diff --git a/apps/desktop/src/main/__tests__/runtime-host-ui-extensions-ipc-main.test.ts b/apps/desktop/src/main/__tests__/runtime-host-ui-extensions-ipc-main.test.ts
new file mode 100644
index 0000000000..b8426992c5
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/runtime-host-ui-extensions-ipc-main.test.ts
@@ -0,0 +1,97 @@
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import type { IpcHandler } from '../ipc-reconnect-policy.js';
+import type { DesktopRuntimeHostClient } from '../runtime-host-client.js';
+import { registerRuntimeHostUiExtensionsIpc } from '../runtime-host-ui-extensions-ipc-main.js';
+
+test('user import previews, confirms, installs, and enables one trusted UI and Event package', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-ui-import-'));
+  try {
+    await mkdir(join(root, 'documents'));
+    await mkdir(join(root, 'host'));
+    await mkdir(join(root, 'dist'));
+    await writeFile(
+      join(root, 'maka.extension.json'),
+      JSON.stringify({
+        schemaVersion: 1,
+        id: 'dev.maka.user.ui',
+        runtime: {
+          entry: 'dist/index.mjs',
+          tools: [],
+          events: [
+            {
+              name: 'dev.maka.user.ui.changed',
+              description: 'UI changed.',
+              payloadSchema: { type: 'object' },
+            },
+          ],
+          listeners: [
+            { id: 'changed', event: 'dev.maka.user.ui.changed', handler: 'changed' },
+          ],
+          services: [],
+          timers: [],
+          permissions: { workspace: 'none', network: false },
+        },
+        ui: {
+          contributions: [
+            { id: 'root', surface: 'app.root', priority: 1, document: 'documents/root.html' },
+          ],
+          host: { entry: 'host/service.mjs', methods: [{ name: 'hello', handler: 'hello' }] },
+          permissions: { network: false, hostState: true, sessionAccess: true },
+        },
+      }),
+    );
+    await writeFile(join(root, 'documents', 'root.html'), '<main>hello</main>');
+    await writeFile(join(root, 'host', 'service.mjs'), 'export default { hello: () => "world" };');
+    await writeFile(
+      join(root, 'dist', 'index.mjs'),
+      'export default { changed: () => undefined };',
+    );
+    const handlers = new Map<string, IpcHandler>();
+    const requests: Array<{ operation: string; input: unknown }> = [];
+    const client = {
+      request: async (operation: string, input: unknown) => {
+        requests.push({ operation, input });
+        if (operation === 'extension.package.install') {
+          return { extensionId: 'dev.maka.user.ui', toolNames: [], uiContributionIds: ['root'], eventContributionIds: ['event:dev.maka.user.ui.changed', 'listener:dev.maka.user.ui.changed:changed'] };
+        }
+        if (operation === 'extension.composition.query') return { extensions: [], entries: [] };
+        if (operation === 'extension.composition.mutate') return { entry: null };
+        throw new Error(`unexpected ${operation}`);
+      },
+    } as unknown as DesktopRuntimeHostClient;
+    registerRuntimeHostUiExtensionsIpc({
+      ipcMain: {
+        handle: (channel, listener) => handlers.set(channel, listener),
+        handleReconnectableRead: (channel, listener) => handlers.set(channel, listener),
+      },
+      client,
+      mainWindowController: {
+        showOpenDialog: async () => ({ canceled: false, filePaths: [root] }),
+        showMessageBox: async () => ({ response: 0, checkboxChecked: false }),
+      } as never,
+      allowLocalPaths: true,
+    });
+    const handler = handlers.get('ui-extensions:importLocal');
+    assert.ok(handler);
+    assert.deepEqual(await handler({} as never), { ok: true, extensionId: 'dev.maka.user.ui' });
+    assert.equal(requests[0]?.operation, 'extension.package.install');
+    const mutations = requests.filter(({ operation }) => operation === 'extension.composition.mutate');
+    assert.equal(mutations.length, 2);
+    assert.deepEqual(mutations[0], {
+      operation: 'extension.composition.mutate',
+      input: {
+        kind: 'enable',
+        entryId: mutations[0] && (mutations[0].input as { entryId: string }).entryId,
+        scopeId: 'desktop-ui',
+        extensionId: 'dev.maka.user.ui',
+      },
+    });
+    assert.equal((mutations[1]?.input as { scopeId?: string } | undefined)?.scopeId, 'profile');
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
diff --git a/apps/desktop/src/main/__tests__/ui-extension-host.test.ts b/apps/desktop/src/main/__tests__/ui-extension-host.test.ts
new file mode 100644
index 0000000000..2ecf53b368
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/ui-extension-host.test.ts
@@ -0,0 +1,194 @@
+import assert from 'node:assert/strict';
+import { afterEach, describe, test } from 'node:test';
+import { parseHTML } from 'linkedom';
+import { act, createElement, useEffect } from 'react';
+import { createRoot } from 'react-dom/client';
+import type { ExtensionUiContributionProjection } from '@maka/runtime-host/protocol';
+import { selectUiSnapshots, UiExtensionSlot, UiExtensionSlotProvider } from '../../renderer/ui-extension-host.js';
+import { withUiSandboxPolicy } from '../ui-extension-frame-document.js';
+import { createUiExtensionFrameRequestHandler } from '../ui-extension-frame-protocol.js';
+import { uiExtensionFrameUrl } from '../../renderer/ui-extension-frame-url.js';
+
+const originalGlobals = {
+  document: globalThis.document,
+  window: globalThis.window,
+  HTMLElement: globalThis.HTMLElement,
+  HTMLIFrameElement: globalThis.HTMLIFrameElement,
+  IS_REACT_ACT_ENVIRONMENT: (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean })
+    .IS_REACT_ACT_ENVIRONMENT,
+};
+
+afterEach(() => {
+  Object.assign(globalThis, originalGlobals);
+});
+
+describe('Desktop UI extension shell', () => {
+  test('selects one deterministic root and ordered independent overlays', () => {
+    const selected = selectUiSnapshots(null, [
+      item('low', 'app.root', 1),
+      item('overlay-b', 'app.overlay', 20),
+      item('high', 'app.root', 100),
+      item('overlay-a', 'app.overlay', 20),
+      item('settings', 'app.slot', 30, 'settings.content'),
+      item('conversation', 'app.slot', 40, 'conversation.header'),
+    ]);
+    assert.equal(selected.root.id, 'high');
+    assert.deepEqual(selected.overlays.map(({ id }) => id), ['overlay-a', 'overlay-b']);
+    assert.deepEqual(selected.slots.map(({ id }) => id), ['conversation', 'settings']);
+  });
+
+  test('updates one slot without remounting the official root', async () => {
+    const { document, window } = parseHTML('<div id="root"></div>');
+    Object.assign(globalThis, {
+      document,
+      window,
+      HTMLElement: window.HTMLElement,
+      HTMLIFrameElement: window.HTMLIFrameElement ?? class HTMLIFrameElement {},
+      IS_REACT_ACT_ENVIRONMENT: true,
+    });
+    const container = document.querySelector('#root');
+    assert.ok(container);
+    const root = createRoot(container);
+    let mounts = 0;
+    let unmounts = 0;
+    function OfficialRootProbe() {
+      useEffect(() => {
+        mounts += 1;
+        return () => {
+          unmounts += 1;
+        };
+      }, []);
+      return createElement('main', { 'data-official-root': true });
+    }
+    const render = async (generation: number) => {
+      await act(async () => {
+        root.render(
+          createElement(
+            UiExtensionSlotProvider,
+            {
+              contributions: [
+                { ...item('status', 'app.slot', 10, 'conversation.header'), generation },
+              ],
+              onSafeMode: () => undefined,
+            },
+            createElement(OfficialRootProbe),
+            createElement(UiExtensionSlot, { name: 'conversation.header' }),
+          ),
+        );
+        await Promise.resolve();
+      });
+    };
+
+    await render(1);
+    await render(2);
+    assert.equal(mounts, 1);
+    assert.equal(unmounts, 0);
+    assert.equal(container.querySelectorAll('iframe').length, 1);
+    await act(async () => root.unmount());
+    assert.equal(unmounts, 1);
+  });
+
+  test('injects an offline CSP by default and only opens declared network lanes', () => {
+    const offline = withUiSandboxPolicy('<html><head></head><body>Hello</body></html>', false);
+    assert.match(offline, /connect-src 'none'/);
+    assert.match(offline, /frame-src 'none'/);
+    assert.ok(offline.indexOf('Content-Security-Policy') < offline.indexOf('</head>'));
+    const online = withUiSandboxPolicy('<main>Hello</main>', true);
+    assert.match(online, /connect-src https: wss:/);
+    assert.match(online, /form-action 'none'/);
+  });
+
+  test('injects the narrow Host SDK only for an admitted frame token', () => {
+    const plain = withUiSandboxPolicy('<main>Hello</main>', false);
+    assert.doesNotMatch(plain, /makaUI/);
+    const bridged = withUiSandboxPolicy('<main>Hello</main>', false, 'test-token', [
+      'workspace.body',
+    ]);
+    assert.match(bridged, /maka-ui-bridge\/v1/);
+    assert.match(bridged, /maka-ui-bridge-ready\/v1/);
+    assert.match(bridged, /maka-ui-host-ready\/v1/);
+    assert.match(bridged, /queued\.push/);
+    assert.match(bridged, /setInterval\(announce,50\)/);
+    assert.match(bridged, /clearInterval\(retry\)/);
+    assert.match(bridged, /getState/);
+    assert.match(bridged, /setState/);
+    assert.match(bridged, /deleteState/);
+    assert.match(bridged, /invoke/);
+    assert.match(bridged, /session_list/);
+    assert.match(bridged, /session_send/);
+    assert.match(bridged, /session_stop/);
+    assert.match(bridged, /safe_mode/);
+    assert.match(bridged, /maka-ui-slot-layout\/v1/);
+    assert.match(bridged, /data-maka-slot/);
+    assert.match(bridged, /workspace\.body/);
+    assert.match(bridged, /getConfig/);
+    assert.match(bridged, /test-token/);
+  });
+
+  test('serves active UI bytes from an isolated scheme instead of srcdoc CSP inheritance', async () => {
+    const token = '12345678-1234-4123-8123-123456789abc';
+    const contribution = item('root', 'app.root', 1);
+    const url = uiExtensionFrameUrl({
+      scopeId: 'desktop-ui',
+      entryId: contribution.entryId,
+      extensionId: contribution.extensionId,
+      generation: contribution.generation,
+      contributionId: contribution.id,
+      token,
+    });
+    const handler = createUiExtensionFrameRequestHandler(() => ({
+      request: async () => ({
+        scopeId: 'desktop-ui',
+        digest: 'sha256-test',
+        contributions: [{ ...contribution, hostState: true }],
+      }),
+    }));
+    const response = await handler(new Request(url));
+    assert.equal(response.status, 200);
+    assert.match(response.headers.get('content-security-policy') ?? '', /script-src 'unsafe-inline'/);
+    assert.match(await response.text(), /makaUI/);
+  });
+
+  test('injects the emergency recovery bridge even without extension permissions', async () => {
+    const token = '12345678-1234-4123-8123-123456789abc';
+    const contribution = item('root', 'app.root', 1);
+    const handler = createUiExtensionFrameRequestHandler(() => ({
+      request: async () => ({
+        scopeId: 'desktop-ui',
+        digest: 'sha256-test',
+        contributions: [contribution],
+      }),
+    }));
+    const response = await handler(new Request(uiExtensionFrameUrl({
+      scopeId: 'desktop-ui',
+      entryId: contribution.entryId,
+      extensionId: contribution.extensionId,
+      generation: contribution.generation,
+      contributionId: contribution.id,
+      token,
+    })));
+    const document = await response.text();
+    assert.match(document, /safe_mode/);
+    assert.match(document, /makaUI/);
+  });
+});
+
+function item(
+  id: string,
+  surface: 'app.root' | 'app.overlay' | 'app.slot',
+  priority: number,
+  slot?: string,
+): ExtensionUiContributionProjection {
+  return {
+    entryId: `entry-${id}`,
+    extensionId: 'demo',
+    generation: 1,
+    id,
+    surface,
+    ...(slot ? { slot } : {}),
+    priority,
+    document: '<p>demo</p>',
+    documentSha256: 'sha256',
+    network: false,
+  };
+}
diff --git a/apps/desktop/src/main/__tests__/ui-plugin-runtime.test.ts b/apps/desktop/src/main/__tests__/ui-plugin-runtime.test.ts
new file mode 100644
index 0000000000..7bb00e7c21
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/ui-plugin-runtime.test.ts
@@ -0,0 +1,41 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import type { ExtensionUiContributionProjection } from '@maka/runtime-host/protocol';
+import { UiPluginRuntime } from '../../renderer/ui-plugin-runtime.js';
+
+test('Client Cordis tree updates one UI entry without remounting siblings', async () => {
+  const runtime = new UiPluginRuntime();
+  const first = contribution('first', 1, 'one');
+  const sibling = contribution('sibling', 1, 'sibling');
+  await runtime.reconcile([first, sibling]);
+  assert.deepEqual(runtime.inspect().map(({ entryId, generation }) => [entryId, generation]), [
+    ['first', 1],
+    ['sibling', 1],
+  ]);
+  await runtime.reconcile([contribution('first', 2, 'two'), sibling]);
+  assert.deepEqual(runtime.inspect().map(({ entryId, generation }) => [entryId, generation]), [
+    ['first', 2],
+    ['sibling', 1],
+  ]);
+  await runtime.reconcile([sibling]);
+  assert.deepEqual(runtime.inspect().map(({ entryId }) => entryId), ['sibling']);
+  await runtime.close();
+});
+
+function contribution(
+  entryId: string,
+  generation: number,
+  id: string,
+): ExtensionUiContributionProjection {
+  return Object.freeze({
+    entryId,
+    extensionId: `fixture.${entryId}`,
+    generation,
+    id,
+    surface: 'app.overlay',
+    priority: 0,
+    document: '<!doctype html>',
+    documentSha256: `${id}-${generation}`,
+    network: false,
+  });
+}
diff --git a/apps/desktop/src/main/main-window.ts b/apps/desktop/src/main/main-window.ts
index dd217d9471..884a528463 100644
--- a/apps/desktop/src/main/main-window.ts
+++ b/apps/desktop/src/main/main-window.ts
@@ -32,6 +32,7 @@ export interface MainWindowController {
   setTitleBarOverlayTheme(sender: Electron.WebContents, theme: unknown): void;
   showOpenDialog(options: Electron.OpenDialogOptions): Promise<Electron.OpenDialogReturnValue>;
   showSaveDialog(options: Electron.SaveDialogOptions): Promise<Electron.SaveDialogReturnValue>;
+  showMessageBox(options: Electron.MessageBoxOptions): Promise<Electron.MessageBoxReturnValue>;
   getBrowserViews(): BrowserViewManager<BrowserViewController>;
   disposeBrowserViews(): Promise<void>;
   hasOpenWindows(): boolean;
@@ -501,6 +502,11 @@ export function createMainWindowController(deps: MainWindowControllerDeps): Main
         ? dialog.showSaveDialog(mainWindow, options)
         : dialog.showSaveDialog(options);
     },
+    showMessageBox(options) {
+      return mainWindow
+        ? dialog.showMessageBox(mainWindow, options)
+        : dialog.showMessageBox(options);
+    },
     getBrowserViews,
     disposeBrowserViews,
     hasOpenWindows() {
diff --git a/apps/desktop/src/main/main.ts b/apps/desktop/src/main/main.ts
index f9a13e5b23..e6772e437e 100644
--- a/apps/desktop/src/main/main.ts
+++ b/apps/desktop/src/main/main.ts
@@ -1,9 +1,22 @@
-import { app, dialog } from 'electron';
+import { app, dialog, protocol } from 'electron';
 import { installMainProcessLogCapture } from './main-process-diagnostics.js';
 import { isIsolatedE2e } from './startup-context.js';
 
 installMainProcessLogCapture();
 
+protocol.registerSchemesAsPrivileged([
+  {
+    scheme: 'maka-ui',
+    privileges: {
+      standard: true,
+      secure: true,
+      supportFetchAPI: false,
+      corsEnabled: false,
+      bypassCSP: false,
+    },
+  },
+]);
+
 // The macOS app menu title and app.getName() consumers read this name. Set it
 // before ready, unchanged from its historical pre-ready position.
 //
diff --git a/apps/desktop/src/main/runtime-host-boot.ts b/apps/desktop/src/main/runtime-host-boot.ts
index cf058b5278..ad3b38375a 100644
--- a/apps/desktop/src/main/runtime-host-boot.ts
+++ b/apps/desktop/src/main/runtime-host-boot.ts
@@ -126,6 +126,8 @@ import {
   updateRuntimeHostSettings,
 } from "./runtime-host-settings-ipc-main.js";
 import { registerRuntimeHostSkillsIpc } from "./runtime-host-skills-ipc-main.js";
+import { registerRuntimeHostUiExtensionsIpc } from "./runtime-host-ui-extensions-ipc-main.js";
+import { registerUiExtensionFrameProtocol } from "./ui-extension-frame-protocol-main.js";
 import { registerRuntimeHostUsageIpc } from "./runtime-host-usage-ipc-main.js";
 import { registerRuntimeHostWorkspaceIpc } from "./runtime-host-workspace-ipc-main.js";
 import { resolveShellEnv } from "./shell-env.js";
@@ -937,6 +939,16 @@ function registerHostClientIpc(
     openPath: (path) => shell.openPath(path),
     allowLocalPaths: target.kind === "local",
   });
+  registerRuntimeHostUiExtensionsIpc({
+    ipcMain: scopedIpc,
+    client,
+    mainWindowController,
+    allowLocalPaths: target.kind === "local",
+    automatedImportSourcePath: isIsolatedE2e
+      ? process.env.MAKA_E2E_UI_EXTENSION_PATH
+      : undefined,
+  });
+  registerUiExtensionFrameProtocol(client);
   registerRuntimeHostSearchIpc({ ipcMain: scopedIpc, client });
   registerRuntimeHostUsageIpc({
     ipcMain: scopedIpc,
diff --git a/apps/desktop/src/main/runtime-host-renderer-ipc-main.ts b/apps/desktop/src/main/runtime-host-renderer-ipc-main.ts
index 9bb25af465..b5301b376b 100644
--- a/apps/desktop/src/main/runtime-host-renderer-ipc-main.ts
+++ b/apps/desktop/src/main/runtime-host-renderer-ipc-main.ts
@@ -77,11 +77,21 @@ function request(
       return client.request(operation, HOST_OPERATION_SPECS[operation].decodeInput(value));
     case 'execution.inspect.query':
       return client.request(operation, HOST_OPERATION_SPECS[operation].decodeInput(value));
+    case 'extension.ui.snapshot':
+      return client.request(operation, HOST_OPERATION_SPECS[operation].decodeInput(value));
+    case 'extension.ui.state.query':
+      return client.request(operation, HOST_OPERATION_SPECS[operation].decodeInput(value));
+    case 'extension.configuration.query':
+      return client.request(operation, HOST_OPERATION_SPECS[operation].decodeInput(value));
     case 'scheduled-task.mutate':
       return client.request(operation, HOST_OPERATION_SPECS[operation].decodeInput(value));
     case 'scheduled-task.query':
       return client.request(operation, HOST_OPERATION_SPECS[operation].decodeInput(value));
     case 'web-search.execute':
       return client.request(operation, HOST_OPERATION_SPECS[operation].decodeInput(value));
+    case 'extension.ui.state.mutate':
+      return client.request(operation, HOST_OPERATION_SPECS[operation].decodeInput(value));
+    case 'extension.ui.rpc.invoke':
+      return client.request(operation, HOST_OPERATION_SPECS[operation].decodeInput(value));
   }
 }
diff --git a/apps/desktop/src/main/runtime-host-ui-extensions-ipc-main.ts b/apps/desktop/src/main/runtime-host-ui-extensions-ipc-main.ts
new file mode 100644
index 0000000000..060ecaf838
--- /dev/null
+++ b/apps/desktop/src/main/runtime-host-ui-extensions-ipc-main.ts
@@ -0,0 +1,240 @@
+import { createHash } from 'node:crypto';
+import { readFile, stat } from 'node:fs/promises';
+import { basename, join } from 'node:path';
+import type { ReconnectableReadIpcMain } from './ipc-reconnect-policy.js';
+import { handleReconnectableRead } from './ipc-reconnect-policy.js';
+import type { DesktopRuntimeHostClient } from './runtime-host-client.js';
+import type { createMainWindowController } from './main-window.js';
+
+const DESKTOP_UI_SCOPE = 'desktop-ui';
+const PROFILE_EXTENSION_SCOPE = 'profile';
+type MainWindowController = ReturnType<typeof createMainWindowController>;
+
+export function registerRuntimeHostUiExtensionsIpc(input: {
+  readonly ipcMain: ReconnectableReadIpcMain;
+  readonly client: DesktopRuntimeHostClient;
+  readonly mainWindowController: MainWindowController;
+  readonly allowLocalPaths: boolean;
+  readonly automatedImportSourcePath?: string;
+}): void {
+  handleReconnectableRead(input.ipcMain, 'ui-extensions:list', async () => listUiExtensions(input.client));
+
+  input.ipcMain.handle('ui-extensions:importLocal', async () => {
+    if (!input.allowLocalPaths) throw new Error('Local UI Extension import is unavailable for a remote Runtime Host');
+    const selected = input.automatedImportSourcePath
+      ? { canceled: false, filePaths: [input.automatedImportSourcePath] }
+      : await input.mainWindowController.showOpenDialog({
+          title: 'Import Extension',
+          properties: ['openDirectory', 'openFile'],
+          filters: [{ name: 'Maka Extension', extensions: ['maka-extension'] }],
+        });
+    const sourcePath = selected.filePaths[0];
+    if (selected.canceled || !sourcePath) return { ok: false as const, reason: 'cancelled' as const };
+    const manifest = await previewPackage(sourcePath);
+    const confirmation = input.automatedImportSourcePath
+      ? { response: 0 }
+      : await input.mainWindowController.showMessageBox({
+          type: 'warning',
+          title: `Import ${manifest.id}`,
+          message: `Install Extension “${manifest.id}”?`,
+          detail: [
+            `${manifest.uiCount} UI contribution${manifest.uiCount === 1 ? '' : 's'}`,
+            `${manifest.toolCount} Tool contribution${manifest.toolCount === 1 ? '' : 's'}`,
+            `${manifest.eventCount} Event/Listener contribution${manifest.eventCount === 1 ? '' : 's'}`,
+            `${manifest.serviceCount} Service contribution${manifest.serviceCount === 1 ? '' : 's'}`,
+            `${manifest.timerCount} Timer contribution${manifest.timerCount === 1 ? '' : 's'}`,
+            `Host state: ${manifest.permissions.hostState ? 'allowed' : 'not allowed'}`,
+            `Session control: ${manifest.permissions.sessionAccess ? 'allowed' : 'not allowed'}`,
+            `Host methods: ${manifest.hostMethods.length === 0 ? 'none' : manifest.hostMethods.join(', ')}`,
+            `Network: ${manifest.permissions.network ? 'allowed' : 'blocked'}`,
+            `Workspace: ${manifest.permissions.workspace}`,
+            '',
+            'Trusted code warning: enabling this Extension executes its code inside the Runtime Host process. It has the same authority as a local application or Bash command and may read credentials, access files and the network, change MAKA behavior, block, or terminate the Runtime. Manifest permissions are approval and audit metadata, not a security boundary against malicious code.',
+          ].join('\n'),
+          buttons: ['Install and enable', 'Cancel'],
+          defaultId: 0,
+          cancelId: 1,
+        });
+    if (confirmation.response !== 0) return { ok: false as const, reason: 'cancelled' as const };
+    const installed = await input.client.request('extension.package.install', { sourcePath });
+    const catalog = await input.client.request('extension.composition.query', {});
+    for (const scopeId of new Set([
+      ...(installed.uiContributionIds.length > 0 ? [DESKTOP_UI_SCOPE] : []),
+      ...(installed.toolNames.length > 0 || installed.eventContributionIds.length > 0 || (installed.serviceContributionIds?.length ?? 0) > 0 || (installed.timerContributionIds?.length ?? 0) > 0
+        ? [PROFILE_EXTENSION_SCOPE]
+        : []),
+    ])) {
+      const current = catalog.entries.find(
+        (entry) => entry.scopeId === scopeId && entry.extensionId === installed.extensionId,
+      );
+      await input.client.request(
+        'extension.composition.mutate',
+        current
+          ? { kind: 'reload', entryId: current.entryId }
+          : {
+              kind: 'enable',
+              entryId: userEntryId(installed.extensionId, scopeId),
+              scopeId,
+              extensionId: installed.extensionId,
+            },
+      );
+    }
+    return { ok: true as const, extensionId: installed.extensionId };
+  });
+
+  input.ipcMain.handle('ui-extensions:setEnabled', async (_event, extensionId: string, enabled: boolean) => {
+    const catalog = await input.client.request('extension.composition.query', {});
+    const entries = catalog.entries.filter((item) => item.extensionId === extensionId);
+    if (entries.length === 0) throw new Error('Extension entry is not installed');
+    for (const entry of entries) {
+      await input.client.request('extension.composition.mutate', enabled
+        ? { kind: 'enable', entryId: entry.entryId, scopeId: entry.scopeId, extensionId: entry.extensionId }
+        : { kind: 'disable', entryId: entry.entryId });
+    }
+    return { ok: true as const };
+  });
+
+  input.ipcMain.handle('ui-extensions:remove', async (_event, extensionId: string) => {
+    const catalog = await input.client.request('extension.composition.query', {});
+    for (const entry of catalog.entries.filter((item) => item.extensionId === extensionId)) {
+      await input.client.request('extension.composition.mutate', { kind: 'remove', entryId: entry.entryId });
+    }
+    if (catalog.extensions.some((item) => item.extensionId === extensionId))
+      await input.client.request('extension.package.uninstall', { extensionId });
+    return { ok: true as const };
+  });
+
+  input.ipcMain.handle('ui-extensions:configure', async (_event, entryId: string, configuration: Record<string, string | number | boolean>) => {
+    const result = await input.client.request('extension.configuration.mutate', { entryId, configuration });
+    return { ok: true as const, configuration: result.configuration };
+  });
+
+  handleReconnectableRead(input.ipcMain, 'ui-extensions:getConfiguration', async (_event, entryId: string) =>
+    input.client.request('extension.configuration.query', { entryId }),
+  );
+
+  input.ipcMain.handle('ui-extensions:export', async (_event, extensionId: string) => {
+    if (!input.allowLocalPaths) throw new Error('Extension export is unavailable for a remote Runtime Host');
+    const selected = await input.mainWindowController.showSaveDialog({
+      title: `Export ${extensionId}`,
+      defaultPath: `${extensionId}.maka-extension`,
+      filters: [{ name: 'Maka Extension', extensions: ['maka-extension'] }],
+    });
+    if (selected.canceled || !selected.filePath) return { ok: false as const, reason: 'cancelled' as const };
+    await input.client.request('extension.package.export', { extensionId, targetPath: selected.filePath });
+    return { ok: true as const, path: selected.filePath };
+  });
+}
+
+async function listUiExtensions(client: DesktopRuntimeHostClient) {
+  const catalog = await client.request('extension.composition.query', {});
+  const contracts = await client.request('extension.contract.query', {}).catch(() => ({ packages: [] }));
+  return catalog.extensions
+    .map((extension) => {
+      const entries = catalog.entries.filter((item) => item.extensionId === extension.extensionId);
+      const contract = contracts.packages.find((item) => item.extensionId === extension.extensionId);
+      return {
+        extensionId: extension.extensionId,
+        displayName: contract?.displayName ?? extension.extensionId,
+        description: contract?.description ?? '',
+        contributionIds: [
+          ...extension.toolNames,
+          ...extension.uiContributionIds,
+          ...extension.eventContributionIds,
+          ...(extension.serviceContributionIds ?? []),
+          ...(extension.timerContributionIds ?? []),
+        ],
+        toolNames: extension.toolNames,
+        uiContributionIds: extension.uiContributionIds,
+        eventContributionIds: extension.eventContributionIds,
+        serviceContributionIds: extension.serviceContributionIds ?? [],
+        timerContributionIds: extension.timerContributionIds ?? [],
+        dependencies: contract?.dependencies ?? [],
+        configuration: contract?.configuration ?? { properties: {}, required: [] },
+        entries,
+        active: entries.some((item) => item.status === 'active'),
+        enabled: entries.some((item) => item.enabled),
+        status: entries.some((item) => item.status === 'failed') ? 'failed' : entries.some((item) => item.status === 'active') ? 'active' : entries.some((item) => item.status === 'waiting') ? 'waiting' : 'disabled',
+        error: entries.find((item) => item.error)?.error ?? null,
+      };
+    });
+}
+
+async function previewPackage(sourcePath: string): Promise<{ id: string; uiCount: number; toolCount: number; eventCount: number; serviceCount: number; timerCount: number; hostMethods: string[]; permissions: { network: boolean; hostState: boolean; sessionAccess: boolean; workspace: string } }> {
+  if (!(await stat(sourcePath)).isDirectory()) return previewBundle(sourcePath);
+  const encoded = await readFile(join(sourcePath, 'maka.extension.json'), 'utf8');
+  return previewManifest(JSON.parse(encoded) as Record<string, unknown>);
+}
+
+async function previewBundle(sourcePath: string): ReturnType<typeof previewPackage> {
+  const encoded = await readFile(sourcePath);
+  if (encoded.byteLength > 32 * 1024 * 1024) throw new Error('Extension Bundle is too large');
+  const bundle = JSON.parse(encoded.toString('utf8')) as { files?: unknown };
+  if (!Array.isArray(bundle.files)) throw new Error('Extension Bundle is invalid');
+  let manifest: string | undefined;
+  for (const value of bundle.files) {
+    const file = value as { path?: unknown; content?: unknown };
+    if (typeof file.path !== 'string' || typeof file.content !== 'string') {
+      throw new Error('Extension Bundle file is invalid');
+    }
+    if (file.path === 'maka.extension.json') {
+      manifest = Buffer.from(file.content, 'base64').toString('utf8');
+    }
+  }
+  if (!manifest) {
+    throw new Error(`Extension Bundle is missing manifests: ${basename(sourcePath)}`);
+  }
+  return previewManifest(JSON.parse(manifest) as Record<string, unknown>);
+}
+
+function previewManifest(value: Record<string, unknown>): Awaited<ReturnType<typeof previewPackage>> {
+  if (typeof value.id !== 'string') {
+    throw new Error('Extension manifest is invalid');
+  }
+  const runtime = value.runtime as Record<string, unknown> | undefined;
+  const uiValue = value.ui as Record<string, unknown> | undefined;
+  const ui = Array.isArray(uiValue?.contributions) ? uiValue.contributions : [];
+  const tools = Array.isArray(runtime?.tools) ? runtime.tools : [];
+  const eventDefinitions = Array.isArray(runtime?.events) ? runtime.events : [];
+  const listeners = Array.isArray(runtime?.listeners) ? runtime.listeners : [];
+  const services = Array.isArray(runtime?.services) ? runtime.services : [];
+  const timers = Array.isArray(runtime?.timers) ? runtime.timers : [];
+  if (
+    ui.length === 0 &&
+    tools.length === 0 &&
+    eventDefinitions.length === 0 &&
+    listeners.length === 0 &&
+    services.length === 0 &&
+    timers.length === 0
+  ) {
+    throw new Error('Extension package has no contributions');
+  }
+  const permissions = uiValue?.permissions as Record<string, unknown> | undefined;
+  const runtimePermissions = runtime?.permissions as Record<string, unknown> | undefined;
+  const host = uiValue?.host as Record<string, unknown> | undefined;
+  const methods = Array.isArray(host?.methods) ? host.methods : [];
+  const hostMethods = methods.map((item) => (item as Record<string, unknown>)?.name);
+  if (hostMethods.some((name) => typeof name !== 'string')) {
+    throw new Error('Extension Bundle Host methods are invalid');
+  }
+  return {
+    id: value.id,
+    uiCount: ui.length,
+    toolCount: tools.length,
+    eventCount: eventDefinitions.length + listeners.length,
+    serviceCount: services.length,
+    timerCount: timers.length,
+    hostMethods: hostMethods as string[],
+    permissions: {
+      network: permissions?.network === true || runtimePermissions?.network === true,
+      hostState: permissions?.hostState === true,
+      sessionAccess: permissions?.sessionAccess === true,
+      workspace:
+        typeof runtimePermissions?.workspace === 'string' ? runtimePermissions.workspace : 'none',
+    },
+  };
+}
+
+function userEntryId(extensionId: string, scopeId: string): string {
+  return `user_extension_${createHash('sha256').update(`${scopeId}\u0000${extensionId}`).digest('hex').slice(0, 32)}`;
+}
diff --git a/apps/desktop/src/main/ui-extension-frame-document.ts b/apps/desktop/src/main/ui-extension-frame-document.ts
new file mode 100644
index 0000000000..2055fa04a3
--- /dev/null
+++ b/apps/desktop/src/main/ui-extension-frame-document.ts
@@ -0,0 +1,25 @@
+export function uiExtensionFramePolicy(network: boolean): string {
+  const networkPolicy = network
+    ? "connect-src https: wss:; img-src data: blob: https:; media-src blob: https:; font-src data: https:;"
+    : "connect-src 'none'; img-src data: blob:; media-src blob:; font-src data:;";
+  return `default-src 'none'; base-uri 'none'; object-src 'none'; frame-src 'none'; form-action 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; ${networkPolicy}`;
+}
+
+export function withUiSandboxPolicy(
+  document: string,
+  network: boolean,
+  bridgeToken?: string,
+  declaredSlots: readonly string[] = [],
+): string {
+  const policy = `<meta http-equiv="Content-Security-Policy" content="${uiExtensionFramePolicy(network)}">`;
+  const bridge = bridgeToken
+    ? `<script>${bridgeBootstrap(bridgeToken, declaredSlots)}</script>`
+    : '';
+  const head = /^\s*(?:<!doctype[^>]*>\s*)?<html(?:\s[^>]*)?>\s*<head(?:\s[^>]*)?>/iu;
+  if (head.test(document)) return document.replace(head, (match) => `${match}${policy}${bridge}`);
+  return `<!doctype html><html><head>${policy}${bridge}</head><body>${document}</body></html>`;
+}
+
+function bridgeBootstrap(token: string, declaredSlots: readonly string[]): string {
+  return `(function(){const token=${JSON.stringify(token)},declaredSlots=${JSON.stringify(declaredSlots)},pending=new Map(),queued=[];let sequence=0,ready=false,layoutFrame=0;const announce=function(){if(!ready)parent.postMessage({channel:'maka-ui-bridge-ready/v1',token:token},'*');},retry=setInterval(announce,50);function publishSlots(){layoutFrame=0;const slots=[];for(const name of declaredSlots){const element=document.querySelector('[data-maka-slot="'+CSS.escape(name)+'"]');if(!element)continue;const rect=element.getBoundingClientRect();slots.push({name:name,x:rect.x,y:rect.y,width:rect.width,height:rect.height});}parent.postMessage({channel:'maka-ui-slot-layout/v1',token:token,slots:slots},'*');}function scheduleSlots(){if(!layoutFrame)layoutFrame=requestAnimationFrame(publishSlots);}window.addEventListener('resize',scheduleSlots);window.addEventListener('scroll',scheduleSlots,true);new MutationObserver(scheduleSlots).observe(document.documentElement,{attributes:true,childList:true,subtree:true});if(typeof ResizeObserver==='function')new ResizeObserver(scheduleSlots).observe(document.documentElement);window.addEventListener('keydown',function(event){if((event.metaKey||event.ctrlKey)&&event.shiftKey&&event.key==='Backspace'){event.preventDefault();event.stopImmediatePropagation();const id=String(++sequence),envelope={channel:'maka-ui-bridge/v1',token:token,id:id,kind:'safe_mode'};ready?parent.postMessage(envelope,'*'):queued.push(envelope);}},true);window.addEventListener('message',function(event){const data=event.data;if(event.source!==parent||!data||data.token!==token)return;if(data.channel==='maka-ui-host-ready/v1'){if(ready)return;ready=true;clearInterval(retry);while(queued.length)parent.postMessage(queued.shift(),'*');scheduleSlots();return;}if(data.channel!=='maka-ui-host/v1')return;const task=pending.get(data.id);if(!task)return;pending.delete(data.id);data.ok?task.resolve(data.result):task.reject(new Error(data.error||'Host request failed'));});function call(message){return new Promise(function(resolve,reject){const id=String(++sequence),envelope=Object.assign({channel:'maka-ui-bridge/v1',token,id},message);pending.set(id,{resolve,reject});ready?parent.postMessage(envelope,'*'):queued.push(envelope);});}const sessions=Object.freeze({list:function(){return call({kind:'session_list'});},send:function(input){input=input||{};return call({kind:'session_send',sessionId:input.sessionId,text:input.text});},stop:function(sessionId){return call({kind:'session_stop',sessionId:sessionId});}});Object.defineProperty(window,'makaUI',{value:Object.freeze({getConfig:function(){return call({kind:'config'}).then(function(result){return result.configuration;});},getState:function(key){return call({kind:'get',key:key});},setState:function(key,value){return call({kind:'set',key:key,value:value});},deleteState:function(key){return call({kind:'delete',key:key});},invoke:function(method,args){return call({kind:'invoke',method:method,args:args===undefined?null:args});},sessions:sessions}),writable:false,configurable:false});setTimeout(announce,0);})();`;
+}
diff --git a/apps/desktop/src/main/ui-extension-frame-protocol-main.ts b/apps/desktop/src/main/ui-extension-frame-protocol-main.ts
new file mode 100644
index 0000000000..9172dc6332
--- /dev/null
+++ b/apps/desktop/src/main/ui-extension-frame-protocol-main.ts
@@ -0,0 +1,19 @@
+import { protocol } from 'electron';
+import type { DesktopRuntimeHostClient } from './runtime-host-client.js';
+import {
+  createUiExtensionFrameRequestHandler,
+  type UiExtensionFrameClient,
+} from './ui-extension-frame-protocol.js';
+
+let installed = false;
+let activeClient: UiExtensionFrameClient | null = null;
+
+export function registerUiExtensionFrameProtocol(client: DesktopRuntimeHostClient): void {
+  activeClient = client;
+  if (installed) return;
+  installed = true;
+  protocol.handle(
+    'maka-ui',
+    createUiExtensionFrameRequestHandler(() => activeClient),
+  );
+}
diff --git a/apps/desktop/src/main/ui-extension-frame-protocol.ts b/apps/desktop/src/main/ui-extension-frame-protocol.ts
new file mode 100644
index 0000000000..5478982940
--- /dev/null
+++ b/apps/desktop/src/main/ui-extension-frame-protocol.ts
@@ -0,0 +1,110 @@
+import type { ExtensionUiSnapshotResult } from '@maka/runtime-host/protocol';
+import {
+  uiExtensionFramePolicy,
+  withUiSandboxPolicy,
+} from './ui-extension-frame-document.js';
+
+const TOKEN_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+const EXPECTED_QUERY_KEYS = Object.freeze([
+  'contributionId',
+  'entryId',
+  'extensionId',
+  'generation',
+  'scopeId',
+  'token',
+]);
+
+export interface UiExtensionFrameClient {
+  request(
+    operation: 'extension.ui.snapshot',
+    input: { readonly scopeId: string },
+  ): Promise<ExtensionUiSnapshotResult>;
+}
+
+export function createUiExtensionFrameRequestHandler(
+  resolveClient: () => UiExtensionFrameClient | null,
+): (request: Request) => Promise<Response> {
+  return async (request) => {
+    if (request.method !== 'GET') return response('Method not allowed', 405);
+    const identity = decodeFrameIdentity(request.url);
+    if (!identity) return response('Invalid UI Extension frame request', 400);
+    const client = resolveClient();
+    if (!client) return response('Runtime Host unavailable', 503);
+    try {
+      const snapshot = await client.request('extension.ui.snapshot', {
+        scopeId: identity.scopeId,
+      });
+      const contribution = snapshot.contributions.find(
+        (item) =>
+          item.entryId === identity.entryId &&
+          item.extensionId === identity.extensionId &&
+          item.generation === identity.generation &&
+          item.id === identity.contributionId,
+      );
+      if (!contribution) return response('UI Extension contribution not active', 404);
+      const document = withUiSandboxPolicy(
+        contribution.document,
+        contribution.network,
+        identity.token,
+        contribution.slots ?? [],
+      );
+      return new Response(document, {
+        status: 200,
+        headers: {
+          'cache-control': 'no-store',
+          'content-security-policy': uiExtensionFramePolicy(contribution.network),
+          'content-type': 'text/html; charset=utf-8',
+          'cross-origin-resource-policy': 'cross-origin',
+        },
+      });
+    } catch {
+      return response('Runtime Host unavailable', 503);
+    }
+  };
+}
+
+function decodeFrameIdentity(urlValue: string): {
+  readonly scopeId: 'desktop-ui';
+  readonly entryId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+  readonly contributionId: string;
+  readonly token: string;
+} | null {
+  const url = new URL(urlValue);
+  if (url.protocol !== 'maka-ui:' || url.hostname !== 'frame' || url.pathname !== '/v1') {
+    return null;
+  }
+  if ([...url.searchParams.keys()].sort().join('\0') !== EXPECTED_QUERY_KEYS.join('\0')) {
+    return null;
+  }
+  const scopeId = url.searchParams.get('scopeId');
+  const entryId = url.searchParams.get('entryId');
+  const extensionId = url.searchParams.get('extensionId');
+  const generation = Number(url.searchParams.get('generation'));
+  const contributionId = url.searchParams.get('contributionId');
+  const token = url.searchParams.get('token');
+  if (
+    scopeId !== 'desktop-ui' ||
+    !entryId ||
+    !extensionId ||
+    !Number.isSafeInteger(generation) ||
+    generation <= 0 ||
+    !contributionId ||
+    !token ||
+    !TOKEN_PATTERN.test(token)
+  ) {
+    return null;
+  }
+  return { scopeId, entryId, extensionId, generation, contributionId, token };
+}
+
+function response(body: string, status: number): Response {
+  return new Response(body, {
+    status,
+    headers: {
+      'cache-control': 'no-store',
+      'content-type': 'text/plain; charset=utf-8',
+    },
+  });
+}
diff --git a/apps/desktop/src/preload/bridge-contract.d.ts b/apps/desktop/src/preload/bridge-contract.d.ts
index 56aec7f324..88d75ea5e1 100644
--- a/apps/desktop/src/preload/bridge-contract.d.ts
+++ b/apps/desktop/src/preload/bridge-contract.d.ts
@@ -305,6 +305,40 @@ export interface PetPackChangedEvent {
   readonly ts: number;
 }
 
+export interface UiExtensionEntry {
+  readonly extensionId: string;
+  readonly displayName: string;
+  readonly description: string;
+  readonly contributionIds: readonly string[];
+  readonly toolNames: readonly string[];
+  readonly uiContributionIds: readonly string[];
+  readonly eventContributionIds: readonly string[];
+  readonly serviceContributionIds: readonly string[];
+  readonly timerContributionIds: readonly string[];
+  readonly dependencies: readonly { readonly id: string }[];
+  readonly configuration: {
+    readonly properties: Readonly<Record<string, {
+      readonly type: 'string' | 'number' | 'boolean';
+      readonly title?: string;
+      readonly description?: string;
+      readonly default?: string | number | boolean;
+      readonly enum?: readonly (string | number | boolean)[];
+      readonly secret: boolean;
+    }>>;
+    readonly required: readonly string[];
+  };
+  readonly entries: readonly {
+    readonly entryId: string;
+    readonly scopeId: string;
+    readonly enabled: boolean;
+    readonly status: 'disabled' | 'active' | 'waiting' | 'failed';
+  }[];
+  readonly active: boolean;
+  readonly enabled: boolean;
+  readonly status: 'disabled' | 'active' | 'waiting' | 'failed';
+  readonly error: string | null;
+}
+
 export interface MakaBridge {
   runtimeHost: {
     query<K extends RendererRuntimeHostQueryOperation>(
@@ -317,6 +351,16 @@ export interface MakaBridge {
     ): Promise<OperationOutput<K>>;
   };
 
+  uiExtensions: {
+    list(): Promise<readonly UiExtensionEntry[]>;
+    importLocal(): Promise<{ ok: true; extensionId: string } | { ok: false; reason: 'cancelled' }>;
+    setEnabled(extensionId: string, enabled: boolean): Promise<{ ok: true }>;
+    getConfiguration(entryId: string): Promise<{ configuration: Record<string, string | number | boolean> }>;
+    configure(entryId: string, configuration: Record<string, string | number | boolean>): Promise<{ ok: true; configuration: Record<string, string | number | boolean> }>;
+    export(extensionId: string): Promise<{ ok: true; path: string } | { ok: false; reason: 'cancelled' }>;
+    remove(extensionId: string): Promise<{ ok: true }>;
+  };
+
   runtimeHostProfiles: {
     getSnapshot(): Promise<DesktopRuntimeHostProfileSnapshot>;
     addAndSelect(
diff --git a/apps/desktop/src/preload/preload.ts b/apps/desktop/src/preload/preload.ts
index 7c789e09a8..2521ae1f0f 100644
--- a/apps/desktop/src/preload/preload.ts
+++ b/apps/desktop/src/preload/preload.ts
@@ -496,6 +496,29 @@ async function bridgeResult<T>(operation: () => Promise<T>, code: string): Promi
 
 const makaBridge = {
   runtimeHost,
+  uiExtensions: {
+    list() {
+      return invokeActiveRuntimeHost('ui-extensions:list');
+    },
+    importLocal() {
+      return invokeActiveRuntimeHost('ui-extensions:importLocal');
+    },
+    setEnabled(extensionId: string, enabled: boolean) {
+      return invokeActiveRuntimeHost('ui-extensions:setEnabled', extensionId, enabled);
+    },
+    getConfiguration(entryId: string) {
+      return invokeActiveRuntimeHost('ui-extensions:getConfiguration', entryId);
+    },
+    configure(entryId: string, configuration: Record<string, string | number | boolean>) {
+      return invokeActiveRuntimeHost('ui-extensions:configure', entryId, configuration);
+    },
+    export(extensionId: string) {
+      return invokeActiveRuntimeHost('ui-extensions:export', extensionId);
+    },
+    remove(extensionId: string) {
+      return invokeActiveRuntimeHost('ui-extensions:remove', extensionId);
+    },
+  },
   runtimeHostProfiles: {
     getSnapshot() {
       return ipcRenderer.invoke('runtime-host-profiles:getSnapshot');
diff --git a/apps/desktop/src/preload/runtime-host-renderer-operations.ts b/apps/desktop/src/preload/runtime-host-renderer-operations.ts
index e0dde01165..0e65bbc3cd 100644
--- a/apps/desktop/src/preload/runtime-host-renderer-operations.ts
+++ b/apps/desktop/src/preload/runtime-host-renderer-operations.ts
@@ -7,6 +7,9 @@ export const RENDERER_RUNTIME_HOST_QUERY_OPERATIONS = [
   'context.diagnostics.query',
   'daily-review.query',
   'execution.inspect.query',
+  'extension.ui.snapshot',
+  'extension.ui.state.query',
+  'extension.configuration.query',
   'scheduled-task.query',
 ] as const satisfies readonly (keyof OperationSpecMap)[];
 
@@ -14,6 +17,8 @@ export const RENDERER_RUNTIME_HOST_COMMAND_OPERATIONS = [
   'daily-review.mutate',
   'scheduled-task.mutate',
   'web-search.execute',
+  'extension.ui.state.mutate',
+  'extension.ui.rpc.invoke',
 ] as const satisfies readonly (keyof OperationSpecMap)[];
 
 /** Runtime Host operations that the sandboxed renderer may invoke directly. */
diff --git a/apps/desktop/src/renderer/app-shell-detail-panel.tsx b/apps/desktop/src/renderer/app-shell-detail-panel.tsx
index 1778f6f961..c0ba43a315 100644
--- a/apps/desktop/src/renderer/app-shell-detail-panel.tsx
+++ b/apps/desktop/src/renderer/app-shell-detail-panel.tsx
@@ -4,7 +4,7 @@ type AppShellDetailPanelProps = Omit<
   ComponentPropsWithoutRef<'div'>,
   'className' | 'data-agents-view'
 > & {
-  agentsView: 'skills' | 'mcp' | 'cron' | 'daily-review' | 'im_hub';
+  agentsView: 'skills' | 'mcp' | 'ui' | 'cron' | 'daily-review' | 'im_hub';
 };
 
 export function AppShellDetailPanel({
diff --git a/apps/desktop/src/renderer/app-shell.tsx b/apps/desktop/src/renderer/app-shell.tsx
index 10d4637f8d..617c4d4407 100644
--- a/apps/desktop/src/renderer/app-shell.tsx
+++ b/apps/desktop/src/renderer/app-shell.tsx
@@ -7,6 +7,7 @@ import {
   useState,
   type CSSProperties,
   type Dispatch,
+  type ReactNode,
   type SetStateAction,
 } from 'react';
 import type { ScheduledTask } from '@maka/core/scheduled-task';
@@ -93,6 +94,8 @@ import {
   usePlanModeState,
 } from './plan-mode-panel';
 import { McpPage } from './mcp-page';
+import { UiExtensionsPage } from './ui-extensions-page';
+import { UiExtensionSlot } from './ui-extension-host';
 import { getOnboardingActivationCandidate, useOnboardingSnapshot } from './use-onboarding-snapshot';
 import type { AppUpdateStatus, OnboardingSnapshot } from '../preload/bridge-contract.js';
 import { DESKTOP_TRANSCRIPT_RANGE_MAX_BYTES } from '../preload/transcript-contract.js';
@@ -232,7 +235,9 @@ type AppShellProps = {
   initialOnboardingSnapshot?: OnboardingSnapshot | null;
 };
 
-export function AppShell({ initialOnboardingSnapshot = null }: AppShellProps = {}) {
+export function AppShell({
+  initialOnboardingSnapshot = null,
+}: AppShellProps = {}) {
   const [uiLocalePreference, setUiLocalePreference] = useState<UiLocalePreference>('auto');
   const [uiLocaleOverride, setUiLocaleOverride] = useState<UiLocale | null>(null);
   const systemUiLocale = useSystemUiLocale();
@@ -2780,6 +2785,7 @@ function AppShellContent({
             onImport={() => setExternalImportOpen(true)}
             rowActions={sessionRowActions}
             projectActions={projectRowActions}
+            footerExtension={<UiExtensionSlot name="sidebar.footer" />}
           />
         }
       >
@@ -2825,6 +2831,8 @@ function AppShellContent({
                 />
               ) : navSelection.section === 'extensions' && navSelection.module === 'mcp' ? (
                 <McpPage hubHeader={extensionsHubHeader} />
+              ) : navSelection.section === 'extensions' && navSelection.module === 'ui' ? (
+                <UiExtensionsPage hubHeader={extensionsHubHeader} />
               ) : navSelection.section === 'automations' && navSelection.module === 'scheduled-tasks' ? (
                 <ScheduledTasksPage
                   hubHeader={automationsHubHeader}
@@ -3057,6 +3065,7 @@ function AppShellContent({
               >
                 {navSelection.section === 'sessions' ? (
                   <ChatMessageSurface
+                headerExtension={<UiExtensionSlot name="conversation.header" />}
                 sessionUiController={sessionUiController}
                 activeSessionId={activeId}
                 hasOlderHistory={activeTranscriptRange?.hasOlder === true}
diff --git a/apps/desktop/src/renderer/app.tsx b/apps/desktop/src/renderer/app.tsx
index 75d5e20573..af7f8725e8 100644
--- a/apps/desktop/src/renderer/app.tsx
+++ b/apps/desktop/src/renderer/app.tsx
@@ -7,6 +7,7 @@ import { useAstryxThemeMode } from './astryx-theme-mode';
 import type { OnboardingSnapshot } from '../preload/bridge-contract.js';
 import { RuntimeHostSshTerminalDialog } from './settings/runtime-host-ssh-terminal-dialog.js';
 import { readSystemUiLocale } from './use-system-ui-locale';
+import { UiExtensionHost } from './ui-extension-host';
 
 export function App({
   initialOnboardingSnapshot = null,
@@ -63,7 +64,11 @@ export function App({
     <StrictMode>
       <Theme theme={makaTheme} mode={astryxMode}>
         {runtimeHostReady ? (
-          <AppShell initialOnboardingSnapshot={initialOnboardingSnapshot} />
+          <UiExtensionHost
+            officialSnapshot={() => (
+              <AppShell initialOnboardingSnapshot={initialOnboardingSnapshot} />
+            )}
+          />
         ) : (
           <LocaleProvider locale={readSystemUiLocale()}>
             <AstryxLocaleProvider>
diff --git a/apps/desktop/src/renderer/chat-message-surface.tsx b/apps/desktop/src/renderer/chat-message-surface.tsx
index 5719dd55f9..feda212f6e 100644
--- a/apps/desktop/src/renderer/chat-message-surface.tsx
+++ b/apps/desktop/src/renderer/chat-message-surface.tsx
@@ -74,6 +74,8 @@ interface ChatMessageSurfaceProps extends Omit<
   historyLoadPending: boolean;
   onLoadEarlierHistory: () => Promise<void> | void;
   onReturnToLatestHistory: () => Promise<void> | void;
+  /** Independently lifecycle-managed UI contributions above the transcript. */
+  headerExtension?: ReactNode;
 }
 
 function captureLiveContent(
@@ -112,6 +114,7 @@ export function ChatMessageSurface({
   historyLoadPending,
   onLoadEarlierHistory,
   onReturnToLatestHistory,
+  headerExtension,
   ...chatViewRest
 }: ChatMessageSurfaceProps) {
   const locale = useUiLocale();
@@ -214,6 +217,7 @@ export function ChatMessageSurface({
 
   return (
     <>
+      {headerExtension}
       <ChatView
         {...chatViewRest}
         liveTurn={liveTurn}
diff --git a/apps/desktop/src/renderer/index.html b/apps/desktop/src/renderer/index.html
index 76098398f6..83b79cab02 100644
--- a/apps/desktop/src/renderer/index.html
+++ b/apps/desktop/src/renderer/index.html
@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'"
+      content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; frame-src 'self' maka-ui:"
     />
     <title>Maka</title>
     <style>
diff --git a/apps/desktop/src/renderer/locales/settings-subagents-copy.ts b/apps/desktop/src/renderer/locales/settings-subagents-copy.ts
index 03a27da730..93662b96da 100644
--- a/apps/desktop/src/renderer/locales/settings-subagents-copy.ts
+++ b/apps/desktop/src/renderer/locales/settings-subagents-copy.ts
@@ -148,8 +148,10 @@ const SETTINGS_SUBAGENTS_COPY_BY_LOCALE = {
     },
     profiles: {
       local_read: { label: '代码阅读', description: '只读访问当前工作区，适合搜索、理解和总结代码。' },
-      web_research: { label: '网络研究', description: '只使用联网搜索，适合查找外部资料和最新信息。' },
+      web_research: { label: '网络研究', description: '使用联网搜索或直接抓取页面，适合查找和提取外部资料。' },
       implementation: { label: '实现代码', description: '可以读写文件并执行命令，在隔离 worktree 中完成改动。' },
+      tool_author: { label: '工具作者', description: '通过正式接口创建、安装并在沙箱中测试候选 Tool，不修改工作区源码。' },
+      ui_author: { label: 'UI 作者', description: '通过正式接口创建、安装并在沙箱中测试候选 UI，不修改工作区源码。' },
     },
     thinking: {
       off: '关闭',
@@ -229,8 +231,10 @@ const SETTINGS_SUBAGENTS_COPY_BY_LOCALE = {
     },
     profiles: {
       local_read: { label: 'Code reading', description: 'Read-only access to the current workspace for search, understanding, and summaries.' },
-      web_research: { label: 'Web research', description: 'Web search only, for external sources and current information.' },
+      web_research: { label: 'Web research', description: 'Search the web or fetch a concrete page for external sources and current information.' },
       implementation: { label: 'Implementation', description: 'Read and write files and run commands in an isolated worktree.' },
+      tool_author: { label: 'Tool author', description: 'Create, install, and sandbox-test Tool candidates through the formal authoring interface without editing workspace source.' },
+      ui_author: { label: 'UI author', description: 'Create, install, and sandbox-test UI candidates through the formal authoring interface without editing workspace source.' },
     },
     thinking: {
       off: 'Off',
diff --git a/apps/desktop/src/renderer/nav-selection.ts b/apps/desktop/src/renderer/nav-selection.ts
index 6fa5c3c94d..e0f465e493 100644
--- a/apps/desktop/src/renderer/nav-selection.ts
+++ b/apps/desktop/src/renderer/nav-selection.ts
@@ -29,7 +29,7 @@ function isSessionFilter(value: unknown): value is SessionFilter {
 }
 
 function isExtensionModule(value: unknown): value is ExtensionModule {
-  return value === 'skills' || value === 'mcp';
+  return value === 'skills' || value === 'mcp' || value === 'ui';
 }
 
 function isAutomationModule(value: unknown): value is AutomationModule {
diff --git a/apps/desktop/src/renderer/settings/settings-surface.tsx b/apps/desktop/src/renderer/settings/settings-surface.tsx
index 17f22f8165..3fd9e156b0 100644
--- a/apps/desktop/src/renderer/settings/settings-surface.tsx
+++ b/apps/desktop/src/renderer/settings/settings-surface.tsx
@@ -51,6 +51,7 @@ import { UsageSettingsPage } from './usage-settings-page';
 import { WebSearchSettingsPage } from './web-search-settings-page';
 import type { UiLocaleUpdateGate } from './ui-locale-update-gate';
 import { getSettingsSharedCopy } from '../locales/settings-shared-copy.js';
+import { UiExtensionSlot } from '../ui-extension-host.js';
 
 const NARROW_SETTINGS_QUERY = '(max-width: 760px)';
 
