reset() {
+        let workspace = unique_temp_root("project-corrupt");
+        let path = project_store_path(&workspace.to_string_lossy());
+        std::fs::create_dir_all(path.parent().unwrap()).expect(".lithe dir");
+        std::fs::write(&path, "{ not json").expect("corrupt store");
+
+        assert!(store_project(
+            &workspace.to_string_lossy(),
+            "acme.php",
+            "a",
+            Some(serde_json::json!(1))
+        )
+        .is_err());
+        // The corrupted bytes are preserved for diagnosis.
+        assert_eq!(std::fs::read_to_string(&path).expect("store"), "{ not json");
+        let _ = std::fs::remove_dir_all(&workspace);
+    }
+
+    // store_global needs an AppHandle; its logic is covered through the
+    // project variant (same read/write helpers) and the live command test.
+    #[allow(unused_imports)]
+    fn witness() {
+        let _ = store_global;
+    }
+}
+
+/// The bundled PHP contract package validates, expands run and test plans,
+/// and exposes settings resolution through the real Core commands — the
+/// end-to-end acceptance of the contract package shipped with the app.
+#[test]
+fn bundled_php_contract_package_expands_plans() {
+    let text = std::fs::read_to_string(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../../Plugins/win/Official/PhpSupportContract/plugin.json"
+    ))
+    .expect("contract package manifest is readable");
+    let manifest: serde_json::Value = serde_json::from_str(&text).expect("manifest is JSON");
+
+    let validated = scan::validate_manifest_with(&manifest, Some(super::host_capabilities()));
+    let plugin = validated.expect("contract package is accepted by the host");
+    assert_eq!(plugin["id"], "dev.lithe.plugin.php-support");
+    assert_eq!(plugin["pluginAPIVersion"], 2);
+
+    // Run plan expansion.
+    let run = scan::core_execute(
+        "plugins.declarative.runPlan",
+        serde_json::json!({
+            "manifest": manifest,
+            "languageID": "php",
+            "request": {
+                "relativeFilePath": "src/Item.php",
+                "arguments": ["--verbose"]
+            },
+        }),
+    )
+    .expect("run plan executes");
+    assert_eq!(run["status"], "ok", "{run}");
+    assert_eq!(run["plan"]["executable"]["command"], "php");
+    assert_eq!(
+        run["plan"]["arguments"],
+        serde_json::json!(["src/Item.php", "--verbose"])
+    );
+
+    // Workspace test plan expansion.
+    let test = scan::core_execute(
+        "plugins.declarative.testPlan",
+        serde_json::json!({
+            "manifest": manifest,
+            "languageID": "php",
+            "request": {
+                "scope": { "kind": "workspace" },
+                "relativeProjectFilePaths": ["composer.json", "tests/ItemTest.php"],
+            },
+        }),
+    )
+    .expect("test plan executes");
+    assert_eq!(test["status"], "ok", "{test}");
+    assert_eq!(
+        test["plan"]["arguments"],
+        serde_json::json!(["vendor/bin/phpunit"])
+    );
+
+    // Settings resolution with an empty store (defaults).
+    let settings = scan::core_execute(
+        "plugins.declarative.resolveSettings",
+        serde_json::json!({
+            "manifest": manifest,
+            "settings": {},
+            "projectSettings": {},
+        }),
+    )
+    .expect("resolve settings executes");
+    assert_eq!(settings["status"], "ok", "{settings}");
+}
+
+/// A scan owns discovery and publication together, so the second discover
+/// cannot snapshot the old catalog and overwrite a newer published result.
+#[test]
+fn concurrent_catalog_refreshes_publish_in_discovery_order() {
+    use std::sync::{mpsc, Arc};
+    use std::time::Duration;
+    let state = Arc::new(super::PluginHostState::default());
+    let (entered_tx, entered_rx) = mpsc::channel();
+    let (release_tx, release_rx) = mpsc::channel();
+    let (done_tx, done_rx) = mpsc::channel();
+    std::thread::scope(|scope| {
+        let first = state.clone();
+        let done = done_tx.clone();
+        scope.spawn(move || {
+            first
+                .refresh(|| {
+                    entered_tx.send(()).unwrap();
+                    release_rx.recv_timeout(Duration::from_secs(2)).unwrap();
+                    Ok(Vec::new())
+                })
+                .unwrap();
+            done.send(()).unwrap();
+        });
+        entered_rx.recv_timeout(Duration::from_secs(2)).unwrap();
+        assert!(state.scan_lock.try_lock().is_err());
+        let second = state.clone();
+        scope.spawn(move || {
+            second
+                .refresh(|| {
+                    // This closure runs only after the first publication.
+                    assert!(second.scan_lock.try_lock().is_err());
+                    Ok(vec![scan_package_at(
+                        &PathBuf::from("catalog-new.plugin"),
+                        None,
+                    )])
+                })
+                .unwrap();
+            done_tx.send(()).unwrap();
+        });
+        release_tx.send(()).unwrap();
+        done_rx.recv_timeout(Duration::from_secs(2)).unwrap();
+        done_rx.recv_timeout(Duration::from_secs(2)).unwrap();
+    });
+    assert_eq!(state.packages().len(), 1);
+    assert_eq!(state.packages()[0].entry.plugin_id, "catalog-new.plugin");
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/web.rs b/windows/tauri/src-tauri/src/plugin_host/web.rs
new file mode 100644
index 0000000000..905f791205
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/web.rs
@@ -0,0 +1,1836 @@
+//! Web tool windows (ui capability 2): package pages in a WebView2 shell.
+//!
+//! The contract rules (shared/contracts/plugins/v1/README.md, "Web content
+//! (ui 2)") put the security boundary in the file service: only files of the
+//! owning installed package are served, read-only, from a plugin-private
+//! origin, with a CSP that refuses network access, remote resources, frames,
+//! inline scripts and eval. The window shell (dock, title, order, lifecycle)
+//! is host-owned; the page fills the body only. Build-system bridge methods
+//! wait for the Windows build-system plugin capability and are not part of
+//! this module.
+
+use super::scan::ScannedPackage;
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+use std::collections::{BTreeMap, HashMap};
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+use tauri::{AppHandle, Manager, WebviewUrl, WebviewWindowBuilder};
+
+#[cfg(windows)]
+#[path = "web_network.rs"]
+mod network;
+
+/// Largest package file the scheme serves; a page cannot map the whole
+/// package into memory through one request.
+const MAX_PAGE_FILE_BYTES: u64 = 16 * 1024 * 1024;
+
+/// CSP applied to every page response. `wasm-unsafe-eval` is absent: pages
+/// compile no WebAssembly. `tauri:` IPC stays available because the bridge
+/// runs over it; every other source is refused.
+const PAGE_CSP: &str = "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src ipc: http://ipc.localhost; frame-ancestors 'none'; form-action 'none'; base-uri 'none'";
+
+/// Per-window page state (`ui.getState` / `ui.setState`), kept in the host so
+/// web storage can stay non-persistent. Bounded per contract.
+const MAX_PAGE_STATE_BYTES: usize = 64 * 1024;
+/// Reserved same-origin host script, served before any package-authored code.
+const HOST_BRIDGE_PATH: &str = "__lithe_host__/bridge.js";
+
+#[derive(Default)]
+pub struct WebPageHostState {
+    states: Mutex<HashMap<String, Value>>,
+    owners: Mutex<HashMap<String, PageOwner>>,
+    workspace_generations: Mutex<HashMap<String, u64>>,
+    open_files: Mutex<HashMap<String, PendingOpenFile>>,
+    appearances: Mutex<HashMap<String, WebPageAppearance>>,
+}
+
+struct PendingOpenFile {
+    host_label: String,
+    page_label: String,
+    completion: tokio::sync::oneshot::Sender<Result<(), String>>,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+struct PageOwner {
+    generation: u64,
+    workspace_generation: u64,
+    host_label: String,
+    workspace_id: String,
+    workspace_path: String,
+    plugin_id: String,
+    window_id: String,
+    state_id: String,
+}
+
+static OPEN_PAGE_SEQUENCE: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+
+fn workspace_generation(state: &WebPageHostState, host: &str, workspace: &str) -> u64 {
+    state
+        .workspace_generations
+        .lock()
+        .expect("workspace page generations")
+        .get(&workspace_label_suffix(host, workspace))
+        .copied()
+        .unwrap_or(0)
+}
+
+/// Effects and revocation share the owners lock. A request cloned before
+/// close cannot recreate state or register an event after authority is gone.
+fn with_page_owner<T>(
+    state: &WebPageHostState,
+    label: &str,
+    identity: &BridgeIdentity,
+    effect: impl FnOnce() -> Result<T, String>,
+) -> Result<T, String> {
+    let owners = state.owners.lock().expect("page owners");
+    if !owners.get(label).is_some_and(|owner| {
+        owner.generation == identity.generation
+            && owner.workspace_generation
+                == workspace_generation(state, &owner.host_label, &owner.workspace_id)
+    }) {
+        return Err(bridge_error(
+            "plugin.web.forbidden",
+            "page ownership was revoked",
+        ));
+    }
+    effect()
+}
+
+fn revoke_owners(
+    state: &WebPageHostState,
+    matches: impl Fn(&PageOwner) -> bool,
+    clear_state: bool,
+) -> Vec<String> {
+    let mut owners = state.owners.lock().expect("page owners");
+    let labels: Vec<_> = owners
+        .iter()
+        .filter(|(_, owner)| matches(owner))
+        .map(|(label, _)| label.clone())
+        .collect();
+    owners.retain(|label, _| !labels.contains(label));
+    state
+        .open_files
+        .lock()
+        .expect("open file requests")
+        .retain(|_, request| !labels.contains(&request.page_label));
+    state
+        .appearances
+        .lock()
+        .expect("page appearances")
+        .retain(|label, _| !labels.contains(label));
+    if clear_state {
+        state
+            .states
+            .lock()
+            .expect("page state")
+            .retain(|key, _| !labels.iter().any(|label| key.ends_with(label)));
+    }
+    labels
+}
+
+fn workspace_label_suffix(host_label: &str, workspace_id: &str) -> String {
+    format!(
+        "--h{}--s{}",
+        hex_label_part(host_label),
+        hex_label_part(workspace_id)
+    )
+}
+
+fn owned_label(owner: &PageOwner) -> String {
+    format!(
+        "plugin-web-{}{}",
+        web_window_label(&owner.plugin_id, &owner.window_id),
+        workspace_label_suffix(&owner.host_label, &owner.workspace_id)
+    )
+}
+
+/// Resolved workbench locale and theme tokens; supplied only by host windows.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct WebPageAppearance {
+    pub locale: String,
+    pub theme: String,
+    pub variables: BTreeMap<String, String>,
+}
+
+/// Checks the real document origin, including WebView2's custom-scheme mapping.
+/// Navigation and IPC share this predicate so a window label alone grants nothing.
+fn is_package_url(url: &url::Url, plugin_id: &str) -> bool {
+    if !url.username().is_empty() || url.password().is_some() || url.port().is_some() {
+        return false;
+    }
+    let private_origin = url.scheme() == "lithe-plugin" && url.host_str() == Some(plugin_id);
+    let mapped_origin = cfg!(windows)
+        && url.scheme() == "http"
+        && url.host_str() == Some(format!("lithe-plugin.{plugin_id}").as_str());
+    (private_origin || mapped_origin) && sanitize_package_path(url.path()).is_ok()
+}
+
+fn require_package_url(url: &url::Url, plugin_id: &str) -> Result<(), String> {
+    if is_package_url(url, plugin_id) {
+        Ok(())
+    } else {
+        Err(bridge_error(
+            "plugin.web.forbidden",
+            "the document is outside its plugin package",
+        ))
+    }
+}
+
+/// State key of one page: plugin ID and tool window ID.
+fn state_key(plugin_id: &str, window_id: &str) -> String {
+    format!("{plugin_id}\u{0}{window_id}")
+}
+
+/// One declared web tool window of a scanned package.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct WebToolWindow {
+    pub window_id: String,
+    pub plugin_id: String,
+    pub title: String,
+    pub placement: String,
+    pub order: Option<u32>,
+    /// Package-relative entry HTML path.
+    pub entry: String,
+}
+
+/// Declared web tool windows of all accepted, enabled packages.
+#[tauri::command]
+pub fn declarative_plugins_web_windows(app: AppHandle) -> Vec<WebToolWindow> {
+    let mut windows = Vec::new();
+    for package in app.state::<super::PluginHostState>().packages() {
+        if package.entry.status != "accepted"
+            || !package.entry.enabled
+            || app
+                .state::<super::lifecycle::LifecycleState>()
+                .blocked(&package.entry.plugin_id)
+        {
+            continue;
+        }
+        collect_web_windows(&package, &mut windows);
+    }
+    windows.sort_by(|left, right| {
+        (left.order.unwrap_or(u32::MAX), left.window_id.as_str())
+            .cmp(&(right.order.unwrap_or(u32::MAX), right.window_id.as_str()))
+    });
+    windows
+}
+
+fn collect_web_windows(package: &ScannedPackage, windows: &mut Vec<WebToolWindow>) {
+    let Some(tool_windows) = package.manifest["ui"]["toolWindows"].as_array() else {
+        return;
+    };
+    for window in tool_windows {
+        let entry = match window["web"]["entry"].as_str() {
+            Some(entry) => entry.to_string(),
+            None if window["text"].is_string() => format!(
+                "__lithe_host__/text/{}.html",
+                hex_label_part(window["id"].as_str().unwrap_or_default())
+            ),
+            _ => continue,
+        };
+        windows.push(WebToolWindow {
+            window_id: window["id"].as_str().unwrap_or_default().to_string(),
+            plugin_id: package.entry.plugin_id.clone(),
+            title: window["title"].as_str().unwrap_or_default().to_string(),
+            placement: window["placement"].as_str().unwrap_or("bottom").to_string(),
+            order: window["order"].as_u64().map(|order| order as u32),
+            entry,
+        });
+    }
+}
+
+/// Opens (or focuses) the web view of one tool window. The URL is the
+/// plugin-private scheme origin with the declared entry path.
+#[tauri::command]
+pub async fn declarative_plugins_open_web_window(
+    app: AppHandle,
+    caller: tauri::WebviewWindow,
+    plugin_id: String,
+    window_id: String,
+    workspace_id: String,
+    workspace_path: String,
+    appearance: WebPageAppearance,
+) -> Result<(), String> {
+    if workspace_id.is_empty()
+        || workspace_path.is_empty()
+        || app
+            .state::<super::lifecycle::LifecycleState>()
+            .blocked(&plugin_id)
+    {
+        return Err("plugin page requires an active workspace and package".into());
+    }
+    // Register the whole asynchronous creation, not just resource reads.
+    // Mutation waits for this lease before collecting and closing owners.
+    let _native_page = app
+        .state::<super::lifecycle::LifecycleState>()
+        .acquire(&plugin_id)?;
+    let owner = PageOwner {
+        generation: OPEN_PAGE_SEQUENCE.fetch_add(1, std::sync::atomic::Ordering::Relaxed),
+        workspace_generation: workspace_generation(
+            &app.state::<WebPageHostState>(),
+            caller.label(),
+            &workspace_id,
+        ),
+        host_label: caller.label().into(),
+        workspace_id,
+        workspace_path,
+        plugin_id: plugin_id.clone(),
+        window_id: window_id.clone(),
+        state_id: String::new(),
+    };
+    let label = owned_label(&owner);
+    let owner = PageOwner {
+        state_id: label.clone(),
+        ..owner
+    };
+    let Some(window) = declarative_plugins_web_windows(app.clone())
+        .into_iter()
+        .find(|window| window.plugin_id == plugin_id && window.window_id == window_id)
+    else {
+        return Err(format!(
+            "{plugin_id}/{window_id} is not a declared web tool window"
+        ));
+    };
+    app.state::<WebPageHostState>()
+        .owners
+        .lock()
+        .expect("page owners")
+        .insert(label.clone(), owner);
+    app.state::<WebPageHostState>()
+        .appearances
+        .lock()
+        .expect("appearance mutex")
+        .insert(label.clone(), appearance.clone());
+    if let Some(existing) = app.get_webview_window(&label) {
+        let _ = existing.set_focus();
+        return Ok(());
+    }
+    let target_url = package_page_url(&window.plugin_id, &window.entry)?;
+    let request_plugin_id = window.plugin_id.clone();
+    let plugin_id = window.plugin_id.clone();
+    // Start inert. The request filter must be installed before package code
+    // can navigate or otherwise cause an outbound request.
+    let view = WebviewWindowBuilder::new(
+        &app,
+        &label,
+        WebviewUrl::External("about:blank".parse().expect("blank URL")),
+    )
+    .title(window.title)
+    .incognito(true)
+    .on_navigation(move |url| is_package_url(url, &plugin_id))
+    .on_new_window(|_, _| tauri::webview::NewWindowResponse::Deny)
+    .on_download(|_, _| false)
+    .build()
+    .map_err(|error| format!("web window could not open: {error}"))?;
+    let setup: Result<(), String> = async {
+        #[cfg(windows)]
+        network::restrict_requests(&view, request_plugin_id).await?;
+        bridge_identity(&app, &label)?;
+        view.navigate(target_url).map_err(|error| error.to_string())
+    }
+    .await;
+    if let Err(error) = setup {
+        forget_window_appearance(&app, &label);
+        if let Err(close_error) = view.close() {
+            return Err(format!(
+                "{error}; failed to close the inactive page: {close_error}"
+            ));
+        }
+        return Err(error);
+    }
+    Ok(())
+}
+
+fn package_page_url(plugin_id: &str, entry: &str) -> Result<url::Url, String> {
+    // Wry maps custom schemes only at creation. A later navigate() reaches
+    // WebView2 directly, so it must use the same mapped origin explicitly.
+    #[cfg(windows)]
+    let url = format!("http://lithe-plugin.{plugin_id}/{entry}");
+    #[cfg(not(windows))]
+    let url = format!("lithe-plugin://{plugin_id}/{entry}");
+    url.parse()
+        .map_err(|error: url::ParseError| error.to_string())
+}
+
+fn appearance_script(appearance: &WebPageAppearance) -> String {
+    format!(
+        "window.__litheDeliverEvent?.('ui.themeChanged', {});",
+        json!(appearance)
+    )
+}
+
+/// Applies a workbench change to existing pages and their next reload.
+#[tauri::command]
+pub fn declarative_plugins_web_update_appearance(
+    app: AppHandle,
+    caller: tauri::WebviewWindow,
+    appearance: WebPageAppearance,
+) -> Result<(), String> {
+    let windows: Vec<_> = app
+        .webview_windows()
+        .into_iter()
+        .filter(|(label, _)| {
+            app.state::<WebPageHostState>()
+                .owners
+                .lock()
+                .expect("page owners")
+                .get(label)
+                .is_some_and(|owner| owner.host_label == caller.label())
+        })
+        .collect();
+    {
+        let state = app.state::<WebPageHostState>();
+        let mut appearances = state.appearances.lock().expect("appearance mutex");
+        for (label, _) in &windows {
+            appearances.insert(label.clone(), appearance.clone());
+        }
+    }
+    let mut failures = Vec::new();
+    for (label, window) in windows {
+        if let Err(error) = window.eval(appearance_script(&appearance)) {
+            failures.push(format!("{label}: {error}"));
+        }
+    }
+    if failures.is_empty() {
+        Ok(())
+    } else {
+        Err(failures.join("; "))
+    }
+}
+
+/// Native window destruction releases its cached appearance, including X-close.
+pub fn forget_window_appearance<R: tauri::Runtime>(app: &AppHandle<R>, label: &str) {
+    let state = app.state::<WebPageHostState>();
+    let children = revoke_owners(
+        &state,
+        |owner| owner.host_label == label || owned_label(owner) == label,
+        !label.starts_with("plugin-web-"),
+    );
+    let host_prefix = format!("--h{}--s", hex_label_part(label));
+    state
+        .states
+        .lock()
+        .expect("page state")
+        .retain(|key, _| !key.contains(&host_prefix));
+    state
+        .workspace_generations
+        .lock()
+        .expect("workspace page generations")
+        .retain(|scope, _| !scope.starts_with(&host_prefix));
+    for child in children {
+        if child != label {
+            if let Some(view) = app.get_webview_window(&child) {
+                let _ = view.close();
+            }
+        }
+    }
+}
+
+/// Destroys the web view of one tool window; used on plugin disable,
+/// uninstall, and window teardown.
+#[tauri::command]
+pub fn declarative_plugins_close_web_window(
+    app: AppHandle,
+    caller: tauri::WebviewWindow,
+    workspace_id: String,
+    plugin_id: String,
+    window_id: String,
+) -> Result<(), String> {
+    let label = owned_label(&PageOwner {
+        generation: 0,
+        workspace_generation: 0,
+        host_label: caller.label().into(),
+        workspace_id,
+        workspace_path: String::new(),
+        plugin_id,
+        window_id,
+        state_id: String::new(),
+    });
+    if let Some(existing) = app.get_webview_window(&label) {
+        existing
+            .close()
+            .map_err(|error| format!("web window could not close: {error}"))?;
+    }
+    Ok(())
+}
+
+/// `ui.getState`: the host-stored state of one page, or `null`.
+#[tauri::command]
+pub fn declarative_plugins_web_get_state(
+    app: AppHandle,
+    plugin_id: String,
+    window_id: String,
+) -> Value {
+    app.state::<WebPageHostState>()
+        .states
+        .lock()
+        .expect("web page state mutex")
+        .get(&state_key(&plugin_id, &window_id))
+        .cloned()
+        .unwrap_or(Value::Null)
+}
+
+/// `ui.setState`: stores page state; over the contract's 64 KiB budget the
+/// call fails with the bridge error shape instead of truncating.
+#[tauri::command]
+pub fn declarative_plugins_web_set_state(
+    app: AppHandle,
+    plugin_id: String,
+    window_id: String,
+    state: Value,
+) -> Result<(), String> {
+    let serialized = serde_json::to_string(&state).map_err(|error| error.to_string())?;
+    if serialized.len() > MAX_PAGE_STATE_BYTES {
+        return Err(
+            json!({ "code": "plugin.web.invalidRequest", "message": "state exceeds 64 KiB" })
+                .to_string(),
+        );
+    }
+    app.state::<WebPageHostState>()
+        .states
+        .lock()
+        .expect("web page state mutex")
+        .insert(state_key(&plugin_id, &window_id), state);
+    Ok(())
+}
+
+/// Drops state of one plugin (disable/uninstall).
+pub fn forget_plugin_state(app: &AppHandle, plugin_id: &str) {
+    let states = app.state::<WebPageHostState>();
+    let mut guard = states.states.lock().expect("web page state mutex");
+    let prefix = format!("{plugin_id}\u{0}");
+    guard.retain(|key, _| !key.starts_with(&prefix));
+}
+
+/// The first parser-blocking script defines the frozen `window.lithe` bridge.
+/// v0 methods: context, request (state + openFile), on; build.* and
+/// functions.* resolve to `plugin.web.unknownMethod` until their Windows
+/// capabilities land.
+fn bridge_script(plugin_id: &str, window_id: &str, appearance: &WebPageAppearance) -> String {
+    let context = json!({
+        "pluginID": plugin_id,
+        "windowID": window_id,
+        "platform": "windows",
+        "locale": appearance.locale,
+    });
+    const_bridge_script()
+        .replace("__LITHE_CONTEXT__", &context.to_string())
+        .replace("__LITHE_APPEARANCE__", &json!(appearance).to_string())
+        .replace("__LITHE_PLUGIN__", &json!(plugin_id).to_string())
+        .replace("__LITHE_WINDOW__", &json!(window_id).to_string())
+}
+
+/// Bridge bootstrap as a plain string; placeholders are replaced with JSON
+/// literals so no brace escaping is involved.
+fn const_bridge_script() -> &'static str {
+    r#"(() => {
+  "use strict";
+  const initial = __LITHE_CONTEXT__;
+  // Never expose a bridge in another document, even if native navigation
+  // policy regresses or a page fetches this reserved script explicitly.
+  const url = new URL(window.location.href);
+  if (window !== window.top || url.username || url.password || url.port ||
+      !((url.protocol === 'lithe-plugin:' && url.hostname === initial.pluginID) ||
+        (url.protocol === 'http:' && url.hostname === 'lithe-plugin.' + initial.pluginID))) return;
+  let appearance = __LITHE_APPEARANCE__;
+  const context = Object.freeze({ ...initial,
+    get locale() { return appearance.locale; },
+    get theme() { return appearance.theme; },
+  });
+  const applyTheme = () => {
+    const root = document.documentElement;
+    if (!root) { document.addEventListener('readystatechange', applyTheme, { once: true }); return; }
+    root.setAttribute('data-theme', appearance.theme);
+    root.lang = appearance.locale;
+    for (const [name, value] of Object.entries(appearance.variables)) root.style.setProperty(name, value);
+  };
+  const listeners = new Map();
+  const invoke = (method, params) => window.__TAURI_INTERNALS__.invoke(
+    "plugin:declarative-web|request",
+    { method, params },
+  );
+  const bridge = {
+    context,
+    request(method, params) {
+      if (typeof method !== "string" || !method) {
+        return Promise.reject({ code: "plugin.web.invalidRequest", message: "method must be a non-empty string" });
+      }
+      return invoke(method, params ?? null);
+    },
+    on(event, listener) {
+      if (typeof event !== "string" || typeof listener !== "function") {
+        throw new TypeError("on(event, listener) requires a string and a function");
+      }
+      const set = listeners.get(event) ?? new Set();
+      set.add(listener);
+      listeners.set(event, set);
+      return () => set.delete(listener);
+    },
+  };
+  Object.freeze(bridge);
+  Object.defineProperty(window, "lithe", { value: Object.freeze(bridge), configurable: false, writable: false });
+  window.__litheDeliverEvent = (event, payload) => {
+    if (event === 'ui.themeChanged') {
+      appearance = payload;
+      applyTheme();
+      payload = { theme: appearance.theme };
+    }
+    const set = listeners.get(event);
+    if (set) for (const listener of [...set]) {
+      try { listener(payload); } catch { /* a failing listener must not break the pump */ }
+    }
+  };
+  applyTheme();
+})();"#
+}
+
+/// Minimal Tauri plugin namespace so custom-protocol pages can receive one
+/// ACL-granted command without changing the main application's command ACL.
+pub fn bridge_plugin() -> tauri::plugin::TauriPlugin<tauri::Wry> {
+    tauri::plugin::Builder::new("declarative-web")
+        .invoke_handler(|invoke| {
+            if invoke.message.command() != "request" {
+                return false;
+            }
+            handle_bridge_request(invoke);
+            true
+        })
+        .build()
+}
+
+/// The single Tauri entry behind `lithe.request`. The calling page's
+/// identity is derived from the invoking webview's label
+/// (`plugin-web-<windowID>`), never from arguments the page supplies; the
+/// plugin is then resolved from the accepted catalog and must currently
+/// declare this window and be enabled. A page can only reach its own
+/// plugin's state and the workspace layer.
+///
+/// The inlined plugin's ACL admits only this request, and this handler then
+/// enforces document and package identity before dispatching any method.
+fn handle_bridge_request(invoke: tauri::ipc::Invoke<tauri::Wry>) {
+    let webview = invoke.message.webview_ref().clone();
+    // The bridge payload arrives as the command's JSON arguments envelope.
+    let params: BridgeArgs = match invoke.message.payload() {
+        tauri::ipc::InvokeBody::Json(value) => match serde_json::from_value(value.clone()) {
+            Ok(args) => args,
+            Err(error) => {
+                invoke
+                    .resolver
+                    .respond::<tauri::ipc::InvokeResponseBody>(Err(tauri::ipc::InvokeError(
+                        serde_json::json!({
+                            "code": "plugin.web.invalidRequest",
+                            "message": error.to_string(),
+                        }),
+                    )));
+                return;
+            }
+        },
+        _ => {
+            invoke
+                .resolver
+                .respond::<tauri::ipc::InvokeResponseBody>(Err(tauri::ipc::InvokeError(
+                    serde_json::json!({
+                        "code": "plugin.web.invalidRequest",
+                        "message": "the bridge only accepts JSON payloads",
+                    }),
+                )));
+            return;
+        }
+    };
+    let app = webview.app_handle().clone();
+    tauri::async_runtime::spawn(async move {
+        let result = bridge_dispatch(&app, &webview, params).await;
+        match result {
+            Ok(value) => {
+                invoke
+                    .resolver
+                    .respond::<tauri::ipc::InvokeResponseBody>(Ok(serde_json::to_string(&value)
+                        .map(tauri::ipc::InvokeResponseBody::Json)
+                        .unwrap_or_else(|_| tauri::ipc::InvokeResponseBody::Json("{}".into()))));
+            }
+            Err(message) => {
+                invoke
+                    .resolver
+                    .respond::<tauri::ipc::InvokeResponseBody>(Err(tauri::ipc::InvokeError(
+                        // `message` is already the JSON error envelope from `bridge_error`.
+                        serde_json::from_str(&message)
+                            .unwrap_or(serde_json::json!({ "message": message })),
+                    )));
+            }
+        }
+    });
+}
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct BridgeArgs {
+    method: String,
+    #[serde(default)]
+    params: Option<Value>,
+}
+
+async fn bridge_dispatch(
+    app: &AppHandle,
+    webview: &tauri::Webview,
+    args: BridgeArgs,
+) -> Result<Value, String> {
+    let method = args.method.as_str();
+    let params = args.params.unwrap_or(Value::Null);
+    let identity = bridge_identity(app, webview.label())?;
+    let url = webview
+        .url()
+        .map_err(|error| bridge_error("plugin.web.forbidden", error.to_string()))?;
+    require_package_url(&url, &identity.plugin_id)?;
+    match method {
+        "ui.getState" => with_page_owner(
+            &app.state::<WebPageHostState>(),
+            webview.label(),
+            &identity,
+            || {
+                Ok(json!({
+                    "state": declarative_plugins_web_get_state(app.clone(), identity.plugin_id.clone(), identity.state_id.clone())
+                }))
+            },
+        ),
+        "ui.setState" => {
+            let state = params.get("state").ok_or_else(|| {
+                bridge_error("plugin.web.invalidRequest", "setState requires state")
+            })?;
+            with_page_owner(
+                &app.state::<WebPageHostState>(),
+                webview.label(),
+                &identity,
+                || {
+                    declarative_plugins_web_set_state(
+                        app.clone(),
+                        identity.plugin_id.clone(),
+                        identity.state_id.clone(),
+                        state.clone(),
+                    )?;
+                    Ok(json!({}))
+                },
+            )
+        }
+        "workspace.openFile" => {
+            let Some(path) = params["path"].as_str() else {
+                return Err(bridge_error(
+                    "plugin.web.invalidRequest",
+                    "openFile requires path",
+                ));
+            };
+            use tauri::Emitter;
+            let operation_id = format!(
+                "{}-{}",
+                webview.label(),
+                OPEN_FILE_SEQUENCE.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
+            );
+            let (sender, receiver) = tokio::sync::oneshot::channel();
+            let pending = OpenFileRequest {
+                app: app.clone(),
+                operation_id: operation_id.clone(),
+            };
+            with_page_owner(
+                &app.state::<WebPageHostState>(),
+                webview.label(),
+                &identity,
+                || {
+                    let state = app.state::<WebPageHostState>();
+                    let mut requests = state.open_files.lock().expect("open file requests");
+                    if requests.len() >= 128 {
+                        return Err(bridge_error(
+                            "plugin.web.invalidRequest",
+                            "too many pending file open requests",
+                        ));
+                    }
+                    requests.insert(
+                        operation_id.clone(),
+                        PendingOpenFile {
+                            host_label: identity.host_label.clone(),
+                            page_label: webview.label().into(),
+                            completion: sender,
+                        },
+                    );
+                    drop(requests);
+                    app.emit_to(
+                        &identity.host_label,
+                        "plugin-web-open-file",
+                        json!({
+                            "pluginId": identity.plugin_id,
+                            "operationId": operation_id,
+                            "workspaceId": identity.workspace_id,
+                            "workspacePath": identity.workspace_path,
+                            "path": path,
+                            "line": params["line"].as_u64(),
+                            "column": params["column"].as_u64(),
+                        }),
+                    )
+                    .map_err(|error| error.to_string())
+                },
+            )?;
+            tokio::time::timeout(std::time::Duration::from_secs(10), receiver)
+                .await
+                .map_err(|_| {
+                    bridge_error(
+                        "plugin.web.openFileFailed",
+                        "file open acknowledgement timed out",
+                    )
+                })?
+                .map_err(|_| bridge_error("plugin.web.forbidden", "page was closed"))?
+                .map_err(|error| bridge_error("plugin.web.openFileFailed", error))?;
+            drop(pending);
+            bridge_identity(app, webview.label())?;
+            Ok(json!({}))
+        }
+        "build.instances" | "build.refresh" | "build.runTask" | "build.runTests"
+        | "build.cancel" | "build.dependencies" | "build.setOptions" | "functions.list"
+        | "functions.invoke" | "functions.cancel" => Err(bridge_error(
+            "plugin.web.unknownMethod",
+            format!("{method} needs the Windows build-system capability"),
+        )),
+        other => Err(bridge_error(
+            "plugin.web.unknownMethod",
+            format!("unknown method {other}"),
+        )),
+    }
+}
+
+static OPEN_FILE_SEQUENCE: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+struct OpenFileRequest {
+    app: AppHandle,
+    operation_id: String,
+}
+impl Drop for OpenFileRequest {
+    fn drop(&mut self) {
+        self.app
+            .state::<WebPageHostState>()
+            .open_files
+            .lock()
+            .expect("open file requests")
+            .remove(&self.operation_id);
+    }
+}
+
+#[tauri::command]
+pub fn declarative_plugins_web_open_file_ack(
+    app: AppHandle,
+    caller: tauri::WebviewWindow,
+    operation_id: String,
+    error: Option<String>,
+) -> Result<(), String> {
+    let state = app.state::<WebPageHostState>();
+    let mut pending = state.open_files.lock().expect("open file requests");
+    if !pending
+        .get(&operation_id)
+        .is_some_and(|request| request.host_label == caller.label())
+    {
+        return Err("file request does not belong to this product window".into());
+    }
+    if let Some(request) = pending.remove(&operation_id) {
+        let _ = request.completion.send(error.map_or(Ok(()), Err));
+    }
+    Ok(())
+}
+
+/// Identity of a bridge caller, derived from its window label.
+#[derive(Debug, Clone, PartialEq)]
+pub struct BridgeIdentity {
+    pub generation: u64,
+    pub plugin_id: String,
+    pub window_id: String,
+    pub host_label: String,
+    pub workspace_id: String,
+    pub workspace_path: String,
+    pub state_id: String,
+}
+
+/// Resolves and authorizes a bridge caller from its webview label. The label
+/// includes a collision-free encoding of plugin and window IDs; authorization
+/// re-derives it from the owning package's current catalog entry. Anything
+/// that does not round-trip — a label from another window kind, a window the
+/// plugin no longer declares, a disabled or uninstalled plugin, or a forged
+/// label pointing at another plugin's window — is refused with
+/// `plugin.web.forbidden`.
+fn bridge_identity<R: tauri::Runtime>(
+    app: &AppHandle<R>,
+    label: &str,
+) -> Result<BridgeIdentity, String> {
+    let owner = app
+        .state::<WebPageHostState>()
+        .owners
+        .lock()
+        .expect("page owners")
+        .get(label)
+        .cloned()
+        .ok_or_else(|| bridge_error("plugin.web.forbidden", "page ownership was revoked"))?;
+    if owner.workspace_generation
+        != workspace_generation(
+            &app.state::<WebPageHostState>(),
+            &owner.host_label,
+            &owner.workspace_id,
+        )
+        || owned_label(&owner) != label
+        || app.get_webview_window(&owner.host_label).is_none()
+        || app
+            .state::<super::lifecycle::LifecycleState>()
+            .blocked(&owner.plugin_id)
+    {
+        return Err(bridge_error(
+            "plugin.web.forbidden",
+            "page owner is inactive",
+        ));
+    }
+    let declared = declarative_windows_for(app)
+        .into_iter()
+        .any(|window| window.plugin_id == owner.plugin_id && window.window_id == owner.window_id);
+    if !declared {
+        return Err(bridge_error(
+            "plugin.web.forbidden",
+            "package no longer declares this page",
+        ));
+    }
+    Ok(BridgeIdentity {
+        generation: owner.generation,
+        plugin_id: owner.plugin_id,
+        window_id: owner.window_id,
+        host_label: owner.host_label,
+        workspace_id: owner.workspace_id,
+        workspace_path: owner.workspace_path,
+        state_id: owner.state_id,
+    })
+}
+
+fn declarative_windows_for<R: tauri::Runtime>(app: &AppHandle<R>) -> Vec<WebToolWindow> {
+    let mut windows = Vec::new();
+    for package in app.state::<super::PluginHostState>().packages() {
+        if package.entry.status == "accepted" && package.entry.enabled {
+            collect_web_windows(&package, &mut windows);
+        }
+    }
+    windows
+}
+
+/// The webview label of one tool window: a collision-free hexadecimal encoding
+/// of the plugin and window IDs, safe for Tauri labels.
+pub(crate) fn web_window_label(plugin_id: &str, window_id: &str) -> String {
+    format!(
+        "p{}--w{}",
+        hex_label_part(plugin_id),
+        hex_label_part(window_id)
+    )
+}
+
+fn hex_label_part(value: &str) -> String {
+    value
+        .as_bytes()
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect()
+}
+
+fn bridge_error(code: &str, message: impl Into<String>) -> String {
