# 1. Diagnosis The request describes a concrete repair plugin & extension failures failure that should be repaired at the owning contract boundary rather than hidden with broad retries, feature disablement, or production-only workarounds. The governing invariant is: **A plugin or extension must be compatibility-checked before activation, own every registration it creates, and deterministically release those registrations on failure, upgrade, disable, or shutdown.** I would treat the supplied scenario as evidence of a lifecycle/contract disagreement, not proof that every adjacent component is broken. The repository path, logs, and tests should be used to identify the first boundary where the invariant stops being true. Any production state, external system behavior, or command result that was not actually observed remains UNKNOWN. # 2. Evidence and failure trace For this case I would trace these specific evidence surfaces: - manifest/API compatibility range. - activation/deactivation lifecycle. - menu/event/command registrations. - host API capability checks. - partial activation failure path. - upgrade/reload behavior. The trace should connect the user-visible symptom to the exact owner that creates, transforms, persists, retries, or disposes the relevant state. Record VERIFIED facts separately from LIKELY causes. If two components disagree, do not duplicate validation in both; identify which layer already owns the documented contract and make that layer authoritative. For the supplied scenario, the most useful reproduction is a minimal local fixture that preserves the failing sequence while removing unrelated infrastructure. Capture before/after state at each boundary so the repair can be proven by state transition rather than by a single final screenshot or log line. # 3. Repair contract The repair should preserve existing authorization, security, public interfaces, and documented product behavior. I would apply these bounded changes in order: 1. validate host capability/version before side-effectful activation. 2. create one activation scope that records every registration/disposer. 3. roll back partial activation in reverse order on failure. 4. make deactivation idempotent and generation-aware. 5. surface an explicit incompatible state instead of crashing after partial registration. Each change should have one owner and one rollback path. Avoid silent fallback that converts an invalid or ambiguous state into apparent success. If an operation has an unknown outcome, preserve that distinction instead of replaying blindly. If the repository already has a canonical adapter/manager for this contract, extend it rather than introducing a second source of truth. # 4. Implementation plan First locate the narrowest functions or objects that own the evidence listed above. Add explicit typed state where the current code relies on an implicit boolean, mutable global, or timing assumption. Keep generation/version/operation identity attached to the state as it crosses boundaries so stale work can be rejected deterministically. Patch only the paths required to restore the invariant. Keep unrelated refactors out of the repair. Add observability only at the boundary needed to distinguish normal, rejected, retried, conflicted, or incomplete outcomes; do not log secrets or sensitive payloads. When an existing retry path is involved, make the retry consume the typed result from the owner instead of reconstructing the whole workflow. When cleanup is involved, make it idempotent and safe after partial initialization. When compatibility is involved, preserve the documented old behavior unless the evidence explicitly requires a product decision. # 5. Deterministic validation Build local tests for the exact failure and adjacent boundary cases: 1. compatible plugin activates exactly once. 2. incompatible host API blocks before side effects. 3. failure after two registrations disposes both. 4. reload/upgrade leaves one active registration set. 5. double deactivate is harmless and shutdown cleans remaining hooks. Every test should assert the internal contract as well as the visible result. Use generated fixtures, fake services, explicit barriers, fake clocks, or deterministic snapshots where practical. Do not rely on arbitrary sleeps or production access. A passing test should fail against the old behavior for the intended reason and pass after the bounded repair. Add one regression proving normal behavior still works, one failure-path test, one retry/cancellation or lifecycle test where relevant, and one security/identity boundary test if the feature crosses users, tenants, credentials, or authority. # 6. Handoff and unknowns Before merge I would confirm the exact repository owner for: manifest/API compatibility range, activation/deactivation lifecycle, menu/event/command registrations, host API capability checks. I would also confirm any policy decision the code cannot infer safely, such as conflict behavior, retry eligibility, retention, compatibility, or rollback limits. No production process, customer data, external account, or live service needs to be touched to validate this repair. From the request alone I would not claim that files were already modified, commands were run, or tests passed. The handoff is a bounded repository repair plus the deterministic matrix above, with remaining UNKNOWN items explicitly listed for the owner.