@@ -344,6 +345,7 @@ export function SettingsSurface(props: {
               )}
               content={(
                 <LayoutContent padding={6}>
+                  <UiExtensionSlot name="settings.content" />
                   {loading ? (
                     <SettingsSkeleton />
                   ) : (
diff --git a/apps/desktop/src/renderer/styles.css b/apps/desktop/src/renderer/styles.css
index a1fec42305..a392b90288 100644
--- a/apps/desktop/src/renderer/styles.css
+++ b/apps/desktop/src/renderer/styles.css
@@ -47,3 +47,73 @@
 @import "./styles/quote-side-panel.css" layer(components);
 @import "./styles/custom-pet-companion.css" layer(components);
 @import "./styles/astryx-mount.css" layer(components);
+/* The bootstrap shell owns only snapshot selection and isolation. Product UI
+   layout remains inside the selected official or dynamic contribution. */
+.maka-ui-extension-shell,
+.maka-ui-official-snapshot {
+  width: 100%;
+  height: 100%;
+}
+
+.maka-ui-extension-frame {
+  border: 0;
+  background: transparent;
+}
+
+.maka-ui-extension-frame-host {
+  position: relative;
+  min-width: 0;
+  overflow: hidden;
+}
+
+.maka-ui-extension-frame-host--root {
+  width: 100%;
+  height: 100%;
+}
+
+.maka-ui-extension-frame-host--overlay {
+  position: fixed;
+  inset: 0;
+  z-index: 2147483000;
+}
+
+.maka-ui-extension-frame-host--slot {
+  width: 100%;
+  height: 100%;
+  min-height: 64px;
+}
+
+.maka-ui-extension-nested-slot {
+  position: absolute;
+  z-index: 1;
+  display: grid;
+  grid-auto-flow: row;
+  grid-auto-rows: minmax(0, 1fr);
+  overflow: hidden;
+}
+
+.maka-ui-extension-frame--root {
+  display: block;
+  width: 100%;
+  height: 100%;
+}
+
+.maka-ui-extension-frame--overlay {
+  position: fixed;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  z-index: 2147483000;
+}
+
+.maka-ui-extension-slot {
+  display: grid;
+  gap: 6px;
+  min-width: 0;
+}
+
+.maka-ui-extension-frame--slot {
+  display: block;
+  width: 100%;
+  min-height: 64px;
+}
diff --git a/apps/desktop/src/renderer/ui-extension-frame-url.ts b/apps/desktop/src/renderer/ui-extension-frame-url.ts
new file mode 100644
index 0000000000..55211c0213
--- /dev/null
+++ b/apps/desktop/src/renderer/ui-extension-frame-url.ts
@@ -0,0 +1,17 @@
+export function uiExtensionFrameUrl(input: {
+  readonly scopeId: string;
+  readonly entryId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+  readonly contributionId: string;
+  readonly token: string;
+}): string {
+  const url = new URL('maka-ui://frame/v1');
+  url.searchParams.set('scopeId', input.scopeId);
+  url.searchParams.set('entryId', input.entryId);
+  url.searchParams.set('extensionId', input.extensionId);
+  url.searchParams.set('generation', String(input.generation));
+  url.searchParams.set('contributionId', input.contributionId);
+  url.searchParams.set('token', input.token);
+  return url.toString();
+}
diff --git a/apps/desktop/src/renderer/ui-extension-host.tsx b/apps/desktop/src/renderer/ui-extension-host.tsx
new file mode 100644
index 0000000000..5d5f9245d3
--- /dev/null
+++ b/apps/desktop/src/renderer/ui-extension-host.tsx
@@ -0,0 +1,546 @@
+import {
+  createContext,
+  useContext,
+  useEffect,
+  useLayoutEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from 'react';
+import type {
+  ExtensionUiContributionProjection,
+  ExtensionUiSnapshotResult,
+  ExtensionUiStateValue,
+} from '@maka/runtime-host/protocol';
+import { uiExtensionFrameUrl } from './ui-extension-frame-url.js';
+import { UiPluginRuntime } from './ui-plugin-runtime.js';
+
+const DESKTOP_UI_SCOPE = 'desktop-ui';
+const REFRESH_MS = 1_000;
+
+interface UiExtensionSlotContextValue {
+  readonly contributions: readonly ExtensionUiContributionProjection[];
+  readonly onSafeMode: () => void;
+}
+
+const UiExtensionSlotContext = createContext<UiExtensionSlotContextValue>({
+  contributions: Object.freeze([]),
+  onSafeMode: () => undefined,
+});
+
+export function UiExtensionSlotProvider({
+  contributions,
+  onSafeMode,
+  children,
+}: UiExtensionSlotContextValue & { readonly children?: ReactNode }) {
+  const value = useMemo(() => ({ contributions, onSafeMode }), [contributions, onSafeMode]);
+  return (
+    <UiExtensionSlotContext.Provider value={value}>{children}</UiExtensionSlotContext.Provider>
+  );
+}
+
+/**
+ * Stable composition seat owned by the official Maka snapshot.
+ *
+ * Each child remains a separate opaque-origin frame and therefore keeps its
+ * own Fiber generation, permissions, Host bridge, state, and disposal
+ * boundary. Adding or replacing one child never remounts the root snapshot.
+ */
+export function UiExtensionSlot({
+  name,
+  className,
+}: {
+  name: string;
+  className?: string;
+}) {
+  const context = useContext(UiExtensionSlotContext);
+  const contributions = context.contributions.filter(
+    (item) => item.surface === 'app.slot' && item.slot === name,
+  );
+  if (contributions.length === 0) return null;
+  return (
+    <div
+      className={['maka-ui-extension-slot', className].filter(Boolean).join(' ')}
+      data-ui-slot={name}
+    >
+      {contributions.map((item) => (
+        <SandboxedUiFrame
+          key={`${item.extensionId}:${item.generation}:${item.id}`}
+          contribution={item}
+          layer="slot"
+          onSafeMode={context.onSafeMode}
+          contributions={context.contributions}
+          ancestry={new Set([contributionKey(item)])}
+        />
+      ))}
+    </div>
+  );
+}
+
+/**
+ * The fixed Desktop shell is intentionally tiny. The shipped Maka product UI
+ * is the trusted fallback snapshot; installed client contributions enter the
+ * same root/overlay selection path and may replace the entire product surface.
+ */
+export function UiExtensionHost({
+  officialSnapshot,
+}: {
+  officialSnapshot: () => ReactNode;
+}) {
+  const [snapshot, setSnapshot] = useState<ExtensionUiSnapshotResult | null>(null);
+  const [clientContributions, setClientContributions] = useState<
+    readonly ExtensionUiContributionProjection[]
+  >(Object.freeze([]));
+  const [safeMode, setSafeMode] = useState(false);
+  const clientRuntime = useMemo(() => new UiPluginRuntime(), []);
+
+  useEffect(() => {
+    let disposed = false;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const refresh = async () => {
+      try {
+        const next = await window.maka.runtimeHost.query('extension.ui.snapshot', {
+          scopeId: DESKTOP_UI_SCOPE,
+        });
+        if (!disposed) setSnapshot((current) => (current?.digest === next.digest ? current : next));
+      } catch {
+        // Fail open to the compiled official snapshot while the Host reconnects.
+      } finally {
+        if (!disposed) timer = setTimeout(refresh, REFRESH_MS);
+      }
+    };
+    void refresh();
+    return () => {
+      disposed = true;
+      if (timer) clearTimeout(timer);
+    };
+  }, []);
+
+  useEffect(() => {
+    let cancelled = false;
+    void clientRuntime
+      .reconcile(snapshot?.contributions ?? [])
+      .then((contributions) => {
+        if (!cancelled) setClientContributions(contributions);
+      })
+      .catch(() => undefined);
+    return () => {
+      cancelled = true;
+    };
+  }, [clientRuntime, snapshot]);
+
+  useEffect(
+    () => () => {
+      void clientRuntime.close();
+    },
+    [clientRuntime],
+  );
+
+  useEffect(() => {
+    const recover = (event: KeyboardEvent) => {
+      if ((event.metaKey || event.ctrlKey) && event.shiftKey && event.key === 'Backspace') {
+        event.preventDefault();
+        setSafeMode(true);
+      }
+    };
+    window.addEventListener('keydown', recover, { capture: true });
+    return () => window.removeEventListener('keydown', recover, { capture: true });
+  }, []);
+
+  const selected = useMemo(
+    () => selectUiSnapshots(null, clientContributions),
+    [clientContributions],
+  );
+  const selectedRoot = safeMode ? selected.official : selected.root;
+  return (
+    <div
+      className="maka-ui-extension-shell"
+      data-ui-safe-mode={safeMode || undefined}
+      data-ui-composition-id={safeMode ? 'dev.maka.desktop@desktop-build' : snapshot?.digest}
+    >
+      {selectedRoot.kind === 'sandboxed' ? (
+        <SandboxedUiFrame
+          contribution={selectedRoot.contribution}
+          layer="root"
+          onSafeMode={() => setSafeMode(true)}
+          contributions={selected.slots}
+          ancestry={new Set([contributionKey(selectedRoot.contribution)])}
+        />
+      ) : (
+        <UiExtensionSlotProvider
+          contributions={safeMode ? Object.freeze([]) : selected.slots}
+          onSafeMode={() => setSafeMode(true)}
+        >
+          <div
+            className="maka-ui-official-snapshot"
+            data-extension-id={selectedRoot.extensionId}
+            data-extension-build={selectedRoot.buildId}
+          >
+            {officialSnapshot()}
+          </div>
+        </UiExtensionSlotProvider>
+      )}
+      {!safeMode && selected.overlays.map((item) => (
+        <SandboxedUiFrame
+          key={`${item.extensionId}:${item.id}`}
+          contribution={item}
+          layer="overlay"
+          onSafeMode={() => setSafeMode(true)}
+          contributions={selected.slots}
+          ancestry={new Set([contributionKey(item)])}
+        />
+      ))}
+    </div>
+  );
+}
+
+type UiSnapshotCandidate =
+  | {
+      readonly kind: 'official';
+      readonly extensionId: 'dev.maka.desktop';
+      readonly buildId: 'desktop-build';
+      readonly id: 'official-root';
+      readonly priority: -10_000;
+      readonly node: ReactNode;
+    }
+  | {
+      readonly kind: 'sandboxed';
+      readonly extensionId: string;
+      readonly generation: number;
+      readonly id: string;
+      readonly priority: number;
+      readonly contribution: ExtensionUiContributionProjection;
+    };
+
+export function selectUiSnapshots(
+  officialNode: ReactNode,
+  contributions: readonly ExtensionUiContributionProjection[],
+) {
+  const official: UiSnapshotCandidate = Object.freeze({
+    kind: 'official',
+    extensionId: 'dev.maka.desktop',
+    buildId: 'desktop-build',
+    id: 'official-root',
+    priority: -10_000,
+    node: officialNode,
+  });
+  const ordered = [...contributions].sort(
+    (left, right) =>
+      right.priority - left.priority ||
+      left.extensionId.localeCompare(right.extensionId) ||
+      left.id.localeCompare(right.id),
+  );
+  const dynamicRoot = ordered.find(({ surface }) => surface === 'app.root');
+  return Object.freeze({
+    official,
+    root: dynamicRoot && dynamicRoot.priority > official.priority
+      ? Object.freeze({
+          kind: 'sandboxed' as const,
+          extensionId: dynamicRoot.extensionId,
+          generation: dynamicRoot.generation,
+          id: dynamicRoot.id,
+          priority: dynamicRoot.priority,
+          contribution: dynamicRoot,
+        })
+      : official,
+    overlays: Object.freeze(ordered.filter(({ surface }) => surface === 'app.overlay')),
+    slots: Object.freeze(ordered.filter(({ surface }) => surface === 'app.slot')),
+  });
+}
+
+function SandboxedUiFrame({
+  contribution,
+  layer,
+  onSafeMode,
+  contributions,
+  ancestry,
+}: {
+  contribution: ExtensionUiContributionProjection;
+  layer: 'root' | 'overlay' | 'slot';
+  onSafeMode: () => void;
+  contributions: readonly ExtensionUiContributionProjection[];
+  ancestry: ReadonlySet<string>;
+}) {
+  const frameRef = useRef<HTMLIFrameElement>(null);
+  const [slotRects, setSlotRects] = useState<ReadonlyMap<string, UiSlotRect>>(new Map());
+  const token = useMemo(
+    () => crypto.randomUUID(),
+    [contribution.entryId, contribution.generation, contribution.id],
+  );
+  useLayoutEffect(() => {
+    const receive = (event: MessageEvent) => {
+      if (event.source !== frameRef.current?.contentWindow) return;
+      if (isBridgeReady(event.data, token)) {
+        postBridgeReady(frameRef.current, token);
+        return;
+      }
+      const layout = decodeSlotLayout(event.data, token, contribution.slots ?? []);
+      if (layout) {
+        setSlotRects(layout);
+        return;
+      }
+      const request = decodeBridgeRequest(event.data, token);
+      if (!request) return;
+      if (request.kind === 'safe_mode') {
+        onSafeMode();
+        return;
+      }
+      const identity = {
+        scopeId: DESKTOP_UI_SCOPE,
+        entryId: contribution.entryId,
+        extensionId: contribution.extensionId,
+        generation: contribution.generation,
+      };
+      const operation = isSessionBridgeRequest(request)
+        ? runSessionBridgeRequest(contribution, request)
+        : request.kind === 'config'
+          ? window.maka.runtimeHost.query('extension.configuration.query', {
+              entryId: contribution.entryId,
+            })
+        : request.kind === 'invoke'
+        ? window.maka.runtimeHost.command('extension.ui.rpc.invoke', {
+          ...identity,
+          method: request.method,
+          args: request.args as ExtensionUiStateValue,
+        })
+        : request.kind === 'get'
+          ? window.maka.runtimeHost.query('extension.ui.state.query', {
+            ...identity,
+            key: request.key,
+          })
+          : window.maka.runtimeHost.command(
+            'extension.ui.state.mutate',
+            request.kind === 'set'
+              ? { ...identity, key: request.key, kind: 'set', value: request.value as ExtensionUiStateValue }
+              : { ...identity, key: request.key, kind: 'delete' },
+          );
+      void operation.then(
+        (result) => frameRef.current?.contentWindow?.postMessage({ channel: 'maka-ui-host/v1', token, id: request.id, ok: true, result }, '*'),
+        (error) => frameRef.current?.contentWindow?.postMessage({ channel: 'maka-ui-host/v1', token, id: request.id, ok: false, error: error instanceof Error ? error.message : String(error) }, '*'),
+      );
+    };
+    window.addEventListener('message', receive);
+    return () => window.removeEventListener('message', receive);
+  }, [contribution, onSafeMode, token]);
+  return (
+    <div className={`maka-ui-extension-frame-host maka-ui-extension-frame-host--${layer}`}>
+      <iframe
+        ref={frameRef}
+        className={`maka-ui-extension-frame maka-ui-extension-frame--${layer}`}
+        title={`${contribution.extensionId}: ${contribution.id}`}
+        data-extension-id={contribution.extensionId}
+        data-extension-generation={contribution.generation}
+        data-contribution-id={contribution.id}
+        sandbox="allow-scripts allow-modals"
+        referrerPolicy="no-referrer"
+        src={uiExtensionFrameUrl({
+          scopeId: DESKTOP_UI_SCOPE,
+          entryId: contribution.entryId,
+          extensionId: contribution.extensionId,
+          generation: contribution.generation,
+          contributionId: contribution.id,
+          token,
+        })}
+      />
+      {[...slotRects].map(([slot, rect]) => (
+        <div
+          key={slot}
+          className="maka-ui-extension-nested-slot"
+          data-ui-slot={slot}
+          style={{ left: rect.x, top: rect.y, width: rect.width, height: rect.height }}
+        >
+          {slotChildren(slot, contributions, ancestry).map((child) => {
+            const key = contributionKey(child);
+            return (
+              <SandboxedUiFrame
+                key={key}
+                contribution={child}
+                layer="slot"
+                onSafeMode={onSafeMode}
+                contributions={contributions}
+                ancestry={new Set([...ancestry, key])}
+              />
+            );
+          })}
+        </div>
+      ))}
+    </div>
+  );
+}
+
+interface UiSlotRect {
+  readonly x: number;
+  readonly y: number;
+  readonly width: number;
+  readonly height: number;
+}
+
+function decodeSlotLayout(
+  value: unknown,
+  token: string,
+  declared: readonly string[],
+): ReadonlyMap<string, UiSlotRect> | null {
+  if (!value || typeof value !== 'object') return null;
+  const message = value as Record<string, unknown>;
+  if (
+    message.channel !== 'maka-ui-slot-layout/v1' ||
+    message.token !== token ||
+    !Array.isArray(message.slots) ||
+    message.slots.length > 32
+  ) return null;
+  const allowed = new Set(declared);
+  const result = new Map<string, UiSlotRect>();
+  for (const value of message.slots) {
+    if (!value || typeof value !== 'object') return null;
+    const rect = value as Record<string, unknown>;
+    if (
+      typeof rect.name !== 'string' ||
+      !allowed.has(rect.name) ||
+      ![rect.x, rect.y, rect.width, rect.height].every(
+        (number) => typeof number === 'number' && Number.isFinite(number),
+      ) ||
+      (rect.width as number) < 0 ||
+      (rect.height as number) < 0
+    ) return null;
+    result.set(rect.name, {
+      x: rect.x as number,
+      y: rect.y as number,
+      width: rect.width as number,
+      height: rect.height as number,
+    });
+  }
+  return result;
+}
+
+function slotChildren(
+  slot: string,
+  contributions: readonly ExtensionUiContributionProjection[],
+  ancestry: ReadonlySet<string>,
+): readonly ExtensionUiContributionProjection[] {
+  return contributions
+    .filter(
+      (item) =>
+        item.surface === 'app.slot' &&
+        item.slot === slot &&
+        !ancestry.has(contributionKey(item)),
+    )
+    .sort(
+      (left, right) =>
+        right.priority - left.priority ||
+        left.extensionId.localeCompare(right.extensionId) ||
+        left.id.localeCompare(right.id),
+    );
+}
+
+function contributionKey(contribution: ExtensionUiContributionProjection): string {
+  return `${contribution.entryId}:${contribution.generation}:${contribution.id}`;
+}
+
+function postBridgeReady(frame: HTMLIFrameElement | null, token: string): void {
+  frame?.contentWindow?.postMessage({ channel: 'maka-ui-host-ready/v1', token }, '*');
+}
+
+function isBridgeReady(value: unknown, token: string): boolean {
+  if (!value || typeof value !== 'object') return false;
+  const message = value as Record<string, unknown>;
+  return message.channel === 'maka-ui-bridge-ready/v1' && message.token === token;
+}
+
+type UiBridgeRequest =
+  | { id: string; kind: 'safe_mode' }
+  | { id: string; kind: 'config' }
+  | { id: string; kind: 'get' | 'delete'; key: string }
+  | { id: string; kind: 'set'; key: string; value: unknown }
+  | { id: string; kind: 'invoke'; method: string; args: unknown }
+  | { id: string; kind: 'session_list' }
+  | { id: string; kind: 'session_send'; sessionId?: string; text: string }
+  | { id: string; kind: 'session_stop'; sessionId: string };
+
+function decodeBridgeRequest(value: unknown, token: string): UiBridgeRequest | null {
+  if (!value || typeof value !== 'object') return null;
+  const request = value as Record<string, unknown>;
+  if (request.channel !== 'maka-ui-bridge/v1' || request.token !== token) return null;
+  if (typeof request.id !== 'string' || !/^[0-9]{1,16}$/u.test(request.id)) return null;
+  if (request.kind === 'safe_mode') return { id: request.id, kind: request.kind };
+  if (request.kind === 'config') return { id: request.id, kind: request.kind };
+  if (request.kind === 'invoke') {
+    if (typeof request.method !== 'string' || !/^[A-Za-z][A-Za-z0-9_-]{0,127}$/u.test(request.method)) return null;
+    return { id: request.id, kind: request.kind, method: request.method, args: request.args };
+  }
+  if (request.kind === 'session_list') return { id: request.id, kind: request.kind };
+  if (request.kind === 'session_send') {
+    if (
+      (request.sessionId !== undefined && !isBridgeIdentifier(request.sessionId)) ||
+      typeof request.text !== 'string' ||
+      request.text.trim().length === 0 ||
+      request.text.length > 64 * 1024
+    ) return null;
+    return {
+      id: request.id,
+      kind: request.kind,
+      ...(request.sessionId ? { sessionId: request.sessionId } : {}),
+      text: request.text,
+    };
+  }
+  if (request.kind === 'session_stop') {
+    if (!isBridgeIdentifier(request.sessionId)) return null;
+    return { id: request.id, kind: request.kind, sessionId: request.sessionId };
+  }
+  if (request.kind !== 'get' && request.kind !== 'set' && request.kind !== 'delete') return null;
+  if (typeof request.key !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(request.key)) return null;
+  return request.kind === 'set'
+    ? { id: request.id, kind: request.kind, key: request.key, value: request.value }
+    : { id: request.id, kind: request.kind, key: request.key };
+}
+
+function isBridgeIdentifier(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0 && value.length <= 128 && !/[\r\n\0]/u.test(value);
+}
+
+function isSessionBridgeRequest(
+  request: UiBridgeRequest,
+): request is Extract<UiBridgeRequest, { kind: `session_${string}` }> {
+  return request.kind === 'session_list' ||
+    request.kind === 'session_send' ||
+    request.kind === 'session_stop';
+}
+
+async function runSessionBridgeRequest(
+  contribution: ExtensionUiContributionProjection,
+  request: Extract<UiBridgeRequest, { kind: `session_${string}` }>,
+): Promise<unknown> {
+  if (contribution.surface !== 'app.root' || contribution.sessionAccess !== true) {
+    throw new Error('This UI Extension has no Session capability');
+  }
+  if (request.kind === 'session_list') {
+    const sessions = await window.maka.sessions.list();
+    return {
+      sessions: sessions.map((session) => ({
+        id: session.id,
+        name: session.name,
+        status: session.status,
+        lastMessageAt: session.lastMessageAt,
+        lastMessagePreview: session.lastMessagePreview,
+        runningTurnIds: session.runningTurnIds ?? [],
+        model: session.model,
+      })),
+    };
+  }
+  if (request.kind === 'session_stop') {
+    await window.maka.sessions.stop(request.sessionId, { source: 'stop_button' });
+    return { ok: true };
+  }
+  const session = request.sessionId
+    ? (await window.maka.sessions.list()).find(({ id }) => id === request.sessionId)
+    : await window.maka.sessions.create();
+  if (!session) throw new Error('Maka Session does not exist');
+  const turnId = crypto.randomUUID();
+  const result = await window.maka.sessions.send(session.id, {
+    type: 'send',
+    turnId,
+    text: request.text.trim(),
+  });
+  if (!result.ok) throw new Error('Prompt was rejected by Skill invocation');
+  return { ok: true, sessionId: session.id, turnId };
+}
diff --git a/apps/desktop/src/renderer/ui-extensions-page.tsx b/apps/desktop/src/renderer/ui-extensions-page.tsx
new file mode 100644
index 0000000000..19ae5b4070
--- /dev/null
+++ b/apps/desktop/src/renderer/ui-extensions-page.tsx
@@ -0,0 +1,122 @@
+import { useCallback, useEffect, useState } from 'react';
+import { Button, EmptyState, List, ListItem, StatusDot, Switch } from '@astryxdesign/core';
+import { ModulePage, dotForStatus, type ModuleHubHeader } from '@maka/ui';
+import { FolderOpen, Monitor, RefreshCcw, Trash2, ICON_SIZE } from '@maka/ui/icons';
+import type { UiExtensionEntry } from '../preload/bridge-contract.js';
+
+export function UiExtensionsPage({ hubHeader }: { hubHeader: ModuleHubHeader }) {
+  const [entries, setEntries] = useState<readonly UiExtensionEntry[]>([]);
+  const [busy, setBusy] = useState<string | null>('load');
+  const [error, setError] = useState<string | null>(null);
+  const reload = useCallback(async () => {
+    setBusy('load');
+    try {
+      setEntries(await window.maka.uiExtensions.list());
+      setError(null);
+    } catch (cause) {
+      setError(cause instanceof Error ? cause.message : String(cause));
+    } finally {
+      setBusy(null);
+    }
+  }, []);
+  useEffect(() => { void reload(); }, [reload]);
+
+  const act = async (label: string, operation: () => Promise<unknown>) => {
+    setBusy(label);
+    try {
+      await operation();
+      await reload();
+    } catch (cause) {
+      setError(cause instanceof Error ? cause.message : String(cause));
+      setBusy(null);
+    }
+  };
+  const latest = [...entries].reverse().filter((entry, index, all) =>
+    all.findIndex((candidate) => candidate.extensionId === entry.extensionId) === index,
+  );
+  return (
+    <main className="maka-main detailPane maka-module-main agents-chat-panel" data-page-shell="layout" data-module="ui-extensions" data-maka-contract="module-main" aria-label="Extensions">
+      <ModulePage
+        title={hubHeader.title}
+        meta={`${new Set(entries.map((entry) => entry.extensionId)).size} 个插件`}
+        actions={<div className="maka-module-main-actions" role="group" aria-label="插件操作">
+          <Button
+            variant="primary"
+            label={busy === 'import' ? '正在导入…' : '安装插件'}
+            icon={<FolderOpen size={ICON_SIZE.chrome} aria-hidden="true" />}
+            isDisabled={busy !== null}
+            onClick={() => void act('import', async () => {
+              const result = await window.maka.uiExtensions.importLocal();
+              if (!result.ok && result.reason === 'cancelled') return;
+            })}
+          />
+          <Button variant="secondary" label="刷新" icon={<RefreshCcw size={ICON_SIZE.chrome} aria-hidden="true" />} isDisabled={busy !== null} onClick={() => void reload()} />
+        </div>}
+        toolbar={<div className="maka-module-page-bar">{hubHeader.badge}</div>}
+      >
+        {error ? <div role="alert" className="maka-module-error">{error}</div> : null}
+        {latest.length === 0 && busy === null ? (
+          <EmptyState icon={<Monitor size={ICON_SIZE.empty} />} title="还没有插件" description="安装插件目录或 .maka-extension Bundle；一个插件可同时提供 Tool、UI、Event、Service 和 Timer。" />
+        ) : (
+          <List aria-label="已安装插件">
+            {latest.map((entry) => (
+              <ListItem
+                key={entry.extensionId}
+                label={entry.displayName}
+                description={`${entry.toolNames.length} Tools · ${entry.uiContributionIds.length} UI · ${entry.eventContributionIds.length} Events/Listeners · ${entry.serviceContributionIds.length} Services · ${entry.timerContributionIds.length} Timers · ${entry.dependencies.length} 依赖${entry.error ? ` · ${entry.error}` : ''}`}
+                startContent={<StatusDot variant={dotForStatus(entry.status === 'active' ? 'success' : entry.status === 'failed' ? 'error' : 'neutral')} label={entry.status} />}
+                endContent={<div className="maka-module-main-actions">
+                  <Switch
+                    label={`${entry.enabled ? '停用' : '启用'} ${entry.extensionId}`}
+                    value={entry.enabled}
+                    isDisabled={busy !== null}
+                    onChange={(enabled) => void act(`toggle:${entry.extensionId}`, () => window.maka.uiExtensions.setEnabled(entry.extensionId, enabled))}
+                  />
+                  {Object.keys(entry.configuration.properties).length > 0
+                    ? entry.entries.map((compositionEntry) => (
+                        <Button
+                          key={compositionEntry.entryId}
+                          variant="ghost"
+                          label={`配置${compositionEntry.scopeId === 'profile' ? ' Tool / Event / Service / Timer' : ' UI'}`}
+                          isDisabled={busy !== null}
+                          onClick={() =>
+                            void act(`configure:${compositionEntry.entryId}`, async () => {
+                              const current = await window.maka.uiExtensions.getConfiguration(
+                                compositionEntry.entryId,
+                              );
+                              const encoded = window.prompt(
+                                `编辑 ${entry.displayName} · ${compositionEntry.scopeId} 配置（JSON）`,
+                                JSON.stringify(current.configuration, null, 2),
+                              );
+                              if (encoded === null) return;
+                              const parsed = JSON.parse(encoded) as Record<
+                                string,
+                                string | number | boolean
+                              >;
+                              await window.maka.uiExtensions.configure(
+                                compositionEntry.entryId,
+                                parsed,
+                              );
+                            })
+                          }
+                        />
+                      ))
+                    : null}
+                  <Button
+                    variant="ghost"
+                    label="导出"
+                    isDisabled={busy !== null}
+                    onClick={() => void act(`export:${entry.extensionId}`, () =>
+                      window.maka.uiExtensions.export(entry.extensionId),
+                    )}
+                  />
+                  <Button variant="ghost" label="删除" icon={<Trash2 size={ICON_SIZE.chrome} aria-hidden="true" />} isDisabled={busy !== null} onClick={() => void act(`remove:${entry.extensionId}`, () => window.maka.uiExtensions.remove(entry.extensionId))} />
+                </div>}
+              />
+            ))}
+          </List>
+        )}
+      </ModulePage>
+    </main>
+  );
+}
diff --git a/apps/desktop/src/renderer/ui-plugin-runtime.ts b/apps/desktop/src/renderer/ui-plugin-runtime.ts
new file mode 100644
index 0000000000..6a6f9946a0
--- /dev/null
+++ b/apps/desktop/src/renderer/ui-plugin-runtime.ts
@@ -0,0 +1,113 @@
+import { Context, Service, type Fiber } from '@maka/runtime/plugin-kernel';
+import type { ExtensionUiContributionProjection } from '@maka/runtime-host/protocol';
+
+declare module '@maka/runtime/plugin-kernel' {
+  interface Context {
+    clientUi: ClientUiRegistry;
+  }
+}
+
+interface ClientEntry {
+  readonly signature: string;
+  readonly fiber: Fiber;
+}
+
+class ClientUiRegistry extends Service {
+  readonly entries: Array<
+    ExtensionUiContributionProjection & { readonly token: symbol }
+  > = [];
+
+  constructor(ctx: Context) {
+    super(ctx, 'clientUi');
+  }
+
+  register(contribution: ExtensionUiContributionProjection): void {
+    const entry = Object.freeze({ ...contribution, token: Symbol(contribution.id) });
+    this.entries.push(entry);
+    this.ctx.effect(
+      () => () => {
+        const index = this.entries.findIndex(({ token }) => token === entry.token);
+        if (index >= 0) this.entries.splice(index, 1);
+      },
+      `ui:${contribution.id}`,
+    );
+  }
+
+  inspect(): readonly ExtensionUiContributionProjection[] {
+    return Object.freeze(
+      this.entries
+        .map(({ token: _token, ...entry }) => Object.freeze(entry))
+        .sort(
+          (left, right) =>
+            right.priority - left.priority ||
+            left.extensionId.localeCompare(right.extensionId) ||
+            left.id.localeCompare(right.id),
+        ),
+    );
+  }
+}
+
+/** Client-side Cordis tree mirroring committed Host UI entries. */
+export class UiPluginRuntime {
+  readonly #root = new Context();
+  readonly #registry = new ClientUiRegistry(this.#root);
+  readonly #entries = new Map<string, ClientEntry>();
+
+  async reconcile(
+    contributions: readonly ExtensionUiContributionProjection[],
+  ): Promise<readonly ExtensionUiContributionProjection[]> {
+    const grouped = new Map<string, ExtensionUiContributionProjection[]>();
+    for (const contribution of contributions) {
+      const entries = grouped.get(contribution.entryId) ?? [];
+      entries.push(contribution);
+      grouped.set(contribution.entryId, entries);
+    }
+    for (const [entryId, items] of grouped) {
+      const signature = JSON.stringify(
+        items.map(({ generation, id, documentSha256, priority, surface, slot }) => ({
+          generation,
+          id,
+          documentSha256,
+          priority,
+          surface,
+          slot,
+        })),
+      );
+      const current = this.#entries.get(entryId);
+      if (current?.signature === signature) continue;
+      const context = this.#root.extend({ clientEntryId: entryId });
+      const candidate = context.plugin(
+        Object.assign(
+          (ctx: Context) => {
+            for (const item of items) ctx.clientUi.register(item);
+          },
+          { inject: ['clientUi'] },
+        ),
+      );
+      try {
+        await candidate.await();
+      } catch (error) {
+        await candidate.dispose().catch(() => undefined);
+        throw error;
+      }
+      this.#entries.set(entryId, { signature, fiber: candidate });
+      await current?.fiber.dispose();
+    }
+    for (const [entryId, entry] of [...this.#entries]) {
+      if (grouped.has(entryId)) continue;
+      this.#entries.delete(entryId);
+      await entry.fiber.dispose();
+    }
+    return this.#registry.inspect();
+  }
+
+  inspect(): readonly ExtensionUiContributionProjection[] {
+    return this.#registry.inspect();
+  }
+
+  async close(): Promise<void> {
+    await Promise.allSettled([...this.#entries.values()].map(({ fiber }) => fiber.dispose()));
+    this.#entries.clear();
+    await this.#root.fiber.dispose();
+  }
+}
diff --git a/docs/architecture/extension-event-listener-contributions.md b/docs/architecture/extension-event-listener-contributions.md
new file mode 100644
index 0000000000..832dcc4d1d
--- /dev/null
+++ b/docs/architecture/extension-event-listener-contributions.md
@@ -0,0 +1,25 @@
+# Extension Event, Listener, Hook, Service, and Timer contributions
+
+These contributions are effects of the executable Entry's Fiber and are never
+persisted as independent activations.
+
+Events declare payload schemas and dispatch modes: `emit`, `parallel`,
+`serial`, `bail`, `transform`, `observe`, `gate`, and `around`. Listeners
+are deterministically ordered; recursion depth and timeouts are bounded.
+
+A Hook is a Listener attached to a core Event such as `maka.tools.execute` or
+`maka.llm.stream`. Around handlers receive `(value, context, next)`;
+`next()` is single-use.
+
+Services expose schema-validated methods. Calls resolve through Context and
+declared package dependencies. Cross-package calls without a declared provider
+are rejected.
+
+Timers have Host-owned durable scheduling metadata, but their callbacks remain
+Fiber-owned effects. Disable/remove stops the active timer, while restart
+reattaches the schedule to the reconstructed Fiber. A Timer may call a Service
+or emit an Event, but is not itself an Event.
+
+Replacement stages the whole contribution set. Failure publishes none of the
+candidate effects and preserves the old Fiber; success switches the set and
+then disposes the old effects.
diff --git a/docs/architecture/extension-lifecycle-kernel.md b/docs/architecture/extension-lifecycle-kernel.md
new file mode 100644
index 0000000000..e8b4a7de55
--- /dev/null
+++ b/docs/architecture/extension-lifecycle-kernel.md
@@ -0,0 +1,61 @@
+# Extension composition lifecycle
+
+Maka's Extension lifecycle is a two-tree design derived from DSH/Cordis. There
+is no persistent Revision, Binding, candidate record, or last-good object.
+
+## The two trees
+
+The **Composition Entry Tree** is the only durable control state. Each Entry
+contains identity, optional package identity, enabled state, configuration,
+dependency injection, isolation/interception declarations, children, and the
+latest diagnostic. An Entry without a package is a structural group and does
+not require a no-op Fiber.
+
+The **Context/Fiber Tree** is a process-local projection. Executable Entries
+create Contexts and Fibers below `profile`, `desktop-ui`, or `session:<id>`.
+A Fiber owns its provided services, injected dependencies, children, and every
+registered Tool, UI, Event, Listener, Service, and Timer effect.
+
+Entry parentage determines runtime ownership, but the trees are intentionally
+not isomorphic: structural Entries can be skipped, and Host/UI projections can
+use separate runtime Contexts when their authorities differ.
+
+## Mutation and replacement
+
+Entry mutations are serialized and persisted atomically. The loader stages the
+affected subtree in fresh Contexts, validates and activates it, then switches
+the live projection. A failed candidate is disposed without replacing the
+current Fiber. Successful replacement disposes the previous Fiber only after
+the new projection is active. Unrelated Fibers retain identity and effects.
+
+Reloading package bytes is a runtime projection change, not a new durable
+package version. Only Entries using that package are reconciled. Multi-operation
+edits restore and reproject the prior Entry snapshot when a later operation
+fails.
+
+## Dependencies and scope
+
+Package dependencies resolve through Fiber Contexts. `inject`, `isolate`, and
+`intercept` shape child Contexts rather than parallel maps. Missing required
+providers prevent activation. Profile contributions can be inherited by
+Session roots; Desktop UI uses a separate root because its authority and cleanup
+boundary differ.
+
+## Recovery and inspection
+
+Startup reads the persisted Entry Tree, installs referenced package bytes, and
+reconstructs the runtime projection. Fiber state is never restored from disk.
+Failed Entries retain a bounded diagnostic while unrelated Entries recover.
+
+Inspection reports both layers separately. Consumers must not treat Fiber
+generations as durable identities.
+
+## Required invariants
+
+- The Entry Tree is the only durable composition authority.
+- Structural Entries may exist without Fibers.
+- Every live contribution is owned by exactly one Fiber lifecycle.
+- Failed replacement preserves the current active Fiber.
+- Disable/remove releases all effects and descendants.
+- Restart reconstructs Fibers from Entries and package bytes.
+- Session and Desktop UI scopes cannot leak into one another.
diff --git a/docs/architecture/extension-package-platform.md b/docs/architecture/extension-package-platform.md
new file mode 100644
index 0000000000..af8ca69591
--- /dev/null
+++ b/docs/architecture/extension-package-platform.md
@@ -0,0 +1,52 @@
+# Trusted in-process Extension platform
+
+Maka has one Extension package format and one composition lifecycle. A
+`maka.extension.json` package may contribute Tools, UI, Events, Listeners,
+Services, and Host-owned Timers.
+
+## Trust and identity
+
+Executable Extension code is trusted in-process code. Manifest permissions and
+schemas are guardrails, not a sandbox. UI documents separately run in
+opaque-origin iframes with a narrow Host bridge.
+
+The manifest `id` identifies installed package bytes. A manifest `version` is
+display/package metadata, not a persistent lifecycle Revision. Installing bytes
+does not activate them: the Composition Entry Tree decides where and whether a
+package runs, and multiple Entries may reference one package with different
+scope or configuration.
+
+## Composition and ownership
+
+The Entry Tree is projected into the Context/Fiber Tree. Structural Entries can
+remain Entry-only. Executable Fibers own all contribution registrations, so
+enable, disable, move, reconfigure, reload, and remove share one cleanup
+boundary. Host runtime and Desktop UI may use separate Contexts when their
+authorities differ; they are not forced into an artificial shared Fiber.
+
+`define_package` and `manage_package` are the canonical agent-facing controls.
+Product UI uses the same Runtime Host composition operations. There is no
+secondary Revision/Binding controller or per-contribution activation map.
+
+## Contribution roles
+
+- A Tool is a model-callable operation.
+- An Event is a typed dispatch contract.
+- A Listener handles an Event; core Event listeners implement Hooks.
+- A Service exposes typed methods through Context dependency rules.
+- A Timer is a durable Host scheduler whose callback belongs to the Fiber.
+- A UI contribution is a sandboxed document projected into an allowed surface.
+
+The runtime entry exports one handler object per activation. Tool, Listener,
+Service, and Timer handlers share module state and receive configuration,
+cancellation, Event emission, and Service-call capabilities.
+
+## Replacement and restart
+
+Reload and reconfiguration stage fresh Fibers. Health checking and activation
+complete before the live switch. Failure closes the candidate and preserves the
+active Fiber; success switches and then retires the old Fiber.
+
+Restart reads package bytes and the Entry Tree and reconstructs all Fibers.
+Timer scheduling metadata and UI state have dedicated Host stores, but neither
+is a composition authority.
diff --git a/docs/architecture/extension-tool-contributions.md b/docs/architecture/extension-tool-contributions.md
new file mode 100644
index 0000000000..7d0322a81d
--- /dev/null
+++ b/docs/architecture/extension-tool-contributions.md
@@ -0,0 +1,23 @@
+# Extension Tool contributions
+
+Tool declarations are effects of an executable Composition Entry. The Entry
+Tree persists configuration and enabled state; the runtime Fiber owns the
+loaded handler and registry registration.
+
+Activation validates names, descriptions, schemas, handler presence, and
+configuration before exposure. Failed activation cannot partially publish
+Tools. Disable, remove, or replacement releases registrations through Fiber
+disposal.
+
+Tool resolution is scope-aware. Installation alone never makes a Tool globally
+callable. Each model turn captures an immutable Tool snapshot; an in-flight
+handler remains valid until that turn releases its lease, while new turns
+resolve the replacement Fiber. This requires no durable Revision/Binding model.
+
+The core `maka.tools.execute` Event wraps real execution. `around` Listeners can
+observe, transform, gate, or wrap the call. Tool visualization may publish a
+successful result into Host-owned UI state using `visualization.stateKey`.
+
+Tests cover validation, duplicate names, scope isolation, Hook ordering,
+in-flight replacement, failed candidate preservation, restart recovery, and
+exact cleanup after disable/remove.
diff --git a/docs/architecture/extension-ui-contributions.md b/docs/architecture/extension-ui-contributions.md
new file mode 100644
index 0000000000..7b5e1e98d3
--- /dev/null
+++ b/docs/architecture/extension-ui-contributions.md
@@ -0,0 +1,35 @@
+# Extension UI contributions
+
+Extension UI is projected into the `desktop-ui` runtime root. UI may use a
+separate Context/Fiber from Host runtime code because renderer authority,
+failure, and cleanup boundaries differ. Maka does not create a shared Fiber
+solely to make both trees look isomorphic.
+
+## Surfaces and isolation
+
+The trusted renderer owns Maka's native shell. Extensions may declare allowed
+root, overlay, or named-slot surfaces. Nested slots do not grant DOM access to
+Maka or sibling frames. Ordering is deterministic.
+
+Each document runs in a sandboxed opaque-origin iframe. A token-bound bridge
+provides declared configuration, Host state, RPC, optional Session access, and
+safe-mode escape. Every request is checked against the active Entry, Fiber
+generation, contribution identity, and permissions.
+
+## Lifecycle
+
+Documents are package bytes; enabled state, configuration, hierarchy, and
+diagnostics live only in the Entry Tree. Candidate UI is invisible until
+activation succeeds. Success switches the complete runtime snapshot; failure
+leaves the active Fiber and frames current.
+
+Disable/remove destroys frames and revokes bridge tokens. Restart reconstructs
+the `desktop-ui` projection from the Entry Tree. Host-owned UI state may survive
+frame reloads, but is not composition state and does not select package
+versions.
+
+Tool visualization writes structured results to Host state, allowing real Tool
+execution to update sandboxed UI without renderer DOM authority.
+
+Tests cover surface ordering, sandbox and bridge permissions, state/config,
+nested slots, safe mode, failed replacement, cleanup, and Electron restart.
diff --git a/docs/architecture/file-review-extension-e2e.md b/docs/architecture/file-review-extension-e2e.md
new file mode 100644
index 0000000000..171a084676
--- /dev/null
+++ b/docs/architecture/file-review-extension-e2e.md
@@ -0,0 +1,66 @@
+# File Review Extension: Full Composition Demo and Test Plan
+
+This scenario exercises the extension refactor without using the Maka repository as a test target and without allowing an agent to edit source code.
+
+## Fixture
+
+The test creates a disposable directory containing:
+
+- `incoming/release-notes.md`: a reviewable document with one deliberate policy violation.
+- `review-hook.jsonl`: before/after records written by the Tool around Hook.
+- `review-service.json`, `review-event.json`, and `review-refresh.json`: observable outputs from the Service, Event Listener, and Timer.
+
+The fixture is read-only to the extension except for the explicitly scoped `outbox/audit.jsonl` append operation. It is deleted in teardown.
+
+## Composition tree
+
+```text
+file-review-suite (parent entry)
+├── document-reader (Tool: review_document)
+├── review-console (UI: conversation.header + nested status slot)
+└── review-policy (Service + Event/Listener + Hook + Timer)
+```
+
+The parent entry is enabled first. The loader projects only executable entries into runtime Fibers; grouping entries may remain Entry-only. The UI reports the persisted Entry Tree and active Fiber inspection separately, so the test can verify that the projection converges without treating the Fiber Tree as durable state.
+
+## Real user flow
+
+1. Maka receives: “Review the release notes and prepare an approval summary.”
+2. The model invokes `review_document`; the Tool reads the fixture files and calls the policy Service.
+3. The Service emits `review.started` and `review.completed`.
+4. An around Hook records the real Tool call before and after execution, while an Event Listener persists the completed review payload.
+5. The Timer writes an independent refresh heartbeat and the embedded UI contribution is projected into `conversation.header`.
+6. The document is read again after execution to prove the model and extension did not edit it.
+7. The test reloads the package bytes without changing Entry identity. The old Fiber remains usable until the candidate Fiber activates; a deliberately unhealthy candidate must fail and preserve the previous active Fiber.
+8. Disable, restart, and re-enable verify persistence, scope isolation, and recovery.
+
+## Assertions
+
+- Entry Tree mutation is atomic and persisted.
+- Runtime Fiber contains exactly the enabled child contributions.
+- Tool invocation, Service call, Event dispatch, Hook ordering, and Timer tick are observable in isolated fixture outputs.
+- Root UI remains native; extension UI is embedded in `conversation.header` and its nested slot.
+- Failed activation does not replace the last healthy Fiber.
+- Disabled entries disappear after restart and do not leak into another session scope.
+- Maka source files remain unchanged; only the disposable fixture is modified.
+
+## Test commands
+
+Run the focused runtime-host coverage:
+
+```bash
+npm --workspace @maka/runtime-host run build
+node --test \
+  packages/runtime-host/dist/__tests__/extension-e2e.system.test.js \
+  packages/runtime-host/dist/__tests__/extension-composition.test.js \
+  packages/runtime-host/dist/__tests__/extension-controller.test.js \
+  packages/runtime-host/dist/__tests__/extension-package-platform.system.test.js
+```
+
+Then run the real Electron lifecycle test. It installs one package containing Tool, UI, Event/Listener, Service, and Timer contributions, waits for its sandboxed UI to call the Host state/config bridge, and verifies disable, re-enable, and removal through the Desktop preload API:
+
+```bash
+npm --workspace @maka/desktop run build:with-deps
+cd apps/desktop
+npx playwright test extension-lifecycle.spec.ts --config e2e/playwright.config.ts
+```
diff --git a/package-lock.json b/package-lock.json
index e6ac40082f..76422fe336 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1018,9 +1018,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -1038,9 +1035,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -1058,9 +1052,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -1078,9 +1069,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
diff --git a/package.json b/package.json
index 27f93e6867..0a396b54e4 100644
--- a/package.json
+++ b/package.json
@@ -50,6 +50,7 @@
     "sync:model-metadata": "node scripts/sync-model-metadata.mjs",
     "generate:bundled-skills": "node scripts/gen-bundled-skill-catalog.mjs",
     "cost:deepseek-baseline": "node scripts/deepseek-live-cost-baseline.mjs",
+    "benchmark:extension-startup": "node scripts/extension-startup-benchmark.mjs",
     "computer-use": "node scripts/computer-use.mjs",
     "windows:inventory": "node scripts/windows-test-inventory.mjs --check",
     "windows:inventory:write": "node scripts/windows-test-inventory.mjs --write",
diff --git a/packages/cli/src/__tests__/runtime-host-operator-command.test.ts b/packages/cli/src/__tests__/runtime-host-operator-command.test.ts
index 85a0440eb2..a0765917c4 100644
--- a/packages/cli/src/__tests__/runtime-host-operator-command.test.ts
+++ b/packages/cli/src/__tests__/runtime-host-operator-command.test.ts
@@ -106,6 +106,18 @@ describe('Runtime Host operator commands', () => {
       [
         'access.credential.issue',
         'access.credential.revoke',
+        'extension.composition.mutate',
+        'extension.composition.query',
+        'extension.configuration.mutate',
+        'extension.configuration.query',
+        'extension.contract.query',
+        'extension.package.export',
+        'extension.package.install',
+        'extension.package.uninstall',
+        'extension.ui.rpc.invoke',
+        'extension.ui.snapshot',
+        'extension.ui.state.mutate',
+        'extension.ui.state.query',
         'host.upgrade.prepare',
         'hosted.execution.cancel',
         'hosted.execution.start',
diff --git a/packages/core/package.json b/packages/core/package.json
index 0fe9026e7e..1f6958d082 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -96,6 +96,7 @@
     "./result": "./dist/result.js",
     "./settings": "./dist/settings.js",
     "./mcp": "./dist/mcp.js",
+    "./hooks": "./dist/hooks.js",
     "./settings/network-settings": "./dist/settings/network-settings.js",
     "./usage-stats/types": "./dist/usage-stats/types.js",
     "./usage-stats/pricing": "./dist/usage-stats/pricing.js",
diff --git a/packages/core/src/hooks.ts b/packages/core/src/hooks.ts
new file mode 100644
index 0000000000..0627c7345c
--- /dev/null
+++ b/packages/core/src/hooks.ts
@@ -0,0 +1,96 @@
+export const HOOK_CONFIG_VERSION = 1 as const;
+export const HOOK_TRUST_VERSION = 1 as const;
+export const PRE_TOOL_USE_HOOK_EVENT = 'PreToolUse' as const;
+
+export type HookEventName =
+  | 'UserPromptSubmit'
+  | 'RunStart'
+  | typeof PRE_TOOL_USE_HOOK_EVENT
+  | 'PostToolUse'
+  | 'RunEnd';
+export type HookSource = 'user' | 'project';
+export type HookAuditSource = HookSource | 'extension';
+
+export interface HookCommandConfig {
+  id: string;
+  type: 'command';
+  command: string;
+  args?: string[];
+  timeoutMs?: number;
+  enabled?: boolean;
+}
+
+export interface HookMatcherGroupConfig {
+  matcher?: string;
+  hooks: HookCommandConfig[];
+}
+
+export interface HookConfigFile {
+  version: typeof HOOK_CONFIG_VERSION;
+  hooks: {
+    PreToolUse?: HookMatcherGroupConfig[];
+  };
+}
+
+export interface HookTrustRecord {
+  definitionHash: `sha256:${string}`;
+  source: HookSource;
+  projectIdentity: string;
+  trustedAt: number;
+}
+
+export interface HookTrustFile {
+  version: typeof HOOK_TRUST_VERSION;
+  trustedDefinitions: HookTrustRecord[];
+}
+
+export interface ResolvedHookDefinition {
+  id: string;
+  eventName: HookEventName;
+  matcher: string;
+  command: string;
+  args: string[];
+  timeoutMs: number;
+  source: HookSource;
+  sourceOrder: number;
+  definitionOrder: number;
+  projectIdentity: string;
+  definitionHash: `sha256:${string}`;
+  trusted: boolean;
+}
+
+export interface PreToolUseHookInput {
+  schema_version: 1;
+  hook_event_name: HookEventName;
+  session_id: string;
+  turn_id: string;
+  run_id: string;
+  tool_use_id: string;
+  tool_name: string;
+  tool_input: unknown;
+  cwd: string;
+  permission_mode: string;
+  origin: 'provider' | 'code_mode';
+}
+
+export type HookExecutionStatus = 'allowed' | 'denied' | 'failed' | 'skipped_untrusted';
+
+export interface HookCompletedAudit {
+  eventName: HookEventName;
+  handlerId: string;
+  definitionHash: `sha256:${string}`;
+  source: HookAuditSource;
+  toolUseId: string;
+  toolName: string;
+  status: HookExecutionStatus;
+  durationMs: number;
+  message?: string;
+}
+
+export function createDefaultHookConfig(): HookConfigFile {
+  return { version: HOOK_CONFIG_VERSION, hooks: {} };
+}
+
+export function createDefaultHookTrust(): HookTrustFile {
+  return { version: HOOK_TRUST_VERSION, trustedDefinitions: [] };
+}
diff --git a/packages/core/src/runtime-event.ts b/packages/core/src/runtime-event.ts
index fbb9229f0c..ea5470e8a9 100644
--- a/packages/core/src/runtime-event.ts
+++ b/packages/core/src/runtime-event.ts
@@ -23,6 +23,7 @@ import {
 import { INTERACTION_ID_MAX_BYTES, INTERACTION_TOOL_NAME_MAX_BYTES } from './interaction.js';
 import type { PermissionRequestPayload, PermissionResponse } from './permission.js';
 import type { TurnOrigin } from './runtime-inputs.js';
+import type { HookAuditSource, HookEventName, HookExecutionStatus } from './hooks.js';
 import type { UserQuestionRequest } from './user-question.js';
 import {
   defineObjectShape,
@@ -241,6 +242,18 @@ export interface RuntimeEventProtocolMarker {
   toolBoundary: ToolBoundaryProtocol;
 }
 
+export interface RuntimeEventHookCompleted {
+  eventName: HookEventName;
+  handlerId: string;
+  definitionHash: `sha256:${string}`;
+  source: HookAuditSource;
+  toolUseId: string;
+  toolName: string;
+  status: HookExecutionStatus;
+  durationMs: number;
+  message?: string;
+}
+
 export interface RuntimeEventContinuationStartV2 {
   protocol: 'continuation_start_v2';
   /** Mirrors store-owned claim state; recovery never trusts this field alone. */
@@ -308,6 +321,8 @@ export interface RuntimeEventActions {
   toolRecovery?: ToolRecoveryFactEnvelope;
   /** Protocols that were actually active from the first event of this run. */
   runtimeProtocol?: RuntimeEventProtocolMarker;
+  /** Bounded, non-model-visible result of one user-configured lifecycle Hook. */
+  hookCompleted?: RuntimeEventHookCompleted;
   /** Durable provider-call T1 for a claimed continuation. */
   continuationStart?: RuntimeEventContinuationStartV2;
   /** Reserved workspace authority fact; only its atomic SQLite writer may persist it. */
@@ -497,6 +512,7 @@ const RUNTIME_ACTIONS_SHAPE = defineObjectShape<RuntimeEventActions>()(
     'toolDispatch',
     'toolRecovery',
     'runtimeProtocol',
+    'hookCompleted',
     'continuationStart',
     'workspaceFact',
   ],
@@ -527,6 +543,19 @@ const RUNTIME_PROTOCOL_MARKER_SHAPE = defineObjectShape<RuntimeEventProtocolMark
   ['toolBoundary'],
   [],
 );
+const RUNTIME_HOOK_COMPLETED_SHAPE = defineObjectShape<RuntimeEventHookCompleted>()(
+  [
+    'eventName',
+    'handlerId',
+    'definitionHash',
+    'source',
+    'toolUseId',
+    'toolName',
+    'status',
+    'durationMs',
+  ],
+  ['message'],
+);
 const RUNTIME_CONTINUATION_START_SHAPE = defineObjectShape<RuntimeEventContinuationStartV2>()(
   [
     'protocol',
@@ -759,12 +788,41 @@ function isRuntimeEventActions(value: unknown): value is RuntimeEventActions {
     (value.toolDispatch === undefined || isRuntimeToolDispatch(value.toolDispatch)) &&
     (value.toolRecovery === undefined || isToolRecoveryFactEnvelope(value.toolRecovery)) &&
     (value.runtimeProtocol === undefined || isRuntimeProtocolMarker(value.runtimeProtocol)) &&
+    (value.hookCompleted === undefined || isRuntimeHookCompleted(value.hookCompleted)) &&
     (value.continuationStart === undefined ||
       isRuntimeContinuationStart(value.continuationStart)) &&
     (value.workspaceFact === undefined || isRuntimeEventWorkspaceFactEnvelope(value.workspaceFact))
   );
 }
 
+function isRuntimeHookCompleted(value: unknown): value is RuntimeEventHookCompleted {
+  return (
+    isRecord(value) &&
+    hasExactShape(value, RUNTIME_HOOK_COMPLETED_SHAPE) &&
+    (value.eventName === 'UserPromptSubmit' ||
+      value.eventName === 'RunStart' ||
+      value.eventName === 'PreToolUse' ||
+      value.eventName === 'PostToolUse' ||
+      value.eventName === 'RunEnd') &&
+    typeof value.handlerId === 'string' &&
+    value.handlerId.length > 0 &&
+    typeof value.definitionHash === 'string' &&
+    /^sha256:[0-9a-f]{64}$/u.test(value.definitionHash) &&
+    (value.source === 'user' || value.source === 'project' || value.source === 'extension') &&
+    typeof value.toolUseId === 'string' &&
+    value.toolUseId.length > 0 &&
+    typeof value.toolName === 'string' &&
+    value.toolName.length > 0 &&
+    (value.status === 'allowed' ||
+      value.status === 'denied' ||
+      value.status === 'failed' ||
+      value.status === 'skipped_untrusted') &&
+    isFiniteNumber(value.durationMs) &&
+    value.durationMs >= 0 &&
+    isOptionalString(value.message)
+  );
+}
+
 function isRuntimeEventPermissionDecision(value: unknown): value is RuntimeEventPermissionDecision {
   return (
     isRecord(value) &&
diff --git a/packages/core/src/subagent-settings.ts b/packages/core/src/subagent-settings.ts
index 5e0fa980cc..5cbc0949df 100644
--- a/packages/core/src/subagent-settings.ts
+++ b/packages/core/src/subagent-settings.ts
@@ -1,6 +1,12 @@
 import { isThinkingLevel, type ThinkingLevel } from './model-thinking.js';
 
-export const SUBAGENT_PROFILES = ['local_read', 'web_research', 'implementation'] as const;
+export const SUBAGENT_PROFILES = [
+  'local_read',
+  'web_research',
+  'implementation',
+  'tool_author',
+  'ui_author',
+] as const;
 export type SubagentProfile = (typeof SUBAGENT_PROFILES)[number];
 
 export const MAX_SUBAGENT_PRESETS = 64;
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index 354675e1ad..e75216ff94 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
-import { mkdir, mkdtemp, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, realpath, rm, stat, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { test } from 'node:test';
@@ -31,6 +31,7 @@ import { openInteractiveRuntimePolicyStoresForWrite } from '@maka/storage/runtim
 import { HostResidencyRegistry } from '../server/host-residency-registry.js';
 import {
   createExecutionRuntimeHostComposition,
+  extensionTimerCwdForScope,
   runtimeHostFilesystemWorkerRuntime,
 } from '../server/execution-composition.js';
 
@@ -41,6 +42,28 @@ test('filesystem worker follows the candidate executable runtime', () => {
   assert.equal(runtimeHostFilesystemWorkerRuntime({}), 'node');
 });
 
+test('Extension Timers resolve global scopes to the profile root and Session scopes to Session cwd', async () => {
+  const requestedSessions: string[] = [];
+  const sessionCwdForScope = async (sessionId: string) => {
+    requestedSessions.push(sessionId);
+    return `/sessions/${sessionId}`;
+  };
+
+  assert.equal(
+    await extensionTimerCwdForScope('profile', '/profile', sessionCwdForScope),
+    '/profile',
+  );
+  assert.equal(
+    await extensionTimerCwdForScope('desktop-ui', '/profile', sessionCwdForScope),
+    '/profile',
+  );
+  assert.equal(
+    await extensionTimerCwdForScope('session-1', '/profile', sessionCwdForScope),
+    '/sessions/session-1',
+  );
+  assert.deepEqual(requestedSessions, ['session-1']);
+});
+
 test('production composition owns the long-term memory database lifecycle', async () => {
   await withCompositionRoot(async ({ root, owner }) => {
     const databasePath = join(root, LONG_TERM_MEMORY_DATABASE_NAME);
@@ -378,6 +401,92 @@ test('production composition commits automatic titles through Host-owned Session
   });
 });
 
+test('production Session create and archive dispatch profile Extension lifecycle seams', async () => {
+  await withCompositionRoot(async ({ root, owner }) => {
+    const composition = await createExecutionRuntimeHostComposition(compositionContext(owner));
+    const observed: Array<{ event: string; payload: unknown }> = [];
+    const operationContext = {
+      hostEpoch: 'execution-composition-test',
+      connectionId: 'extension-session-lifecycle-test',
+      surface: 'desktop' as const,
+      principal: 'local_os_user' as const,
+      acquireResidency: () => ({ release() {} }),
+    };
+    try {
+      await composition.extensions.installTool({
+        extensionId: 'lifecycle-observer',
+        toolNames: [],
+        eventContributionIds: ['session-created', 'session-disposed'],
+        load: async () => ({
+          tools: [],
+          listeners: [
+            {
+              id: 'created',
+              event: 'maka.session.created',
+              handler: 'created',
+              priority: 0,
+              timeoutMs: 1_000,
+              invoke: async (payload) => {
+                observed.push({ event: 'maka.session.created', payload: structuredClone(payload) });
+              },
+            },
+            {
+              id: 'disposed',
+              event: 'maka.session.disposed',
+              handler: 'disposed',
+              priority: 0,
+              timeoutMs: 1_000,
+              invoke: async (payload) => {
+                observed.push({
+                  event: 'maka.session.disposed',
+                  payload: structuredClone(payload),
+                });
+              },
+            },
+          ],
+        }),
+      });
+      await composition.extensions.applyComposition({
+        operations: [
+          {
+            type: 'insert',
+            rootId: 'profile',
+            entry: {
+              id: 'lifecycle-observer-binding',
+              packageId: 'lifecycle-observer',
+            },
+          },
+        ],
+      });
+      await composition.recover();
+
+      const sessionId = 'extension-lifecycle-session';
+      const created = await composition.handlers['session.create'](
+        {
+          sessionId,
+          workspace: { kind: 'host_path', path: root },
+          modelTarget: { kind: 'default' },
+        },
+        operationContext,
+      );
+      assert.equal(created.ok, true);
+      const archived = await composition.handlers['session.lifecycle.set'](
+        { sessionId, state: 'archived' },
+        operationContext,
+      );
+      assert.equal(archived.ok, true);
+
+      const canonicalRoot = await realpath(root);
+      assert.deepEqual(observed, [
+        { event: 'maka.session.created', payload: { sessionId, cwd: canonicalRoot } },
+        { event: 'maka.session.disposed', payload: { sessionId } },
+      ]);
+    } finally {
+      await composition.close();
+    }
+  });
+});
+
 test('production composition orphans ownerless ShellRuns before serving Resource queries', async () => {
   await withCompositionRoot(async ({ root, owner }) => {
     const stores = await openInteractiveExecutionStoresForWrite(owner.lease);
diff --git a/packages/runtime-host/src/__tests__/execution-model-composition.test.ts b/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
index 81a49ba6b9..4abeee0aaa 100644
--- a/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
@@ -58,6 +58,7 @@ import {
 import type { TurnSnapshot, UsageQueryResult } from '../protocol/index.js';
 import type { ClientCapabilityHostFrame } from '../protocol/index.js';
 import { createExecutionRuntimeHostComposition } from '../server/execution-composition.js';
+import { HostExtensionRuntime } from '../server/extension-runtime.js';
 import {
   createHostDailyReviewModel,
   createHostGoalEvaluator,
@@ -92,6 +93,7 @@ const SUMMARY_TEXT = '## Goal\nContinue hosted real-model execution.';
 const CLIENT_CAPABILITY_RESULT_TEXT = 'HOSTED_CLIENT_CAPABILITY_RESULT_SENTINEL';
 const CHILD_AGENT_RESULT_TEXT = 'HOSTED_CHILD_AGENT_RESULT_SENTINEL';
 const WEB_RESEARCH_CHILD_RESULT_TEXT = 'HOSTED_WEB_RESEARCH_RESULT_SENTINEL';
+const TOOL_AUTHOR_PARENT_RESULT_TEXT = 'HOSTED_TOOL_AUTHOR_PARENT_ACCEPTED';
 const MAX_IMPLEMENTATION_CHILD_PTY_READS = 5;
 const MIN_IMPLEMENTATION_CHILD_REQUESTS = 6;
 const MAX_IMPLEMENTATION_CHILD_REQUESTS =
@@ -258,6 +260,70 @@ test('provider dispatch fails closed when the Run Composition commit fails', asy
   }
 });
 
+test('production backend snapshots Host Extension Tools per send and records the same catalog', async () => {
+  const provider = await startProvider();
+  const extensions = new HostExtensionRuntime();
+  const snapshots: ReturnType<typeof decodeRunCompositionSnapshot>[] = [];
+  let backend: Awaited<ReturnType<typeof createHostAiSdkBackend>> | undefined;
+  try {
+    await extensions.installTrustedTool({
+      extensionId: 'weather',
+      tools: [
+        {
+          name: 'Weather',
+          description: 'Read the current weather.',
+          parameters: z.object({ city: z.string() }),
+          impl: async ({ city }: { city: string }) => ({ city, temperature: 21 }),
+        },
+      ],
+    });
+    await extensions.applyComposition({
+      operations: [
+        {
+          type: 'insert',
+          rootId: 'session:backend-creation-session',
+          entry: { id: 'weather-binding', packageId: 'weather' },
+        },
+      ],
+    });
+    backend = await createHostAiSdkBackend(
+      backendCreationFixture({
+        abortSignal: new AbortController().signal,
+        resolveExecutionConnection: async () => readyExecutionConnection(provider.baseUrl),
+        readPricing: async () => ({ revision: 0, overrides: [] }),
+        executionBoundary: createBypassExecutionBoundary(0),
+        tools: [
+          {
+            name: 'Read',
+            description: 'Read a fixture resource.',
+            parameters: z.object({}),
+            impl: async () => 'read',
+          },
+        ],
+        extensions,
+        recordRunComposition: async (_runId, snapshot) => {
+          snapshots.push(decodeRunCompositionSnapshot(snapshot));
+        },
+      }),
+    );
+
+    await drainBackendSend(backend, 'extension-run-1', 'extension-turn-1');
+    assert.deepEqual(toolNames(provider.requests[0]?.body), ['ArchiveRead', 'Read', 'Weather']);
+    assert.deepEqual(snapshots[0]?.toolNames, ['Read', 'Weather']);
+
+    await extensions.applyComposition({
+      operations: [{ type: 'update', entryId: 'weather-binding', patch: { disabled: true } }],
+    });
+    await drainBackendSend(backend, 'extension-run-2', 'extension-turn-2');
+    assert.deepEqual(toolNames(provider.requests[1]?.body), ['ArchiveRead', 'Read']);
+    assert.deepEqual(snapshots[1]?.toolNames, ['Read']);
+  } finally {
+    await backend?.dispose();
+    await extensions.close();
+    await provider.close();
+  }
+});
+
 test('backend abort cannot cancel the authority-owned OAuth refresh used by its successor', async () => {
   const base = await mkdtemp(join(tmpdir(), 'maka-host-oauth-backend-'));
   const capability = await resolveStorageRoot({
@@ -1033,15 +1099,32 @@ test('production Host executes a canonical ai-sdk Session against a real provide
       'WebSearch',
       'Write',
       'WriteStdin',
+      'call_service',
+      'define_package',
+      'emit_event',
+      'inspect_package',
+      'invoke_tool',
       'load_tools',
+      'manage_package',
       'memory_extract',
       'memory_remember',
+      'publish_ui_state',
       'request_sandbox_boundary',
       'task_create',
       'task_get',
       'task_list',
       'task_update',
     ]);
+    const requestTools = request?.body.tools as Array<Record<string, unknown>> | undefined;
+    const manageTool = requestTools?.find((tool) => {
+      const fn = tool.function;
+      return (
+        fn !== null &&
+        typeof fn === 'object' &&
+        (fn as { name?: unknown }).name === 'manage_package'
+      );
+    }) as { function?: { parameters?: { type?: unknown } } } | undefined;
+    assert.equal(manageTool?.function?.parameters?.type, 'object');
     assert.match(JSON.stringify(compactRequests[0]?.body), /context summarization assistant/);
 
     const messages = await execution.sessionStore.readMessagesSnapshot(session.id);
@@ -1467,6 +1550,8 @@ test('production Host executes a durable runnable child with an exact tool ceili
       'local_read',
       'web_research',
       'implementation',
+      'tool_author',
+      'ui_author',
     ]);
     // A child now carries the archive decoder alongside its allowlist (#2026).
     // Its own placeholders name `ArchiveRead`, so the ceiling that governs
@@ -1474,8 +1559,8 @@ test('production Host executes a durable runnable child with an exact tool ceili
     // can read back a result the runtime itself pruned.
     assert.deepEqual(toolNames(requests[2]?.body), ['ArchiveRead', 'Glob', 'Grep', 'Read']);
     assert.ok(toolNames(requests[3]?.body).includes('agent_spawn'));
-    assert.deepEqual(toolNames(requests[4]?.body), ['ArchiveRead', 'WebSearch']);
-    assert.deepEqual(toolNames(requests[5]?.body), ['ArchiveRead', 'WebSearch']);
+    assert.deepEqual(toolNames(requests[4]?.body), ['ArchiveRead', 'WebFetch', 'WebSearch']);
+    assert.deepEqual(toolNames(requests[5]?.body), ['ArchiveRead', 'WebFetch', 'WebSearch']);
     assert.ok(toolNames(requests[6]?.body).includes('agent_spawn'));
 
     const sessions = await execution.sessionStore.listForRecovery();
@@ -1557,6 +1642,173 @@ test('production Host executes a durable runnable child with an exact tool ceili
   }
 });
 
+test('production Host lets a child define an Extension before the parent activates it', async () => {
+  const base = await mkdtemp(join(tmpdir(), 'maka-host-tool-author-'));
+  const root = join(base, 'interactive');
+  const project = join(base, 'project');
+  const provider = await startProvider();
+  provider.configureToolAuthorChildFlow();
+  const capability = await resolveStorageRoot({ path: root, kind: 'interactive' });
+  const owner = await tryAcquireInteractiveRootOwner(capability);
+  assert.ok(owner);
+  if (!owner) return;
+  const context: ConnectionContext = {
+    hostEpoch: 'tool-author-test-epoch',
+    connectionId: 'tool-author-test-client',
+    surface: 'tui',
+    principal: 'local_os_user',
+    acquireResidency: () => ({ release() {} }),
+  };
+  let composition: Awaited<ReturnType<typeof createExecutionRuntimeHostComposition>> | undefined;
+  try {
+    await mkdir(project);
+    await writeFile(join(project, 'numbers.txt'), '20\n22\n');
+    const policy = await openInteractiveRuntimePolicyStoresForWrite(owner.lease);
+    const created = await policy.connectionCatalog.create({
+      expectedCatalogRevision: 0,
+      connection: {
+        slug: 'hosted-tool-author-provider',
+        name: 'Hosted Tool author provider',
+        providerType: 'moonshot',
+        baseUrl: provider.baseUrl,
+        enabled: true,
+        enabledModelIds: [MODEL_ID],
+      },
+    });
+    assert.equal(created.kind, 'committed');
+    if (created.kind !== 'committed') return;
+    const connection = created.snapshot.connections[0];
+    assert.ok(connection);
+    if (!connection) return;
+    assert.equal(
+      (
+        await policy.credentialVault.set({
+          locator: {
+            scope: 'connection',
+            connectionId: connection.connectionId,
+            kind: 'api_key',
+          },
+          expected: null,
+          secret: API_KEY,
+        })
+      ).kind,
+      'committed',
+    );
+    await publishConnectionModel(policy, connection.connectionId, MODEL_ID, 32_768);
+
+    const execution = await openInteractiveExecutionStoresForWrite(owner.lease);
+    const parent = await execution.sessionStore.create({
+      cwd: project,
+      backend: 'ai-sdk',
+      llmConnectionSlug: 'hosted-tool-author-provider',
+      model: MODEL_ID,
+      permissionMode: 'bypass',
+    });
+    composition = await createExecutionRuntimeHostComposition({
+      owner,
+      hostEpoch: context.hostEpoch,
+      acquireResidency: context.acquireResidency,
+      retainUntilProcessExit: () => undefined,
+      requestDrain: () => undefined,
+    });
+    await composition.recover();
+
+    const terminal = await waitForTerminal(
+      composition,
+      parent.id,
+      'hosted-tool-author-parent-turn',
+      await startTurn(
+        composition,
+        parent.id,
+        'hosted-tool-author-parent-turn',
+        'Delegate Extension creation, then independently activate and invoke the installed Tool.',
+        context,
+      ),
+      context,
+    );
+    assert.equal(
+      terminal.status,
+      'completed',
+      JSON.stringify(providerRequestTrace(provider.requests), null, 2),
+    );
+
+    const requests = provider.requests.filter((request) => request.body.stream === true);
+    assert.equal(requests.length, 9, JSON.stringify(providerRequestTrace(requests)));
+    const childToolNames = [
+      'ArchiveRead',
+      'Glob',
+      'Grep',
+      'Read',
+      'define_package',
+      'inspect_package',
+    ];
+    for (const request of requests.slice(2, 5)) {
+      assert.deepEqual(toolNames(request.body), childToolNames);
+    }
+    assert.equal(childToolNames.includes('manage_package'), false);
+    assert.equal(childToolNames.includes('Write'), false);
+    assert.equal(childToolNames.includes('Bash'), false);
+
+    const sessions = await execution.sessionStore.listForRecovery();
+    const child = sessions.find((session) => session.subagentRuntime?.profile === 'tool_author');
+    assert.ok(child);
+    assert.equal(child?.subagentParent?.parentSessionId, parent.id);
+    assert.equal(child?.cwd, project);
+    assert.equal(child?.subagentWorkspace, undefined);
+    if (!child) return;
+    const childRuns = await execution.agentRunStore.listSessionRuns(child.id);
+    assert.equal(childRuns.length, 1);
+    assert.equal(childRuns[0]?.status, 'completed');
+    const childEvents = await execution.runtimeEventStore.readRuntimeEvents(
+      child.id,
+      childRuns[0]!.runId,
+    );
+    assert.ok(
+      childEvents.some(
+        (event) =>
+          event.content?.kind === 'function_response' && event.content.name === 'define_package',
+      ),
+    );
+
+    const parentEvents = await execution.runtimeEventStore.readRuntimeEvents(
+      parent.id,
+      terminal.runId,
+    );
+    assert.ok(
+      parentEvents.some(
+        (event) =>
+          event.content?.kind === 'function_response' && event.content.name === 'manage_package',
+      ),
+    );
+    assert.ok(
+      parentEvents.some(
+        (event) =>
+          event.content?.kind === 'function_response' && event.content.name === 'invoke_tool',
+      ),
+    );
+    const parentMessages = await execution.sessionStore.readMessagesSnapshot(parent.id);
+    const parentAssistant = parentMessages.find(
+      (message) =>
+        message.type === 'assistant' && message.turnId === 'hosted-tool-author-parent-turn',
+    );
+    assert.equal(parentAssistant?.type, 'assistant');
+    if (parentAssistant?.type === 'assistant') {
+      assert.equal(parentAssistant.text, TOOL_AUTHOR_PARENT_RESULT_TEXT);
+    }
+  } finally {
+    try {
+      await composition?.close();
+    } finally {
+      try {
+        await owner.close();
+      } finally {
+        await provider.close();
+        await rm(base, { recursive: true, force: true });
+      }
+    }
+  }
+});
+
 test('production Host publishes and retires an implementation child patch', async () => {
   const base = await mkdtemp(join(tmpdir(), 'maka-host-child-agent-'));
   const root = join(base, 'interactive');
@@ -1695,7 +1947,10 @@ test('production Host publishes and retires an implementation child patch', asyn
     assert.ok(toolNames(requests[1]?.body).includes('agent_spawn'));
     assert.deepEqual(toolParameterEnum(requests[1]?.body, 'agent_spawn', 'profile'), [
       'local_read',
+      'web_research',
       'implementation',
+      'tool_author',
+      'ui_author',
     ]);
     const childToolNames = [
       'ArchiveRead',
@@ -2729,6 +2984,7 @@ function backendCreationFixture(input: {
   recordRunComposition?: BackendFactoryContext['recordRunComposition'];
   createFetchTransport?: HostAiSdkBackendInput['createFetchTransport'];
   createRunComposer?: HostAiSdkBackendInput['createRunComposer'];
+  extensions?: HostAiSdkBackendInput['extensions'];
 }): HostAiSdkBackendInput {
   const runtimePolicy =
     input.runtimePolicy ??
@@ -2794,6 +3050,7 @@ function backendCreationFixture(input: {
     ...(input.oauthCredentials ? { oauthCredentials: input.oauthCredentials } : {}),
     ...(input.claudeDeviceId ? { claudeDeviceId: input.claudeDeviceId } : {}),
     createRunComposer,
+    ...(input.extensions ? { extensions: input.extensions } : {}),
     artifacts: {},
     executionArtifacts: {
       recordToolArtifacts: async () => undefined,
@@ -2818,6 +3075,22 @@ function backendCreationFixture(input: {
   } as unknown as HostAiSdkBackendInput;
 }
 