+    json!({ "code": code, "message": message.into() }).to_string()
+}
+
+/// Resolves symlinks/junctions before the workspace file-open entry can read.
+/// Returning the canonical target also avoids re-resolving the original link
+/// using stale file-tree metadata in `handleFileSelect`.
+#[tauri::command]
+pub fn declarative_plugins_web_resolve_file(
+    workspace_path: PathBuf,
+    path: PathBuf,
+) -> Result<String, String> {
+    let root = workspace_path.canonicalize().map_err(|error| {
+        bridge_error(
+            "plugin.web.forbidden",
+            format!("workspace is unreadable: {error}"),
+        )
+    })?;
+    let target = if path.is_absolute() {
+        path
+    } else {
+        root.join(path)
+    };
+    let target = target.canonicalize().map_err(|error| {
+        bridge_error(
+            "plugin.web.forbidden",
+            format!("file is unreadable: {error}"),
+        )
+    })?;
+    if target == root || !target.starts_with(&root) || !target.is_file() {
+        return Err(bridge_error(
+            "plugin.web.forbidden",
+            "the file is outside the workspace",
+        ));
+    }
+    let path = target.to_string_lossy().replace('\\', "/");
+    // Keep the editor's conventional drive/UNC spelling after canonicalize.
+    Ok(if let Some(unc) = path.strip_prefix("//?/UNC/") {
+        format!("//{unc}")
+    } else {
+        path.strip_prefix("//?/").unwrap_or(&path).to_string()
+    })
+}
+
+/// Revoke bridge access before closing; close failures stop package mutation.
+pub fn close_plugin_windows(app: &AppHandle, plugin_id: &str) -> Result<(), String> {
+    close_owned_pages(app, |owner| owner.plugin_id == plugin_id)?;
+    forget_plugin_state(app, plugin_id);
+    Ok(())
+}
+
+fn close_owned_pages(app: &AppHandle, matches: impl Fn(&PageOwner) -> bool) -> Result<(), String> {
+    let labels = revoke_owners(&app.state::<WebPageHostState>(), matches, true);
+    let mut failures = Vec::new();
+    for label in labels {
+        if let Some(view) = app.get_webview_window(&label) {
+            if let Err(error) = view.close() {
+                failures.push(error.to_string());
+            }
+        }
+    }
+    if failures.is_empty() {
+        Ok(())
+    } else {
+        Err(failures.join("; "))
+    }
+}
+
+#[tauri::command]
+pub fn declarative_plugins_close_workspace_pages(
+    app: AppHandle,
+    caller: tauri::WebviewWindow,
+    workspace_id: String,
+) -> Result<(), String> {
+    let scope = workspace_label_suffix(caller.label(), &workspace_id);
+    {
+        let state = app.state::<WebPageHostState>();
+        let mut generations = state
+            .workspace_generations
+            .lock()
+            .expect("workspace page generations");
+        *generations.entry(scope).or_default() += 1;
+    }
+    close_owned_pages(&app, |owner| {
+        owner.host_label == caller.label() && owner.workspace_id == workspace_id
+    })?;
+    let suffix = workspace_label_suffix(caller.label(), &workspace_id);
+    app.state::<WebPageHostState>()
+        .states
+        .lock()
+        .expect("page state")
+        .retain(|key, _| !key.ends_with(&suffix));
+    Ok(())
+}
+
+// MARK: scheme file service
+
+/// Serves one package file for the `lithe-plugin://<pluginID>/<path>` origin.
+/// Returns the response or a bridge-error string; the caller maps errors to
+/// an HTTP status.
+pub fn serve_package_file<R: tauri::Runtime>(
+    app: &AppHandle<R>,
+    plugin_id: &str,
+    raw_path: &str,
+) -> Result<(&'static str, Vec<u8>), String> {
+    let package = app
+        .state::<super::PluginHostState>()
+        .packages()
+        .into_iter()
+        .find(|package| {
+            package.entry.status == "accepted"
+                && package.entry.enabled
+                && package.entry.plugin_id == plugin_id
+        })
+        .ok_or_else(|| format!("{plugin_id} is not an accepted declarative plugin"))?;
+    let relative = sanitize_package_path(raw_path)?;
+    if relative
+        .extension()
+        .and_then(|extension| extension.to_str())
+        != Some("html")
+        && relative
+            .extension()
+            .and_then(|extension| extension.to_str())
+            != Some("css")
+        && relative
+            .extension()
+            .and_then(|extension| extension.to_str())
+            != Some("js")
+        && relative
+            .extension()
+            .and_then(|extension| extension.to_str())
+            != Some("svg")
+        && relative
+            .extension()
+            .and_then(|extension| extension.to_str())
+            != Some("png")
+        && relative
+            .extension()
+            .and_then(|extension| extension.to_str())
+            != Some("json")
+        && relative
+            .extension()
+            .and_then(|extension| extension.to_str())
+            != Some("woff2")
+    {
+        return Err(format!(
+            "unsupported page asset type: {}",
+            relative.display()
+        ));
+    }
+    let target = package.root.join(&relative);
+    let metadata = std::fs::symlink_metadata(&target)
+        .map_err(|error| format!("{} is unreadable: {error}", target.display()))?;
+    #[cfg(windows)]
+    {
+        use std::os::windows::fs::MetadataExt;
+        if metadata.file_attributes() & 0x0400 != 0 {
+            return Err(format!("{} is a reparse point", target.display()));
+        }
+    }
+    #[cfg(not(windows))]
+    if metadata.file_type().is_symlink() {
+        return Err(format!("{} is a symbolic link", target.display()));
+    }
+    if !metadata.is_file() || metadata.len() > MAX_PAGE_FILE_BYTES {
+        return Err(format!("{} is not a servable file", target.display()));
+    }
+    let canonical_root = package
+        .root
+        .canonicalize()
+        .map_err(|error| format!("package root is unreadable: {error}"))?;
+    let canonical = target
+        .canonicalize()
+        .map_err(|error| format!("{} is unreadable: {error}", target.display()))?;
+    if !canonical.starts_with(&canonical_root) {
+        return Err(format!("{} escapes the package", target.display()));
+    }
+    let bytes = std::fs::read(&target).map_err(|error| error.to_string())?;
+    Ok((content_type(&relative), bytes))
+}
+
+/// Normalizes a URL path to a safe package-relative path: no empty segments,
+/// `.`/`..`, encoded separators, or absolute forms.
+fn sanitize_package_path(raw: &str) -> Result<PathBuf, String> {
+    let decoded = percent_decode(raw);
+    let mut segments: Vec<&str> = Vec::new();
+    for segment in decoded.split('/') {
+        match segment {
+            "" | "." => {}
+            ".." => return Err("path traversal is refused".to_string()),
+            other => segments.push(other),
+        }
+    }
+    if segments.is_empty() {
+        return Err("empty page path".to_string());
+    }
+    let mut path = PathBuf::new();
+    for segment in segments {
+        path.push(segment);
+    }
+    Ok(path)
+}
+
+fn percent_decode(raw: &str) -> String {
+    let bytes = raw.as_bytes();
+    let mut output = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        if bytes[index] == b'%' && index + 2 < bytes.len() {
+            let hex = std::str::from_utf8(&bytes[index + 1..index + 3]).unwrap_or("");
+            if let Ok(byte) = u8::from_str_radix(hex, 16) {
+                output.push(byte);
+                index += 3;
+                continue;
+            }
+        }
+        output.push(bytes[index]);
+        index += 1;
+    }
+    String::from_utf8_lossy(&output).to_string()
+}
+
+fn content_type(path: &Path) -> &'static str {
+    match path.extension().and_then(|extension| extension.to_str()) {
+        Some("html") => "text/html; charset=utf-8",
+        Some("css") => "text/css; charset=utf-8",
+        Some("js") => "text/javascript; charset=utf-8",
+        Some("svg") => "image/svg+xml",
+        Some("png") => "image/png",
+        Some("json") => "application/json",
+        Some("woff2") => "font/woff2",
+        _ => "application/octet-stream",
+    }
+}
+
+/// Tauri scheme handler for `lithe-plugin://<pluginID>/<path>`. Wry restores
+/// the original URI before delivery; its context supplies the trusted label.
+pub fn handle_scheme_request<R: tauri::Runtime>(
+    app: &AppHandle<R>,
+    webview_label: &str,
+    request: http::Request<Vec<u8>>,
+) -> http::Response<Vec<u8>> {
+    let ok = |content_type: &'static str, body: Vec<u8>| {
+        http::Response::builder()
+            .status(200)
+            .header("Content-Type", content_type)
+            .header("Content-Security-Policy", PAGE_CSP)
+            .header("X-Content-Type-Options", "nosniff")
+            .header("Cache-Control", "no-store")
+            .header("Cross-Origin-Resource-Policy", "same-origin")
+            .body(body)
+            .expect("response builds")
+    };
+    let refused = |message: &str| {
+        http::Response::builder()
+            .status(404)
+            .header("Content-Type", "text/plain; charset=utf-8")
+            .header("Content-Security-Policy", PAGE_CSP)
+            .body(message.as_bytes().to_vec())
+            .expect("response builds")
+    };
+    // Wry restores `http://lithe-plugin.<pluginID>/...` to the original
+    // `lithe-plugin://<pluginID>/...` before invoking this scheme handler.
+    let plugin_id = request.uri().host().unwrap_or_default();
+    let _native_read = match app
+        .state::<super::lifecycle::LifecycleState>()
+        .acquire(plugin_id)
+    {
+        Ok(lease) => lease,
+        Err(_) => return refused("plugin package is changing"),
+    };
+    let identity = match bridge_identity(app, webview_label) {
+        Ok(identity) if identity.plugin_id == plugin_id => identity,
+        _ => return refused("resource request is outside its plugin page"),
+    };
+    let path = request.uri().path().trim_start_matches('/');
+    if path.starts_with("__lithe_host__/text/") {
+        let package = app
+            .state::<super::PluginHostState>()
+            .packages()
+            .into_iter()
+            .find(|package| package.entry.plugin_id == identity.plugin_id);
+        let text = package
+            .as_ref()
+            .and_then(|package| package.manifest["ui"]["toolWindows"].as_array())
+            .and_then(|windows| {
+                windows
+                    .iter()
+                    .find(|window| window["id"].as_str() == Some(&identity.window_id))
+            })
+            .and_then(|window| window["text"].as_str());
+        return match text {
+            Some(text) => ok("text/html; charset=utf-8", text_page(text)),
+            None => refused("text window is no longer declared"),
+        };
+    }
+    if path == HOST_BRIDGE_PATH {
+        let appearance = app
+            .state::<WebPageHostState>()
+            .appearances
+            .lock()
+            .expect("appearance mutex")
+            .get(webview_label)
+            .cloned();
+        return match appearance {
+            Some(appearance) => ok(
+                "text/javascript; charset=utf-8",
+                bridge_script(&identity.plugin_id, &identity.window_id, &appearance).into_bytes(),
+            ),
+            None => refused("page is no longer active"),
+        };
+    }
+    match serve_package_file(app, plugin_id, path) {
+        Ok((content_type, body)) if content_type.starts_with("text/html") => {
+            ok(content_type, page_with_host_bridge(body))
+        }
+        Ok((content_type, body)) => ok(content_type, body),
+        Err(message) => refused(&message),
+    }
+}
+
+/// ui:1 text is literal content, escaped into a host-owned shell. No package
+/// markup or scripts execute; theme follows the same host bridge as web pages.
+fn text_page(text: &str) -> Vec<u8> {
+    let escaped = text
+        .replace('&', "&amp;")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('"', "&quot;")
+        .replace('\'', "&#39;");
+    page_with_host_bridge(format!("<!doctype html><html><head><meta charset=\"utf-8\"><style>body{{margin:16px;background:var(--lithe-background);color:var(--lithe-foreground);font:var(--lithe-font-size) var(--lithe-font-family)}}pre{{white-space:pre-wrap;font:inherit}}</style></head><body><pre>{escaped}</pre></body></html>").into_bytes())
+}
+
+/// Inserts the host script before package code without rewriting the package.
+/// Only the HTML prologue is scanned: comments/declarations and the optional
+/// html/head opening tags. Stop before any other tag or text, so a literal
+/// <head> inside script/style content is never interpreted as markup here.
+fn page_with_host_bridge(body: Vec<u8>) -> Vec<u8> {
+    let offset = bridge_insertion_offset(&body);
+    let tag = format!("<script src=\"/{HOST_BRIDGE_PATH}\"></script>");
+    let mut response = Vec::with_capacity(body.len() + tag.len());
+    response.extend_from_slice(&body[..offset]);
+    response.extend_from_slice(tag.as_bytes());
+    response.extend_from_slice(&body[offset..]);
+    response
+}
+
+fn bridge_insertion_offset(body: &[u8]) -> usize {
+    let mut index = if body.starts_with(b"\xef\xbb\xbf") {
+        3
+    } else {
+        0
+    };
+    let mut fallback = index;
+    loop {
+        while body.get(index).is_some_and(u8::is_ascii_whitespace) {
+            index += 1;
+        }
+        if body[index..].starts_with(b"<!--") {
+            let Some(end) = body[index + 4..].windows(3).position(|part| part == b"-->") else {
+                return fallback;
+            };
+            index += 4 + end + 3;
+            fallback = index;
+            continue;
+        }
+        if body[index..].starts_with(b"<!") || body[index..].starts_with(b"<?") {
+            let Some(end) = opening_tag_end(body, index + 2) else {
+                return fallback;
+            };
+            index = end;
+            fallback = index;
+            continue;
+        }
+        if body.get(index) != Some(&b'<') {
+            return fallback;
+        }
+        let name_start = index + 1;
+        let mut name_end = name_start;
+        while body.get(name_end).is_some_and(u8::is_ascii_alphabetic) {
+            name_end += 1;
+        }
+        let name = &body[name_start..name_end];
+        if !body
+            .get(name_end)
+            .is_some_and(|value| value.is_ascii_whitespace() || *value == b'>' || *value == b'/')
+        {
+            return fallback;
+        }
+        if !name.eq_ignore_ascii_case(b"html") && !name.eq_ignore_ascii_case(b"head") {
+            return fallback;
+        }
+        let Some(end) = opening_tag_end(body, name_end) else {
+            return fallback;
+        };
+        if name.eq_ignore_ascii_case(b"head") {
+            return end;
+        }
+        index = end;
+        fallback = end;
+    }
+}
+
+/// HTML attribute quotes can contain `>`; they do not close the opening tag.
+fn opening_tag_end(body: &[u8], mut index: usize) -> Option<usize> {
+    let mut quote = None;
+    while let Some(&value) = body.get(index) {
+        match quote {
+            Some(expected) if value == expected => quote = None,
+            Some(_) => {}
+            None if value == b'\'' || value == b'"' => quote = Some(value),
+            None if value == b'>' => return Some(index + 1),
+            None => {}
+        }
+        index += 1;
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn compiled_acl_grants_only_the_bridge_to_plugin_private_origins() {
+        // Exercise Tauri's actual compiled capability resolution, including
+        // its distinction between the app's origin and custom-protocol pages.
+        let mut context: tauri::Context<tauri::Wry> = tauri::generate_context!();
+        let acl = context.runtime_authority_mut();
+        let label = "plugin-web-fixture";
+        let own = tauri::ipc::Origin::Remote {
+            url: url::Url::parse("http://lithe-plugin.acme.php/ui/index.html").unwrap(),
+        };
+        assert!(acl
+            .resolve_access("plugin:declarative-web|request", label, label, &own)
+            .is_some());
+        for command in [
+            "plugin:fs|read_text_file",
+            "plugin:http|fetch",
+            "plugin:event|emit",
+            "core_execute",
+            "read_local_file",
+        ] {
+            assert!(
+                acl.resolve_access(command, label, label, &own).is_none(),
+                "{command}"
+            );
+        }
+        let foreign = tauri::ipc::Origin::Remote {
+            url: url::Url::parse("https://example.test/ui/index.html").unwrap(),
+        };
+        assert!(acl
+            .resolve_access("plugin:declarative-web|request", label, label, &foreign)
+            .is_none());
+        assert!(acl
+            .resolve_access("plugin:declarative-web|request", "main", "main", &own)
+            .is_none());
+        let manifests: Value = serde_json::from_str(include_str!(concat!(
+            env!("OUT_DIR"),
+            "/acl-manifests.json"
+        )))
+        .unwrap();
+        assert!(
+            manifests.get("__app__").is_none(),
+            "the product's custom-command ACL must stay unchanged"
+        );
+    }
+
+    #[test]
+    fn package_paths_reject_traversal_and_empty() {
+        assert!(sanitize_package_path("ui/index.html").is_ok());
+        assert_eq!(
+            sanitize_package_path("ui/./index.html").expect("normalizes"),
+            PathBuf::from("ui").join("index.html")
+        );
+        assert!(sanitize_package_path("../outside.html").is_err());
+        assert!(sanitize_package_path("ui/../../outside.html").is_err());
+        assert!(sanitize_package_path("").is_err());
+        assert!(sanitize_package_path("%2e%2e/escape.html").is_err());
+        assert_eq!(
+            sanitize_package_path("ui%2Findex.html").expect("decodes"),
+            PathBuf::from("ui").join("index.html")
+        );
+    }
+
+    #[test]
+    fn percent_decode_handles_encoded_and_plain() {
+        assert_eq!(percent_decode("a%20b"), "a b");
+        assert_eq!(percent_decode("plain.html"), "plain.html");
+        assert_eq!(percent_decode("bad%zz"), "bad%zz");
+    }
+
+    #[test]
+    fn bridge_script_is_frozen_and_scoped() {
+        let script = bridge_script(
+            "acme.php",
+            "window-id",
+            &WebPageAppearance {
+                locale: "zh-CN".into(),
+                theme: "dark".into(),
+                variables: BTreeMap::new(),
+            },
+        );
+        assert!(script.contains(r#""pluginID":"acme.php""#));
+        assert!(script.contains("Object.freeze(bridge)"));
+        assert!(script.contains("writable: false"));
+    }
+
+    #[test]
+    fn html_loads_the_fresh_host_bridge_before_package_code() {
+        let tag = "<script src=\"/__lithe_host__/bridge.js\"></script>";
+        let prologue = "<!doctype html><!-- <head>ignored</head> --><HTML style=\"--package-gap:8px\"><HEAD data-test=\"x>y\">";
+        let tail = "<script src=\"page.js\"></script></HEAD><body></body></HTML>";
+        for bom in ["", "\u{feff}"] {
+            let body = format!("{bom}{prologue}{tail}");
+            let response = String::from_utf8(page_with_host_bridge(body.into_bytes())).unwrap();
+            assert_eq!(response, format!("{bom}{prologue}{tag}{tail}"));
+        }
+        // No synthetic doctype or root tags: preserve the package's HTML mode
+        // and attributes even when its html/head tags are legitimately omitted.
+        for (prefix, tail) in [
+            (
+                "<!doctype html><html style='--gap:8px'>",
+                "<body><script src='page.js'></script></body>",
+            ),
+            (
+                "<!doctype html><head data-test='a>b'>",
+                "<script src='page.js'></script>",
+            ),
+            (
+                "<!doctype html><!-- header -->",
+                "<script src='page.js'></script>",
+            ),
+            ("", "<script>const text='<head>';</script>"),
+        ] {
+            assert_eq!(
+                String::from_utf8(page_with_host_bridge(
+                    format!("{prefix}{tail}").into_bytes()
+                ))
+                .unwrap(),
+                format!("{prefix}{tag}{tail}")
+            );
+        }
+        assert!(!PAGE_CSP.contains("script-src 'self' 'unsafe-inline'"));
+    }
+
+    #[test]
+    fn navigation_and_bridge_refuse_foreign_documents() {
+        let initial = package_page_url("acme.php", "ui/index.html").unwrap();
+        assert!(is_package_url(&initial, "acme.php"));
+        assert_eq!(
+            initial.as_str(),
+            if cfg!(windows) {
+                "http://lithe-plugin.acme.php/ui/index.html"
+            } else {
+                "lithe-plugin://acme.php/ui/index.html"
+            }
+        );
+        for address in [
+            "lithe-plugin://acme.php/ui/index.html",
+            "lithe-plugin://acme.php/ui/next.html#section",
+        ] {
+            assert!(require_package_url(&url::Url::parse(address).unwrap(), "acme.php").is_ok());
+        }
+        for address in [
+            "https://example.com/ui/index.html",
+            "http://lithe-plugin.acme.php.evil.test/ui/index.html",
+            "lithe-plugin://other.plugin/ui/index.html",
+            "lithe-plugin://user@acme.php/ui/index.html",
+            "lithe-plugin://acme.php:1234/ui/index.html",
+            "about:blank",
+            "data:text/html,evil",
+            "file:///tmp/index.html",
+            "lithe-plugin://acme.php/%2e%2e%2foutside.html",
+        ] {
+            let error =
+                require_package_url(&url::Url::parse(address).unwrap(), "acme.php").unwrap_err();
+            assert!(error.contains("plugin.web.forbidden"), "{address}");
+        }
+        assert_eq!(
+            is_package_url(
+                &url::Url::parse("http://lithe-plugin.acme.php/ui/index.html").unwrap(),
+                "acme.php"
+            ),
+            cfg!(windows)
+        );
+    }
+
+    #[test]
+    fn open_file_resolves_targets_before_checking_workspace_boundary() {
+        struct TempRoot(PathBuf);
+        impl Drop for TempRoot {
+            fn drop(&mut self) {
+                let _ = std::fs::remove_dir_all(&self.0);
+            }
+        }
+        let root = TempRoot(super::serve_tests::unique_temp_root("workspace-paths"));
+        let workspace = root.0.join("workspace");
+        std::fs::create_dir(&workspace).unwrap();
+        let inside = workspace.join("inside");
+        let outside = root.0.join("outside");
+        std::fs::create_dir(&inside).unwrap();
+        std::fs::create_dir(&outside).unwrap();
+        std::fs::write(inside.join("file.txt"), "inside").unwrap();
+        std::fs::write(outside.join("file.txt"), "outside").unwrap();
+        assert!(
+            declarative_plugins_web_resolve_file(workspace.clone(), "inside/file.txt".into())
+                .is_ok()
+        );
+        assert!(
+            declarative_plugins_web_resolve_file(workspace.clone(), outside.join("file.txt"))
+                .is_err()
+        );
+        link_directory(&inside, &workspace.join("inside-link"));
+        link_directory(&outside, &workspace.join("outside-link"));
+        let resolved =
+            declarative_plugins_web_resolve_file(workspace.clone(), "inside-link/file.txt".into())
+                .unwrap();
+        assert!(resolved.ends_with("/inside/file.txt"));
+        assert!(declarative_plugins_web_resolve_file(
+            workspace.clone(),
+            "outside-link/file.txt".into()
+        )
+        .is_err());
+        // Canonicalize both sides so a workspace opened through a link works.
+        link_directory(&workspace, &root.0.join("linked-root"));
+        assert!(declarative_plugins_web_resolve_file(
+            root.0.join("linked-root"),
+            "inside/file.txt".into()
+        )
+        .is_ok());
+    }
+
+    fn link_directory(target: &Path, link: &Path) {
+        #[cfg(windows)]
+        {
+            // Junctions need no developer-mode/admin privilege and protect
+            // the same reparse-point escape boundary as directory symlinks.
+            let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+            let mut command = std::process::Command::new("cmd");
+            command
+                .args(["/D", "/C", "mklink", "/J"])
+                .arg(link)
+                .arg(target);
+            let outcome = lithe_git_host::run(
+                &mut command,
+                None,
+                || std::time::Instant::now() >= deadline,
+                || {},
+                |_, _| {},
+            );
+            assert!(
+                outcome.failure.is_none() && outcome.status.is_some_and(|status| status.success()),
+                "junction creation failed: {}",
+                String::from_utf8_lossy(&outcome.stderr)
+            );
+        }
+        #[cfg(unix)]
+        std::os::unix::fs::symlink(target, link).expect("directory symlink");
+    }
+
+    #[test]
+    fn bridge_payload_uses_its_method_and_refuses_claimed_identity() {
+        let args: BridgeArgs = serde_json::from_value(json!({
+            "method": "ui.getState",
+            "params": null
+        }))
+        .expect("bridge request");
+        assert_eq!(args.method, "ui.getState");
+        assert!(serde_json::from_value::<BridgeArgs>(json!({
+            "method": "ui.getState",
+            "pluginId": "another.plugin",
+            "params": null
+        }))
+        .is_err());
+    }
+
+    #[test]
+    fn web_window_labels_are_stable_and_collision_free() {
+        // Hex encoding preserves the full plugin/window identity in a label.
+        assert_eq!(
+            web_window_label("dev.lithe", "window"),
+            "p6465762e6c69746865--w77696e646f77"
+        );
+        assert_eq!(
+            web_window_label("acme", "panel:one"),
+            "p61636d65--w70616e656c3a6f6e65"
+        );
+        assert_ne!(
+            web_window_label("acme", "panel"),
+            web_window_label("other", "panel")
+        );
+    }
+    #[test]
+    fn workspace_pages_have_distinct_labels_and_state() {
+        let first = PageOwner {
+            generation: 1,
+            workspace_generation: 0,
+            host_label: "main".into(),
+            workspace_id: "a".into(),
+            workspace_path: "C:/a".into(),
+            plugin_id: "test.plugin".into(),
+            window_id: "panel".into(),
+            state_id: String::new(),
+        };
+        let second = PageOwner {
+            workspace_id: "b".into(),
+            ..first.clone()
+        };
+        let other_window = PageOwner {
+            generation: 1,
+            workspace_generation: 0,
+            host_label: "workspace-other".into(),
+            ..first.clone()
+        };
+        assert_ne!(owned_label(&first), owned_label(&second));
+        assert_ne!(owned_label(&first), owned_label(&other_window));
+        assert_ne!(
+            state_key("test.plugin", &owned_label(&first)),
+            state_key("test.plugin", &owned_label(&second))
+        );
+    }
+
+    #[test]
+    fn text_window_is_literal_and_hello_fixture_is_registered() {
+        let page = String::from_utf8(text_page("<script>alert('test')</script>&")).unwrap();
+        assert!(!page.contains("<script>alert"));
+        assert!(page.contains("&lt;script&gt;"));
+        assert!(page.contains("/__lithe_host__/bridge.js"));
+        let manifest: Value = serde_json::from_str(include_str!(
+            "../../../../../shared/contracts/plugins/v1/fixtures/hello-lithe.plugin.json"
+        ))
+        .unwrap();
+        assert!(manifest["ui"]["toolWindows"][0]["text"].is_string());
+    }
+
+    #[test]
+    fn state_keys_separate_plugins_and_windows() {
+        assert_ne!(state_key("a.plugin", "w1"), state_key("a.plugin", "w2"));
+        assert_ne!(state_key("a.plugin", "w1"), state_key("b.plugin", "w1"));
+    }
+}
+
+#[cfg(test)]
+mod serve_tests {
+    use super::*;
+
+    pub(super) fn unique_temp_root(label: &str) -> PathBuf {
+        let nanos = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("system clock")
+            .as_nanos();
+        let root = std::env::temp_dir().join(format!(
+            "lithe-plugin-web-{label}-{}-{nanos}",
+            std::process::id()
+        ));
+        std::fs::create_dir_all(&root).expect("temp root");
+        root
+    }
+
+    #[test]
+    fn serve_paths_cover_assets_and_refuse_escapes() {
+        // sanitize + content-type behavior without an app handle.
+        assert_eq!(
+            content_type(&sanitize_package_path("ui/index.html").expect("path")),
+            "text/html; charset=utf-8"
+        );
+        assert_eq!(
+            content_type(&sanitize_package_path("style.css").expect("path")),
+            "text/css; charset=utf-8"
+        );
+        assert!(sanitize_package_path("ui/../../secret.txt").is_err());
+    }
+
+    #[test]
+    fn csp_refuses_network_and_eval() {
+        assert!(PAGE_CSP.contains("default-src 'none'"));
+        assert!(PAGE_CSP.contains("script-src 'self'"));
+        assert!(!PAGE_CSP.contains("wasm-unsafe-eval"));
+        assert!(PAGE_CSP.contains("frame-ancestors 'none'"));
+    }
+    fn registered_test_page(state: &WebPageHostState) -> (String, BridgeIdentity) {
+        let owner = PageOwner {
+            generation: 1,
+            workspace_generation: 0,
+            host_label: "main".into(),
+            workspace_id: "a".into(),
+            workspace_path: "C:/a".into(),
+            plugin_id: "test.plugin".into(),
+            window_id: "test.window".into(),
+            state_id: String::new(),
+        };
+        let label = owned_label(&owner);
+        let identity = BridgeIdentity {
+            generation: owner.generation,
+            plugin_id: owner.plugin_id.clone(),
+            window_id: owner.window_id.clone(),
+            host_label: owner.host_label.clone(),
+            workspace_id: owner.workspace_id.clone(),
+            workspace_path: owner.workspace_path.clone(),
+            state_id: label.clone(),
+        };
+        state.owners.lock().unwrap().insert(
+            label.clone(),
+            PageOwner {
+                state_id: label.clone(),
+                ..owner
+            },
+        );
+        (label, identity)
+    }
+
+    #[test]
+    fn page_revocation_clears_committed_effects_and_refuses_late_effects() {
+        use std::sync::{mpsc, Arc};
+        use std::time::Duration;
+        let state = Arc::new(WebPageHostState::default());
+        let (label, identity) = registered_test_page(&state);
+        let (entered_tx, entered_rx) = mpsc::channel();
+        let (release_tx, release_rx) = mpsc::channel();
+        let (done_tx, done_rx) = mpsc::channel();
+        let (sender, mut receiver) = tokio::sync::oneshot::channel();
+        std::thread::scope(|scope| {
+            let writing = state.clone();
+            let label = label.clone();
+            let identity = identity.clone();
+            scope.spawn(move || {
+                with_page_owner(&writing, &label, &identity, || {
+                    entered_tx.send(()).unwrap();
+                    release_rx.recv_timeout(Duration::from_secs(2)).unwrap();
+                    writing
+                        .states
+                        .lock()
+                        .unwrap()
+                        .insert(state_key(&identity.plugin_id, &label), json!({"a":1}));
+                    writing.open_files.lock().unwrap().insert(
+                        "request".into(),
+                        PendingOpenFile {
+                            host_label: identity.host_label.clone(),
+                            page_label: label.clone(),
+                            completion: sender,
+                        },
+                    );
+                    Ok(())
+                })
+                .unwrap();
+            });
+            entered_rx.recv_timeout(Duration::from_secs(2)).unwrap();
+            assert!(state.owners.try_lock().is_err());
+            let closing = state.clone();
+            scope.spawn(move || {
+                revoke_owners(&closing, |_| true, true);
+                done_tx.send(()).unwrap();
+            });
+            release_tx.send(()).unwrap();
+            done_rx.recv_timeout(Duration::from_secs(2)).unwrap();
+        });
+        assert!(state.states.lock().unwrap().is_empty());
+        assert!(state.open_files.lock().unwrap().is_empty());
+        assert_eq!(
+            receiver.try_recv(),
+            Err(tokio::sync::oneshot::error::TryRecvError::Closed)
+        );
+        let mut applied = false;
+        assert!(with_page_owner(&state, &label, &identity, || {
+            applied = true;
+            Ok(())
+        })
+        .is_err());
+        assert!(!applied);
+        // Reopening the same logical page cannot revive a request from its old instance.
+        let (_, mut replacement) = registered_test_page(&state);
+        state
+            .owners
+            .lock()
+            .unwrap()
+            .get_mut(&label)
+            .unwrap()
+            .generation = 2;
+        assert!(with_page_owner(&state, &label, &identity, || Ok(())).is_err());
+        replacement.generation = 2;
+        assert!(with_page_owner(&state, &label, &replacement, || Ok(())).is_ok());
+    }
+
+    #[test]
+    fn workspace_close_revokes_a_page_created_from_an_older_workspace_epoch() {
+        let state = WebPageHostState::default();
+        let (label, identity) = registered_test_page(&state);
+        state
+            .workspace_generations
+            .lock()
+            .unwrap()
+            .insert(workspace_label_suffix("main", "a"), 1);
+        assert!(with_page_owner(&state, &label, &identity, || Ok(())).is_err());
+        state
+            .owners
+            .lock()
+            .unwrap()
+            .get_mut(&label)
+            .unwrap()
+            .workspace_generation = 1;
+        assert!(with_page_owner(&state, &label, &identity, || Ok(())).is_ok());
+    }
+}
diff --git a/windows/tauri/src-tauri/src/plugin_host/web_network.rs b/windows/tauri/src-tauri/src/plugin_host/web_network.rs
new file mode 100644
index 0000000000..a9783c46a1
--- /dev/null
+++ b/windows/tauri/src-tauri/src/plugin_host/web_network.rs
@@ -0,0 +1,114 @@
+//! WebView2 request boundary installed before a plugin document can execute.
+//!
+//! NavigationStarting prevents document commit but can arrive after a network
+//! request has started. WebResourceRequested completes foreign requests locally
+//! instead, so cancelling navigation cannot leak page state in a request URL.
+
+use std::time::Duration;
+use tauri::WebviewWindow;
+use webview2_com::{Microsoft::Web::WebView2::Win32::*, WebResourceRequestedEventHandler};
+use windows::{
+    core::{w, PWSTR},
+    Win32::System::Com::CoTaskMemFree,
+};
+
+fn request_is_allowed(raw: &str, plugin_id: &str) -> bool {
+    let Ok(url) = url::Url::parse(raw) else {
+        return false;
+    };
+    super::is_package_url(&url, plugin_id)
+        || url.scheme() == "data"
+        || (url.scheme() == "http"
+            && url.host_str() == Some("ipc.localhost")
+            && url.port().is_none()
+            && url.username().is_empty()
+            && url.password().is_none())
+}
+
+pub(super) async fn restrict_requests(
+    view: &WebviewWindow,
+    plugin_id: String,
+) -> Result<(), String> {
+    let (sender, receiver) = tokio::sync::oneshot::channel();
+    view.with_webview(move |platform| {
+        // SAFETY: Tauri runs this closure on the controller's UI thread. All
+        // interfaces remain on that thread; the view owns the event subscription.
+        let result =
+            unsafe { install_filter(platform, plugin_id).map_err(|error| error.to_string()) };
+        let _ = sender.send(result);
+    })
+    .map_err(|error| error.to_string())?;
+    tokio::time::timeout(Duration::from_secs(5), receiver)
+        .await
+        .map_err(|_| "plugin page request-filter setup timed out".to_string())?
+        .map_err(|_| "plugin page request-filter setup was cancelled".to_string())?
+}
+
+unsafe fn install_filter(
+    platform: tauri::webview::PlatformWebview,
+    plugin_id: String,
+) -> windows::core::Result<()> {
+    let core = platform.controller().CoreWebView2()?;
+    let environment = platform.environment();
+    core.AddWebResourceRequestedFilter(w!("*"), COREWEBVIEW2_WEB_RESOURCE_CONTEXT_ALL)?;
+    let mut token = 0;
+    core.add_WebResourceRequested(
+        &WebResourceRequestedEventHandler::create(Box::new(move |_, args| {
+            let Some(args) = args else {
+                return Ok(());
+            };
+            let request = args.Request()?;
+            let mut uri = PWSTR::null();
+            request.Uri(&mut uri)?;
+            // WebView2 allocates this string with CoTaskMemAlloc. Free it even if
+            // URL decoding fails; no request URI is retained in a diagnostic.
+            let raw = if uri.0.is_null() {
+                None
+            } else {
+                uri.to_string().ok()
+            };
+            CoTaskMemFree(Some(uri.0.cast()));
+            if !raw
+                .as_deref()
+                .is_some_and(|value| request_is_allowed(value, &plugin_id))
+            {
+                let response = environment.CreateWebResourceResponse(
+                    None,
+                    403,
+                    w!("Forbidden"),
+                    w!("Content-Type: text/plain\r\nCache-Control: no-store"),
+                )?;
+                args.SetResponse(&response)?;
+            }
+            Ok(())
+        })),
+        &mut token,
+    )?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_package_assets_and_native_ipc_can_reach_the_request_layer() {
+        for allowed in [
+            "http://lithe-plugin.acme.php/ui/index.html",
+            "http://ipc.localhost/",
+            "data:image/png;base64,AA==",
+        ] {
+            assert!(request_is_allowed(allowed, "acme.php"), "{allowed}");
+        }
+        for refused in [
+            "https://example.test/",
+            "http://127.0.0.1/foreign",
+            "http://lithe-plugin.other/ui/index.html",
+            "http://user@ipc.localhost/",
+            "http://ipc.localhost:1234/",
+            "file:///outside.txt",
+        ] {
+            assert!(!request_is_allowed(refused, "acme.php"), "{refused}");
+        }
+    }
+}
diff --git a/windows/tauri/src-tauri/tauri.conf.json b/windows/tauri/src-tauri/tauri.conf.json
index e778f7a5ba..213f72e957 100644
--- a/windows/tauri/src-tauri/tauri.conf.json
+++ b/windows/tauri/src-tauri/tauri.conf.json
@@ -11,7 +11,7 @@
   },
   "app": {
     "security": {
-      "capabilities": ["main-capability"],
+      "capabilities": ["main-capability", "plugin-web-capability"],
       "assetProtocol": {
         "enable": true,
         "scope": ["**"]
@@ -23,6 +23,7 @@
     "targets": ["nsis", "msi"],
     "resources": {
       "../src/extensions/bundled/**/*": "extensions/bundled/",
+      "../../../Plugins/win/Official/PhpSupportContract/**/*": "OfficialPlugins/PhpSupportContract/",
       "helpers/": "helpers/"
     },
     "icon": ["icons/32x32.png", "icons/128x128.png", "icons/icon.ico"]
diff --git a/windows/tauri/src/extensions/ui/types/ui-extension.ts b/windows/tauri/src/extensions/ui/types/ui-extension.ts
index 64ff97da3e..d2469aad5c 100644
--- a/windows/tauri/src/extensions/ui/types/ui-extension.ts
+++ b/windows/tauri/src/extensions/ui/types/ui-extension.ts
@@ -30,6 +30,7 @@ export interface RegisteredToolbarAction {
 }
 