+async function drainBackendSend(
+  backend: Awaited<ReturnType<typeof createHostAiSdkBackend>>,
+  runId: string,
+  turnId: string,
+): Promise<void> {
+  for await (const _event of backend.send({
+    invocationId: `${runId}-invocation`,
+    runId,
+    turnId,
+    text: 'Return a short answer without calling tools.',
+    context: [],
+  })) {
+    // Drain the real provider-backed send to settlement.
+  }
+}
+
 function readyExecutionConnection(
   baseUrl?: string,
   customization: {
@@ -3083,6 +3356,7 @@ type ProviderFlow =
       readonly toolName: string;
     }
   | { readonly kind: 'child_agent' }
+  | { kind: 'tool_author_child_agent' }
   | {
       readonly kind: 'implementation_child_agent';
       ptyReadCount: number;
@@ -3095,6 +3369,7 @@ async function startProvider(): Promise<{
   readonly requests: ProviderRequest[];
   configureClientCapability(input: { groupId: string; toolName: string }): void;
   configureChildAgentFlow(): void;
+  configureToolAuthorChildFlow(): void;
   configureImplementationChildAgentFlow(): void;
   configureAgentGraphFlow(): void;
   close(): Promise<void>;
@@ -3120,6 +3395,10 @@ async function startProvider(): Promise<{
       if (flow.kind !== 'default') throw new Error('Provider flow is already configured');
       flow = { kind: 'child_agent' };
     },
+    configureToolAuthorChildFlow: () => {
+      if (flow.kind !== 'default') throw new Error('Provider flow is already configured');
+      flow = { kind: 'tool_author_child_agent' };
+    },
     configureImplementationChildAgentFlow: () => {
       if (flow.kind !== 'default') throw new Error('Provider flow is already configured');
       flow = { kind: 'implementation_child_agent', ptyReadCount: 0, stopRequested: false };
@@ -3183,7 +3462,9 @@ async function handleProviderRequest(
     return;
   }
   if (
-    (flow.kind === 'child_agent' || flow.kind === 'implementation_child_agent') &&
+    (flow.kind === 'child_agent' ||
+      flow.kind === 'implementation_child_agent' ||
+      flow.kind === 'tool_author_child_agent') &&
     streamRequestIndex === 1
   ) {
     assert.ok(toolNames(body).includes('load_tools'));
@@ -3192,21 +3473,102 @@ async function handleProviderRequest(
     return;
   }
   if (
-    (flow.kind === 'child_agent' || flow.kind === 'implementation_child_agent') &&
+    (flow.kind === 'child_agent' ||
+      flow.kind === 'implementation_child_agent' ||
+      flow.kind === 'tool_author_child_agent') &&
     streamRequestIndex === 2
   ) {
     assert.ok(toolNames(body).includes('agent_spawn'));
     respondProviderToolCall(response, streamRequestIndex, 'agent_spawn', {
-      profile: flow.kind === 'child_agent' ? 'local_read' : 'implementation',
+      profile:
+        flow.kind === 'child_agent'
+          ? 'local_read'
+          : flow.kind === 'tool_author_child_agent'
+            ? 'tool_author'
+            : 'implementation',
       task:
         flow.kind === 'child_agent'
           ? 'Inspect the hosted child execution boundary without changing files.'
-          : 'Create implementation.txt with the requested sentinel.',
-      isolation: flow.kind === 'child_agent' ? 'same_workspace' : 'worktree',
-      write_back: flow.kind === 'child_agent' ? 'summary' : 'patch',
+          : flow.kind === 'tool_author_child_agent'
+            ? 'Create, install, and sandbox-test a Tool that adds two numbers.'
+            : 'Create implementation.txt with the requested sentinel.',
+      isolation: flow.kind === 'implementation_child_agent' ? 'worktree' : 'same_workspace',
+      write_back: flow.kind === 'implementation_child_agent' ? 'patch' : 'summary',
+    });
+    return;
+  }
+  if (flow.kind === 'tool_author_child_agent' && streamRequestIndex === 3) {
+    assert.deepEqual(toolNames(body), [
+      'ArchiveRead',
+      'Glob',
+      'Grep',
+      'Read',
+      'define_package',
+      'inspect_package',
+    ]);
+    respondProviderToolCall(response, streamRequestIndex, 'inspect_package', {});
+    return;
+  }
+  if (flow.kind === 'tool_author_child_agent' && streamRequestIndex === 4) {
+    respondProviderToolCall(response, streamRequestIndex, 'define_package', {
+      id: 'child-calculator',
+      runtime: {
+        source:
+          "export default { Add: ({ left, right }) => ({ sum: left + right, author: 'child' }) };",
+        tools: [
+          {
+            name: 'Add',
+            description: 'Add two numbers using the child-authored Extension.',
+            handler: 'Add',
+            inputSchema: {
+              type: 'object',
+              properties: { left: { type: 'number' }, right: { type: 'number' } },
+              required: ['left', 'right'],
+              additionalProperties: false,
+            },
+            category: 'read',
+            recoveryMode: 'replay_safe',
+          },
+        ],
+        permissions: { workspace: 'none', network: false },
+      },
     });
     return;
   }
+  if (flow.kind === 'tool_author_child_agent' && streamRequestIndex === 5) {
+    const installed = requireLatestToolResult(body);
+    assert.equal(installed.extensionId, 'child-calculator');
+    respondProviderText(response, 'Defined child-calculator for parent activation.');
+    return;
+  }
+  if (flow.kind === 'tool_author_child_agent' && streamRequestIndex === 6) {
+    assert.ok(toolNames(body).includes('manage_package'));
+    respondProviderToolCall(response, streamRequestIndex, 'manage_package', {
+      action: 'activate',
+      extensionId: 'child-calculator',
+    });
+    return;
+  }
+  if (flow.kind === 'tool_author_child_agent' && streamRequestIndex === 7) {
+    assert.ok(toolNames(body).includes('invoke_tool'));
+    respondProviderToolCall(response, streamRequestIndex, 'invoke_tool', {
+      toolName: 'Add',
+      args: { left: 19, right: 23 },
+    });
+    return;
+  }
+  if (flow.kind === 'tool_author_child_agent' && streamRequestIndex === 8) {
+    assert.deepEqual(requireLatestToolResult(body), { sum: 42, author: 'child' });
+    respondProviderToolCall(response, streamRequestIndex, 'manage_package', {
+      action: 'stop',
+      extensionId: 'child-calculator',
+    });
+    return;
+  }
+  if (flow.kind === 'tool_author_child_agent' && streamRequestIndex === 9) {
+    respondProviderText(response, TOOL_AUTHOR_PARENT_RESULT_TEXT);
+    return;
+  }
   if (flow.kind === 'child_agent' && streamRequestIndex === 3) {
     assert.deepEqual(toolNames(body), ['ArchiveRead', 'Glob', 'Grep', 'Read']);
     respondProviderText(response, CHILD_AGENT_RESULT_TEXT);
@@ -3223,7 +3585,7 @@ async function handleProviderRequest(
     return;
   }
   if (flow.kind === 'child_agent' && streamRequestIndex === 5) {
-    assert.deepEqual(toolNames(body), ['ArchiveRead', 'WebSearch']);
+    assert.deepEqual(toolNames(body), ['ArchiveRead', 'WebFetch', 'WebSearch']);
     respondProviderToolCall(response, streamRequestIndex, 'WebSearch', {
       query: 'latest hosted web result',
       limit: 1,
@@ -3231,7 +3593,7 @@ async function handleProviderRequest(
     return;
   }
   if (flow.kind === 'child_agent' && streamRequestIndex === 6) {
-    assert.deepEqual(toolNames(body), ['ArchiveRead', 'WebSearch']);
+    assert.deepEqual(toolNames(body), ['ArchiveRead', 'WebFetch', 'WebSearch']);
     respondProviderText(response, WEB_RESEARCH_CHILD_RESULT_TEXT);
     return;
   }
diff --git a/packages/runtime-host/src/__tests__/extension-composition.test.ts b/packages/runtime-host/src/__tests__/extension-composition.test.ts
new file mode 100644
index 0000000000..b67fc21d18
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/extension-composition.test.ts
@@ -0,0 +1,117 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import {
+  resolveStorageRoot,
+  tryAcquireInteractiveRootOwner,
+  type InteractiveRootOwner,
+} from '@maka/storage/root-authority';
+import { z } from 'zod';
+import { createExecutionRuntimeHostComposition } from '../server/execution-composition.js';
+import type { ConnectionContext } from '../server/operation-dispatcher.js';
+
+const connection: ConnectionContext = {
+  hostEpoch: 'extension-composition-test',
+  connectionId: 'local-owner',
+  surface: 'desktop',
+  principal: 'local_os_user',
+  acquireResidency: () => ({ release: () => undefined }),
+};
+
+test('production composition exposes trusted Extension control and restores it after restart', async () => {
+  const base = await mkdtemp(join(tmpdir(), 'maka-extension-composition-'));
+  const root = join(base, 'interactive');
+  const capability = await resolveStorageRoot({ path: root, kind: 'interactive' });
+  let owner = await tryAcquireInteractiveRootOwner(capability);
+  assert.ok(owner);
+  if (!owner) return;
+  const trustedToolExtensions = [
+    {
+      extensionId: 'weather',
+      tools: [
+        {
+          name: 'Weather',
+          description: 'Read the deterministic weather fixture',
+          parameters: z.object({}),
+          impl: async () => ({ forecast: 'sunny' }),
+        },
+      ],
+    },
+  ];
+  let composition: Awaited<ReturnType<typeof createExecutionRuntimeHostComposition>> | undefined;
+  try {
+    composition = await createExecutionRuntimeHostComposition(compositionContext(owner), {
+      trustedToolExtensions,
+    });
+    await composition.recover();
+    const enabled = await composition.handlers['extension.composition.mutate'](
+      {
+        kind: 'enable',
+        entryId: 'weather-entry',
+        scopeId: 'session-1',
+        extensionId: 'weather',
+      },
+      connection,
+    );
+    assert.equal(enabled.ok, true);
+    assert.deepEqual(
+      composition.extensions.resolveTools('session-1', []).map(({ name }) => name),
+      [
+        'Weather',
+        'call_service',
+        'define_package',
+        'emit_event',
+        'inspect_package',
+        'invoke_tool',
+        'manage_package',
+        'publish_ui_state',
+      ],
+    );
+
+    await composition.close();
+    composition = undefined;
+    await owner.close();
+    owner = await tryAcquireInteractiveRootOwner(
+      await resolveStorageRoot({ path: root, kind: 'interactive' }),
+    );
+    assert.ok(owner);
+    if (!owner) return;
+
+    composition = await createExecutionRuntimeHostComposition(compositionContext(owner), {
+      trustedToolExtensions,
+    });
+    await composition.recover();
+    const restored = await composition.handlers['extension.composition.query']({}, connection);
+    assert.equal(restored.ok, true);
+    assert.equal(restored.ok && restored.result.entries[0]?.status, 'active');
+    assert.deepEqual(
+      composition.extensions.resolveTools('session-1', []).map(({ name }) => name),
+      [
+        'Weather',
+        'call_service',
+        'define_package',
+        'emit_event',
+        'inspect_package',
+        'invoke_tool',
+        'manage_package',
+        'publish_ui_state',
+      ],
+    );
+  } finally {
+    await composition?.close().catch(() => undefined);
+    if (owner && !owner.closed) await owner.close();
+    await rm(base, { recursive: true, force: true });
+  }
+});
+
+function compositionContext(owner: InteractiveRootOwner) {
+  return {
+    owner,
+    hostEpoch: 'extension-composition-test',
+    acquireResidency: () => ({ release() {} }),
+    retainUntilProcessExit: () => undefined,
+    requestDrain: () => undefined,
+  };
+}
diff --git a/packages/runtime-host/src/__tests__/extension-controller.test.ts b/packages/runtime-host/src/__tests__/extension-controller.test.ts
new file mode 100644
index 0000000000..91311b051d
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/extension-controller.test.ts
@@ -0,0 +1,355 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import type { MakaTool } from '@maka/runtime/tool-runtime';
+import { z } from 'zod';
+import { HostExtensionController } from '../server/extension-controller.js';
+import { StaticTrustedToolExtensionLoader } from '../server/extension-loader.js';
+import { HostExtensionRuntime } from '../server/extension-runtime.js';
+import { HostPluginCompositionStore } from '../server/plugin-composition-store.js';
+import type { ConnectionContext } from '../server/operation-dispatcher.js';
+
+const connection: ConnectionContext = {
+  hostEpoch: 'extension-controller-test',
+  connectionId: 'local-owner',
+  surface: 'desktop',
+  principal: 'local_os_user',
+  acquireResidency: () => ({ release: () => undefined }),
+};
+
+test('Extension composition enables, upgrades, rejects failed replacement, and restarts', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-extension-control-'));
+  let current = revision('1');
+  const loader = mutableLoader(() => current);
+  const store = new HostPluginCompositionStore(root);
+  let runtime = new HostExtensionRuntime();
+  let controller = new HostExtensionController(runtime, loader, store, () =>
+    assert.fail('deterministic Extension failures must not drain the Host'),
+  );
+
+  try {
+    await controller.recover();
+    const initial = await controller.handlers['extension.composition.query']({}, connection);
+    assert.equal(initial.ok, true);
+    assert.deepEqual(
+      initial.ok && initial.result.extensions.map(({ extensionId }) => extensionId),
+      ['weather'],
+    );
+
+    const enabled = await controller.handlers['extension.composition.mutate'](
+      {
+        kind: 'enable',
+        entryId: 'weather-entry',
+        scopeId: 'session-1',
+        extensionId: 'weather',
+      },
+      connection,
+    );
+    assert.equal(enabled.ok, true);
+    assert.deepEqual(enabled.ok && enabled.result.entry, {
+      entryId: 'weather-entry',
+      scopeId: 'session-1',
+      extensionId: 'weather',
+      generation: 1,
+      enabled: true,
+      status: 'active',
+      error: null,
+    });
+    assert.equal(await invoke(runtime, 'session-1'), '1');
+
+    current = revision('2');
+    const upgraded = await controller.handlers['extension.composition.mutate'](
+      { kind: 'reload', entryId: 'weather-entry' },
+      connection,
+    );
+    assert.equal(upgraded.ok, true);
+    assert.equal(await invoke(runtime, 'session-1'), '2');
+    assert.deepEqual(runtime.installedExtensions(), [{ extensionId: 'weather' }]);
+
+    current = revision('3', async () => {
+      throw new Error('weather v3 is unhealthy');
+    });
+    const failed = await controller.handlers['extension.composition.mutate'](
+      { kind: 'reload', entryId: 'weather-entry' },
+      connection,
+    );
+    assert.deepEqual(failed.ok, false);
+    assert.equal(!failed.ok && failed.error.code, 'operation_conflict');
+    assert.match(!failed.ok ? failed.error.message : '', /weather v3 is unhealthy/);
+    assert.equal(await invoke(runtime, 'session-1'), '2');
+
+    const afterFailure = await controller.handlers['extension.composition.query']({}, connection);
+    assert.equal(afterFailure.ok, true);
+    assert.deepEqual(afterFailure.ok && afterFailure.result.entries[0], {
+      entryId: 'weather-entry',
+      scopeId: 'session-1',
+      extensionId: 'weather',
+      generation: 2,
+      enabled: true,
+      status: 'active',
+      error: null,
+    });
+
+    await runtime.close();
+    runtime = new HostExtensionRuntime();
+    controller = new HostExtensionController(runtime, loader, store, () =>
+      assert.fail('failed composition recovery must not drain the Host'),
+    );
+    await controller.recover();
+    assert.deepEqual(runtime.resolveTools('session-1', []), []);
+    const recovered = await controller.handlers['extension.composition.query']({}, connection);
+    assert.equal(recovered.ok, true);
+    assert.equal(recovered.ok && recovered.result.entries[0]?.status, 'failed');
+
+    const disabled = await controller.handlers['extension.composition.mutate'](
+      { kind: 'disable', entryId: 'weather-entry' },
+      connection,
+    );
+    assert.equal(disabled.ok, true);
+    assert.equal(disabled.ok && disabled.result.entry?.status, 'disabled');
+    assert.deepEqual(runtime.resolveTools('session-1', []), []);
+
+    await runtime.close();
+    runtime = new HostExtensionRuntime();
+    controller = new HostExtensionController(runtime, loader, store, () =>
+      assert.fail('disabled recovery must not drain the Host'),
+    );
+    await controller.recover();
+    assert.deepEqual(runtime.resolveTools('session-1', []), []);
+    assert.deepEqual(runtime.installedExtensions(), []);
+
+    const persisted = JSON.parse(await readFile(store.path, 'utf8')) as {
+      roots: { sessions: Record<string, Array<{ disabled: boolean }>> };
+    };
+    assert.equal(persisted.roots.sessions['session-1']?.[0]?.disabled, true);
+
+    const removed = await controller.handlers['extension.composition.mutate'](
+      { kind: 'remove', entryId: 'weather-entry' },
+      connection,
+    );
+    assert.deepEqual(removed, { ok: true, result: { entry: null } });
+    assert.deepEqual(runtime.installedExtensions(), []);
+    const empty = JSON.parse(await readFile(store.path, 'utf8')) as {
+      roots: { sessions: Record<string, unknown[]> };
+    };
+    assert.deepEqual(empty.roots.sessions['session-1'], []);
+  } finally {
+    await runtime.close().catch(() => undefined);
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('Extension recovery isolates corrupt state from normal Runtime Host startup', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-extension-corrupt-'));
+  const store = new HostPluginCompositionStore(root);
+  const runtime = new HostExtensionRuntime();
+  const controller = new HostExtensionController(
+    runtime,
+    new StaticTrustedToolExtensionLoader([revision('1')]),
+    store,
+    () => undefined,
+  );
+  try {
+    const { writeFile } = await import('node:fs/promises');
+    await writeFile(store.path, '{not-json', 'utf8');
+    await controller.recover();
+    assert.deepEqual(await controller.handlers['extension.composition.query']({}, connection), {
+      ok: false,
+      error: { code: 'persistence_failed', message: 'Extension state is unavailable' },
+    });
+    assert.deepEqual(runtime.resolveTools('session-1', []), []);
+  } finally {
+    await runtime.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('Composition Snapshot restores and preserves nested groups', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-extension-tree-'));
+  const store = new HostPluginCompositionStore(root);
+  await store.replace({
+    schemaVersion: 1,
+    generation: 7,
+    roots: {
+      profile: [],
+      desktopUi: [],
+      sessions: {
+        'session-1': [
+          {
+            id: 'workspace-group',
+            disabled: false,
+            config: {},
+            intercept: { locale: 'zh-CN' },
+            children: [
+              {
+                id: 'weather-entry',
+                packageId: 'weather',
+                disabled: false,
+                config: {},
+                error: null,
+              },
+            ],
+          },
+        ],
+      },
+    },
+  });
+  const runtime = new HostExtensionRuntime();
+  const controller = new HostExtensionController(
+    runtime,
+    new StaticTrustedToolExtensionLoader([revision('1')]),
+    store,
+    () => assert.fail('tree recovery must not drain the Host'),
+  );
+  try {
+    await controller.recover();
+    assert.deepEqual(
+      runtime.inspectRuntime().map(({ id, children }) => [id, children[0]?.id]),
+      [['workspace-group', 'weather-entry']],
+    );
+    assert.equal(await invoke(runtime, 'session-1'), '1');
+    const persisted = await store.read();
+    assert.equal(persisted?.roots.sessions['session-1']?.[0]?.children?.[0]?.id, 'weather-entry');
+    assert.deepEqual(persisted?.roots.sessions['session-1']?.[0]?.intercept, { locale: 'zh-CN' });
+  } finally {
+    await runtime.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('Composition allows repeated instances of one Extension in a scope', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-extension-repeated-'));
+  const store = new HostPluginCompositionStore(root);
+  const runtime = new HostExtensionRuntime();
+  const loader = {
+    list: async () => [
+      {
+        extensionId: 'repeated-extension',
+        toolNames: ['per-entry'],
+        uiContributionIds: [],
+        eventContributionIds: [],
+        serviceContributionIds: [],
+        timerContributionIds: [],
+      },
+    ],
+    load: async () => ({
+      extensionId: 'repeated-extension',
+      toolNames: ['per-entry'],
+      load: async (context: { readonly entryId: string }) => ({
+        tools: [
+          {
+            name: `Tool_${context.entryId}`,
+            description: 'Entry-owned Tool',
+            parameters: z.object({}),
+            impl: async () => context.entryId,
+          },
+        ],
+      }),
+    }),
+    contracts: async () => [
+      {
+        extensionId: 'repeated-extension',
+        displayName: 'Repeated Extension',
+        description: '',
+        dependencies: [],
+        configuration: { properties: {}, required: [] },
+        contributions: [],
+      },
+    ],
+  };
+  const controller = new HostExtensionController(runtime, loader, store, () =>
+    assert.fail('repeated Extension entries must not drain the Host'),
+  );
+  try {
+    await controller.recover();
+    for (const entryId of ['empty-first', 'empty-second']) {
+      const enabled = await controller.handlers['extension.composition.mutate'](
+        {
+          kind: 'enable',
+          entryId,
+          scopeId: 'session-1',
+          extensionId: 'repeated-extension',
+        },
+        connection,
+      );
+      assert.equal(enabled.ok, true);
+    }
+    const queried = await controller.handlers['extension.composition.query']({}, connection);
+    assert.equal(queried.ok, true);
+    assert.deepEqual(queried.ok && queried.result.entries.map(({ entryId }) => entryId), [
+      'empty-first',
+      'empty-second',
+    ]);
+    assert.equal(runtime.inspect('empty-first').status, 'active');
+    assert.equal(runtime.inspect('empty-second').status, 'active');
+  } finally {
+    await runtime.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+function revision(
+  value: string,
+  healthCheck?: () => void | Promise<void>,
+): {
+  extensionId: string;
+  tools: readonly MakaTool[];
+  healthCheck?: () => void | Promise<void>;
+} {
+  return {
+    extensionId: 'weather',
+    tools: [
+      {
+        name: 'Weather',
+        description: `Weather revision ${value}`,
+        parameters: z.object({}),
+        impl: async () => ({ revision: value }),
+      },
+    ],
+    ...(healthCheck ? { healthCheck } : {}),
+  };
+}
+
+function mutableLoader(current: () => ReturnType<typeof revision>) {
+  return {
+    list: async () => [
+      {
+        extensionId: 'weather',
+        toolNames: ['Weather'],
+        uiContributionIds: [],
+        eventContributionIds: [],
+      },
+    ],
+    load: async () => current(),
+    contracts: async () => [
+      {
+        extensionId: 'weather',
+        displayName: 'weather',
+        description: '',
+        dependencies: [],
+        configuration: { properties: {}, required: [] },
+        contributions: [],
+      },
+    ],
+  };
+}
+
+async function invoke(runtime: HostExtensionRuntime, scopeId: string): Promise<string> {
+  const tool = runtime.resolveTools(scopeId, []).find(({ name }) => name === 'Weather');
+  assert.ok(tool);
+  const result = (await tool.impl(
+    {},
+    {
+      sessionId: scopeId,
+      turnId: 'turn-1',
+      cwd: '/workspace',
+      toolCallId: 'tool-call-1',
+      abortSignal: new AbortController().signal,
+      emitOutput: () => undefined,
+      askUserQuestion: async () => ({ answers: [] }),
+    },
+  )) as { revision: string };
+  return result.revision;
+}
diff --git a/packages/runtime-host/src/__tests__/extension-e2e.system.test.ts b/packages/runtime-host/src/__tests__/extension-e2e.system.test.ts
new file mode 100644
index 0000000000..36010e9453
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/extension-e2e.system.test.ts
@@ -0,0 +1,1011 @@
+import assert from 'node:assert/strict';
+import { randomUUID } from 'node:crypto';
+import { appendFile, mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import type { MakaTool } from '@maka/runtime/tool-runtime';
+import {
+  resolveRootControlNamespace,
+  resolveStorageRoot,
+  tryAcquireInteractiveRootOwner,
+} from '@maka/storage/root-authority';
+import {
+  openInteractiveRuntimePolicyStoresForWrite,
+  type RuntimePolicyStoresWriter,
+} from '@maka/storage/runtime-policy-stores';
+import { z } from 'zod';
+import {
+  connectRuntimeHost,
+  RuntimeHostOperationError,
+  type RuntimeHostConnection,
+} from '../client/index.js';
+import { RUNTIME_HOST_PROTOCOL_VERSION } from '../protocol/index.js';
+import type { RuntimeHostKernel } from '../server/host-kernel.js';
+import type { StaticTrustedToolExtension } from '../server/extension-loader.js';
+import { startExecutionRuntimeHostService } from '../server/execution-service.js';
+import { waitForTerminalTurn } from './fixtures/execution-host-suite.js';
+
+const MODEL_ID = 'extension-e2e-model';
+const CONNECTION_SLUG = 'extension-e2e-provider';
+const API_KEY = 'extension-e2e-key';
+const PROTOCOL = {
+  min: RUNTIME_HOST_PROTOCOL_VERSION,
+  max: RUNTIME_HOST_PROTOCOL_VERSION,
+} as const;
+
+test('installed Tool package works through real UDS, provider execution, sandbox, restart, and uninstall', {
+  timeout: 120_000,
+}, async () => {
+  const base = await mkdtemp(join(tmpdir(), 'maka-package-extension-e2e-'));
+  const root = join(base, 'interactive');
+  const source = join(base, 'weather-package');
+  const invocationLog = join(root, 'package-weather-invocations.jsonl');
+  const provider = await startProvider();
+  let host: RuntimeHostKernel | undefined;
+  let client: RuntimeHostConnection | undefined;
+  const capability = await resolveStorageRoot({ path: root, kind: 'interactive' });
+
+  try {
+    await createWeatherPackage(source);
+    await seedProvider(root, provider.baseUrl);
+    ({ host, client } = await startHost(root, []));
+    const installed = await client.request('extension.package.install', { sourcePath: source });
+    assert.equal(installed.extensionId, 'package-weather');
+    assert.deepEqual(installed.toolNames, ['Weather']);
+
+    await createSession(client, 'package-extension-session', root);
+    const enabled = await client.request('extension.composition.mutate', {
+      kind: 'enable',
+      entryId: 'package-weather-entry',
+      scopeId: 'package-extension-session',
+      extensionId: installed.extensionId,
+    });
+    assert.equal(enabled.entry?.status, 'active');
+    const first = await runTurn(
+      client,
+      provider,
+      'package-extension-session',
+      'call installed package weather',
+    );
+    assert.equal(first.tools.includes('Weather'), true);
+    assert.match(first.toolResult ?? '', /"source":"installed-package"/u);
+    assert.match(first.toolResult ?? '', /"temperature":31/u);
+    assert.equal((await readFile(invocationLog, 'utf8')).trim().split('\n').length, 1);
+
+    await client.close();
+    client = undefined;
+    await host.close();
+    host = undefined;
+    ({ host, client } = await startHost(root, []));
+    const recovered = await client.request('extension.composition.query', {});
+    assert.equal(recovered.entries[0]?.status, 'active');
+    assert.equal(recovered.extensions[0]?.extensionId, installed.extensionId);
+    const afterRestart = await runTurn(
+      client,
+      provider,
+      'package-extension-session',
+      'call recovered package weather',
+    );
+    assert.match(afterRestart.toolResult ?? '', /"source":"installed-package"/u);
+    assert.equal((await readFile(invocationLog, 'utf8')).trim().split('\n').length, 2);
+
+    await client.request('extension.composition.mutate', {
+      kind: 'remove',
+      entryId: 'package-weather-entry',
+    });
+    await client.request('extension.package.uninstall', {
+      extensionId: installed.extensionId,
+    });
+    assert.deepEqual(await client.request('extension.composition.query', {}), {
+      extensions: [],
+      entries: [],
+    });
+    const removed = await runTurn(
+      client,
+      provider,
+      'package-extension-session',
+      'uninstalled package must disappear',
+    );
+    assert.equal(removed.tools.includes('Weather'), false);
+  } finally {
+    await client?.close().catch(() => undefined);
+    await host?.close().catch(() => undefined);
+    await provider.close();
+    await rm(join(resolveRootControlNamespace(), capability.rootId), {
+      recursive: true,
+      force: true,
+    });
+    await rm(base, { recursive: true, force: true });
+  }
+});
+
+test('installed package runs real Tool execution through trusted around middleware', {
+  timeout: 120_000,
+}, async () => {
+  const base = await mkdtemp(join(tmpdir(), 'maka-around-extension-e2e-'));
+  const root = join(base, 'interactive');
+  const source = join(base, 'around-package');
+  const invocationLog = join(root, 'around-invocations.jsonl');
+  const provider = await startProvider();
+  let host: RuntimeHostKernel | undefined;
+  let client: RuntimeHostConnection | undefined;
+  const capability = await resolveStorageRoot({ path: root, kind: 'interactive' });
+
+  try {
+    await createAroundPackage(source);
+    await seedProvider(root, provider.baseUrl);
+    ({ host, client } = await startHost(root, []));
+    const installed = await client.request('extension.package.install', { sourcePath: source });
+    assert.equal(installed.extensionId, 'around-package');
+    assert.deepEqual(installed.toolNames, ['Weather']);
+    assert.ok(installed.eventContributionIds.some((id) => id.includes('weather.alert')));
+    assert.ok(installed.eventContributionIds.some((id) => id.includes('alert-record')));
+    assert.ok(installed.serviceContributionIds?.some((id) => id.includes('audit')));
+    assert.ok(installed.timerContributionIds?.some((id) => id.includes('heartbeat')));
+
+    await createSession(client, 'around-extension-session', root);
+    const enabled = await client.request('extension.composition.mutate', {
+      kind: 'enable',
+      entryId: 'around-package-entry',
+      scopeId: 'profile',
+      extensionId: installed.extensionId,
+    });
+    assert.equal(enabled.entry?.status, 'active');
+    const configured = await client.request('extension.configuration.mutate', {
+      entryId: 'around-package-entry',
+      configuration: { region: 'Hangzhou' },
+    });
+    assert.deepEqual(configured.configuration, { region: 'Hangzhou' });
+
+    const result = await runTurn(
+      client,
+      provider,
+      'around-extension-session',
+      'exercise real around middleware',
+    );
+    assert.match(result.toolResult ?? '', /"middleware":"around"/u);
+    assert.match(result.toolResult ?? '', /"city":"Hangzhou-through-around"/u);
+    assert.match(result.toolResult ?? '', /"callCount":1/u);
+    assert.match(result.toolResult ?? '', /"region":"Hangzhou"/u);
+    assert.match(result.toolResult ?? '', /"auditAccepted":true/u);
+    assert.deepEqual(
+      (await readFile(invocationLog, 'utf8'))
+        .trim()
+        .split('\n')
+        .map((line) => JSON.parse(line)),
+      [
+        { phase: 'before', toolName: 'Weather', city: 'Hangzhou' },
+        { phase: 'after', middleware: 'around' },
+      ],
+    );
+    assert.deepEqual(JSON.parse(await readFile(join(root, 'weather-alert.json'), 'utf8')), {
+      city: 'Hangzhou-through-around',
+      score: 7,
+    });
+    assert.deepEqual(JSON.parse(await readFile(join(root, 'weather-service.json'), 'utf8')), {
+      city: 'Hangzhou-through-around',
+      score: 7,
+    });
+    await waitForFile(join(root, 'weather-heartbeat.json'));
+    assert.deepEqual(JSON.parse(await readFile(join(root, 'weather-heartbeat.json'), 'utf8')), {
+      region: 'Hangzhou',
+      kind: 'heartbeat',
+    });
+    const llmLog = (await readFile(join(root, 'llm-around-invocations.jsonl'), 'utf8'))
+      .trim()
+      .split('\n')
+      .map((line) => JSON.parse(line));
+    assert.ok(llmLog.length >= 4, 'real provider execution should cross the LLM middleware');
+    assert.equal(llmLog.length % 2, 0);
+    for (let index = 0; index < llmLog.length; index += 2) {
+      assert.deepEqual(llmLog[index], { phase: 'before' });
+      assert.deepEqual(llmLog[index + 1], { phase: 'after' });
+    }
+
+    const sharedState = await runTurn(
+      client,
+      provider,
+      'around-extension-session',
+      'exercise shared in-process module state',
+    );
+    assert.match(sharedState.toolResult ?? '', /"callCount":2/u);
+
+    await client.close();
+    client = undefined;
+    await host.close();
+    host = undefined;
+    ({ host, client } = await startHost(root, []));
+    const afterRestart = await runTurn(
+      client,
+      provider,
+      'around-extension-session',
+      'exercise fresh activation after Host restart',
+    );
+    assert.match(afterRestart.toolResult ?? '', /"callCount":1/u);
+  } finally {
+    await client?.close().catch(() => undefined);
+    await host?.close().catch(() => undefined);
+    await provider.close();
+    await rm(join(resolveRootControlNamespace(), capability.rootId), {
+      recursive: true,
+      force: true,
+    });
+    await rm(base, { recursive: true, force: true });
+  }
+});
+
+test('file review package links Tool, UI, Hook, Service, Event, and Timer through real provider execution', {
+  timeout: 120_000,
+}, async () => {
+  const base = await mkdtemp(join(tmpdir(), 'maka-file-review-e2e-'));
+  const root = join(base, 'interactive');
+  const source = join(base, 'file-review-package');
+  const provider = await startProvider('ReviewDocument', { path: 'incoming/release-notes.md' });
+  let host: RuntimeHostKernel | undefined;
+  let client: RuntimeHostConnection | undefined;
+  const capability = await resolveStorageRoot({ path: root, kind: 'interactive' });
+
+  try {
+    await mkdir(join(root, 'incoming'), { recursive: true });
+    await writeFile(
+      join(root, 'incoming', 'release-notes.md'),
+      '# Release notes\n\nOwner: platform\n\nTODO: add rollback instructions.\n',
+    );
+    await createFileReviewPackage(source);
+    await seedProvider(root, provider.baseUrl);
+    ({ host, client } = await startHost(root, []));
+    const installed = await client.request('extension.package.install', { sourcePath: source });
+    assert.equal(installed.extensionId, 'file-review-package');
+    assert.deepEqual(installed.toolNames, ['ReviewDocument']);
+    assert.ok(installed.uiContributionIds.some((id) => id.includes('review-console')));
+    assert.ok(installed.eventContributionIds.some((id) => id.includes('review.completed')));
+    assert.ok(installed.serviceContributionIds?.some((id) => id.includes('policy')));
+    assert.ok(installed.timerContributionIds?.some((id) => id.includes('refresh')));
+
+    await createSession(client, 'file-review-session', root);
+    const enabled = await client.request('extension.composition.mutate', {
+      kind: 'enable',
+      entryId: 'file-review-entry',
+      scopeId: 'profile',
+      extensionId: installed.extensionId,
+    });
+    assert.equal(enabled.entry?.status, 'active');
+
+    const result = await runTurn(
+      client,
+      provider,
+      'file-review-session',
+      'review the fixture document without editing it',
+    );
+    assert.match(result.toolResult ?? '', /"status":"needs_changes"/u);
+    assert.match(result.toolResult ?? '', /"violations":1/u);
+    assert.deepEqual(JSON.parse(await readFile(join(root, 'review-event.json'), 'utf8')), {
+      path: 'incoming/release-notes.md',
+      status: 'needs_changes',
+      violations: 1,
+    });
+    assert.deepEqual(JSON.parse(await readFile(join(root, 'review-service.json'), 'utf8')), {
+      path: 'incoming/release-notes.md',
+      violations: 1,
+    });
+    assert.deepEqual(
+      (await readFile(join(root, 'review-hook.jsonl'), 'utf8'))
+        .trim()
+        .split('\n')
+        .map((line) => JSON.parse(line)),
+      [
+        { phase: 'before', toolName: 'ReviewDocument' },
+        { phase: 'after', toolName: 'ReviewDocument' },
+      ],
+    );
+    await waitForFile(join(root, 'review-refresh.json'));
+    assert.deepEqual(JSON.parse(await readFile(join(root, 'review-refresh.json'), 'utf8')), {
+      kind: 'refresh',
+    });
+    assert.match(
+      await readFile(join(root, 'incoming', 'release-notes.md'), 'utf8'),
+      /TODO: add rollback instructions/u,
+    );
+  } finally {
+    await client?.close().catch(() => undefined);
+    await host?.close().catch(() => undefined);
+    await provider.close();
+    await rm(join(resolveRootControlNamespace(), capability.rootId), {
+      recursive: true,
+      force: true,
+    });
+    await rm(base, { recursive: true, force: true });
+  }
+});
+
+async function createWeatherPackage(source: string): Promise<void> {
+  await mkdir(join(source, 'dist'), { recursive: true });
+  await writeFile(
+    join(source, 'maka.extension.json'),
+    `${JSON.stringify(
+      {
+        schemaVersion: 1,
+        id: 'package-weather',
+        runtime: {
+          entry: 'dist/index.mjs',
+          tools: [
+            {
+              name: 'Weather',
+              description: 'Read deterministic weather from an installed package.',
+              handler: 'Weather',
+              inputSchema: {
+                type: 'object',
+                properties: { city: { type: 'string' } },
+                required: ['city'],
+                additionalProperties: false,
+              },
+              category: 'file_write',
+              recoveryMode: 'never_auto_retry',
+            },
+          ],
+          events: [],
+          listeners: [],
+          services: [],
+          timers: [],
+          permissions: { workspace: 'write', network: false },
+        },
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  await writeFile(
+    join(source, 'dist', 'index.mjs'),
+    `import { appendFile } from 'node:fs/promises';
+import { join } from 'node:path';
+export default {
+  Weather: async ({ city }, context) => {
+    await appendFile(join(context.cwd, 'package-weather-invocations.jsonl'), JSON.stringify({ city, sessionId: context.sessionId }) + '\\n', 'utf8');
+    return { source: 'installed-package', city, temperature: 31 };
+  },
+};
+`,
+  );
+}
+
+async function createAroundPackage(source: string): Promise<void> {
+  await mkdir(join(source, 'dist'), { recursive: true });
+  await writeFile(
+    join(source, 'maka.extension.json'),
+    `${JSON.stringify(
+      {
+        schemaVersion: 1,
+        id: 'around-package',
+        configuration: {
+          properties: {
+            region: { type: 'string', default: 'default-region', secret: false },
+          },
+          required: ['region'],
+        },
+        runtime: {
+          entry: 'dist/index.mjs',
+          tools: [
+            {
+              name: 'Weather',
+              description: 'Read weather through real around middleware.',
+              handler: 'Weather',
+              inputSchema: {
+                type: 'object',
+                properties: { city: { type: 'string' } },
+                required: ['city'],
+                additionalProperties: false,
+              },
+              recoveryMode: 'never_auto_retry',
+            },
+          ],
+          events: [
+            {
+              name: 'around-package.weather.alert',
+              description: 'Weather alert emitted by the Tool.',
+              payloadSchema: {
+                type: 'object',
+                properties: { city: { type: 'string' }, score: { type: 'number' } },
+                required: ['city', 'score'],
+                additionalProperties: false,
+              },
+            },
+          ],
+          listeners: [
+            {
+              id: 'around-llm',
+              event: 'maka.llm.stream',
+              handler: 'aroundLlm',
+            },
+            {
+              id: 'around-tools',
+              event: 'maka.tools.execute',
+              handler: 'aroundTools',
+            },
+            {
+              id: 'alert-record',
+              event: 'around-package.weather.alert',
+              handler: 'alertRecord',
+            },
+          ],
+          services: [
+            {
+              name: 'around-package.audit',
+              version: '1.0.0',
+              description: 'Records the accepted weather score.',
+              methods: [
+                {
+                  name: 'record',
+                  description: 'Record a weather score.',
+                  handler: 'recordAudit',
+                  inputSchema: {
+                    type: 'object',
+                    properties: { city: { type: 'string' }, score: { type: 'number' } },
+                    required: ['city', 'score'],
+                    additionalProperties: false,
+                  },
+                  outputSchema: {
+                    type: 'object',
+                    properties: { accepted: { type: 'boolean' } },
+                    required: ['accepted'],
+                    additionalProperties: false,
+                  },
+                },
+              ],
+            },
+          ],
+          timers: [
+            {
+              id: 'heartbeat',
+              handler: 'heartbeat',
+              intervalMs: 1_000,
+              initialDelayMs: 100,
+              timeoutMs: 1_000,
+              payload: { kind: 'heartbeat' },
+            },
+          ],
+          permissions: { workspace: 'write', network: false },
+        },
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  await writeFile(
+    join(source, 'dist', 'index.mjs'),
+    `import { appendFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const log = (context, value) => appendFile(
+  join(context.cwd, 'around-invocations.jsonl'),
+  JSON.stringify(value) + '\\n',
+  'utf8',
+);
+const logLlm = (context, value) => appendFile(
+  join(context.cwd, 'llm-around-invocations.jsonl'),
+  JSON.stringify(value) + '\\n',
+  'utf8',
+);
+const writeJson = (context, name, value) => import('node:fs/promises').then(({ writeFile }) =>
+  writeFile(join(context.cwd, name), JSON.stringify(value), 'utf8'));
+let callCount = 0;
+export default {
+  Weather: async ({ city }, context) => {
+    callCount += 1;
+    const score = 7;
+    const audit = await context.callService('around-package.audit', 'record', { city, score });
+    await context.emitEvent('around-package.weather.alert', { city, score });
+    return {
+      source: 'around-package', city, temperature: 32, callCount, score,
+      region: context.configuration.region, auditAccepted: audit.accepted,
+    };
+  },
+  aroundTools: async (payload, context, next) => {
+    await log(context, { phase: 'before', toolName: payload.toolName, city: payload.toolInput.city });
+    const result = await next({
+      ...payload,
+      toolInput: { ...payload.toolInput, city: payload.toolInput.city + '-through-around' },
+    });
+    const wrapped = { ...result, middleware: 'around' };
+    await log(context, { phase: 'after', middleware: wrapped.middleware });
+    return wrapped;
+  },
+  aroundLlm: async (payload, context, next) => {
+    await logLlm(context, { phase: 'before' });
+    const result = await next(payload);
+    await logLlm(context, { phase: 'after' });
+    return result;
+  },
+  alertRecord: async (payload, context) => writeJson(context, 'weather-alert.json', payload),
+  recordAudit: async (payload, context) => {
+    await writeJson(context, 'weather-service.json', payload);
+    return { accepted: true };
+  },
+  heartbeat: async (payload, context) =>
+    writeJson(context, 'weather-heartbeat.json', { ...payload, region: context.configuration.region }),
+};
+`,
+  );
+}
+
+async function createFileReviewPackage(source: string): Promise<void> {
+  await mkdir(join(source, 'dist'), { recursive: true });
+  await mkdir(join(source, 'documents'), { recursive: true });
+  await writeFile(
+    join(source, 'documents', 'review-console.html'),
+    '<!doctype html><title>File Review Console</title><main>WAITING</main>',
+  );
+  await writeFile(
+    join(source, 'maka.extension.json'),
+    JSON.stringify({
+      schemaVersion: 1,
+      id: 'file-review-package',
+      ui: {
+        contributions: [
+          {
+            id: 'review-console',
+            surface: 'app.slot',
+            slot: 'conversation.header',
+            priority: 20,
+            document: 'documents/review-console.html',
+          },
+        ],
+        permissions: { network: false },
+      },
+      runtime: {
+        entry: 'dist/index.mjs',
+        tools: [
+          {
+            name: 'ReviewDocument',
+            description: 'Review a fixture document without editing it.',
+            handler: 'ReviewDocument',
+            inputSchema: {
+              type: 'object',
+              properties: { path: { type: 'string' } },
+              required: ['path'],
+              additionalProperties: false,
+            },
+            recoveryMode: 'never_auto_retry',
+          },
+        ],
+        events: [
+          {
+            name: 'file-review-package.review.completed',
+            description: 'A document review completed.',
+            payloadSchema: {
+              type: 'object',
+              properties: {
+                path: { type: 'string' },
+                status: { type: 'string' },
+                violations: { type: 'number' },
+              },
+              required: ['path', 'status', 'violations'],
+              additionalProperties: false,
+            },
+          },
+        ],
+        listeners: [
+          { id: 'around-review-tool', event: 'maka.tools.execute', handler: 'aroundReviewTool' },
+          {
+            id: 'record-review',
+            event: 'file-review-package.review.completed',
+            handler: 'recordReview',
+          },
+        ],
+        services: [
+          {
+            name: 'file-review-package.policy',
+            version: '1.0.0',
+            description: 'Evaluates document policy violations.',
+            methods: [
+              {
+                name: 'evaluate',
+                description: 'Evaluate a fixture document.',
+                handler: 'evaluate',
+                inputSchema: {
+                  type: 'object',
+                  properties: { path: { type: 'string' }, content: { type: 'string' } },
+                  required: ['path', 'content'],
+                  additionalProperties: false,
+                },
+                outputSchema: {
+                  type: 'object',
+                  properties: { status: { type: 'string' }, violations: { type: 'number' } },
+                  required: ['status', 'violations'],
+                  additionalProperties: false,
+                },
+              },
+            ],
+          },
+        ],
+        timers: [
+          {
+            id: 'refresh',
+            handler: 'refresh',
+            intervalMs: 1_000,
+            initialDelayMs: 100,
+            timeoutMs: 1_000,
+            payload: { kind: 'refresh' },
+          },
+        ],
+        permissions: { workspace: 'write', network: false },
+      },
+    }),
+  );
+  await writeFile(
+    join(source, 'dist', 'index.mjs'),
+    `import { appendFile, readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const writeJson = (context, name, value) =>
+  writeFile(join(context.cwd, name), JSON.stringify(value), 'utf8');
+export default {
+  ReviewDocument: async ({ path }, context) => {
+    const content = await readFile(join(context.cwd, path), 'utf8');
+    const policy = await context.callService('file-review-package.policy', 'evaluate', { path, content });
+    const result = { path, ...policy };
+    await context.emitEvent('file-review-package.review.completed', result);
+    return result;
+  },
+  aroundReviewTool: async (payload, context, next) => {
+    if (payload.toolName !== 'ReviewDocument') return next(payload);
+    await appendFile(join(context.cwd, 'review-hook.jsonl'), JSON.stringify({ phase: 'before', toolName: payload.toolName }) + '\\n');
+    const result = await next(payload);
+    await appendFile(join(context.cwd, 'review-hook.jsonl'), JSON.stringify({ phase: 'after', toolName: payload.toolName }) + '\\n');
+    return result;
+  },
+  evaluate: async ({ path, content }, context) => {
+    const violations = content.includes('TODO:') ? 1 : 0;
+    await writeJson(context, 'review-service.json', { path, violations });
+    return { status: violations > 0 ? 'needs_changes' : 'approved', violations };
+  },
+  recordReview: async (payload, context) => writeJson(context, 'review-event.json', payload),
+  refresh: async (payload, context) => writeJson(context, 'review-refresh.json', payload),
+};
+`,
+  );
+}
+
+async function waitForFile(path: string, timeoutMs = 5_000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      await stat(path);
+      return;
+    } catch {
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+  }
+  throw new Error(`Timed out waiting for ${path}`);
+}
+
+async function seedProvider(root: string, baseUrl: string): Promise<void> {
+  const capability = await resolveStorageRoot({ path: root, kind: 'interactive' });
+  const owner = await tryAcquireInteractiveRootOwner(capability);
+  assert.ok(owner);
+  if (!owner) return;
+  try {
+    const policy = await openInteractiveRuntimePolicyStoresForWrite(owner.lease);
+    const created = await policy.connectionCatalog.create({
+      expectedCatalogRevision: 0,
+      connection: {
+        slug: CONNECTION_SLUG,
+        name: 'Extension E2E provider',
+        providerType: 'moonshot',
+        baseUrl,
+        enabled: true,
+        enabledModelIds: [MODEL_ID],
+      },
+    });
+    assert.equal(created.kind, 'committed');
+    if (created.kind !== 'committed') return;
+    const connection = created.snapshot.connections[0];
+    assert.ok(connection);
+    if (!connection) return;
+    const credential = await policy.credentialVault.set({
+      locator: {
+        scope: 'connection',
+        connectionId: connection.connectionId,
+        kind: 'api_key',
+      },
+      expected: null,
+      secret: API_KEY,
+    });
+    assert.equal(credential.kind, 'committed');
+    await publishConnectionModel(policy, connection.connectionId);
+  } finally {
+    await owner.close();
+  }
+}
+
+async function publishConnectionModel(
+  policy: RuntimePolicyStoresWriter,
+  connectionId: string,
+): Promise<void> {
+  const prepared = await policy.operations.beginModelFetch(connectionId);
+  assert.equal(prepared.kind, 'ready');
+  if (prepared.kind !== 'ready') return;
+  const committed = await policy.operations.completeModelFetch(prepared.ticket, {
+    models: [
+      {
+        id: MODEL_ID,
+        capabilities: { chat: true, functionCalling: true },
+        contextWindow: 8_192,
+        maxOutputTokens: 256,
+      },
+    ],
+    source: 'fetched',
+    fetchedAt: Date.now(),
+  });
+  assert.equal(committed.kind, 'committed');
+}
+
+async function startHost(
+  root: string,
+  trustedToolExtensions: readonly StaticTrustedToolExtension[],
+): Promise<{ host: RuntimeHostKernel; client: RuntimeHostConnection }> {
+  const host = await startExecutionRuntimeHostService({
+    rootPath: root,
+    trustedToolExtensions,
+  });
+  const connected = await connectRuntimeHost({
+    rootPath: root,
+    surface: 'desktop',
+    protocol: PROTOCOL,
+  });
+  assert.equal(connected.kind, 'connected');
+  if (connected.kind !== 'connected') {
+    await host.close();
+    throw new Error('Runtime Host Client did not connect');
+  }
+  return { host, client: connected.connection };
+}
+
+async function createSession(
+  client: RuntimeHostConnection,
+  sessionId: string,
+  root: string,
+): Promise<void> {
+  const created = await client.request('session.create', {
+    sessionId,
+    workspace: { kind: 'host_path', path: root },
+    modelTarget: {
+      kind: 'explicit',
+      connectionSlug: CONNECTION_SLUG,
+      model: MODEL_ID,
+    },
+    permissionMode: 'bypass',
+  });
+  assert.equal('kind' in created, false);
+}
+
+async function runTurn(
+  client: RuntimeHostConnection,
+  provider: Awaited<ReturnType<typeof startProvider>>,
+  sessionId: string,
+  marker: string,
+): Promise<{ tools: readonly string[]; toolResult: string | undefined }> {
+  const before = provider.requests.length;
+  const turnId = randomUUID();
+  const started = await client.startTurn({
+    sessionId,
+    turnId,
+    content: { text: marker },
+    maxSteps: 8,
+  });
+  assert.equal(started.kind, 'started');
+  const terminal = await waitForTerminalTurn(client, sessionId, turnId);
+  assert.equal(terminal.status, 'completed', JSON.stringify(terminal));
+  const requests = provider.requests.slice(before).filter(({ body }) => body.stream === true);
+  assert.ok(requests.length >= 1, `Provider did not receive Turn ${turnId}`);
+  const first = requests[0];
+  const toolResult = requests.map(({ body }) => latestToolResult(body)).find(Boolean);
+  return { tools: toolNames(first?.body), toolResult };
+}
+
+function operationError(code: string, message?: RegExp): (error: unknown) => boolean {
+  return (error: unknown) =>
+    error instanceof RuntimeHostOperationError &&
+    error.code === code &&
+    (message ? message.test(error.message) : true);
+}
+
+interface ProviderRequest {
+  readonly body: Record<string, unknown>;
+}
+
+async function startProvider(
+  toolName = 'Weather',
+  toolArgs: Record<string, unknown> = { city: 'Hangzhou' },
+): Promise<{
+  readonly baseUrl: string;
+  readonly requests: ProviderRequest[];
+  close(): Promise<void>;
+}> {
+  const requests: ProviderRequest[] = [];
+  let callSequence = 0;
+  const server = createServer((request, response) => {
+    void (async () => {
+      assert.equal(request.method, 'POST');
+      assert.equal(request.headers.authorization, `Bearer ${API_KEY}`);
+      const body = JSON.parse(await readBody(request)) as Record<string, unknown>;
+      requests.push({ body });
+      if (body.stream !== true) {
+        respondJson(response, 'Extension E2E background effect completed.');
+        return;
+      }
+      const result = latestToolResult(body);
+      if (result !== undefined) {
+        respondText(response, `Observed trusted Tool result: ${result}`);
+        return;
+      }
+      if (toolNames(body).includes(toolName)) {
+        callSequence += 1;
+        respondToolCall(response, callSequence, toolName, toolArgs);
+        return;
+      }
+      respondText(response, `${toolName} is not available in this Session scope.`);
+    })().catch((error) => response.destroy(error as Error));
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      server.off('error', reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  assert.ok(address && typeof address === 'object');
+  return {
+    baseUrl: `http://127.0.0.1:${address.port}/v1`,
+    requests,
+    close: () =>
+      new Promise<void>((resolve, reject) => {
+        server.close((error) => (error ? reject(error) : resolve()));
+      }),
+  };
+}
+
+function toolNames(body: Record<string, unknown> | undefined): string[] {
+  const tools = Array.isArray(body?.tools) ? body.tools : [];
+  return tools.flatMap((tool) => {
+    if (!tool || typeof tool !== 'object') return [];
+    const fn = (tool as { function?: unknown }).function;
+    if (!fn || typeof fn !== 'object') return [];
+    const name = (fn as { name?: unknown }).name;
+    return typeof name === 'string' ? [name] : [];
+  });
+}
+
+function latestToolResult(body: Record<string, unknown>): string | undefined {
+  const messages: unknown[] = Array.isArray(body.messages) ? body.messages : [];
+  let currentTurnStart = -1;
+  for (let index = messages.length - 1; index >= 0; index -= 1) {
+    const message = messages[index];
+    if (message && typeof message === 'object' && 'role' in message && message.role === 'user') {
+      currentTurnStart = index;
+      break;
+    }
+  }
+  const content = messages
+    .slice(currentTurnStart + 1)
+    .filter(
+      (message): message is Record<string, unknown> =>
+        message !== null &&
+        typeof message === 'object' &&
+        'role' in message &&
+        message.role === 'tool',
+    )
+    .at(-1)?.content;
+  return typeof content === 'string'
+    ? content
+    : content === undefined
+      ? undefined
+      : JSON.stringify(content);
+}
+
+function respondToolCall(
+  response: ServerResponse,
+  sequence: number,
+  toolName: string,
+  args: Record<string, unknown>,
+): void {
+  response.writeHead(200, { 'content-type': 'text/event-stream' });
+  response.write(
+    `data: ${JSON.stringify({
+      id: `extension-tool-${sequence}`,
+      object: 'chat.completion.chunk',
+      created: sequence,
+      model: MODEL_ID,
+      choices: [
+        {
+          index: 0,
+          delta: {
+            role: 'assistant',
+            tool_calls: [
+              {
+                index: 0,
+                id: `extension-tool-call-${sequence}`,
+                type: 'function',
+                function: { name: toolName, arguments: JSON.stringify(args) },
+              },
+            ],
+          },
+          finish_reason: null,
+        },
+      ],
+    })}\n\n`,
+  );
+  response.write(
+    `data: ${JSON.stringify({
+      id: `extension-tool-${sequence}`,
+      object: 'chat.completion.chunk',
+      created: sequence,
+      model: MODEL_ID,
+      choices: [{ index: 0, delta: {}, finish_reason: 'tool_calls' }],
+      usage: { prompt_tokens: 10, completion_tokens: 5, total_tokens: 15 },
+    })}\n\n`,
+  );
+  response.end('data: [DONE]\n\n');
+}
+
+function respondText(response: ServerResponse, text: string): void {
+  response.writeHead(200, { 'content-type': 'text/event-stream' });
+  response.write(
+    `data: ${JSON.stringify({
+      id: `extension-text-${randomUUID()}`,
+      object: 'chat.completion.chunk',
+      created: 1,
+      model: MODEL_ID,
+      choices: [
+        {
+          index: 0,
+          delta: { role: 'assistant', content: text },
+          finish_reason: null,
+        },
+      ],
+    })}\n\n`,
+  );
+  response.write(
+    `data: ${JSON.stringify({
+      id: `extension-text-${randomUUID()}`,
+      object: 'chat.completion.chunk',
+      created: 1,
+      model: MODEL_ID,
+      choices: [{ index: 0, delta: {}, finish_reason: 'stop' }],
+      usage: { prompt_tokens: 12, completion_tokens: 6, total_tokens: 18 },
+    })}\n\n`,
+  );
+  response.end('data: [DONE]\n\n');
+}
+
+function respondJson(response: ServerResponse, text: string): void {
+  response.writeHead(200, { 'content-type': 'application/json' });
+  response.end(
+    JSON.stringify({
+      id: 'extension-background-effect',
+      object: 'chat.completion',
+      created: 1,
+      model: MODEL_ID,
+      choices: [
+        {
+          index: 0,
+          message: { role: 'assistant', content: text },
+          finish_reason: 'stop',
+        },
+      ],
+      usage: { prompt_tokens: 5, completion_tokens: 3, total_tokens: 8 },
+    }),
+  );
+}
+
+function readBody(request: IncomingMessage): Promise<string> {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    request.setEncoding('utf8');
+    request.on('data', (chunk) => {
+      body += chunk;
+    });
+    request.on('end', () => resolve(body));
+    request.on('error', reject);
+  });
+}
diff --git a/packages/runtime-host/src/__tests__/extension-package-management.system.test.ts b/packages/runtime-host/src/__tests__/extension-package-management.system.test.ts
new file mode 100644
index 0000000000..f4c960bb9f
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/extension-package-management.system.test.ts
@@ -0,0 +1,405 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import type { MakaTool, MakaToolContext } from '@maka/runtime/tool-runtime';
+import { z } from 'zod';
+import { HostExtensionController } from '../server/extension-controller.js';
+import {
+  InstalledPluginPackageLoader,
+  StaticTrustedToolExtensionLoader,
+} from '../server/extension-loader.js';
+import { HostExtensionPackageManagementTools } from '../server/extension-package-management-tools.js';
+import { HostExtensionRuntime } from '../server/extension-runtime.js';
+import { HostPluginCompositionStore } from '../server/plugin-composition-store.js';
+import { PluginPackageStore } from '../server/plugin-package-store.js';
+import type { ConnectionContext } from '../server/operation-dispatcher.js';
+
+const connection: ConnectionContext = {
+  hostEpoch: 'extension-package-management-test',
+  connectionId: 'local-owner',
+  surface: 'desktop',
+  principal: 'local_os_user',
+  acquireResidency: () => ({ release: () => undefined }),
+};
+
+test('define_package installs Tool, UI, Event, dependencies, and secret configuration as one Extension', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-define-package-'));
+  const control = join(root, 'control');
+  const runtime = new HostExtensionRuntime();
+  const toolStore = new PluginPackageStore(control);
+  const uiStore = toolStore;
+  const eventStore = toolStore;
+  const loader = new InstalledPluginPackageLoader(
+    new StaticTrustedToolExtensionLoader(),
+    toolStore,
+  );
+  const controller = new HostExtensionController(
+    runtime,
+    loader,
+    new HostPluginCompositionStore(control),
+    () => undefined,
+  );
+  try {
+    const management = new HostExtensionPackageManagementTools(control, controller);
+    assert.deepEqual(
+      management.authorTools().map(({ name }) => name),
+      ['inspect_package', 'define_package'],
+    );
+    assert.deepEqual(
+      management.tools().map(({ name }) => name),
+      [
+        'inspect_package',
+        'define_package',
+        'manage_package',
+        'invoke_tool',
+        'emit_event',
+        'call_service',
+        'publish_ui_state',
+      ],
+    );
+    await call(management.tools(), 'define_package', {
+      id: 'dev.maka.base',
+      runtime: {
+        source: 'export default { ping: async () => ({ pong: true }) };\n',
+        tools: [
+          {
+            name: 'base_ping',
+            description: 'Dependency health check.',
+            handler: 'ping',
+            inputSchema: { type: 'object', additionalProperties: false },
+          },
+        ],
+        permissions: { workspace: 'none', network: false },
+      },
+    });
+    const result = (await call(management.tools(), 'define_package', {
+      id: 'dev.maka.codebase-studio',
+      displayName: 'Codebase Studio',
+      description: 'Unified authoring acceptance fixture.',
+      dependencies: [{ id: 'dev.maka.base' }],
+      configuration: {
+        properties: {
+          policy: { type: 'string', default: 'strict' },
+          apiToken: { type: 'string', secret: true },
+        },
+        required: [],
+      },
+      runtime: {
+        source:
+          'export default { scan: async () => ({ issues: 1 }), observe: async () => undefined, sum: async ({ left, right }) => ({ total: left + right }), aroundTool: async (input, _context, next) => next(input) };\n',
+        tools: [
+          {
+            name: 'codebase_scan',
+            description: 'Scan the selected codebase.',
+            handler: 'scan',
+            inputSchema: { type: 'object', additionalProperties: false },
+            visualization: { stateKey: 'scan.result' },
+          },
+        ],
+        events: [
+          {
+            name: 'dev.maka.codebase-studio.scan.completed',
+            description: 'A scan completed.',
+            payloadSchema: {
+              type: 'object',
+              properties: { issues: { type: 'number' } },
+              required: ['issues'],
+              additionalProperties: false,
+            },
+          },
+        ],
+        listeners: [
+          {
+            id: 'safe-write',
+            event: 'maka.tools.execute',
+            handler: 'aroundTool',
+            priority: 100,
+          },
+          {
+            id: 'observe-scan',
+            event: 'dev.maka.codebase-studio.scan.completed',
+            handler: 'observe',
+          },
+        ],
+        services: [
+          {
+            name: 'dev.maka.codebase-studio.math',
+            version: '1',
+            methods: [
+              {
+                name: 'sum',
+                description: 'Add two numbers.',
+                handler: 'sum',
+                inputSchema: {
+                  type: 'object',
+                  properties: { left: { type: 'number' }, right: { type: 'number' } },
+                  required: ['left', 'right'],
+                  additionalProperties: false,
+                },
+                outputSchema: {
+                  type: 'object',
+                  properties: { total: { type: 'number' } },
+                  required: ['total'],
+                  additionalProperties: false,
+                },
+              },
+            ],
+          },
+        ],
+        permissions: { workspace: 'read', network: false },
+      },
+      ui: {
+        contributions: [
+          {
+            id: 'studio-panel',
+            surface: 'app.slot',
+            slot: 'settings.content',
+            priority: 10,
+            document: '<!doctype html><title>Codebase Studio</title>',
+          },
+        ],
+        permissions: { network: false, hostState: true, sessionAccess: false },
+      },
+    })) as {
+      extensionId: string;
+      toolNames: string[];
+      uiContributionIds: string[];
+      eventContributionIds: string[];
+      serviceContributionIds?: string[];
+    };
+
+    assert.equal(result.extensionId, 'dev.maka.codebase-studio');
+    assert.deepEqual(result.toolNames, ['codebase_scan']);
+    assert.deepEqual(result.uiContributionIds, ['studio-panel']);
+    assert.deepEqual(result.eventContributionIds, [
+      'event:dev.maka.codebase-studio.scan.completed',
+      'listener:dev.maka.codebase-studio.scan.completed:observe-scan',
+      'listener:maka.tools.execute:safe-write',
+    ]);
+    assert.deepEqual(result.serviceContributionIds, ['dev.maka.codebase-studio.math']);
+    const installedPackages = await Promise.all([
+      toolStore.list(),
+      uiStore.list(),
+      eventStore.list(),
+    ]);
+    assert.deepEqual(
+      installedPackages.map((installed) =>
+        installed.some(({ extensionId }) => extensionId === result.extensionId),
+      ),
+      [true, true, true],
+    );
+
+    const inspected = (await call(management.tools(), 'inspect_package', {})) as {
+      contracts: {
+        packages: Array<{
+          extensionId: string;
+          dependencies: Array<{ id: string }>;
+          configuration: {
+            properties: Record<string, { secret: boolean; default?: unknown }>;
+            required: string[];
+          };
+          contributions: Array<{ kind: string; id: string }>;
+        }>;
+      };
+    };
+    const contract = inspected.contracts.packages.find(
+      ({ extensionId }) => extensionId === result.extensionId,
+    );
+    assert.ok(contract);
+    assert.deepEqual(contract.dependencies, [{ id: 'dev.maka.base' }]);
+    assert.deepEqual(contract.configuration.properties, {
+      apiToken: { type: 'string', secret: true },
+      policy: { type: 'string', default: 'strict', secret: false },
+    });
+    assert.deepEqual(contract.configuration.required, []);
+    assert.deepEqual(
+      contract.contributions.map(({ kind, id }) => ({ kind, id })),
+      [
+        { kind: 'tool', id: 'codebase_scan' },
+        { kind: 'ui', id: 'studio-panel' },
+        { kind: 'event', id: 'dev.maka.codebase-studio.scan.completed' },
+        { kind: 'listener', id: 'observe-scan' },
+        { kind: 'listener', id: 'safe-write' },
+        { kind: 'service', id: 'dev.maka.codebase-studio.math' },
+      ],
+    );
+
+    const activated = (await call(management.tools(), 'manage_package', {
+      action: 'activate',
+      extensionId: result.extensionId,
+    })) as { entries: Array<{ entryId: string; scopeId: string; generation: number }> };
+    assert.deepEqual(
+      activated.entries.map(({ scopeId }) => scopeId),
+      ['session-package-test', 'desktop-ui'],
+    );
+    assert.ok(
+      runtime
+        .inspectTools('session-package-test')
+        .some(({ extensionId }) => extensionId === result.extensionId),
+    );
+    assert.ok(
+      runtime
+        .inspectEvents('session-package-test')
+        .some(({ extensionId }) => extensionId === result.extensionId),
+    );
+    assert.ok(
+      runtime.inspectUi('desktop-ui').some(({ extensionId }) => extensionId === result.extensionId),
+    );
+    assert.deepEqual(
+      await call(management.tools(), 'invoke_tool', { toolName: 'codebase_scan', args: {} }),
+      { issues: 1 },
+    );
+    assert.deepEqual(
+      await call(management.tools(), 'call_service', {
+        service: 'dev.maka.codebase-studio.math',
+        method: 'sum',
+        input: { left: 20, right: 22 },
+      }),
+      { total: 42 },
+    );
+    const emitted = (await call(management.tools(), 'emit_event', {
+      event: 'dev.maka.codebase-studio.scan.completed',
+      payload: { issues: 1 },
+    })) as { listenerCount: number; delivered: number };
+    assert.equal(emitted.listenerCount, 1);
+    assert.equal(emitted.delivered, 1);
+    assert.deepEqual(
+      await call(management.tools(), 'publish_ui_state', {
+        extensionId: result.extensionId,
+        key: 'manual.result',
+        value: { accepted: true },
+      }),
+      {
+        extensionId: result.extensionId,
+        key: 'manual.result',
+        published: true,
+      },
+    );
+    const desktopEntry = activated.entries.find(({ scopeId }) => scopeId === 'desktop-ui');
+    assert.ok(desktopEntry);
+    assert.deepEqual(
+      await controller.handlers['extension.ui.state.query'](
+        {
+          scopeId: 'desktop-ui',
+          entryId: desktopEntry.entryId,
+          extensionId: result.extensionId,
+          generation: desktopEntry.generation,
+          key: 'scan.result',
+        },
+        connection,
+      ),
+      { ok: true, result: { found: true, value: { issues: 1 } } },
+    );
+    assert.deepEqual(
+      await controller.handlers['extension.ui.state.query'](
+        {
+          scopeId: 'desktop-ui',
+          entryId: desktopEntry.entryId,
+          extensionId: result.extensionId,
+          generation: desktopEntry.generation,
+          key: 'manual.result',
+        },
+        connection,
+      ),
+      { ok: true, result: { found: true, value: { accepted: true } } },
+    );
+    await call(management.tools(), 'manage_package', {
+      action: 'stop',
+      extensionId: result.extensionId,
+    });
+    assert.equal(
+      runtime
+        .inspectTools('session-package-test')
+        .some(({ extensionId }) => extensionId === result.extensionId),
+      false,
+    );
+    assert.equal(
+      runtime.inspectUi('desktop-ui').some(({ extensionId }) => extensionId === result.extensionId),
+      false,
+    );
+    assert.equal(
+      runtime
+        .inspectEvents('session-package-test')
+        .some(({ extensionId }) => extensionId === result.extensionId),
+      false,
+    );
+  } finally {
+    await runtime.close().catch(() => undefined);
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('define_package rejects secret defaults before writing an Extension', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-define-package-secret-'));
+  const runtime = new HostExtensionRuntime();
+  const toolStore = new PluginPackageStore(root);
+  const loader = new InstalledPluginPackageLoader(
+    new StaticTrustedToolExtensionLoader(),
+    toolStore,
+  );
+  const controller = new HostExtensionController(
+    runtime,
+    loader,
+    new HostPluginCompositionStore(root),
+    () => undefined,
+  );
+  try {
+    const define = requireTool(
+      new HostExtensionPackageManagementTools(root, controller).tools(),
+      'define_package',
+    );
+    assert.throws(
+      () =>
+        (define.parameters as z.ZodType).parse({
+          id: 'dev.maka.invalid-secret',
+          configuration: {
+            properties: {
+              apiToken: { type: 'string', secret: true, default: 'must-not-leak' },
+            },
+          },
+          tool: {
+            source: 'export default { run: async () => ({ ok: true }) };',
+            tools: [
+              {
+                name: 'run',
+                description: 'run',
+                handler: 'run',
+                inputSchema: { type: 'object' },
+              },
+            ],
+            permissions: { workspace: 'none', network: false },
+          },
+        }),
+      /secret configuration must not declare a default value/u,
+    );
+    assert.deepEqual(await toolStore.list(), []);
+  } finally {
+    await runtime.close().catch(() => undefined);
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+async function call(tools: readonly MakaTool[], name: string, input: unknown): Promise<unknown> {
+  const tool = requireTool(tools, name);
+  const parsed = (tool.parameters as z.ZodType).parse(input);
+  return await tool.impl(parsed, context());
+}
+
+function requireTool(tools: readonly MakaTool[], name: string): MakaTool {
+  const tool = tools.find((candidate) => candidate.name === name);
+  assert.ok(tool, `missing Tool ${name}`);
+  return tool;
+}
+
+function context(): MakaToolContext {
+  return {
+    sessionId: 'session-package-test',
+    turnId: 'turn-package-test',
+    cwd: tmpdir(),
+    toolCallId: 'call-package-test',
+    abortSignal: new AbortController().signal,
+    emitOutput: () => undefined,
+  };
+}
diff --git a/packages/runtime-host/src/__tests__/extension-package-platform.system.test.ts b/packages/runtime-host/src/__tests__/extension-package-platform.system.test.ts
new file mode 100644
index 0000000000..3ec3271c27
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/extension-package-platform.system.test.ts
@@ -0,0 +1,317 @@
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import type { MakaToolContext } from '@maka/runtime/tool-runtime';
+import { HostExtensionController } from '../server/extension-controller.js';
+import {
+  InstalledPluginPackageLoader,
+  StaticTrustedToolExtensionLoader,
+} from '../server/extension-loader.js';
+import { HostExtensionRuntime, PROFILE_EXTENSION_SCOPE } from '../server/extension-runtime.js';
+import { HostPluginCompositionStore } from '../server/plugin-composition-store.js';
+import {} from '../server/extension-package-manifest.js';
+import { PluginPackageStore } from '../server/plugin-package-store.js';
+
+test('unified Extension package resolves dependencies, configures workers, survives restart, and round-trips a Bundle', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-extension-platform-'));
+  const control = join(root, 'control');
+  const dependencySource = join(root, 'dependency');
+  const applicationSource = join(root, 'application');
+  const bundle = join(root, 'application.maka-extension');
+  let fixture: ReturnType<typeof createFixture> | undefined;
+  try {
+    await writeToolPackage(dependencySource, {
+      id: 'dev.maka.platform.dependency',
+      toolName: 'dependency_ping',
+      handler: 'ping',
+      source: 'export default { ping: () => ({ pong: true }) };\n',
+      metadata: {},
+    });
+    await writeToolPackage(applicationSource, {
+      id: 'dev.maka.platform.application',
+      toolName: 'configured_echo',
+      handler: 'echo',
+      source: 'export default { echo: (_args, context) => context.configuration };\n',
+      metadata: {
+        displayName: 'Configured Application',
+        description: 'Exercises the unified package contract.',
+        dependencies: [{ id: 'dev.maka.platform.dependency' }],
+        configuration: {
+          properties: {
+            endpoint: { type: 'string', default: 'https://default.invalid' },
+            apiKey: { type: 'string', default: 'initial-secret', secret: true },
+          },
+          required: ['endpoint', 'apiKey'],
+        },
+      },
+    });
+
+    fixture = createFixture(control);
+    const dependency = await fixture.loader.installPackage(dependencySource);
+    const application = await fixture.loader.installPackage(applicationSource);
+    await fixture.controller.recover();
+    const enabled = await fixture.controller.handlers['extension.composition.mutate'](
+      {
+        kind: 'enable',
+        entryId: 'application-profile',
+        scopeId: PROFILE_EXTENSION_SCOPE,
+        extensionId: application.extensionId,
+      },
+      connection,
+    );
+    assert.equal(enabled.ok, true);
+    const catalog = await fixture.controller.handlers['extension.composition.query'](
+      {},
+      connection,
+    );
+    assert.ok(catalog.ok);
+    assert.equal(catalog.ok && catalog.result.entries.length, 2);
+    assert.ok(
+      catalog.ok &&
+        catalog.result.entries.some(
+          (entry) => entry.extensionId === dependency.extensionId && entry.status === 'active',
+        ),
+    );
+    const dependencyEntry = catalog.ok
+      ? catalog.result.entries.find((entry) => entry.extensionId === 'dev.maka.platform.dependency')
+      : undefined;
+    assert.ok(dependencyEntry);
+    const protectedDependency = await fixture.controller.handlers['extension.composition.mutate'](
+      { kind: 'disable', entryId: dependencyEntry.entryId },
+      connection,
+    );
+    assert.equal(protectedDependency.ok, false);
+    assert.match(
+      protectedDependency.ok ? '' : protectedDependency.error.message,
+      /required by application-profile/u,
+    );
+    assert.deepEqual(
+      fixture.runtime.composition('session-test').entries.map(({ packageId }) => packageId),
+      ['dev.maka.platform.application', 'dev.maka.platform.dependency'],
+    );
+
+    const contracts = await fixture.controller.handlers['extension.contract.query']({}, connection);
+    assert.ok(contracts.ok);
+    const contract = contracts.ok
+      ? contracts.result.packages.find(
+          (item) => item.extensionId === 'dev.maka.platform.application',
+        )
+      : undefined;
+    assert.equal(contract?.displayName, 'Configured Application');
+    assert.deepEqual(contract?.dependencies, [{ id: 'dev.maka.platform.dependency' }]);
+    assert.deepEqual(
+      contract?.contributions.map(({ kind, id }) => ({ kind, id })),
+      [{ kind: 'tool', id: 'configured_echo' }],
+    );
+
+    const initial = await fixture.controller.handlers['extension.configuration.query'](
+      { entryId: 'application-profile' },
+      connection,
+    );
+    assert.deepEqual(initial, {
+      ok: true,
+      result: { configuration: { endpoint: 'https://default.invalid' } },
+    });
+    assert.deepEqual(await invoke(fixture.runtime, 'configured_echo'), {
+      endpoint: 'https://default.invalid',
+      apiKey: 'initial-secret',
+    });
+
+    const configured = await fixture.controller.handlers['extension.configuration.mutate'](
+      {
+        entryId: 'application-profile',
+        configuration: { endpoint: 'https://api.example', apiKey: 'rotated-secret' },
+      },
+      connection,
+    );
+    assert.deepEqual(configured, {
+      ok: true,
+      result: { configuration: { endpoint: 'https://api.example' } },
+    });
+    assert.deepEqual(await invoke(fixture.runtime, 'configured_echo'), {
+      endpoint: 'https://api.example',
+      apiKey: 'rotated-secret',
+    });
+
+    const exported = await fixture.controller.handlers['extension.package.export'](
+      {
+        extensionId: application.extensionId,
+        targetPath: bundle,
+      },
+      connection,
+    );
+    assert.deepEqual(exported, { ok: true, result: { targetPath: bundle } });
+
+    await fixture.runtime.close();
+    fixture = createFixture(control);
+    await fixture.controller.recover();
+    assert.deepEqual(await invoke(fixture.runtime, 'configured_echo'), {
+      endpoint: 'https://api.example',
+      apiKey: 'rotated-secret',
+    });
+
+    const disabled = await fixture.controller.handlers['extension.composition.mutate'](
+      { kind: 'disable', entryId: 'application-profile' },
+      connection,
+    );
+    assert.equal(disabled.ok, true);
+    const disabledCatalog = await fixture.controller.handlers['extension.composition.query'](
+      {},
+      connection,
+    );
+    assert.ok(disabledCatalog.ok);
+    assert.deepEqual(
+      disabledCatalog.ok
+        ? disabledCatalog.result.entries.map(({ extensionId, enabled }) => ({
+            extensionId,
+            enabled,
+          }))
+        : [],
+      [{ extensionId: 'dev.maka.platform.application', enabled: false }],
+    );
+
+    const importedControl = join(root, 'imported-control');
+    const imported = createFixture(importedControl);
+    try {
+      const roundTripped = await imported.loader.installPackage(bundle);
+      assert.equal(roundTripped.extensionId, application.extensionId);
+      assert.equal(roundTripped.extensionId, application.extensionId);
+      const importedContracts = await imported.loader.contracts();
+      assert.equal(importedContracts[0]?.displayName, 'Configured Application');
+    } finally {
+      await imported.runtime.close();
+    }
+  } finally {
+    await fixture?.runtime.close().catch(() => undefined);
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+function createFixture(control: string) {
+  const runtime = new HostExtensionRuntime();
+  const loader = new InstalledPluginPackageLoader(
+    new StaticTrustedToolExtensionLoader(),
+    new PluginPackageStore(control),
+  );
+  const controller = new HostExtensionController(
+    runtime,
+    loader,
+    new HostPluginCompositionStore(control),
+    () => undefined,
+  );
+  return { runtime, loader, controller };
+}
+
+async function invoke(runtime: HostExtensionRuntime, name: string): Promise<unknown> {
+  const tool = runtime
+    .resolveTools('session-test', [])
+    .find((candidate) => candidate.name === name);
+  assert.ok(tool);
+  const context: MakaToolContext = {
+    sessionId: 'session-test',
+    turnId: 'turn-test',
+    cwd: tmpdir(),
+    toolCallId: 'call-test',
+    abortSignal: new AbortController().signal,
+    emitOutput: () => undefined,
+  };
+  return tool.impl({}, context);
+}
+
+async function writeToolPackage(
+  root: string,
+  input: {
+    id: string;
+    toolName: string;
+    handler: string;
+    source: string;
+    metadata: Record<string, unknown>;
+  },
+): Promise<void> {
+  await mkdir(join(root, 'dist'), { recursive: true });
+  await writeFile(
+    join(root, 'maka.extension.json'),
+    JSON.stringify({
+      schemaVersion: 1,
+      id: input.id,
+      ...input.metadata,
+      runtime: {
+        entry: 'dist/index.mjs',
+        tools: [
+          {
+            name: input.toolName,
+            description: input.toolName,
+            handler: input.handler,
+            inputSchema: { type: 'object', additionalProperties: false },
+          },
+        ],
+        events: [],
+        listeners: [],
+        services: [],
+        timers: [],
+        permissions: { workspace: 'none', network: false },
+      },
+    }),
+  );
+  await writeFile(join(root, 'dist', 'index.mjs'), input.source);
+}
+
+const connection = {
+  hostEpoch: 'test',
+  connectionId: 'test',
+  surface: 'activation' as const,
+  principal: 'runtime_host' as const,
+  acquireResidency: () => ({ release: () => undefined }),
+};
+
+test('combined package installation rolls back a newly installed Tool when UI persistence fails', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-extension-atomic-install-'));
+  const source = join(root, 'source');
+  const control = join(root, 'control');
+  try {
+    await writeToolPackage(source, {
+      id: 'dev.maka.platform.combined',
+      toolName: 'combined_ping',
+      handler: 'ping',
+      source: 'export default { ping: () => ({ pong: true }) };\n',
+      metadata: {
+        ui: {
+          contributions: [
+            {
+              id: 'combined-root',
+              surface: 'app.root',
+              priority: 0,
+              document: 'documents/root.html',
+            },
+          ],
+          permissions: { network: false },
+        },
+      },
+    });
+    await mkdir(join(source, 'documents'), { recursive: true });
+    await writeFile(
+      join(source, 'documents', 'root.html'),
+      '<!doctype html><title>Combined</title>',
+    );
+    const toolStore = new RejectingPluginPackageStore(control);
+    const loader = new InstalledPluginPackageLoader(
+      new StaticTrustedToolExtensionLoader(),
+      toolStore,
+    );
+    await assert.rejects(
+      () => loader.installPackage(source),
+      /Extension package operation failed/u,
+    );
+    assert.deepEqual(await new PluginPackageStore(control).list(), []);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+class RejectingPluginPackageStore extends PluginPackageStore {
+  override async install(): Promise<never> {
+    throw new Error('simulated UI persistence failure');
+  }
+}
diff --git a/packages/runtime-host/src/__tests__/extension-protocol.test.ts b/packages/runtime-host/src/__tests__/extension-protocol.test.ts
new file mode 100644
index 0000000000..d5c2853e96
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/extension-protocol.test.ts
@@ -0,0 +1,282 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import {
+  decodeExtensionCompositionMutateInput,
+  decodeExtensionCompositionQueryResult,
+  decodeExtensionContractQueryResult,
+  decodeExtensionConfigurationMutateInput,
+  decodeExtensionPackageExportInput,
+  decodeExtensionUiRpcInvokeInput,
+  decodeExtensionUiSnapshotResult,
+  decodeToolPackageInstallInput,
+  decodeToolPackageUninstallInput,
+} from '../protocol/extension.js';
+import { operationAllowsRemoteOwner } from '../protocol/operations.js';
+
+test('Extension control protocol strictly decodes catalog and lifecycle mutations', () => {
+  assert.deepEqual(
+    decodeExtensionCompositionMutateInput({
+      kind: 'enable',
+      entryId: 'weather-entry',
+      scopeId: 'session:1',
+      extensionId: 'dev.maka.weather',
+    }),
+    {
+      kind: 'enable',
+      entryId: 'weather-entry',
+      scopeId: 'session:1',
+      extensionId: 'dev.maka.weather',
+    },
+  );
+  assert.deepEqual(
+    decodeExtensionContractQueryResult({
+      packages: [
+        {
+          extensionId: 'dev.maka.weather',
+          displayName: 'Weather',
+          description: '',
+          dependencies: [{ id: 'dev.maka.http' }],
+          configuration: {
+            properties: {
+              apiKey: { type: 'string', secret: true },
+            },
+            required: ['apiKey'],
+          },
+          contributions: [
+            { kind: 'ui', id: 'root', surface: 'app.root', slots: ['weather.details'] },
+            { kind: 'hook', id: 'policy', event: 'PreToolUse', mode: 'gate' },
+            {
+              kind: 'event',
+              id: 'dev.maka.weather.changed',
+              event: 'dev.maka.weather.changed',
+              description: 'Weather changed.',
+            },
+            {
+              kind: 'listener',
+              id: 'refresh',
+              event: 'dev.maka.weather.changed',
+            },
+          ],
+        },
+      ],
+    }).packages[0]?.contributions[0]?.slots,
+    ['weather.details'],
+  );
+  assert.equal(
+    decodeExtensionContractQueryResult({
+      packages: [
+        {
+          extensionId: 'dev.maka.policy',
+          displayName: 'Policy',
+          description: '',
+          dependencies: [],
+          configuration: { properties: {}, required: [] },
+          contributions: [{ kind: 'hook', id: 'policy', event: 'PreToolUse', mode: 'gate' }],
+        },
+      ],
+    }).packages[0]?.contributions[0]?.event,
+    'PreToolUse',
+  );
+  assert.equal(
+    decodeExtensionContractQueryResult({
+      packages: [
+        {
+          extensionId: 'dev.maka.events',
+          displayName: 'Events',
+          description: '',
+          dependencies: [],
+          configuration: { properties: {}, required: [] },
+          contributions: [
+            {
+              kind: 'listener',
+              id: 'observe',
+              event: 'dev.maka.events.changed',
+            },
+          ],
+        },
+      ],
+    }).packages[0]?.contributions[0]?.event,
+    'dev.maka.events.changed',
+  );
+  assert.deepEqual(
+    decodeExtensionConfigurationMutateInput({
+      entryId: 'weather-entry',
+      configuration: { apiKey: 'secret', retries: 3 },
+    }),
+    { entryId: 'weather-entry', configuration: { apiKey: 'secret', retries: 3 } },
+  );
+  assert.deepEqual(
+    decodeExtensionPackageExportInput({
+      extensionId: 'dev.maka.weather',
+      targetPath: '/tmp/weather.maka-extension',
+    }),
+    {
+      extensionId: 'dev.maka.weather',
+      targetPath: '/tmp/weather.maka-extension',
+    },
+  );
+  assert.deepEqual(
+    decodeExtensionUiRpcInvokeInput({
+      scopeId: 'desktop-ui',
+      entryId: 'ui-entry',
+      extensionId: 'dev.maka.appearance',
+      generation: 2,
+      method: 'lookup',
+      args: { query: 'Maka' },
+    }),
+    {
+      scopeId: 'desktop-ui',
+      entryId: 'ui-entry',
+      extensionId: 'dev.maka.appearance',
+      generation: 2,
+      method: 'lookup',
+      args: { query: 'Maka' },
+    },
+  );
+  assert.deepEqual(
+    decodeExtensionUiSnapshotResult({
+      scopeId: 'desktop-ui',
+      digest: 'sha256-demo',
+      contributions: [
+        {
+          entryId: 'ui-entry',
+          extensionId: 'dev.maka.appearance',
+          generation: 2,
+          id: 'root',
+          surface: 'app.root',
+          priority: 100,
+          document: '<main>Maka</main>',
+          documentSha256: 'demo',
+          network: false,
+          sessionAccess: true,
+        },
+        {
+          entryId: 'legacy-overlay-entry',
+          extensionId: 'dev.maka.legacy-overlay',
+          generation: 1,
+          id: 'legacy-overlay',
+          surface: 'app.overlay',
+          priority: 10,
+          document: '<aside>Legacy</aside>',
+          documentSha256: 'legacy-demo',
+          network: false,
+        },
+      ],
+    }),
+    {
+      scopeId: 'desktop-ui',
+      digest: 'sha256-demo',
+      contributions: [
+        {
+          entryId: 'ui-entry',
+          extensionId: 'dev.maka.appearance',
+          generation: 2,
+          id: 'root',
+          surface: 'app.root',
+          priority: 100,
+          document: '<main>Maka</main>',
+          documentSha256: 'demo',
+          network: false,
+          sessionAccess: true,
+        },
+        {
+          entryId: 'legacy-overlay-entry',
+          extensionId: 'dev.maka.legacy-overlay',
+          generation: 1,
+          id: 'legacy-overlay',
+          surface: 'app.overlay',
+          priority: 10,
+          document: '<aside>Legacy</aside>',
+          documentSha256: 'legacy-demo',
+          network: false,
+        },
+      ],
+    },
+  );
+  assert.deepEqual(
+    decodeExtensionCompositionQueryResult({
+      extensions: [
+        {
+          extensionId: 'dev.maka.weather',
+          toolNames: ['Weather'],
+          uiContributionIds: [],
+          eventContributionIds: [],
+        },
+      ],
+      entries: [
+        {
+          entryId: 'weather-entry',
+          scopeId: 'session:1',
+          extensionId: 'dev.maka.weather',
+          generation: 2,
+          enabled: true,
+          status: 'active',
+          error: null,
+        },
+      ],
+    }),
+    {
+      extensions: [
+        {
+          extensionId: 'dev.maka.weather',
+          toolNames: ['Weather'],
+          uiContributionIds: [],
+          eventContributionIds: [],
+        },
+      ],
+      entries: [
+        {
+          entryId: 'weather-entry',
+          scopeId: 'session:1',
+          extensionId: 'dev.maka.weather',
+          generation: 2,
+          enabled: true,
+          status: 'active',
+          error: null,
+        },
+      ],
+    },
+  );
+
+  assert.throws(
+    () =>
+      decodeExtensionCompositionMutateInput({
+        kind: 'enable',
+        entryId: 'weather-entry',
+        scopeId: 'session-1',
+        extensionId: 'weather',
+        modulePath: '/tmp/untrusted.mjs',
+      }),
+    /Unknown extension enable input field/,
+  );
+  assert.throws(
+    () =>
+      decodeExtensionCompositionMutateInput({
+        kind: 'reload',
+        entryId: 'weather-entry',
+        extra: true,
+      }),
+    /Unknown extension reload input field/,
+  );
+  assert.deepEqual(decodeToolPackageInstallInput({ sourcePath: '/tmp/weather-tool' }), {
+    sourcePath: '/tmp/weather-tool',
+  });
+  assert.deepEqual(
+    decodeToolPackageUninstallInput({
+      extensionId: 'weather',
+    }),
+    { extensionId: 'weather' },
+  );
+  assert.throws(
+    () => decodeToolPackageInstallInput({ sourcePath: '/tmp/weather-tool', source: 'inline' }),
+    /Unknown Tool package install input field/u,
+  );
+  assert.equal(operationAllowsRemoteOwner('extension.composition.query'), false);
+  assert.equal(operationAllowsRemoteOwner('extension.composition.mutate'), false);
+  assert.equal(operationAllowsRemoteOwner('extension.ui.snapshot'), false);
+  assert.equal(operationAllowsRemoteOwner('extension.ui.rpc.invoke'), false);
+  assert.equal(operationAllowsRemoteOwner('extension.package.install'), false);
+  assert.equal(operationAllowsRemoteOwner('extension.package.uninstall'), false);
+  assert.equal(operationAllowsRemoteOwner('extension.package.export'), false);
+  assert.equal(operationAllowsRemoteOwner('extension.configuration.mutate'), false);
+});
diff --git a/packages/runtime-host/src/__tests__/extension-ui-state-store.test.ts b/packages/runtime-host/src/__tests__/extension-ui-state-store.test.ts
new file mode 100644
index 0000000000..7e8efeba00
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/extension-ui-state-store.test.ts
@@ -0,0 +1,36 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import { HostExtensionUiStateStore } from '../server/extension-ui-state-store.js';
+
+test('UI state is isolated by Entry identity and survives restart', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-extension-ui-state-'));
+  try {
+    const first = new HostExtensionUiStateStore(root);
+    await first.set('desktop-ui', 'entry-a', 'status', 'ready-a');
+    await first.set('desktop-ui', 'entry-b', 'status', 'ready-b');
+    assert.deepEqual(await first.get('desktop-ui', 'entry-a', 'status'), {
+      found: true,
+      value: 'ready-a',
+    });
+    assert.deepEqual(await first.get('desktop-ui', 'entry-b', 'status'), {
+      found: true,
+      value: 'ready-b',
+    });
+
+    const restarted = new HostExtensionUiStateStore(root);
+    assert.deepEqual(await restarted.get('desktop-ui', 'entry-a', 'status'), {
+      found: true,
+      value: 'ready-a',
+    });
+    await restarted.clear('desktop-ui', 'entry-a');
+    assert.deepEqual(await restarted.get('desktop-ui', 'entry-b', 'status'), {
+      found: true,
+      value: 'ready-b',
+    });
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
diff --git a/packages/runtime-host/src/__tests__/host-hook-composition.test.ts b/packages/runtime-host/src/__tests__/host-hook-composition.test.ts
new file mode 100644
index 0000000000..c16fdc1af4
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/host-hook-composition.test.ts
@@ -0,0 +1,260 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, it } from 'node:test';
+import { createExternalExecutionBoundary } from '@maka/core/sandbox-boundary';
+import type { PreToolUseHookInput } from '@maka/core/hooks';
+import type { SessionEvent } from '@maka/core/events';
+import type { RuntimeEvent } from '@maka/core/runtime-event';
+import type { SessionHeader } from '@maka/core/session';
+import {
+  createHookConfigStore,
+  createHookTrustStore,
+  createSqliteRuntimeStore,
+} from '@maka/storage';
+import { ToolRuntime, type MakaTool } from '@maka/runtime/tool-runtime';
+import { createHostHookComposition, hashHookDefinition } from '../server/host-hook-composition.js';
+
+describe('Host Hook composition', () => {
+  it('invalidates exact-definition trust on the next Turn after an execution change', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'maka-host-hooks-'));
+    const events: RuntimeEvent[] = [];
+    try {
+      const config = createHookConfigStore(root);
+      const trust = createHookTrustStore(root);
+      const firstArgs = ['-e', 'process.stderr.write("denied");process.exit(2)'];
+      await config.set({
+        version: 1,
+        hooks: {
+          PreToolUse: [
+            {
+              matcher: 'Bash',
+              hooks: [
+                {
+                  id: 'policy',
+                  type: 'command',
+                  command: process.execPath,
+                  args: firstArgs,
+                  timeoutMs: 1_000,
+                },
+              ],
+            },
+          ],
+        },
+      });
+      const hash = hashHookDefinition({
+        source: 'user',
+        projectIdentity: 'user',
+        matcher: 'Bash',
+        command: process.execPath,
+        args: firstArgs,
+        timeoutMs: 1_000,
+      });
+      await trust.trust({
+        definitionHash: hash,
+        source: 'user',
+        projectIdentity: 'user',
+        trustedAt: Date.now(),
+      });
+      const composition = createHostHookComposition({
+        stateRoot: root,
+        runtimeEvents: {
+          appendRuntimeEvent: async (_sessionId, _runId, event) => {
+            events.push(event);
+          },
+        },
+      });
+      const dispatcher = composition.dispatcherFor(header(root));
+      const first = await dispatcher.runPreToolUse(
+        hookInput('turn-1', 'run-1', root),
+        new AbortController().signal,
+        { invocationId: 'invocation-1' },
+      );
+      assert.equal(first.denied, true);
+      assert.equal(first.audits[0]?.definitionHash, hash);
+      assert.equal(events[0]?.actions?.hookCompleted?.status, 'denied');
+
+      await config.set({
+        version: 1,
+        hooks: {
+          PreToolUse: [
+            {
+              matcher: 'Bash',
+              hooks: [
+                {
+                  id: 'policy',
+                  type: 'command',
+                  command: process.execPath,
+                  args: ['-e', 'process.exit(0)'],
+                  timeoutMs: 1_000,
+                },
+              ],
+            },
+          ],
+        },
+      });
+      const second = await dispatcher.runPreToolUse(
+        hookInput('turn-2', 'run-2', root),
+        new AbortController().signal,
+        { invocationId: 'invocation-2' },
+      );
+      assert.equal(second.denied, false);
+      assert.equal(second.audits[0]?.status, 'skipped_untrusted');
+      assert.notEqual(second.audits[0]?.definitionHash, hash);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('denies a real configured and trusted command before ToolRuntime T1 and side effects', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'maka-host-hook-e2e-'));
+    const runtimeStore = createSqliteRuntimeStore(join(root, 'runtime.sqlite'));
+    try {
+      const args = [
+        '-e',
+        `let s='';process.stdin.on('data',c=>s+=c);process.stdin.on('end',()=>{const x=JSON.parse(s);if(x.schema_version===1&&x.tool_name==='Bash'&&x.tool_input.command==='git push'){process.stderr.write('push blocked by fixture');process.exit(2)}process.exit(9)})`,
+      ];
+      const config = createHookConfigStore(root);
+      await config.set({
+        version: 1,
+        hooks: {
+          PreToolUse: [
+            {
+              matcher: 'Bash',
+              hooks: [
+                {
+                  id: 'push-policy',
+                  type: 'command',
+                  command: process.execPath,
+                  args,
+                  timeoutMs: 1_000,
+                },
+              ],
+            },
+          ],
+        },
+      });
+      const definitionHash = hashHookDefinition({
+        source: 'user',
+        projectIdentity: 'user',
+        matcher: 'Bash',
+        command: process.execPath,
+        args,
+        timeoutMs: 1_000,
+      });
+      await createHookTrustStore(root).trust({
+        definitionHash,
+        source: 'user',
+        projectIdentity: 'user',
+        trustedAt: Date.now(),
+      });
+
+      const sessionHeader = header(root);
+      const dispatcher = createHostHookComposition({
+        stateRoot: root,
+        runtimeEvents: runtimeStore,
+      }).dispatcherFor(sessionHeader);
+      let implementationCalls = 0;
+      let id = 0;
+      let now = 0;
+      const runtime = new ToolRuntime({
+        sessionId: 'session-1',
+        header: sessionHeader,
+        connection: {
+          slug: 'connection-1',
+          providerType: 'openai',
+          defaultModel: 'model-1',
+        },
+        modelId: 'model-1',
+        appendMessage: async () => {},
+        readExecutionBoundary: async () => createExternalExecutionBoundary(),
+        newId: () => `id-${++id}`,
+        now: () => ++now,
+        getPermissionPauseTarget: () => null,
+        turnId: 'turn-1',
+        runId: 'run-1',
+        invocationId: 'invocation-1',
+        runtimeCommitSink: runtimeStore,
+        preToolUseHooks: dispatcher,
+      });
+      const tool: MakaTool<{ command: string }, string> = {
+        name: 'Bash',
+        description: 'fixture',
+        parameters: { type: 'object' },
+        impl: async () => {
+          implementationCalls += 1;
+          return 'should not run';
+        },
+      };
+      const sessionEvents: SessionEvent[] = [];
+      const settlement = await runtime.settleToolCall({
+        tool,
+        turnId: 'turn-1',
+        toolCallId: 'provider-call-1',
+        input: { command: 'git push' },
+        abortSignal: new AbortController().signal,
+        eventSink: {
+          push: (event) => sessionEvents.push(event),
+          pushAndWaitUntilConsumed: async (event) => {
+            sessionEvents.push(event);
+          },
+        },
+      });
+
+      assert.equal(implementationCalls, 0);
+      assert.match(JSON.stringify(settlement.result), /push blocked by fixture/u);
+      const toolStart = sessionEvents.find((event) => event.type === 'tool_start');
+      assert.ok(toolStart && toolStart.type === 'tool_start');
+      assert.equal(toolStart.operationId, undefined);
+      assert.equal(sessionEvents.filter((event) => event.type === 'tool_result').length, 1);
+
+      const runtimeEvents = await runtimeStore.readImmutableRuntimeEvents('session-1', 'run-1');
+      assert.equal(runtimeEvents.length, 1);
+      assert.equal(runtimeEvents[0]?.actions?.hookCompleted?.status, 'denied');
+      assert.equal(runtimeEvents[0]?.actions?.hookCompleted?.definitionHash, definitionHash);
+      assert.equal(runtimeEvents[0]?.content, undefined);
+    } finally {
+      runtimeStore.close();
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+function hookInput(turnId: string, runId: string, cwd: string): PreToolUseHookInput {
+  return {
+    schema_version: 1,
+    hook_event_name: 'PreToolUse',
+    session_id: 'session-1',
+    turn_id: turnId,
+    run_id: runId,
+    tool_use_id: `tool-${turnId}`,
+    tool_name: 'Bash',
+    tool_input: { command: 'git push' },
+    cwd,
+    permission_mode: 'ask',
+    origin: 'provider',
+  };
+}
+
+function header(root: string): SessionHeader {
+  return {
+    id: 'session-1',
+    workspaceRoot: root,
+    cwd: root,
+    projectId: null,
+    createdAt: 1,
+    lastUsedAt: 1,
+    name: 'Hook test',
+    titleIsManual: false,
+    isFlagged: false,
+    labels: [],
+    isArchived: false,
+    status: 'active',
+    permissionMode: 'ask',
+    collaborationMode: 'agent',
+    connectionId: 'connection-1',
+    modelId: 'model-1',
+    thinkingLevel: 'medium',
+  } as unknown as SessionHeader;
+}
diff --git a/packages/runtime-host/src/__tests__/plugin-runtime.test.ts b/packages/runtime-host/src/__tests__/plugin-runtime.test.ts
new file mode 100644
index 0000000000..b78b7c5d64
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/plugin-runtime.test.ts
@@ -0,0 +1,148 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { z } from 'zod';
+import { HostExtensionRuntime } from '../server/extension-runtime.js';
+
+test('one Cordis package owns Tool, UI, and Hook contributions together', async () => {
+  const runtime = new HostExtensionRuntime();
+  const observed: unknown[] = [];
+  await runtime.installTool({
+    extensionId: 'fixture.combined',
+    toolNames: ['fixture_combined'],
+    ui: [
+      {
+        id: 'fixture-root',
+        surface: 'app.root',
+        slots: ['fixture.detail'],
+        priority: 10,
+        document: '<!doctype html><title>fixture</title>',
+        network: false,
+      },
+      {
+        id: 'fixture-detail',
+        surface: 'app.slot',
+        slot: 'fixture.detail',
+        priority: 10,
+        document: '<!doctype html><title>detail</title>',
+        network: false,
+      },
+    ],
+    eventContributionIds: ['fixture.combined.changed', 'capture'],
+    load: async () => ({
+      tools: [
+        {
+          name: 'fixture_combined',
+          description: 'fixture',
+          parameters: z.object({ value: z.number() }),
+          impl: async ({ value }: { value: number }) => value + 1,
+        },
+      ],
+      events: [
+        {
+          name: 'fixture.combined.changed',
+          description: 'fixture changed',
+          payloadSchema: {
+            type: 'object',
+            properties: { value: { type: 'number' } },
+            required: ['value'],
+          },
+        },
+      ],
+      listeners: [
+        {
+          id: 'capture',
+          event: 'fixture.combined.changed',
+          handler: 'capture',
+          priority: 0,
+          timeoutMs: 1_000,
+          invoke: async (payload: unknown) => {
+            observed.push(payload);
+          },
+        },
+      ],
+    }),
+  });
+  await runtime.applyComposition({
+    operations: [
+      {
+        type: 'insert',
+        rootId: 'session:session-one',
+        entry: { id: 'combined-entry', packageId: 'fixture.combined' },
+      },
+    ],
+  });
+  assert.equal(runtime.inspectTools('session-one').length, 1);
+  assert.equal(runtime.inspectUi('session-one').length, 2);
+  assert.equal(runtime.inspectEvents('session-one').length, 1);
+  assert.equal(runtime.inspectEventListeners('session-one').length, 1);
+  await runtime.emitEvent(
+    'session-one',
+    'fixture.combined.changed',
+    { value: 3 },
+    invocationContext(),
+  );
+  assert.deepEqual(observed, [{ value: 3 }]);
+  await runtime.applyComposition({
+    operations: [{ type: 'update', entryId: 'combined-entry', patch: { disabled: true } }],
+  });
+  assert.equal(runtime.inspectTools('session-one').length, 0);
+  assert.equal(runtime.inspectUi('session-one').length, 0);
+  assert.equal(runtime.inspectEventListeners('session-one').length, 0);
+  await runtime.applyComposition({
+    operations: [{ type: 'update', entryId: 'combined-entry', patch: { disabled: false } }],
+  });
+  assert.equal(runtime.inspectTools('session-one').length, 1);
+  assert.equal(runtime.inspectUi('session-one').length, 2);
+  assert.equal(runtime.inspectEventListeners('session-one').length, 1);
+  await runtime.close();
+});
+
+test('failed package reload leaves the current Fiber visible', async () => {
+  const runtime = new HostExtensionRuntime();
+  await runtime.installTrustedTool({
+    extensionId: 'fixture.atomic',
+    tools: [
+      {
+        name: 'fixture_atomic',
+        description: 'current',
+        parameters: z.object({}),
+        impl: async () => 'current',
+      },
+    ],
+  });
+  await runtime.applyComposition({
+    operations: [
+      {
+        type: 'insert',
+        rootId: 'profile',
+        entry: { id: 'atomic-entry', packageId: 'fixture.atomic' },
+      },
+    ],
+  });
+  await assert.rejects(
+    () =>
+      runtime.installTrustedTool({
+        extensionId: 'fixture.atomic',
+        tools: [],
+        healthCheck: () => {
+          throw new Error('candidate rejected');
+        },
+      }),
+    /candidate rejected/u,
+  );
+  assert.equal(runtime.inspect('atomic-entry').current?.generation, 1);
+  assert.equal(runtime.inspectTools('profile')[0]?.generation, 1);
+  await runtime.close();
+});
+
+function invocationContext() {
+  return {
+    sessionId: 'session-one',
+    turnId: 'turn-one',
+    cwd: process.cwd(),
+    permissionMode: 'full_access',
+    origin: 'host' as const,
+    configuration: Object.freeze({}),
+    signal: new AbortController().signal,
+  };
+}
diff --git a/packages/runtime-host/src/__tests__/protocol.test.ts b/packages/runtime-host/src/__tests__/protocol.test.ts
index 80a5a4e2df..fca2da57be 100644
--- a/packages/runtime-host/src/__tests__/protocol.test.ts
+++ b/packages/runtime-host/src/__tests__/protocol.test.ts
@@ -41,7 +41,7 @@ import {
 