 export interface RegisteredCommand {
+  placements?: string[];
   id: string;
   extensionId: string;
   title: string;
diff --git a/windows/tauri/src/features/bootstrap/bootstrap-async.ts b/windows/tauri/src/features/bootstrap/bootstrap-async.ts
index dde79e2ac7..419f96e297 100644
--- a/windows/tauri/src/features/bootstrap/bootstrap-async.ts
+++ b/windows/tauri/src/features/bootstrap/bootstrap-async.ts
@@ -42,6 +42,18 @@ const asyncBootstrapSteps = [
       await initializeExtensionStore();
     },
   },
+  {
+    name: "declarative plugins",
+    run: async () => {
+      const { rescanDeclarativePlugins } =
+        await import("@/features/plugins/declarative-plugin-launch");
+      const { initializePluginWebListeners } = await import("@/features/plugins/plugin-web-open-file");
+      await initializePluginWebListeners();
+      await rescanDeclarativePlugins();
+      const { refreshDeclarativeUI } = await import("@/features/plugins/declarative-plugin-ui");
+      await refreshDeclarativeUI();
+    },
+  },
 ] as const;
 
 export async function runAsyncBootstrapSteps(): Promise<void> {
diff --git a/windows/tauri/src/features/command-palette/components/command-palette.tsx b/windows/tauri/src/features/command-palette/components/command-palette.tsx
index fdc039f9b3..df1f45da22 100644
--- a/windows/tauri/src/features/command-palette/components/command-palette.tsx
+++ b/windows/tauri/src/features/command-palette/components/command-palette.tsx
@@ -1,3 +1,4 @@
+import { useUIExtensionStore } from "@/extensions/ui/stores/ui-extension-store";
 import { appDataDir } from "@tauri-apps/api/path";
 import { getCurrentWindow } from "@tauri-apps/api/window";
 import { ClockCounterClockwiseIcon as History } from "@/ui/icons";
@@ -68,6 +69,7 @@ interface CommandPaletteContentProps {
 
 const CommandPaletteContent = ({ commandPaletteInitialView }: CommandPaletteContentProps) => {
   const { t } = useTranslation();
+  const pluginCommands = useUIExtensionStore((state) => state.commands);
   // Get data from stores
   const setIsCommandPaletteVisible = useUIState((state) => state.setIsCommandPaletteVisible);
   const setIsSettingsDialogVisible = useUIState((state) => state.setIsSettingsDialogVisible);
@@ -388,7 +390,12 @@ const CommandPaletteContent = ({ commandPaletteInitialView }: CommandPaletteCont
       onClose,
     }),
   ];
-  const allActions = rawActions.map((action) => localizeCommandPaletteAction(action, t));
+  const allActions: Action[] = [
+    ...rawActions.map((action) => localizeCommandPaletteAction(action, t)),
+    ...[...pluginCommands.values()].filter((command) => command.extensionId.startsWith("declarative:") && command.placements?.includes("commandPalette"))
+      .map((command) => ({ id: command.id, label: command.title, description: command.category ?? "", category: "plugins", icon: null,
+        action: async () => { onClose(); await command.execute(); } })),
+  ];
 