 describe('Runtime Host bootstrap protocol', () => {
   test('publishes a new compatibility epoch for legacy Automation provenance', () => {
-    assert.equal(RUNTIME_HOST_COMPATIBILITY_EPOCH, 20);
+    assert.equal(RUNTIME_HOST_COMPATIBILITY_EPOCH, 21);
   });
 
   test('selects the highest mutually supported protocol and rejects a gap', () => {
diff --git a/packages/runtime-host/src/__tests__/tool-package.system.test.ts b/packages/runtime-host/src/__tests__/tool-package.system.test.ts
new file mode 100644
index 0000000000..2311fbf0d4
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/tool-package.system.test.ts
@@ -0,0 +1,419 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import type { MakaTool } from '@maka/runtime/tool-runtime';
+import { HostExtensionController } from '../server/extension-controller.js';
+import {
+  InstalledPluginPackageLoader,
+  StaticTrustedToolExtensionLoader,
+} from '../server/extension-loader.js';
+import { HostExtensionRuntime } from '../server/extension-runtime.js';
+import { HostPluginCompositionStore } from '../server/plugin-composition-store.js';
+import { PluginPackageStore } from '../server/plugin-package-store.js';
+import { InProcessPackageActivation } from '../server/in-process-package-runtime.js';
+import type { ConnectionContext } from '../server/operation-dispatcher.js';
+
+const connection: ConnectionContext = {
+  hostEpoch: 'tool-package-system-test',
+  connectionId: 'local-owner',
+  surface: 'desktop',
+  principal: 'local_os_user',
+  acquireResidency: () => ({ release: () => undefined }),
+};
+
+test('real Tool package installs, runs in process, updates, drains, and uninstalls', {
+  timeout: 60_000,
+}, async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-tool-package-'));
+  const control = join(root, 'control');
+  const workspace = join(root, 'workspace');
+  await mkdir(workspace, { recursive: true });
+  const packageV1 = await createPackage(root, 'v1', 21);
+  const packageV2 = await createPackage(root, 'v2', 27);
+  const packageStore = new PluginPackageStore(control);
+  const loader = new InstalledPluginPackageLoader(
+    new StaticTrustedToolExtensionLoader(),
+    packageStore,
+  );
+  const runtime = new HostExtensionRuntime();
+  const controller = new HostExtensionController(
+    runtime,
+    loader,
+    new HostPluginCompositionStore(control),
+    () => assert.fail('deterministic Tool package failures must not drain the Host'),
+  );
+
+  try {
+    await controller.recover();
+    const installedV1 = await controller.handlers['extension.package.install'](
+      { sourcePath: packageV1 },
+      connection,
+    );
+    assert.equal(installedV1.ok, true);
+    assert.deepEqual(installedV1.ok && installedV1.result.toolNames, ['Weather']);
+
+    const enabled = await controller.handlers['extension.composition.mutate'](
+      {
+        kind: 'enable',
+        entryId: 'weather-entry',
+        scopeId: 'session-1',
+        extensionId: 'weather',
+      },
+      connection,
+    );
+    assert.equal(enabled.ok, true, JSON.stringify(enabled));
+    assert.equal(enabled.ok && enabled.result.entry?.status, 'active');
+    assert.deepEqual(await invoke(runtime, workspace, 'v1'), {
+      label: 'v1',
+      temperature: 21,
+      location: 'Shanghai',
+    });
+    assert.equal(await readFile(join(workspace, 'weather-v1.txt'), 'utf8'), 'Shanghai\n');
+
+    let startedSlow: (() => void) | undefined;
+    const slowStarted = new Promise<void>((resolve) => {
+      startedSlow = resolve;
+    });
+    const oldTool = runtime.resolveTools('session-1', []).find(({ name }) => name === 'Weather');
+    assert.ok(oldTool);
+    const oldInvocation = oldTool.impl(
+      { location: 'Ningbo', delayMs: 500 },
+      {
+        ...invocationContext(workspace),
+        toolCallId: 'slow-old-call',
+        emitOutput: () => startedSlow?.(),
+      },
+    );
+    await slowStarted;
+    const installedV2 = await controller.handlers['extension.package.install'](
+      { sourcePath: packageV2 },
+      connection,
+    );
+    assert.equal(installedV2.ok, true);
+    const firstGeneration = runtime.inspect('weather-entry').current?.generation ?? 0;
+    const upgradeTask = controller.handlers['extension.composition.mutate'](
+      { kind: 'reload', entryId: 'weather-entry' },
+      connection,
+    );
+    await waitForGeneration(runtime, firstGeneration);
+    assert.deepEqual(await invoke(runtime, workspace, 'v2-during-drain', 'v2'), {
+      label: 'v2',
+      temperature: 27,
+      location: 'Shanghai',
+    });
+    assert.deepEqual(await oldInvocation, {
+      label: 'v1',
+      temperature: 21,
+      location: 'Ningbo',
+    });
+    const upgraded = await upgradeTask;
+    assert.equal(upgraded.ok, true);
+    assert.deepEqual(await invoke(runtime, workspace, 'v2'), {
+      label: 'v2',
+      temperature: 27,
+      location: 'Shanghai',
+    });
+
+    const retained = await controller.handlers['extension.package.uninstall'](
+      { extensionId: 'weather' },
+      connection,
+    );
+    assert.equal(retained.ok, false);
+    assert.equal(!retained.ok && retained.error.code, 'operation_conflict');
+
+    assert.deepEqual(
+      await controller.handlers['extension.composition.mutate'](
+        { kind: 'remove', entryId: 'weather-entry' },
+        connection,
+      ),
+      { ok: true, result: { entry: null } },
+    );
+    assert.deepEqual(
+      await controller.handlers['extension.package.uninstall'](
+        { extensionId: 'weather' },
+        connection,
+      ),
+      { ok: true, result: {} },
+    );
+    assert.deepEqual(await packageStore.list(), []);
+    assert.deepEqual(await controller.handlers['extension.composition.query']({}, connection), {
+      ok: true,
+      result: { extensions: [], entries: [] },
+    });
+  } finally {
+    await runtime.close().catch(() => undefined);
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('Tool package install rejects traversal, unknown fields, and missing entries', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-tool-package-invalid-'));
+  const source = join(root, 'source');
+  const store = new PluginPackageStore(join(root, 'control'));
+  try {
+    await mkdir(source, { recursive: true });
+    await writeFile(
+      join(source, 'maka.extension.json'),
+      JSON.stringify({
+        schemaVersion: 1,
+        id: 'invalid',
+        runtime: {
+          entry: '../escape.mjs',
+          tools: [toolManifest()],
+          events: [],
+          listeners: [],
+          services: [],
+          timers: [],
+          permissions: { workspace: 'none', network: false },
+        },
+      }),
+    );
+    await assert.rejects(store.install(source), /entry is invalid/u);
+
+    await writeFile(
+      join(source, 'maka.extension.json'),
+      JSON.stringify({
+        schemaVersion: 1,
+        id: 'invalid',
+        runtime: {
+          entry: 'dist/missing.mjs',
+          tools: [toolManifest()],
+          events: [],
+          listeners: [],
+          services: [],
+          timers: [],
+          permissions: { workspace: 'none', network: false },
+          unexpected: true,
+        },
+      }),
+    );
+    await assert.rejects(store.install(source), /unknown fields/u);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('Tool package Store resolves the current Extension directory', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-tool-package-corrupt-'));
+  const source = await createPackage(root, 'sealed', 42);
+  const store = new PluginPackageStore(join(root, 'control'));
+  try {
+    const installed = await store.install(source);
+    assert.ok(installed.toolManifest);
+    await writeFile(
+      join(installed.root, installed.toolManifest.entry),
+      'export default {};\n',
+      'utf8',
+    );
+    assert.equal((await store.load(installed.extensionId)).extensionId, installed.extensionId);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('trusted Tool activation shares in-process state, host network, and cancellation', {
+  timeout: 30_000,
+}, async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-tool-in-process-'));
+  const source = join(root, 'source');
+  const store = new PluginPackageStore(join(root, 'control'));
+  let networkRequests = 0;
+  const server = createServer((_request, response) => {
+    networkRequests += 1;
+    response.end('trusted-host-network');
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      server.off('error', reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  assert.ok(address && typeof address === 'object');
+  try {
+    process.env.MAKA_TEST_PLUGIN_SECRET = 'visible-to-trusted-plugin';
+    await createTrustedPackage(source, `http://127.0.0.1:${address.port}/allowed`);
+    const sealed = await store.install(source);
+    const installed = await store.loadTool(sealed.extensionId);
+    const activation = new InProcessPackageActivation(installed);
+    try {
+      await activation.healthCheck(installed.manifest.tools.map(({ handler }) => handler));
+      const tools = new Map(activation.tools().map((tool) => [tool.name, tool]));
+      const context = invocationContext(root);
+
+      assert.deepEqual(await tools.get('Identity')?.impl({}, context), {
+        pid: process.pid,
+        secret: 'visible-to-trusted-plugin',
+      });
+      assert.deepEqual(await tools.get('Counter')?.impl({}, context), { value: 1 });
+      assert.deepEqual(await tools.get('Counter')?.impl({}, context), { value: 2 });
+      assert.deepEqual(await tools.get('Network')?.impl({}, context), {
+        body: 'trusted-host-network',
+      });
+      assert.equal(networkRequests, 1);
+
+      const abort = new AbortController();
+      const hanging = tools.get('Hang')?.impl({}, { ...context, abortSignal: abort.signal });
+      setTimeout(() => abort.abort(new Error('test abort')), 50).unref();
+      await assert.rejects(async () => await hanging, /test abort|aborted/u);
+    } finally {
+      await activation.dispose();
+    }
+  } finally {
+    delete process.env.MAKA_TEST_PLUGIN_SECRET;
+    await new Promise<void>((resolve, reject) =>
+      server.close((error) => (error ? reject(error) : resolve())),
+    );
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+async function createPackage(root: string, label: string, temperature: number): Promise<string> {
+  const source = join(root, `source-${label}`);
+  await mkdir(join(source, 'dist'), { recursive: true });
+  await writeFile(
+    join(source, 'maka.extension.json'),
+    `${JSON.stringify(
+      {
+        schemaVersion: 1,
+        id: 'weather',
+        runtime: {
+          entry: 'dist/index.mjs',
+          tools: [toolManifest()],
+          events: [],
+          listeners: [],
+          services: [],
+          timers: [],
+          permissions: { workspace: 'write', network: false },
+        },
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  await writeFile(
+    join(source, 'dist', 'index.mjs'),
+    `import { appendFile } from 'node:fs/promises';
+import { join } from 'node:path';
+export default {
+  Weather: async (args, context) => {
+    context.emitOutput('stdout', 'weather:${label}');
+    if (args.delayMs) await new Promise((resolve) => setTimeout(resolve, args.delayMs));
+    await appendFile(join(context.cwd, 'weather-${label}.txt'), args.location + '\\n', 'utf8');
+    return { label: ${JSON.stringify(label)}, temperature: ${temperature}, location: args.location };
+  },
+};
+`,
+  );
+  return source;
+}
+
+function toolManifest(): Record<string, unknown> {
+  return {
+    name: 'Weather',
+    description: 'Read the test weather',
+    handler: 'Weather',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        location: { type: 'string' },
+        delayMs: { type: 'number', minimum: 0, maximum: 10_000 },
+      },
+      required: ['location'],
+      additionalProperties: false,
+    },
+    displayName: 'Weather',
+    category: 'file_write',
+    recoveryMode: 'never_auto_retry',
+  };
+}
+
+async function createTrustedPackage(source: string, allowedUrl: string): Promise<void> {
+  await mkdir(join(source, 'dist'), { recursive: true });
+  const declaration = (name: string): Record<string, unknown> => ({
+    name,
+    description: `Exercise ${name}`,
+    handler: name,
+    inputSchema: { type: 'object', additionalProperties: true },
+    category: 'shell_unsafe',
+    recoveryMode: 'never_auto_retry',
+  });
+  await writeFile(
+    join(source, 'maka.extension.json'),
+    JSON.stringify({
+      schemaVersion: 1,
+      id: 'trusted-runtime',
+      runtime: {
+        entry: 'dist/index.mjs',
+        tools: ['Identity', 'Counter', 'Network', 'Hang'].map(declaration),
+        events: [],
+        listeners: [],
+        services: [],
+        timers: [],
+        permissions: { workspace: 'none', network: true },
+      },
+    }),
+  );
+  await writeFile(
+    join(source, 'dist', 'index.mjs'),
+    `let calls = 0;
+export default {
+  Identity: () => ({ pid: process.pid, secret: process.env.MAKA_TEST_PLUGIN_SECRET }),
+  Counter: () => ({ value: ++calls }),
+  Network: async () => ({ body: await (await fetch(${JSON.stringify(allowedUrl)})).text() }),
+  Hang: async (_args, context) => await new Promise((_resolve, reject) => context.abortSignal.addEventListener('abort', () => reject(context.abortSignal.reason), { once: true })),
+};
+`,
+  );
+}
+
+function invocationContext(cwd: string): Parameters<MakaTool['impl']>[1] {
+  return {
+    sessionId: 'fault-session',
+    turnId: 'fault-turn',
+    cwd,
+    toolCallId: 'fault-call',
+    abortSignal: new AbortController().signal,
+    emitOutput: () => undefined,
+    askUserQuestion: async () => ({ answers: [] }),
+  };
+}
+
+async function waitForGeneration(runtime: HostExtensionRuntime, previous: number): Promise<void> {
+  const deadline = Date.now() + 5_000;
+  while (Date.now() < deadline) {
+    if ((runtime.inspect('weather-entry').current?.generation ?? 0) > previous) return;
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+  assert.fail(`Tool Fiber generation did not advance beyond ${previous}`);
+}
+
+async function invoke(
+  runtime: HostExtensionRuntime,
+  workspace: string,
+  label: string,
+  expectedRevisionLabel = label,
+): Promise<unknown> {
+  const tool = runtime.resolveTools('session-1', []).find(({ name }) => name === 'Weather');
+  assert.ok(tool);
+  const output: string[] = [];
+  const result = await tool.impl(
+    { location: 'Shanghai' },
+    {
+      sessionId: 'session-1',
+      runId: `run-${label}`,
+      turnId: `turn-${label}`,
+      cwd: workspace,
+      toolCallId: `call-${label}`,
+      abortSignal: new AbortController().signal,
+      emitOutput: (_stream, chunk) => output.push(chunk),
+      askUserQuestion: async () => ({ answers: [] }),
+    },
+  );
+  assert.deepEqual(output, [`weather:${expectedRevisionLabel}`]);
+  return result;
+}
diff --git a/packages/runtime-host/src/protocol/extension.ts b/packages/runtime-host/src/protocol/extension.ts
new file mode 100644
index 0000000000..a6d5276885
--- /dev/null
+++ b/packages/runtime-host/src/protocol/extension.ts
@@ -0,0 +1,1121 @@
+import { isCanonicalExtensionId, isCanonicalExtensionScopeId } from '@maka/runtime/plugin-runtime';
+import {
+  requireEncodedByteLimit,
+  requireEntityId,
+  requireExactRecord,
+  requireRecord,
+  requireUtf8String,
+} from './codec.js';
+import { invalidProtocolFrame } from './errors.js';
+import { defineHostPathOperation, defineOperation } from './operation-spec.js';
+
+export const EXTENSION_COMPOSITION_MAX_EXTENSIONS = 256;
+export const EXTENSION_COMPOSITION_MAX_ENTRIES = 256;
+export const EXTENSION_COMPOSITION_RESULT_MAX_BYTES = 96 * 1024;
+export const EXTENSION_ERROR_MAX_BYTES = 4 * 1024;
+export const EXTENSION_UI_OFFICIAL_SLOTS = Object.freeze([
+  'sidebar.footer',
+  'conversation.header',
+  'settings.content',
+] as const);
+
+const QUERY_ERRORS = [
+  'host_not_ready',
+  'host_draining',
+  'operation_unavailable',
+  'persistence_failed',
+  'internal_failure',
+] as const;
+const MUTATION_ERRORS = [
+  'host_not_ready',
+  'host_draining',
+  'operation_unavailable',
+  'not_found',
+  'operation_conflict',
+  'invalid_request',
+  'persistence_failed',
+  'commit_outcome_unknown',
+  'internal_failure',
+] as const;
+
+export interface TrustedExtensionProjection {
+  readonly extensionId: string;
+  readonly toolNames: readonly string[];
+  readonly uiContributionIds: readonly string[];
+  readonly eventContributionIds: readonly string[];
+  readonly serviceContributionIds?: readonly string[];
+  readonly timerContributionIds?: readonly string[];
+}
+
+export type ExtensionCompositionEntryStatus = 'disabled' | 'active' | 'waiting' | 'failed';
+
+export interface ExtensionCompositionEntryProjection {
+  readonly entryId: string;
+  readonly scopeId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+  readonly enabled: boolean;
+  readonly status: ExtensionCompositionEntryStatus;
+  readonly error: string | null;
+}
+
+export interface ExtensionCompositionQueryInput {}
+
+export interface ExtensionCompositionQueryResult {
+  readonly extensions: readonly TrustedExtensionProjection[];
+  readonly entries: readonly ExtensionCompositionEntryProjection[];
+}
+
+export type ExtensionConfigurationScalar = string | number | boolean;
+
+export interface ExtensionContractDependency {
+  readonly id: string;
+}
+
+export interface ExtensionContractConfigurationProperty {
+  readonly type: 'string' | 'number' | 'boolean';
+  readonly title?: string;
+  readonly description?: string;
+  readonly default?: ExtensionConfigurationScalar;
+  readonly enum?: readonly ExtensionConfigurationScalar[];
+  readonly secret: boolean;
+}
+
+export interface ExtensionContractContribution {
+  readonly kind: 'tool' | 'ui' | 'hook' | 'event' | 'listener' | 'service' | 'timer';
+  readonly id: string;
+  readonly name?: string;
+  readonly description?: string;
+  readonly surface?: 'app.root' | 'app.overlay' | 'app.slot';
+  readonly slot?: string;
+  readonly slots?: readonly string[];
+  readonly event?: string;
+  readonly mode?:
+    | 'emit'
+    | 'parallel'
+    | 'serial'
+    | 'bail'
+    | 'observe'
+    | 'gate'
+    | 'transform'
+    | 'around';
+}
+
+export interface ExtensionPackageContractProjection {
+  readonly extensionId: string;
+  readonly displayName: string;
+  readonly description: string;
+  readonly dependencies: readonly ExtensionContractDependency[];
+  readonly configuration: {
+    readonly properties: Readonly<Record<string, ExtensionContractConfigurationProperty>>;
+    readonly required: readonly string[];
+  };
+  readonly contributions: readonly ExtensionContractContribution[];
+}
+
+export interface ExtensionContractQueryInput {}
+
+export interface ExtensionContractQueryResult {
+  readonly packages: readonly ExtensionPackageContractProjection[];
+}
+
+export interface ExtensionConfigurationQueryInput {
+  readonly entryId: string;
+}
+
+export interface ExtensionConfigurationQueryResult {
+  readonly configuration: Readonly<Record<string, ExtensionConfigurationScalar>>;
+}
+
+export interface ExtensionConfigurationMutateInput extends ExtensionConfigurationQueryInput {
+  readonly configuration: Readonly<Record<string, ExtensionConfigurationScalar>>;
+}
+
+export type ExtensionConfigurationMutateResult = ExtensionConfigurationQueryResult;
+
+export interface ExtensionUiSnapshotInput {
+  readonly scopeId: string;
+}
+
+export interface ExtensionUiContributionProjection {
+  readonly entryId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+  readonly id: string;
+  readonly surface: 'app.root' | 'app.overlay' | 'app.slot';
+  readonly slot?: string;
+  readonly slots?: readonly string[];
+  readonly priority: number;
+  readonly document: string;
+  readonly documentSha256: string;
+  readonly network: boolean;
+  readonly hostState?: boolean;
+  readonly hostMethods?: readonly string[];
+  readonly sessionAccess?: boolean;
+}
+
+export interface ExtensionUiSnapshotResult {
+  readonly scopeId: string;
+  readonly digest: string;
+  readonly contributions: readonly ExtensionUiContributionProjection[];
+}
+
+export type ExtensionUiStateValue =
+  | null
+  | boolean
+  | number
+  | string
+  | readonly ExtensionUiStateValue[]
+  | { readonly [key: string]: ExtensionUiStateValue };
+
+export interface ExtensionUiStateQueryInput {
+  readonly scopeId: string;
+  readonly entryId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+  readonly key: string;
+}
+
+export interface ExtensionUiStateQueryResult {
+  readonly found: boolean;
+  readonly value: ExtensionUiStateValue | null;
+}
+
+export type ExtensionUiStateMutateInput = ExtensionUiStateQueryInput &
+  ({ readonly kind: 'set'; readonly value: ExtensionUiStateValue } | { readonly kind: 'delete' });
+
+export interface ExtensionUiStateMutateResult {
+  readonly changed: boolean;
+}
+
+export interface ExtensionUiRpcInvokeInput {
+  readonly scopeId: string;
+  readonly entryId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+  readonly method: string;
+  readonly args: ExtensionUiStateValue;
+}
+
+export interface ExtensionUiRpcInvokeResult {
+  readonly value: ExtensionUiStateValue;
+}
+
+export type ExtensionCompositionMutateInput =
+  | {
+      readonly kind: 'enable';
+      readonly entryId: string;
+      readonly scopeId: string;
+      readonly extensionId: string;
+    }
+  | { readonly kind: 'disable'; readonly entryId: string }
+  | { readonly kind: 'reload'; readonly entryId: string }
+  | { readonly kind: 'remove'; readonly entryId: string };
+
+export interface ExtensionCompositionMutateResult {
+  readonly entry: ExtensionCompositionEntryProjection | null;
+}
+
+export interface ToolPackageInstallInput {
+  readonly sourcePath: string;
+}
+
+export type ToolPackageInstallResult = TrustedExtensionProjection;
+
+export interface ToolPackageUninstallInput {
+  readonly extensionId: string;
+}
+
+export interface ToolPackageUninstallResult {}
+
+export interface ExtensionPackageExportInput {
+  readonly extensionId: string;
+  readonly targetPath: string;
+}
+
+export interface ExtensionPackageExportResult {
+  readonly targetPath: string;
+}
+
+export const EXTENSION_OPERATION_SPECS = {
+  'extension.composition.query': defineOperation<
+    ExtensionCompositionQueryInput,
+    ExtensionCompositionQueryResult,
+    (typeof QUERY_ERRORS)[number]
+  >({
+    mode: 'query',
+    availability: 'ready',
+    errors: QUERY_ERRORS,
+    decodeInput: decodeExtensionCompositionQueryInput,
+    decodeOutput: decodeExtensionCompositionQueryResult,
+  }),
+  'extension.composition.mutate': defineOperation<
+    ExtensionCompositionMutateInput,
+    ExtensionCompositionMutateResult,
+    (typeof MUTATION_ERRORS)[number]
+  >({
+    mode: 'command',
+    availability: 'ready',
+    errors: MUTATION_ERRORS,
+    decodeInput: decodeExtensionCompositionMutateInput,
+    decodeOutput: decodeExtensionCompositionMutateResult,
+  }),
+  'extension.contract.query': defineOperation<
+    ExtensionContractQueryInput,
+    ExtensionContractQueryResult,
+    (typeof QUERY_ERRORS)[number]
+  >({
+    mode: 'query',
+    availability: 'ready',
+    errors: QUERY_ERRORS,
+    decodeInput: decodeExtensionContractQueryInput,
+    decodeOutput: decodeExtensionContractQueryResult,
+  }),
+  'extension.configuration.query': defineOperation<
+    ExtensionConfigurationQueryInput,
+    ExtensionConfigurationQueryResult,
+    (typeof MUTATION_ERRORS)[number]
+  >({
+    mode: 'query',
+    availability: 'ready',
+    errors: MUTATION_ERRORS,
+    decodeInput: decodeExtensionConfigurationQueryInput,
+    decodeOutput: decodeExtensionConfigurationQueryResult,
+  }),
+  'extension.configuration.mutate': defineOperation<
+    ExtensionConfigurationMutateInput,
+    ExtensionConfigurationMutateResult,
+    (typeof MUTATION_ERRORS)[number]
+  >({
+    mode: 'command',
+    availability: 'ready',
+    errors: MUTATION_ERRORS,
+    decodeInput: decodeExtensionConfigurationMutateInput,
+    decodeOutput: decodeExtensionConfigurationQueryResult,
+  }),
+  'extension.ui.snapshot': defineOperation<
+    ExtensionUiSnapshotInput,
+    ExtensionUiSnapshotResult,
+    (typeof QUERY_ERRORS)[number]
+  >({
+    mode: 'query',
+    availability: 'ready',
+    errors: QUERY_ERRORS,
+    decodeInput: decodeExtensionUiSnapshotInput,
+    decodeOutput: decodeExtensionUiSnapshotResult,
+  }),
+  'extension.ui.state.query': defineOperation<
+    ExtensionUiStateQueryInput,
+    ExtensionUiStateQueryResult,
+    (typeof MUTATION_ERRORS)[number]
+  >({
+    mode: 'query',
+    availability: 'ready',
+    errors: MUTATION_ERRORS,
+    decodeInput: decodeExtensionUiStateQueryInput,
+    decodeOutput: decodeExtensionUiStateQueryResult,
+  }),
+  'extension.ui.state.mutate': defineOperation<
+    ExtensionUiStateMutateInput,
+    ExtensionUiStateMutateResult,
+    (typeof MUTATION_ERRORS)[number]
+  >({
+    mode: 'command',
+    availability: 'ready',
+    errors: MUTATION_ERRORS,
+    decodeInput: decodeExtensionUiStateMutateInput,
+    decodeOutput: decodeExtensionUiStateMutateResult,
+  }),
+  'extension.ui.rpc.invoke': defineOperation<
+    ExtensionUiRpcInvokeInput,
+    ExtensionUiRpcInvokeResult,
+    (typeof MUTATION_ERRORS)[number]
+  >({
+    mode: 'command',
+    availability: 'ready',
+    errors: MUTATION_ERRORS,
+    decodeInput: decodeExtensionUiRpcInvokeInput,
+    decodeOutput: decodeExtensionUiRpcInvokeResult,
+  }),
+  'extension.package.install': defineHostPathOperation<
+    ToolPackageInstallInput,
+    ToolPackageInstallResult,
+    (typeof MUTATION_ERRORS)[number]
+  >({
+    mode: 'command',
+    availability: 'ready',
+    errors: MUTATION_ERRORS,
+    decodeInput: decodeToolPackageInstallInput,
+    decodeOutput: decodeToolPackageInstallResult,
+  }),
+  'extension.package.uninstall': defineOperation<
+    ToolPackageUninstallInput,
+    ToolPackageUninstallResult,
+    (typeof MUTATION_ERRORS)[number]
+  >({
+    mode: 'command',
+    availability: 'ready',
+    errors: MUTATION_ERRORS,
+    decodeInput: decodeToolPackageUninstallInput,
+    decodeOutput: decodeToolPackageUninstallResult,
+  }),
+  'extension.package.export': defineHostPathOperation<
+    ExtensionPackageExportInput,
+    ExtensionPackageExportResult,
+    (typeof MUTATION_ERRORS)[number]
+  >({
+    mode: 'command',
+    availability: 'ready',
+    errors: MUTATION_ERRORS,
+    decodeInput: decodeExtensionPackageExportInput,
+    decodeOutput: decodeExtensionPackageExportResult,
+  }),
+} as const;
+
+export function decodeExtensionCompositionQueryInput(
+  value: unknown,
+): ExtensionCompositionQueryInput {
+  requireExactRecord(value, 'extension composition query input', []);
+  return {};
+}
+
+export function decodeExtensionContractQueryInput(value: unknown): ExtensionContractQueryInput {
+  requireExactRecord(value, 'extension contract query input', []);
+  return {};
+}
+
+export function decodeExtensionContractQueryResult(value: unknown): ExtensionContractQueryResult {
+  const result = requireExactRecord(value, 'extension contract query result', ['packages']);
+  if (
+    !Array.isArray(result.packages) ||
+    result.packages.length > EXTENSION_COMPOSITION_MAX_EXTENSIONS
+  ) {
+    throw invalidProtocolFrame('Invalid extension contract packages');
+  }
+  const decoded = { packages: result.packages.map(decodePackageContract) };
+  requireEncodedByteLimit(decoded, 'extension contract query result', 512 * 1024);
+  return decoded;
+}
+
+export function decodeExtensionConfigurationQueryInput(
+  value: unknown,
+): ExtensionConfigurationQueryInput {
+  const input = requireExactRecord(value, 'extension configuration query input', ['entryId']);
+  return { entryId: requireEntityId(input.entryId, 'extension entryId') };
+}
+
+export function decodeExtensionConfigurationQueryResult(
+  value: unknown,
+): ExtensionConfigurationQueryResult {
+  const result = requireExactRecord(value, 'extension configuration query result', [
+    'configuration',
+  ]);
+  return { configuration: decodeConfigurationValues(result.configuration) };
+}
+
+export function decodeExtensionConfigurationMutateInput(
+  value: unknown,
+): ExtensionConfigurationMutateInput {
+  const input = requireExactRecord(value, 'extension configuration mutation input', [
+    'entryId',
+    'configuration',
+  ]);
+  return {
+    entryId: requireEntityId(input.entryId, 'extension entryId'),
+    configuration: decodeConfigurationValues(input.configuration),
+  };
+}
+
+export function decodeExtensionUiSnapshotInput(value: unknown): ExtensionUiSnapshotInput {
+  const input = requireExactRecord(value, 'extension UI snapshot input', ['scopeId']);
+  return { scopeId: decodeExtensionScopeId(input.scopeId, 'extension UI scopeId') };
+}
+
+export function decodeExtensionUiSnapshotResult(value: unknown): ExtensionUiSnapshotResult {
+  const result = requireExactRecord(value, 'extension UI snapshot result', [
+    'scopeId',
+    'digest',
+    'contributions',
+  ]);
+  if (!Array.isArray(result.contributions) || result.contributions.length > 64) {
+    throw invalidProtocolFrame('Invalid extension UI contributions');
+  }
+  const decoded = {
+    scopeId: decodeExtensionScopeId(result.scopeId, 'extension UI scopeId'),
+    digest: requireUtf8String(result.digest, 'extension UI digest', 128),
+    contributions: result.contributions.map(decodeUiContributionProjection),
+  };
+  requireEncodedByteLimit(decoded, 'extension UI snapshot result', 2 * 1024 * 1024);
+  return decoded;
+}
+
+export function decodeExtensionUiStateQueryInput(value: unknown): ExtensionUiStateQueryInput {
+  const input = requireExactRecord(value, 'extension UI state query input', [
+    'scopeId',
+    'entryId',
+    'extensionId',
+    'generation',
+    'key',
+  ]);
+  return decodeUiStateIdentity(input);
+}
+
+export function decodeExtensionUiStateQueryResult(value: unknown): ExtensionUiStateQueryResult {
+  const result = requireExactRecord(value, 'extension UI state query result', ['found', 'value']);
+  const decoded = {
+    found: decodeBoolean(result.found, 'extension UI state found'),
+    value: decodeUiStateValue(result.value),
+  };
+  requireEncodedByteLimit(decoded, 'extension UI state query result', 72 * 1024);
+  return decoded;
+}
+
+export function decodeExtensionUiStateMutateInput(value: unknown): ExtensionUiStateMutateInput {
+  const record = requireRecord(value, 'extension UI state mutation input');
+  if (record.kind === 'set') {
+    const input = requireExactRecord(record, 'extension UI state set input', [
+      'scopeId',
+      'entryId',
+      'extensionId',
+      'generation',
+      'key',
+      'kind',
+      'value',
+    ]);
+    const decoded = {
+      ...decodeUiStateIdentity(input),
+      kind: 'set' as const,
+      value: decodeUiStateValue(input.value),
+    };
+    requireEncodedByteLimit(decoded, 'extension UI state mutation input', 72 * 1024);
+    return decoded;
+  }
+  if (record.kind === 'delete') {
+    const input = requireExactRecord(record, 'extension UI state delete input', [
+      'scopeId',
+      'entryId',
+      'extensionId',
+      'generation',
+      'key',
+      'kind',
+    ]);
+    return { ...decodeUiStateIdentity(input), kind: 'delete' };
+  }
+  throw invalidProtocolFrame('Invalid extension UI state mutation kind');
+}
+
+export function decodeExtensionUiStateMutateResult(value: unknown): ExtensionUiStateMutateResult {
+  const result = requireExactRecord(value, 'extension UI state mutation result', ['changed']);
+  return { changed: decodeBoolean(result.changed, 'extension UI state changed') };
+}
+
+export function decodeExtensionUiRpcInvokeInput(value: unknown): ExtensionUiRpcInvokeInput {
+  const input = requireExactRecord(value, 'extension UI RPC invoke input', [
+    'scopeId',
+    'entryId',
+    'extensionId',
+    'generation',
+    'method',
+    'args',
+  ]);
+  const decoded = {
+    scopeId: decodeExtensionScopeId(input.scopeId, 'extension UI scopeId'),
+    entryId: requireEntityId(input.entryId, 'extension entryId'),
+    extensionId: decodeExtensionId(input.extensionId),
+    generation: decodeGeneration(input.generation),
+    method: requireUtf8String(input.method, 'extension UI RPC method', 128),
+    args: decodeUiStateValue(input.args),
+  };
+  requireEncodedByteLimit(decoded, 'extension UI RPC invoke input', 512 * 1024);
+  return decoded;
+}
+
+export function decodeExtensionUiRpcInvokeResult(value: unknown): ExtensionUiRpcInvokeResult {
+  const result = requireExactRecord(value, 'extension UI RPC invoke result', ['value']);
+  const decoded = { value: decodeUiStateValue(result.value) };
+  requireEncodedByteLimit(decoded, 'extension UI RPC invoke result', 1024 * 1024);
+  return decoded;
+}
+
+export function decodeExtensionCompositionQueryResult(
+  value: unknown,
+): ExtensionCompositionQueryResult {
+  const result = requireExactRecord(value, 'extension composition query result', [
+    'extensions',
+    'entries',
+  ]);
+  if (
+    !Array.isArray(result.extensions) ||
+    result.extensions.length > EXTENSION_COMPOSITION_MAX_EXTENSIONS ||
+    !Array.isArray(result.entries) ||
+    result.entries.length > EXTENSION_COMPOSITION_MAX_ENTRIES
+  ) {
+    throw invalidProtocolFrame('Invalid extension composition result');
+  }
+  const decoded = {
+    extensions: result.extensions.map(decodeExtensionProjection),
+    entries: result.entries.map(decodeEntryProjection),
+  };
+  requireEncodedByteLimit(
+    decoded,
+    'extension composition result',
+    EXTENSION_COMPOSITION_RESULT_MAX_BYTES,
+  );
+  return decoded;
+}
+
+export function decodeExtensionCompositionMutateInput(
+  value: unknown,
+): ExtensionCompositionMutateInput {
+  const record = requireRecord(value, 'extension composition mutation input');
+  switch (record.kind) {
+    case 'enable': {
+      const input = requireExactRecord(record, 'extension enable input', [
+        'kind',
+        'entryId',
+        'scopeId',
+        'extensionId',
+      ]);
+      return {
+        kind: 'enable',
+        entryId: requireEntityId(input.entryId, 'extension entryId'),
+        scopeId: decodeExtensionScopeId(input.scopeId, 'extension scopeId'),
+        extensionId: decodeExtensionId(input.extensionId),
+      };
+    }
+    case 'disable':
+    case 'remove': {
+      const input = requireExactRecord(record, `extension ${record.kind} input`, [
+        'kind',
+        'entryId',
+      ]);
+      return {
+        kind: record.kind,
+        entryId: requireEntityId(input.entryId, 'extension entryId'),
+      };
+    }
+    case 'reload': {
+      const input = requireExactRecord(record, 'extension reload input', ['kind', 'entryId']);
+      return {
+        kind: 'reload',
+        entryId: requireEntityId(input.entryId, 'extension entryId'),
+      };
+    }
+    default:
+      throw invalidProtocolFrame('Invalid extension composition mutation kind');
+  }
+}
+
+export function decodeExtensionCompositionMutateResult(
+  value: unknown,
+): ExtensionCompositionMutateResult {
+  const result = requireExactRecord(value, 'extension composition mutation result', ['entry']);
+  return {
+    entry: result.entry === null ? null : decodeEntryProjection(result.entry),
+  };
+}
+
+export function decodeToolPackageInstallInput(value: unknown): ToolPackageInstallInput {
+  const input = requireExactRecord(value, 'Tool package install input', ['sourcePath']);
+  return { sourcePath: requireUtf8String(input.sourcePath, 'Tool package sourcePath', 16 * 1024) };
+}
+
+export function decodeToolPackageInstallResult(value: unknown): ToolPackageInstallResult {
+  return decodeExtensionProjection(value);
+}
+
+export function decodeToolPackageUninstallInput(value: unknown): ToolPackageUninstallInput {
+  const input = requireExactRecord(value, 'Tool package uninstall input', ['extensionId']);
+  return {
+    extensionId: decodeExtensionId(input.extensionId),
+  };
+}
+
+export function decodeToolPackageUninstallResult(value: unknown): ToolPackageUninstallResult {
+  requireExactRecord(value, 'Tool package uninstall result', []);
+  return {};
+}
+
+export function decodeExtensionPackageExportInput(value: unknown): ExtensionPackageExportInput {
+  const input = requireExactRecord(value, 'Extension package export input', [
+    'extensionId',
+    'targetPath',
+  ]);
+  return {
+    extensionId: decodeExtensionId(input.extensionId),
+    targetPath: requireUtf8String(input.targetPath, 'Extension package targetPath', 16 * 1024),
+  };
+}
+
+export function decodeExtensionPackageExportResult(value: unknown): ExtensionPackageExportResult {
+  const result = requireExactRecord(value, 'Extension package export result', ['targetPath']);
+  return {
+    targetPath: requireUtf8String(result.targetPath, 'Extension package targetPath', 16 * 1024),
+  };
+}
+
+function decodeExtensionProjection(value: unknown): TrustedExtensionProjection {
+  const source = requireRecord(value, 'trusted extension');
+  const extension = requireExactRecord(value, 'trusted extension', [
+    'extensionId',
+    'toolNames',
+    'uiContributionIds',
+    ...(Object.hasOwn(source, 'eventContributionIds') ? ['eventContributionIds'] : []),
+    ...(Object.hasOwn(source, 'serviceContributionIds') ? ['serviceContributionIds'] : []),
+    ...(Object.hasOwn(source, 'timerContributionIds') ? ['timerContributionIds'] : []),
+  ]);
+  const eventContributionIds = extension.eventContributionIds ?? [];
+  const serviceContributionIds = extension.serviceContributionIds ?? [];
+  const timerContributionIds = extension.timerContributionIds ?? [];
+  if (
+    !Array.isArray(extension.toolNames) ||
+    extension.toolNames.length > 128 ||
+    !Array.isArray(extension.uiContributionIds) ||
+    extension.uiContributionIds.length > 64 ||
+    !Array.isArray(eventContributionIds) ||
+    eventContributionIds.length > 128 ||
+    !Array.isArray(serviceContributionIds) ||
+    serviceContributionIds.length > 64 ||
+    !Array.isArray(timerContributionIds) ||
+    timerContributionIds.length > 64
+  ) {
+    throw invalidProtocolFrame('Invalid trusted extension contribution names');
+  }
+  return {
+    extensionId: decodeExtensionId(extension.extensionId),
+    toolNames: extension.toolNames.map((name) =>
+      requireUtf8String(name, 'extension tool name', 128),
+    ),
+    uiContributionIds: extension.uiContributionIds.map((id) =>
+      requireUtf8String(id, 'extension UI contribution id', 128),
+    ),
+    eventContributionIds: eventContributionIds.map((id) =>
+      requireUtf8String(id, 'extension Event contribution id', 512),
+    ),
+    ...(Object.hasOwn(source, 'serviceContributionIds')
+      ? {
+          serviceContributionIds: serviceContributionIds.map((id) =>
+            requireUtf8String(id, 'extension Service contribution id', 192),
+          ),
+        }
+      : {}),
+    ...(Object.hasOwn(source, 'timerContributionIds')
+      ? {
+          timerContributionIds: timerContributionIds.map((id) =>
+            requireUtf8String(id, 'extension Timer contribution id', 128),
+          ),
+        }
+      : {}),
+  };
+}
+
+function decodePackageContract(value: unknown): ExtensionPackageContractProjection {
+  const contract = requireExactRecord(value, 'Extension package contract', [
+    'extensionId',
+    'displayName',
+    'description',
+    'dependencies',
+    'configuration',
+    'contributions',
+  ]);
+  if (
+    !Array.isArray(contract.dependencies) ||
+    contract.dependencies.length > 64 ||
+    !Array.isArray(contract.contributions) ||
+    contract.contributions.length > 320
+  )
+    throw invalidProtocolFrame('Invalid Extension package contract collections');
+  const configuration = requireExactRecord(
+    contract.configuration,
+    'Extension configuration contract',
+    ['properties', 'required'],
+  );
+  const properties = requireRecord(configuration.properties, 'Extension configuration properties');
+  if (Object.keys(properties).length > 128 || !Array.isArray(configuration.required)) {
+    throw invalidProtocolFrame('Invalid Extension configuration contract');
+  }
+  const decodedProperties: Record<string, ExtensionContractConfigurationProperty> =
+    Object.fromEntries(
+      Object.entries(properties).map(([key, value]) => {
+        const propertySource = requireRecord(value, 'Extension configuration property');
+        const fields = [
+          'type',
+          'secret',
+          ...(Object.hasOwn(propertySource, 'title') ? ['title'] : []),
+          ...(Object.hasOwn(propertySource, 'description') ? ['description'] : []),
+          ...(Object.hasOwn(propertySource, 'default') ? ['default'] : []),
+          ...(Object.hasOwn(propertySource, 'enum') ? ['enum'] : []),
+        ];
+        const property = requireExactRecord(
+          propertySource,
+          'Extension configuration property',
+          fields,
+        );
+        if (
+          property.type !== 'string' &&
+          property.type !== 'number' &&
+          property.type !== 'boolean'
+        ) {
+          throw invalidProtocolFrame('Invalid Extension configuration property type');
+        }
+        const scalar = (candidate: unknown): ExtensionConfigurationScalar => {
+          if (
+            typeof candidate !== property.type ||
+            (typeof candidate === 'number' && !Number.isFinite(candidate))
+          )
+            throw invalidProtocolFrame('Invalid Extension configuration property value');
+          return candidate as ExtensionConfigurationScalar;
+        };
+        return [
+          requireUtf8String(key, 'Extension configuration property key', 128),
+          {
+            type: property.type,
+            ...(property.title === undefined
+              ? {}
+              : { title: requireUtf8String(property.title, 'Extension configuration title', 128) }),
+            ...(property.description === undefined
+              ? {}
+              : {
+                  description: requireUtf8String(
+                    property.description,
+                    'Extension configuration description',
+                    1024,
+                  ),
+                }),
+            ...(property.default === undefined ? {} : { default: scalar(property.default) }),
+            ...(property.enum === undefined
+              ? {}
+              : {
+                  enum:
+                    Array.isArray(property.enum) && property.enum.length <= 64
+                      ? property.enum.map(scalar)
+                      : (() => {
+                          throw invalidProtocolFrame('Invalid Extension configuration enum');
+                        })(),
+                }),
+            secret: decodeBoolean(property.secret, 'Extension configuration secret'),
+          } satisfies ExtensionContractConfigurationProperty,
+        ];
+      }),
+    );
+  const required = configuration.required.map((key) =>
+    requireUtf8String(key, 'Extension required configuration key', 128),
+  );
+  return {
+    extensionId: decodeExtensionId(contract.extensionId),
+    displayName: requireUtf8String(contract.displayName, 'Extension package displayName', 128),
+    description:
+      typeof contract.description === 'string' &&
+      Buffer.byteLength(contract.description, 'utf8') <= 4096
+        ? contract.description
+        : (() => {
+            throw invalidProtocolFrame('Invalid Extension package description');
+          })(),
+    dependencies: contract.dependencies.map((value) => {
+      const dependency = requireExactRecord(value, 'Extension dependency', ['id']);
+      return { id: decodeExtensionId(dependency.id) };
+    }),
+    configuration: { properties: decodedProperties, required },
+    contributions: contract.contributions.map(decodeContractContribution),
+  };
+}
+
+function decodeContractContribution(value: unknown): ExtensionContractContribution {
+  const source = requireRecord(value, 'Extension contract contribution');
+  const fields = [
+    'kind',
+    'id',
+    ...(Object.hasOwn(source, 'name') ? ['name'] : []),
+    ...(Object.hasOwn(source, 'description') ? ['description'] : []),
+    ...(Object.hasOwn(source, 'surface') ? ['surface'] : []),
+    ...(Object.hasOwn(source, 'slot') ? ['slot'] : []),
+    ...(Object.hasOwn(source, 'slots') ? ['slots'] : []),
+    ...(Object.hasOwn(source, 'event') ? ['event'] : []),
+    ...(Object.hasOwn(source, 'mode') ? ['mode'] : []),
+  ];
+  const contribution = requireExactRecord(source, 'Extension contract contribution', fields);
+  if (
+    contribution.kind !== 'tool' &&
+    contribution.kind !== 'ui' &&
+    contribution.kind !== 'hook' &&
+    contribution.kind !== 'event' &&
+    contribution.kind !== 'listener' &&
+    contribution.kind !== 'service' &&
+    contribution.kind !== 'timer'
+  ) {
+    throw invalidProtocolFrame('Invalid Extension contract contribution kind');
+  }
+  const isHookEvent =
+    contribution.event === 'UserPromptSubmit' ||
+    contribution.event === 'RunStart' ||
+    contribution.event === 'PreToolUse' ||
+    contribution.event === 'PostToolUse' ||
+    contribution.event === 'RunEnd';
+  const isPluginEvent =
+    typeof contribution.event === 'string' &&
+    /^[A-Za-z][A-Za-z0-9_-]*(?:\.[A-Za-z][A-Za-z0-9_-]*)+$/u.test(contribution.event) &&
+    Buffer.byteLength(contribution.event, 'utf8') <= 192;
+  const hookMode =
+    contribution.mode === 'observe' ||
+    contribution.mode === 'gate' ||
+    contribution.mode === 'transform';
+  const eventMode =
+    contribution.mode === 'emit' ||
+    contribution.mode === 'parallel' ||
+    contribution.mode === 'serial' ||
+    contribution.mode === 'bail' ||
+    hookMode;
+  if (contribution.mode !== undefined && !eventMode)
+    throw invalidProtocolFrame('Invalid Extension contract dispatch mode');
+  if (
+    (contribution.kind === 'hook' && (!isHookEvent || !hookMode)) ||
+    (contribution.kind === 'event' &&
+      (!isPluginEvent || (contribution.mode !== undefined && !eventMode))) ||
+    (contribution.kind === 'listener' && (!isPluginEvent || contribution.mode !== undefined)) ||
+    (contribution.kind !== 'hook' &&
+      contribution.kind !== 'event' &&
+      contribution.kind !== 'listener' &&
+      (contribution.event !== undefined || contribution.mode !== undefined))
+  ) {
+    throw invalidProtocolFrame('Invalid Extension contract Hook fields');
+  }
+  if (
+    contribution.surface !== undefined &&
+    contribution.surface !== 'app.root' &&
+    contribution.surface !== 'app.overlay' &&
+    contribution.surface !== 'app.slot'
+  )
+    throw invalidProtocolFrame('Invalid Extension contract UI surface');
+  if (
+    contribution.slots !== undefined &&
+    (!Array.isArray(contribution.slots) || contribution.slots.length > 32)
+  ) {
+    throw invalidProtocolFrame('Invalid Extension contract child slots');
+  }
+  return {
+    kind: contribution.kind,
+    id: requireUtf8String(contribution.id, 'Extension contribution id', 128),
+    ...(contribution.name === undefined
+      ? {}
+      : { name: requireUtf8String(contribution.name, 'Extension Tool name', 128) }),
+    ...(contribution.description === undefined
+      ? {}
+      : {
+          description: requireUtf8String(
+            contribution.description,
+            'Extension Tool description',
+            4096,
+          ),
+        }),
+    ...(contribution.surface === undefined ? {} : { surface: contribution.surface }),
+    ...(contribution.slot === undefined
+      ? {}
+      : { slot: requireUtf8String(contribution.slot, 'Extension UI slot', 128) }),
+    ...(contribution.slots === undefined
+      ? {}
+      : {
+          slots: contribution.slots.map((slot) =>
+            requireUtf8String(slot, 'Extension UI child slot', 128),
+          ),
+        }),
+    ...(contribution.event === undefined ? {} : { event: contribution.event as string }),
+    ...(contribution.mode === undefined
+      ? {}
+      : { mode: contribution.mode as ExtensionContractContribution['mode'] }),
+  };
+}
+
+function decodeConfigurationValues(
+  value: unknown,
+): Readonly<Record<string, ExtensionConfigurationScalar>> {
+  const source = requireRecord(value, 'Extension configuration values');
+  if (Object.keys(source).length > 128)
+    throw invalidProtocolFrame('Too many Extension configuration values');
+  const result: Record<string, ExtensionConfigurationScalar> = {};
+  for (const [key, configured] of Object.entries(source)) {
+    if (
+      !/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u.test(key) ||
+      (typeof configured !== 'string' &&
+        typeof configured !== 'boolean' &&
+        !(typeof configured === 'number' && Number.isFinite(configured)))
+    )
+      throw invalidProtocolFrame('Invalid Extension configuration value');
+    result[key] = configured;
+  }
+  requireEncodedByteLimit(result, 'Extension configuration values', 64 * 1024);
+  return result;
+}
+
+function decodeUiContributionProjection(value: unknown): ExtensionUiContributionProjection {
+  const candidate = value as Record<string, unknown> | null;
+  const fields = [
+    'entryId',
+    'extensionId',
+    'generation',
+    'id',
+    'surface',
+    'priority',
+    'document',
+    'documentSha256',
+    'network',
+    ...(candidate && Object.hasOwn(candidate, 'hostState') ? ['hostState'] : []),
+    ...(candidate && Object.hasOwn(candidate, 'hostMethods') ? ['hostMethods'] : []),
+    ...(candidate && Object.hasOwn(candidate, 'sessionAccess') ? ['sessionAccess'] : []),
+    ...(candidate && Object.hasOwn(candidate, 'slot') ? ['slot'] : []),
+    ...(candidate && Object.hasOwn(candidate, 'slots') ? ['slots'] : []),
+  ];
+  const item = requireExactRecord(value, 'extension UI contribution', fields);
+  if (
+    item.surface !== 'app.root' &&
+    item.surface !== 'app.overlay' &&
+    item.surface !== 'app.slot'
+  ) {
+    throw invalidProtocolFrame('Invalid extension UI surface');
+  }
+  if (
+    (item.surface === 'app.slot' &&
+      (typeof item.slot !== 'string' ||
+        !/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/u.test(item.slot) ||
+        Buffer.byteLength(item.slot, 'utf8') > 128)) ||
+    (item.surface !== 'app.slot' && item.slot !== undefined)
+  ) {
+    throw invalidProtocolFrame('Invalid extension UI slot');
+  }
+  if (
+    item.slots !== undefined &&
+    (!Array.isArray(item.slots) ||
+      item.slots.length > 32 ||
+      item.slots.some(
+        (slot) =>
+          typeof slot !== 'string' ||
+          !/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/u.test(slot) ||
+          Buffer.byteLength(slot, 'utf8') > 128,
+      ) ||
+      new Set(item.slots).size !== item.slots.length)
+  ) {
+    throw invalidProtocolFrame('Invalid extension UI child slots');
+  }
+  if (!Number.isSafeInteger(item.priority) || Math.abs(item.priority as number) > 10_000) {
+    throw invalidProtocolFrame('Invalid extension UI priority');
+  }
+  if (
+    item.hostMethods !== undefined &&
+    (!Array.isArray(item.hostMethods) || item.hostMethods.length > 64)
+  ) {
+    throw invalidProtocolFrame('Invalid extension UI Host methods');
+  }
+  return {
+    entryId: requireEntityId(item.entryId, 'extension entryId'),
+    extensionId: decodeExtensionId(item.extensionId),
+    generation: decodeGeneration(item.generation),
+    id: requireUtf8String(item.id, 'extension UI contribution id', 128),
+    surface: item.surface,
+    ...(item.slot === undefined ? {} : { slot: item.slot as string }),
+    ...(item.slots === undefined ? {} : { slots: item.slots as string[] }),
+    priority: item.priority as number,
+    document: requireUtf8String(item.document, 'extension UI document', 1024 * 1024),
+    documentSha256: requireUtf8String(item.documentSha256, 'extension UI document digest', 128),
+    network: decodeBoolean(item.network, 'extension UI network capability'),
+    ...(item.hostState === undefined
+      ? {}
+      : { hostState: decodeBoolean(item.hostState, 'extension UI Host state capability') }),
+    ...(item.hostMethods === undefined
+      ? {}
+      : {
+          hostMethods: (item.hostMethods as unknown[]).map((method) =>
+            requireUtf8String(method, 'extension UI Host method', 128),
+          ),
+        }),
+    ...(item.sessionAccess === undefined
+      ? {}
+      : {
+          sessionAccess: decodeBoolean(
+            item.sessionAccess,
+            'extension UI Session access capability',
+          ),
+        }),
+  };
+}
+
+function decodeUiStateIdentity(input: Record<string, unknown>): ExtensionUiStateQueryInput {
+  return {
+    scopeId: decodeExtensionScopeId(input.scopeId, 'extension UI scopeId'),
+    entryId: requireEntityId(input.entryId, 'extension entryId'),
+    extensionId: decodeExtensionId(input.extensionId),
+    generation: decodeGeneration(input.generation),
+    key: requireUtf8String(input.key, 'extension UI state key', 128),
+  };
+}
+
+function decodeUiStateValue(value: unknown, depth = 0): ExtensionUiStateValue {
+  if (depth > 16) throw invalidProtocolFrame('Extension UI state value is too deeply nested');
+  if (value === null || typeof value === 'boolean' || typeof value === 'string') return value;
+  if (typeof value === 'number' && Number.isFinite(value)) return value;
+  if (Array.isArray(value)) return value.map((item) => decodeUiStateValue(item, depth + 1));
+  if (value && typeof value === 'object') {
+    const record = value as Record<string, unknown>;
+    if (Object.keys(record).length > 256)
+      throw invalidProtocolFrame('Extension UI state object is too large');
+    return Object.fromEntries(
+      Object.entries(record).map(([key, item]) => [
+        requireUtf8String(key, 'extension UI state object key', 128),
+        decodeUiStateValue(item, depth + 1),
+      ]),
+    );
+  }
+  throw invalidProtocolFrame('Invalid extension UI state value');
+}
+
+function decodeEntryProjection(value: unknown): ExtensionCompositionEntryProjection {
+  const entry = requireExactRecord(value, 'extension entry', [
+    'entryId',
+    'scopeId',
+    'extensionId',
+    'generation',
+    'enabled',
+    'status',
+    'error',
+  ]);
+  return {
+    entryId: requireEntityId(entry.entryId, 'extension entryId'),
+    scopeId: decodeExtensionScopeId(entry.scopeId, 'extension scopeId'),
+    extensionId: decodeExtensionId(entry.extensionId),
+    generation: decodeGeneration(entry.generation),
+    enabled: decodeBoolean(entry.enabled, 'extension enabled'),
+    status: decodeEntryStatus(entry.status),
+    error:
+      entry.error === null
+        ? null
+        : requireUtf8String(entry.error, 'extension error', EXTENSION_ERROR_MAX_BYTES),
+  };
+}
+
+function decodeGeneration(value: unknown): number {
+  if (!Number.isSafeInteger(value) || (value as number) <= 0)
+    throw invalidProtocolFrame('Invalid extension Fiber generation');
+  return value as number;
+}
+
+function decodeExtensionId(value: unknown): string {
+  if (!isCanonicalExtensionId(value)) {
+    throw invalidProtocolFrame('Invalid extension extensionId');
+  }
+  return value;
+}
+
+function decodeExtensionScopeId(value: unknown, label: string): string {
+  if (!isCanonicalExtensionScopeId(value)) throw invalidProtocolFrame(`Invalid ${label}`);
+  return value;
+}
+
+function decodeBoolean(value: unknown, label: string): boolean {
+  if (typeof value !== 'boolean') throw invalidProtocolFrame(`Invalid ${label}`);
+  return value;
+}
+
+function decodeEntryStatus(value: unknown): ExtensionCompositionEntryStatus {
+  if (value !== 'disabled' && value !== 'active' && value !== 'waiting' && value !== 'failed') {
+    throw invalidProtocolFrame('Invalid extension entry status');
+  }
+  return value;
+}
diff --git a/packages/runtime-host/src/protocol/index.ts b/packages/runtime-host/src/protocol/index.ts
index 9c5e607986..5fb5d60651 100644
--- a/packages/runtime-host/src/protocol/index.ts
+++ b/packages/runtime-host/src/protocol/index.ts
@@ -56,6 +56,7 @@ export * from './project-catalog.js';
 export * from './project-catalog-change.js';
 export * from './execution-inspect.js';
 export * from './external-session.js';
+export * from './extension.js';
 export * from './message.js';
 export * from './operations.js';
 export * from './runtime-resource.js';
@@ -72,7 +73,7 @@ export const RUNTIME_HOST_REGISTRATION_SCHEMA_VERSION = 1 as const;
 export const RUNTIME_HOST_PROTOCOL_VERSION = 0 as const;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
-export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 20 as const;
+export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 21 as const;
 // Transcript pages amortize storage and network round trips with a 512 KiB raw
 // payload. Base64 expansion plus the bounded fragment envelope must still fit in
 // one transport message; narrower domains retain their own encoded limits.
diff --git a/packages/runtime-host/src/protocol/operations.ts b/packages/runtime-host/src/protocol/operations.ts
index 7cb9923142..03910e13a1 100644
--- a/packages/runtime-host/src/protocol/operations.ts
+++ b/packages/runtime-host/src/protocol/operations.ts
@@ -8,6 +8,7 @@ import { DEEP_RESEARCH_OPERATION_SPECS } from './deep-research.js';
 import { DAILY_REVIEW_OPERATION_SPECS } from './daily-review.js';
 import { CONTEXT_OPERATION_SPECS } from './context.js';
 import { EXECUTION_INSPECT_OPERATION_SPECS } from './execution-inspect.js';
+import { EXTENSION_OPERATION_SPECS } from './extension.js';
 import { EXTERNAL_SESSION_OPERATION_SPECS } from './external-session.js';
 import { CLIENT_CAPABILITY_OPERATION_SPECS } from './client-capability.js';
 import { invalidProtocolFrame } from './errors.js';
@@ -165,6 +166,7 @@ export const HOST_OPERATION_SPECS = composeOperationSpecMaps(
   DEEP_RESEARCH_OPERATION_SPECS,
   DAILY_REVIEW_OPERATION_SPECS,
   EXECUTION_INSPECT_OPERATION_SPECS,
+  EXTENSION_OPERATION_SPECS,
   EXTERNAL_SESSION_OPERATION_SPECS,
   RUNTIME_POLICY_OPERATION_SPECS,
   RUNTIME_RESOURCE_OPERATION_SPECS,
diff --git a/packages/runtime-host/src/server/execution-candidate.ts b/packages/runtime-host/src/server/execution-candidate.ts
index 0aa666408a..93cdd18c20 100644
--- a/packages/runtime-host/src/server/execution-candidate.ts
+++ b/packages/runtime-host/src/server/execution-candidate.ts
@@ -8,6 +8,7 @@ import {
   createExecutionRuntimeHostCompositionSource,
   type ExecutionRuntimeHostCompositionDependencies,
 } from './execution-composition-factory.js';
+import type { StaticTrustedToolExtension } from './extension-loader.js';
 
 export type ExecutionRuntimeHostCandidateResult = InteractiveRuntimeHostCandidateResult;
 
@@ -16,6 +17,7 @@ export interface ExecutionRuntimeHostCandidateOptions
   readonly managedWorkspaceGitRuntime?: VerifiedGitRuntimeInput;
   /** Packaged resource root containing bundled-git.json and the Git toolchain. */
   readonly bundledGitResourcesRoot?: string;
+  readonly trustedToolExtensions?: readonly StaticTrustedToolExtension[];
 }
 
 export type ExecutionRuntimeHostCandidateDependencies = ExecutionRuntimeHostCompositionDependencies;
diff --git a/packages/runtime-host/src/server/execution-composition-factory.ts b/packages/runtime-host/src/server/execution-composition-factory.ts
index 741fed9092..df380a71c7 100644
--- a/packages/runtime-host/src/server/execution-composition-factory.ts
+++ b/packages/runtime-host/src/server/execution-composition-factory.ts
@@ -1,5 +1,6 @@
 import type { VerifiedGitRuntimeInput } from '@maka/storage/managed-workspace-owner';
 import { resolveBundledGitRuntime } from './bundled-git-runtime.js';
+import type { StaticTrustedToolExtension } from './extension-loader.js';
 import {
   createExecutionRuntimeHostComposition,
   type ExecutionRuntimeHostComposition,
@@ -13,6 +14,7 @@ import {
 export interface ExecutionRuntimeHostCompositionSourceOptions {
   readonly managedWorkspaceGitRuntime?: VerifiedGitRuntimeInput;
   readonly bundledGitResourcesRoot?: string;
+  readonly trustedToolExtensions?: readonly StaticTrustedToolExtension[];
 }
 
 export interface ExecutionRuntimeHostCompositionDependencies {
@@ -34,6 +36,9 @@ export async function createExecutionRuntimeHostCompositionSource(
     : options.managedWorkspaceGitRuntime;
   const compositionOptions = {
     ...(managedWorkspaceGitRuntime ? { managedWorkspaceGitRuntime } : {}),
+    ...(options.trustedToolExtensions
+      ? { trustedToolExtensions: options.trustedToolExtensions }
+      : {}),
   };
   const createComposition = dependencies.createComposition ?? createExecutionRuntimeHostComposition;
   return defineInteractiveRuntimeHostComposition((context) =>
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 4b1c4a7702..42198f5365 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -99,6 +99,7 @@ import { HostClientCapabilityCoordinator } from './client-capability-coordinator
 import { HostDeepResearchCoordinator } from './deep-research-coordinator.js';
 import { HostDailyReviewCoordinator } from './daily-review-coordinator.js';
 import { createHostAiSdkBackend } from './execution-model-composition.js';
+import { createHostHookComposition } from './host-hook-composition.js';
 import {
   createInteractiveRunComposer,
   createInteractiveRunComposerFactory,
@@ -111,12 +112,26 @@ import {
 } from './execution-model-authority.js';
 import { HostExecutionInspectCoordinator } from './execution-inspect-coordinator.js';
 import { HostExternalSessionCoordinator } from './external-session-coordinator.js';
+import { HostExtensionController } from './extension-controller.js';
+import { HostExtensionTimerScheduler } from './extension-timer-scheduler.js';
+import {
+  InstalledPluginPackageLoader,
+  StaticTrustedToolExtensionLoader,
+  type StaticTrustedToolExtension,
+} from './extension-loader.js';
+import { HostExtensionRuntime, PROFILE_EXTENSION_SCOPE } from './extension-runtime.js';
+import { HostPluginCompositionStore } from './plugin-composition-store.js';
+import { HostExtensionUiStateStore } from './extension-ui-state-store.js';
+import { PluginPackageStore } from './plugin-package-store.js';
+import { HostExtensionPackageManagementTools } from './extension-package-management-tools.js';
 import { HostGoalCoordinator } from './goal-coordinator.js';
 import { HostGoalExecutionCoordinator } from './goal-execution-coordinator.js';
 import { HostHostedExecutionCoordinator } from './hosted-execution-coordinator.js';
 import { HostHostedExecutionRunner } from './hosted-execution-runner.js';
 import { executeHostedExecutionToSettlement } from './hosted-execution-wait.js';
 import type { RuntimeHostComposition, RuntimeHostCompositionContext } from './host-kernel.js';
+
+const DESKTOP_UI_EXTENSION_SCOPE = 'desktop-ui';
 import {
   beginRuntimeHostDomainModuleDrain,
   closeRuntimeHostDomainModules,
@@ -174,12 +189,14 @@ import {
 
 export interface ExecutionRuntimeHostComposition extends RuntimeHostComposition {
   readonly workspaceExecution: RuntimeHostWorkspaceExecutionComposition;
+  readonly extensions: HostExtensionRuntime;
 }
 
 export interface CreateExecutionRuntimeHostCompositionOptions {
   readonly managedWorkspaceGitRuntime?: VerifiedGitRuntimeInput;
   readonly bootstrapRuntimePolicy?: boolean;
   readonly skillHomeDirectory?: string;
+  readonly trustedToolExtensions?: readonly StaticTrustedToolExtension[];
 }
 
 export interface ExecutionRuntimeHostCompositionDependencies {
@@ -196,6 +213,15 @@ export function runtimeHostFilesystemWorkerRuntime(versions: {
   return versions.electron ? 'electron' : 'node';
 }
 
+export async function extensionTimerCwdForScope(
+  scopeId: string,
+  rootCwd: string,
+  sessionCwdForScope: (sessionId: string) => string | Promise<string>,
+): Promise<string> {
+  if (scopeId === PROFILE_EXTENSION_SCOPE || scopeId === DESKTOP_UI_EXTENSION_SCOPE) return rootCwd;
+  return await sessionCwdForScope(scopeId);
+}
+
 export async function createExecutionRuntimeHostComposition(
   context: RuntimeHostCompositionContext<'interactive'>,
   options: CreateExecutionRuntimeHostCompositionOptions = {},
@@ -203,6 +229,40 @@ export async function createExecutionRuntimeHostComposition(
 ): Promise<ExecutionRuntimeHostComposition> {
   const stores = await openInteractiveExecutionStoresForWrite(context.owner.lease);
   await stores.sessionStore.ready();
+  const extensionTimers = new HostExtensionTimerScheduler(
+    context.owner.controlDirectory,
+    (scopeId) =>
+      extensionTimerCwdForScope(
+        scopeId,
+        context.owner.capability.canonicalPath,
+        async (sessionId) => (await stores.sessionStore.readHeaderSnapshot(sessionId)).cwd,
+      ),
+  );
+  const extensions = new HostExtensionRuntime(
+    {
+      invocationTimeoutMs: 30_000,
+      failureThreshold: 3,
+    },
+    extensionTimers,
+  );
+  const pluginPackageStore = new PluginPackageStore(context.owner.controlDirectory);
+  const extensionLoader = new InstalledPluginPackageLoader(
+    new StaticTrustedToolExtensionLoader(options.trustedToolExtensions),
+    pluginPackageStore,
+  );
+  const extensionController = new HostExtensionController(
+    extensions,
+    extensionLoader,
+    new HostPluginCompositionStore(context.owner.controlDirectory),
+    context.requestDrain,
+    new HostExtensionUiStateStore(context.owner.controlDirectory),
+    pluginPackageStore,
+  );
+  const extensionPackageManagement = new HostExtensionPackageManagementTools(
+    context.owner.controlDirectory,
+    extensionController,
+  );
+  extensions.registerHostTools([...extensionPackageManagement.tools()]);
   let graphControlStore: ReturnType<typeof createAgentGraphControlStore> | undefined;
   let taskLedgerStore:
     | Awaited<ReturnType<typeof openInteractiveTaskLedgerStoreForWrite>>
@@ -278,6 +338,11 @@ export async function createExecutionRuntimeHostComposition(
     });
     await stores.messageReceiptStore.beginHostEpoch(context.hostEpoch);
     const backends = new BackendRegistry();
+    const hooks = createHostHookComposition({
+      stateRoot: context.owner.capability.canonicalPath,
+      runtimeEvents: stores.runtimeEventStore,
+      extensions,
+    });
     backends.register('fake', (backendContext) => new FakeBackend(backendContext));
     const runtimePolicyActivation = new RuntimePolicyActivationGate();
     const runtimePolicy = new HostRuntimePolicyCoordinator(
@@ -390,7 +455,7 @@ export async function createExecutionRuntimeHostComposition(
     const childAgentTools = createHostChildAgentToolComposition({
       taskLedger,
       builtinTools,
-      hostTools,
+      hostTools: [...hostTools, ...extensionPackageManagement.authorTools()],
       worktreePatchWriteBackAvailable: true,
     });
     const openedGraphControlStore = createAgentGraphControlStore(
@@ -657,6 +722,8 @@ export async function createExecutionRuntimeHostComposition(
               backendContext.sessionId,
             ),
             runtimeCommitSink: stores.runtimeEventStore,
+            extensions,
+            hooks,
             requestDrain: context.requestDrain,
           })),
     );
@@ -683,7 +750,7 @@ export async function createExecutionRuntimeHostComposition(
         if (tools.length !== header.subagentRuntime.toolNames.length) {
           throw new Error('Subagent runtime tool snapshot is unavailable');
         }
-        return tools.map((tool) => tool.name);
+        return extensions.resolveTools(sessionId, tools, { exact: true }).map((tool) => tool.name);
       }
       if (header.subagentParent) {
         throw new Error('Linked child session is missing its durable runtime snapshot');
@@ -697,7 +764,7 @@ export async function createExecutionRuntimeHostComposition(
           runtimePolicyStores.runtimePolicy.getSnapshot(),
         ]);
         const runProfile = hostedExecutionRunProfile(header.toolProfile);
-        return createInteractiveRunComposer({
+        const composition = createInteractiveRunComposer({
           runtimePolicy: runtimePolicySnapshot,
           skills,
           memory: requireMemory(memory),
@@ -727,7 +794,10 @@ export async function createExecutionRuntimeHostComposition(
                 },
               }
             : {}),
-        }).tools.map((tool) => tool.name);
+        });
+        return extensions
+          .resolveTools(sessionId, composition.tools, { exact: runProfile !== undefined })
+          .map((tool) => tool.name);
       } finally {
         capabilitySnapshot?.release();
       }
@@ -745,7 +815,7 @@ export async function createExecutionRuntimeHostComposition(
           requireClientCapabilities(clientCapabilities).snapshotForSession(previewSessionId);
         try {
           const runtimePolicySnapshot = await runtimePolicyStores.runtimePolicy.getSnapshot();
-          return createInteractiveRunComposer({
+          const composition = createInteractiveRunComposer({
             runtimePolicy: runtimePolicySnapshot,
             skills,
             memory: requireMemory(memory),
@@ -762,7 +832,10 @@ export async function createExecutionRuntimeHostComposition(
               mode: collaborationMode,
               permissionMode,
             },
-          }).tools.map((tool) => tool.name);
+          });
+          return extensions
+            .resolveTools(previewSessionId, composition.tools)
+            .map((tool) => tool.name);
         } finally {
           capabilitySnapshot?.release();
         }
@@ -1131,6 +1204,22 @@ export async function createExecutionRuntimeHostComposition(
       continuity: continuityCoordinator,
       workspaceResolver,
       requestDrain: context.requestDrain,
+      onCreated: async (sessionId, cwd) => {
+        await extensions.dispatchCoreEvent(
+          sessionId,
+          'maka.session.created',
+          { sessionId, cwd },
+          {
+            sessionId,
+            turnId: `session-created:${Date.now()}`,
+            cwd,
+            permissionMode: 'default',
+            origin: 'host',
+            configuration: Object.freeze({}),
+            signal: new AbortController().signal,
+          },
+        );
+      },
     });
     scheduledTasks = new HostScheduledTaskCoordinator({
       store: openedScheduledTaskStore,
@@ -1219,6 +1308,22 @@ export async function createExecutionRuntimeHostComposition(
       worktrees: worktreeChildExecutor,
       requestDrain: context.requestDrain,
       memoryExtractionLane,
+      onDisposed: async (sessionId, cwd) => {
+        await extensions.dispatchCoreEvent(
+          sessionId,
+          'maka.session.disposed',
+          { sessionId },
+          {
+            sessionId,
+            turnId: `session-disposed:${Date.now()}`,
+            cwd,
+            permissionMode: 'default',
+            origin: 'host',
+            configuration: Object.freeze({}),
+            signal: new AbortController().signal,
+          },
+        );
+      },
     });
     const hostedExecutionRunner = new HostHostedExecutionRunner({
       handlers: {
@@ -1255,6 +1360,13 @@ export async function createExecutionRuntimeHostComposition(
     );
     let recoverySessions: Awaited<ReturnType<typeof stores.sessionStore.listForRecovery>> = [];
     domainModules = [
+      createRuntimeHostDomainModule({
+        id: 'extension',
+        handlers: [extensionController.handlers],
+        recovery: { state: () => extensionController.recover() },
+        drain: [() => extensionController.beginDrain(), () => extensions.beginDrain()],
+        close: [() => extensions.close()],
+      }),
       createRuntimeHostDomainModule({
         id: 'memory',
         handlers: [requireMemory(memory).handlers],
@@ -1508,6 +1620,7 @@ export async function createExecutionRuntimeHostComposition(
       handlers,
       moduleIds: Object.freeze(domainModules.map(({ id }) => id)),
       workspaceExecution: requireWorkspaceExecution(workspaceExecution),
+      extensions,
       continuity: continuityCoordinator,
       clientCapabilities,
       configurationChanges,
@@ -1612,6 +1725,11 @@ export async function createExecutionRuntimeHostComposition(
     } catch (closeError) {
       errors.push(closeError);
     }
+    try {
+      await extensions.close();
+    } catch (closeError) {
+      errors.push(closeError);
+    }
     if (errors.length === 1) throw error;
     throw new AggregateError(errors, 'Unable to clean up Runtime Host execution composition');
   }
diff --git a/packages/runtime-host/src/server/execution-model-composition.ts b/packages/runtime-host/src/server/execution-model-composition.ts
index 9d9a6e24b1..26d6be8bb9 100644
--- a/packages/runtime-host/src/server/execution-model-composition.ts
+++ b/packages/runtime-host/src/server/execution-model-composition.ts
@@ -23,6 +23,7 @@ import { stableHash, toolCatalogHash } from '@maka/runtime/request-shape';
 import { toolAvailabilityHash } from '@maka/runtime/tool-availability';
 import { type BackendFactoryContext } from '@maka/runtime/session-manager';
 import { type RuntimeCommitSink } from '@maka/runtime/runtime-commit-sink';
+import type { MakaTool } from '@maka/runtime/tool-runtime';
 import {
   createAttachmentByteReader,
   persistProviderRequestCaptureArtifact,
@@ -37,9 +38,11 @@ import {
 import type { HostChildAgentBackendCapabilities } from './child-agent-composition.js';
 import type { HostExecutionArtifactServices } from './execution-artifacts.js';
 import type { HostMemoryExtractionCoordinator } from './memory-extraction-coordinator.js';
+import type { HostExtensionToolResolver } from './extension-runtime.js';
 import { readDuringBackendCreation, resolveExecutionTarget } from './execution-model-authority.js';
 import { toRuntimePolicyProxy } from './runtime-policy-proxy.js';
 import type { HostRunComposer, HostRunComposerFactory } from './host-run-composer.js';
+import type { HostHookComposition } from './host-hook-composition.js';
 
 export interface HostAiSdkBackendInput {
   readonly context: BackendFactoryContext;
@@ -54,6 +57,8 @@ export interface HostAiSdkBackendInput {
   readonly requestDrain: () => void;
   readonly runtimeCommitSink?: RuntimeCommitSink;
   readonly childAgents?: HostChildAgentBackendCapabilities;
+  readonly extensions?: HostExtensionToolResolver;
+  readonly hooks?: HostHookComposition;
   readonly createFetchTransport?: (proxy: ProxiedFetchProxy | null) => ProxiedFetchTransport;
 }
 
@@ -148,6 +153,12 @@ export async function createHostAiSdkBackend(input: HostAiSdkBackendInput): Prom
     await transport.close();
     throw error;
   }
+  const resolveModelTools = (): readonly MakaTool[] =>
+    input.extensions?.resolveTools(input.context.sessionId, modelComposition.tools, {
+      exact:
+        input.context.header.subagentRuntime !== undefined ||
+        input.context.header.toolProfile !== undefined,
+    }) ?? modelComposition.tools;
   const modelFactory = (
     modelInput: Parameters<typeof getAIModel>[0],
   ): ReturnType<typeof getAIModel> =>
@@ -270,8 +281,13 @@ export async function createHostAiSdkBackend(input: HostAiSdkBackendInput): Prom
   };
   const recordRunComposition = input.context.recordRunComposition;
   const commitRunComposition = recordRunComposition
-    ? async (context: { readonly turnId: string; readonly runId: string }): Promise<void> => {
+    ? async (context: {
+        readonly turnId: string;
+        readonly runId: string;
+        readonly tools?: readonly MakaTool[];
+      }): Promise<void> => {
         const resolved = await resolveRunPrompt(context);
+        const tools = context.tools ?? resolveModelTools();
         await recordRunComposition(
           context.runId,
           createRunCompositionSnapshot({
@@ -279,10 +295,10 @@ export async function createHostAiSdkBackend(input: HostAiSdkBackendInput): Prom
             composerRevision: modelComposition.composerRevision,
             sourceRevisions: resolved.sourceRevisions,
             baseSystemPromptHash: stableHash(resolved.text ?? ''),
-            toolCatalogHash: toolCatalogHash(modelComposition.tools),
+            toolCatalogHash: toolCatalogHash(tools),
             toolAvailabilityHash: toolAvailabilityHash(modelComposition.toolAvailability),
             baseProviderOptionsHash: stableHash(providerOptions),
-            toolNames: modelComposition.tools.map(({ name }) => name),
+            toolNames: tools.map(({ name }) => name),
             contextWindow: contextWindow ?? null,
           }),
         );
@@ -323,6 +339,7 @@ export async function createHostAiSdkBackend(input: HostAiSdkBackendInput): Prom
         modelId: target.model,
         modelFactory,
         tools: [...modelComposition.tools],
+        ...(input.extensions ? { resolveTools: resolveModelTools } : {}),
         toolAvailability: modelComposition.toolAvailability,
         ...(modelComposition.planTraceContext
           ? { planTraceContext: modelComposition.planTraceContext }
@@ -344,6 +361,9 @@ export async function createHostAiSdkBackend(input: HostAiSdkBackendInput): Prom
           sessionId: input.context.sessionId,
         }),
         recordToolArtifacts: input.executionArtifacts.recordToolArtifacts,
+        ...(input.hooks
+          ? { preToolUseHooks: input.hooks.dispatcherFor(input.context.header) }
+          : {}),
         toolResultArchive: input.executionArtifacts.toolResultArchive,
         ...(!input.context.tools &&
         !input.context.header.subagentParent &&
diff --git a/packages/runtime-host/src/server/execution-service.ts b/packages/runtime-host/src/server/execution-service.ts
index d8713e1ccf..7a587597cb 100644
--- a/packages/runtime-host/src/server/execution-service.ts
+++ b/packages/runtime-host/src/server/execution-service.ts
@@ -8,11 +8,13 @@ import { RuntimeHostKernel } from './host-kernel.js';
 import { openRuntimeHostAccessAuthority } from './access-authority.js';
 import { startRuntimeHostServiceListenerSet } from './listener-set.js';
 import type { StartRuntimeHostWebSocketListenerOptions } from './websocket-listener.js';
+import type { StaticTrustedToolExtension } from './extension-loader.js';
 
 export interface ExecutionRuntimeHostServiceOptions {
   readonly rootPath: string;
   readonly managedWorkspaceGitRuntime?: VerifiedGitRuntimeInput;
   readonly bundledGitResourcesRoot?: string;
+  readonly trustedToolExtensions?: readonly StaticTrustedToolExtension[];
   readonly handshakeTimeoutMs?: number;
   readonly shutdownGraceMs?: number;
   readonly websocket?: Omit<
diff --git a/packages/runtime-host/src/server/extension-bundle.ts b/packages/runtime-host/src/server/extension-bundle.ts
new file mode 100644
index 0000000000..54ecf3c1c2
--- /dev/null
+++ b/packages/runtime-host/src/server/extension-bundle.ts
@@ -0,0 +1,245 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { copyFile, mkdir, open, readdir, realpath, rm, stat } from 'node:fs/promises';
+import { dirname, isAbsolute, join, posix, resolve } from 'node:path';
+
+const MAX_FILES = 256;
+const MAX_FILE_BYTES = 8 * 1024 * 1024;
+const MAX_BUNDLE_BYTES = 16 * 1024 * 1024;
+
+interface BundleFile {
+  readonly path: string;
+  readonly sha256: string;
+  readonly content: string;
+}
+
+interface ExtensionBundleDocument {
+  readonly schemaVersion: 1;
+  readonly digest: string;
+  readonly files: readonly BundleFile[];
+}
+
+export class ExtensionBundleError extends Error {
+  readonly name = 'ExtensionBundleError';
+  constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+  }
+}
+
+export async function exportExtensionBundle(sourceRoot: string, targetPath: string): Promise<void> {
+  if (!isAbsolute(targetPath)) throw invalid('Extension bundle targetPath must be absolute');
+  const files = await readDirectory(sourceRoot);
+  const document: ExtensionBundleDocument = Object.freeze({
+    schemaVersion: 1,
+    digest: packageDigest(files),
+    files: Object.freeze(
+      files.map((file) =>
+        Object.freeze({
+          path: file.path,
+          sha256: createHash('sha256').update(file.content).digest('hex'),
+          content: file.content.toString('base64'),
+        }),
+      ),
+    ),
+  });
+  const encoded = Buffer.from(`${JSON.stringify(document)}\n`, 'utf8');
+  if (encoded.byteLength > MAX_BUNDLE_BYTES * 2)
+    throw invalid('Encoded Extension bundle is too large');
+  await mkdir(dirname(targetPath), { recursive: true, mode: 0o700 });
+  const temporary = `${targetPath}.${randomUUID()}.tmp`;
+  let handle: Awaited<ReturnType<typeof open>> | undefined;
+  try {
+    handle = await open(temporary, 'wx', 0o600);
+    await handle.writeFile(encoded);
+    await handle.sync();
+    await handle.close();
+    handle = undefined;
+    await copyFile(temporary, targetPath, constants.COPYFILE_EXCL);
+  } catch (error) {
+    throw invalid('Unable to export Extension bundle', error);
+  } finally {
+    await handle?.close().catch(() => undefined);
+    await rm(temporary, { force: true }).catch(() => undefined);
+  }
+}
+
+export async function materializeExtensionPackage(
+  sourcePath: string,
+  controlDirectory: string,
+): Promise<{ readonly root: string; readonly dispose: () => Promise<void> }> {
+  if (!isAbsolute(sourcePath)) throw invalid('Extension package sourcePath must be absolute');
+  const canonical = await realpath(resolve(sourcePath)).catch((error) => {
+    throw invalid('Extension package source is unavailable', error);
+  });
+  const metadata = await stat(canonical);
+  if (metadata.isDirectory()) return { root: canonical, dispose: async () => undefined };
+  if (!metadata.isFile())
+    throw invalid('Extension package source must be a directory or bundle file');
+  if (metadata.size > MAX_BUNDLE_BYTES * 2)
+    throw invalid('Extension bundle exceeds its size limit');
+  const handle = await open(canonical, constants.O_RDONLY | constants.O_NOFOLLOW);
+  let document: ExtensionBundleDocument;
+  try {
+    document = decodeBundle(JSON.parse((await handle.readFile()).toString('utf8')));
+  } catch (error) {
+    if (error instanceof ExtensionBundleError) throw error;
+    throw invalid('Extension bundle is invalid', error);
+  } finally {
+    await handle.close();
+  }
+  const imports = join(controlDirectory, 'bundle-imports-v1');
+  const root = join(imports, randomUUID());
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  try {
+    for (const file of document.files) {
+      const target = join(root, ...file.path.split('/'));
+      await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+      const output = await open(target, 'wx', 0o600);
+      try {
+        await output.writeFile(Buffer.from(file.content, 'base64'));
+      } finally {
+        await output.close();
+      }
+    }
+    return { root, dispose: () => rm(root, { recursive: true, force: true }) };
+  } catch (error) {
+    await rm(root, { recursive: true, force: true }).catch(() => undefined);
+    throw invalid('Unable to materialize Extension bundle', error);
+  }
+}
+
+async function readDirectory(
+  rootValue: string,
+): Promise<readonly { path: string; content: Buffer }[]> {
+  const root = await realpath(rootValue);
+  if (!(await stat(root)).isDirectory())
+    throw invalid('Extension bundle source is not a directory');
+  const paths: string[] = [];
+  await collect(root, '', paths);
+  if (paths.length === 0 || paths.length > MAX_FILES)
+    throw invalid('Extension bundle file count is invalid');
+  let total = 0;
+  const files: { path: string; content: Buffer }[] = [];
+  for (const path of paths.sort()) {
+    const handle = await open(
+      join(root, ...path.split('/')),
+      constants.O_RDONLY | constants.O_NOFOLLOW,
+    );
+    try {
+      const metadata = await handle.stat();
+      if (!metadata.isFile() || metadata.size > MAX_FILE_BYTES)
+        throw invalid(`Extension bundle file is invalid: ${path}`);
+      const content = await handle.readFile();
+      total += content.byteLength;
+      if (total > MAX_BUNDLE_BYTES) throw invalid('Extension bundle payload is too large');
+      files.push({ path, content });
+    } finally {
+      await handle.close();
+    }
+  }
+  return files;
+}
+
+async function collect(root: string, directory: string, paths: string[]): Promise<void> {
+  const entries = await readdir(directory ? join(root, ...directory.split('/')) : root, {
+    withFileTypes: true,
+  });
+  for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+    if (entry.name === '.git') continue;
+    const path = directory ? `${directory}/${entry.name}` : entry.name;
+    safePath(path);
+    if (entry.isSymbolicLink()) throw invalid(`Extension bundle may not contain symlinks: ${path}`);
+    if (entry.isDirectory()) await collect(root, path, paths);
+    else if (entry.isFile()) paths.push(path);
+    else throw invalid(`Extension bundle contains an unsupported entry: ${path}`);
+    if (paths.length > MAX_FILES) throw invalid('Extension bundle contains too many files');
+  }
+}
+
+function decodeBundle(value: unknown): ExtensionBundleDocument {
+  if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw invalid('Extension bundle must be an object');
+  const record = value as Record<string, unknown>;
+  if (
+    Object.keys(record).sort().join() !== 'digest,files,schemaVersion' ||
+    record.schemaVersion !== 1 ||
+    !Array.isArray(record.files) ||
+    record.files.length === 0 ||
+    record.files.length > MAX_FILES
+  ) {
+    throw invalid('Extension bundle fields are invalid');
+  }
+  let total = 0;
+  const paths = new Set<string>();
+  const files = record.files.map((value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+      throw invalid('Extension bundle file is invalid');
+    const file = value as Record<string, unknown>;
+    if (
+      Object.keys(file).sort().join() !== 'content,path,sha256' ||
+      typeof file.path !== 'string' ||
+      typeof file.content !== 'string' ||
+      typeof file.sha256 !== 'string'
+    )
+      throw invalid('Extension bundle file fields are invalid');
+    const path = safePath(file.path);
+    if (paths.has(path)) throw invalid(`Extension bundle repeats file: ${path}`);
+    paths.add(path);
+    const content = Buffer.from(file.content, 'base64');
+    total += content.byteLength;
+    if (
+      content.byteLength > MAX_FILE_BYTES ||
+      total > MAX_BUNDLE_BYTES ||
+      createHash('sha256').update(content).digest('hex') !== file.sha256
+    ) {
+      throw invalid(`Extension bundle file integrity failed: ${path}`);
+    }
+    return { path, content };
+  });
+  if (typeof record.digest !== 'string' || packageDigest(files) !== record.digest)
+    throw invalid('Extension bundle digest is invalid');
+  return Object.freeze({
+    schemaVersion: 1,
+    digest: record.digest,
+    files: Object.freeze(
+      files.map((file) =>
+        Object.freeze({
+          path: file.path,
+          sha256: createHash('sha256').update(file.content).digest('hex'),
+          content: file.content.toString('base64'),
+        }),
+      ),
+    ),
+  });
+}
+
+function packageDigest(files: readonly { path: string; content: Buffer }[]): string {
+  const hash = createHash('sha256');
+  for (const file of files) {
+    const path = Buffer.from(file.path, 'utf8');
+    const length = Buffer.allocUnsafe(8);
+    length.writeBigUInt64BE(BigInt(path.byteLength));
+    hash.update(length).update(path);
+    length.writeBigUInt64BE(BigInt(file.content.byteLength));
+    hash.update(length).update(file.content);
+  }
+  return `sha256-${hash.digest('hex')}`;
+}
+
+function safePath(value: string): string {
+  if (
+    !value ||
+    value.length > 512 ||
+    value.includes('\\') ||
+    value.startsWith('/') ||
+    posix.normalize(value) !== value ||
+    value.split('/').some((part) => !part || part === '.' || part === '..')
+  ) {
+    throw invalid('Extension bundle path is invalid');
+  }
+  return value;
+}
+
+function invalid(message: string, cause?: unknown): ExtensionBundleError {
+  return new ExtensionBundleError(message, { cause });
+}
diff --git a/packages/runtime-host/src/server/extension-controller.ts b/packages/runtime-host/src/server/extension-controller.ts
new file mode 100644
index 0000000000..f8b0384187
--- /dev/null
+++ b/packages/runtime-host/src/server/extension-controller.ts
@@ -0,0 +1,1511 @@
+import type {
+  MakaCompositionEntry,
+  MakaCompositionSnapshot,
+  MakaPluginMountInspection,
+  MakaPluginRootId,
+} from '@maka/runtime/plugin-runtime';
+import type { MakaTool, MakaToolContext } from '@maka/runtime/tool-runtime';
+import { createHash } from 'node:crypto';
+import {
+  type ExtensionCompositionEntryProjection,
+  type ExtensionCompositionMutateInput,
+  type ExtensionCompositionMutateResult,
+  type ExtensionCompositionQueryResult,
+  type ExtensionConfigurationMutateInput,
+  type ExtensionConfigurationMutateResult,
+  type ExtensionConfigurationQueryInput,
+  type ExtensionConfigurationQueryResult,
+  type ExtensionContractQueryResult,
+  type ExtensionPackageExportInput,
+  type ExtensionPackageExportResult,
+  type ExtensionPackageContractProjection,
+  type ExtensionUiSnapshotInput,
+  type ExtensionUiSnapshotResult,
+  type ExtensionUiRpcInvokeInput,
+  type ExtensionUiRpcInvokeResult,
+  type ExtensionUiStateMutateInput,
+  type ExtensionUiStateMutateResult,
+  type ExtensionUiStateQueryInput,
+  type ExtensionUiStateQueryResult,
+  type OperationOutcome,
+  type ToolPackageInstallInput,
+  type ToolPackageInstallResult,
+  type ToolPackageUninstallInput,
+} from '../protocol/index.js';
+import type { ExtensionOperationHandlerMap } from './operation-dispatcher.js';
+import {
+  HostExtensionLoaderError,
+  type HostTrustedToolExtensionLoader,
+} from './extension-loader.js';
+import { HostExtensionRuntime } from './extension-runtime.js';
+import {
+  HostPluginCompositionStore,
+  HostPluginCompositionStoreError,
+  type PersistedPluginComposition,
+  type PersistedPluginEntry,
+} from './plugin-composition-store.js';
+import { HostExtensionUiStateStore } from './extension-ui-state-store.js';
+import { UiPackageService } from './ui-package-service.js';
+import type { PluginPackageStore } from './plugin-package-store.js';
+import { validateExtensionConfiguration } from './extension-package-manifest.js';
+
+type MutationFailureCode =
+  | 'host_draining'
+  | 'not_found'
+  | 'operation_conflict'
+  | 'persistence_failed'
+  | 'commit_outcome_unknown';
+
+interface CompositionEntryState {
+  readonly entryId: string;
+  readonly scopeId: string;
+  readonly extensionId: string;
+  readonly enabled: boolean;
+  readonly error: string | null;
+  readonly config: Readonly<Record<string, string | number | boolean>>;
+}
+
+/** Durable control plane that converges persisted desired entries into the Host runtime. */
+export class HostExtensionController {
+  readonly handlers: ExtensionOperationHandlerMap = {
+    'extension.composition.query': () => this.#query(),
+    'extension.composition.mutate': (input) => this.#mutate(input),
+    'extension.contract.query': () => this.#contractQuery(),
+    'extension.configuration.query': (input) => this.#configurationQuery(input),
+    'extension.configuration.mutate': (input) => this.#configurationMutate(input),
+    'extension.ui.snapshot': (input) => this.#uiSnapshot(input),
+    'extension.ui.state.query': (input) => this.#uiStateQuery(input),
+    'extension.ui.state.mutate': (input) => this.#uiStateMutate(input),
+    'extension.ui.rpc.invoke': (input) => this.#uiRpcInvoke(input),
+    'extension.package.install': (input) => this.#installPackage(input),
+    'extension.package.uninstall': (input) => this.#uninstallPackage(input),
+    'extension.package.export': (input) => this.#exportPackage(input),
+  };
+
+  readonly #entries = new CompositionEntryIndex(
+    () => this.#persistedComposition,
+    (composition) => {
+      this.#persistedComposition = composition;
+    },
+  );
+  #mutationTail: Promise<void> = Promise.resolve();
+  #recovered = false;
+  #draining = false;
+  #persistenceFailure: HostPluginCompositionStoreError | undefined;
+  #compositionGeneration = 0;
+  #persistedComposition: PersistedPluginComposition = emptyComposition();
+
+  constructor(
+    private readonly runtime: HostExtensionRuntime,
+    private readonly loader: HostTrustedToolExtensionLoader,
+    private readonly store: HostPluginCompositionStore,
+    private readonly requestDrain: () => void,
+    private readonly uiState = new HostExtensionUiStateStore(),
+    private readonly uiPackages?: PluginPackageStore,
+  ) {
+    this.loader.setConfigurationResolver?.((entryId) => this.#configurationForEntry(entryId));
+    this.loader.setEventEmitter?.((scopeId, event, payload, context) =>
+      this.runtime.emitEvent(scopeId, event, payload, context),
+    );
+    this.loader.setServiceCaller?.((scopeId, service, method, input, context) =>
+      this.runtime.callService(scopeId, service, method, input, context),
+    );
+    this.loader.setUiStatePublisher?.((extensionId, key, value) =>
+      this.#publishToolVisualization(extensionId, key, value),
+    );
+  }
+
+  resolveTool(scopeId: string, name: string): MakaTool | undefined {
+    return this.runtime.resolveTools(scopeId, []).find((tool) => tool.name === name);
+  }
+
+  emitEvent(scopeId: string, event: string, payload: unknown, context: MakaToolContext) {
+    return this.runtime.emitEvent(scopeId, event, payload, invocationContext(context));
+  }
+
+  callService(
+    scopeId: string,
+    service: string,
+    method: string,
+    input: unknown,
+    context: MakaToolContext,
+  ) {
+    return this.runtime.callService(scopeId, service, method, input, {
+      ...invocationContext(context),
+      callerExtensionId: 'maka.host',
+    });
+  }
+
+  async publishUiState(extensionId: string, key: string, value: unknown): Promise<void> {
+    const matches = this.runtime
+      .inspectUi('desktop-ui')
+      .filter((item) => item.extensionId === extensionId);
+    if (matches.length === 0) {
+      throw new Error(`Active Desktop UI Extension was not found: ${extensionId}`);
+    }
+    if (!matches.some((item) => item.hostState)) {
+      throw new Error(`Active Desktop UI Extension does not allow Host state: ${extensionId}`);
+    }
+    await this.#publishToolVisualization(extensionId, key, value);
+  }
+
+  async #publishToolVisualization(extensionId: string, key: string, value: unknown): Promise<void> {
+    const admitted = this.runtime
+      .inspectUi('desktop-ui')
+      .filter((item) => item.extensionId === extensionId && item.hostState);
+    await Promise.all(
+      admitted.map((item) =>
+        this.uiState.set(
+          'desktop-ui',
+          item.entryId,
+          key,
+          value as Parameters<HostExtensionUiStateStore['set']>[3],
+        ),
+      ),
+    );
+  }
+
+  /** Recovery is fail-open for the Host and fail-closed for Extension mutations. */
+  async recover(): Promise<void> {
+    if (this.#recovered) return;
+    try {
+      const composition = await this.store.read();
+      if (composition) {
+        this.#persistedComposition = composition;
+        this.#compositionGeneration = composition.generation;
+        for (const [, entry] of persistedEntries(composition)) {
+          if (!entry.packageId || entry.disabled) continue;
+          await this.#ensureInstalled(entry.packageId);
+        }
+        const hasPersistedFailures = [...persistedEntries(composition)].some(
+          ([, entry]) => entry.error,
+        );
+        if (hasPersistedFailures) await this.#recoverCompositionEntries(composition);
+        else {
+          try {
+            await this.runtime.replaceCompositionSnapshot(runtimeSnapshot(composition));
+          } catch {
+            await this.#recoverCompositionEntries(composition);
+          }
+        }
+      }
+      await this.#recoverEnabledEntries();
+      await this.#refreshRuntimeState();
+      await this.#pruneOrphanDependencyEntries();
+      await this.#persist();
+    } catch (error) {
+      this.#persistenceFailure = asPersistenceFailure(error);
+    } finally {
+      this.#recovered = true;
+    }
+  }
+
+  beginDrain(): void {
+    this.#draining = true;
+  }
+
+  async #query(): Promise<OperationOutcome<'extension.composition.query'>> {
+    if (this.#persistenceFailure) {
+      return queryFailure('persistence_failed', 'Extension state is unavailable');
+    }
+    const result: ExtensionCompositionQueryResult = {
+      extensions: await this.loader.list(),
+      entries: this.#entryProjections(),
+    };
+    return { ok: true, result };
+  }
+
+  async #contractQuery(): Promise<OperationOutcome<'extension.contract.query'>> {
+    if (this.#persistenceFailure) {
+      return {
+        ok: false,
+        error: { code: 'persistence_failed', message: 'Extension state is unavailable' },
+      };
+    }
+    try {
+      const packages = this.loader.contracts ? await this.loader.contracts() : [];
+      const result: ExtensionContractQueryResult = { packages };
+      return { ok: true, result };
+    } catch (error) {
+      return {
+        ok: false,
+        error: { code: 'internal_failure', message: boundedErrorMessage(error) },
+      };
+    }
+  }
+
+  async #configurationQuery(
+    input: ExtensionConfigurationQueryInput,
+  ): Promise<OperationOutcome<'extension.configuration.query'>> {
+    const entry = this.#readEntryState(input.entryId);
+    if (!entry) {
+      return { ok: false, error: { code: 'not_found', message: 'Extension entry not found' } };
+    }
+    try {
+      const contract = await this.#requireContract(entry.extensionId);
+      const configuration = validateExtensionConfiguration(
+        contract.configuration,
+        this.#configurationForEntry(input.entryId),
+      );
+      const result: ExtensionConfigurationQueryResult = {
+        configuration: redactSecretConfiguration(contract, configuration),
+      };
+      return { ok: true, result };
+    } catch (error) {
+      return {
+        ok: false,
+        error: { code: 'invalid_request', message: boundedErrorMessage(error) },
+      };
+    }
+  }
+
+  #configurationMutate(
+    input: ExtensionConfigurationMutateInput,
+  ): Promise<OperationOutcome<'extension.configuration.mutate'>> {
+    if (this.#draining) {
+      return Promise.resolve({
+        ok: false,
+        error: { code: 'host_draining', message: 'Runtime Host is draining' },
+      });
+    }
+    return this.#serializeMutation(async () => {
+      const entry = this.#entries.get(input.entryId);
+      if (!entry) {
+        return { ok: false, error: { code: 'not_found', message: 'Extension entry not found' } };
+      }
+      let configuration: Readonly<Record<string, string | number | boolean>>;
+      try {
+        const contract = await this.#requireContract(entry.extensionId);
+        configuration = validateExtensionConfiguration(contract.configuration, input.configuration);
+      } catch (error) {
+        return {
+          ok: false,
+          error: { code: 'invalid_request', message: boundedErrorMessage(error) },
+        };
+      }
+      const previous = entry;
+      this.#entries.set(input.entryId, entryState({ ...entry, config: configuration }));
+      try {
+        await this.#persist();
+        if (entry.enabled && this.#tryInspect(entry.entryId)) {
+          await this.#applyComposition({
+            operations: [
+              {
+                type: 'update',
+                entryId: entry.entryId,
+                patch: { config: configuration },
+              },
+            ],
+          });
+          await this.#refreshRuntimeState();
+          await this.#persist();
+        }
+        const contract = await this.#requireContract(entry.extensionId);
+        const result: ExtensionConfigurationMutateResult = {
+          configuration: redactSecretConfiguration(contract, configuration),
+        };
+        return { ok: true, result };
+      } catch (error) {
+        this.#entries.set(input.entryId, previous);
+        await this.#persist().catch(() => undefined);
+        if (entry.enabled) await this.#convergeEntry(entry.entryId).catch(() => undefined);
+        return {
+          ok: false,
+          error: { code: 'persistence_failed', message: boundedErrorMessage(error) },
+        };
+      }
+    });
+  }
+
+  async #uiSnapshot(
+    input: ExtensionUiSnapshotInput,
+  ): Promise<OperationOutcome<'extension.ui.snapshot'>> {
+    if (this.#persistenceFailure) {
+      return uiSnapshotFailure('persistence_failed', 'Extension state is unavailable');
+    }
+    const contributions: ExtensionUiSnapshotResult['contributions'] = this.runtime
+      .inspectUi(input.scopeId)
+      .map((item) =>
+        Object.freeze({
+          entryId: item.entryId,
+          extensionId: item.extensionId,
+          generation: item.generation,
+          id: item.id,
+          surface: item.surface,
+          ...(item.slot ? { slot: item.slot } : {}),
+          slots: item.slots,
+          priority: item.priority,
+          document: item.document,
+          documentSha256: item.documentSha256,
+          network: item.network,
+          hostState: item.hostState,
+          hostMethods: item.hostMethods,
+          sessionAccess: item.sessionAccess,
+        }),
+      );
+    const digest = createHash('sha256').update(JSON.stringify(contributions)).digest('hex');
+    const result: ExtensionUiSnapshotResult = {
+      scopeId: input.scopeId,
+      digest: `sha256-${digest}`,
+      contributions,
+    };
+    return { ok: true, result };
+  }
+
+  async #uiStateQuery(
+    input: ExtensionUiStateQueryInput,
+  ): Promise<OperationOutcome<'extension.ui.state.query'>> {
+    const denied = this.#authorizeUiState(input);
+    if (denied) return uiStateFailure(denied.code, denied.message);
+    try {
+      const result: ExtensionUiStateQueryResult = await this.uiState.get(
+        input.scopeId,
+        input.entryId,
+        input.key,
+      );
+      return { ok: true, result };
+    } catch (error) {
+      return uiStateFailure('persistence_failed', boundedErrorMessage(error));
+    }
+  }
+
+  #uiStateMutate(
+    input: ExtensionUiStateMutateInput,
+  ): Promise<OperationOutcome<'extension.ui.state.mutate'>> {
+    if (this.#draining)
+      return Promise.resolve(uiStateMutationFailure('host_draining', 'Runtime Host is draining'));
+    return this.#serializeMutation(async () => {
+      const denied = this.#authorizeUiState(input);
+      if (denied) return uiStateMutationFailure(denied.code, denied.message);
+      try {
+        const changed =
+          input.kind === 'set'
+            ? await this.uiState
+                .set(input.scopeId, input.entryId, input.key, input.value)
+                .then(() => true)
+            : await this.uiState.delete(input.scopeId, input.entryId, input.key);
+        const result: ExtensionUiStateMutateResult = { changed };
+        return { ok: true, result };
+      } catch (error) {
+        return uiStateMutationFailure('persistence_failed', boundedErrorMessage(error));
+      }
+    });
+  }
+
+  async #uiRpcInvoke(
+    input: ExtensionUiRpcInvokeInput,
+  ): Promise<OperationOutcome<'extension.ui.rpc.invoke'>> {
+    if (this.#draining) return uiRpcFailure('host_draining', 'Runtime Host is draining');
+    if (!this.uiPackages)
+      return uiRpcFailure('operation_unavailable', 'UI Host services are unavailable');
+    const denied = this.#authorizeUiRpc(input);
+    if (denied) return uiRpcFailure(denied.code, denied.message);
+    try {
+      const installed = await this.uiPackages.loadUi(input.extensionId);
+      const result: ExtensionUiRpcInvokeResult = {
+        value: (await new UiPackageService().invoke(
+          installed,
+          input.method,
+          input.args,
+          new AbortController().signal,
+        )) as ExtensionUiRpcInvokeResult['value'],
+      };
+      return { ok: true, result };
+    } catch (error) {
+      return uiRpcFailure('internal_failure', boundedErrorMessage(error));
+    }
+  }
+
+  #authorizeUiState(
+    input: ExtensionUiStateQueryInput,
+  ): { code: 'not_found' | 'invalid_request'; message: string } | undefined {
+    const entry = this.#readEntryState(input.entryId);
+    if (!entry) return { code: 'not_found', message: 'UI Extension entry is not installed' };
+    const current = this.runtime.inspect(input.entryId).current;
+    if (
+      !entry.enabled ||
+      entry.scopeId !== input.scopeId ||
+      entry.extensionId !== input.extensionId ||
+      current?.generation !== input.generation
+    ) {
+      return {
+        code: 'invalid_request',
+        message: 'UI Extension bridge identity is stale or inactive',
+      };
+    }
+    const admitted = this.runtime
+      .inspectUi(input.scopeId)
+      .some(
+        (item) =>
+          item.entryId === input.entryId &&
+          item.extensionId === input.extensionId &&
+          item.generation === input.generation &&
+          item.hostState,
+      );
+    return admitted
+      ? undefined
+      : { code: 'invalid_request', message: 'UI Extension did not declare Host state permission' };
+  }
+
+  #authorizeUiRpc(
+    input: ExtensionUiRpcInvokeInput,
+  ): { code: 'not_found' | 'invalid_request'; message: string } | undefined {
+    const entry = this.#readEntryState(input.entryId);
+    if (!entry) return { code: 'not_found', message: 'UI Extension entry is not installed' };
+    const current = this.runtime.inspect(input.entryId).current;
+    if (
+      !entry.enabled ||
+      entry.scopeId !== input.scopeId ||
+      entry.extensionId !== input.extensionId ||
+      current?.generation !== input.generation
+    ) {
+      return {
+        code: 'invalid_request',
+        message: 'UI Extension bridge identity is stale or inactive',
+      };
+    }
+    const admitted = this.runtime
+      .inspectUi(input.scopeId)
+      .some(
+        (item) =>
+          item.entryId === input.entryId &&
+          item.extensionId === input.extensionId &&
+          item.generation === input.generation &&
+          item.hostMethods.includes(input.method),
+      );
+    return admitted
+      ? undefined
+      : {
+          code: 'invalid_request',
+          message: 'UI Host method is not declared by the active Fiber',
+        };
+  }
+
+  #installPackage(
+    input: ToolPackageInstallInput,
+  ): Promise<OperationOutcome<'extension.package.install'>> {
+    if (this.#draining) {
+      return Promise.resolve(packageFailure('host_draining', 'Runtime Host is draining'));
+    }
+    return this.#serializeMutation(async () => {
+      if (this.#persistenceFailure) {
+        return packageFailure('persistence_failed', 'Extension state is unavailable');
+      }
+      if (!this.loader.installPackage) {
+        return packageFailure('operation_unavailable', 'Tool package installation is unavailable');
+      }
+      try {
+        const result: ToolPackageInstallResult = await this.loader.installPackage(input.sourcePath);
+        return { ok: true, result };
+      } catch (error) {
+        return packageLoaderFailure(error, 'install');
+      }
+    });
+  }
+
+  #uninstallPackage(
+    input: ToolPackageUninstallInput,
+  ): Promise<OperationOutcome<'extension.package.uninstall'>> {
+    if (this.#draining) {
+      return Promise.resolve(packageFailure('host_draining', 'Runtime Host is draining'));
+    }
+    return this.#serializeMutation(async () => {
+      if (this.#persistenceFailure) {
+        return packageFailure('persistence_failed', 'Extension state is unavailable');
+      }
+      if (!this.loader.uninstallPackage) {
+        return packageFailure(
+          'operation_unavailable',
+          'Tool package uninstallation is unavailable',
+        );
+      }
+      const referenced = [...this.#entries.values()].find(
+        (entry) => entry.extensionId === input.extensionId,
+      );
+      if (referenced) {
+        return packageFailure(
+          'operation_conflict',
+          `Tool package is retained by entry ${referenced.entryId}`,
+        );
+      }
+      try {
+        if (
+          this.runtime.installedExtensions().some((item) => item.extensionId === input.extensionId)
+        ) {
+          await this.runtime.uninstall(input.extensionId);
+        }
+        await this.loader.uninstallPackage(input.extensionId);
+        return { ok: true, result: {} };
+      } catch (error) {
+        return packageLoaderFailure(error, 'uninstall');
+      }
+    });
+  }
+
+  #exportPackage(
+    input: ExtensionPackageExportInput,
+  ): Promise<OperationOutcome<'extension.package.export'>> {
+    if (this.#draining) {
+      return Promise.resolve({
+        ok: false,
+        error: { code: 'host_draining', message: 'Runtime Host is draining' },
+      });
+    }
+    return this.#serializeMutation(async () => {
+      if (!this.loader.exportPackage) {
+        return {
+          ok: false,
+          error: {
+            code: 'operation_unavailable',
+            message: 'Extension package export is unavailable',
+          },
+        };
+      }
+      try {
+        await this.loader.exportPackage(input.extensionId, input.targetPath);
+        const result: ExtensionPackageExportResult = { targetPath: input.targetPath };
+        return { ok: true, result };
+      } catch (error) {
+        const failure = packageLoaderFailure(error, 'export');
+        return failure;
+      }
+    });
+  }
+
+  #mutate(
+    input: ExtensionCompositionMutateInput,
+  ): Promise<OperationOutcome<'extension.composition.mutate'>> {
+    if (this.#draining) {
+      return Promise.resolve(mutationFailure('host_draining', 'Runtime Host is draining'));
+    }
+    return this.#serializeMutation(async () => {
+      if (this.#persistenceFailure) {
+        return mutationFailure('persistence_failed', 'Extension state is unavailable');
+      }
+      switch (input.kind) {
+        case 'enable':
+          return this.#enable(input);
+        case 'disable':
+          return this.#disable(input.entryId);
+        case 'reload':
+          return this.#reload(input.entryId);
+        case 'remove':
+          return this.#remove(input.entryId);
+      }
+    });
+  }
+
+  async #enable(
+    input: Extract<ExtensionCompositionMutateInput, { kind: 'enable' }>,
+  ): Promise<OperationOutcome<'extension.composition.mutate'>> {
+    const available = await this.#requireAvailable(input.extensionId);
+    if (available) return available;
+    const current = this.#entries.get(input.entryId);
+    if (
+      current &&
+      (current.scopeId !== input.scopeId || current.extensionId !== input.extensionId)
+    ) {
+      return mutationFailure(
+        'operation_conflict',
+        `Entry ${input.entryId} cannot change scope or Extension identity`,
+      );
+    }
+    const compositionSnapshot = this.#persistedComposition;
+    let dependencyEntries: readonly string[];
+    let configuration: Readonly<Record<string, string | number | boolean>>;
+    try {
+      const contract = await this.#requireContract(input.extensionId);
+      dependencyEntries = await this.#stageDependencies(input.scopeId, contract, new Set());
+      configuration = validateExtensionConfiguration(contract.configuration, current?.config);
+    } catch (error) {
+      this.#persistedComposition = compositionSnapshot;
+      return mutationFailure('operation_conflict', boundedErrorMessage(error));
+    }
+    this.#entries.set(
+      input.entryId,
+      entryState({
+        entryId: input.entryId,
+        scopeId: input.scopeId,
+        extensionId: input.extensionId,
+        enabled: true,
+        error: null,
+        config: configuration,
+      }),
+    );
+    const committed = await this.#commitDesiredState(compositionSnapshot);
+    if (committed) return committed;
+    for (const dependencyEntryId of dependencyEntries) {
+      const dependency = await this.#convergeMutation(dependencyEntryId);
+      if (!dependency.ok) return dependency;
+    }
+    return this.#convergeMutation(input.entryId);
+  }
+
+  async #reload(entryId: string): Promise<OperationOutcome<'extension.composition.mutate'>> {
+    const entry = this.#entries.get(entryId);
+    if (!entry) return mutationFailure('not_found', `Extension entry not found: ${entryId}`);
+    const available = await this.#requireAvailable(entry.extensionId);
+    if (available) return available;
+    const compositionSnapshot = this.#persistedComposition;
+    let dependencyEntries: readonly string[];
+    let configuration: Readonly<Record<string, string | number | boolean>>;
+    try {
+      const contract = await this.#requireContract(entry.extensionId);
+      dependencyEntries = await this.#stageDependencies(entry.scopeId, contract, new Set());
+      configuration = validateExtensionConfiguration(contract.configuration, entry.config);
+      // Like DSH's loader, reload the plugin definition and let the Fiber
+      // replacement transaction keep the old Fiber alive on activation failure.
+      await this.runtime.installExtension(await this.loader.load(entry.extensionId));
+    } catch (error) {
+      this.#persistedComposition = compositionSnapshot;
+      return mutationFailure('operation_conflict', boundedErrorMessage(error));
+    }
+    this.#entries.set(
+      entryId,
+      entryState({
+        ...entry,
+        enabled: true,
+        error: null,
+        config: configuration,
+      }),
+    );
+    const committed = await this.#commitDesiredState(compositionSnapshot);
+    if (committed) return committed;
+    for (const dependencyEntryId of dependencyEntries) {
+      const dependency = await this.#convergeMutation(dependencyEntryId);
+      if (!dependency.ok) return dependency;
+    }
+    return this.#convergeMutation(entryId);
+  }
+
+  async #disable(entryId: string): Promise<OperationOutcome<'extension.composition.mutate'>> {
+    const entry = this.#entries.get(entryId);
+    if (!entry) return mutationFailure('not_found', `Extension entry not found: ${entryId}`);
+    let dependent: CompositionEntryState | undefined;
+    try {
+      dependent = await this.#requiredBy(entry);
+    } catch (error) {
+      return mutationFailure('operation_conflict', boundedErrorMessage(error));
+    }
+    if (dependent) {
+      return mutationFailure(
+        'operation_conflict',
+        `Extension entry ${entryId} is required by ${dependent.entryId}`,
+      );
+    }
+    const compositionSnapshot = this.#persistedComposition;
+    this.#entries.set(entryId, entryState({ ...entry, enabled: false, error: null }));
+    const committed = await this.#commitDesiredState(compositionSnapshot);
+    if (committed) return committed;
+    try {
+      if (this.#tryInspect(entryId)) {
+        await this.#applyComposition({
+          operations: [{ type: 'update', entryId: entryId, patch: { disabled: true } }],
+        });
+      }
+      await this.#pruneOrphanDependencyEntries();
+      await this.#refreshRuntimeState();
+      const persisted = await this.#commitDesiredState();
+      return persisted ?? mutationSuccess(this.#projection(entryId));
+    } catch (error) {
+      return this.#recordRuntimeFailure(entryId, error);
+    }
+  }
+
+  async #remove(entryId: string): Promise<OperationOutcome<'extension.composition.mutate'>> {
+    const entry = this.#entries.get(entryId);
+    if (!entry) return mutationFailure('not_found', `Extension entry not found: ${entryId}`);
+    let dependent: CompositionEntryState | undefined;
+    try {
+      dependent = await this.#requiredBy(entry);
+    } catch (error) {
+      return mutationFailure('operation_conflict', boundedErrorMessage(error));
+    }
+    if (dependent) {
+      return mutationFailure(
+        'operation_conflict',
+        `Extension entry ${entryId} is required by ${dependent.entryId}`,
+      );
+    }
+    const compositionSnapshot = this.#persistedComposition;
+    this.#entries.delete(entryId);
+    const committed = await this.#commitDesiredState(compositionSnapshot);
+    if (committed) return committed;
+    try {
+      if (this.#tryInspect(entryId)) {
+        await this.#applyComposition({
+          operations: [{ type: 'remove', entryId: entryId }],
+        });
+      }
+      await this.uiState.clear(entry.scopeId, entry.entryId);
+      await this.#pruneOrphanDependencyEntries();
+      const persisted = await this.#commitDesiredState();
+      return persisted ?? mutationSuccess(null);
+    } catch (error) {
+      return mutationFailure('operation_conflict', boundedErrorMessage(error));
+    }
+  }
+
+  async #convergeMutation(
+    entryId: string,
+  ): Promise<OperationOutcome<'extension.composition.mutate'>> {
+    try {
+      await this.#convergeEntry(entryId);
+      await this.#refreshRuntimeState();
+      await this.#pruneOrphanDependencyEntries();
+      const persisted = await this.#commitDesiredState();
+      return persisted ?? mutationSuccess(this.#projection(entryId));
+    } catch (error) {
+      return this.#recordRuntimeFailure(entryId, error);
+    }
+  }
+
+  async #recordRuntimeFailure(
+    entryId: string,
+    error: unknown,
+  ): Promise<OperationOutcome<'extension.composition.mutate'>> {
+    const entry = this.#entries.get(entryId);
+    if (entry) {
+      this.#entries.set(entryId, entryState({ ...entry, error: boundedErrorMessage(error) }));
+    }
+    const persisted = await this.#commitDesiredState();
+    return persisted ?? mutationFailure('operation_conflict', boundedErrorMessage(error));
+  }
+
+  async #recoverEnabledEntries(): Promise<void> {
+    const enabled = [...this.#entries.values()]
+      .filter((entry) => entry.enabled && !entry.error)
+      .sort(compareEntry);
+    for (const entry of enabled) {
+      try {
+        await this.#ensureInstalled(entry.extensionId);
+      } catch (error) {
+        this.#entries.set(
+          entry.entryId,
+          entryState({ ...entry, error: boundedErrorMessage(error) }),
+        );
+      }
+    }
+    for (const original of enabled) {
+      const entry = this.#entries.get(original.entryId)!;
+      try {
+        await this.#convergeEntry(entry.entryId);
+      } catch (error) {
+        const latest = this.#entries.get(entry.entryId)!;
+        this.#entries.set(
+          entry.entryId,
+          entryState({ ...latest, error: boundedErrorMessage(error) }),
+        );
+      }
+    }
+  }
+
+  async #convergeEntry(entryId: string): Promise<void> {
+    const entry = this.#entries.get(entryId);
+    if (!entry || !entry.enabled) return;
+    await this.#ensureInstalled(entry.extensionId);
+    const inspection = this.#tryInspect(entryId);
+    const rootId: MakaPluginRootId =
+      entry.scopeId === 'profile'
+        ? 'profile'
+        : entry.scopeId === 'desktop-ui'
+          ? 'desktop-ui'
+          : `session:${entry.scopeId}`;
+    await this.#applyComposition({
+      operations: inspection
+        ? [
+            {
+              type: 'update',
+              entryId: entry.entryId,
+              patch: {
+                packageId: entry.extensionId,
+                disabled: false,
+                config: this.#configurationForEntry(entry.entryId),
+              },
+            },
+          ]
+        : [
+            {
+              type: 'insert',
+              rootId,
+              entry: {
+                id: entry.entryId,
+                packageId: entry.extensionId,
+                config: this.#configurationForEntry(entry.entryId),
+              },
+            },
+          ],
+    });
+  }
+
+  async #ensureInstalled(extensionId: string): Promise<void> {
+    if (this.runtime.installedExtensions().some((item) => item.extensionId === extensionId)) {
+      return;
+    }
+    await this.runtime.installExtension(await this.loader.load(extensionId));
+  }
+
+  async #recoverCompositionEntries(composition: PersistedPluginComposition): Promise<void> {
+    const roots: readonly (readonly [MakaPluginRootId, readonly PersistedPluginEntry[]])[] = [
+      ['profile', composition.roots.profile],
+      ['desktop-ui', composition.roots.desktopUi],
+      ...Object.entries(composition.roots.sessions).map(
+        ([scopeId, entries]) => [`session:${scopeId}` as MakaPluginRootId, entries] as const,
+      ),
+    ];
+    for (const [rootId, entries] of roots)
+      for (const entry of entries) await this.#recoverCompositionEntry(rootId, entry);
+  }
+
+  async #recoverCompositionEntry(
+    rootId: MakaPluginRootId,
+    entry: PersistedPluginEntry,
+    parentId?: string,
+  ): Promise<void> {
+    try {
+      await this.runtime.applyComposition({
+        operations: [
+          {
+            type: 'insert',
+            rootId,
+            parentId,
+            entry: persistedRuntimeEntry(entry),
+          },
+        ],
+      });
+    } catch (error) {
+      const currentEntry = this.#entries.get(entry.id);
+      if (currentEntry)
+        this.#entries.set(
+          entry.id,
+          entryState({ ...currentEntry, error: boundedErrorMessage(error) }),
+        );
+      return;
+    }
+    for (const child of entry.children ?? [])
+      await this.#recoverCompositionEntry(rootId, child, entry.id);
+  }
+
+  async #refreshRuntimeState(): Promise<void> {
+    for (const entry of [...this.#entries.values()]) {
+      const inspection = this.#tryInspect(entry.entryId);
+      if (!inspection) continue;
+      const error = inspection.diagnostic?.message ?? entry.error;
+      this.#entries.set(
+        entry.entryId,
+        entryState({
+          ...entry,
+          error: !inspection.diagnostic && inspection.status === 'active' ? null : error,
+        }),
+      );
+    }
+  }
+
+  #tryInspect(entryId: string): MakaPluginMountInspection | undefined {
+    try {
+      return this.runtime.inspect(entryId);
+    } catch {
+      return undefined;
+    }
+  }
+
+  async #applyComposition(
+    input: Parameters<HostExtensionRuntime['applyComposition']>[0],
+  ): Promise<void> {
+    await this.runtime.applyComposition(input);
+  }
+
+  #configurationForEntry(entryId: string): Readonly<Record<string, string | number | boolean>> {
+    return this.#readEntryState(entryId)?.config ?? Object.freeze({});
+  }
+
+  #readEntryState(entryId: string): CompositionEntryState | undefined {
+    return this.#entries.get(entryId);
+  }
+
+  async #requireAvailable(
+    extensionId: string,
+  ): Promise<OperationOutcome<'extension.composition.mutate'> | undefined> {
+    try {
+      await this.loader.load(extensionId);
+      return undefined;
+    } catch (error) {
+      if (error instanceof HostExtensionLoaderError && error.code === 'not_found') {
+        return mutationFailure('not_found', error.message);
+      }
+      return mutationFailure('operation_conflict', boundedErrorMessage(error));
+    }
+  }
+
+  async #requireContract(extensionId: string): Promise<ExtensionPackageContractProjection> {
+    const contracts = this.loader.contracts ? await this.loader.contracts() : [];
+    const contract = contracts.find((candidate) => candidate.extensionId === extensionId);
+    if (!contract) {
+      throw new Error(`Extension contract is unavailable: ${extensionId}`);
+    }
+    return contract;
+  }
+
+  async #stageDependencies(
+    scopeId: string,
+    contract: ExtensionPackageContractProjection,
+    visiting: Set<string>,
+  ): Promise<readonly string[]> {
+    if (visiting.has(contract.extensionId)) {
+      throw new Error(`Extension dependency cycle includes ${contract.extensionId}`);
+    }
+    visiting.add(contract.extensionId);
+    const staged: string[] = [];
+    try {
+      const contracts = this.loader.contracts ? await this.loader.contracts() : [];
+      for (const dependency of contract.dependencies) {
+        const selected = contracts.find((candidate) => candidate.extensionId === dependency.id);
+        if (!selected) {
+          throw new Error(`Required dependency is not installed: ${dependency.id}`);
+        }
+        const existing = [...this.#entries.values()].find(
+          (entry) => entry.scopeId === scopeId && entry.extensionId === dependency.id,
+        );
+        const entryId = existing?.entryId ?? dependencyEntryId(scopeId, dependency.id);
+        if (existing) {
+          if (!existing.enabled) {
+            this.#entries.set(entryId, entryState({ ...existing, enabled: true, error: null }));
+          }
+        } else {
+          this.#entries.set(
+            entryId,
+            entryState({
+              entryId,
+              scopeId,
+              extensionId: selected.extensionId,
+              enabled: true,
+              error: null,
+              config: validateExtensionConfiguration(selected.configuration, undefined),
+            }),
+          );
+        }
+        const stagedEntry = this.#entries.get(entryId);
+        if (stagedEntry) {
+          this.#entries.set(
+            entryId,
+            entryState({
+              ...stagedEntry,
+              config: validateExtensionConfiguration(selected.configuration, stagedEntry.config),
+            }),
+          );
+        }
+        staged.push(...(await this.#stageDependencies(scopeId, selected, visiting)), entryId);
+      }
+      return Object.freeze([...new Set(staged)]);
+    } finally {
+      visiting.delete(contract.extensionId);
+    }
+  }
+
+  async #requiredBy(target: CompositionEntryState): Promise<CompositionEntryState | undefined> {
+    const contracts = this.loader.contracts ? await this.loader.contracts() : [];
+    return [...this.#entries.values()].find((entry) => {
+      if (!entry.enabled || entry.entryId === target.entryId) return false;
+      if (entry.scopeId !== target.scopeId) return false;
+      const contract = contracts.find((candidate) => candidate.extensionId === entry.extensionId);
+      return contract?.dependencies.some((dependency) => dependency.id === target.extensionId);
+    });
+  }
+
+  async #pruneOrphanDependencyEntries(): Promise<void> {
+    const contracts = this.loader.contracts ? await this.loader.contracts() : [];
+    const required = new Set<string>();
+    const visit = (entry: CompositionEntryState, visiting: Set<string>): void => {
+      if (visiting.has(entry.entryId)) return;
+      visiting.add(entry.entryId);
+      const contract = contracts.find((candidate) => candidate.extensionId === entry.extensionId);
+      for (const dependency of contract?.dependencies ?? []) {
+        const dependencyEntry = [...this.#entries.values()].find(
+          (candidate) =>
+            candidate.enabled &&
+            candidate.scopeId === entry.scopeId &&
+            candidate.extensionId === dependency.id,
+        );
+        if (!dependencyEntry) continue;
+        required.add(dependencyEntry.entryId);
+        visit(dependencyEntry, visiting);
+      }
+      visiting.delete(entry.entryId);
+    };
+    for (const entry of this.#entries.values()) {
+      if (entry.enabled && !entry.entryId.startsWith('dependency_')) {
+        visit(entry, new Set());
+      }
+    }
+    for (const entry of [...this.#entries.values()]) {
+      if (!entry.entryId.startsWith('dependency_') || required.has(entry.entryId)) continue;
+      if (this.#tryInspect(entry.entryId)) {
+        await this.#applyComposition({
+          operations: [{ type: 'remove', entryId: entry.entryId }],
+        });
+      }
+      this.#entries.delete(entry.entryId);
+    }
+  }
+
+  async #commitDesiredState(
+    rollback?: PersistedPluginComposition,
+  ): Promise<OperationOutcome<'extension.composition.mutate'> | undefined> {
+    try {
+      await this.#persist();
+      return undefined;
+    } catch (error) {
+      const failure = asPersistenceFailure(error);
+      if (failure.code === 'commit_outcome_unknown') this.requestDrain();
+      else if (rollback) this.#persistedComposition = rollback;
+      return mutationFailure(
+        failure.code === 'invalid_state' ? 'persistence_failed' : failure.code,
+        failure.message,
+      );
+    }
+  }
+
+  async #persist(): Promise<void> {
+    const snapshot: PersistedPluginComposition = {
+      schemaVersion: 1,
+      generation: ++this.#compositionGeneration,
+      roots: this.#persistedComposition.roots,
+    };
+    await this.store.replace(snapshot);
+    this.#persistedComposition = snapshot;
+  }
+
+  #entryProjections(): readonly ExtensionCompositionEntryProjection[] {
+    const entryIds = persistedEntries(this.#persistedComposition)
+      .filter(([, entry]) => entry.packageId)
+      .map(([, entry]) => entry.id);
+    return entryIds.sort(compareString).map((entryId) => this.#projection(entryId));
+  }
+
+  #projection(entryId: string): ExtensionCompositionEntryProjection {
+    const entry = this.#readEntryState(entryId);
+    if (!entry) throw new Error(`Extension entry not found: ${entryId}`);
+    const inspection = this.#tryInspect(entryId);
+    return {
+      entryId: entry.entryId,
+      scopeId: entry.scopeId,
+      extensionId: entry.extensionId,
+      generation: inspection?.current?.generation ?? 1,
+      enabled: entry.enabled,
+      status: projectStatus(entry, inspection),
+      error: entry.error,
+    };
+  }
+
+  #serializeMutation<T>(operation: () => Promise<T>): Promise<T> {
+    const result = this.#mutationTail.then(operation, operation);
+    this.#mutationTail = result.then(
+      () => undefined,
+      () => undefined,
+    );
+    return result;
+  }
+}
+
+function invocationContext(context: MakaToolContext) {
+  return {
+    sessionId: context.sessionId,
+    ...(context.runId ? { runId: context.runId } : {}),
+    turnId: context.turnId,
+    cwd: context.cwd,
+    permissionMode: context.permissionMode ?? 'default',
+    origin: 'provider' as const,
+    configuration: Object.freeze({}),
+    signal: context.abortSignal,
+  };
+}
+
+class CompositionEntryIndex {
+  constructor(
+    private readonly read: () => PersistedPluginComposition,
+    private readonly write: (composition: PersistedPluginComposition) => void,
+  ) {}
+
+  get(entryId: string): CompositionEntryState | undefined {
+    const persisted = persistedEntries(this.read()).find(([, entry]) => entry.id === entryId);
+    return persisted ? compositionEntryState(...persisted) : undefined;
+  }
+
+  values(): IterableIterator<CompositionEntryState> {
+    return persistedEntries(this.read())
+      .flatMap(([scopeId, entry]) => {
+        const state = compositionEntryState(scopeId, entry);
+        return state ? [state] : [];
+      })
+      .values();
+  }
+
+  set(entryId: string, state: CompositionEntryState): void {
+    if (entryId !== state.entryId) throw new Error('Composition entry identity is immutable');
+    const composition = this.read();
+    const entry = persistedEntryState(state);
+    const updated = replacePersistedEntry(composition, entryId, entry);
+    this.write(updated ?? appendPersistedEntry(composition, state.scopeId, entry));
+  }
+
+  delete(entryId: string): void {
+    this.write(removePersistedEntry(this.read(), entryId));
+  }
+}
+
+function projectStatus(
+  entry: CompositionEntryState,
+  inspection: MakaPluginMountInspection | undefined,
+): ExtensionCompositionEntryProjection['status'] {
+  if (!entry.enabled) return 'disabled';
+  if (entry.error || inspection?.status === 'failed') return 'failed';
+  if (inspection?.current) return 'active';
+  return 'waiting';
+}
+
+function entryState(entry: CompositionEntryState): CompositionEntryState {
+  return Object.freeze({ ...entry });
+}
+
+function compositionEntryState(
+  scopeId: string,
+  entry: PersistedPluginEntry,
+): CompositionEntryState | undefined {
+  if (!entry.packageId) return undefined;
+  return entryState({
+    entryId: entry.id,
+    scopeId,
+    extensionId: entry.packageId,
+    enabled: !entry.disabled,
+    error: entry.error ?? null,
+    config: entry.config,
+  });
+}
+
+function persistedEntryState(state: CompositionEntryState): PersistedPluginEntry {
+  return Object.freeze({
+    id: state.entryId,
+    packageId: state.extensionId,
+    disabled: !state.enabled,
+    config: state.config,
+    error: state.error,
+  });
+}
+
+function boundedErrorMessage(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  const encoded = Buffer.from(message || 'Extension operation failed', 'utf8');
+  return encoded.byteLength <= 4096
+    ? encoded.toString('utf8')
+    : encoded
+        .subarray(0, 4093)
+        .toString('utf8')
+        .replace(/\uFFFD$/u, '') + '...';
+}
+
+function asPersistenceFailure(error: unknown): HostPluginCompositionStoreError {
+  return error instanceof HostPluginCompositionStoreError
+    ? error
+    : new HostPluginCompositionStoreError('persistence_failed', 'Extension state is unavailable', {
+        cause: error,
+      });
+}
+
+function mutationSuccess(
+  entry: ExtensionCompositionEntryProjection | null,
+): OperationOutcome<'extension.composition.mutate'> {
+  const result: ExtensionCompositionMutateResult = { entry };
+  return { ok: true, result };
+}
+
+function queryFailure(
+  code: 'persistence_failed',
+  message: string,
+): OperationOutcome<'extension.composition.query'> {
+  return { ok: false, error: { code, message } };
+}
+
+function uiSnapshotFailure(
+  code: 'persistence_failed',
+  message: string,
+): OperationOutcome<'extension.ui.snapshot'> {
+  return { ok: false, error: { code, message } };
+}
+
+function uiStateFailure(
+  code: 'not_found' | 'invalid_request' | 'persistence_failed',
+  message: string,
+): OperationOutcome<'extension.ui.state.query'> {
+  return { ok: false, error: { code, message } };
+}
+
+function uiStateMutationFailure(
+  code: 'host_draining' | 'not_found' | 'invalid_request' | 'persistence_failed',
+  message: string,
+): OperationOutcome<'extension.ui.state.mutate'> {
+  return { ok: false, error: { code, message } };
+}
+
+function uiRpcFailure(
+  code:
+    | 'host_draining'
+    | 'operation_unavailable'
+    | 'not_found'
+    | 'invalid_request'
+    | 'internal_failure',
+  message: string,
+): OperationOutcome<'extension.ui.rpc.invoke'> {
+  return { ok: false, error: { code, message } };
+}
+
+function mutationFailure(
+  code: MutationFailureCode,
+  message: string,
+): OperationOutcome<'extension.composition.mutate'> {
+  return { ok: false, error: { code, message } };
+}
+
+function packageFailure(
+  code:
+    | 'host_draining'
+    | 'operation_unavailable'
+    | 'not_found'
+    | 'operation_conflict'
+    | 'invalid_request'
+    | 'persistence_failed',
+  message: string,
+): OperationOutcome<'extension.package.install'> &
+  OperationOutcome<'extension.package.uninstall'> &
+  OperationOutcome<'extension.package.export'> {
+  return { ok: false, error: { code, message } };
+}
+
+function packageLoaderFailure(
+  error: unknown,
+  operation: 'install' | 'uninstall' | 'export',
+): OperationOutcome<'extension.package.install'> &
+  OperationOutcome<'extension.package.uninstall'> &
+  OperationOutcome<'extension.package.export'> {
+  if (error instanceof HostExtensionLoaderError) {
+    const code =
+      error.code === 'not_found'
+        ? 'not_found'
+        : error.code === 'invalid_definition'
+          ? operation === 'install'
+            ? 'invalid_request'
+            : 'operation_conflict'
+          : 'persistence_failed';
+    return packageFailure(code, error.message);
+  }
+  return packageFailure('operation_conflict', boundedErrorMessage(error));
+}
+
+function compareEntry(
+  left: Pick<CompositionEntryState, 'entryId'>,
+  right: Pick<CompositionEntryState, 'entryId'>,
+): number {
+  return compareString(left.entryId, right.entryId);
+}
+
+function persistedEntries(
+  composition: PersistedPluginComposition,
+): readonly (readonly [scopeId: string, entry: PersistedPluginEntry])[] {
+  return [
+    ...flattenPersistedEntries('profile', composition.roots.profile),
+    ...flattenPersistedEntries('desktop-ui', composition.roots.desktopUi),
+    ...Object.entries(composition.roots.sessions).flatMap(([scopeId, entries]) =>
+      flattenPersistedEntries(scopeId, entries),
+    ),
+  ];
+}
+
+function flattenPersistedEntries(
+  scopeId: string,
+  entries: readonly PersistedPluginEntry[],
+): readonly (readonly [scopeId: string, entry: PersistedPluginEntry])[] {
+  return entries.flatMap((entry) => [
+    [scopeId, entry] as const,
+    ...flattenPersistedEntries(scopeId, entry.children ?? []),
+  ]);
+}
+
+function emptyComposition(): PersistedPluginComposition {
+  return Object.freeze({
+    schemaVersion: 1,
+    generation: 0,
+    roots: Object.freeze({
+      profile: Object.freeze([]),
+      desktopUi: Object.freeze([]),
+      sessions: Object.freeze({}),
+    }),
+  });
+}
+
+function replacePersistedEntry(
+  composition: PersistedPluginComposition,
+  entryId: string,
+  replacement: PersistedPluginEntry,
+): PersistedPluginComposition | undefined {
+  const update = (
+    entries: readonly PersistedPluginEntry[],
+  ): readonly PersistedPluginEntry[] | undefined => {
+    let changed = false;
+    const next = entries.map((entry) => {
+      if (entry.id === entryId) {
+        changed = true;
+        return Object.freeze({ ...entry, ...replacement });
+      }
+      const children = update(entry.children ?? []);
+      if (!children) return entry;
+      changed = true;
+      return Object.freeze({ ...entry, children });
+    });
+    return changed ? Object.freeze(next) : undefined;
+  };
+  const profile = update(composition.roots.profile);
+  if (profile) return replaceCompositionRoots(composition, { profile });
+  const desktopUi = update(composition.roots.desktopUi);
+  if (desktopUi) return replaceCompositionRoots(composition, { desktopUi });
+  for (const [scopeId, entries] of Object.entries(composition.roots.sessions)) {
+    const session = update(entries);
+    if (session) {
+      return replaceCompositionRoots(composition, {
+        sessions: Object.freeze({ ...composition.roots.sessions, [scopeId]: session }),
+      });
+    }
+  }
+  return undefined;
+}
+
+function appendPersistedEntry(
+  composition: PersistedPluginComposition,
+  scopeId: string,
+  entry: PersistedPluginEntry,
+): PersistedPluginComposition {
+  if (scopeId === 'profile') {
+    return replaceCompositionRoots(composition, {
+      profile: Object.freeze([...composition.roots.profile, entry]),
+    });
+  }
+  if (scopeId === 'desktop-ui') {
+    return replaceCompositionRoots(composition, {
+      desktopUi: Object.freeze([...composition.roots.desktopUi, entry]),
+    });
+  }
+  return replaceCompositionRoots(composition, {
+    sessions: Object.freeze({
+      ...composition.roots.sessions,
+      [scopeId]: Object.freeze([...(composition.roots.sessions[scopeId] ?? []), entry]),
+    }),
+  });
+}
+
+function removePersistedEntry(
+  composition: PersistedPluginComposition,
+  entryId: string,
+): PersistedPluginComposition {
+  const remove = (
+    entries: readonly PersistedPluginEntry[],
+  ): readonly PersistedPluginEntry[] | undefined => {
+    let changed = false;
+    const next = entries.flatMap((entry) => {
+      if (entry.id === entryId) {
+        changed = true;
+        return [];
+      }
+      const children = remove(entry.children ?? []);
+      if (!children) return [entry];
+      changed = true;
+      return [Object.freeze({ ...entry, children })];
+    });
+    return changed ? Object.freeze(next) : undefined;
+  };
+  const profile = remove(composition.roots.profile);
+  const desktopUi = remove(composition.roots.desktopUi);
+  const sessions = Object.entries(composition.roots.sessions).map(([scopeId, entries]) => {
+    const next = remove(entries);
+    return [scopeId, next ?? entries] as const;
+  });
+  if (
+    !profile &&
+    !desktopUi &&
+    sessions.every(([scopeId, entries]) => entries === composition.roots.sessions[scopeId])
+  ) {
+    return composition;
+  }
+  return replaceCompositionRoots(composition, {
+    profile: profile ?? composition.roots.profile,
+    desktopUi: desktopUi ?? composition.roots.desktopUi,
+    sessions: Object.freeze(Object.fromEntries(sessions)),
+  });
+}
+
+function replaceCompositionRoots(
+  composition: PersistedPluginComposition,
+  patch: Partial<PersistedPluginComposition['roots']>,
+): PersistedPluginComposition {
+  return Object.freeze({
+    ...composition,
+    roots: Object.freeze({ ...composition.roots, ...patch }),
+  });
+}
+
+function runtimeSnapshot(composition: PersistedPluginComposition): MakaCompositionSnapshot {
+  const convert = (entry: PersistedPluginEntry): MakaCompositionEntry =>
+    persistedRuntimeEntry(entry);
+  return Object.freeze({
+    schemaVersion: 1,
+    generation: composition.generation,
+    roots: Object.freeze({
+      profile: Object.freeze(composition.roots.profile.map(convert)),
+      desktopUi: Object.freeze(composition.roots.desktopUi.map(convert)),
+      sessions: Object.freeze(
+        Object.fromEntries(
+          Object.entries(composition.roots.sessions).map(([scopeId, entries]) => [
+            scopeId,
+            Object.freeze(entries.map(convert)),
+          ]),
+        ),
+      ),
+    }),
+  });
+}
+
+function persistedRuntimeEntry(entry: PersistedPluginEntry): MakaCompositionEntry {
+  return Object.freeze({
+    id: entry.id,
+    ...(entry.packageId ? { packageId: entry.packageId } : {}),
+    config: entry.config,
+    disabled: entry.disabled,
+    ...(entry.inject === undefined ? {} : { inject: entry.inject }),
+    ...(entry.isolate === undefined ? {} : { isolate: entry.isolate }),
+    ...(entry.intercept === undefined ? {} : { intercept: entry.intercept }),
+    ...(entry.children === undefined
+      ? {}
+      : { children: Object.freeze(entry.children.map(persistedRuntimeEntry)) }),
+  });
+}
+
+function compareString(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+function dependencyEntryId(scopeId: string, extensionId: string): string {
+  return `dependency_${createHash('sha256')
+    .update(`${scopeId}\u0000${extensionId}`)
+    .digest('hex')
+    .slice(0, 32)}`;
+}
+
+function redactSecretConfiguration(
+  contract: ExtensionPackageContractProjection,
+  configuration: Readonly<Record<string, string | number | boolean>>,
+): Readonly<Record<string, string | number | boolean>> {
+  return Object.freeze(
+    Object.fromEntries(
+      Object.entries(configuration).filter(
+        ([key]) => contract.configuration.properties[key]?.secret !== true,
+      ),
+    ),
+  );
+}
diff --git a/packages/runtime-host/src/server/extension-loader.ts b/packages/runtime-host/src/server/extension-loader.ts
new file mode 100644
index 0000000000..72c756d3d6
--- /dev/null
+++ b/packages/runtime-host/src/server/extension-loader.ts
@@ -0,0 +1,846 @@
+import { isCanonicalExtensionId } from '@maka/runtime/plugin-runtime';
+import type {
+  ExtensionConfigurationScalar,
+  ExtensionPackageContractProjection,
+  TrustedExtensionProjection,
+} from '../protocol/index.js';
+import type {
+  HostExtensionInput,
+  HostPreparedPluginPackageInput,
+  HostToolExtensionInput,
+  HostTrustedToolExtensionInput,
+  HostUiExtensionInput,
+} from './extension-runtime.js';
+import type { ExtensionEventInvocationContext } from '@maka/runtime/extension-event-contributions';
+import type { ExtensionServiceInvocationContext } from '@maka/runtime/extension-service-contributions';
+import type {
+  PackageInvocationContext,
+  PackageServiceCaller,
+} from './in-process-package-runtime.js';
+import { InProcessPackageActivation } from './in-process-package-runtime.js';
+import { PluginHookActivation } from './plugin-hook-activation.js';
+import { type InstalledEventPackage } from './plugin-hook-manifest.js';
+import { type InstalledToolPackage } from './plugin-runtime-manifest.js';
+import { type InstalledUiPackage } from './plugin-ui-manifest.js';
+import { UiPackageService } from './ui-package-service.js';
+import { dirname, join } from 'node:path';
+import { exportExtensionBundle, materializeExtensionPackage } from './extension-bundle.js';
+import { type ExtensionPackageManifest } from './extension-package-manifest.js';
+import {
+  type InstalledPluginPackage,
+  PluginPackageStore,
+  PluginPackageStoreError,
+} from './plugin-package-store.js';
+
+export type StaticTrustedToolExtension = HostTrustedToolExtensionInput;
+
+export class HostExtensionLoaderError extends Error {
+  readonly name = 'HostExtensionLoaderError';
+
+  constructor(
+    readonly code: 'not_found' | 'invalid_definition' | 'load_failed',
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+export interface HostTrustedToolExtensionLoader {
+  list(): Promise<readonly TrustedExtensionProjection[]>;
+  load(extensionId: string): Promise<HostExtensionInput>;
+  installPackage?(sourcePath: string): Promise<TrustedExtensionProjection>;
+  uninstallPackage?(extensionId: string): Promise<void>;
+  contracts?(): Promise<readonly ExtensionPackageContractProjection[]>;
+  exportPackage?(extensionId: string, targetPath: string): Promise<void>;
+  setConfigurationResolver?(
+    resolver: (entryId: string) => Readonly<Record<string, ExtensionConfigurationScalar>>,
+  ): void;
+  setEventEmitter?(
+    emitter: (
+      scopeId: string,
+      event: string,
+      payload: unknown,
+      context: ExtensionEventInvocationContext,
+    ) => Promise<unknown>,
+  ): void;
+  setServiceCaller?(
+    caller: (
+      scopeId: string,
+      service: string,
+      method: string,
+      input: unknown,
+      context: ExtensionServiceInvocationContext,
+    ) => Promise<unknown>,
+  ): void;
+  setUiStatePublisher?(
+    publisher: (extensionId: string, key: string, value: unknown) => Promise<void>,
+  ): void;
+}
+
+/**
+ * Loader for Tools explicitly registered by the trusted Host composition.
+ *
+ * It never resolves a path or executes workspace code. Installed trusted
+ * packages use the same lifecycle registry but a dynamic in-process loader.
+ */
+export class StaticTrustedToolExtensionLoader implements HostTrustedToolExtensionLoader {
+  readonly #definitions = new Map<string, HostTrustedToolExtensionInput>();
+  readonly #catalog: readonly TrustedExtensionProjection[];
+
+  constructor(definitions: readonly StaticTrustedToolExtension[] = []) {
+    for (const definition of definitions) {
+      assertDefinition(definition);
+      const key = definition.extensionId;
+      if (this.#definitions.has(key)) {
+        throw new HostExtensionLoaderError(
+          'invalid_definition',
+          `Trusted Extension is registered more than once: ${key}`,
+        );
+      }
+      this.#definitions.set(key, freezeDefinition(definition));
+    }
+    this.#catalog = Object.freeze(
+      [...this.#definitions.values()]
+        .map((definition) =>
+          Object.freeze({
+            extensionId: definition.extensionId,
+            toolNames: Object.freeze(definition.tools.map(({ name }) => name).sort(compareString)),
+            uiContributionIds: Object.freeze([]),
+            eventContributionIds: Object.freeze([]),
+          }),
+        )
+        .sort((left, right) => compareString(left.extensionId, right.extensionId)),
+    );
+  }
+
+  async list(): Promise<readonly TrustedExtensionProjection[]> {
+    return this.#catalog;
+  }
+
+  async load(extensionId: string): Promise<HostTrustedToolExtensionInput> {
+    const definition = this.#definitions.get(extensionId);
+    if (!definition) {
+      throw new HostExtensionLoaderError(
+        'not_found',
+        `Trusted Extension is not available: ${extensionId}`,
+      );
+    }
+    return definition;
+  }
+
+  async contracts(): Promise<readonly ExtensionPackageContractProjection[]> {
+    return Object.freeze(
+      [...this.#definitions.values()]
+        .map((definition) =>
+          Object.freeze({
+            extensionId: definition.extensionId,
+            displayName: definition.extensionId,
+            description: '',
+            dependencies: Object.freeze(
+              (definition.dependencies ?? []).map(({ extensionId: id }) => Object.freeze({ id })),
+            ),
+            configuration: Object.freeze({
+              properties: Object.freeze({}),
+              required: Object.freeze([]),
+            }),
+            contributions: Object.freeze(
+              definition.tools.map((tool) =>