   // Filter actions based on query
   const filteredActions = allActions.filter(
diff --git a/windows/tauri/src/features/editor/lsp/lsp-client.ts b/windows/tauri/src/features/editor/lsp/lsp-client.ts
index b0d1fd59a8..efbe5d738a 100644
--- a/windows/tauri/src/features/editor/lsp/lsp-client.ts
+++ b/windows/tauri/src/features/editor/lsp/lsp-client.ts
@@ -778,8 +778,10 @@ export class LspClient {
           serverArgs: launch.serverArgs,
           languageId: launch.languageId,
           providerId: launch.providerId,
+          pluginId: launch.pluginId,
           tools: launch.tools || null,
           initializationOptions: launch.initializationOptions || null,
+          workspaceConfiguration: launch.workspaceConfiguration || null,
           runtimeExecutablePath: launch.runtimeExecutablePath || null,
           jdtlsLaunchResources: launch.jdtlsLaunchResources || null,
           cacheDirectory: launch.cacheDirectory || null,
@@ -1019,8 +1021,10 @@ export class LspClient {
           serverArgs: launch.serverArgs,
           languageId,
           providerId: launch.providerId,
+          pluginId: launch.pluginId,
           tools: launch.tools || null,
           initializationOptions: launch.initializationOptions || null,
+          workspaceConfiguration: launch.workspaceConfiguration || null,
           runtimeExecutablePath: launch.runtimeExecutablePath || null,
           jdtlsLaunchResources: launch.jdtlsLaunchResources || null,
           cacheDirectory: launch.cacheDirectory || null,
diff --git a/windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.test.ts b/windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.test.ts
index a9d34c45dd..d96c4ac0fb 100644
--- a/windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.test.ts
+++ b/windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.test.ts
@@ -36,6 +36,7 @@ test("resolves workspace A Maven context while workspace B is active", async ()
       resolveJavaLspLaunch,
       mavenLaunchContextForWorkspace,
       ensureWorkspaceGitBootstrap: async () => "skipped",
+      resolveDeclarativePluginLaunch: async () => null,
     },
   );
 
@@ -70,6 +71,7 @@ test("forwards the declared Gradle import context to the launch", async () => {
       })),
       mavenLaunchContextForWorkspace,
       ensureWorkspaceGitBootstrap: async () => "skipped",
+      resolveDeclarativePluginLaunch: async () => null,
     },
   );
 
@@ -84,8 +86,61 @@ test("omits the Gradle import context for a workspace without one", async () =>
       resolveJavaLspLaunch,
       mavenLaunchContextForWorkspace,
       ensureWorkspaceGitBootstrap: async () => "skipped",
+      resolveDeclarativePluginLaunch: async () => null,
     },
   );
 
   expect(launch?.javaGradle).toBeNull();
 });
+
+test("falls back to a declarative plugin launch when the registry has no server", async () => {
+  const resolveDeclarativePluginLaunch = mock(async () => ({
+    pluginId: "dev.lithe.plugin.php-support",
+    languageId: "php",
+    serverPath: "C:/Users/example/AppData/Local/Lithe/plugins/dev.lithe.plugin.php-support/1.0.0/language-server/bin/intelephense.js",
+    serverArgs: ["--stdio"],
+    initializationOptions: { memory: 4096 },
+    workspaceConfiguration: { php: { format: true } },
+    environment: { LITHE_NODE_PATH: "C:/Lithe/tools/node/node.exe" },
+  }));
+  const launch = await resolveEditorLspLaunch(
+    "D:/work/src/Index.php",
+    { workspaceId: "workspace-a", root: "D:/work" },
+    {
+      resolveJavaLspLaunch,
+      mavenLaunchContextForWorkspace,
+      ensureWorkspaceGitBootstrap: async () => "skipped",
+      resolveDeclarativePluginLaunch,
+    },
+  );
+
+  expect(resolveDeclarativePluginLaunch).toHaveBeenCalledWith(
+    "D:/work/src/Index.php",
+    "D:/work",
+  );
+  expect(launch).toEqual({
+    providerId: "dev.lithe.plugin.php-support",
+    pluginId: "dev.lithe.plugin.php-support",
+    languageId: "php",
+    serverPath: "C:/Users/example/AppData/Local/Lithe/plugins/dev.lithe.plugin.php-support/1.0.0/language-server/bin/intelephense.js",
+    serverArgs: ["--stdio"],
+    initializationOptions: { memory: 4096 },
+    workspaceConfiguration: { php: { format: true } },
+    environment: { LITHE_NODE_PATH: "C:/Lithe/tools/node/node.exe" },
+  });
+});
+
+test("returns null when neither the registry nor a declarative plugin owns the file", async () => {
+  const launch = await resolveEditorLspLaunch(
+    "D:/work/src/notes.txt",
+    { workspaceId: "workspace-a", root: "D:/work" },
+    {
+      resolveJavaLspLaunch,
+      mavenLaunchContextForWorkspace,
+      ensureWorkspaceGitBootstrap: async () => "skipped",
+      resolveDeclarativePluginLaunch: async () => null,
+    },
+  );
+
+  expect(launch).toBeNull();
+});
diff --git a/windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.ts b/windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.ts
index 6c98870c75..8be6386551 100644
--- a/windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.ts
+++ b/windows/tauri/src/features/editor/lsp/resolve-editor-lsp-launch.ts
@@ -1,4 +1,5 @@
 import type { BackendLanguageToolConfigSet } from "@/extensions/registry/extension-store-runtime";
+import { resolveDeclarativePluginLaunch } from "@/features/plugins/declarative-plugin-launch";
 import { isJavaSourcePath, JAVA_LANGUAGE_ID, JAVA_PROVIDER_ID } from "./built-in-language-support";
 import {
   resolveJavaLspLaunch,
@@ -14,10 +15,12 @@ import { ensureWorkspaceGitBootstrap } from "@/features/workspace/services/works
 
 export interface EditorLspLaunch {
   providerId: string;
+  pluginId?: string;
   languageId: string;
   serverPath: string;
   serverArgs: string[];
   initializationOptions?: Record<string, unknown>;
+  workspaceConfiguration?: Record<string, unknown>;
   tools?: BackendLanguageToolConfigSet;
   runtimeExecutablePath?: string | null;
   jdtlsLaunchResources?: JdtlsLaunchResources | null;
@@ -35,12 +38,14 @@ export interface EditorLspLaunchDependencies {
   ensureWorkspaceGitBootstrap: typeof ensureWorkspaceGitBootstrap;
   resolveJavaLspLaunch: typeof resolveJavaLspLaunch;
   mavenLaunchContextForWorkspace: typeof mavenLaunchContextForWorkspace;
+  resolveDeclarativePluginLaunch: typeof resolveDeclarativePluginLaunch;
 }
 
 const defaultDependencies: EditorLspLaunchDependencies = {
   ensureWorkspaceGitBootstrap,
   resolveJavaLspLaunch,
   mavenLaunchContextForWorkspace,
+  resolveDeclarativePluginLaunch,
 };
 
 export async function resolveEditorLspLaunch(
@@ -88,7 +93,9 @@ export async function resolveEditorLspLaunch(
   const extension = extensionRegistry.getExtensionForFilePath(filePath);
   const serverPath = extensionRegistry.getLspServerPath(filePath);
   const languageId = extensionRegistry.getLanguageId(filePath);
-  if (!serverPath || !languageId) return null;
+  if (!serverPath || !languageId) {
+    return resolveDeclarativeFallback(filePath, workspacePath, dependencies);
+  }
 
   return {
     providerId: languageId,
@@ -99,3 +106,26 @@ export async function resolveEditorLspLaunch(
     tools: getLanguageToolConfigSet(extension?.manifest),
   };
 }
+
+/**
+ * Contract v1 declarative plugins resolve after the Worker extension model so
+ * a Worker-owned language keeps its server until the package migration lands.
+ */
+async function resolveDeclarativeFallback(
+  filePath: string,
+  workspacePath: string,
+  dependencies: EditorLspLaunchDependencies,
+): Promise<EditorLspLaunch | null> {
+  const launch = await dependencies.resolveDeclarativePluginLaunch(filePath, workspacePath);
+  if (!launch) return null;
+  return {
+    providerId: launch.pluginId,
+    pluginId: launch.pluginId,
+    languageId: launch.languageId,
+    serverPath: launch.serverPath,
+    serverArgs: launch.serverArgs,
+    initializationOptions: launch.initializationOptions ?? undefined,
+    workspaceConfiguration: launch.workspaceConfiguration ?? undefined,
+    environment: launch.environment,
+  };
+}
diff --git a/windows/tauri/src/features/layout/components/bottom-pane/bottom-pane-terminal-lifecycle.test.tsx b/windows/tauri/src/features/layout/components/bottom-pane/bottom-pane-terminal-lifecycle.test.tsx
index 71a7344674..2294d8d0d3 100644
--- a/windows/tauri/src/features/layout/components/bottom-pane/bottom-pane-terminal-lifecycle.test.tsx
+++ b/windows/tauri/src/features/layout/components/bottom-pane/bottom-pane-terminal-lifecycle.test.tsx
@@ -129,6 +129,13 @@ mock.module("@/features/agent/components/agent-trigger", () => ({ AgentTrigger:
 mock.module("@/features/notifications/components/notifications-trigger", () => ({
   NotificationsTrigger: () => null,
 }));
+// Keep the real activity rail without starting the unrelated native plugin host.
+mock.module("@/features/plugins/declarative-plugin-ui", () => ({
+  useDeclarativePluginUI: create(() => ({ windows: [] })),
+}));
+mock.module("@/features/plugins/declarative-plugin-launch", () => ({
+  openDeclarativeWebWindow: async () => {},
+}));
 mock.module("@/features/panes/stores/pane.store", () => ({
   usePaneStore: {
     use: { bottomRoot: () => null, actions: () => ({ moveBufferToPane: () => {} }) },
diff --git a/windows/tauri/src/features/layout/components/plugin-activity-rail.tsx b/windows/tauri/src/features/layout/components/plugin-activity-rail.tsx
index 5b8380ff2e..08c97e1c6a 100644
--- a/windows/tauri/src/features/layout/components/plugin-activity-rail.tsx
+++ b/windows/tauri/src/features/layout/components/plugin-activity-rail.tsx
@@ -1,3 +1,5 @@
+import { useDeclarativePluginUI } from "@/features/plugins/declarative-plugin-ui";
+import { openDeclarativeWebWindow } from "@/features/plugins/declarative-plugin-launch";
 import { useBufferStore } from "@/features/editor/stores/buffer.store";
 import { AgentTrigger } from "@/features/agent/components/agent-trigger";
 import {
@@ -20,6 +22,7 @@ const STRIPE_BUTTON_CLASS_NAME = "size-[30px] rounded-[6px]";
 