+                Object.freeze({
+                  kind: 'tool' as const,
+                  id: tool.name,
+                  name: tool.name,
+                  description: tool.description,
+                }),
+              ),
+            ),
+          }),
+        )
+        .sort((left, right) => compareString(left.extensionId, right.extensionId)),
+    );
+  }
+}
+
+/** Combines Host-composed static Tools with real packages installed in the root-private Store. */
+export class InstalledPluginPackageLoader implements HostTrustedToolExtensionLoader {
+  #configurationFor: (entryId: string) => Readonly<Record<string, ExtensionConfigurationScalar>> =
+    () => Object.freeze({});
+  #emitEvent: (
+    scopeId: string,
+    event: string,
+    payload: unknown,
+    context: ExtensionEventInvocationContext,
+  ) => Promise<unknown> = async () => {
+    throw new Error('Extension Event emission is unavailable');
+  };
+  #callService: (
+    scopeId: string,
+    service: string,
+    method: string,
+    input: unknown,
+    context: ExtensionServiceInvocationContext,
+  ) => Promise<unknown> = async () => {
+    throw new Error('Extension Service calls are unavailable');
+  };
+  #publishUiState: (extensionId: string, key: string, value: unknown) => Promise<void> = async () =>
+    undefined;
+
+  constructor(
+    private readonly statics: StaticTrustedToolExtensionLoader,
+    private readonly packages: PluginPackageStore,
+  ) {}
+
+  setConfigurationResolver(
+    resolver: (entryId: string) => Readonly<Record<string, ExtensionConfigurationScalar>>,
+  ): void {
+    this.#configurationFor = resolver;
+  }
+
+  setEventEmitter(
+    emitter: (
+      scopeId: string,
+      event: string,
+      payload: unknown,
+      context: ExtensionEventInvocationContext,
+    ) => Promise<unknown>,
+  ): void {
+    this.#emitEvent = emitter;
+  }
+
+  setServiceCaller(
+    caller: (
+      scopeId: string,
+      service: string,
+      method: string,
+      input: unknown,
+      context: ExtensionServiceInvocationContext,
+    ) => Promise<unknown>,
+  ): void {
+    this.#callService = caller;
+  }
+
+  setUiStatePublisher(
+    publisher: (extensionId: string, key: string, value: unknown) => Promise<void>,
+  ): void {
+    this.#publishUiState = publisher;
+  }
+
+  async list(): Promise<readonly TrustedExtensionProjection[]> {
+    const combined = [...(await this.statics.list())];
+    for (const installed of await this.packages.list()) {
+      combined.push(projectPluginPackage(installed));
+    }
+    const keys = new Set<string>();
+    for (const item of combined) {
+      const key = item.extensionId;
+      if (keys.has(key)) {
+        throw new HostExtensionLoaderError(
+          'invalid_definition',
+          `Plugin exists in both static and installed catalogs: ${item.extensionId}`,
+        );
+      }
+      keys.add(key);
+    }
+    return Object.freeze(combined.sort(compareExtension));
+  }
+
+  async load(extensionId: string): Promise<HostExtensionInput> {
+    try {
+      return await this.statics.load(extensionId);
+    } catch (error) {
+      if (!(error instanceof HostExtensionLoaderError) || error.code !== 'not_found') throw error;
+    }
+    const installed = await this.#load(extensionId);
+    const { tool, ui, event } = packageViews(installed);
+    return combinedPackageInput({
+      tool,
+      ui: ui
+        ? {
+            installed: ui,
+            store: {
+              readDocument: (_package, path) => this.packages.readText(installed, path),
+            },
+          }
+        : undefined,
+      event,
+      metadata: installed.manifest,
+      configurationFor: this.#configurationFor,
+      emitEvent: (...args) => this.#emitEvent(...args),
+      callService: (...args) => this.#callService(...args),
+      publishUiState: (...args) => this.#publishUiState(...args),
+    });
+  }
+
+  async installPackage(sourcePath: string): Promise<TrustedExtensionProjection> {
+    const materialized = await materializeExtensionPackage(
+      sourcePath,
+      dirname(this.packages.root),
+    ).catch((error) => {
+      throw translatePackageError(error);
+    });
+    try {
+      const installed = await this.packages.install(materialized.root);
+      const staticConflict = (await this.statics.list()).some(
+        (item) => item.extensionId === installed.extensionId,
+      );
+      if (staticConflict) {
+        await this.packages.uninstall(installed.extensionId).catch(() => undefined);
+        throw new HostExtensionLoaderError(
+          'invalid_definition',
+          `Installed package conflicts with a static Extension: ${installed.extensionId}`,
+        );
+      }
+      return projectPluginPackage(installed);
+    } catch (error) {
+      throw translatePackageError(error);
+    } finally {
+      await materialized.dispose();
+    }
+  }
+
+  async contracts(): Promise<readonly ExtensionPackageContractProjection[]> {
+    const contracts = [...(await this.statics.contracts())];
+    for (const installed of await this.packages.list()) {
+      const { tool, ui, event } = packageViews(installed);
+      contracts.push(projectContract(tool, ui, event, installed.manifest));
+    }
+    return Object.freeze(
+      contracts.sort((left, right) => compareString(left.extensionId, right.extensionId)),
+    );
+  }
+
+  async exportPackage(extensionId: string, targetPath: string): Promise<void> {
+    const installed = await this.#load(extensionId);
+    await exportExtensionBundle(installed.root, targetPath).catch((error) => {
+      throw translatePackageError(error);
+    });
+  }
+
+  async uninstallPackage(extensionId: string): Promise<void> {
+    const staticExtension = (await this.statics.list()).some(
+      (item) => item.extensionId === extensionId,
+    );
+    if (staticExtension) {
+      throw new HostExtensionLoaderError(
+        'invalid_definition',
+        `Static Tool Extensions cannot be uninstalled: ${extensionId}`,
+      );
+    }
+    try {
+      await this.packages.uninstall(extensionId);
+    } catch (error) {
+      throw translatePackageError(error);
+    }
+  }
+
+  async #load(extensionId: string): Promise<InstalledPluginPackage> {
+    try {
+      return await this.packages.load(extensionId);
+    } catch (error) {
+      throw translatePackageError(error);
+    }
+  }
+}
+
+function packageViews(installed: InstalledPluginPackage): {
+  readonly tool?: InstalledToolPackage;
+  readonly ui?: InstalledUiPackage;
+  readonly event?: InstalledEventPackage;
+} {
+  return Object.freeze({
+    ...(installed.toolManifest
+      ? {
+          tool: Object.freeze({
+            extensionId: installed.extensionId,
+            root: installed.root,
+            entry: join(installed.root, ...installed.toolManifest.entry.split('/')),
+            manifest: installed.toolManifest,
+          }),
+        }
+      : {}),
+    ...(installed.uiManifest
+      ? {
+          ui: Object.freeze({
+            extensionId: installed.extensionId,
+            root: installed.root,
+            manifest: installed.uiManifest,
+          }),
+        }
+      : {}),
+    ...(installed.eventManifest
+      ? {
+          event: Object.freeze({
+            extensionId: installed.extensionId,
+            root: installed.root,
+            entry: join(installed.root, ...installed.eventManifest.entry.split('/')),
+            manifest: installed.eventManifest,
+          }),
+        }
+      : {}),
+  });
+}
+
+function projectPluginPackage(installed: InstalledPluginPackage): TrustedExtensionProjection {
+  const { tool, ui, event } = packageViews(installed);
+  const projections = [
+    tool ? projectPackage(tool) : undefined,
+    ui ? projectUiPackage(ui) : undefined,
+    event ? projectEventPackage(event) : undefined,
+  ].filter((item): item is TrustedExtensionProjection => Boolean(item));
+  return projections.reduce(mergeProjection);
+}
+
+function projectPackage(installed: InstalledToolPackage): TrustedExtensionProjection {
+  return Object.freeze({
+    extensionId: installed.extensionId,
+    toolNames: Object.freeze(installed.manifest.tools.map(({ name }) => name).sort(compareString)),
+    uiContributionIds: Object.freeze([]),
+    eventContributionIds: Object.freeze([]),
+  });
+}
+
+async function uiPackageInput(
+  store: {
+    readDocument(installed: InstalledUiPackage, path: string): Promise<string>;
+  },
+  installed: InstalledUiPackage,
+  metadata?: ExtensionPackageManifest,
+): Promise<HostUiExtensionInput> {
+  const service = new UiPackageService();
+  return Object.freeze({
+    extensionId: installed.extensionId,
+    ...(metadata?.dependencies.length
+      ? {
+          dependencies: Object.freeze(
+            metadata.dependencies.map(({ id: extensionId }) => Object.freeze({ extensionId })),
+          ),
+        }
+      : {}),
+    ui: Object.freeze(
+      await Promise.all(
+        installed.manifest.ui.map(async (item) =>
+          Object.freeze({
+            id: item.id,
+            surface: item.surface,
+            ...(item.slot ? { slot: item.slot } : {}),
+            slots: item.slots,
+            priority: item.priority,
+            document: await store.readDocument(installed, item.document),
+            network: installed.manifest.permissions.network,
+            hostState: installed.manifest.permissions.hostState,
+            hostMethods: Object.freeze(
+              installed.manifest.host?.methods.map(({ name }) => name) ?? [],
+            ),
+            sessionAccess:
+              installed.manifest.permissions.sessionAccess && item.surface === 'app.root',
+          }),
+        ),
+      ),
+    ),
+    healthCheck: () => service.healthCheck(installed),
+  });
+}
+
+function projectUiPackage(installed: InstalledUiPackage): TrustedExtensionProjection {
+  return Object.freeze({
+    extensionId: installed.extensionId,
+    toolNames: Object.freeze([]),
+    uiContributionIds: Object.freeze(installed.manifest.ui.map(({ id }) => id).sort(compareString)),
+    eventContributionIds: Object.freeze([]),
+  });
+}
+
+function projectEventPackage(installed: InstalledEventPackage): TrustedExtensionProjection {
+  return Object.freeze({
+    extensionId: installed.extensionId,
+    toolNames: Object.freeze([]),
+    uiContributionIds: Object.freeze([]),
+    eventContributionIds: Object.freeze(
+      [
+        ...installed.manifest.events.map(({ name }) => `event:${name}`),
+        ...installed.manifest.listeners.map(({ event, id }) => `listener:${event}:${id}`),
+      ].sort(compareString),
+    ),
+    ...(installed.manifest.services.length
+      ? {
+          serviceContributionIds: Object.freeze(
+            installed.manifest.services.map(({ name }) => name).sort(compareString),
+          ),
+        }
+      : {}),
+    ...(installed.manifest.timers.length
+      ? {
+          timerContributionIds: Object.freeze(
+            installed.manifest.timers.map(({ id }) => id).sort(compareString),
+          ),
+        }
+      : {}),
+  });
+}
+
+async function combinedPackageInput(input: {
+  readonly tool?: InstalledToolPackage;
+  readonly ui?: {
+    readonly installed: InstalledUiPackage;
+    readonly store: {
+      readDocument(installed: InstalledUiPackage, path: string): Promise<string>;
+    };
+  };
+  readonly event?: InstalledEventPackage;
+  readonly metadata?: ExtensionPackageManifest;
+  readonly configurationFor: (
+    entryId: string,
+  ) => Readonly<Record<string, ExtensionConfigurationScalar>>;
+  readonly emitEvent: (
+    scopeId: string,
+    event: string,
+    payload: unknown,
+    context: ExtensionEventInvocationContext,
+  ) => Promise<unknown>;
+  readonly callService: (
+    scopeId: string,
+    service: string,
+    method: string,
+    payload: unknown,
+    context: ExtensionServiceInvocationContext,
+  ) => Promise<unknown>;
+  readonly publishUiState: (extensionId: string, key: string, value: unknown) => Promise<void>;
+}): Promise<HostPreparedPluginPackageInput> {
+  const installed = input.tool ?? input.ui?.installed ?? input.event;
+  if (!installed) throw new HostExtensionLoaderError('not_found', 'Extension package is missing');
+  const uiInput = input.ui
+    ? await uiPackageInput(input.ui.store, input.ui.installed, input.metadata)
+    : undefined;
+  const configurationFor = input.configurationFor;
+  return Object.freeze({
+    extensionId: installed.extensionId,
+    ...(input.metadata?.dependencies.length
+      ? {
+          dependencies: Object.freeze(
+            input.metadata.dependencies.map(({ id: extensionId }) =>
+              Object.freeze({ extensionId }),
+            ),
+          ),
+        }
+      : {}),
+    toolNames: Object.freeze(input.tool?.manifest.tools.map(({ name }) => name) ?? []),
+    ...(uiInput ? { ui: uiInput.ui } : {}),
+    ...(input.event
+      ? {
+          eventContributionIds: Object.freeze([
+            ...input.event.manifest.events.map(({ name }) => `event:${name}`),
+            ...input.event.manifest.listeners.map(({ event, id }) => `listener:${event}:${id}`),
+          ]),
+          ...(input.event.manifest.services.length
+            ? {
+                serviceContributionIds: Object.freeze(
+                  input.event.manifest.services.map(({ name }) => name),
+                ),
+              }
+            : {}),
+          ...(input.event.manifest.timers.length
+            ? {
+                timerContributionIds: Object.freeze(
+                  input.event.manifest.timers.map(({ id }) => id),
+                ),
+              }
+            : {}),
+        }
+      : {}),
+    load: async (context: Parameters<HostPreparedPluginPackageInput['load']>[0]) => {
+      const configuration = configurationFor(context.entryId);
+      const emitEvent = (
+        event: string,
+        payload: unknown,
+        packageContext: PackageInvocationContext,
+      ) =>
+        input.emitEvent(packageContext.sessionId, event, payload, {
+          sessionId: packageContext.sessionId,
+          ...(packageContext.runId ? { runId: packageContext.runId } : {}),
+          turnId: packageContext.turnId,
+          cwd: packageContext.cwd,
+          permissionMode: packageContext.permissionMode ?? 'default',
+          origin: packageContext.origin ?? 'provider',
+          configuration,
+          signal: packageContext.abortSignal,
+          eventDepth: (packageContext.eventDepth ?? 0) + 1,
+        });
+      const declaredDependencies = new Set(input.metadata?.dependencies.map(({ id }) => id) ?? []);
+      const callService: PackageServiceCaller = (service, method, payload, packageContext) => {
+        const ownsService = service.startsWith(`${packageContext.callerExtensionId}.`);
+        const declaredProvider = [...declaredDependencies].find((id) =>
+          service.startsWith(`${id}.`),
+        );
+        if (!ownsService && !declaredProvider) {
+          throw new Error(
+            `Extension Service provider must be declared as a dependency: ${service}`,
+          );
+        }
+        return input.callService(packageContext.sessionId, service, method, payload, {
+          sessionId: packageContext.sessionId,
+          ...(packageContext.runId ? { runId: packageContext.runId } : {}),
+          turnId: packageContext.turnId,
+          cwd: packageContext.cwd,
+          permissionMode: packageContext.permissionMode ?? 'default',
+          origin: packageContext.origin ?? 'provider',
+          configuration,
+          signal: packageContext.abortSignal,
+          callerExtensionId: packageContext.callerExtensionId,
+          serviceDepth: (packageContext.serviceDepth ?? 0) + 1,
+        });
+      };
+      const toolActivation = input.tool
+        ? new InProcessPackageActivation(input.tool, configuration, emitEvent, callService)
+        : undefined;
+      const eventActivation = input.event
+        ? new PluginHookActivation(
+            input.event,
+            configuration,
+            emitEvent,
+            callService,
+            toolActivation,
+          )
+        : undefined;
+      return {
+        tools: Object.freeze(
+          (toolActivation?.tools() ?? []).map((tool) => {
+            const stateKey = input.tool?.manifest.tools.find(({ name }) => name === tool.name)
+              ?.visualization?.stateKey;
+            if (!stateKey) return tool;
+            return Object.freeze({
+              ...tool,
+              impl: async (...args: Parameters<typeof tool.impl>) => {
+                const result = await tool.impl(...args);
+                await input.publishUiState(installed.extensionId, stateKey, result);
+                return result;
+              },
+            });
+          }),
+        ),
+        ...(eventActivation
+          ? {
+              events: eventActivation.events(),
+              listeners: eventActivation.listeners(),
+              services: eventActivation.services(),
+              timers: eventActivation.timers(),
+            }
+          : {}),
+        healthCheck: async () => {
+          await toolActivation?.healthCheck(
+            input.tool?.manifest.tools.map(({ handler }) => handler) ?? [],
+          );
+          await uiInput?.healthCheck?.();
+          await eventActivation?.healthCheck();
+        },
+        dispose: async () => {
+          await Promise.allSettled([
+            ...(toolActivation ? [toolActivation.dispose()] : []),
+            ...(eventActivation ? [eventActivation.dispose()] : []),
+          ]);
+        },
+      };
+    },
+  });
+}
+
+function mergeProjection(
+  left: TrustedExtensionProjection,
+  right: TrustedExtensionProjection,
+): TrustedExtensionProjection {
+  return Object.freeze({
+    extensionId: left.extensionId,
+    toolNames: Object.freeze(
+      [...new Set([...left.toolNames, ...right.toolNames])].sort(compareString),
+    ),
+    uiContributionIds: Object.freeze(
+      [...new Set([...left.uiContributionIds, ...right.uiContributionIds])].sort(compareString),
+    ),
+    eventContributionIds: Object.freeze(
+      [...new Set([...left.eventContributionIds, ...right.eventContributionIds])].sort(
+        compareString,
+      ),
+    ),
+    ...((left.serviceContributionIds?.length ?? 0) + (right.serviceContributionIds?.length ?? 0) > 0
+      ? {
+          serviceContributionIds: Object.freeze(
+            [
+              ...new Set([
+                ...(left.serviceContributionIds ?? []),
+                ...(right.serviceContributionIds ?? []),
+              ]),
+            ].sort(compareString),
+          ),
+        }
+      : {}),
+    ...((left.timerContributionIds?.length ?? 0) + (right.timerContributionIds?.length ?? 0) > 0
+      ? {
+          timerContributionIds: Object.freeze(
+            [
+              ...new Set([
+                ...(left.timerContributionIds ?? []),
+                ...(right.timerContributionIds ?? []),
+              ]),
+            ].sort(compareString),
+          ),
+        }
+      : {}),
+  });
+}
+
+function projectContract(
+  tool: InstalledToolPackage | undefined,
+  ui: InstalledUiPackage | undefined,
+  event: InstalledEventPackage | undefined,
+  metadata: ExtensionPackageManifest | undefined,
+): ExtensionPackageContractProjection {
+  const installed = tool ?? ui ?? event;
+  if (!installed) throw new HostExtensionLoaderError('not_found', 'Extension package is missing');
+  return Object.freeze({
+    extensionId: installed.extensionId,
+    displayName: metadata?.displayName ?? installed.extensionId,
+    description: metadata?.description ?? '',
+    dependencies: Object.freeze(metadata?.dependencies.map(({ id }) => ({ id })) ?? []),
+    configuration:
+      metadata?.configuration ??
+      Object.freeze({ properties: Object.freeze({}), required: Object.freeze([]) }),
+    contributions: Object.freeze([
+      ...(tool?.manifest.tools.map((item) =>
+        Object.freeze({
+          kind: 'tool' as const,
+          id: item.name,
+          name: item.name,
+          description: item.description,
+        }),
+      ) ?? []),
+      ...(ui?.manifest.ui.map((item) =>
+        Object.freeze({
+          kind: 'ui' as const,
+          id: item.id,
+          surface: item.surface,
+          ...(item.slot ? { slot: item.slot } : {}),
+          ...(item.slots.length ? { slots: item.slots } : {}),
+        }),
+      ) ?? []),
+      ...(event?.manifest.events.map((item) =>
+        Object.freeze({
+          kind: 'event' as const,
+          id: item.name,
+          event: item.name,
+          description: item.description,
+          ...(item.mode === 'emit' ? {} : { mode: item.mode }),
+        }),
+      ) ?? []),
+      ...(event?.manifest.listeners.map((item) =>
+        Object.freeze({
+          kind: 'listener' as const,
+          id: item.id,
+          event: item.event,
+        }),
+      ) ?? []),
+      ...(event?.manifest.services.map((item) =>
+        Object.freeze({
+          kind: 'service' as const,
+          id: item.name,
+          name: item.name,
+          description: item.description,
+        }),
+      ) ?? []),
+      ...(event?.manifest.timers.map((item) =>
+        Object.freeze({
+          kind: 'timer' as const,
+          id: item.id,
+          name: item.id,
+          description: `Every ${item.intervalMs}ms`,
+        }),
+      ) ?? []),
+    ]),
+  });
+}
+
+function translatePackageError(error: unknown): HostExtensionLoaderError {
+  if (error instanceof HostExtensionLoaderError) return error;
+  if (error instanceof PluginPackageStoreError) {
+    return new HostExtensionLoaderError(
+      error.code === 'not_found'
+        ? 'not_found'
+        : error.code === 'invalid_package' || error.code === 'already_installed'
+          ? 'invalid_definition'
+          : 'load_failed',
+      error.message,
+      { cause: error },
+    );
+  }
+  return new HostExtensionLoaderError('load_failed', 'Extension package operation failed', {
+    cause: error,
+  });
+}
+
+function assertDefinition(definition: HostTrustedToolExtensionInput): void {
+  if (!definition || typeof definition !== 'object') {
+    throw new HostExtensionLoaderError('invalid_definition', 'Trusted Extension is required');
+  }
+  if (!isCanonicalExtensionId(definition.extensionId)) {
+    throw new HostExtensionLoaderError(
+      'invalid_definition',
+      'Trusted Extension extensionId is invalid',
+    );
+  }
+  if (!Array.isArray(definition.tools) || definition.tools.length === 0) {
+    throw new HostExtensionLoaderError(
+      'invalid_definition',
+      'Trusted Extension must declare at least one Tool',
+    );
+  }
+  const names = new Set<string>();
+  for (const tool of definition.tools) {
+    if (
+      !tool ||
+      typeof tool !== 'object' ||
+      typeof tool.name !== 'string' ||
+      tool.name.length === 0 ||
+      tool.name.length > 128 ||
+      /[\r\n\0]/u.test(tool.name) ||
+      typeof tool.description !== 'string' ||
+      typeof tool.impl !== 'function' ||
+      tool.parameters === undefined
+    ) {
+      throw new HostExtensionLoaderError('invalid_definition', 'Trusted Extension Tool is invalid');
+    }
+    const key = tool.name.toLowerCase();
+    if (names.has(key)) {
+      throw new HostExtensionLoaderError(
+        'invalid_definition',
+        `Trusted Extension repeats Tool name: ${tool.name}`,
+      );
+    }
+    names.add(key);
+  }
+}
+
+function freezeDefinition(
+  definition: HostTrustedToolExtensionInput,
+): HostTrustedToolExtensionInput {
+  return Object.freeze({
+    extensionId: definition.extensionId,
+    tools: Object.freeze(definition.tools.map((tool) => Object.freeze({ ...tool }))),
+    ...(definition.dependencies
+      ? {
+          dependencies: Object.freeze(
+            definition.dependencies.map((item) => Object.freeze({ ...item })),
+          ),
+        }
+      : {}),
+    ...(definition.healthCheck ? { healthCheck: definition.healthCheck } : {}),
+  });
+}
+
+function compareExtension(
+  left: TrustedExtensionProjection,
+  right: TrustedExtensionProjection,
+): number {
+  return compareString(left.extensionId, right.extensionId);
+}
+
+function compareString(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
diff --git a/packages/runtime-host/src/server/extension-package-management-tools.ts b/packages/runtime-host/src/server/extension-package-management-tools.ts
new file mode 100644
index 0000000000..680fe41061
--- /dev/null
+++ b/packages/runtime-host/src/server/extension-package-management-tools.ts
@@ -0,0 +1,793 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import type { MakaTool, MakaToolContext } from '@maka/runtime/tool-runtime';
+import { z } from 'zod';
+import type { OperationKey, OperationOutcome } from '../protocol/index.js';
+import type { ConnectionContext } from './operation-dispatcher.js';
+import type { HostExtensionController } from './extension-controller.js';
+
+const CATEGORIES = [
+  'read',
+  'web_read',
+  'file_write',
+  'fs_destructive',
+  'shell_safe',
+  'shell_unsafe',
+  'git_destructive',
+  'network_send',
+  'subagent',
+  'computer_use',
+  'client_capability',
+] as const;
+const RECOVERY_MODES = [
+  'replay_safe',
+  'idempotent',
+  'reconcile',
+  'reattach',
+  'outcome_unknown',
+  'never_auto_retry',
+] as const;
+const SURFACES = ['app.root', 'app.overlay', 'app.slot'] as const;
+const jsonSchema = z.record(z.string(), z.unknown());
+const extensionName = z
+  .string()
+  .regex(/^[A-Za-z][A-Za-z0-9_-]*(?:\.[A-Za-z][A-Za-z0-9_-]*)+$/u)
+  .max(192);
+const invokeToolInput = z.object({
+  toolName: z.string().min(1).max(128),
+  args: z.unknown(),
+});
+const emitEventInput = z.object({ event: extensionName, payload: z.unknown() });
+const callServiceInput = z.object({
+  service: extensionName,
+  method: z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u),
+  input: z.unknown(),
+});
+const uiStateValueSchema: z.ZodType<
+  null | boolean | number | string | readonly unknown[] | Readonly<Record<string, unknown>>
+> = z.lazy(() =>
+  z.union([
+    z.null(),
+    z.boolean(),
+    z.number().finite(),
+    z.string(),
+    z.array(uiStateValueSchema),
+    z.record(z.string(), uiStateValueSchema),
+  ]),
+);
+const publishUiStateInput = z.object({
+  extensionId: z.string().min(1).max(128),
+  key: z.string().min(1).max(128),
+  value: uiStateValueSchema,
+});
+const PACKAGE_TOOL_NAMES = new Set([
+  'inspect_package',
+  'define_package',
+  'manage_package',
+  'invoke_tool',
+  'emit_event',
+  'call_service',
+  'publish_ui_state',
+]);
+
+const configurationProperty = z
+  .object({
+    type: z.enum(['string', 'number', 'boolean']),
+    title: z.string().min(1).max(128).optional(),
+    description: z.string().max(1024).optional(),
+    default: z.union([z.string(), z.number(), z.boolean()]).optional(),
+    enum: z
+      .array(z.union([z.string(), z.number(), z.boolean()]))
+      .max(64)
+      .optional(),
+    secret: z.boolean().optional(),
+  })
+  .superRefine((input, context) => {
+    if (input.secret && input.default !== undefined) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['default'],
+        message: 'secret configuration must not declare a default value',
+      });
+    }
+  });
+
+const toolDeclaration = z.object({
+  name: z.string().min(1).max(128),
+  description: z.string().min(1).max(4096),
+  handler: z.string().min(1).max(128),
+  inputSchema: jsonSchema,
+  displayName: z.string().min(1).max(128).optional(),
+  category: z.enum(CATEGORIES).optional(),
+  recoveryMode: z.enum(RECOVERY_MODES).optional(),
+  visualization: z
+    .object({ stateKey: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u) })
+    .optional(),
+});
+
+const uiContribution = z
+  .object({
+    id: z.string().min(1).max(128),
+    surface: z.enum(SURFACES),
+    slot: z
+      .string()
+      .regex(/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/u)
+      .optional(),
+    slots: z
+      .array(z.string().regex(/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/u))
+      .max(32)
+      .optional(),
+    priority: z.number().int().min(-10_000).max(10_000),
+    document: z
+      .string()
+      .min(1)
+      .max(1024 * 1024),
+  })
+  .superRefine((input, context) => {
+    if (input.surface === 'app.slot' && !input.slot) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['slot'],
+        message: 'slot is required for app.slot',
+      });
+    }
+    if (input.surface !== 'app.slot' && input.slot !== undefined) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['slot'],
+        message: 'slot is only valid for app.slot',
+      });
+    }
+  });
+
+const customEventName = z
+  .string()
+  .regex(/^[A-Za-z][A-Za-z0-9_-]*(?:\.[A-Za-z][A-Za-z0-9_-]*)+$/u)
+  .max(192);
+const eventContractDeclaration = z.object({
+  name: customEventName,
+  description: z.string().max(4096).default(''),
+  mode: z
+    .enum(['emit', 'parallel', 'serial', 'bail', 'transform', 'observe', 'gate', 'around'])
+    .default('emit'),
+  payloadSchema: jsonSchema,
+  resultSchema: jsonSchema.optional(),
+});
+const serviceDeclaration = z.object({
+  name: customEventName,
+  version: z.string().min(1).max(128),
+  description: z.string().max(4096).default(''),
+  methods: z
+    .array(
+      z.object({
+        name: z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u),
+        description: z.string().max(4096).default(''),
+        handler: z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u),
+        inputSchema: jsonSchema,
+        outputSchema: jsonSchema,
+        timeoutMs: z.number().int().min(10).max(120_000).default(3_000),
+      }),
+    )
+    .min(1)
+    .max(64),
+});
+const timerDeclaration = z.object({
+  id: z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u),
+  handler: z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u),
+  intervalMs: z
+    .number()
+    .int()
+    .min(1_000)
+    .max(30 * 24 * 60 * 60 * 1_000),
+  initialDelayMs: z
+    .number()
+    .int()
+    .min(0)
+    .max(30 * 24 * 60 * 60 * 1_000)
+    .optional(),
+  timeoutMs: z.number().int().min(10).max(120_000).default(3_000),
+  payload: z.unknown().optional(),
+});
+const eventListenerDeclaration = z.object({
+  id: z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u),
+  event: customEventName,
+  handler: z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u),
+  priority: z.number().int().min(-10_000).max(10_000).default(0),
+  timeoutMs: z.number().int().min(10).max(120_000).default(3_000),
+});
+
+const definePackageInput = z
+  .object({
+    id: z.string().min(1).max(128),
+    displayName: z.string().min(1).max(128).optional(),
+    description: z.string().max(4096).optional(),
+    dependencies: z
+      .array(z.object({ id: z.string().min(1).max(128) }))
+      .max(64)
+      .optional(),
+    configuration: z
+      .object({
+        properties: z.record(z.string(), configurationProperty),
+        required: z.array(z.string()).max(128).optional(),
+      })
+      .optional(),
+    runtime: z
+      .object({
+        source: z
+          .string()
+          .min(1)
+          .max(256 * 1024),
+        tools: z.array(toolDeclaration).max(64).default([]),
+        events: z.array(eventContractDeclaration).max(64).default([]),
+        listeners: z.array(eventListenerDeclaration).max(64).default([]),
+        services: z.array(serviceDeclaration).max(64).default([]),
+        timers: z.array(timerDeclaration).max(64).default([]),
+        permissions: z.object({
+          workspace: z.enum(['none', 'read', 'write']),
+          network: z.boolean(),
+        }),
+      })
+      .superRefine((input, context) => {
+        if (
+          input.tools.length === 0 &&
+          input.events.length === 0 &&
+          input.listeners.length === 0 &&
+          input.services.length === 0 &&
+          input.timers.length === 0
+        ) {
+          context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'runtime requires at least one Tool, Event, Listener, Service, or Timer',
+          });
+        }
+      })
+      .optional(),
+    ui: z
+      .object({
+        contributions: z.array(uiContribution).min(1).max(16),
+        permissions: z.object({
+          network: z.boolean(),
+          hostState: z.boolean().default(false),
+          sessionAccess: z.boolean().default(false),
+        }),
+        host: z
+          .object({
+            source: z
+              .string()
+              .min(1)
+              .max(1024 * 1024),
+            methods: z
+              .array(
+                z.object({
+                  name: z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,127}$/u),
+                  handler: z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,127}$/u),
+                }),
+              )
+              .min(1)
+              .max(64),
+          })
+          .optional(),
+      })
+      .optional(),
+  })
+  .superRefine((input, context) => {
+    if (!input.runtime && !input.ui) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'define_package requires runtime or ui contributions',
+      });
+    }
+  });
+
+const managePackageInput = z.object({
+  action: z.enum(['activate', 'reload', 'stop', 'delete']),
+  extensionId: z.string().min(1).max(128),
+});
+
+/** Agent-facing authoring surface for one multi-contribution Extension. */
+export class HostExtensionPackageManagementTools {
+  readonly #draftRoot: string;
+  readonly #connection: ConnectionContext = {
+    hostEpoch: 'internal-extension-package-management',
+    connectionId: 'internal-agent-extension-package',
+    surface: 'activation',
+    principal: 'runtime_host',
+    acquireResidency: () => ({ release: () => undefined }),
+  };
+
+  constructor(
+    controlDirectory: string,
+    private readonly controller: HostExtensionController,
+  ) {
+    this.#draftRoot = join(controlDirectory, 'extension-package-drafts-v1');
+  }
+
+  tools(): readonly MakaTool[] {
+    return Object.freeze([
+      this.#inspect(),
+      this.#define(),
+      this.#manage(),
+      this.#invokeTool(),
+      this.#emitEvent(),
+      this.#callService(),
+      this.#publishUiState(),
+    ]);
+  }
+
+  authorTools(): readonly MakaTool[] {
+    return Object.freeze([this.#inspect(), this.#define()]);
+  }
+
+  #inspect(): MakaTool {
+    return Object.freeze({
+      name: 'inspect_package',
+      description:
+        'Inspect the unified Extension catalog and contracts before defining a package. One Extension may contain Tool, UI, Event, Listener, Service, and Timer contributions together. Configuration properties with secret=true are declared in the contract but their configured values are redacted from query results.',
+      parameters: z.object({}),
+      categoryHint: 'read',
+      recoveryMode: 'replay_safe',
+      impl: async () => ({
+        catalog: unwrap(
+          await this.controller.handlers['extension.composition.query']({}, this.#connection),
+        ),
+        contracts: unwrap(
+          await this.controller.handlers['extension.contract.query']({}, this.#connection),
+        ),
+      }),
+    });
+  }
+
+  #define(): MakaTool {
+    return Object.freeze({
+      name: 'define_package',
+      description:
+        'Validate and install one Extension containing any combination of Tool, UI, Event, Listener, typed Service, and durable host-owned Timer contributions. Trusted executable contributions run in the Runtime Host process and have the same authority as local application or Bash code. All contributions share the same identity, metadata, dependencies, and configuration contract.',
+      parameters: definePackageInput,
+      categoryHint: 'file_write',
+      recoveryMode: 'idempotent',
+      permissionArgs: (input: z.infer<typeof definePackageInput>) => ({
+        id: input.id,
+        contributionKinds: [...(input.runtime ? ['runtime'] : []), ...(input.ui ? ['ui'] : [])],
+        ...(input.runtime
+          ? {
+              toolNames: input.runtime.tools.map(({ name }) => name),
+              eventNames: input.runtime.events.map(({ name }) => name),
+              eventListeners: input.runtime.listeners.map(({ id, event }) => ({ id, event })),
+              serviceNames: input.runtime.services.map(({ name }) => name),
+              timerIds: input.runtime.timers.map(({ id }) => id),
+              runtimeSourceBytes: Buffer.byteLength(input.runtime.source),
+              runtimeSourceSha256: digest(input.runtime.source),
+              runtimePermissions: input.runtime.permissions,
+            }
+          : {}),
+        ...(input.ui
+          ? {
+              uiContributionIds: input.ui.contributions.map(({ id }) => id),
+              uiDocumentBytes: input.ui.contributions.reduce(
+                (total, { document }) => total + Buffer.byteLength(document),
+                0,
+              ),
+              uiDocumentSha256: input.ui.contributions.map(({ document }) => digest(document)),
+              uiPermissions: input.ui.permissions,
+              ...(input.ui.host
+                ? {
+                    uiHostMethods: input.ui.host.methods.map(({ name }) => name),
+                    uiHostSourceBytes: Buffer.byteLength(input.ui.host.source),
+                    uiHostSourceSha256: digest(input.ui.host.source),
+                  }
+                : {}),
+            }
+          : {}),
+        configurationKeys: Object.keys(input.configuration?.properties ?? {}),
+        secretConfigurationKeys: Object.entries(input.configuration?.properties ?? {})
+          .filter(([, property]) => property.secret === true)
+          .map(([key]) => key),
+        historyProjectionNotice:
+          'Full trusted Extension source plus UI documents were accepted and intentionally redacted from model history.',
+      }),
+      impl: async (input: z.infer<typeof definePackageInput>) => {
+        if (input.runtime) assertSupportedSource(input.runtime.source, 'Runtime');
+        if (input.ui?.host) assertSupportedSource(input.ui.host.source, 'UI Host');
+        const draft = join(this.#draftRoot, randomUUID());
+        try {
+          await mkdir(draft, { recursive: true, mode: 0o700 });
+          if (input.runtime) await this.#writeRuntime(draft, input);
+          if (input.ui) await this.#writeUi(draft, input);
+          await this.#writeManifest(draft, input);
+          return unwrap(
+            await this.controller.handlers['extension.package.install'](
+              { sourcePath: draft },
+              this.#connection,
+            ),
+          );
+        } finally {
+          await rm(draft, { recursive: true, force: true }).catch(() => undefined);
+        }
+      },
+    });
+  }
+
+  #manage(): MakaTool {
+    return Object.freeze({
+      name: 'manage_package',
+      description:
+        'Activate, reload, stop, or delete one trusted Extension package. Tool, Event, Listener, Service, and Timer contributions bind once to the current Session; UI contributions bind once to the Desktop UI scope. Activation executes package code in the Runtime Host process with application-level authority. Multi-scope activation and reload roll back to the prior Entry Tree if either scope fails.',
+      parameters: managePackageInput,
+      categoryHint: 'file_write',
+      recoveryMode: 'idempotent',
+      permissionArgs: (input: z.infer<typeof managePackageInput>) => input,
+      impl: async (input: z.infer<typeof managePackageInput>, context: MakaToolContext) => {
+        const slots = packageEntrySlots(context.sessionId, input.extensionId);
+        if (input.action === 'stop') {
+          await this.#stopEntries(slots);
+          return { extensionId: input.extensionId, entries: [] };
+        }
+        if (input.action === 'delete') {
+          await this.#stopEntries(slots);
+          return unwrap(
+            await this.controller.handlers['extension.package.uninstall'](
+              { extensionId: input.extensionId },
+              this.#connection,
+            ),
+          );
+        }
+        const catalog = unwrap(
+          await this.controller.handlers['extension.composition.query']({}, this.#connection),
+        );
+        const candidate = catalog.extensions.find((item) => item.extensionId === input.extensionId);
+        if (!candidate) {
+          throw new Error(`Extension is not installed: ${input.extensionId}`);
+        }
+        const desired = [
+          {
+            ...slots.session,
+            needed:
+              candidate.toolNames.length > 0 ||
+              candidate.eventContributionIds.length > 0 ||
+              (candidate.serviceContributionIds?.length ?? 0) > 0 ||
+              (candidate.timerContributionIds?.length ?? 0) > 0,
+          },
+          { ...slots.desktop, needed: candidate.uiContributionIds.length > 0 },
+        ];
+        const previous = new Map(
+          catalog.entries
+            .filter(({ entryId }) => desired.some((slot) => slot.entryId === entryId))
+            .map((entry) => [entry.entryId, entry]),
+        );
+        try {
+          for (const slot of desired) {
+            const current = previous.get(slot.entryId);
+            if (!slot.needed) {
+              if (current) await this.#removeEntry(slot.entryId);
+              continue;
+            }
+            if (current) {
+              if (input.action === 'reload' || current.status !== 'active') {
+                unwrap(
+                  await this.controller.handlers['extension.composition.mutate'](
+                    { kind: 'reload', entryId: slot.entryId },
+                    this.#connection,
+                  ),
+                );
+              }
+            } else {
+              unwrap(
+                await this.controller.handlers['extension.composition.mutate'](
+                  {
+                    kind: 'enable',
+                    entryId: slot.entryId,
+                    scopeId: slot.scopeId,
+                    extensionId: input.extensionId,
+                  },
+                  this.#connection,
+                ),
+              );
+            }
+          }
+        } catch (error) {
+          await this.#restoreEntries(desired, previous, input.extensionId);
+          throw error;
+        }
+        const updated = unwrap(
+          await this.controller.handlers['extension.composition.query']({}, this.#connection),
+        );
+        return {
+          extensionId: input.extensionId,
+          entries: updated.entries.filter(({ entryId }) =>
+            desired.some((slot) => slot.entryId === entryId),
+          ),
+        };
+      },
+    });
+  }
+
+  #invokeTool(): MakaTool {
+    return Object.freeze({
+      name: 'invoke_tool',
+      description:
+        'Immediately invoke an active Extension Tool by name, including after package activation in the same model turn before native Tool schemas refresh.',
+      parameters: invokeToolInput,
+      categoryHint: 'shell_unsafe',
+      recoveryMode: 'never_auto_retry',
+      permissionArgs: (input: z.infer<typeof invokeToolInput>) => input,
+      executionFacts: managementExecutionFacts(),
+      impl: async (input: z.infer<typeof invokeToolInput>, context: MakaToolContext) => {
+        if (PACKAGE_TOOL_NAMES.has(input.toolName)) {
+          throw new Error(
+            `Extension Package Tools cannot be invoked recursively: ${input.toolName}`,
+          );
+        }
+        const tool = this.controller.resolveTool(context.sessionId, input.toolName);
+        if (!tool) throw new Error(`Active Extension Tool was not found: ${input.toolName}`);
+        await validateArgs(tool, input.args);
+        return await tool.impl(input.args, context);
+      },
+    });
+  }
+
+  #emitEvent(): MakaTool {
+    return Object.freeze({
+      name: 'emit_event',
+      description:
+        'Dispatch one active typed Extension Event in the current session without creating an Agent Turn.',
+      parameters: emitEventInput,
+      categoryHint: 'shell_unsafe',
+      recoveryMode: 'never_auto_retry',
+      permissionArgs: (input: z.infer<typeof emitEventInput>) => input,
+      executionFacts: managementExecutionFacts(),
+      impl: (input: z.infer<typeof emitEventInput>, context: MakaToolContext) =>
+        this.controller.emitEvent(context.sessionId, input.event, input.payload, context),
+    });
+  }
+
+  #callService(): MakaTool {
+    return Object.freeze({
+      name: 'call_service',
+      description:
+        'Call one active typed trusted Extension Service method. Input and output are JSON-schema validated.',
+      parameters: callServiceInput,
+      categoryHint: 'shell_unsafe',
+      recoveryMode: 'never_auto_retry',
+      permissionArgs: (input: z.infer<typeof callServiceInput>) => input,
+      executionFacts: managementExecutionFacts(),
+      impl: (input: z.infer<typeof callServiceInput>, context: MakaToolContext) =>
+        this.controller.callService(
+          context.sessionId,
+          input.service,
+          input.method,
+          input.input,
+          context,
+        ),
+    });
+  }
+
+  #publishUiState(): MakaTool {
+    return Object.freeze({
+      name: 'publish_ui_state',
+      description:
+        'Publish structured business state to every active Desktop UI Entry for one Extension that allows Host state.',
+      parameters: publishUiStateInput,
+      categoryHint: 'client_capability',
+      recoveryMode: 'idempotent',
+      permissionArgs: (input: z.infer<typeof publishUiStateInput>) => ({
+        extensionId: input.extensionId,
+        key: input.key,
+        valueRedacted: true,
+        valueSha256: digest(JSON.stringify(input.value) ?? 'null'),
+      }),
+      impl: async (input: z.infer<typeof publishUiStateInput>) => {
+        await this.controller.publishUiState(input.extensionId, input.key, input.value);
+        return { extensionId: input.extensionId, key: input.key, published: true };
+      },
+    });
+  }
+
+  async #stopEntries(slots: ReturnType<typeof packageEntrySlots>): Promise<void> {
+    const catalog = unwrap(
+      await this.controller.handlers['extension.composition.query']({}, this.#connection),
+    );
+    const ids = new Set<string>([slots.session.entryId, slots.desktop.entryId]);
+    for (const entry of catalog.entries.filter(({ entryId }) => ids.has(entryId))) {
+      await this.#removeEntry(entry.entryId);
+    }
+  }
+
+  async #removeEntry(entryId: string): Promise<void> {
+    unwrap(
+      await this.controller.handlers['extension.composition.mutate'](
+        { kind: 'remove', entryId },
+        this.#connection,
+      ),
+    );
+  }
+
+  async #restoreEntries(
+    desired: readonly {
+      entryId: string;
+      scopeId: string;
+      needed: boolean;
+    }[],
+    previous: ReadonlyMap<
+      string,
+      {
+        readonly entryId: string;
+        readonly scopeId: string;
+        readonly extensionId: string;
+        readonly generation: number;
+      }
+    >,
+    extensionId: string,
+  ): Promise<void> {
+    const current = unwrap(
+      await this.controller.handlers['extension.composition.query']({}, this.#connection),
+    );
+    const currentById = new Map(current.entries.map((entry) => [entry.entryId, entry]));
+    for (const slot of [...desired].reverse()) {
+      const before = previous.get(slot.entryId);
+      const now = currentById.get(slot.entryId);
+      try {
+        if (!before && now) {
+          await this.#removeEntry(slot.entryId);
+        } else if (before && now && now.generation !== before.generation) {
+          unwrap(
+            await this.controller.handlers['extension.composition.mutate'](
+              { kind: 'reload', entryId: slot.entryId },
+              this.#connection,
+            ),
+          );
+        } else if (before && !now) {
+          unwrap(
+            await this.controller.handlers['extension.composition.mutate'](
+              {
+                kind: 'enable',
+                entryId: before.entryId,
+                scopeId: before.scopeId,
+                extensionId,
+              },
+              this.#connection,
+            ),
+          );
+        }
+      } catch {
+        // Preserve the original transition failure; the catalog keeps diagnostics for recovery.
+      }
+    }
+  }
+
+  async #writeRuntime(draft: string, input: z.infer<typeof definePackageInput>): Promise<void> {
+    const runtime = input.runtime!;
+    await mkdir(join(draft, 'dist'), { recursive: true, mode: 0o700 });
+    await writeFile(join(draft, 'dist', 'runtime.mjs'), runtime.source, {
+      encoding: 'utf8',
+      mode: 0o600,
+    });
+  }
+
+  async #writeUi(draft: string, input: z.infer<typeof definePackageInput>): Promise<void> {
+    const ui = input.ui!;
+    await mkdir(join(draft, 'documents'), { recursive: true, mode: 0o700 });
+    if (ui.host) await mkdir(join(draft, 'host'), { mode: 0o700 });
+    await Promise.all(
+      ui.contributions.map((item, index) =>
+        writeFile(join(draft, 'documents', `${index + 1}.html`), item.document, {
+          encoding: 'utf8',
+          mode: 0o600,
+        }),
+      ),
+    );
+    if (ui.host) {
+      await writeFile(join(draft, 'host', 'service.mjs'), ui.host.source, {
+        encoding: 'utf8',
+        mode: 0o600,
+      });
+    }
+  }
+
+  async #writeManifest(draft: string, input: z.infer<typeof definePackageInput>): Promise<void> {
+    await writeJson(draft, 'maka.extension.json', {
+      schemaVersion: 1,
+      id: input.id,
+      ...(input.displayName ? { displayName: input.displayName } : {}),
+      ...(input.description !== undefined ? { description: input.description } : {}),
+      ...(input.dependencies ? { dependencies: input.dependencies } : {}),
+      ...(input.configuration ? { configuration: input.configuration } : {}),
+      ...(input.runtime
+        ? {
+            runtime: {
+              entry: 'dist/runtime.mjs',
+              tools: input.runtime.tools,
+              events: input.runtime.events,
+              listeners: input.runtime.listeners,
+              services: input.runtime.services,
+              timers: input.runtime.timers,
+              permissions: input.runtime.permissions,
+            },
+          }
+        : {}),
+      ...(input.ui
+        ? {
+            ui: {
+              contributions: input.ui.contributions.map((item, index) => ({
+                id: item.id,
+                surface: item.surface,
+                ...(item.slot ? { slot: item.slot } : {}),
+                ...(item.slots ? { slots: item.slots } : {}),
+                priority: item.priority,
+                document: `documents/${index + 1}.html`,
+              })),
+              ...(input.ui.host
+                ? { host: { entry: 'host/service.mjs', methods: input.ui.host.methods } }
+                : {}),
+              permissions: input.ui.permissions,
+            },
+          }
+        : {}),
+    });
+  }
+}
+
+async function writeJson(root: string, file: string, value: unknown): Promise<void> {
+  await writeFile(join(root, file), `${JSON.stringify(value, null, 2)}\n`, {
+    encoding: 'utf8',
+    mode: 0o600,
+  });
+}
+
+function assertSupportedSource(source: string, label: string): void {
+  if (/\bmodule\s*\.\s*exports\b|\bexports\s*(?:\.|\[)/u.test(source)) {
+    throw new Error(`${label} package source must use ESM, not CommonJS exports.`);
+  }
+  if (!/\bexport\s+default\b/u.test(source)) {
+    throw new Error(`${label} package source must export one default handler object.`);
+  }
+}
+
+function digest(value: string): string {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+function packageEntrySlots(sessionId: string, extensionId: string) {
+  const digestFor = (scope: string) =>
+    createHash('sha256').update(scope).update('\0').update(extensionId).digest('hex').slice(0, 32);
+  return {
+    session: {
+      entryId: `agent_package_session_${digestFor(sessionId)}`,
+      scopeId: sessionId,
+    },
+    desktop: {
+      entryId: `agent_package_ui_${digestFor('desktop-ui')}`,
+      scopeId: 'desktop-ui',
+    },
+  } as const;
+}
+
+function unwrap<K extends OperationKey>(
+  outcome: OperationOutcome<K>,
+): Extract<OperationOutcome<K>, { ok: true }>['result'] {
+  if (outcome.ok) return outcome.result;
+  throw new Error(`${outcome.error.code}: ${outcome.error.message}`);
+}
+
+async function validateArgs(tool: MakaTool, args: unknown): Promise<void> {
+  const schema = tool.parameters as {
+    safeParseAsync?: (value: unknown) => Promise<{ success: boolean; error?: unknown }>;
+    safeParse?: (value: unknown) => { success: boolean; error?: unknown };
+  };
+  const result = schema.safeParseAsync
+    ? await schema.safeParseAsync(args)
+    : schema.safeParse?.(args);
+  if (result && !result.success) {
+    throw new Error(`Tool arguments failed validation: ${String(result.error)}`);
+  }
+}
+
+function managementExecutionFacts(): NonNullable<MakaTool['executionFacts']> {
+  return Object.freeze({
+    isolation: 'none',
+    writesAffectHost: true,
+    writeBack: 'direct',
+    network: 'host',
+    secrets: 'host_env',
+  });
+}
diff --git a/packages/runtime-host/src/server/extension-package-manifest.ts b/packages/runtime-host/src/server/extension-package-manifest.ts
new file mode 100644
index 0000000000..1d5c4c99a6
--- /dev/null
+++ b/packages/runtime-host/src/server/extension-package-manifest.ts
@@ -0,0 +1,267 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isCanonicalExtensionId } from '@maka/runtime/plugin-runtime';
+
+export const EXTENSION_PACKAGE_MANIFEST_FILE = 'maka.extension.json';
+const MAX_MANIFEST_BYTES = 256 * 1024;
+const KEY_PATTERN = /^[A-Za-z][A-Za-z0-9._-]{0,127}$/u;
+
+export type ExtensionConfigurationScalar = string | number | boolean;
+
+export interface ExtensionPackageDependency {
+  readonly id: string;
+}
+
+export interface ExtensionConfigurationProperty {
+  readonly type: 'string' | 'number' | 'boolean';
+  readonly title?: string;
+  readonly description?: string;
+  readonly default?: ExtensionConfigurationScalar;
+  readonly enum?: readonly ExtensionConfigurationScalar[];
+  readonly secret: boolean;
+}
+
+export interface ExtensionConfigurationSchema {
+  readonly properties: Readonly<Record<string, ExtensionConfigurationProperty>>;
+  readonly required: readonly string[];
+}
+
+export interface ExtensionPackageManifest {
+  readonly schemaVersion: 1;
+  readonly id: string;
+  readonly displayName: string;
+  readonly description: string;
+  readonly dependencies: readonly ExtensionPackageDependency[];
+  readonly configuration: ExtensionConfigurationSchema;
+  readonly runtime?: unknown;
+  readonly ui?: unknown;
+}
+
+export class ExtensionPackageManifestError extends Error {
+  readonly name = 'ExtensionPackageManifestError';
+  constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+  }
+}
+
+export async function loadExtensionPackageManifest(
+  root: string,
+): Promise<ExtensionPackageManifest | undefined> {
+  let encoded: Buffer;
+  try {
+    encoded = await readFile(join(root, EXTENSION_PACKAGE_MANIFEST_FILE));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
+    throw invalid('Unable to read unified Extension manifest', error);
+  }
+  if (encoded.byteLength > MAX_MANIFEST_BYTES) {
+    throw invalid('Unified Extension manifest exceeds its size limit');
+  }
+  try {
+    return decodeExtensionPackageManifest(JSON.parse(encoded.toString('utf8')));
+  } catch (error) {
+    if (error instanceof ExtensionPackageManifestError) throw error;
+    throw invalid('Unified Extension manifest is invalid JSON', error);
+  }
+}
+
+export function decodeExtensionPackageManifest(value: unknown): ExtensionPackageManifest {
+  const source = record(value, 'Extension manifest');
+  exactOptional(
+    source,
+    ['schemaVersion', 'id'],
+    ['displayName', 'description', 'dependencies', 'configuration', 'runtime', 'ui'],
+  );
+  if (source.schemaVersion !== 1) throw invalid('Extension manifest schemaVersion must be 1');
+  const id = extensionId(source.id);
+  const displayName =
+    source.displayName === undefined ? id : text(source.displayName, 'displayName', 128);
+  const description =
+    source.description === undefined ? '' : boundedDescription(source.description);
+  const dependencies = decodeDependencies(source.dependencies);
+  const configuration = decodeConfigurationSchema(source.configuration);
+  return Object.freeze({
+    schemaVersion: 1,
+    id,
+    displayName,
+    description,
+    dependencies,
+    configuration,
+    ...(source.runtime === undefined ? {} : { runtime: source.runtime }),
+    ...(source.ui === undefined ? {} : { ui: source.ui }),
+  });
+}
+
+export function validateExtensionConfiguration(
+  schema: ExtensionConfigurationSchema,
+  value: unknown,
+): Readonly<Record<string, ExtensionConfigurationScalar>> {
+  const input = value === undefined ? {} : record(value, 'Extension configuration');
+  const unknown = Object.keys(input).find((key) => !Object.hasOwn(schema.properties, key));
+  if (unknown) throw invalid(`Extension configuration key is not declared: ${unknown}`);
+  const result: Record<string, ExtensionConfigurationScalar> = {};
+  for (const [key, property] of Object.entries(schema.properties)) {
+    const configured = input[key] ?? property.default;
+    if (configured === undefined) {
+      if (schema.required.includes(key)) {
+        throw invalid(`Extension configuration is missing required key: ${key}`);
+      }
+      continue;
+    }
+    if (typeof configured !== property.type || !isScalar(configured)) {
+      throw invalid(`Extension configuration type is invalid for key: ${key}`);
+    }
+    if (property.enum && !property.enum.some((candidate) => candidate === configured)) {
+      throw invalid(`Extension configuration value is not allowed for key: ${key}`);
+    }
+    result[key] = configured;
+  }
+  const encoded = JSON.stringify(result);
+  if (Buffer.byteLength(encoded, 'utf8') > 64 * 1024) {
+    throw invalid('Extension configuration exceeds its size limit');
+  }
+  return Object.freeze(result);
+}
+
+function decodeDependencies(value: unknown): readonly ExtensionPackageDependency[] {
+  if (value === undefined) return Object.freeze([]);
+  if (!Array.isArray(value) || value.length > 64)
+    throw invalid('Extension dependencies are invalid');
+  const ids = new Set<string>();
+  const dependencies = value.map((item, index) => {
+    const dependency = record(item, `dependencies[${index}]`);
+    exactOptional(dependency, ['id'], []);
+    const id = extensionId(dependency.id);
+    if (ids.has(id)) throw invalid(`Extension dependency repeats: ${id}`);
+    ids.add(id);
+    return Object.freeze({ id });
+  });
+  return Object.freeze(dependencies.sort((left, right) => left.id.localeCompare(right.id)));
+}
+
+function decodeConfigurationSchema(value: unknown): ExtensionConfigurationSchema {
+  if (value === undefined)
+    return Object.freeze({ properties: Object.freeze({}), required: Object.freeze([]) });
+  const schema = record(value, 'configuration');
+  exactOptional(schema, ['properties'], ['required']);
+  const propertiesSource = record(schema.properties, 'configuration properties');
+  if (Object.keys(propertiesSource).length > 128)
+    throw invalid('Too many Extension configuration properties');
+  const properties: Record<string, ExtensionConfigurationProperty> = {};
+  for (const [key, value] of Object.entries(propertiesSource)) {
+    if (!KEY_PATTERN.test(key)) throw invalid(`Extension configuration key is invalid: ${key}`);
+    const property = record(value, `configuration.properties.${key}`);
+    exactOptional(property, ['type'], ['title', 'description', 'default', 'enum', 'secret']);
+    if (property.type !== 'string' && property.type !== 'number' && property.type !== 'boolean') {
+      throw invalid(`Extension configuration property type is invalid: ${key}`);
+    }
+    const type = property.type;
+    const defaultValue = property.default;
+    if (defaultValue !== undefined && (typeof defaultValue !== type || !isScalar(defaultValue))) {
+      throw invalid(`Extension configuration default is invalid: ${key}`);
+    }
+    let values: readonly ExtensionConfigurationScalar[] | undefined;
+    if (property.enum !== undefined) {
+      if (
+        !Array.isArray(property.enum) ||
+        property.enum.length === 0 ||
+        property.enum.length > 64 ||
+        property.enum.some((item) => typeof item !== type || !isScalar(item))
+      )
+        throw invalid(`Extension configuration enum is invalid: ${key}`);
+      values = Object.freeze([...new Set(property.enum as ExtensionConfigurationScalar[])]);
+      if (
+        defaultValue !== undefined &&
+        !values.includes(defaultValue as ExtensionConfigurationScalar)
+      ) {
+        throw invalid(`Extension configuration default is outside enum: ${key}`);
+      }
+    }
+    properties[key] = Object.freeze({
+      type,
+      ...(property.title === undefined
+        ? {}
+        : { title: text(property.title, 'configuration title', 128) }),
+      ...(property.description === undefined
+        ? {}
+        : { description: text(property.description, 'configuration description', 1024) }),
+      ...(defaultValue === undefined
+        ? {}
+        : { default: defaultValue as ExtensionConfigurationScalar }),
+      ...(values ? { enum: values } : {}),
+      secret: property.secret === true,
+    });
+  }
+  const required = schema.required === undefined ? [] : schema.required;
+  if (
+    !Array.isArray(required) ||
+    required.length > Object.keys(properties).length ||
+    required.some((key) => typeof key !== 'string' || !Object.hasOwn(properties, key)) ||
+    new Set(required).size !== required.length
+  )
+    throw invalid('Extension configuration required keys are invalid');
+  return Object.freeze({
+    properties: Object.freeze(properties),
+    required: Object.freeze(required as string[]),
+  });
+}
+
+function exactOptional(
+  value: Record<string, unknown>,
+  required: readonly string[],
+  optional: readonly string[],
+): void {
+  const allowed = new Set([...required, ...optional]);
+  if (
+    required.some((key) => !Object.hasOwn(value, key)) ||
+    Object.keys(value).some((key) => !allowed.has(key))
+  ) {
+    throw invalid('Extension manifest fields are invalid');
+  }
+}
+
+function record(value: unknown, label: string): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw invalid(`${label} must be an object`);
+  return value as Record<string, unknown>;
+}
+
+function extensionId(value: unknown): string {
+  if (!isCanonicalExtensionId(value)) throw invalid('Extension manifest id is invalid');
+  return value;
+}
+
+function text(value: unknown, label: string, maxBytes: number): string {
+  if (
+    typeof value !== 'string' ||
+    value.length === 0 ||
+    Buffer.byteLength(value, 'utf8') > maxBytes ||
+    /[\0\r\n]/u.test(value)
+  ) {
+    throw invalid(`Extension manifest ${label} is invalid`);
+  }
+  return value;
+}
+
+function boundedDescription(value: unknown): string {
+  if (
+    typeof value !== 'string' ||
+    Buffer.byteLength(value, 'utf8') > 4096 ||
+    value.includes('\0')
+  ) {
+    throw invalid('Extension manifest description is invalid');
+  }
+  return value;
+}
+
+function isScalar(value: unknown): value is ExtensionConfigurationScalar {
+  return (
+    typeof value === 'string' ||
+    typeof value === 'boolean' ||
+    (typeof value === 'number' && Number.isFinite(value))
+  );
+}
+
+function invalid(message: string, cause?: unknown): ExtensionPackageManifestError {
+  return new ExtensionPackageManifestError(message, { cause });
+}
diff --git a/packages/runtime-host/src/server/extension-runtime.ts b/packages/runtime-host/src/server/extension-runtime.ts
new file mode 100644
index 0000000000..f925e81c1d
--- /dev/null
+++ b/packages/runtime-host/src/server/extension-runtime.ts
@@ -0,0 +1,704 @@
+import { Context, type Plugin } from '@maka/runtime/plugin-kernel';
+import { MakaCompositionLoader } from '@maka/runtime/plugin-composition-loader';
+import {
+  type MakaContributionContext,
+  type MakaCompositionSnapshot,
+  type MakaCompositionApplyInput,
+  type MakaCompositionEntryInspection,
+  type MakaPluginMountInspection,
+  type MakaPluginPackage,
+  type MakaPluginRootId,
+  type MakaRuntimeCompositionSnapshot,
+  ownPluginEffect,
+  pluginIdentity,
+} from '@maka/runtime/plugin-runtime';
+import { PluginToolService } from '@maka/runtime/plugin-tool-service';
+import { PluginUiService } from '@maka/runtime/plugin-ui-service';
+import { PluginHookService } from '@maka/runtime/plugin-hook-service';
+import {
+  type ExtensionToolContributionInspection,
+  type ExtensionToolContributionRegistryOptions,
+} from '@maka/runtime/extension-tool-contributions';
+import type { MakaTool } from '@maka/runtime/tool-runtime';
+import {
+  type ExtensionUiContribution,
+  type ExtensionUiContributionInspection,
+} from '@maka/runtime/extension-ui-contributions';
+import {
+  type ExtensionEventDefinition,
+  type ExtensionEventDefinitionInspection,
+  type ExtensionEventInvocationContext,
+  type ExtensionEventListenerContribution,
+  type ExtensionEventListenerInspection,
+} from '@maka/runtime/extension-event-contributions';
+import {
+  contributeExtensionService,
+  ExtensionServiceContributionRegistry,
+  type ExtensionServiceContribution,
+  type ExtensionServiceContributionInspection,
+  type ExtensionServiceInvocationContext,
+} from '@maka/runtime/extension-service-contributions';
+import { createHash } from 'node:crypto';
+import { dispatchExtensionHandlers } from '@maka/runtime/extension-dispatch';
+import {
+  EXTENSION_CORE_EVENTS,
+  isExtensionCoreEventName,
+  validateExtensionCoreEventPayload,
+  type ExtensionCoreEventName,
+} from '@maka/runtime/extension-core-events';
+import {
+  contributeExtensionTimer,
+  type ExtensionTimerAuthority,
+  type ExtensionTimerContribution,
+  type ExtensionTimerContributionInspection,
+} from '@maka/runtime/extension-timer-contributions';
+export interface HostTrustedToolExtensionInput {
+  readonly extensionId: string;
+  readonly dependencies?: readonly { readonly extensionId: string }[];
+  readonly tools: readonly MakaTool[];
+  readonly healthCheck?: () => void | Promise<void>;
+}
+
+export interface HostPreparedPluginPackageInput {
+  readonly extensionId: string;
+  readonly toolNames: readonly string[];
+  readonly dependencies?: readonly { readonly extensionId: string }[];
+  /** Optional client contributions owned by the same Extension Entry. */
+  readonly ui?: readonly ExtensionUiContribution[];
+  /** Plugin-defined Event and Listener identities owned by the same Extension Entry. */
+  readonly eventContributionIds?: readonly string[];
+  readonly serviceContributionIds?: readonly string[];
+  readonly timerContributionIds?: readonly string[];
+  readonly load: (context: MakaContributionContext) => Promise<{
+    readonly tools: readonly MakaTool[];
+    readonly events?: readonly ExtensionEventDefinition[];
+    readonly listeners?: readonly ExtensionEventListenerContribution[];
+    readonly services?: readonly ExtensionServiceContribution[];
+    readonly timers?: readonly ExtensionTimerContribution[];
+    readonly healthCheck?: () => void | Promise<void>;
+    readonly dispose?: () => void | Promise<void>;
+  }>;
+}
+
+export type HostToolExtensionInput = HostTrustedToolExtensionInput | HostPreparedPluginPackageInput;
+
+export interface HostUiExtensionInput {
+  readonly extensionId: string;
+  readonly dependencies?: readonly { readonly extensionId: string }[];
+  readonly ui: readonly ExtensionUiContribution[];
+  readonly healthCheck?: () => void | Promise<void>;
+}
+
+export type HostExtensionInput = HostToolExtensionInput | HostUiExtensionInput;
+
+export interface HostExtensionToolResolver {
+  resolveTools(
+    scopeId: string,
+    coreTools: readonly MakaTool[],
+    options?: HostExtensionToolResolutionOptions,
+  ): readonly MakaTool[];
+}
+
+export interface HostExtensionToolResolutionOptions {
+  /** Preserve an exact caller-owned Tool ceiling without Host or Extension additions. */
+  readonly exact?: boolean;
+}
+
+export const PROFILE_EXTENSION_SCOPE = 'profile';
+
+export interface HostExtensionEventDispatchResult {
+  readonly event: string;
+  readonly mode?: import('@maka/runtime/extension-event-contributions').ExtensionEventDispatchMode;
+  readonly listenerCount: number;
+  readonly delivered: number;
+  readonly failed: number;
+  readonly failures: readonly {
+    readonly extensionId: string;
+    readonly listenerId: string;
+    readonly diagnostic: string;
+  }[];
+  readonly result?: unknown;
+}
+
+export interface HostExtensionRuntimeInspection {
+  readonly runtime: readonly import('@maka/runtime/plugin-runtime').MakaCompositionEntryInspection[];
+  readonly scopes: readonly MakaPluginMountInspection[];
+  readonly tools: readonly ExtensionToolContributionInspection[];
+  readonly ui: readonly ExtensionUiContributionInspection[];
+  readonly uiReadiness: readonly import('@maka/runtime/extension-ui-contributions').ExtensionUiReadinessInspection[];
+  readonly timers: readonly ExtensionTimerContributionInspection[];
+  readonly events: readonly ExtensionEventDefinitionInspection[];
+  readonly listeners: readonly ExtensionEventListenerInspection[];
+  readonly services: readonly ExtensionServiceContributionInspection[];
+}
+
+/**
+ * Runtime Host-owned Extension authority.
+ *
+ * This is deliberately an in-process seam rather than a product control plane.
+ * It gives the Host one lifecycle owner, one typed Tool registry, and one close
+ * boundary while later API/CLI/UI work decides how trusted definitions arrive.
+ */
+export class HostExtensionRuntime implements HostExtensionToolResolver {
+  readonly #composition: MakaCompositionLoader;
+  readonly #tools: PluginToolService;
+  readonly #ui: PluginUiService;
+  readonly #hooks: PluginHookService;
+  readonly #services = new ExtensionServiceContributionRegistry();
+  readonly #scopeIds = new Set<string>();