 export function PluginActivityRail() {
   const { t } = useTranslation();
+  const pluginWindows = useDeclarativePluginUI((state) => state.windows);
   const terminalDock = useTerminalDock();
   const terminalEnabled = useSettingsStore((state) => state.settings.coreFeatures.terminal);
   const terminalHidden = useSettingsStore((state) =>
@@ -76,6 +79,13 @@ export function PluginActivityRail() {
       >
         <PuzzlePieceIcon className="size-5" />
       </Button>
+      {pluginWindows.map((window) => (
+        <Button key={`${window.pluginId}:${window.windowId}`} variant="ghost" size="icon-sm"
+          className={STRIPE_BUTTON_CLASS_NAME} tooltip={window.title} aria-label={window.title}
+          onClick={() => { void openDeclarativeWebWindow(window.pluginId, window.windowId).catch(console.error); }}>
+          <PuzzlePieceIcon className="size-5" />
+        </Button>
+      ))}
       <NotificationsTrigger className={STRIPE_BUTTON_CLASS_NAME} />
       <AgentTrigger className={STRIPE_BUTTON_CLASS_NAME} />
       {isMavenAvailable ? (
diff --git a/windows/tauri/src/features/plugins/declarative-plugin-launch.ts b/windows/tauri/src/features/plugins/declarative-plugin-launch.ts
new file mode 100644
index 0000000000..a22f44d851
--- /dev/null
+++ b/windows/tauri/src/features/plugins/declarative-plugin-launch.ts
@@ -0,0 +1,294 @@
+import { workspaceRuntimeRegistry } from "@/features/workspace/runtime/workspace-runtime-registry";
+import { useFileSystemStore } from "@/features/file-system/stores/file-system.store";
+import { pluginPlanGuard } from "./declarative-plugin-lifecycle";
+import { invoke } from "@/platform/tauri-core";
+import { getPluginWebAppearance } from "./plugin-web-appearance";
+
+/**
+ * Host API for contract v1 declarative plugin packages. The Rust
+ * `plugin_host` module owns package storage and scanning; these wrappers are
+ * the only frontend entry points. Decisions about the declarative host and
+ * its coexistence with the Worker extension model are recorded in
+ * .agents/notes/implemented/architecture/2026-10-22-windows-declarative-plugin-host.md
+ */
+
+export interface DeclarativePluginLanguage {
+  id: string;
+  displayName: string;
+  fileExtensions: string[];
+  fileNames: string[];
+}
+
+export interface DeclarativePluginRejection {
+  code: string;
+  message: string;
+  path: string | null;
+}
+
+export interface DeclarativePluginSummary {
+  pluginId: string;
+  displayName: string;
+  version: string;
+  apiVersion: number;
+  /** `bundled` packages ship with the app; `installed` live in the user store. */
+  source: "bundled" | "installed";
+  enabled: boolean;
+  /** `rejected` packages are quarantined and never own a language. */
+  status: "accepted" | "rejected";
+  languages: DeclarativePluginLanguage[];
+  declaredSettings: DeclarativePluginSetting[];
+  declaresTests: boolean;
+  primaryLanguageId: string | null;
+  rejection: DeclarativePluginRejection | null;
+}
+
+export interface DeclarativePluginSetting {
+  id: string;
+  type: "integer" | "enum" | "boolean" | "multiSelect" | "text" | "file" | "directory";
+  title: string;
+  description?: string | null;
+  default: unknown;
+  minimum?: number | null;
+  maximum?: number | null;
+  unit?: string | null;
+  options?: Array<{ value: string; title: string }> | null;
+  scope?: "global" | "project" | null;
+  effect?: "restart" | "immediate" | "reload" | "nextRun" | null;
+}
+
+export interface DeclarativePluginLaunch {
+  pluginId: string;
+  languageId: string;
+  serverPath: string;
+  serverArgs: string[];
+  initializationOptions: Record<string, unknown> | null;
+  workspaceConfiguration: Record<string, unknown> | null;
+  environment: Record<string, string>;
+}
+
+/** Rescans bundled and installed packages; call at startup and after installs. */
+export function rescanDeclarativePlugins(): Promise<number> {
+  return invoke<number>("declarative_plugins_rescan");
+}
+
+/** Returns the cached scan result; call `rescanDeclarativePlugins` first. */
+export function listDeclarativePlugins(): Promise<DeclarativePluginSummary[]> {
+  return invoke<DeclarativePluginSummary[]>("declarative_plugins_state");
+}
+
+/**
+ * Resolves the launch of the enabled plugin that owns `filePath`, or `null`
+ * when no accepted declarative plugin claims the file.
+ */
+export async function resolveDeclarativePluginLaunch(
+  filePath: string,
+  workspacePath: string,
+): Promise<DeclarativePluginLaunch | null> {
+  const guard = pluginPlanGuard();
+  const launch = await invoke<DeclarativePluginLaunch | null>("declarative_plugins_language_launch", {
+    filePath,
+    workspacePath,
+  });
+  if (launch) guard(launch.pluginId);
+  return launch;
+}
+
+/** Core's install review for one prepared package. */
+export interface DeclarativePluginInstallReview {
+  pluginId: string;
+  version: string;
+  permissions: string[];
+  /** Full canonical program declarations, including arguments and templates. */
+  programs: unknown[];
+  newPrograms: unknown[];
+}
+
+/** A prepared disk import awaiting user confirmation. */
+export interface PreparedDeclarativeInstall {
+  sessionId: string;
+  review: DeclarativePluginInstallReview;
+  /** Digest the confirm call must present to prove the package is unchanged. */
+  manifestDigest: string;
+  displayName: string;
+}
+
+/** Prepares a disk import from a .zip archive or unpacked package directory. */
+export function prepareDeclarativeDiskInstall(
+  sourcePath: string,
+): Promise<PreparedDeclarativeInstall> {
+  return invoke<PreparedDeclarativeInstall>("declarative_plugins_prepare_disk_install", {
+    sourcePath,
+  });
+}
+
+/** Installs a confirmed snapshot; rejects when the package changed after review. */
+export function confirmDeclarativeDiskInstall(
+  sessionId: string,
+  manifestDigest: string,
+): Promise<DeclarativePluginSummary> {
+  return invoke<DeclarativePluginSummary>("declarative_plugins_confirm_disk_install", {
+    sessionId,
+    manifestDigest,
+  });
+}
+
+export function cancelDeclarativeDiskInstall(sessionId: string): Promise<void> {
+  return invoke<void>("declarative_plugins_cancel_disk_install", { sessionId });
+}
+
+/** Removes an installed package and its state directory. */
+export function uninstallDeclarativePlugin(pluginId: string): Promise<void> {
+  return invoke<void>("declarative_plugins_uninstall", { pluginId });
+}
+
+/** Enables or disables an installed package; bundled packages reject this. */
+export function setDeclarativePluginEnabled(pluginId: string, enabled: boolean): Promise<void> {
+  return invoke<void>("declarative_plugins_set_enabled", { pluginId, enabled });
+}
+
+/** Restores the highest retained previous version of an installed package. */
+export function rollbackDeclarativePlugin(pluginId: string): Promise<void> {
+  return invoke<void>("declarative_plugins_rollback", { pluginId });
+}
+
+/** One declared setting, as Core normalizes it (settings capability v2). */
+export interface DeclarativePluginSetting {
+  id: string;
+  type: "integer" | "enum" | "boolean" | "multiSelect" | "text" | "file" | "directory";
+  title: string;
+  description?: string | null;
+  default: unknown;
+  minimum?: number | null;
+  maximum?: number | null;
+  unit?: string | null;
+  options?: Array<{ value: string; title: string }> | null;
+  scope?: "global" | "project" | null;
+  effect?: "restart" | "immediate" | "reload" | "nextRun" | null;
+  section?: { languageID?: string; buildSystemID?: string } | null;
+}
+
+/** Effective value of one setting and the layer it came from. */
+export interface ResolvedDeclarativeSetting {
+  id: string;
+  value: unknown;
+  source: "default" | "global" | "project";
+}
+
+/** Effective values of one plugin's settings for one workspace. */
+export function resolveDeclarativeSettings(
+  manifest: Record<string, unknown>,
+  workspacePath: string,
+): Promise<{ status: string; settings?: ResolvedDeclarativeSetting[] }> {
+  return invoke("declarative_plugins_resolve_settings", { manifest, workspacePath });
+}
+
+/** Stores a setting value in the requested layer; `null` erases it. */
+export function storeDeclarativeSetting(
+  pluginId: string,
+  settingId: string,
+  scope: "global" | "project",
+  workspacePath: string,
+  value: unknown,
+): Promise<void> {
+  return invoke("declarative_plugins_store_setting", {
+    pluginId,
+    settingId,
+    scope,
+    workspacePath,
+    value,
+  });
+}
+
+/** A running server's workspace configuration expanded with current values. */
+export function declarativeWorkspaceConfiguration(
+  manifest: Record<string, unknown>,
+  languageId: string,
+  workspacePath: string,
+): Promise<{ status: string; configuration?: unknown }> {
+  return invoke("declarative_plugins_workspace_configuration", {
+    manifest,
+    languageId,
+    workspacePath,
+  });
+}
+
+/** An expanded run or test plan ready for the shared run pipeline. */
+export interface DeclarativeRunPlan {
+  pluginId: string;
+  languageId: string;
+  executable: { command?: string | null; tool?: string | null };
+  arguments: string[];
+  workingDirectory: string;
+}
+
+/** Expands the run template for one file of a plugin-owned language. */
+export function resolveDeclarativeRunPlan(
+  pluginId: string,
+  languageId: string,
+  relativeFilePath: string,
+  userArguments: string[] = [],
+): Promise<DeclarativeRunPlan> {
+  return invoke<DeclarativeRunPlan>("declarative_plugins_run_plan", {
+    pluginId,
+    languageId,
+    relativeFilePath,
+    userArguments,
+  });
+}
+
+/** Expands the workspace test template for a plugin-owned language. */
+export function resolveDeclarativeTestPlan(
+  pluginId: string,
+  languageId: string,
+  workspacePath: string,
+): Promise<DeclarativeRunPlan> {
+  return invoke<DeclarativeRunPlan>("declarative_plugins_test_plan", {
+    pluginId,
+    languageId,
+    workspacePath,
+  });
+}
+
+/** One host-rendered text or web tool window (ui capabilities 1 and 2). */
+export interface DeclarativeWebToolWindow {
+  windowId: string;
+  pluginId: string;
+  title: string;
+  placement: string;
+  order: number | null;
+  entry: string;
+}
+
+/** Declared web tool windows of all accepted, enabled packages. */
+export function listDeclarativeWebWindows(): Promise<DeclarativeWebToolWindow[]> {
+  return invoke<DeclarativeWebToolWindow[]>("declarative_plugins_web_windows");
+}
+
+/** Opens (or focuses) the web view of one tool window. */
+export function openDeclarativeWebWindow(pluginId: string, windowId: string): Promise<void> {
+  return invoke<void>("declarative_plugins_open_web_window", {
+    pluginId, windowId, workspaceId: workspaceRuntimeRegistry.getActiveWorkspaceId(),
+    workspacePath: useFileSystemStore.getState().rootFolderPath, appearance: getPluginWebAppearance(),
+  });
+}
+
+/** Destroys the web view of one tool window. */
+export function closeDeclarativeWebWindow(pluginId: string, windowId: string): Promise<void> {
+  return invoke<void>("declarative_plugins_close_web_window", { pluginId, windowId, workspaceId: workspaceRuntimeRegistry.getActiveWorkspaceId() });
+}
+
+/** Returns the raw manifest of one accepted declarative plugin. */
+export function getDeclarativePluginManifest(
+  pluginId: string,
+): Promise<Record<string, unknown> | null> {
+  return invoke<Record<string, unknown> | null>("declarative_plugins_manifest", { pluginId });
+}
+
+/** The enabled declarative plugin that owns a file, or null. */
+export function invokeDeclarativePluginOwner(filePath: string): Promise<{
+  pluginId: string;
+  displayName: string;
+  languageId: string;
+} | null> {
+  return invoke("declarative_plugins_language_owner", { filePath });
+}
diff --git a/windows/tauri/src/features/plugins/declarative-plugin-lifecycle.test.ts b/windows/tauri/src/features/plugins/declarative-plugin-lifecycle.test.ts
new file mode 100644
index 0000000000..55f82a435b
--- /dev/null
+++ b/windows/tauri/src/features/plugins/declarative-plugin-lifecycle.test.ts
@@ -0,0 +1,21 @@
+import { expect, test } from "bun:test";
+import {
+  assertPluginActive,
+  pluginPlanGuard,
+  setPluginActive,
+} from "./declarative-plugin-lifecycle";
+
+test("revocation rejects old plans and new launches until the plugin resumes", () => {
+  const id = "test.plugin";
+  const oldPlan = pluginPlanGuard();
+  setPluginActive(id, false);
+  try {
+    expect(() => assertPluginActive(id)).toThrow("inactive");
+    expect(() => oldPlan(id)).toThrow();
+    setPluginActive(id, true);
+    expect(() => oldPlan(id)).toThrow("superseded");
+    expect(() => pluginPlanGuard()(id)).not.toThrow();
+  } finally {
+    setPluginActive(id, true);
+  }
+});
diff --git a/windows/tauri/src/features/plugins/declarative-plugin-lifecycle.ts b/windows/tauri/src/features/plugins/declarative-plugin-lifecycle.ts
new file mode 100644
index 0000000000..d4b9c2341b
--- /dev/null
+++ b/windows/tauri/src/features/plugins/declarative-plugin-lifecycle.ts
@@ -0,0 +1,23 @@
+/** Per-window revocation, set synchronously before draining owned processes. */
+const blocked = new Set<string>();
+const revisions = new Map<string, number>();
+
+export function setPluginActive(pluginId: string, active: boolean): void {
+  revisions.set(pluginId, (revisions.get(pluginId) ?? 0) + 1);
+  if (active) blocked.delete(pluginId);
+  else blocked.add(pluginId);
+}
+
+export function assertPluginActive(pluginId: string): void {
+  if (blocked.has(pluginId)) throw new Error(`Plugin ${pluginId} is inactive or changing version.`);
+}
+
+/** Discard native plans resolved across any plugin catalog mutation. */
+export function pluginPlanGuard(): (pluginId: string) => void {
+  const startedAt = new Map(revisions);
+  return (pluginId) => {
+    assertPluginActive(pluginId);
+    if ((startedAt.get(pluginId) ?? 0) !== (revisions.get(pluginId) ?? 0))
+      throw new Error("Plugin launch plan was superseded.");
+  };
+}
diff --git a/windows/tauri/src/features/plugins/declarative-plugin-process-owner.ts b/windows/tauri/src/features/plugins/declarative-plugin-process-owner.ts
new file mode 100644
index 0000000000..8d369331ca
--- /dev/null
+++ b/windows/tauri/src/features/plugins/declarative-plugin-process-owner.ts
@@ -0,0 +1,8 @@
+import { ExtensionProcessOwner } from "@/extensions/run/extension-process-owner";
+
+/**
+ * Process ownership for contract v1 plugin runs. The lifecycle rules are the
+ * Worker extension model's (stop on disable/uninstall/workspace close), so
+ * the same owner class is reused with a plugin-ID key.
+ */
+export const declarativePluginProcessOwner = new ExtensionProcessOwner();
diff --git a/windows/tauri/src/features/plugins/declarative-plugin-run.test.ts b/windows/tauri/src/features/plugins/declarative-plugin-run.test.ts
new file mode 100644
index 0000000000..7a373754cc
--- /dev/null
+++ b/windows/tauri/src/features/plugins/declarative-plugin-run.test.ts
@@ -0,0 +1,44 @@
+import { expect, mock, test } from "bun:test";
+
+const owner = mock(async () => ({
+  pluginId: "dev.lithe.plugin.php-support",
+  displayName: "PHP Support",
+  languageId: "php",
+}));
+const manifest = mock(async () => ({
+  executionProviders: [{ languageID: "php", run: {}, test: { projectMarkers: ["composer.json"] } }],
+}));
+const runPlan = mock(async () => { throw new Error("run plan must not be used for a test"); });
+const testPlan = mock(async () => { throw new Error("unsupported test project"); });
+const actualLaunch = await import("./declarative-plugin-launch");
+
+mock.module("./declarative-plugin-launch", () => ({
+  ...actualLaunch,
+  invokeDeclarativePluginOwner: owner,
+  getDeclarativePluginManifest: manifest,
+  resolveDeclarativeRunPlan: runPlan,
+  resolveDeclarativeTestPlan: testPlan,
+}));
+
+const { declarativeRunActionsForFile, runDeclarativeAction } = await import("./declarative-plugin-run");
+
+test("discovers separate run and test actions for the owning language", async () => {
+  const actions = await declarativeRunActionsForFile("C:/work/tests/ItemTest.php");
+  expect(actions.map((action) => action.id)).toEqual([
+    "declarative:dev.lithe.plugin.php-support:php:run",
+    "declarative:dev.lithe.plugin.php-support:php:test",
+  ]);
+  expect(actions.map((action) => action.declarativeTest)).toEqual([false, true]);
+});
+
+test("a failed test plan never runs the file instead", async () => {
+  const actions = await declarativeRunActionsForFile("C:/work/tests/ItemTest.php");
+  await expect(runDeclarativeAction(
+    actions[1]!,
+    "workspace-1",
+    "C:/work",
+    "C:/work/tests/ItemTest.php",
+  )).rejects.toThrow("unsupported test project");
+  expect(testPlan).toHaveBeenCalledWith("dev.lithe.plugin.php-support", "php", "C:/work");
+  expect(runPlan).not.toHaveBeenCalled();
+});
diff --git a/windows/tauri/src/features/plugins/declarative-plugin-run.ts b/windows/tauri/src/features/plugins/declarative-plugin-run.ts
new file mode 100644
index 0000000000..a6c0e30c05
--- /dev/null
+++ b/windows/tauri/src/features/plugins/declarative-plugin-run.ts
@@ -0,0 +1,133 @@
+import { assertPluginActive, pluginPlanGuard } from "./declarative-plugin-lifecycle";
+import { saveWorkspaceBeforeLaunch } from "@/features/editor/services/save-workspace-before-launch";
+import { ensureRunProcessListeners } from "@/features/run/hooks/use-run-process-events";
+import { resolveRunLaunch, startRunProcess, stopRunProcess } from "@/features/run/api/run-host-api";
+import {
+  bindRunSessionWorkspace,
+  releaseRunSessionWorkspace,
+  useRunStore,
+} from "@/features/run/stores/run.store";
+import { useUIState } from "@/features/window/stores/ui-state.store";
+import { useSettingsStore } from "@/features/settings/stores/settings.store";
+import { createTranslator } from "@/i18n/locale";
+import type { RunActionItem } from "@/features/run-actions/types/run-action.types";
+import {
+  invokeDeclarativePluginOwner,
+  getDeclarativePluginManifest,
+  resolveDeclarativeRunPlan,
+  resolveDeclarativeTestPlan,
+} from "./declarative-plugin-launch";
+import { declarativePluginProcessOwner } from "./declarative-plugin-process-owner";
+
+/**
+ * Run actions for contract v1 plugins, mirroring the Worker extension run
+ * path: Core expands the declared template, the shared run pipeline resolves
+ * and starts the process, and the process owner tracks it per workspace and
+ * plugin so disabling or uninstalling stops its sessions. File ownership
+ * comes from the host's live catalog (`declarative_plugins_language_owner`),
+ * so there is no second catalog to drift.
+ */
+
+/** Run and test actions declared for the file's owning language. */
+export async function declarativeRunActionsForFile(
+  filePath: string,
+): Promise<RunActionItem[]> {
+  const owner = await invokeDeclarativePluginOwner(filePath);
+  if (!owner) return [];
+  const manifest = await getDeclarativePluginManifest(owner.pluginId);
+  const providers = Array.isArray(manifest?.executionProviders)
+    ? manifest.executionProviders as Array<Record<string, unknown>>
+    : [];
+  const provider = providers.find((item) => item.languageID === owner.languageId);
+  if (!provider) return [];
+  const t = createTranslator(useSettingsStore.getState().settings.displayLanguage);
+  return (["run", "test"] as const)
+    .filter((kind) => provider[kind] != null)
+    .map((kind) => ({
+      id: `declarative:${owner.pluginId}:${owner.languageId}:${kind}`,
+      name: `${t(`runActions.${kind}`)} ${owner.displayName}`,
+      description: owner.languageId,
+      source: "declarative" as const,
+      sourceLabel: owner.displayName,
+      declarativeOwner: { pluginId: owner.pluginId, languageId: owner.languageId },
+      declarativeTest: kind === "test",
+    }));
+}
+
+export async function runDeclarativeAction(
+  action: RunActionItem,
+  workspaceId: string,
+  root: string,
+  filePath: string,
+): Promise<void> {
+  const owner = action.declarativeOwner;
+  if (!owner) throw new Error("The action does not name a declarative plugin.");
+  assertPluginActive(owner.pluginId);
+  const guard = pluginPlanGuard();
+  const id = `declarative:${owner.pluginId}:${crypto.randomUUID()}`;
+  const store = useRunStore.getStore(workspaceId);
+  await declarativePluginProcessOwner.start(
+    id,
+    workspaceId,
+    owner.pluginId,
+    async () => {
+      const relative = toWorkspaceRelative(filePath, root);
+      const plan = action.declarativeTest
+        ? await resolveDeclarativeTestPlan(owner.pluginId, owner.languageId, root)
+        : await resolveDeclarativeRunPlan(owner.pluginId, owner.languageId, relative);
+      guard(owner.pluginId);
+      await ensureRunProcessListeners();
+      await saveWorkspaceBeforeLaunch(workspaceId);
+      const resolved = await resolveRunLaunch({
+        root,
+        executable: plan.executable,
+        workingDirectory: plan.workingDirectory,
+      });
+      guard(owner.pluginId);
+      bindRunSessionWorkspace(id, workspaceId);
+      store.setState((state) => ({
+        sessions: [
+          ...state.sessions,
+          {
+            id,
+            configurationId: id,
+            title: `${filePath} (declarative)`,
+            output: "",
+            isRunning: true,
+            exitCode: null,
+          },
+        ],
+        selectedSessionId: id,
+      }));
+      const ui = useUIState.getState();
+      ui.setBottomPaneActiveTab("run");
+      ui.setIsBottomPaneVisible(true);
+      try {
+        await startRunProcess({
+          sessionId: id,
+          executionId: id,
+          ...resolved,
+          arguments: plan.arguments,
+        });
+      } catch (error) {
+        store.getState().actions.finishProcess(id, 1);
+        releaseRunSessionWorkspace(id);
+        throw error;
+      }
+    },
+    async () => {
+      await stopRunProcess(id, id);
+      store.getState().actions.finishProcess(id, -1);
+      releaseRunSessionWorkspace(id);
+    },
+  );
+}
+
+function toWorkspaceRelative(filePath: string, root: string): string {
+  const normalized = filePath.replace(/\\/g, "/");
+  const normalizedRoot = root.replace(/\\/g, "/").replace(/\/$/, "");
+  if (normalized.toLowerCase().startsWith(`${normalizedRoot.toLowerCase()}/`)) {
+    return normalized.slice(normalizedRoot.length + 1);
+  }
+  return normalized;
+}
diff --git a/windows/tauri/src/features/plugins/declarative-plugin-settings-editor.tsx b/windows/tauri/src/features/plugins/declarative-plugin-settings-editor.tsx
new file mode 100644
index 0000000000..7293e2190a
--- /dev/null
+++ b/windows/tauri/src/features/plugins/declarative-plugin-settings-editor.tsx
@@ -0,0 +1,256 @@
+import { useCallback, useEffect, useState } from "react";
+import { useTranslation } from "@/i18n/locale-provider";
+import Switch from "@/ui/switch";
+import { Checkbox } from "@/ui/checkbox";
+import NumberInput from "@/ui/number-input";
+import SettingsSelect from "@/ui/settings-select";
+import { pushDeclarativeWorkspaceConfiguration } from "@/platform/lsp-core-adapter";
+import {
+  getDeclarativePluginManifest,
+  resolveDeclarativeSettings,
+  storeDeclarativeSetting,
+  declarativeWorkspaceConfiguration,
+  type DeclarativePluginSetting,
+  type ResolvedDeclarativeSetting,
+} from "./declarative-plugin-launch";
+
+/**
+ * Editor for one accepted plugin's declared settings. Value semantics live in
+ * Core (`plugins.declarative.resolveSettings`); this view only renders
+ * controls, applies the declared scope/effect, and reports "immediate"
+ * changes to a running server through `workspaceConfiguration`.
+ *
+ * The workspace path arrives when a workspace feature mounts the editor;
+ * without one, project-scoped settings fall back to the global layer and the
+ * scope badge says so.
+ */
+export function DeclarativePluginSettingsEditor({
+  pluginId,
+  settings,
+  workspacePath,
+  languageId,
+}: {
+  pluginId: string;
+  settings: DeclarativePluginSetting[];
+  workspacePath: string | null;
+  languageId: string | null;
+}) {
+  const { t } = useTranslation();
+  const [values, setValues] = useState<ResolvedDeclarativeSetting[]>([]);
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  // Core re-validates the whole manifest on every resolve call, so the
+  // editor must send the full raw manifest from the host catalog — not an
+  // ID placeholder.
+  const [manifest, setManifest] = useState<Record<string, unknown> | null>(null);
+
+  useEffect(() => {
+    getDeclarativePluginManifest(pluginId)
+      .then((loaded) => setManifest(loaded))
+      .catch((reason: unknown) => setError(String(reason)));
+  }, [pluginId]);
+
+  const refresh = useCallback(async () => {
+    setError(null);
+    if (!manifest) return;
+    try {
+      const outcome = await resolveDeclarativeSettings(manifest, workspacePath ?? "");
+      if (outcome.status !== "ok") {
+        setError(t("settings.declarativePlugins.settingsUnavailable"));
+        return;
+      }
+      setValues(outcome.settings ?? []);
+    } catch (reason) {
+      setError(String(reason));
+    }
+  }, [manifest, workspacePath, t]);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  const apply = async (setting: DeclarativePluginSetting, value: unknown) => {
+    setBusy(true);
+    setError(null);
+    try {
+      const scope = setting.scope === "project" && workspacePath ? "project" : "global";
+      // Only the global layer forgets values equal to the declaration default.
+      // A project layer must retain an explicit default to override a
+      // different global value; null means “inherit global” there.
+      const stored = scope === "global" && valuesEqual(value, setting.default) ? null : value;
+      await storeDeclarativeSetting(pluginId, setting.id, scope, workspacePath ?? "", stored);
+      await refresh();
+      if (setting.effect === "immediate" && languageId && manifest && workspacePath) {
+        // Expand the configuration from the stored values, then push it to
+        // the running language server through the LSP session.
+        const outcome = await declarativeWorkspaceConfiguration(
+          manifest,
+          languageId,
+          workspacePath,
+        );
+        if (outcome.status === "ok" && outcome.configuration !== null) {
+          await pushDeclarativeWorkspaceConfiguration({
+            pluginId,
+            workspacePath,
+            languageId,
+            configuration: outcome.configuration,
+          });
+        }
+      }
+    } catch (reason) {
+      setError(String(reason));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  // Loading and error states stay visible; an empty settings list never
+  // hides a failed resolve.
+  if (!manifest) {
+    return error ? (
+      <div className="mt-2 flex flex-col gap-2 border-t border-border pt-2">
+        <p role="alert" className="text-destructive ui-text-sm">
+          {error}
+        </p>
+      </div>
+    ) : null;
+  }
+  return (
+    <div className="mt-2 flex flex-col gap-2 border-t border-border pt-2">
+      <h4 className="ui-text-sm font-semibold">{t("settings.declarativePlugins.settings")}</h4>
+      {error && (
+        <p role="alert" className="text-destructive ui-text-sm">
+          {error}
+        </p>
+      )}
+      {settings.map((setting) => {
+        const resolved = values.find((value) => value.id === setting.id);
+        if (!resolved) return null;
+        return (
+          <SettingControl
+            key={setting.id}
+            setting={setting}
+            resolved={resolved}
+            disabled={busy}
+            projectAvailable={setting.scope === "project" && Boolean(workspacePath)}
+            onApply={(value) => void apply(setting, value)}
+          />
+        );
+      })}
+    </div>
+  );
+}
+
+function SettingControl({
+  setting,
+  resolved,
+  disabled,
+  projectAvailable,
+  onApply,
+}: {
+  setting: DeclarativePluginSetting;
+  resolved: ResolvedDeclarativeSetting;
+  disabled: boolean;
+  projectAvailable: boolean;
+  onApply: (value: unknown) => void;
+}) {
+  const { t } = useTranslation();
+  const sourceLabel = t(`settings.declarativePlugins.settingSource.${resolved.source}`);
+  const effectLabel = setting.effect
+    ? t(`settings.declarativePlugins.settingEffect.${setting.effect}`)
+    : t("settings.declarativePlugins.settingEffect.restart");
+  const scopeLabel = projectAvailable
+    ? t("settings.declarativePlugins.settingScope.project")
+    : t("settings.declarativePlugins.settingScope.global");
+
+  return (
+    <div className="flex items-center justify-between gap-3">
+      <div className="min-w-0">
+        <p className="truncate ui-text-sm">
+          {setting.title}
+          <span className="text-subtle-foreground">
+            {" "}
+            · {sourceLabel} · {scopeLabel} · {effectLabel}
+          </span>
+        </p>
+        {setting.description && (
+          <p className="text-subtle-foreground ui-text-sm">{setting.description}</p>
+        )}
+      </div>
+      {setting.type === "boolean" ? (
+        <Switch
+          checked={resolved.value === true}
+          disabled={disabled}
+          onChange={onApply}
+          aria-label={setting.title}
+        />
+      ) : setting.type === "integer" ? (
+        <NumberInput
+          value={Number(resolved.value ?? 0)}
+          min={setting.minimum ?? undefined}
+          max={setting.maximum ?? undefined}
+          disabled={disabled}
+          onChange={(value: number) => onApply(value)}
+          aria-label={setting.title}
+        />
+      ) : setting.type === "enum" ? (
+        <SettingsSelect
+          value={String(resolved.value ?? "")}
+          disabled={disabled}
+          options={(setting.options ?? []).map((option) => ({
+            value: option.value,
+            label: option.title,
+          }))}
+          onChange={onApply}
+        />
+      ) : setting.type === "multiSelect" ? (
+        <div className="flex max-w-64 flex-wrap justify-end gap-x-3 gap-y-1">
+          {(setting.options ?? []).map((option) => {
+            const selected = Array.isArray(resolved.value)
+              ? resolved.value.some((value) => String(value) === option.value)
+              : false;
+            return (
+              <label key={option.value} className="flex items-center gap-1 ui-text-sm">
+                <Checkbox
+                  checked={selected}
+                  disabled={disabled}
+                  onCheckedChange={(checked) => {
+                    const current = Array.isArray(resolved.value)
+                      ? resolved.value.map(String)
+                      : [];
+                    const next = checked
+                      ? [...new Set([...current, option.value])]
+                      : current.filter((value) => value !== option.value);
+                    onApply(next);
+                  }}
+                  aria-label={option.title}
+                />
+                <span>{option.title}</span>
+              </label>
+            );
+          })}
+        </div>
+      ) : (
+        <input
+          type="text"
+          className="w-40 rounded border border-border bg-background px-2 py-1 ui-text-sm"
+          value={String(resolved.value ?? "")}
+          disabled={disabled}
+          onChange={(event) => onApply(event.target.value)}
+          aria-label={setting.title}
+        />
+      )}
+    </div>
+  );
+}
+
+export type { DeclarativePluginSetting, ResolvedDeclarativeSetting };
+
+function valuesEqual(left: unknown, right: unknown): boolean {
+  if (Object.is(left, right)) return true;
+  try {
+    return JSON.stringify(left) === JSON.stringify(right);
+  } catch {
+    return false;
+  }
+}
diff --git a/windows/tauri/src/features/plugins/declarative-plugin-ui.test.ts b/windows/tauri/src/features/plugins/declarative-plugin-ui.test.ts
new file mode 100644
index 0000000000..5178e326b3
--- /dev/null
+++ b/windows/tauri/src/features/plugins/declarative-plugin-ui.test.ts
@@ -0,0 +1,89 @@
+import { afterEach, expect, mock, test } from "bun:test";
+import { enableMapSet } from "immer";
+import { createRequire } from "node:module";
+import hello from "../../../../../shared/contracts/plugins/v1/fixtures/hello-lithe.plugin.json";
+import { useUIExtensionStore } from "@/extensions/ui/stores/ui-extension-store";
+enableMapSet();
+// Zustand's Bun CJS adapter loads the CommonJS Immer export. Enable its
+// MapSet plugin as well as the ESM export used by the product bundler.
+createRequire(import.meta.url)("immer").enableMapSet();
+const open = mock(async () => undefined);
+let manifestGate: Promise<void> | null = null;
+mock.module("./declarative-plugin-launch", () => ({
+  listDeclarativePlugins: async () => [
+    { pluginId: hello.id, displayName: hello.displayName, enabled: true, status: "accepted" },
+  ],
+  listDeclarativeWebWindows: async () => [
+    { pluginId: hello.id, windowId: hello.ui.toolWindows[0].id, title: hello.displayName },
+  ],
+  getDeclarativePluginManifest: async () => {
+    await manifestGate;
+    return hello;
+  },
+  openDeclarativeWebWindow: open,
+}));
+const { refreshDeclarativeUI, removeDeclarativeUI, useDeclarativePluginUI } =
+  await import("./declarative-plugin-ui");
+afterEach(() => {
+  removeDeclarativeUI(hello.id);
+  open.mockClear();
+  manifestGate = null;
+});
+
+test("hello ui1 contributes a text window and all three command placements and revokes them", async () => {
+  await refreshDeclarativeUI();
+  const state = useUIExtensionStore.getState();
+  const command = [...state.commands.values()].find(
+    (command) => command.extensionId === `declarative:${hello.id}`,
+  )!;
+  expect(command.placements).toEqual(["commandPalette", "toolbar", "menu"]);
+  expect(useDeclarativePluginUI.getState().windows).toHaveLength(1);
+  expect([...state.toolbarActions.values()].some((action) => action.id === command.id)).toBe(true);
+  await command.execute();
+  expect(open).toHaveBeenCalledWith(hello.id, hello.ui.toolWindows[0].id);
+  removeDeclarativeUI(hello.id);
+  expect(useDeclarativePluginUI.getState().windows).toHaveLength(0);
+  expect(useUIExtensionStore.getState().commands.has(command.id)).toBe(false);
+  expect(useUIExtensionStore.getState().toolbarActions.has(command.id)).toBe(false);
+});
+
+test("removing another plugin does not cancel an in-flight refresh", async () => {
+  let release!: () => void;
+  manifestGate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const refreshing = refreshDeclarativeUI();
+  removeDeclarativeUI("test.unrelated");
+  try {
+    release();
+    await refreshing;
+    expect(
+      useDeclarativePluginUI.getState().windows.some((window) => window.pluginId === hello.id),
+    ).toBe(true);
+    expect(
+      [...useUIExtensionStore.getState().commands.values()].some(
+        (command) => command.extensionId === `declarative:${hello.id}`,
+      ),
+    ).toBe(true);
+  } finally {
+    release();
+  }
+}, 5000);
+
+test("revoking the same plugin rejects its in-flight UI contribution", async () => {
+  let release!: () => void;
+  manifestGate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const refreshing = refreshDeclarativeUI();
+  removeDeclarativeUI(hello.id);
+  try {
+    release();
+    await refreshing;
+    expect(
+      useDeclarativePluginUI.getState().windows.some((window) => window.pluginId === hello.id),
+    ).toBe(false);
+  } finally {
+    release();
+  }
+}, 5000);
diff --git a/windows/tauri/src/features/plugins/declarative-plugin-ui.ts b/windows/tauri/src/features/plugins/declarative-plugin-ui.ts
new file mode 100644
index 0000000000..9284619cd0
--- /dev/null
+++ b/windows/tauri/src/features/plugins/declarative-plugin-ui.ts
@@ -0,0 +1,109 @@
+import { create } from "zustand";
+import { useUIExtensionStore } from "@/extensions/ui/stores/ui-extension-store";
+import {
+  listDeclarativePlugins,
+  listDeclarativeWebWindows,
+  getDeclarativePluginManifest,
+  openDeclarativeWebWindow,
+  type DeclarativeWebToolWindow,
+} from "./declarative-plugin-launch";
+
+interface DeclaredCommand {
+  id: string;
+  title: string;
+  toolWindowID: string;
+  placements: string[];
+  order?: number;
+}
+export const useDeclarativePluginUI = create<{ windows: DeclarativeWebToolWindow[] }>(() => ({
+  windows: [],
+}));
+let refreshSequence = 0;
+const revisions = new Map<string, number>();
+const appliedRefreshes = new Map<string, number>();
+const registered = new Set<string>();
+
+export function removeDeclarativeUI(pluginId: string): void {
+  revisions.set(pluginId, (revisions.get(pluginId) ?? 0) + 1);
+  const owner = `declarative:${pluginId}`;
+  useUIExtensionStore.getState().actions.cleanupExtension(owner);
+  registered.delete(pluginId);
+  useDeclarativePluginUI.setState((state) => ({
+    windows: state.windows.filter((window) => window.pluginId !== pluginId),
+  }));
+}
+
+/** Reuse the presentation registries, never the Worker loader or interpreter. */
+export async function refreshDeclarativeUI(): Promise<void> {
+  const current = ++refreshSequence;
+  const observedRevisions = new Map(revisions);
+  const [plugins, windows] = await Promise.all([
+    listDeclarativePlugins(),
+    listDeclarativeWebWindows(),
+  ]);
+  const declarations = await Promise.all(
+    plugins
+      .filter((plugin) => plugin.enabled && plugin.status === "accepted")
+      .map(async (plugin) => ({
+        plugin,
+        manifest: await getDeclarativePluginManifest(plugin.pluginId),
+      })),
+  );
+  const actions = useUIExtensionStore.getState().actions;
+  const pluginIds = new Set([...registered, ...plugins.map((plugin) => plugin.pluginId)]);
+  for (const pluginId of pluginIds) {
+    // Revoking B must neither resurrect B nor cancel an unrelated refresh of A.
+    if (
+      (observedRevisions.get(pluginId) ?? 0) !== (revisions.get(pluginId) ?? 0) ||
+      current < (appliedRefreshes.get(pluginId) ?? 0)
+    )
+      continue;
+    appliedRefreshes.set(pluginId, current);
+    const owner = `declarative:${pluginId}`;
+    actions.cleanupExtension(owner);
+    registered.delete(pluginId);
+    const declaration = declarations.find(({ plugin }) => plugin.pluginId === pluginId);
+    const ownedWindows = declaration
+      ? windows.filter((window) => window.pluginId === pluginId)
+      : [];
+    useDeclarativePluginUI.setState((state) => ({
+      windows: [...state.windows.filter((window) => window.pluginId !== pluginId), ...ownedWindows],
+    }));
+    if (!declaration) continue;
+    const { plugin, manifest } = declaration;
+    const ui = manifest?.ui as { commands?: DeclaredCommand[] } | undefined;
+    registered.add(pluginId);
+    for (const command of [...(ui?.commands ?? [])].sort(
+      (a, b) => (a.order ?? 0) - (b.order ?? 0) || a.id.localeCompare(b.id),
+    )) {
+      if (
+        !windows.some(
+          (window) =>
+            window.pluginId === plugin.pluginId && window.windowId === command.toolWindowID,
+        )
+      )
+        continue;
+      const execute = () => openDeclarativeWebWindow(plugin.pluginId, command.toolWindowID);
+      const id = `${owner}:${command.id}`;
+      actions.registerCommand({
+        id,
+        extensionId: owner,
+        title: command.title,
+        category: plugin.displayName,
+        placements: command.placements,
+        execute,
+      });
+      if (command.placements.includes("toolbar"))
+        actions.registerToolbarAction({
+          id,
+          extensionId: owner,
+          title: command.title,
+          icon: "puzzle",
+          position: "right",
+          onClick: () => {
+            void execute().catch(console.error);
+          },
+        });
+    }
+  }
+}
diff --git a/windows/tauri/src/features/plugins/declarative-plugins-section.tsx b/windows/tauri/src/features/plugins/declarative-plugins-section.tsx
new file mode 100644
index 0000000000..fd429c7bfe
--- /dev/null
+++ b/windows/tauri/src/features/plugins/declarative-plugins-section.tsx
@@ -0,0 +1,373 @@
+import { useCallback, useEffect, useState } from "react";
+import { useTranslation } from "@/i18n/locale-provider";
+import { Button } from "@/ui/button";
+import Switch from "@/ui/switch";
+import {
+  closeDeclarativeWebWindow,
+  cancelDeclarativeDiskInstall,
+  confirmDeclarativeDiskInstall,
+  listDeclarativePlugins,
+  listDeclarativeWebWindows,
+  openDeclarativeWebWindow,
+  prepareDeclarativeDiskInstall,
+  type DeclarativeWebToolWindow,
+  rescanDeclarativePlugins,
+  rollbackDeclarativePlugin,
+  setDeclarativePluginEnabled,
+  uninstallDeclarativePlugin,
+  type DeclarativePluginSummary,
+  type PreparedDeclarativeInstall,
+} from "./declarative-plugin-launch";
+import { DeclarativePluginSettingsEditor } from "./declarative-plugin-settings-editor";
+import { useWorkspaceTabsStore } from "@/features/window/stores/workspace-tabs.store";
+
+/**
+ * Management surface for contract v1 declarative plugins. This block is
+ * intentionally separate from the Worker extension browser: the two models
+ * have different trust properties (contract packages run only host-launched
+ * processes reviewed through Core's install review), so mixing them in one
+ * list would hide that difference from the user.
+ */
+export function DeclarativePluginsSection() {
+  const { t } = useTranslation();
+  const [plugins, setPlugins] = useState<DeclarativePluginSummary[]>([]);
+  const [webWindows, setWebWindows] = useState<DeclarativeWebToolWindow[]>([]);
+  const [pending, setPending] = useState<PreparedDeclarativeInstall | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const workspacePath = useWorkspaceTabsStore((state) =>
+    state.projectTabs.find((tab) => tab.isActive)?.path ?? null,
+  );
+
+  const refresh = useCallback(async () => {
+    await rescanDeclarativePlugins();
+    setPlugins(await listDeclarativePlugins());
+    setWebWindows(await listDeclarativeWebWindows());
+  }, []);
+
+  useEffect(() => {
+    refresh().catch((reason: unknown) => setError(String(reason)));
+  }, [refresh]);
+
+  useEffect(() => {
+    if (!pending) return;
+    return () => {
+      void cancelDeclarativeDiskInstall(pending.sessionId).catch((reason: unknown) =>
+        console.warn("Could not discard plugin install review", reason),
+      );
+    };
+  }, [pending]);
+
+  const importPackage = async () => {
+    const selection = await import("@tauri-apps/plugin-dialog").then(({ open }) =>
+      open({
+        multiple: false,
+        filters: [
+          { name: "Lithe plugin package", extensions: ["zip"] },
+        ],
+      }),
+    );
+    if (typeof selection !== "string") return;
+    setBusy(true);
+    setError(null);
+    try {
+      setPending(await prepareDeclarativeDiskInstall(selection));
+    } catch (reason) {
+      setError(String(reason));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const confirmInstall = async () => {
+    if (!pending) return;
+    setBusy(true);
+    setError(null);
+    try {
+      await confirmDeclarativeDiskInstall(pending.sessionId, pending.manifestDigest);
+      setPending(null);
+      await refresh();
+    } catch (reason) {
+      setError(String(reason));
+      setPending(null);
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <section aria-label={t("settings.declarativePlugins.title")} className="flex flex-col gap-2">
+      <SettingsSectionGroup
+        title={t("settings.declarativePlugins.title")}
+        description={t("settings.declarativePlugins.description")}
+        action={
+          <Button variant="accent" size="sm" disabled={busy || Boolean(pending)} onClick={() => void importPackage()}>
+            {t("settings.declarativePlugins.import")}
+          </Button>
+        }
+      />
+      {error && (
+        <p role="alert" className="text-destructive ui-text-sm">
+          {error}
+        </p>
+      )}
+      {pending && (
+        <InstallReviewCard
+          pending={pending}
+          onConfirm={() => void confirmInstall()}
+          onCancel={() => setPending(null)}
+          busy={busy}
+        />
+      )}
+      <ul className="flex flex-col gap-1" data-testid="declarative-plugin-list">
+        {plugins.map((plugin) => (
+          <DeclarativePluginRow
+            key={`${plugin.source}-${plugin.pluginId}`}
+            plugin={plugin}
+            workspacePath={workspacePath}
+            onChanged={() => void refresh()}
+          />
+        ))}
+        {!plugins.length && (
+          <li className="text-subtle-foreground ui-text-sm">
+            {t("settings.declarativePlugins.empty")}
+          </li>
+        )}
+      </ul>
+      {webWindows.length > 0 && (
+        <div className="flex flex-col gap-1">
+          <h3 className="ui-text-sm font-semibold">
+            {t("settings.declarativePlugins.webWindows")}
+          </h3>
+          <ul className="flex flex-col gap-1" data-testid="declarative-web-window-list">
+            {webWindows.map((window) => (
+            <WebWindowRow key={`${window.pluginId}:${window.windowId}`} window={window} />
+            ))}
+          </ul>
+        </div>
+      )}
+    </section>
+  );
+}
+
+function WebWindowRow({ window }: { window: DeclarativeWebToolWindow }) {
+  const { t } = useTranslation();
+  const [open, setOpen] = useState(false);
+  return (
+    <li className="flex items-center gap-3 rounded-md border border-border px-3 py-2">
+      <div className="min-w-0 flex-1">
+        <p className="truncate ui-text-sm">
+          {window.title}
+          <span className="text-subtle-foreground">
+            {" "}
+            · {t(`settings.declarativePlugins.placement.${window.placement}`)}
+          </span>
+        </p>
+      </div>
+      <Button
+        variant="accent"
+        size="sm"
+        onClick={() => {
+          if (open) {
+            void closeDeclarativeWebWindow(window.pluginId, window.windowId).then(() => setOpen(false));
+          } else {
+            void openDeclarativeWebWindow(window.pluginId, window.windowId).then(() => setOpen(true));
+          }
+        }}
+      >
+        {open
+          ? t("settings.declarativePlugins.closeWindow")
+          : t("settings.declarativePlugins.openWindow")}
+      </Button>
+    </li>
+  );
+}
+
+function InstallReviewCard({
+  pending,
+  onConfirm,
+  onCancel,
+  busy,
+}: {
+  pending: PreparedDeclarativeInstall;
+  onConfirm: () => void;
+  onCancel: () => void;
+  busy: boolean;
+}) {
+  const { t } = useTranslation();
+  return (
+    <div
+      role="dialog"
+      aria-label={t("settings.declarativePlugins.reviewTitle")}
+      className="rounded-md border border-border p-3"
+    >
+      <p className="ui-text-sm font-medium">
+        {t("settings.declarativePlugins.reviewTitle", {
+          name: pending.displayName,
+          version: pending.review.version,
+        })}
+      </p>
+      <p className="text-subtle-foreground ui-text-sm">
+        {t("settings.declarativePlugins.unverified")}
+      </p>
+      {pending.review.permissions.length > 0 && (
+        <ul className="mt-1 list-disc pl-5 ui-text-sm">
+          {pending.review.permissions.map((permission) => (
+            <li key={permission}>{permission}</li>
+          ))}
+        </ul>
+      )}
+      {pending.review.programs.length > 0 && (
+        <ProgramDeclarationList programs={pending.review.programs} />
+      )}
+      <div className="mt-2 flex gap-2">
+        <Button size="sm" disabled={busy} onClick={onConfirm}>
+          {t("settings.declarativePlugins.confirmInstall")}
+        </Button>
+        <Button size="sm" variant="accent" disabled={busy} onClick={onCancel}>
+          {t("ui.cancel")}
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+function ProgramDeclarationList({ programs }: { programs: unknown[] }) {
+  const { t } = useTranslation();
+  const [expanded, setExpanded] = useState(false);
+  return (
+    <div className="mt-1 ui-text-sm">
+      <button
+        type="button"
+        className="text-left underline"
+        onClick={() => setExpanded((value) => !value)}
+      >
+        {t("settings.declarativePlugins.programDeclaration", { count: programs.length })}
+      </button>
+      {expanded && (
+        <pre className="mt-1 max-h-40 overflow-auto rounded bg-muted p-2 text-xs">
+          {JSON.stringify(programs, null, 2)}
+        </pre>
+      )}
+    </div>
+  );
+}
+
+function DeclarativePluginRow({
+  plugin,
+  workspacePath,
+  onChanged,
+}: {
+  plugin: DeclarativePluginSummary;
+  workspacePath: string | null;
+  onChanged: () => void;
+}) {
+  const { t } = useTranslation();
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [showSettings, setShowSettings] = useState(false);
+  const rejected = plugin.status === "rejected";
+  const declaredSettings =
+    !rejected && Array.isArray(plugin.declaredSettings) ? plugin.declaredSettings : [];
+  const hasSettings = declaredSettings.length > 0;
+
+  const run = async (action: () => Promise<void>) => {
+    setBusy(true);
+    setError(null);
+    try {
+      await action();
+      onChanged();
+    } catch (reason) {
+      setError(String(reason));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <li className="rounded-md border border-border px-3 py-2">
+      <div className="flex items-center gap-3">
+        <div className="min-w-0 flex-1">
+          <p className="truncate ui-text-sm font-medium">
+            {plugin.displayName}{" "}
+            <span className="text-subtle-foreground">
+              {plugin.version} · {t(`settings.declarativePlugins.source.${plugin.source}`)}
+            </span>
+          </p>
+          {rejected && plugin.rejection && (
+            <p className="text-destructive ui-text-sm">
+              {plugin.rejection.code}: {plugin.rejection.message}
+            </p>
+          )}
+          {error && <p className="text-destructive ui-text-sm">{error}</p>}
+        </div>
+        {!rejected && hasSettings && (
+          <Button
+            variant="accent"
+            size="sm"
+            disabled={busy}
+            onClick={() => setShowSettings((value) => !value)}
+          >
+            {showSettings ? t("settings.declarativePlugins.hideSettings") : t("settings.declarativePlugins.showSettings")}
+          </Button>
+        )}
+        {!rejected && plugin.source === "installed" && (
+          <>
+            <Switch
+              checked={plugin.enabled}
+              disabled={busy}
+              onChange={(checked) =>
+                void run(() => setDeclarativePluginEnabled(plugin.pluginId, checked))
+              }
+              aria-label={t("settings.declarativePlugins.toggle", { name: plugin.displayName })}
+            />
+            <Button
+              variant="accent"
+              size="sm"
+              disabled={busy}
+              onClick={() => void run(() => rollbackDeclarativePlugin(plugin.pluginId))}
+            >
+              {t("settings.declarativePlugins.rollback")}
+            </Button>
+            <Button
+              variant="danger"
+              size="sm"
+              disabled={busy}
+              onClick={() => void run(() => uninstallDeclarativePlugin(plugin.pluginId))}
+            >
+              {t("settings.declarativePlugins.uninstall")}
+            </Button>
+          </>
+        )}
+      </div>
+      {!rejected && showSettings && hasSettings && (
+        <DeclarativePluginSettingsEditor
+          pluginId={plugin.pluginId}
+          settings={declaredSettings}
+          workspacePath={workspacePath}
+          languageId={plugin.primaryLanguageId}
+        />
+      )}
+    </li>
+  );
+}
+
+function SettingsSectionGroup({
+  title,
+  description,
+  action,
+}: {
+  title: string;
+  description: string;
+  action?: React.ReactNode;
+}) {
+  return (
+    <div className="flex items-center justify-between gap-3">
+      <div>
+        <h3 className="ui-text-sm font-semibold">{title}</h3>
+        <p className="text-subtle-foreground ui-text-sm">{description}</p>
+      </div>
+      {action}
+    </div>
+  );
+}
diff --git a/windows/tauri/src/features/plugins/plugin-lifecycle-listener.test.ts b/windows/tauri/src/features/plugins/plugin-lifecycle-listener.test.ts
new file mode 100644
index 0000000000..5a50c9de17
--- /dev/null
+++ b/windows/tauri/src/features/plugins/plugin-lifecycle-listener.test.ts
@@ -0,0 +1,158 @@
+import { afterEach, expect, mock, test } from "bun:test";
+const handlers = new Map<string, (event: { payload: any }) => Promise<void>>();
+const targets = new Map<string, unknown>();
+const invoke = mock(async (_command: string, _args: unknown) => undefined);
+const select = mock(async (..._args: unknown[]) => undefined);
+let root = "C:/a";
+let workspaceId = "workspace-a";
+let editorOpened = true;
+let resolveFile = async (_path: string, _root: string) => "C:/a/file.txt";
+mock.module("@tauri-apps/api/event", () => ({
+  listen: async (event: string, handler: (event: any) => Promise<void>, options: unknown) => {
+    handlers.set(event, handler);
+    targets.set(event, options);
+    return () => {
+      handlers.delete(event);
+      targets.delete(event);
+    };
+  },
+}));
+mock.module("@tauri-apps/api/window", () => ({
+  getCurrentWindow: () => ({ label: "workspace-owner" }),
+}));
+mock.module("@/platform/tauri-core", () => ({ invoke }));
+mock.module("@/features/file-system/stores/file-system.store", () => ({
+  useFileSystemStore: { getState: () => ({ rootFolderPath: root, handleFileSelect: select }) },
+}));
+mock.module("@/features/workspace/runtime/workspace-runtime-registry", () => ({
+  workspaceRuntimeRegistry: { getActiveWorkspaceId: () => workspaceId },
+}));
+mock.module("@/features/editor/stores/buffer.store", () => ({
+  useBufferStore: {
+    getStore: () => ({
+      getState: () => ({
+        buffers: editorOpened ? [{ id: "file", path: "C:/a/file.txt" }] : [],
+        activeBufferId: editorOpened ? "file" : null,
+      }),
+    }),
+  },
+}));
+mock.module("./plugin-web-path", () => ({
+  resolvePluginWebFilePath: (path: string, root: string) => resolveFile(path, root),
+}));
+mock.module("./plugin-web-appearance", () => ({
+  initializePluginWebAppearanceSync: () => () => {},
+}));
+mock.module("./declarative-plugin-ui", () => ({
+  removeDeclarativeUI: () => {},
+  refreshDeclarativeUI: async () => {},
+}));
+let stopRuns = async () => {};
+let stopLsp = async () => {};
+mock.module("./declarative-plugin-process-owner", () => ({
+  declarativePluginProcessOwner: { stop: () => stopRuns() },
+}));
+mock.module("@/platform/lsp-core-adapter", () => ({ invokeLsp: () => stopLsp() }));
+const { initializePluginWebListeners } = await import("./plugin-web-open-file");
+const { assertPluginActive, setPluginActive } = await import("./declarative-plugin-lifecycle");
+let dispose: (() => void) | undefined;
+afterEach(() => {
+  dispose?.();
+  dispose = undefined;
+  invoke.mockClear();
+  select.mockClear();
+  root = "C:/a";
+  workspaceId = "workspace-a";
+  editorOpened = true;
+  setPluginActive("test.plugin", true);
+});
+const request = {
+  pluginId: "test.plugin",
+  operationId: "request-1",
+  workspaceId: "workspace-a",
+  workspacePath: "C:/a",
+  path: "file.txt",
+  line: 3,
+  column: 2,
+};
+
+test("file requests and lifecycle barriers listen only to their owning product window", async () => {
+  dispose = await initializePluginWebListeners();
+  const scoped = { target: { kind: "Window", label: "workspace-owner" } };
+  expect(targets.get("plugin-web-open-file")).toEqual(scoped);
+  expect(targets.get("declarative-plugin-lifecycle")).toEqual(scoped);
+});
+
+test("mutation acknowledgement waits for both process owners and carries failures", async () => {
+  dispose = await initializePluginWebListeners();
+  let release: (() => void) | undefined;
+  stopRuns = () =>
+    new Promise<void>((resolve) => {
+      release = resolve;
+    });
+  stopLsp = async () => {
+    throw new Error("process still running");
+  };
+  const draining = handlers.get("declarative-plugin-lifecycle")!({
+    payload: { pluginId: "test.plugin", active: false, operationId: "mutation-1" },
+  });
+  try {
+    expect(() => assertPluginActive("test.plugin")).toThrow("inactive");
+    expect(invoke).not.toHaveBeenCalled();
+    release?.();
+    await draining;
+    expect(invoke).toHaveBeenCalledWith("declarative_plugins_lifecycle_ack", {
+      operationId: "mutation-1",
+      error: "Error: process still running",
+    });
+  } finally {
+    release?.();
+    await draining;
+    stopRuns = async () => {};
+    stopLsp = async () => {};
+  }
+}, 5000);
+
+test("openFile rejects another workspace and a workspace switch during canonicalization", async () => {
+  dispose = await initializePluginWebListeners();
+  root = "C:/b";
+  workspaceId = "workspace-b";
+  await handlers.get("plugin-web-open-file")!({ payload: request });
+  expect(select).not.toHaveBeenCalled();
+  expect(invoke.mock.calls[0]?.[1]).toEqual(
+    expect.objectContaining({ error: expect.stringContaining("no longer active") }),
+  );
+  root = "C:/a";
+  workspaceId = "workspace-a";
+  resolveFile = async () => {
+    workspaceId = "workspace-b";
+    return "C:/a/file.txt";
+  };
+  await handlers.get("plugin-web-open-file")!({ payload: request });
+  expect(select).not.toHaveBeenCalled();
+  expect(invoke.mock.calls[1]?.[1]).toEqual(
+    expect.objectContaining({ error: expect.stringContaining("changed during") }),
+  );
+}, 5000);
+
+test("openFile acknowledges success after the owning editor opens the canonical file", async () => {
+  dispose = await initializePluginWebListeners();
+  resolveFile = async () => "C:/a/file.txt";
+  await handlers.get("plugin-web-open-file")!({ payload: request });
+  expect(select).toHaveBeenCalledWith("C:/a/file.txt", false, 3, 2, undefined, false);
+  expect(invoke).toHaveBeenCalledWith("declarative_plugins_web_open_file_ack", {
+    operationId: "request-1",
+    error: null,
+  });
+}, 5000);
+
+test("openFile reports a read failure even when the shared handler resolves", async () => {
+  dispose = await initializePluginWebListeners();
+  resolveFile = async () => "C:/a/file.txt";
+  editorOpened = false;
+  await handlers.get("plugin-web-open-file")!({ payload: request });
+  expect(invoke).toHaveBeenCalledWith("declarative_plugins_web_open_file_ack", {
+    operationId: "request-1",
+    error: "Error: the editor did not open the requested file",
+  });
+}, 5000);
diff --git a/windows/tauri/src/features/plugins/plugin-web-appearance.test.ts b/windows/tauri/src/features/plugins/plugin-web-appearance.test.ts
new file mode 100644
index 0000000000..1f9f188ba8
--- /dev/null
+++ b/windows/tauri/src/features/plugins/plugin-web-appearance.test.ts
@@ -0,0 +1,101 @@
+import { expect, spyOn, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { Window } from "happy-dom";
+import { themeRegistry } from "@/extensions/themes/theme-registry";
+import { useSettingsStore } from "@/features/settings/stores/settings.store";
+import * as native from "@/platform/tauri-core";
+import { installHappyDom } from "@/test-utils/happy-dom";
+import { getPluginWebAppearance, initializePluginWebAppearanceSync } from "./plugin-web-appearance";
+
+test("plugin appearance uses resolved workbench colors, fonts and locale", () => {
+  const restore = installHappyDom();
+  const current = useSettingsStore.getState();
+  const getState = spyOn(useSettingsStore, "getState").mockReturnValue({ ...current,
+    settings: { ...current.settings, uiFontFamily: "Test UI", uiFontSize: 15, fontFamily: "Test Mono" },
+  });
+  try {
+    const root = document.documentElement;
+    root.setAttribute("data-theme-type", "dark");
+    root.style.setProperty("--background", "#101010");
+    root.style.setProperty("--app-font-family", "Test UI");
+    root.style.setProperty("--editor-font-family", "Test Mono");
+    const appearance = getPluginWebAppearance();
+    expect(appearance.locale).toBe(useSettingsStore.getState().settings.displayLanguage);
+    expect(appearance.theme).toBe("dark");
+    expect(appearance.variables["--lithe-background"]).toBe("#101010");
+    expect(appearance.variables["--lithe-font-family"]).toStartWith('"Test UI",');
+    expect(appearance.variables["--lithe-font-size"]).toBe("15px");
+    expect(appearance.variables["--lithe-code-font-family"]).toStartWith('"Test Mono",');
+    expect(appearance.variables["--lithe-code-font-size"]).toBe(`${useSettingsStore.getState().settings.fontSize}px`);
+  } finally { getState.mockRestore(); restore(); }
+});
+
+test("theme updates reach native pages and unsubscribe at bootstrap cleanup", () => {
+  const restore = installHappyDom();
+  let changed = () => {};
+  let stopped = false;
+  const subscribe = spyOn(themeRegistry, "onThemeChange").mockImplementation((callback) => {
+    changed = () => callback("fixture");
+    return () => { stopped = true; };
+  });
+  const invoke = spyOn(native, "invoke").mockResolvedValue(undefined);
+  const stop = initializePluginWebAppearanceSync();
+  try {
+    document.documentElement.setAttribute("data-theme-type", "dark");
+    changed();
+    expect(invoke).toHaveBeenCalledWith("declarative_plugins_web_update_appearance", {
+      appearance: expect.objectContaining({ theme: "dark" }),
+    });
+  } finally {
+    stop();
+    expect(stopped).toBe(true);
+    subscribe.mockRestore();
+    invoke.mockRestore();
+    restore();
+  }
+});
+
+// Execute the exact native document-start bootstrap rather than a JS copy.
+const source = readFileSync(new URL("../../../src-tauri/src/plugin_host/web.rs", import.meta.url), "utf8");
+const template = source.match(/fn const_bridge_script[\s\S]*?r#"([\s\S]*?)"#/u)?.[1];
+if (!template) throw new Error("native plugin bootstrap not found");
+const bootstrap = template
+  .replace("__LITHE_CONTEXT__", JSON.stringify({ pluginID: "acme.php", windowID: "panel", platform: "windows", locale: "zh-CN" }))
+  .replace("__LITHE_APPEARANCE__", JSON.stringify({ locale: "zh-CN", theme: "dark", variables: { "--lithe-background": "#101010" } }));
+
+function runBootstrap(page: Window) {
+  new Function("window", "document", bootstrap)(page, page.document);
+  return page as unknown as {
+    lithe?: { context: { locale: string; theme: string }; on: (event: string, listener: (payload: { theme: string }) => void) => () => void };
+    __litheDeliverEvent: (event: string, payload: unknown) => void;
+  };
+}
+
+test("native bridge provides context and root tokens before page code and updates them live", () => {
+  const page = new Window({ url: "http://lithe-plugin.acme.php/ui/index.html" });
+  try {
+    const bridge = runBootstrap(page);
+    expect(Object.isFrozen(bridge.lithe!.context)).toBe(true);
+    expect(bridge.lithe!.context.locale).toBe("zh-CN");
+    expect(bridge.lithe!.context.theme).toBe("dark");
+    expect(page.document.documentElement.dataset.theme).toBe("dark");
+    expect(page.document.documentElement.style.getPropertyValue("--lithe-background")).toBe("#101010");
+    const received: string[] = [];
+    bridge.lithe!.on("ui.themeChanged", (value) => { received.push(value.theme); });
+    bridge.__litheDeliverEvent("ui.themeChanged", {locale:"en-US",theme:"light",variables:{"--lithe-background":"#ffffff"}});
+    expect(bridge.lithe!.context.theme).toBe("light");
+    expect(bridge.lithe!.context.locale).toBe("en-US");
+    expect(received).toEqual(["light"]);
+    expect(page.document.documentElement.dataset.theme).toBe("light");
+    expect(page.document.documentElement.style.getPropertyValue("--lithe-background")).toBe("#ffffff");
+  } finally { page.close(); }
+});
+
+test("document-start bootstrap exposes no bridge to a foreign document", () => {
+  for (const url of ["https://example.test/", "http://lithe-plugin.other.plugin/ui/index.html", "about:blank"]) {
+    const page = new Window({ url });
+    try {
+      expect(runBootstrap(page).lithe).toBeUndefined();
+    } finally { page.close(); }
+  }
+});
diff --git a/windows/tauri/src/features/plugins/plugin-web-appearance.ts b/windows/tauri/src/features/plugins/plugin-web-appearance.ts
new file mode 100644
index 0000000000..390b1a7455
--- /dev/null
+++ b/windows/tauri/src/features/plugins/plugin-web-appearance.ts
@@ -0,0 +1,59 @@
+import { themeRegistry } from "@/extensions/themes/theme-registry";
+import { useSettingsStore } from "@/features/settings/stores/settings.store";
+import { DEFAULT_MONO_FONT_FAMILY, DEFAULT_UI_FONT_FAMILY, getTypographyFontFallbacks } from "@/features/settings/config/typography-defaults";
+import { buildFontFamilyStack } from "@/features/settings/lib/font-family-resolution";
+import { normalizeUiFontSize } from "@/features/settings/lib/ui-font-size";
+import { invoke } from "@/platform/tauri-core";
+import { IS_WINDOWS } from "@/utils/platform";
+
+export interface PluginWebAppearance {
+  locale: string;
+  theme: "light" | "dark";
+  variables: Record<string, string>;
+}
+
+/** Shares the workbench's resolved tokens with package pages, like macOS. */
+export function getPluginWebAppearance(): PluginWebAppearance {
+  const root = document.documentElement;
+  const style = getComputedStyle(root);
+  const read = (name: string) => style.getPropertyValue(name).trim();
+  const settings = useSettingsStore.getState().settings;
+  const colorTokens: Record<string, string> = {
+    background: "--background", surface: "--surface", header: "--tab-bar-bg",
+    "popup-background": "--popover", foreground: "--foreground",
+    "secondary-foreground": "--muted-foreground", border: "--border", accent: "--accent",
+    link: "--info", success: "--success", warning: "--warning", error: "--destructive",
+  };
+  const variables = Object.fromEntries(Object.entries(colorTokens).map(([name, token]) =>
+    [`--lithe-${name}`, read(token) || read("--foreground")],
+  ));
+  // Settings subscriptions run before FontStyleInjector's React effect. Reuse
+  // its font resolution helpers so pages receive the new values immediately.
+  const { mono, sans } = getTypographyFontFallbacks(IS_WINDOWS);
+  variables["--lithe-font-family"] = buildFontFamilyStack(settings.uiFontFamily || DEFAULT_UI_FONT_FAMILY, sans);
+  variables["--lithe-font-size"] = `${normalizeUiFontSize(settings.uiFontSize)}px`;
+  variables["--lithe-code-font-family"] = buildFontFamilyStack(settings.fontFamily || DEFAULT_MONO_FONT_FAMILY, mono);
+  variables["--lithe-code-font-size"] = `${settings.fontSize}px`;
+  return {
+    locale: settings.displayLanguage,
+    theme: root.getAttribute("data-theme-type") === "dark" ? "dark" : "light",
+    variables,
+  };
+}
+
+/** Owns and releases both subscriptions with the workspace bootstrap. */
+export function initializePluginWebAppearanceSync(): () => void {
+  const sync = () => {
+    void invoke("declarative_plugins_web_update_appearance", { appearance: getPluginWebAppearance() })
+      .catch((error) => console.warn("Plugin page appearance update failed", error));
+  };
+  const stopTheme = themeRegistry.onThemeChange(sync);
+  const stopSettings = useSettingsStore.subscribe((state, previous) => {
+    if (state.settings.displayLanguage !== previous.settings.displayLanguage ||
+        state.settings.fontSize !== previous.settings.fontSize ||
+        state.settings.fontFamily !== previous.settings.fontFamily ||
+        state.settings.uiFontFamily !== previous.settings.uiFontFamily ||
+        state.settings.uiFontSize !== previous.settings.uiFontSize) sync();
+  });
+  return () => { stopTheme(); stopSettings(); };
+}
diff --git a/windows/tauri/src/features/plugins/plugin-web-open-file.test.ts b/windows/tauri/src/features/plugins/plugin-web-open-file.test.ts
new file mode 100644
index 0000000000..cf2a9a7163
--- /dev/null
+++ b/windows/tauri/src/features/plugins/plugin-web-open-file.test.ts
@@ -0,0 +1,15 @@
+import { expect, spyOn, test } from "bun:test";
+import * as native from "@/platform/tauri-core";
+import { resolvePluginWebFilePath } from "./plugin-web-path";
+
+test("open-file uses the native resolved target and propagates boundary rejection", async () => {
+  const invoke = spyOn(native, "invoke").mockResolvedValue("C:/work/inside.txt");
+  try {
+    expect(await resolvePluginWebFilePath("C:/work/link.txt", "C:/work")).toBe("C:/work/inside.txt");
+    expect(invoke).toHaveBeenCalledWith("declarative_plugins_web_resolve_file", {
+      path: "C:/work/link.txt", workspacePath: "C:/work",
+    });
+    invoke.mockRejectedValue({ code: "plugin.web.forbidden" });
+    await expect(resolvePluginWebFilePath("C:/work/escape.txt", "C:/work")).rejects.toEqual({ code: "plugin.web.forbidden" });
+  } finally { invoke.mockRestore(); }
+});
diff --git a/windows/tauri/src/features/plugins/plugin-web-open-file.ts b/windows/tauri/src/features/plugins/plugin-web-open-file.ts
new file mode 100644
index 0000000000..8df0c99877
--- /dev/null
+++ b/windows/tauri/src/features/plugins/plugin-web-open-file.ts
@@ -0,0 +1,126 @@
+import { removeDeclarativeUI, refreshDeclarativeUI } from "./declarative-plugin-ui";
+import { workspaceRuntimeRegistry } from "@/features/workspace/runtime/workspace-runtime-registry";
+import { invoke } from "@/platform/tauri-core";
+import { assertPluginActive, setPluginActive } from "./declarative-plugin-lifecycle";
+import { useBufferStore } from "@/features/editor/stores/buffer.store";
+import { getBufferByPath } from "@/features/editor/utils/buffer-index";
+import { listen } from "@tauri-apps/api/event";
+import { getCurrentWindow } from "@tauri-apps/api/window";
+import { useFileSystemStore } from "@/features/file-system/stores/file-system.store";
+import { invokeLsp } from "@/platform/lsp-core-adapter";
+import { declarativePluginProcessOwner } from "./declarative-plugin-process-owner";
+import { resolvePluginWebFilePath } from "./plugin-web-path";
+import { initializePluginWebAppearanceSync } from "./plugin-web-appearance";
+
+interface PluginWebOpenFilePayload {
+  pluginId: string;
+  operationId: string;
+  workspaceId: string;
+  workspacePath: string;
+  path: string | null;
+  line: number | null;
+  column: number | null;
+}
+
+/**
+ * Handles `workspace.openFile` bridge requests from plugin web pages. The
+ * Rust bridge authorizes the calling page's plugin; this listener routes the
+ * request into the workspace's canonical file-open entry and confines the
+ * path to the open workspace root (the bridge contract only allows paths
+ * inside the workspace).
+ */
+export async function initializePluginWebOpenFileListener(): Promise<() => void> {
+  const unlisten = await listen<PluginWebOpenFilePayload>(
+    "plugin-web-open-file",
+    async ({ payload }) => {
+      if (!payload?.operationId) return;
+      let failure: string | null = null;
+      try {
+        if (!payload.path) throw new Error("file path is missing");
+        const store = useFileSystemStore.getState();
+        const root = store.rootFolderPath;
+        if (
+          !root ||
+          payload.workspacePath !== root ||
+          payload.workspaceId !== workspaceRuntimeRegistry.getActiveWorkspaceId()
+        )
+          throw new Error("page workspace is no longer active");
+        const resolvedPath = await resolvePluginWebFilePath(payload.path, root);
+        if (
+          useFileSystemStore.getState().rootFolderPath !== root ||
+          payload.workspaceId !== workspaceRuntimeRegistry.getActiveWorkspaceId()
+        )
+          throw new Error("page workspace changed during file resolution");
+        assertPluginActive(payload.pluginId);
+        await store.handleFileSelect(
+          resolvedPath,
+          false,
+          payload.line ?? undefined,
+          payload.column ?? undefined,
+          undefined,
+          false,
+        );
+        if (
+          useFileSystemStore.getState().rootFolderPath !== root ||
+          payload.workspaceId !== workspaceRuntimeRegistry.getActiveWorkspaceId()
+        )
+          throw new Error("page workspace changed while opening the file");
+        const editor = useBufferStore.getStore(payload.workspaceId).getState();
+        const opened = getBufferByPath(editor.buffers, resolvedPath);
+        // The shared file-open handler also resolves after a stale request or
+        // a read error, so its promise alone cannot acknowledge success.
+        if (!opened || editor.activeBufferId !== opened.id)
+          throw new Error("the editor did not open the requested file");
+      } catch (error) {
+        failure = String(error);
+      }
+      await invoke("declarative_plugins_web_open_file_ack", {
+        operationId: payload.operationId,
+        error: failure,
+      });
+    },
+    { target: { kind: "Window", label: getCurrentWindow().label } },
+  );
+  return unlisten;
+}
+
+/**
+ * Stops declarative run sessions owned by a plugin whose state changed
+ * (disable/uninstall) and releases its web-page state.
+ */
+async function initializePluginLifecycleListener(): Promise<() => void> {
+  const unlisten = await listen<{ pluginId: string; active: boolean; operationId?: string }>(
+    "declarative-plugin-lifecycle",
+    async ({ payload }) => {
+      setPluginActive(payload.pluginId, payload.active);
+      if (!payload.active) removeDeclarativeUI(payload.pluginId);
+      else await refreshDeclarativeUI();
+      if (!payload.operationId) return;
+      const outcomes = await Promise.allSettled([
+        declarativePluginProcessOwner.stop(undefined, payload.pluginId),
+        invokeLsp("lsp_stop_for_provider", { providerId: payload.pluginId }),
+      ]);
+      const failure = outcomes.find((outcome) => outcome.status === "rejected");
+      await invoke("declarative_plugins_lifecycle_ack", {
+        operationId: payload.operationId,
+        error: failure?.status === "rejected" ? String(failure.reason) : null,
+      });
+    },
+    // Tauri's default Any target also receives events emitted to other labels.
+    // Each product window must drain and acknowledge only its own event.
+    { target: { kind: "Window", label: getCurrentWindow().label } },
+  );
+  return unlisten;
+}
+
+/** Registers both plugin-page listeners (open-file and lifecycle). */
+export async function initializePluginWebListeners(): Promise<() => void> {
+  const unlistenOpen = await initializePluginWebOpenFileListener();
+  const unlistenLifecycle = await initializePluginLifecycleListener();
+  const stopAppearanceSync = initializePluginWebAppearanceSync();
+  return () => {
+    unlistenOpen();
+    unlistenLifecycle();
+    stopAppearanceSync();
+  };
+}
diff --git a/windows/tauri/src/features/plugins/plugin-web-path.ts b/windows/tauri/src/features/plugins/plugin-web-path.ts
new file mode 100644
index 0000000000..480f384746
--- /dev/null
+++ b/windows/tauri/src/features/plugins/plugin-web-path.ts
@@ -0,0 +1,6 @@
+import { invoke } from "@/platform/tauri-core";
+
+/** The native host resolves every path component, including directory junctions. */
+export function resolvePluginWebFilePath(path: string, workspacePath: string): Promise<string> {
+  return invoke<string>("declarative_plugins_web_resolve_file", { path, workspacePath });
+}
diff --git a/windows/tauri/src/features/run-actions/components/run-actions-button.tsx b/windows/tauri/src/features/run-actions/components/run-actions-button.tsx
index b3eb5922b9..d13a1c3d39 100644
--- a/windows/tauri/src/features/run-actions/components/run-actions-button.tsx
+++ b/windows/tauri/src/features/run-actions/components/run-actions-button.tsx
@@ -1,4 +1,5 @@
 import { runExtensionAction } from "@/extensions/run/extension-run-actions";
+import { runDeclarativeAction } from "@/features/plugins/declarative-plugin-run";
 import { RefreshCw } from "lucide-react";
 import { useEffect, useMemo, useRef, useState } from "react";
 import {
@@ -131,7 +132,7 @@ export default function RunActionsButton() {
   const [draft, setDraft] = useState<RunActionDraft>(EMPTY_DRAFT);
   const triggerRef = useRef<HTMLDivElement>(null);
   const searchInputRef = useRef<HTMLInputElement>(null);
-  const { projectActions, lspActions, isDiscovering, discoveryError, refresh } =
+  const { projectActions, declarativeActions, lspActions, isDiscovering, discoveryError, refresh } =
     useRunActionDiscovery(
       workspaceId,
       workspacePath,
@@ -164,8 +165,15 @@ export default function RunActionsButton() {
     () => customRunActions.filter((action) => matchesRunAction(action, query)),
     [customRunActions, query],
   );
+  const visibleDeclarativeActions = useMemo(
+    () => declarativeActions.filter((action) => matchesRunAction(action, query)),
+    [declarativeActions, query],
+  );
   const firstVisibleAction =
-    visibleLspActions[0] ?? visibleProjectActions[0] ?? visibleCustomActions[0];
+    visibleLspActions[0] ??
+    visibleProjectActions[0] ??
+    visibleDeclarativeActions[0] ??
+    visibleCustomActions[0];
   const hasVisibleActions = Boolean(firstVisibleAction);
 
   const closeMenu = () => setIsMenuOpen(false);
@@ -185,6 +193,14 @@ export default function RunActionsButton() {
   };
 
   const runAction = (action: RunActionItem) => {
+    if (action.source === "declarative") {
+      if (workspacePath && activeFilePath)
+        void runDeclarativeAction(action, workspaceId, workspacePath, activeFilePath).catch(
+          (error) => toast.error(String(error)),
+        );
+      closeMenu();
+      return;
+    }
     if (action.source === "extension") {
       if (workspacePath)
         void runExtensionAction(action, workspaceId, workspacePath).catch((error) =>
@@ -352,6 +368,11 @@ export default function RunActionsButton() {
               actions={visibleLspActions}
               onRun={runAction}
             />
+            <RunActionSection
+              label={t("run.declarativePlugins")}
+              actions={visibleDeclarativeActions}
+              onRun={runAction}
+            />
             <RunActionSection
               label={t("run.detectedInProject")}
               actions={visibleProjectActions}
diff --git a/windows/tauri/src/features/run-actions/hooks/use-run-action-discovery.ts b/windows/tauri/src/features/run-actions/hooks/use-run-action-discovery.ts
index 0147528015..071b7fff65 100644
--- a/windows/tauri/src/features/run-actions/hooks/use-run-action-discovery.ts
+++ b/windows/tauri/src/features/run-actions/hooks/use-run-action-discovery.ts
@@ -1,4 +1,5 @@
 import { uiExtensionHost } from "@/extensions/ui/services/ui-extension-host";
+import { declarativeRunActionsForFile } from "@/features/plugins/declarative-plugin-run";
 import { useExtensionStore } from "@/extensions/registry/extension-store";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { useBufferStore } from "@/features/editor/stores/buffer.store";
@@ -98,6 +99,25 @@ export function useRunActionDiscovery(
     };
   }, [activeFilePath, enabled, workspacePath]);
 
+  const [declarativeActions, setDeclarativeActions] = useState<RunActionItem[]>([]);
+  useEffect(() => {
+    if (!enabled || !activeFilePath) {
+      setDeclarativeActions([]);
+      return;
+    }
+    let cancelled = false;
+    void declarativeRunActionsForFile(activeFilePath)
+      .then((actions) => {
+        if (!cancelled) setDeclarativeActions(actions);
+      })
+      .catch(() => {
+        if (!cancelled) setDeclarativeActions([]);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [activeFilePath, enabled, revision]);
+
   const lspActions = useMemo(
     () =>
       activeFilePath
@@ -114,6 +134,7 @@ export function useRunActionDiscovery(
     projectActions: projectActions.filter(
       (action) => !action.extensionId || enabledExtensions.split("\n").includes(action.extensionId),
     ),
+    declarativeActions,
     lspActions,
     isDiscovering,
     discoveryError,
diff --git a/windows/tauri/src/features/run-actions/types/run-action.types.ts b/windows/tauri/src/features/run-actions/types/run-action.types.ts
index 98070de0a4..fc624e67b7 100644
--- a/windows/tauri/src/features/run-actions/types/run-action.types.ts
+++ b/windows/tauri/src/features/run-actions/types/run-action.types.ts
@@ -10,9 +10,14 @@ export type RunActionSource =
   | "go"
   | "python"
   | "extension"
-  | "lsp";
+  | "lsp"
+  | "declarative";
 
 export interface RunActionItem {
+  /** Owning declarative plugin, for `source: "declarative"` items. */
+  declarativeOwner?: { pluginId: string; languageId: string };
+  /** Route this declarative action through the plugin's test template. */
+  declarativeTest?: boolean;
   id: string;
   name: string;
   command?: string;
diff --git a/windows/tauri/src/features/run-actions/utils/run-action-discovery.ts b/windows/tauri/src/features/run-actions/utils/run-action-discovery.ts
index 121cca10f7..a7d8cd93a8 100644
--- a/windows/tauri/src/features/run-actions/utils/run-action-discovery.ts
+++ b/windows/tauri/src/features/run-actions/utils/run-action-discovery.ts
@@ -36,6 +36,7 @@ const SOURCE_PRIORITY: Record<RunActionSource, number> = {
   go: 6,
   python: 7,
   extension: 8,
+  declarative: 9,
 };
 
 export function javaTestActionsForFile(
diff --git a/windows/tauri/src/features/run/hooks/use-run-process-events.test.ts b/windows/tauri/src/features/run/hooks/use-run-process-events.test.ts
index 4a5b2d9e15..ca7a31c5b9 100644
--- a/windows/tauri/src/features/run/hooks/use-run-process-events.test.ts
+++ b/windows/tauri/src/features/run/hooks/use-run-process-events.test.ts
@@ -11,6 +11,7 @@ const globalListen = mock(async () => () => {});
 const appendOutput = mock(() => undefined);
 const finishProcess = mock(() => undefined);
 const releaseRunSessionWorkspace = mock(() => undefined);
+const declarativeFinished = mock(() => undefined);
 
 const actualRunStore = await import("../stores/run.store");
 
@@ -21,6 +22,9 @@ mock.module("@tauri-apps/api/webviewWindow", () => ({
   }),
 }));
 mock.module("@tauri-apps/api/event", () => ({ listen: globalListen }));
+mock.module("@/features/plugins/declarative-plugin-process-owner", () => ({
+  declarativePluginProcessOwner: { finished: declarativeFinished },
+}));
 mock.module("../stores/run.store", () => ({
   ...actualRunStore,
   runStoreForSession: () => ({
@@ -38,6 +42,7 @@ describe("run process event listeners", () => {
     appendOutput.mockClear();
     finishProcess.mockClear();
     releaseRunSessionWorkspace.mockClear();
+    declarativeFinished.mockClear();
   });
 
   test("concurrent owners register run-output and run-exit only once on the current webview", async () => {
@@ -68,4 +73,11 @@ describe("run process event listeners", () => {
 
     expect(appendOutput).toHaveBeenCalledWith("primary", "hello\n");
   });
+
+  test("releases declarative process ownership when a run exits", () => {
+    const exitHandler = eventHandlers.get("run-exit");
+    expect(exitHandler).toBeDefined();
+    exitHandler?.({ payload: { sessionId: "declarative:php:1", exitCode: 0 } });
+    expect(declarativeFinished).toHaveBeenCalledWith("declarative:php:1");
+  });
 });
diff --git a/windows/tauri/src/features/run/hooks/use-run-process-events.ts b/windows/tauri/src/features/run/hooks/use-run-process-events.ts
index 55851bf9d7..3ed84f3157 100644
--- a/windows/tauri/src/features/run/hooks/use-run-process-events.ts
+++ b/windows/tauri/src/features/run/hooks/use-run-process-events.ts
@@ -1,4 +1,5 @@
 import { extensionProcessOwner } from "@/extensions/run/extension-process-owner";
+import { declarativePluginProcessOwner } from "@/features/plugins/declarative-plugin-process-owner";
 import type { UnlistenFn } from "@tauri-apps/api/event";
 import { getCurrentWebviewWindow } from "@tauri-apps/api/webviewWindow";
 import { releaseRunSessionWorkspace, runStoreForSession } from "../stores/run.store";
@@ -44,6 +45,7 @@ async function installRunProcessListeners(): Promise<void> {
         .actions.finishProcess(sessionId, event.payload.exitCode);
       releaseRunSessionWorkspace(sessionId);
       extensionProcessOwner.finished(sessionId);
+      declarativePluginProcessOwner.finished(sessionId);
     });
   }
 }
diff --git a/windows/tauri/src/features/settings/components/settings-hierarchy.test.tsx b/windows/tauri/src/features/settings/components/settings-hierarchy.test.tsx
index d380a4cf05..db354d2a36 100644
--- a/windows/tauri/src/features/settings/components/settings-hierarchy.test.tsx
+++ b/windows/tauri/src/features/settings/components/settings-hierarchy.test.tsx
@@ -75,10 +75,19 @@ test("every settings page belongs to exactly one group or is a top-level page, i
   ]);
   expect(
     settingsSidebarLayout.flatMap((entry) => (entry.type === "page" ? [entry.id] : [])),
-  ).toEqual(["plugins"]);
+  ).toEqual(["plugins", "declarative-plugins"]);
   expect(
     settingsSidebarLayout.map((entry) => (entry.type === "group" ? entry.group.id : entry.id)),
-  ).toEqual(["appearance", "plugins", "version-control", "build", "languages", "tools", "ai"]);
+  ).toEqual([
+    "appearance",
+    "plugins",
+    "declarative-plugins",
+    "version-control",
+    "build",
+    "languages",
+    "tools",
+    "ai",
+  ]);
   for (const language of ["en-US", "zh-CN"] as const) {
     const t = createTranslator(language);
     expect(settingsGroups.map(({ labelKey }) => t(labelKey))).toEqual(
diff --git a/windows/tauri/src/features/settings/components/settings-panels.tsx b/windows/tauri/src/features/settings/components/settings-panels.tsx
index ef548c87ea..0d5243145e 100644
--- a/windows/tauri/src/features/settings/components/settings-panels.tsx
+++ b/windows/tauri/src/features/settings/components/settings-panels.tsx
@@ -60,6 +60,7 @@ export type SettingsCategory =
   | "editor"
   | "keyboard"
   | "plugins"
+  | "declarative-plugins"
   | "terminal"
   | "lsp"
   | "maven"
@@ -76,6 +77,12 @@ const PluginsPanel = lazy(() =>
   })),
 );
 
+const DeclarativePluginsPanel = lazy(() =>
+  import("@/features/plugins/declarative-plugins-section").then(
+    ({ DeclarativePluginsSection }) => ({ default: DeclarativePluginsSection }),
+  ),
+);
+
 function GeneralPanel() {
   const { t } = useTranslation();
   const settings = useSettingsStore((state) => state.settings);
@@ -616,6 +623,12 @@ export function SettingsPanel({
           <PluginsPanel presentation="settings" />
         </Suspense>
       );
+    case "declarative-plugins":
+      return (
+        <Suspense fallback={null}>
+          <DeclarativePluginsPanel />
+        </Suspense>
+      );
     case "terminal":
       return <TerminalPanel />;
     case "lsp":
diff --git a/windows/tauri/src/features/settings/lib/settings-navigation.ts b/windows/tauri/src/features/settings/lib/settings-navigation.ts
index 11793d540a..87e3a5f656 100644
--- a/windows/tauri/src/features/settings/lib/settings-navigation.ts
+++ b/windows/tauri/src/features/settings/lib/settings-navigation.ts
@@ -60,6 +60,7 @@ export const settingsSidebarLayout: ReadonlyArray<
 > = [
   { type: "group", group: appearanceGroup },
   { type: "page", id: "plugins" },
+  { type: "page", id: "declarative-plugins" },
   { type: "group", group: versionControlGroup },
   { type: "group", group: buildGroup },
   { type: "group", group: languagesGroup },
@@ -141,6 +142,18 @@ export const settingsCategories: Array<{
       "settings.mac.layout",
     ],
   },
+  {
+    id: "declarative-plugins",
+    labelKey: "settings.declarativePlugins.title",
+    terms: [
+      "Declarative plugins",
+      "Contract v1",
+      "插件包",
+      "声明式插件",
+      "settings.declarativePlugins.title",
+      "settings.declarativePlugins.import",
+    ],
+  },
   {
     id: "plugins",
     labelKey: "settings.tabs.plugins",
diff --git a/windows/tauri/src/features/window/components/window-menu-bar.tsx b/windows/tauri/src/features/window/components/window-menu-bar.tsx
index 91917db405..564bbe0baf 100644
--- a/windows/tauri/src/features/window/components/window-menu-bar.tsx
+++ b/windows/tauri/src/features/window/components/window-menu-bar.tsx
@@ -1,3 +1,4 @@
+import { useUIExtensionStore } from "@/extensions/ui/stores/ui-extension-store";
 import { openNewEntry } from "@/features/file-explorer/stores/new-entry.store";
 import { useFileSystemStore } from "@/features/file-system/stores/file-system.store";
 import { useUIState } from "@/features/window/stores/ui-state.store";
@@ -43,6 +44,7 @@ const WindowMenuBar = ({
 }: Props) => {
   const { t } = useTranslation();
   const themes = useRegisteredThemes();
+  const pluginCommands = useUIExtensionStore((state) => state.commands);
   const rootFolderPath = useFileSystemStore((state) => state.rootFolderPath);
   const canCreateJava = !!rootFolderPath && !/^(?:remote|wsl):\/\//.test(rootFolderPath);
   const menuWindowRaiseRef = useRef<{ restoreTo: boolean } | null>(null);
@@ -488,6 +490,11 @@ const WindowMenuBar = ({
       ),
       Tools: (
         <MenubarContent>
+          {[...pluginCommands.values()].filter((command) => command.placements?.includes("menu")).map((command) => (
+            <MenubarItem key={command.id} onClick={() => { closeMenu(); void Promise.resolve(command.execute()).catch(console.error); }}>
+              {command.title}
+            </MenubarItem>
+          ))}
           <MenubarItem
             onClick={() => handleCommand("database.connect")}
             disabled={!isBackendCapabilityAvailable("database")}
@@ -579,6 +586,7 @@ const WindowMenuBar = ({
       ),
     }),
     [
+      pluginCommands,
       closeMenu,
       handleClickEmit,
       handleCommand,
diff --git a/windows/tauri/src/features/workspace/services/workspace-git-bootstrap.test.ts b/windows/tauri/src/features/workspace/services/workspace-git-bootstrap.test.ts
index 10123bacaa..ade67beee4 100644
--- a/windows/tauri/src/features/workspace/services/workspace-git-bootstrap.test.ts
+++ b/windows/tauri/src/features/workspace/services/workspace-git-bootstrap.test.ts
@@ -32,7 +32,12 @@ const resolveJavaLspLaunch = mock(async () => ({
   arguments: [], environment: {}, cacheDirectory: "C:/runtime/cache",
 }));
 const mavenLaunchContextForWorkspace = mock(async () => null);
-const dependencies = { ensureWorkspaceGitBootstrap, resolveJavaLspLaunch, mavenLaunchContextForWorkspace };
+const dependencies = {
+  ensureWorkspaceGitBootstrap,
+  resolveJavaLspLaunch,
+  mavenLaunchContextForWorkspace,
+  resolveDeclarativePluginLaunch: async () => null,
+};
 let invokeSpy: ReturnType<typeof spyOn<typeof tauriCore, "invoke">>;
 
 function openRuntime() {
diff --git a/windows/tauri/src/features/workspace/services/workspace-lifecycle.test.ts b/windows/tauri/src/features/workspace/services/workspace-lifecycle.test.ts
index 416594278a..7c0c97eb0d 100644
--- a/windows/tauri/src/features/workspace/services/workspace-lifecycle.test.ts
+++ b/windows/tauri/src/features/workspace/services/workspace-lifecycle.test.ts
@@ -8,6 +8,11 @@ const released: string[] = [];
 // Native registry owners claimed by this window, so tests can observe leaked claims.
 const ownedByThisWindow = new Set<string>();
 const revokedIdeWorkspaces: string[] = [];
+const stoppedDeclarativeWorkspaces: string[] = [];
+const closedPluginWorkspaces: string[] = [];
+mock.module("@/platform/tauri-core", () => ({ invoke: async (command: string, args: { workspaceId: string }) => {
+  if (command === "declarative_plugins_close_workspace_pages") closedPluginWorkspaces.push(args.workspaceId);
+} }));
 mock.module("@/features/host-api/mcp-connection", () => ({
   disableMcp: async (id: string) => {
     revokedIdeWorkspaces.push(id);
@@ -39,6 +44,13 @@ const actions = {
 mock.module("@/extensions/run/extension-process-owner", () => ({
   extensionProcessOwner: { stop: async () => {} },
 }));
+mock.module("@/features/plugins/declarative-plugin-process-owner", () => ({
+  declarativePluginProcessOwner: {
+    stop: async (workspaceId: string) => {
+      stoppedDeclarativeWorkspaces.push(workspaceId);
+    },
+  },
+}));
 mock.module("@/features/settings/stores/settings.store", () => ({
   useSettingsStore: { getState: () => ({ settings: { theme: "dark" } }) },
 }));
@@ -91,6 +103,8 @@ beforeEach(() => {
   released.length = 0;
   ownedByThisWindow.clear();
   revokedIdeWorkspaces.length = 0;
+  stoppedDeclarativeWorkspaces.length = 0;
+  closedPluginWorkspaces.length = 0;
 });
 afterEach(() => {
   mock.restore();
@@ -171,6 +185,8 @@ test("closing a project revokes IDE access before disposal and then releases own
     }),
   ).toBe(true);
   expect(disposed).toBe(true);
+  expect(stoppedDeclarativeWorkspaces).toEqual([id]);
+  expect(closedPluginWorkspaces).toEqual([id]);
   expect(released).toEqual([id]);
   expect(tabs).toEqual([]);
 });
diff --git a/windows/tauri/src/features/workspace/services/workspace-lifecycle.ts b/windows/tauri/src/features/workspace/services/workspace-lifecycle.ts
index 3daee438b0..7739b1454e 100644
--- a/windows/tauri/src/features/workspace/services/workspace-lifecycle.ts
+++ b/windows/tauri/src/features/workspace/services/workspace-lifecycle.ts
@@ -1,4 +1,5 @@
 import { extensionProcessOwner } from "@/extensions/run/extension-process-owner";
+import { declarativePluginProcessOwner } from "@/features/plugins/declarative-plugin-process-owner";
 import { workspaceRuntimeRegistry } from "@/features/workspace/runtime/workspace-runtime-registry";
 import { useSettingsStore } from "@/features/settings/stores/settings.store";
 import type { WorkspaceRuntimeDescriptor } from "@/features/workspace/types/workspace-runtime.types";
@@ -486,6 +487,9 @@ async function closeWorkspaceRuntimeOnce(
   const { disableMcp } = await import("@/features/host-api/mcp-connection");
   await disableMcp(workspaceId);
   await extensionProcessOwner.stop(workspaceId);
+  await declarativePluginProcessOwner.stop(workspaceId);
+  const { invoke: invokePluginHost } = await import("@/platform/tauri-core");
+  await invokePluginHost("declarative_plugins_close_workspace_pages", { workspaceId });
   await dispose?.(path);
 
   // Defensive: nothing can reactivate a closing project, but never leave the registry
diff --git a/windows/tauri/src/i18n/shared-i18n.test.ts b/windows/tauri/src/i18n/shared-i18n.test.ts
index c0f051bc34..add9ccf40e 100644
--- a/windows/tauri/src/i18n/shared-i18n.test.ts
+++ b/windows/tauri/src/i18n/shared-i18n.test.ts
@@ -57,4 +57,19 @@ describe("Shared built-in translations", () => {
       expect(t(key)).toBe(key);
     expect(t("quickOpen.filesCount", Object.create({ count: 3 }))).toBe("{count} files");
   });
+
+  test("declarative plugin labels and review parameters survive shared catalog migration", () => {
+    for (const [language, group, review, programs, toggle] of [
+      ["en-US", "Declarative plugins", "Install Demo {version} 1.0?", "Program declaration (0)", "Enable or disable Demo"],
+      ["zh-CN", "声明式插件", "安装 Demo {version} 1.0？", "程序声明（0 项）", "启用或停用 Demo"],
+    ] as const) {
+      const t = createTranslator(language);
+      expect(t("run.declarativePlugins")).toBe(group);
+      expect(t("settings.declarativePlugins.reviewTitle", {
+        name: "Demo {version}", version: "1.0",
+      })).toBe(review);
+      expect(t("settings.declarativePlugins.programDeclaration", { count: 0 })).toBe(programs);
+      expect(t("settings.declarativePlugins.toggle", { name: "Demo" })).toBe(toggle);
+    }
+  });
 });
diff --git a/windows/tauri/src/i18n/shared.generated.ts b/windows/tauri/src/i18n/shared.generated.ts
index 50ee829304..2534b6d1fa 100644
--- a/windows/tauri/src/i18n/shared.generated.ts
+++ b/windows/tauri/src/i18n/shared.generated.ts
@@ -3907,6 +3907,7 @@ export const sharedCatalogs = {
     "run.configurations": "Run configurations",
     "run.currentFile": "Current file",
     "run.custom": "Custom",
+    "run.declarativePlugins": "Declarative plugins",
     "run.deleteAction": "Delete run action",
     "run.deleteActionMessage": "Delete the run action “{name}”?",
     "run.detectedInProject": "Detected in project",
@@ -4177,6 +4178,38 @@ export const sharedCatalogs = {
     "settings.appearance.windowTransparencyDescription": "Use translucent app chrome and transparent native windows where supported",
     "settings.common.allFiles": "All Files",
     "settings.common.json": "JSON",
+    "settings.declarativePlugins.closeWindow": "Close",
+    "settings.declarativePlugins.confirmInstall": "Install",
+    "settings.declarativePlugins.description": "Packages that declare processes; the host launches them after an install review. Themes and Worker extensions live in the Extensions browser.",
+    "settings.declarativePlugins.empty": "No declarative plugins installed.",
+    "settings.declarativePlugins.hideSettings": "Hide settings",
+    "settings.declarativePlugins.import": "Import package…",
+    "settings.declarativePlugins.openWindow": "Open",
+    "settings.declarativePlugins.placement.bottom": "bottom",
+    "settings.declarativePlugins.placement.left": "left",
+    "settings.declarativePlugins.placement.right": "right",
+    "settings.declarativePlugins.programDeclaration": "Program declaration ({count})",
+    "settings.declarativePlugins.reviewTitle": "Install {name} {version}?",
+    "settings.declarativePlugins.rollback": "Roll back",
+    "settings.declarativePlugins.settingEffect.immediate": "applied to the running language server",
+    "settings.declarativePlugins.settingEffect.nextRun": "takes effect on the next run",
+    "settings.declarativePlugins.settingEffect.reload": "takes effect when the plugin model reloads",
+    "settings.declarativePlugins.settingEffect.restart": "takes effect after the language server restarts",
+    "settings.declarativePlugins.settingScope.global": "all workspaces",
+    "settings.declarativePlugins.settingScope.project": "this workspace",
+    "settings.declarativePlugins.settingSource.default": "default",
+    "settings.declarativePlugins.settingSource.global": "user value",
+    "settings.declarativePlugins.settingSource.project": "project override",
+    "settings.declarativePlugins.settings": "Settings",
+    "settings.declarativePlugins.settingsUnavailable": "This plugin's settings could not be resolved.",
+    "settings.declarativePlugins.showSettings": "Settings…",
+    "settings.declarativePlugins.source.bundled": "bundled",
+    "settings.declarativePlugins.source.installed": "installed",
+    "settings.declarativePlugins.title": "Declarative plugins (contract v1)",
+    "settings.declarativePlugins.toggle": "Enable or disable {name}",
+    "settings.declarativePlugins.uninstall": "Uninstall",
+    "settings.declarativePlugins.unverified": "Unverified publisher: this package has no signature. Its permissions and programs are shown below.",
+    "settings.declarativePlugins.webWindows": "Web tool windows",
     "settings.displayLanguage": "Display Language",
     "settings.displayLanguageDescription": "Choose the language used throughout Lithe.",
     "settings.editor.autoCompletion": "Auto Completion",
@@ -9011,6 +9044,7 @@ export const sharedCatalogs = {
     "run.configurations": "运行配置",
     "run.currentFile": "当前文件",
     "run.custom": "自定义",
+    "run.declarativePlugins": "声明式插件",
     "run.deleteAction": "删除运行操作",
     "run.deleteActionMessage": "要删除运行操作“{name}”吗？",
     "run.detectedInProject": "项目中检测到",
@@ -9281,6 +9315,38 @@ export const sharedCatalogs = {
     "settings.appearance.windowTransparencyDescription": "在支持时使用半透明应用框架和透明原生窗口",
     "settings.common.allFiles": "所有文件",
     "settings.common.json": "JSON",
+    "settings.declarativePlugins.closeWindow": "关闭",
+    "settings.declarativePlugins.confirmInstall": "安装",
+    "settings.declarativePlugins.description": "以声明方式提供进程的插件包，宿主在安装审查后代为拉起。主题与 Worker 扩展请在扩展浏览器中管理。",
+    "settings.declarativePlugins.empty": "尚未安装声明式插件。",
+    "settings.declarativePlugins.hideSettings": "收起设置",
+    "settings.declarativePlugins.import": "导入包…",
+    "settings.declarativePlugins.openWindow": "打开",
+    "settings.declarativePlugins.placement.bottom": "底部",
+    "settings.declarativePlugins.placement.left": "左侧",
+    "settings.declarativePlugins.placement.right": "右侧",
+    "settings.declarativePlugins.programDeclaration": "程序声明（{count} 项）",
+    "settings.declarativePlugins.reviewTitle": "安装 {name} {version}？",
+    "settings.declarativePlugins.rollback": "回滚",
+    "settings.declarativePlugins.settingEffect.immediate": "立即应用到运行中的语言服务器",
+    "settings.declarativePlugins.settingEffect.nextRun": "下次运行生效",
+    "settings.declarativePlugins.settingEffect.reload": "插件模型重新加载后生效",
+    "settings.declarativePlugins.settingEffect.restart": "语言服务器重启后生效",
+    "settings.declarativePlugins.settingScope.global": "所有工作区",
+    "settings.declarativePlugins.settingScope.project": "当前工作区",
+    "settings.declarativePlugins.settingSource.default": "默认",
+    "settings.declarativePlugins.settingSource.global": "用户值",
+    "settings.declarativePlugins.settingSource.project": "项目覆盖",
+    "settings.declarativePlugins.settings": "设置",
+    "settings.declarativePlugins.settingsUnavailable": "无法解析该插件的设置。",
+    "settings.declarativePlugins.showSettings": "设置…",
+    "settings.declarativePlugins.source.bundled": "内置",
+    "settings.declarativePlugins.source.installed": "已安装",
+    "settings.declarativePlugins.title": "声明式插件（契约 v1）",
+    "settings.declarativePlugins.toggle": "启用或停用 {name}",
+    "settings.declarativePlugins.uninstall": "卸载",
+    "settings.declarativePlugins.unverified": "未认证发布者：该包没有签名。其权限与程序声明如下。",
+    "settings.declarativePlugins.webWindows": "Web 工具窗口",
     "settings.displayLanguage": "显示语言",
     "settings.displayLanguageDescription": "选择 Lithe 界面使用的语言。",
     "settings.editor.autoCompletion": "自动补全",
diff --git a/windows/tauri/src/platform/lsp-core-adapter.test.ts b/windows/tauri/src/platform/lsp-core-adapter.test.ts
index 83d5559014..170e4d8f77 100644
--- a/windows/tauri/src/platform/lsp-core-adapter.test.ts
+++ b/windows/tauri/src/platform/lsp-core-adapter.test.ts
@@ -29,6 +29,7 @@ const frontendTrace = mock(() => undefined);
 const cancelCoreOperation = mock(async () => false);
 const commands: string[] = [];
 let scenario:
+  | "held-plugin-start"
   | "poll-failure"
   | "preparation-snapshot"
   | "capabilities"
@@ -39,6 +40,9 @@ let scenario:
   | "semantic-request"
   | "structured-log"
   | "virtual-document" = "failure";
+let pluginStartGate: Promise<void> | undefined;
+let pluginStartEntered: (() => void) | undefined;
+let releasePluginStart: (() => void) | undefined;
 let startPayload: Record<string, unknown> | undefined;
 let requestPayload: Record<string, unknown> | undefined;
 const requestPayloads: Record<string, unknown>[] = [];
@@ -110,6 +114,10 @@ const executeCore = mock(
     if (request.command === "lsp.startServer") {
       startCount += 1;
       startPayload = request.payload;
+      if (scenario === "held-plugin-start") {
+        pluginStartEntered?.();
+        await pluginStartGate;
+      }
       const sessionId =
         scenario === "failure"
           ? "failed-java-session"
@@ -1820,4 +1828,44 @@ describe("Rust Core LSP adapter failures", () => {
       }
     }
   });
+  test("declarative launch forwards Core plugin identity and configuration", async () => {
+    scenario = "capabilities";
+    await invokeLsp("lsp_start_for_file", {
+      workspacePath: "C:/work", filePath: "C:/work/Main.go", languageId: "go",
+      providerId: "acme.lang", pluginId: "acme.lang", serverPath: "fixture.exe",
+      workspaceConfiguration: { gopls: { enabled: true } },
+    });
+    expect(startPayload?.pluginId).toBe("acme.lang");
+    expect(startPayload?.workspaceConfiguration).toEqual({ gopls: { enabled: true } });
+  }, 5000);
+
+  test("provider stop drains and destroys an in-flight Core start", async () => {
+    const entered = new Promise<void>((resolve) => { pluginStartEntered = resolve; });
+    pluginStartGate = new Promise<void>((resolve) => { releasePluginStart = resolve; });
+    scenario = "held-plugin-start";
+    const starting = invokeLsp("lsp_start_for_file", {
+      workspacePath: "C:/work", filePath: "C:/work/Main.go", languageId: "go",
+      providerId: "acme.lang", pluginId: "acme.lang", serverPath: "fixture.exe",
+    });
+    const outcome = starting.then(() => "started", () => "cancelled");
+    let stopping: Promise<unknown> | undefined;
+    try {
+      await entered;
+      stopping = invokeLsp("lsp_stop_for_provider", { providerId: "acme.lang" });
+      scenario = "capabilities";
+      releasePluginStart?.();
+      await stopping;
+      expect(await outcome).toBe("cancelled");
+      expect(commands).toContain("lsp.stopServer");
+      expect(commands).toContain("lsp.destroyServer");
+      expect(getLspWorkspaceSessionSnapshot({ workspacePath: "C:/work", languageId: "go" })).toBeNull();
+    } finally {
+      releasePluginStart?.();
+      await Promise.allSettled([outcome, stopping]);
+      pluginStartEntered = undefined;
+      pluginStartGate = undefined;
+      releasePluginStart = undefined;
+    }
+  }, 5000);
+
 });
diff --git a/windows/tauri/src/platform/lsp-core-adapter.ts b/windows/tauri/src/platform/lsp-core-adapter.ts
index 015b8731fd..264ceb5f7b 100644
--- a/windows/tauri/src/platform/lsp-core-adapter.ts
+++ b/windows/tauri/src/platform/lsp-core-adapter.ts
@@ -1,3 +1,4 @@
+import { assertPluginActive } from "@/features/plugins/declarative-plugin-lifecycle";
 import {
   getProjectPreparation,
   failProjectPreparation,
@@ -59,6 +60,9 @@ interface Session {
   id: string;
   workspacePath: string;
   languageId: string;
+  /** Provider identity used to stop all sessions owned by a plugin. */
+  providerId: string;
+  pluginId?: string;
   files: Set<string>;
   lifecycle: LspSessionLifecycle;
   eventPump: EventPumpOwner | null;
@@ -83,6 +87,8 @@ interface StoredSession {
   id: string;
   workspacePath: string;
   languageId: string;
+  providerId?: string;
+  pluginId?: string;
   files: string[];
   features?: string[];
 }
@@ -135,6 +141,8 @@ export interface LspSessionSnapshot {
 const sessions = new Map<string, Session>();
 const fileSessions = new Map<string, FileAttachment>();
 const sessionStarts = new Map<string, Promise<Session>>();
+const startOwners = new Map<string, string>();
+const providerGenerations = new Map<string, number>();
 const sessionStops = new Map<string, Promise<void>>();
 const stoppingSessionIds = new Set<string>();
 const pendingFileSessions = new Map<string, PendingFileAttachment>();
@@ -170,6 +178,8 @@ function persistSessions(): void {
       id: session.id,
       workspacePath: session.workspacePath,
       languageId: session.languageId,
+      providerId: session.providerId,
+      pluginId: session.pluginId,
       files: [...session.files].sort(),
       features:
         session.featureState.phase === "known"
@@ -254,6 +264,7 @@ function restorePersistedSessions(): void {
         typeof stored.languageId !== "string" ||
         !Array.isArray(stored.files) ||
         !stored.files.every((file: unknown) => typeof file === "string") ||
+        (stored.providerId !== undefined && typeof stored.providerId !== "string") ||
         (stored.features !== undefined &&
           (!Array.isArray(stored.features) ||
             !stored.features.every((feature: unknown) => typeof feature === "string")))
@@ -265,6 +276,8 @@ function restorePersistedSessions(): void {
         id: stored.id,
         workspacePath: stored.workspacePath,
         languageId: stored.languageId,
+        providerId: stored.providerId ?? stored.languageId,
+        pluginId: stored.pluginId,
         files: new Set(),
         // Persisted entries are projections of Core state. They must be
         // validated before any new document can attach after a reload.
@@ -671,21 +684,7 @@ async function cleanupFailedStart(
   operationId: string,
 ): Promise<void> {
   if (session.languageId === "java") failProjectPreparation(session.workspacePath, session.id);
-  stoppingSessionIds.add(session.id);
-  if (sessions.get(key) === session) sessions.delete(key);
-  removeSessionMappings(session);
-  persistSessions();
-  try {
-    await stopAndDestroySession(session, operationId);
-  } catch (reason) {
-    frontendTrace("warn", "lsp.runtime", "Language-server cleanup failed", {
-      operationId,
-      sessionId: session.id,
-      error: reason instanceof Error ? reason.message : String(reason),
-    });
-  } finally {
-    stoppingSessionIds.delete(session.id);
-  }
+  await stopSession(session, true);
 }
 
 function sessionForFile(filePath: string, attachmentId?: string): Session {
@@ -782,10 +781,17 @@ async function recoverSession(session: Session): Promise<Session | null> {
   }
 }
 
-async function createSession(args: JsonRecord, key: string): Promise<Session> {
+async function createSession(args: JsonRecord, key: string, generation: number): Promise<Session> {
   const workspacePath = String(args.workspacePath ?? "");
   const languageId = String(args.languageId ?? "plaintext");
   const providerId = String(args.providerId ?? languageId);
+  const assertCurrent = () => {
+    if (args.pluginId) assertPluginActive(args.pluginId);
+    if ((providerGenerations.get(providerId) ?? 0) !== generation) {
+      throw new Error("Language server start was cancelled by its provider.");
+    }
+  };
+  assertCurrent();
   const operationId = crypto.randomUUID();
   const operation = new LspOperationLog("sessionStart", operationId, {
     workspacePath,
@@ -802,12 +808,14 @@ async function createSession(args: JsonRecord, key: string): Promise<Session> {
       "lsp.startServer",
       {
         providerId,
+        pluginId: args.pluginId ?? null,
         executablePath: args.serverPath,
         arguments: args.serverArgs ?? [],
         environment,
         rootUri: fileUri(workspacePath),
         workingDirectory: workspacePath,
         initializationOptions: args.initializationOptions ?? null,
+        workspaceConfiguration: args.workspaceConfiguration ?? null,
         runtimeExecutablePath: args.runtimeExecutablePath ?? null,
         jdtlsLaunchResources: args.jdtlsLaunchResources ?? null,
         cacheDirectory: args.cacheDirectory ?? null,
@@ -829,6 +837,8 @@ async function createSession(args: JsonRecord, key: string): Promise<Session> {
     id: started.sessionId,
     workspacePath,
     languageId,
+    providerId,
+    pluginId: args.pluginId,
     files: new Set(),
     lifecycle: createSessionLifecycle(started.state ?? "initializing", operationId),
     eventPump: null,
@@ -837,11 +847,18 @@ async function createSession(args: JsonRecord, key: string): Promise<Session> {
     completed: new Map(),
     documentVersions: new Map(),
   };
+  try {
+    assertCurrent();
+  } catch (reason) {
+    await stopSession(session);
+    throw reason;
+  }
   sessions.set(key, session);
   if (session.languageId === "java") beginProjectPreparation(session.workspacePath, session.id);
   persistSessions();
   try {
     await waitUntilReady(session);
+    assertCurrent();
   } catch (reason) {
     if (isInitializationTimeout(reason)) {
       const code = (reason as Error & { code?: string }).code;
@@ -883,7 +900,7 @@ async function waitForProjectedReadiness(
   }
 }
 
-async function resolveSession(args: JsonRecord, key: string): Promise<Session> {
+async function resolveSession(args: JsonRecord, key: string, generation: number): Promise<Session> {
   const stopping = sessionStops.get(key);
   if (stopping) await stopping;
 
@@ -900,10 +917,11 @@ async function resolveSession(args: JsonRecord, key: string): Promise<Session> {
     await stopSession(existing);
   }
 
-  return createSession(args, key);
+  return createSession(args, key, generation);
 }
 
 async function start(args: JsonRecord): Promise<void> {
+  if (args.pluginId) assertPluginActive(args.pluginId);
   const workspacePath = String(args.workspacePath ?? "");
   const languageId = String(args.languageId ?? "plaintext");
   const key = sessionKey(workspacePath, languageId);
@@ -933,7 +951,19 @@ async function start(args: JsonRecord): Promise<void> {
     if (!session || !isSessionReady(session.lifecycle)) {
       let startPromise = sessionStarts.get(key);
       if (!startPromise) {
-        startPromise = resolveSession(args, key).finally(() => sessionStarts.delete(key));
+        const providerId = String(args.providerId ?? languageId);
+        const generation = providerGenerations.get(providerId) ?? 0;
+        startOwners.set(key, providerId);
+        startPromise = resolveSession(args, key, generation).then(async (resolved) => {
+          if ((providerGenerations.get(providerId) ?? 0) !== generation) {
+            await stopSession(resolved);
+            throw new Error("Language server start was cancelled by its provider.");
+          }
+          return resolved;
+        }).finally(() => {
+          sessionStarts.delete(key);
+          startOwners.delete(key);
+        });
         sessionStarts.set(key, startPromise);
       }
       session = await startPromise;
@@ -973,8 +1003,8 @@ async function start(args: JsonRecord): Promise<void> {
   }
 }
 
-async function stopSession(session: Session): Promise<void> {
-  if (session.languageId === "java") clearProjectPreparation(session.workspacePath, session.id);
+async function stopSession(session: Session, preservePreparation = false): Promise<void> {
+  if (session.languageId === "java" && !preservePreparation) clearProjectPreparation(session.workspacePath, session.id);
   const key = sessionKey(session.workspacePath, session.languageId);
   stoppingSessionIds.add(session.id);
   removeSessionMappings(session);
@@ -991,12 +1021,15 @@ async function stopSession(session: Session): Promise<void> {
       .then((outcome) => {
         if (outcome === "timedOut") {
           operation.timedOut({ stage: "cleanup" });
+          throw new Error("Language server cleanup timed out.");
         } else {
           operation.succeeded();
         }
       })
       .catch((reason) => {
         operation.failed(reason);
+        sessions.set(key, session);
+        persistSessions();
         throw reason;
       })
       .finally(() => {
@@ -1437,6 +1470,28 @@ export function getLspWorkspaceSessionSnapshot(args: {
   return session ? snapshotForSession(session) : null;
 }
 
+/**
+ * Pushes a declarative plugin's expanded `workspaceConfiguration` to the
+ * running language server for this workspace and language (`effect:`
+ * `immediate` settings). Returns whether a live session received it.
+ */
+export async function pushDeclarativeWorkspaceConfiguration(args: {
+  workspacePath: string;
+  languageId: string;
+  configuration: unknown;
+  pluginId: string;
+}): Promise<boolean> {
+  const session = sessions.get(sessionKey(args.workspacePath, args.languageId));
+  if (!session || session.pluginId !== args.pluginId || !isSessionReady(session.lifecycle)) return false;
+  assertPluginActive(args.pluginId);
+  await core(
+    "lsp.updateWorkspaceConfiguration",
+    { sessionId: session.id, configuration: args.configuration },
+    crypto.randomUUID(),
+  );
+  return true;
+}
+
 function snapshotForSession(session: Session): LspSessionSnapshot {
   return {
     id: session.id,
@@ -1456,6 +1511,23 @@ export async function invokeLsp<T>(command: string, args: JsonRecord = {}): Prom
     await start(args);
     return undefined as T;
   }
+  if (command === "lsp_stop_for_provider") {
+    const providerId = typeof args.providerId === "string" ? args.providerId : "";
+    if (!providerId) return undefined as T;
+    providerGenerations.set(providerId, (providerGenerations.get(providerId) ?? 0) + 1);
+    const pending = [...sessionStarts.entries()]
+      .filter(([key]) => startOwners.get(key) === providerId)
+      .map(([, promise]) => promise);
+    const matches = [...sessions.values()].filter((session) => session.providerId === providerId);
+    await Promise.all(matches.map((session) => stopSession(session)));
+    // A late Core response still owns a process. Its cancelled start cleans it
+    // up before this barrier acknowledges that package files can be changed.
+    await Promise.allSettled(pending);
+    if ([...sessions.values()].some((session) => session.providerId === providerId)) {
+      throw new Error("Plugin language server cleanup failed; package files must be preserved.");
+    }
+    return undefined as T;
+  }
   if (command === "lsp_stop") {
     const preparation = getProjectPreparation(args.workspacePath);
     if (preparation) clearProjectPreparation(args.workspacePath, preparation.sessionId);
@@ -1463,7 +1535,7 @@ export async function invokeLsp<T>(command: string, args: JsonRecord = {}): Prom
       (session) =>
         normalizedPathKey(session.workspacePath) === normalizedPathKey(args.workspacePath),
     );
-    await Promise.all(matches.map(stopSession));
+    await Promise.all(matches.map((session) => stopSession(session)));
     return undefined as T;
   }
   if (command === "lsp_retry_maven_profiles") {