+  #hostTools: readonly MakaTool[] = Object.freeze([]);
+  #draining = false;
+  #closed = false;
+  #closeTask: Promise<void> | undefined;
+
+  constructor(
+    options: ExtensionToolContributionRegistryOptions = {},
+    private readonly timerAuthority?: ExtensionTimerAuthority & {
+      inspect?(scopeId?: string): readonly ExtensionTimerContributionInspection[];
+      beginDrain?(): void;
+      close?(): Promise<void> | void;
+    },
+  ) {
+    const root = new Context();
+    this.#tools = new PluginToolService(root, options);
+    this.#ui = new PluginUiService(root);
+    this.#hooks = new PluginHookService(root);
+    this.#composition = new MakaCompositionLoader({ root });
+  }
+
+  installTrustedTool(input: HostTrustedToolExtensionInput): Promise<void> {
+    this.#assertMutable();
+    const tools = Object.freeze(input.tools.map((tool) => Object.freeze({ ...tool })));
+    return this.#composition.install(
+      this.#package(input, (ctx) => {
+        const setup = async () => {
+          await input.healthCheck?.();
+          for (const tool of tools) ctx.tools.register(tool);
+        };
+        return setup();
+      }),
+    );
+  }
+
+  installTool(input: HostToolExtensionInput): Promise<void> {
+    if ('tools' in input) return this.installTrustedTool(input);
+    this.#assertMutable();
+    return this.#composition.install(
+      this.#package(input, async (ctx) => {
+        const activation = this.#activationContext(ctx);
+        const loaded = await input.load(activation);
+        await loaded.healthCheck?.();
+        const isDesktopUiScope = activation.scopeId === 'desktop-ui';
+        for (const contribution of input.ui ?? []) ctx.ui.register(contribution);
+        if (!isDesktopUiScope) {
+          for (const tool of loaded.tools) ctx.tools.register(tool);
+          for (const definition of loaded.events ?? []) ctx.hooks.define(definition);
+          for (const listener of loaded.listeners ?? []) ctx.hooks.on(listener);
+          for (const service of loaded.services ?? [])
+            contributeExtensionService(activation, this.#services, service);
+          if ((loaded.timers?.length ?? 0) > 0 && !this.timerAuthority)
+            throw new Error('Extension Timer authority is unavailable');
+          for (const timer of loaded.timers ?? [])
+            await contributeExtensionTimer(activation, this.timerAuthority!, timer);
+        }
+        if (loaded.dispose) ownPluginEffect(ctx, 'package.dispose', loaded.dispose);
+      }),
+    );
+  }
+
+  installUi(input: HostUiExtensionInput): Promise<void> {
+    this.#assertMutable();
+    return this.#composition.install(
+      this.#package(input, async (ctx) => {
+        await input.healthCheck?.();
+        for (const contribution of input.ui) ctx.ui.register(contribution);
+      }),
+    );
+  }
+
+  installExtension(input: HostExtensionInput): Promise<void> {
+    return 'load' in input || 'tools' in input ? this.installTool(input) : this.installUi(input);
+  }
+
+  async disposeScope(scopeId: string): Promise<void> {
+    await this.applyComposition({
+      operations: [...this.#composition.inspectTree(this.#rootId(scopeId))]
+        .reverse()
+        .map(({ id: entryId }) => ({ type: 'remove' as const, entryId })),
+    });
+  }
+
+  async replaceCompositionSnapshot(snapshot: MakaCompositionSnapshot): Promise<void> {
+    this.#assertMutable();
+    await this.#composition.replaceSnapshot(snapshot);
+    this.#refreshScopeIds();
+  }
+
+  /**
+   * Applies an atomic batch to the EntryTree. All public extension mutations
+   * should converge on this operation; the loader owns the runtime tree.
+   */
+  async applyComposition(
+    input: MakaCompositionApplyInput,
+  ): Promise<readonly MakaCompositionEntryInspection[]> {
+    this.#assertMutable();
+    const changed = await this.#composition.apply(input);
+    this.#refreshScopeIds();
+    return changed;
+  }
+
+  uninstall(extensionId: string): Promise<void> {
+    this.#assertMutable();
+    return this.#composition.uninstall(extensionId);
+  }
+
+  inspect(entryId: string): MakaPluginMountInspection {
+    const entry = this.#composition.inspect(entryId);
+    return this.#mountInspection(entry);
+  }
+
+  inspectScope(scopeId: string): readonly MakaPluginMountInspection[] {
+    const rootId = this.#rootId(scopeId);
+    return Object.freeze(
+      this.#composition
+        .inspectTree(rootId)
+        .flatMap(flattenInspection)
+        .filter((entry) => entry.packageId)
+        .map((entry) => this.#mountInspection(entry)),
+    );
+  }
+
+  inspectTools(scopeId: string): readonly ExtensionToolContributionInspection[] {
+    return this.#tools.inspect(this.#rootId(scopeId));
+  }
+
+  inspectUi(scopeId: string): readonly ExtensionUiContributionInspection[] {
+    const committed = this.inspectScope(scopeId).flatMap((entry) =>
+      entry.current ? [{ entryId: entry.entryId, generation: entry.current.generation }] : [],
+    );
+    return this.#ui.inspect(this.#rootId(scopeId), committed);
+  }
+
+  reportUiReadiness(
+    scopeId: string,
+    entryId: string,
+    generation: number,
+    status: import('@maka/runtime/extension-ui-contributions').ExtensionUiReadiness,
+    diagnostic?: string,
+  ): void {
+    this.#ui.setReadinessForRoot(this.#rootId(scopeId), entryId, generation, status, diagnostic);
+  }
+
+  inspectUiReadiness(scopeId?: string) {
+    return this.#ui.inspectReadiness(scopeId ? this.#rootId(scopeId) : undefined);
+  }
+
+  inspectEvents(scopeId: string): readonly ExtensionEventDefinitionInspection[] {
+    const { scopeIds, committed } = this.#resolvedScopeState(scopeId);
+    return this.#hooks.inspectEvents(scopeIds, committed);
+  }
+
+  inspectEventListeners(scopeId: string): readonly ExtensionEventListenerInspection[] {
+    const { scopeIds, committed } = this.#resolvedScopeState(scopeId);
+    return this.#hooks.inspectListeners(scopeIds, committed);
+  }
+
+  inspectServices(scopeId: string): readonly ExtensionServiceContributionInspection[] {
+    const { scopeIds, committed } = this.#resolvedScopeState(scopeId);
+    return this.#services.inspect(scopeIds, committed);
+  }
+
+  inspectTimers(scopeId: string): readonly ExtensionTimerContributionInspection[] {
+    return this.timerAuthority?.inspect?.(this.#rootId(scopeId)) ?? Object.freeze([]);
+  }
+
+  async callService(
+    scopeId: string,
+    service: string,
+    method: string,
+    input: unknown,
+    context: ExtensionServiceInvocationContext,
+  ): Promise<unknown> {
+    if (this.#closed) throw new Error('Runtime Host Extension authority is closed');
+    if (this.#draining) throw new Error('Runtime Host Extension authority is draining');
+    if ((context.serviceDepth ?? 0) >= 8)
+      throw new Error('Extension Service recursion limit exceeded');
+    const { scopeIds, committed } = this.#resolvedScopeState(scopeId);
+    return await this.#services.call(scopeIds, committed, service, method, input, context);
+  }
+
+  async emitEvent(
+    scopeId: string,
+    event: string,
+    payload: unknown,
+    context: ExtensionEventInvocationContext,
+  ): Promise<HostExtensionEventDispatchResult> {
+    if (this.#closed) throw new Error('Runtime Host Extension authority is closed');
+    if (this.#draining) throw new Error('Runtime Host Extension authority is draining');
+    if (context.signal.aborted)
+      throw context.signal.reason ?? new Error('Event emission was aborted');
+    if ((context.eventDepth ?? 0) > 8) throw new Error('Extension Event recursion limit exceeded');
+    const { scopeIds, committed } = this.#resolvedScopeState(scopeId);
+    const parsed = this.#hooks.parsePayload(scopeIds, committed, event, payload);
+    const definition = this.#hooks.resolveDefinition(scopeIds, committed, event);
+    const listeners = this.#hooks
+      .inspectListeners(scopeIds, committed)
+      .filter((listener) => listener.event === event);
+    const dispatched = await dispatchExtensionHandlers({
+      mode: definition.mode,
+      payload: parsed,
+      signal: context.signal,
+      handlers: listeners.map((listener) => ({
+        identity: listener,
+        invoke: (value: unknown) => listener.invoke(value, context),
+      })),
+    });
+    const failures = dispatched.settlements
+      .filter((item) => item.status === 'rejected')
+      .map((item) => ({
+        extensionId: item.identity.extensionId,
+        listenerId: item.identity.id,
+        diagnostic: boundedDiagnostic(item.error),
+      }));
+    const delivered = dispatched.settlements.length - failures.length;
+    const result =
+      definition.mode === 'emit'
+        ? undefined
+        : this.#hooks.parseResult(scopeIds, committed, event, dispatched.value);
+    return Object.freeze({
+      event,
+      ...(definition.mode === 'emit' ? {} : { mode: definition.mode }),
+      listenerCount: listeners.length,
+      delivered,
+      failed: failures.length,
+      failures: Object.freeze(failures.map((failure) => Object.freeze(failure))),
+      ...(result === undefined ? {} : { result }),
+    });
+  }
+
+  async dispatchCoreEvent(
+    scopeId: string,
+    event: ExtensionCoreEventName,
+    payload: unknown,
+    context: ExtensionEventInvocationContext,
+  ): Promise<HostExtensionEventDispatchResult> {
+    if (this.#closed) throw new Error('Runtime Host Extension authority is closed');
+    if (this.#draining) throw new Error('Runtime Host Extension authority is draining');
+    if (!isExtensionCoreEventName(event)) throw new Error(`Unknown core Extension Event: ${event}`);
+    if (context.signal.aborted)
+      throw context.signal.reason ?? new Error('Core Extension Event was aborted');
+    const mode = EXTENSION_CORE_EVENTS[event];
+    const { scopeIds, committed } = this.#resolvedScopeState(scopeId);
+    const listeners = this.#hooks
+      .inspectListeners(scopeIds, committed)
+      .filter((listener) => listener.event === event);
+    if (listeners.length === 0) {
+      return Object.freeze({
+        event,
+        mode,
+        listenerCount: 0,
+        delivered: 0,
+        failed: 0,
+        failures: Object.freeze([]),
+        result: mode === 'bail' ? undefined : payload,
+      });
+    }
+    const parsed = validateExtensionCoreEventPayload(event, payload);
+    const dispatched = await dispatchExtensionHandlers({
+      mode,
+      payload: parsed,
+      signal: context.signal,
+      handlers: listeners.map((listener) => ({
+        identity: listener,
+        invoke: (value: unknown) => listener.invoke(value, context),
+      })),
+    });
+    const failures = dispatched.settlements
+      .filter((item) => item.status === 'rejected')
+      .map((item) => ({
+        extensionId: item.identity.extensionId,
+        listenerId: item.identity.id,
+        diagnostic: boundedDiagnostic(item.error),
+      }));
+    return Object.freeze({
+      event,
+      mode,
+      listenerCount: listeners.length,
+      delivered: dispatched.settlements.length - failures.length,
+      failed: failures.length,
+      failures: Object.freeze(failures.map((failure) => Object.freeze(failure))),
+      result: dispatched.value,
+    });
+  }
+
+  async dispatchCoreMiddleware(
+    scopeId: string,
+    event: 'maka.tools.execute' | 'maka.llm.stream',
+    payload: unknown,
+    context: ExtensionEventInvocationContext,
+    final: (value: unknown) => unknown | Promise<unknown>,
+  ): Promise<unknown> {
+    if (this.#closed) throw new Error('Runtime Host Extension authority is closed');
+    if (this.#draining) throw new Error('Runtime Host Extension authority is draining');
+    if (context.signal.aborted)
+      throw context.signal.reason ?? new Error('Core Extension Middleware was aborted');
+    const { scopeIds, committed } = this.#resolvedScopeState(scopeId);
+    const listeners = this.#hooks
+      .inspectListeners(scopeIds, committed)
+      .filter((listener) => listener.event === event);
+    const dispatched = await dispatchExtensionHandlers({
+      mode: 'around',
+      payload,
+      signal: context.signal,
+      handlers: listeners.map((listener) => ({
+        identity: listener,
+        invoke: (value, next) => listener.invoke(value, context, next),
+      })),
+      final,
+    });
+    return dispatched.value;
+  }
+
+  installedExtensions(): readonly { readonly extensionId: string }[] {
+    return this.#composition
+      .installedPackages()
+      .map(({ packageId: extensionId }) => Object.freeze({ extensionId }));
+  }
+
+  composition(scopeId: string): MakaRuntimeCompositionSnapshot {
+    const scoped = this.#runtimeComposition(scopeId);
+    if (scopeId === PROFILE_EXTENSION_SCOPE) return scoped;
+    const profile = this.#runtimeComposition(PROFILE_EXTENSION_SCOPE);
+    if (profile.entries.length === 0) return scoped;
+    const entries = Object.freeze([...profile.entries, ...scoped.entries]);
+    const digest = createHash('sha256').update(JSON.stringify(entries)).digest('hex');
+    return Object.freeze({
+      schemaVersion: 1,
+      rootId: scopeId,
+      digest: `sha256:${digest}`,
+      entries,
+    });
+  }
+
+  inspectRuntime() {
+    return this.#composition.inspectTree();
+  }
+
+  inspectAll(): HostExtensionRuntimeInspection {
+    const scopes = this.#scopeIds.size === 0 ? [PROFILE_EXTENSION_SCOPE] : [...this.#scopeIds];
+    return Object.freeze({
+      runtime: this.inspectRuntime(),
+      scopes: Object.freeze(scopes.flatMap((scopeId) => this.inspectScope(scopeId))),
+      tools: Object.freeze(scopes.flatMap((scopeId) => this.inspectTools(scopeId))),
+      ui: Object.freeze(scopes.flatMap((scopeId) => this.inspectUi(scopeId))),
+      uiReadiness: this.inspectUiReadiness(),
+      timers: Object.freeze(scopes.flatMap((scopeId) => this.inspectTimers(scopeId))),
+      events: Object.freeze(scopes.flatMap((scopeId) => this.inspectEvents(scopeId))),
+      listeners: Object.freeze(scopes.flatMap((scopeId) => this.inspectEventListeners(scopeId))),
+      services: Object.freeze(scopes.flatMap((scopeId) => this.inspectServices(scopeId))),
+    });
+  }
+
+  resolveTools(
+    scopeId: string,
+    coreTools: readonly MakaTool[],
+    options: HostExtensionToolResolutionOptions = {},
+  ): readonly MakaTool[] {
+    if (this.#closed) throw new Error('Runtime Host Extension authority is closed');
+    if (options.exact) return Object.freeze([...coreTools]);
+    const profileTools = this.#tools.compose(PROFILE_EXTENSION_SCOPE, [
+      ...coreTools,
+      ...this.#hostTools,
+    ]);
+    return scopeId === PROFILE_EXTENSION_SCOPE
+      ? profileTools
+      : this.#tools.compose(this.#rootId(scopeId), profileTools);
+  }
+
+  registerHostTools(tools: readonly MakaTool[]): void {
+    this.#assertMutable();
+    if (this.#hostTools.length > 0)
+      throw new Error('Runtime Host Extension Tools are already registered');
+    this.#hostTools = Object.freeze(tools.map((tool) => Object.freeze({ ...tool })));
+  }
+
+  #resolvedScopeState(scopeId: string): {
+    scopeIds: readonly string[];
+    committed: readonly { readonly entryId: string; readonly generation: number }[];
+  } {
+    const scopeIds =
+      scopeId === PROFILE_EXTENSION_SCOPE
+        ? [this.#rootId(scopeId)]
+        : [this.#rootId(PROFILE_EXTENSION_SCOPE), this.#rootId(scopeId)];
+    const committed = scopeIds.flatMap((resolvedScopeId) =>
+      this.inspectScope(resolvedScopeId).flatMap((entry) =>
+        entry.current ? [{ entryId: entry.entryId, generation: entry.current.generation }] : [],
+      ),
+    );
+    return { scopeIds, committed };
+  }
+
+  #package(
+    input: {
+      readonly extensionId: string;
+      readonly dependencies?: readonly { readonly extensionId: string }[];
+    },
+    apply: (ctx: Context) => void | Promise<void>,
+  ): MakaPluginPackage {
+    const inject = Object.freeze(['tools', 'ui', 'hooks']);
+    const host: Plugin = Object.freeze({
+      name: input.extensionId,
+      inject,
+      apply: async (ctx: Context) => {
+        await apply(ctx);
+      },
+    });
+    return Object.freeze({
+      packageId: input.extensionId,
+      host,
+    });
+  }
+
+  #activationContext(ctx: Context): MakaContributionContext {
+    const identity = pluginIdentity(ctx);
+    return Object.freeze({
+      ...identity,
+      signal: new AbortController().signal,
+      runtimeContext: ctx,
+      ownEffect: (label: string, dispose: () => void | Promise<void>) =>
+        ownPluginEffect(ctx, label, dispose),
+      dependency: <T>(packageId: string) =>
+        this.inspectScope(this.#scopeId(identity.scopeId)).some(
+          ({ packageId: activePackage, current }) => activePackage === packageId && current,
+        ) as T,
+    });
+  }
+
+  #rootId(scopeId: string): MakaPluginRootId {
+    if (scopeId === PROFILE_EXTENSION_SCOPE || scopeId === 'desktop-ui') return scopeId;
+    return scopeId.startsWith('session:') ? (scopeId as MakaPluginRootId) : `session:${scopeId}`;
+  }
+
+  #scopeId(rootId: string): string {
+    return rootId.startsWith('session:') ? rootId.slice('session:'.length) : rootId;
+  }
+
+  #refreshScopeIds(): void {
+    this.#scopeIds.clear();
+    for (const entry of this.#composition.inspectTree())
+      this.#scopeIds.add(this.#scopeId(entry.rootId));
+  }
+
+  #mountInspection(entry: MakaCompositionEntryInspection): MakaPluginMountInspection {
+    const active = entry.status === 'active';
+    return Object.freeze({
+      entryId: entry.id,
+      rootId: this.#scopeId(entry.rootId),
+      packageId: entry.packageId!,
+      enabled: entry.status !== 'disabled' && entry.status !== 'disposed',
+      status: entry.status,
+      ...(active && entry.generation !== undefined
+        ? { current: Object.freeze({ generation: entry.generation }) }
+        : {}),
+      waitingFor: entry.waitingFor,
+      pendingCleanupEffects: 0,
+      ...(entry.diagnostic ? { diagnostic: Object.freeze({ message: entry.diagnostic }) } : {}),
+    });
+  }
+
+  #runtimeComposition(scopeId: string): MakaRuntimeCompositionSnapshot {
+    const entries = this.inspectScope(scopeId)
+      .flatMap((entry) => {
+        if (!entry.current) return [];
+        const pkg = this.#composition.package(entry.packageId);
+        return [
+          Object.freeze({
+            entryId: entry.entryId,
+            packageId: entry.packageId,
+            generation: entry.current.generation,
+            contributions: Object.freeze([...(pkg.contributions ?? [])]),
+          }),
+        ];
+      })
+      .sort(
+        (left, right) =>
+          left.packageId.localeCompare(right.packageId) ||
+          left.entryId.localeCompare(right.entryId),
+      );
+    const digest = createHash('sha256').update(JSON.stringify(entries)).digest('hex');
+    return Object.freeze({
+      schemaVersion: 1,
+      rootId: scopeId,
+      digest: `sha256:${digest}`,
+      entries: Object.freeze(entries),
+    });
+  }
+
+  beginDrain(): void {
+    this.#draining = true;
+    this.timerAuthority?.beginDrain?.();
+  }
+
+  close(): Promise<void> {
+    if (this.#closed) return Promise.resolve();
+    this.#closeTask ??= this.#closeOnce().finally(() => {
+      if (!this.#closed) this.#closeTask = undefined;
+    });
+    return this.#closeTask;
+  }
+
+  async #closeOnce(): Promise<void> {
+    this.beginDrain();
+    const errors: unknown[] = [];
+    for (const scopeId of [...this.#scopeIds].sort(compareString)) {
+      try {
+        for (const entry of [...this.#composition.inspectTree(this.#rootId(scopeId))].reverse()) {
+          await this.#composition.remove(entry.id);
+        }
+        this.#scopeIds.delete(scopeId);
+      } catch (error) {
+        errors.push(error);
+      }
+    }
+    if (errors.length === 0) {
+      for (const { extensionId } of [...this.installedExtensions()].reverse()) {
+        try {
+          await this.#composition.uninstall(extensionId);
+        } catch (error) {
+          errors.push(error);
+        }
+      }
+    }
+    if (errors.length > 0) {
+      throw new AggregateError(errors, 'Unable to close Runtime Host Extension authority');
+    }
+    await this.timerAuthority?.close?.();
+    await this.#composition.close();
+    this.#closed = true;
+  }
+
+  #assertMutable(): void {
+    if (this.#closed) throw new Error('Runtime Host Extension authority is closed');
+    if (this.#draining) throw new Error('Runtime Host Extension authority is draining');
+  }
+}
+
+function compareString(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+function flattenInspection(
+  entry: MakaCompositionEntryInspection,
+): readonly MakaCompositionEntryInspection[] {
+  return [entry, ...entry.children.flatMap(flattenInspection)];
+}
+
+function boundedDiagnostic(error: unknown): string {
+  const value = error instanceof Error ? error.message : String(error);
+  const encoded = Buffer.from(value || 'Event Listener failed', 'utf8');
+  if (encoded.byteLength <= 4096) return value || 'Event Listener failed';
+  return `${encoded
+    .subarray(0, 4093)
+    .toString('utf8')
+    .replace(/\uFFFD$/u, '')}...`;
+}
diff --git a/packages/runtime-host/src/server/extension-timer-scheduler.ts b/packages/runtime-host/src/server/extension-timer-scheduler.ts
new file mode 100644
index 0000000000..035009b97c
--- /dev/null
+++ b/packages/runtime-host/src/server/extension-timer-scheduler.ts
@@ -0,0 +1,294 @@
+import type {
+  ExtensionTimerAuthority,
+  ExtensionTimerContribution,
+  ExtensionTimerContributionInspection,
+} from '@maka/runtime/extension-timer-contributions';
+import type { MakaContributionContext } from '@maka/runtime/plugin-runtime';
+import { randomUUID } from 'node:crypto';
+import { mkdir, open, readFile, rename, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+
+const STATE_FILE = 'extension-timers-v2.json';
+const MAX_STATE_BYTES = 2 * 1024 * 1024;
+const MAX_TIMEOUT_MS = 2_147_483_647;
+
+interface TimerState {
+  readonly entryId: string;
+  readonly scopeId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+  readonly id: string;
+  readonly intervalMs: number;
+  nextRunAt: number;
+  running: boolean;
+  lastStartedAt?: number;
+  lastSucceededAt?: number;
+  lastError?: string;
+}
+
+interface ActiveTimer {
+  readonly token: symbol;
+  readonly runtimeContext: MakaContributionContext['runtimeContext'];
+  readonly contribution: ExtensionTimerContribution;
+  readonly configuration: Readonly<Record<string, string | number | boolean>>;
+  readonly state: TimerState;
+  handle?: NodeJS.Timeout;
+}
+
+/** Host-owned, durable scheduler for trusted in-process Extension Timer invocations. */
+export class HostExtensionTimerScheduler implements ExtensionTimerAuthority {
+  readonly path: string | undefined;
+  readonly #states = new Map<string, TimerState>();
+  readonly #active = new Map<string, ActiveTimer[]>();
+  #loaded = false;
+  #closed = false;
+  #draining = false;
+  #tail: Promise<void> = Promise.resolve();
+
+  constructor(
+    controlDirectory?: string,
+    private readonly cwdForScope: (scopeId: string) => string | Promise<string> = () =>
+      process.cwd(),
+  ) {
+    this.path = controlDirectory ? join(controlDirectory, STATE_FILE) : undefined;
+  }
+
+  async register(
+    context: MakaContributionContext,
+    contribution: ExtensionTimerContribution,
+  ): Promise<() => Promise<void>> {
+    if (this.#closed) throw new Error('Extension Timer scheduler is closed');
+    await this.#load();
+    const key = timerKey(context.entryId, contribution.id);
+    const stack = this.#active.get(key) ?? [];
+    const previous = stack.at(-1);
+    if (previous?.handle) clearTimeout(previous.handle);
+    const persisted = this.#states.get(key);
+    const reusable =
+      persisted?.scopeId === context.scopeId &&
+      persisted.extensionId === context.extensionId &&
+      persisted.generation === context.generation &&
+      persisted.intervalMs === contribution.intervalMs;
+    const state: TimerState = reusable
+      ? persisted
+      : {
+          entryId: context.entryId,
+          scopeId: context.scopeId,
+          extensionId: context.extensionId,
+          generation: context.generation,
+          id: contribution.id,
+          intervalMs: contribution.intervalMs,
+          nextRunAt: Date.now() + contribution.initialDelayMs,
+          running: false,
+        };
+    state.running = false;
+    this.#states.set(key, state);
+    const active: ActiveTimer = {
+      token: Symbol(key),
+      runtimeContext: context.runtimeContext,
+      contribution,
+      configuration: Object.freeze({ ...contribution.configuration }),
+      state,
+    };
+    this.#active.set(key, [...stack, active]);
+    await this.#persistQueued();
+    this.#scheduleWhenActive(key, active);
+    return async () => {
+      const current = this.#active.get(key) ?? [];
+      const wasCurrent = current.at(-1)?.token === active.token;
+      const remaining = current.filter((entry) => entry.token !== active.token);
+      if (remaining.length === current.length) return;
+      if (active.handle) clearTimeout(active.handle);
+      if (remaining.length === 0) {
+        this.#active.delete(key);
+        if (!this.#draining) this.#states.delete(key);
+      } else {
+        this.#active.set(key, remaining);
+        const restored = remaining.at(-1)!;
+        this.#states.set(key, restored.state);
+        if (wasCurrent && !restored.state.running) this.#scheduleWhenActive(key, restored);
+      }
+      await this.#persistQueued();
+    };
+  }
+
+  beginDrain(): void {
+    this.#draining = true;
+  }
+
+  inspect(scopeId?: string): readonly ExtensionTimerContributionInspection[] {
+    return Object.freeze(
+      [...this.#states.values()]
+        .filter((state) => scopeId === undefined || state.scopeId === scopeId)
+        .map((state) => Object.freeze({ ...state }))
+        .sort(
+          (left, right) =>
+            left.scopeId.localeCompare(right.scopeId) || left.id.localeCompare(right.id),
+        ),
+    );
+  }
+
+  async close(): Promise<void> {
+    if (this.#closed) return;
+    this.#closed = true;
+    for (const stack of this.#active.values()) {
+      for (const active of stack) if (active.handle) clearTimeout(active.handle);
+    }
+    this.#active.clear();
+    await this.#tail;
+  }
+
+  #scheduleWhenActive(key: string, active: ActiveTimer): void {
+    if (this.#closed || this.#current(key)?.token !== active.token) return;
+    if (active.runtimeContext.fiber.state === 2) {
+      this.#schedule(key, active);
+      return;
+    }
+    if (active.runtimeContext.fiber.state !== 0 && active.runtimeContext.fiber.state !== 1) return;
+    active.handle = setTimeout(() => this.#scheduleWhenActive(key, active), 0);
+    active.handle.unref?.();
+  }
+
+  #schedule(key: string, active: ActiveTimer): void {
+    if (this.#closed || this.#current(key)?.token !== active.token) return;
+    const delay = Math.max(0, Math.min(MAX_TIMEOUT_MS, active.state.nextRunAt - Date.now()));
+    active.handle = setTimeout(() => void this.#fire(key, active), delay);
+    active.handle.unref?.();
+  }
+
+  async #fire(key: string, active: ActiveTimer): Promise<void> {
+    if (this.#closed || this.#current(key)?.token !== active.token) return;
+    const scheduledAt = active.state.nextRunAt;
+    const now = Date.now();
+    const elapsed = Math.max(0, now - scheduledAt);
+    const skipped = Math.floor(elapsed / active.state.intervalMs);
+    active.state.nextRunAt = scheduledAt + (skipped + 1) * active.state.intervalMs;
+    active.state.running = true;
+    active.state.lastStartedAt = now;
+    delete active.state.lastError;
+    // Advance durably before invoking: a crash can skip this fire, but can never duplicate it.
+    await this.#persistQueued().catch((error) => {
+      active.state.running = false;
+      active.state.lastError = boundedError(error);
+    });
+    if (active.state.lastError) {
+      this.#schedule(key, active);
+      return;
+    }
+
+    const controller = new AbortController();
+    const timeout = setTimeout(
+      () => controller.abort(new Error(`Extension Timer timed out: ${active.state.id}`)),
+      active.contribution.timeoutMs,
+    );
+    timeout.unref?.();
+    try {
+      const cwd = await this.cwdForScope(active.state.scopeId);
+      await active.contribution.invoke(structuredClone(active.contribution.payload ?? null), {
+        sessionId: active.state.scopeId,
+        turnId: `timer:${active.state.id}:${scheduledAt}`,
+        cwd,
+        permissionMode: 'default',
+        origin: 'host',
+        configuration: active.configuration,
+        signal: controller.signal,
+        scheduledAt,
+      });
+      active.state.lastSucceededAt = Date.now();
+      delete active.state.lastError;
+    } catch (error) {
+      active.state.lastError = boundedError(error);
+    } finally {
+      clearTimeout(timeout);
+      active.state.running = false;
+      await this.#persistQueued().catch(() => undefined);
+      // A Timer owns at most one live invocation. If it ran beyond its
+      // interval, #fire collapses all missed ticks when this next handle fires.
+      this.#schedule(key, active);
+    }
+  }
+
+  #current(key: string): ActiveTimer | undefined {
+    return this.#active.get(key)?.at(-1);
+  }
+
+  #persistQueued(): Promise<void> {
+    const run = this.#tail.then(() => this.#persist());
+    this.#tail = run.catch(() => undefined);
+    return run;
+  }
+
+  async #load(): Promise<void> {
+    if (this.#loaded) return;
+    this.#loaded = true;
+    if (!this.path) return;
+    let encoded: Buffer;
+    try {
+      encoded = await readFile(this.path);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return;
+      throw error;
+    }
+    if (encoded.byteLength > MAX_STATE_BYTES) throw new Error('Extension Timer state is too large');
+    const value = JSON.parse(encoded.toString('utf8')) as {
+      schemaVersion?: unknown;
+      timers?: unknown;
+    };
+    if (value.schemaVersion !== 1 || !Array.isArray(value.timers))
+      throw new Error('Extension Timer state is invalid');
+    for (const item of value.timers) {
+      if (!validState(item)) throw new Error('Extension Timer state contains an invalid record');
+      this.#states.set(timerKey(item.entryId, item.id), { ...item, running: false });
+    }
+  }
+
+  async #persist(): Promise<void> {
+    if (!this.path) return;
+    const timers = [...this.#states.values()]
+      .map((state) => ({ ...state, running: false }))
+      .sort(
+        (left, right) =>
+          left.entryId.localeCompare(right.entryId) || left.id.localeCompare(right.id),
+      );
+    const encoded = `${JSON.stringify({ schemaVersion: 1, timers })}\n`;
+    if (Buffer.byteLength(encoded, 'utf8') > MAX_STATE_BYTES)
+      throw new Error('Extension Timer state is too large');
+    const temporary = `${this.path}.${randomUUID()}.tmp`;
+    let handle: Awaited<ReturnType<typeof open>> | undefined;
+    try {
+      await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+      handle = await open(temporary, 'wx', 0o600);
+      await handle.writeFile(encoded, 'utf8');
+      await handle.sync();
+      await handle.close();
+      handle = undefined;
+      await rename(temporary, this.path);
+    } finally {
+      await handle?.close().catch(() => undefined);
+      await rm(temporary, { force: true }).catch(() => undefined);
+    }
+  }
+}
+
+function timerKey(entryId: string, id: string): string {
+  return `${entryId}\0${id}`;
+}
+
+function validState(value: unknown): value is TimerState {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const state = value as Record<string, unknown>;
+  return (
+    ['entryId', 'scopeId', 'extensionId', 'id'].every(
+      (key) => typeof state[key] === 'string' && (state[key] as string).length > 0,
+    ) &&
+    Number.isSafeInteger(state.generation) &&
+    (state.generation as number) > 0 &&
+    Number.isSafeInteger(state.intervalMs) &&
+    Number.isSafeInteger(state.nextRunAt)
+  );
+}
+
+function boundedError(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  return Buffer.from(message, 'utf8').subarray(0, 4096).toString('utf8');
+}
diff --git a/packages/runtime-host/src/server/extension-ui-state-store.ts b/packages/runtime-host/src/server/extension-ui-state-store.ts
new file mode 100644
index 0000000000..f44efc52e6
--- /dev/null
+++ b/packages/runtime-host/src/server/extension-ui-state-store.ts
@@ -0,0 +1,174 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, open, readFile, rename, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+
+const STATE_FILE_NAME = 'extension-ui-state-v2.json';
+const MAX_STATE_BYTES = 1024 * 1024;
+const MAX_VALUE_BYTES = 64 * 1024;
+const MAX_KEYS = 256;
+
+export type ExtensionUiStateValue =
+  | null
+  | boolean
+  | number
+  | string
+  | readonly ExtensionUiStateValue[]
+  | { readonly [key: string]: ExtensionUiStateValue };
+
+interface PersistedState {
+  readonly schemaVersion: 1;
+  readonly scopes: Readonly<Record<string, Readonly<Record<string, ExtensionUiStateValue>>>>;
+}
+
+/** Durable, root-private state owned by sandboxed UI Extensions. */
+export class HostExtensionUiStateStore {
+  readonly path: string | undefined;
+  readonly #memory = new Map<string, Map<string, ExtensionUiStateValue>>();
+  #loaded = false;
+  #tail: Promise<void> = Promise.resolve();
+
+  constructor(controlDirectory?: string) {
+    this.path = controlDirectory ? join(controlDirectory, STATE_FILE_NAME) : undefined;
+  }
+
+  async get(
+    scopeId: string,
+    entryId: string,
+    key: string,
+  ): Promise<{ found: boolean; value: ExtensionUiStateValue | null }> {
+    await this.#load();
+    const state = this.#memory.get(ownerKey(scopeId, entryId));
+    return state?.has(key)
+      ? { found: true, value: cloneValue(state.get(key)!) }
+      : { found: false, value: null };
+  }
+
+  async set(
+    scopeId: string,
+    entryId: string,
+    key: string,
+    value: ExtensionUiStateValue,
+  ): Promise<void> {
+    validateKey(key);
+    validateValue(value);
+    await this.#mutate(async () => {
+      let state = this.#memory.get(ownerKey(scopeId, entryId));
+      if (!state) {
+        state = new Map();
+        this.#memory.set(ownerKey(scopeId, entryId), state);
+      }
+      if (!state.has(key) && state.size >= MAX_KEYS)
+        throw new Error('UI Extension state key limit exceeded');
+      state.set(key, cloneValue(value));
+    });
+  }
+
+  async delete(scopeId: string, entryId: string, key: string): Promise<boolean> {
+    validateKey(key);
+    let deleted = false;
+    await this.#mutate(async () => {
+      const owner = ownerKey(scopeId, entryId);
+      const state = this.#memory.get(owner);
+      deleted = state?.delete(key) ?? false;
+      if (state?.size === 0) this.#memory.delete(owner);
+    });
+    return deleted;
+  }
+
+  async clear(scopeId: string, entryId: string): Promise<void> {
+    await this.#mutate(async () => {
+      this.#memory.delete(ownerKey(scopeId, entryId));
+    });
+  }
+
+  async #mutate(operation: () => Promise<void>): Promise<void> {
+    const run = this.#tail.then(async () => {
+      await this.#load();
+      await operation();
+      await this.#persist();
+    });
+    this.#tail = run.catch(() => undefined);
+    return run;
+  }
+
+  async #load(): Promise<void> {
+    if (this.#loaded) return;
+    this.#loaded = true;
+    if (!this.path) return;
+    let encoded: Buffer;
+    try {
+      encoded = await readFile(this.path);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return;
+      throw error;
+    }
+    if (encoded.byteLength > MAX_STATE_BYTES)
+      throw new Error('UI Extension state exceeds its size limit');
+    const decoded = JSON.parse(encoded.toString('utf8')) as PersistedState;
+    if (decoded.schemaVersion !== 1 || !decoded.scopes || typeof decoded.scopes !== 'object') {
+      throw new Error('UI Extension state is invalid');
+    }
+    for (const [owner, entries] of Object.entries(decoded.scopes)) {
+      const state = new Map<string, ExtensionUiStateValue>();
+      for (const [key, value] of Object.entries(entries)) {
+        validateKey(key);
+        validateValue(value);
+        state.set(key, cloneValue(value));
+      }
+      this.#memory.set(owner, state);
+    }
+  }
+
+  async #persist(): Promise<void> {
+    if (!this.path) return;
+    const scopes = Object.fromEntries(
+      [...this.#memory.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([owner, entries]) => [
+          owner,
+          Object.fromEntries(
+            [...entries.entries()].sort(([left], [right]) => left.localeCompare(right)),
+          ),
+        ]),
+    );
+    const encoded = `${JSON.stringify({ schemaVersion: 1, scopes })}\n`;
+    if (Buffer.byteLength(encoded, 'utf8') > MAX_STATE_BYTES)
+      throw new Error('UI Extension state exceeds its size limit');
+    const directory = dirname(this.path);
+    const temporary = `${this.path}.${randomUUID()}.tmp`;
+    let handle: Awaited<ReturnType<typeof open>> | undefined;
+    try {
+      await mkdir(directory, { recursive: true, mode: 0o700 });
+      handle = await open(temporary, 'wx', 0o600);
+      await handle.writeFile(encoded, 'utf8');
+      await handle.sync();
+      await handle.close();
+      handle = undefined;
+      await rename(temporary, this.path);
+    } finally {
+      await handle?.close().catch(() => undefined);
+      await rm(temporary, { force: true }).catch(() => undefined);
+    }
+  }
+}
+
+function ownerKey(scopeId: string, entryId: string): string {
+  return `${scopeId}\u0000${entryId}`;
+}
+
+function validateKey(key: string): void {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(key))
+    throw new Error('UI Extension state key is invalid');
+}
+
+function validateValue(value: unknown): asserts value is ExtensionUiStateValue {
+  const encoded = JSON.stringify(value);
+  if (encoded === undefined || Buffer.byteLength(encoded, 'utf8') > MAX_VALUE_BYTES) {
+    throw new Error('UI Extension state value is invalid or too large');
+  }
+  JSON.parse(encoded);
+}
+
+function cloneValue<T extends ExtensionUiStateValue>(value: T): T {
+  return JSON.parse(JSON.stringify(value)) as T;
+}
diff --git a/packages/runtime-host/src/server/host-hook-composition.ts b/packages/runtime-host/src/server/host-hook-composition.ts
new file mode 100644
index 0000000000..61c2e131a9
--- /dev/null
+++ b/packages/runtime-host/src/server/host-hook-composition.ts
@@ -0,0 +1,248 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import type {
+  HookCompletedAudit,
+  HookConfigFile,
+  HookSource,
+  PreToolUseHookInput,
+  ResolvedHookDefinition,
+} from '@maka/core/hooks';
+import type { RuntimeEvent } from '@maka/core/runtime-event';
+import type { SessionHeader } from '@maka/core/session';
+import {
+  createHookExecutionLimiter,
+  createPreToolUseHookDispatcher,
+  type HookExecutionLimiter,
+  type PreToolUseHookDispatcher,
+} from '@maka/runtime/hooks/engine';
+import {
+  createHookConfigStore,
+  createHookTrustStore,
+  readHookConfigFile,
+  type HookConfigStore,
+  type HookTrustStore,
+} from '@maka/storage';
+import type { HostExtensionRuntime } from './extension-runtime.js';
+
+interface HookRuntimeEventWriter {
+  appendRuntimeEvent(sessionId: string, runId: string, event: RuntimeEvent): Promise<void>;
+}
+
+export interface HostHookComposition {
+  dispatcherFor(header: SessionHeader): PreToolUseHookDispatcher;
+}
+
+export function createHostHookComposition(input: {
+  stateRoot: string;
+  runtimeEvents: HookRuntimeEventWriter;
+  extensions?: HostExtensionRuntime;
+}): HostHookComposition {
+  const userConfig = createHookConfigStore(input.stateRoot);
+  const trust = createHookTrustStore(input.stateRoot);
+  const executionLimiter = createHookExecutionLimiter();
+  return {
+    dispatcherFor(header) {
+      return createSessionHookDispatcher({
+        header,
+        userConfig,
+        trust,
+        executionLimiter,
+        runtimeEvents: input.runtimeEvents,
+        extensions: input.extensions,
+      });
+    },
+  };
+}
+
+function createSessionHookDispatcher(input: {
+  header: SessionHeader;
+  userConfig: HookConfigStore;
+  trust: HookTrustStore;
+  executionLimiter: HookExecutionLimiter;
+  runtimeEvents: HookRuntimeEventWriter;
+  extensions?: HostExtensionRuntime;
+}): PreToolUseHookDispatcher {
+  const commandDispatcher = createPreToolUseHookDispatcher({
+    loadSnapshot: () => loadSnapshot(input),
+    executionLimiter: input.executionLimiter,
+    recordAudit: (hookInput, audit, context) =>
+      recordAudit(input.runtimeEvents, hookInput, audit, context.invocationId),
+  });
+  return {
+    prepareTurn(turnId) {
+      commandDispatcher.prepareTurn(turnId);
+    },
+    releaseTurn(turnId) {
+      commandDispatcher.releaseTurn(turnId);
+    },
+    runPreToolUse: (hookInput, abortSignal, context) =>
+      commandDispatcher.runPreToolUse(hookInput, abortSignal, context),
+    async runCoreEvent(event, payload, abortSignal, context) {
+      if (!input.extensions) return { result: structuredClone(payload), delivered: 0, failed: 0 };
+      const dispatched = await input.extensions.dispatchCoreEvent(input.header.id, event, payload, {
+        sessionId: context.sessionId,
+        runId: context.runId,
+        turnId: context.turnId,
+        cwd: context.cwd,
+        permissionMode: context.permissionMode,
+        origin: context.origin,
+        configuration: Object.freeze({}),
+        signal: abortSignal,
+      });
+      return {
+        result: dispatched.result,
+        delivered: dispatched.delivered,
+        failed: dispatched.failed,
+      };
+    },
+    async runCoreMiddleware(event, payload, abortSignal, context, final) {
+      if (!input.extensions) return await final(payload);
+      return await input.extensions.dispatchCoreMiddleware(
+        input.header.id,
+        event,
+        payload,
+        {
+          sessionId: context.sessionId,
+          runId: context.runId,
+          turnId: context.turnId,
+          cwd: context.cwd,
+          permissionMode: context.permissionMode,
+          origin: context.origin,
+          configuration: Object.freeze({}),
+          signal: abortSignal,
+        },
+        final,
+      );
+    },
+  };
+}
+
+async function loadSnapshot(input: {
+  header: SessionHeader;
+  userConfig: HookConfigStore;
+  trust: HookTrustStore;
+}): Promise<ResolvedHookDefinition[]> {
+  const projectIdentity = input.header.projectId
+    ? `project:${input.header.projectId}`
+    : `workspace:${input.header.workspaceRoot}`;
+  const [userConfig, projectConfig, trust] = await Promise.all([
+    input.userConfig.get(),
+    readHookConfigFile(join(input.header.cwd, '.maka', 'hooks.json')),
+    input.trust.get(),
+  ]);
+  const trustedHashes = new Set(trust.trustedDefinitions.map((record) => record.definitionHash));
+  const definitions: ResolvedHookDefinition[] = [];
+  appendDefinitions(definitions, userConfig, {
+    source: 'user',
+    sourceOrder: 0,
+    projectIdentity: 'user',
+    trustedHashes,
+  });
+  appendDefinitions(definitions, projectConfig, {
+    source: 'project',
+    sourceOrder: 1,
+    projectIdentity,
+    trustedHashes,
+  });
+  return definitions;
+}
+
+function appendDefinitions(
+  output: ResolvedHookDefinition[],
+  config: HookConfigFile,
+  input: {
+    source: HookSource;
+    sourceOrder: number;
+    projectIdentity: string;
+    trustedHashes: ReadonlySet<string>;
+  },
+): void {
+  for (const group of config.hooks.PreToolUse ?? []) {
+    for (const handler of group.hooks) {
+      if (handler.enabled === false) continue;
+      const definitionOrder = output.length;
+      const definitionHash = hashDefinition({
+        source: input.source,
+        projectIdentity: input.projectIdentity,
+        matcher: group.matcher ?? '*',
+        command: handler.command,
+        args: handler.args ?? [],
+        timeoutMs: handler.timeoutMs ?? 3_000,
+      });
+      output.push({
+        id: handler.id,
+        eventName: 'PreToolUse',
+        matcher: group.matcher ?? '*',
+        command: handler.command,
+        args: handler.args ?? [],
+        timeoutMs: handler.timeoutMs ?? 3_000,
+        source: input.source,
+        sourceOrder: input.sourceOrder,
+        definitionOrder,
+        projectIdentity: input.projectIdentity,
+        definitionHash,
+        trusted: input.trustedHashes.has(definitionHash),
+      });
+    }
+  }
+}
+
+export function hashHookDefinition(input: {
+  source: HookSource;
+  projectIdentity: string;
+  matcher: string;
+  command: string;
+  args: readonly string[];
+  timeoutMs: number;
+}): `sha256:${string}` {
+  return hashDefinition(input);
+}
+
+function hashDefinition(input: {
+  source: HookSource;
+  projectIdentity: string;
+  matcher: string;
+  command: string;
+  args: readonly string[];
+  timeoutMs: number;
+}): `sha256:${string}` {
+  const digest = createHash('sha256')
+    .update(
+      JSON.stringify([
+        1,
+        input.source,
+        input.projectIdentity,
+        'PreToolUse',
+        input.matcher,
+        'command',
+        input.command,
+        input.args,
+        input.timeoutMs,
+      ]),
+    )
+    .digest('hex');
+  return `sha256:${digest}`;
+}
+
+async function recordAudit(
+  runtimeEvents: HookRuntimeEventWriter,
+  input: PreToolUseHookInput,
+  audit: HookCompletedAudit,
+  invocationId: string,
+): Promise<void> {
+  await runtimeEvents.appendRuntimeEvent(input.session_id, input.run_id, {
+    id: randomUUID(),
+    invocationId,
+    runId: input.run_id,
+    sessionId: input.session_id,
+    turnId: input.turn_id,
+    ts: Date.now(),
+    partial: false,
+    role: 'system',
+    author: 'host',
+    origin: input.origin,
+    modelVisibility: 'hidden',
+    actions: { hookCompleted: audit },
+    refs: { toolCallId: input.tool_use_id },
+  });
+}
diff --git a/packages/runtime-host/src/server/in-process-package-runtime.ts b/packages/runtime-host/src/server/in-process-package-runtime.ts
new file mode 100644
index 0000000000..99272e40be
--- /dev/null
+++ b/packages/runtime-host/src/server/in-process-package-runtime.ts
@@ -0,0 +1,253 @@
+import { pathToFileURL } from 'node:url';
+import { randomUUID } from 'node:crypto';
+import type { MakaTool, MakaToolContext } from '@maka/runtime/tool-runtime';
+import { z } from 'zod';
+import type { ExtensionConfigurationScalar } from '../protocol/extension.js';
+import type { InstalledToolPackage } from './plugin-runtime-manifest.js';
+
+export interface PackageInvocationContext {
+  readonly sessionId: string;
+  readonly runId?: string;
+  readonly turnId: string;
+  readonly cwd: string;
+  readonly toolCallId: string;
+  readonly operationId?: string;
+  readonly abortSignal: AbortSignal;
+  readonly permissionMode?: string;
+  readonly origin?: 'provider' | 'code_mode' | 'host';
+  readonly eventDepth?: number;
+  readonly serviceDepth?: number;
+  readonly emitOutput?: (stream: 'stdout' | 'stderr', chunk: string) => void;
+}
+
+export type PackageEventEmitter = (
+  event: string,
+  payload: unknown,
+  context: PackageInvocationContext,
+) => Promise<unknown>;
+
+export type PackageServiceCaller = (
+  service: string,
+  method: string,
+  input: unknown,
+  context: PackageInvocationContext & { readonly callerExtensionId: string },
+) => Promise<unknown>;
+
+export type PackageContinuation = (value?: unknown) => unknown | Promise<unknown>;
+
+type PackageHandler = (
+  value: unknown,
+  context: Readonly<
+    PackageInvocationContext & {
+      readonly configuration: Readonly<Record<string, ExtensionConfigurationScalar>>;
+      readonly emitEvent: (event: string, payload: unknown) => Promise<unknown>;
+      readonly callService: (service: string, method: string, input: unknown) => Promise<unknown>;
+    }
+  >,
+  next?: PackageContinuation,
+) => unknown | Promise<unknown>;
+
+interface PackageModule {
+  readonly default?: unknown;
+  readonly tools?: unknown;
+}
+
+export class InProcessPackageError extends Error {
+  readonly name = 'InProcessPackageError';
+
+  constructor(
+    readonly code: 'load_failed' | 'handler_missing' | 'aborted' | 'retired',
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+/**
+ * One trusted in-process Extension activation.
+ *
+ * Package code has the same security authority as the Runtime Host. The public
+ * context is a cooperative API and not a sandbox boundary. A module is loaded
+ * once for the activation and all contribution calls share its live state.
+ */
+export class InProcessPackageActivation {
+  readonly #invocations = new Set<Promise<unknown>>();
+  #handlersTask: Promise<Readonly<Record<string, PackageHandler>>> | undefined;
+
+  constructor(
+    readonly installedPackage: InstalledToolPackage,
+    readonly configuration: Readonly<Record<string, ExtensionConfigurationScalar>> = Object.freeze(
+      {},
+    ),
+    private readonly emitEvent?: PackageEventEmitter,
+    private readonly callService?: PackageServiceCaller,
+  ) {}
+
+  tools(): readonly MakaTool[] {
+    return Object.freeze(
+      this.installedPackage.manifest.tools.map((declaration) => {
+        let parameters: unknown;
+        try {
+          parameters = z.fromJSONSchema(declaration.inputSchema);
+        } catch (error) {
+          throw new InProcessPackageError(
+            'load_failed',
+            `Tool package JSON Schema is unsupported: ${declaration.name}`,
+            { cause: error },
+          );
+        }
+        return Object.freeze({
+          name: declaration.name,
+          description: declaration.description,
+          parameters,
+          ...(declaration.displayName ? { displayName: declaration.displayName } : {}),
+          categoryHint: effectiveCategory(this.installedPackage.manifest, declaration.category),
+          recoveryMode: declaration.recoveryMode ?? 'never_auto_retry',
+          executionFacts: executionFacts(this.installedPackage.manifest),
+          permissionArgs: (args: unknown) => args,
+          impl: (args: unknown, context: MakaToolContext) =>
+            this.invoke(declaration.handler, args, context),
+        } satisfies MakaTool);
+      }),
+    );
+  }
+
+  async healthCheck(handlers: readonly string[]): Promise<void> {
+    this.#assertActive();
+    const loaded = await this.#handlers();
+    for (const handler of handlers) requireHandler(loaded, handler);
+  }
+
+  invoke(handler: string, args: unknown, context: MakaToolContext): Promise<unknown> {
+    return this.invokeRaw(handler, args, context);
+  }
+
+  invokeRaw(
+    handler: string,
+    value: unknown,
+    context: PackageInvocationContext,
+    next?: PackageContinuation,
+  ): Promise<unknown> {
+    this.#assertActive();
+    if (context.abortSignal.aborted) {
+      return Promise.reject(
+        new InProcessPackageError('aborted', `Extension invocation was aborted: ${handler}`, {
+          cause: context.abortSignal.reason,
+        }),
+      );
+    }
+    const invocation = this.#invoke(handler, value, context, next);
+    this.#invocations.add(invocation);
+    void invocation.then(
+      () => this.#invocations.delete(invocation),
+      () => this.#invocations.delete(invocation),
+    );
+    return invocation;
+  }
+
+  async dispose(): Promise<void> {
+    // Registries stop exposing this activation before disposal. Captured Turn
+    // snapshots intentionally retain their bound handlers and may still enter
+    // after a Binding update; those live references are the generation lease.
+    await Promise.allSettled([...this.#invocations]);
+  }
+
+  async #invoke(
+    handlerName: string,
+    value: unknown,
+    context: PackageInvocationContext,
+    next?: PackageContinuation,
+  ): Promise<unknown> {
+    const handler = requireHandler(await this.#handlers(), handlerName);
+    const runtimeContext = Object.freeze({
+      ...context,
+      configuration: this.configuration,
+      emitEvent: (event: string, payload: unknown) => {
+        if (!this.emitEvent) throw new Error('Extension Event emission is unavailable');
+        return this.emitEvent(event, payload, context);
+      },
+      callService: (service: string, method: string, input: unknown) => {
+        if (!this.callService) throw new Error('Extension Service calls are unavailable');
+        return this.callService(service, method, input, {
+          ...context,
+          callerExtensionId: this.installedPackage.extensionId,
+        });
+      },
+    });
+    const result = await handler(value, runtimeContext, next);
+    if (context.abortSignal.aborted) {
+      throw new InProcessPackageError(
+        'aborted',
+        `Extension invocation was aborted: ${handlerName}`,
+        {
+          cause: context.abortSignal.reason,
+        },
+      );
+    }
+    return result;
+  }
+
+  #handlers(): Promise<Readonly<Record<string, PackageHandler>>> {
+    this.#assertActive();
+    this.#handlersTask ??= loadHandlers(this.installedPackage.entry);
+    return this.#handlersTask;
+  }
+
+  #assertActive(): void {
+    // Authority is owned by the lifecycle registries. A captured contribution
+    // is itself a lease and remains callable until its Turn releases the snapshot.
+  }
+}
+
+async function loadHandlers(entry: string): Promise<Readonly<Record<string, PackageHandler>>> {
+  let imported: PackageModule;
+  try {
+    const url = pathToFileURL(entry);
+    url.searchParams.set('makaActivation', randomUUID());
+    imported = (await import(url.href)) as PackageModule;
+  } catch (error) {
+    throw new InProcessPackageError('load_failed', `Unable to load Extension entry: ${entry}`, {
+      cause: error,
+    });
+  }
+  const handlers = imported.default ?? imported.tools;
+  if (!handlers || typeof handlers !== 'object' || Array.isArray(handlers)) {
+    throw new InProcessPackageError(
+      'load_failed',
+      'Extension entry must export a default handler object',
+    );
+  }
+  return handlers as Readonly<Record<string, PackageHandler>>;
+}
+
+function requireHandler(
+  handlers: Readonly<Record<string, PackageHandler>>,
+  name: string,
+): PackageHandler {
+  const handler = handlers[name];
+  if (typeof handler !== 'function') {
+    throw new InProcessPackageError('handler_missing', `Extension handler is missing: ${name}`);
+  }
+  return handler;
+}
+
+function effectiveCategory(
+  manifest: InstalledToolPackage['manifest'],
+  declared: InstalledToolPackage['manifest']['tools'][number]['category'],
+): NonNullable<InstalledToolPackage['manifest']['tools'][number]['category']> {
+  if (declared) return declared;
+  if (manifest.permissions.workspace === 'write') return 'file_write';
+  if (manifest.permissions.network) return 'network_send';
+  return 'read';
+}
+
+function executionFacts(manifest: InstalledToolPackage['manifest']): MakaTool['executionFacts'] {
+  return Object.freeze({
+    isolation: 'none',
+    writesAffectHost: manifest.permissions.workspace === 'write',
+    writeBack: 'direct',
+    network: manifest.permissions.network ? 'host' : 'disabled',
+    secrets: 'host_env',
+  });
+}
diff --git a/packages/runtime-host/src/server/index.ts b/packages/runtime-host/src/server/index.ts
index c612afc009..1d4ec5c687 100644
--- a/packages/runtime-host/src/server/index.ts
+++ b/packages/runtime-host/src/server/index.ts
@@ -29,6 +29,44 @@ export {
   type InteractiveRuntimeHostCandidateResult,
 } from './candidate.js';
 export { createUnavailableDomainOperationHandlers } from './operation-dispatcher.js';
+export {
+  HostExtensionRuntime,
+  type HostExtensionToolResolver,
+  type HostPreparedPluginPackageInput,
+  type HostToolExtensionInput,
+  type HostTrustedToolExtensionInput,
+  type HostUiExtensionInput,
+  type HostExtensionInput,
+  type HostExtensionEventDispatchResult,
+} from './extension-runtime.js';
+export {
+  HostExtensionLoaderError,
+  InstalledPluginPackageLoader,
+  StaticTrustedToolExtensionLoader,
+  type HostTrustedToolExtensionLoader,
+  type StaticTrustedToolExtension,
+} from './extension-loader.js';
+export {
+  PluginPackageStore,
+  PluginPackageStoreError,
+  type InstalledPluginPackage,
+} from './plugin-package-store.js';
+export { PluginHookActivation } from './plugin-hook-activation.js';
+export { HostExtensionPackageManagementTools } from './extension-package-management-tools.js';
+export {
+  decodeExtensionPackageManifest,
+  loadExtensionPackageManifest,
+  validateExtensionConfiguration,
+  type ExtensionPackageManifest,
+  type ExtensionPackageDependency,
+  type ExtensionConfigurationSchema,
+} from './extension-package-manifest.js';
+export {
+  exportExtensionBundle,
+  materializeExtensionPackage,
+  ExtensionBundleError,
+} from './extension-bundle.js';
+export { HostPluginCompositionStore } from './plugin-composition-store.js';
 export {
   RuntimeHostRootAlreadyOwnedError,
   startExecutionRuntimeHostService,
diff --git a/packages/runtime-host/src/server/operation-dispatcher.ts b/packages/runtime-host/src/server/operation-dispatcher.ts
index 32642edd91..1d920919eb 100644
--- a/packages/runtime-host/src/server/operation-dispatcher.ts
+++ b/packages/runtime-host/src/server/operation-dispatcher.ts
@@ -72,6 +72,7 @@ export type GoalOperationKey = Extract<OperationKey, `goal.${string}`>;
 export type ExecutionInspectOperationKey = Extract<OperationKey, `execution.inspect.${string}`>;
 export type HostedExecutionOperationKey = Extract<OperationKey, `hosted.execution.${string}`>;
 export type ExternalSessionOperationKey = Extract<OperationKey, `external-session.${string}`>;
+export type ExtensionOperationKey = Extract<OperationKey, `extension.${string}`>;
 export type AgentGraphOperationKey = Extract<OperationKey, `agent.graph.${string}`>;
 export type SessionContinuityOperationKey = Extract<
   OperationKey,
@@ -135,6 +136,7 @@ export type ExternalSessionOperationHandlerMap = Pick<
   OperationHandlerMap,
   ExternalSessionOperationKey
 >;
+export type ExtensionOperationHandlerMap = Pick<OperationHandlerMap, ExtensionOperationKey>;
 export type AgentGraphOperationHandlerMap = Pick<OperationHandlerMap, AgentGraphOperationKey>;
 export type SessionContinuityOperationHandlerMap = Pick<
   OperationHandlerMap,
diff --git a/packages/runtime-host/src/server/plugin-composition-store.ts b/packages/runtime-host/src/server/plugin-composition-store.ts
new file mode 100644
index 0000000000..f6843e5574
--- /dev/null
+++ b/packages/runtime-host/src/server/plugin-composition-store.ts
@@ -0,0 +1,298 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, open, readFile, rename, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { isCanonicalExtensionId, isCanonicalExtensionScopeId } from '@maka/runtime/plugin-runtime';
+import type { ExtensionConfigurationScalar } from './extension-package-manifest.js';
+
+const FILE_NAME = 'plugin-composition-v2.json';
+const MAX_BYTES = 2 * 1024 * 1024;
+
+export interface PersistedPluginEntry {
+  readonly id: string;
+  readonly packageId?: string;
+  readonly disabled: boolean;
+  readonly config: Readonly<Record<string, ExtensionConfigurationScalar>>;
+  readonly inject?: readonly string[] | Readonly<Record<string, unknown>>;
+  readonly isolate?: Readonly<Record<string, true | string>>;
+  readonly intercept?: Readonly<Record<string, unknown>>;
+  readonly children?: readonly PersistedPluginEntry[];
+  readonly error?: string | null;
+}
+
+export interface PersistedPluginComposition {
+  readonly schemaVersion: 1;
+  readonly generation: number;
+  readonly roots: {
+    readonly profile: readonly PersistedPluginEntry[];
+    readonly desktopUi: readonly PersistedPluginEntry[];
+    readonly sessions: Readonly<Record<string, readonly PersistedPluginEntry[]>>;
+  };
+}
+
+export class HostPluginCompositionStoreError extends Error {
+  readonly name = 'HostPluginCompositionStoreError';
+
+  constructor(
+    readonly code: 'persistence_failed' | 'invalid_state' | 'commit_outcome_unknown',
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+export class HostPluginCompositionStore {
+  readonly path: string;
+
+  constructor(controlDirectory: string) {
+    this.path = join(controlDirectory, FILE_NAME);
+  }
+
+  async read(): Promise<PersistedPluginComposition | undefined> {
+    let encoded: Buffer;
+    try {
+      encoded = await readFile(this.path);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
+      throw persistence('Unable to read Plugin Composition', error);
+    }
+    if (encoded.byteLength > MAX_BYTES) throw invalid('Plugin Composition exceeds its size limit');
+    try {
+      return decode(JSON.parse(encoded.toString('utf8')));
+    } catch (error) {
+      if (error instanceof HostPluginCompositionStoreError) throw error;
+      throw invalid('Plugin Composition is invalid JSON', error);
+    }
+  }
+
+  async replace(snapshot: PersistedPluginComposition): Promise<void> {
+    const normalized = decode(snapshot);
+    const encoded = Buffer.from(`${JSON.stringify(normalized)}\n`, 'utf8');
+    if (encoded.byteLength > MAX_BYTES) throw invalid('Plugin Composition exceeds its size limit');
+    const directory = dirname(this.path);
+    const temporary = join(directory, `.${FILE_NAME}.${randomUUID()}.tmp`);
+    let handle: Awaited<ReturnType<typeof open>> | undefined;
+    try {
+      await mkdir(directory, { recursive: true, mode: 0o700 });
+      handle = await open(temporary, 'wx', 0o600);
+      await handle.writeFile(encoded);
+      await handle.sync();
+      await handle.close();
+      handle = undefined;
+      await rename(temporary, this.path);
+      const directoryHandle = await open(directory, 'r');
+      try {
+        await directoryHandle.sync();
+      } finally {
+        await directoryHandle.close();
+      }
+    } catch (error) {
+      throw persistence('Unable to persist Plugin Composition', error);
+    } finally {
+      await handle?.close().catch(() => undefined);
+      await rm(temporary, { force: true }).catch(() => undefined);
+    }
+  }
+}
+
+function decode(value: unknown): PersistedPluginComposition {
+  const root = record(value, 'Plugin Composition');
+  exact(root, ['schemaVersion', 'generation', 'roots']);
+  if (
+    root.schemaVersion !== 1 ||
+    !Number.isSafeInteger(root.generation) ||
+    (root.generation as number) < 0
+  ) {
+    throw invalid('Plugin Composition header is invalid');
+  }
+  const roots = record(root.roots, 'Plugin Composition roots');
+  exact(roots, ['profile', 'desktopUi', 'sessions']);
+  const sessions = record(roots.sessions, 'Plugin Composition sessions');
+  const decodedSessions: Record<string, readonly PersistedPluginEntry[]> = {};
+  for (const [scopeId, entries] of Object.entries(sessions)) {
+    if (!isCanonicalExtensionScopeId(scopeId)) throw invalid(`Invalid Session scope: ${scopeId}`);
+    decodedSessions[scopeId] = decodeEntries(entries, `sessions.${scopeId}`);
+  }
+  const profile = decodeEntries(roots.profile, 'profile');
+  const desktopUi = decodeEntries(roots.desktopUi, 'desktopUi');
+  const all = [
+    ...walk(profile),
+    ...walk(desktopUi),
+    ...Object.values(decodedSessions).flatMap(walk),
+  ];
+  const ids = new Set<string>();
+  for (const entry of all) {
+    if (ids.has(entry.id)) throw invalid(`Plugin entry id is repeated: ${entry.id}`);
+    ids.add(entry.id);
+  }
+  return Object.freeze({
+    schemaVersion: 1,
+    generation: root.generation as number,
+    roots: Object.freeze({
+      profile,
+      desktopUi,
+      sessions: Object.freeze(decodedSessions),
+    }),
+  });
+}
+
+function decodeEntries(value: unknown, label: string): readonly PersistedPluginEntry[] {
+  if (!Array.isArray(value) || value.length > 256) throw invalid(`${label} entries are invalid`);
+  return Object.freeze(value.map((item, index) => decodeEntry(item, `${label}[${index}]`)));
+}
+
+function decodeEntry(value: unknown, label: string): PersistedPluginEntry {
+  const entry = record(value, label);
+  exactOptional(
+    entry,
+    ['id', 'disabled', 'config'],
+    ['packageId', 'inject', 'isolate', 'intercept', 'children', 'error'],
+  );
+  if (!isCanonicalExtensionScopeId(entry.id)) throw invalid(`${label}.id is invalid`);
+  const group = entry.packageId === undefined;
+  if (!group && !isCanonicalExtensionId(entry.packageId))
+    throw invalid(`${label}.packageId is invalid`);
+  if (typeof entry.disabled !== 'boolean') throw invalid(`${label}.disabled is invalid`);
+  const config = scalarRecord(entry.config, `${label}.config`);
+  const error =
+    entry.error === undefined
+      ? undefined
+      : entry.error === null
+        ? null
+        : text(entry.error, `${label}.error`, 4096);
+  const inject = decodeInject(entry.inject, `${label}.inject`);
+  const isolate = decodeIsolate(entry.isolate, `${label}.isolate`);
+  const intercept = decodeJsonRecord(entry.intercept, `${label}.intercept`);
+  const children =
+    entry.children === undefined ? undefined : decodeEntries(entry.children, `${label}.children`);
+  return Object.freeze({
+    id: entry.id as string,
+    ...(group ? {} : { packageId: entry.packageId as string }),
+    disabled: entry.disabled,
+    config,
+    ...(inject === undefined ? {} : { inject }),
+    ...(isolate === undefined ? {} : { isolate }),
+    ...(intercept === undefined ? {} : { intercept }),
+    ...(children === undefined ? {} : { children }),
+    ...(error === undefined ? {} : { error }),
+  });
+}
+
+function decodeInject(
+  value: unknown,
+  label: string,
+): readonly string[] | Readonly<Record<string, unknown>> | undefined {
+  if (value === undefined) return undefined;
+  if (Array.isArray(value)) {
+    if (value.length > 64 || value.some((item) => typeof item !== 'string' || !item)) {
+      throw invalid(`${label} is invalid`);
+    }
+    return Object.freeze([...value]);
+  }
+  return decodeJsonRecord(value, label);
+}
+
+function decodeIsolate(
+  value: unknown,
+  label: string,
+): Readonly<Record<string, true | string>> | undefined {
+  if (value === undefined) return undefined;
+  const source = record(value, label);
+  const output: Record<string, true | string> = {};
+  for (const [key, item] of Object.entries(source)) {
+    if (item !== true && (typeof item !== 'string' || !item))
+      throw invalid(`${label}.${key} is invalid`);
+    output[key] = item;
+  }
+  return Object.freeze(output);
+}
+
+function decodeJsonRecord(
+  value: unknown,
+  label: string,
+): Readonly<Record<string, unknown>> | undefined {
+  if (value === undefined) return undefined;
+  const source = record(value, label);
+  let encoded: string;
+  try {
+    encoded = JSON.stringify(source);
+  } catch (error) {
+    throw invalid(`${label} is not JSON`, error);
+  }
+  if (Buffer.byteLength(encoded, 'utf8') > 64 * 1024)
+    throw invalid(`${label} exceeds its size limit`);
+  return Object.freeze(structuredClone(source));
+}
+
+function walk(entries: readonly PersistedPluginEntry[]): readonly PersistedPluginEntry[] {
+  return entries.flatMap((entry) => [entry, ...walk(entry.children ?? [])]);
+}
+
+function scalarRecord(
+  value: unknown,
+  label: string,
+): Readonly<Record<string, ExtensionConfigurationScalar>> {
+  const source = record(value, label);
+  const output: Record<string, ExtensionConfigurationScalar> = {};
+  for (const [key, item] of Object.entries(source)) {
+    if (!/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u.test(key)) throw invalid(`${label} key is invalid`);
+    if (
+      typeof item !== 'string' &&
+      typeof item !== 'boolean' &&
+      !(typeof item === 'number' && Number.isFinite(item))
+    ) {
+      throw invalid(`${label}.${key} is invalid`);
+    }
+    output[key] = item;
+  }
+  return Object.freeze(output);
+}
+
+function record(value: unknown, label: string): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw invalid(`${label} must be an object`);
+  return value as Record<string, unknown>;
+}
+
+function exact(value: Record<string, unknown>, keys: readonly string[]): void {
+  if (
+    keys.some((key) => !Object.hasOwn(value, key)) ||
+    Object.keys(value).some((key) => !keys.includes(key))
+  ) {
+    throw invalid('Plugin Composition fields are invalid');
+  }
+}
+
+function exactOptional(
+  value: Record<string, unknown>,
+  required: readonly string[],
+  optional: readonly string[],
+): void {
+  const allowed = new Set([...required, ...optional]);
+  if (
+    required.some((key) => !Object.hasOwn(value, key)) ||
+    Object.keys(value).some((key) => !allowed.has(key))
+  ) {
+    throw invalid('Plugin Composition fields are invalid');
+  }
+}
+
+function text(value: unknown, label: string, maxBytes: number): string {
+  if (
+    typeof value !== 'string' ||
+    !value ||
+    Buffer.byteLength(value, 'utf8') > maxBytes ||
+    /[\r\n\0]/u.test(value)
+  ) {
+    throw invalid(`${label} is invalid`);
+  }
+  return value;
+}
+
+function invalid(message: string, cause?: unknown): HostPluginCompositionStoreError {
+  return new HostPluginCompositionStoreError('invalid_state', message, { cause });
+}
+
+function persistence(message: string, cause?: unknown): HostPluginCompositionStoreError {
+  return new HostPluginCompositionStoreError('persistence_failed', message, { cause });
+}
diff --git a/packages/runtime-host/src/server/plugin-hook-activation.ts b/packages/runtime-host/src/server/plugin-hook-activation.ts
new file mode 100644
index 0000000000..a623c5308a
--- /dev/null
+++ b/packages/runtime-host/src/server/plugin-hook-activation.ts
@@ -0,0 +1,219 @@
+import type {
+  ExtensionEventDefinition,
+  ExtensionEventInvocationContext,
+  ExtensionEventListenerContribution,
+} from '@maka/runtime/extension-event-contributions';
+import type {
+  ExtensionServiceContribution,
+  ExtensionServiceInvocationContext,
+} from '@maka/runtime/extension-service-contributions';
+import type {
+  ExtensionTimerContribution,
+  ExtensionTimerInvocationContext,
+} from '@maka/runtime/extension-timer-contributions';
+import type { InstalledToolPackage, ToolPackageManifest } from './plugin-runtime-manifest.js';
+import {
+  InProcessPackageActivation,
+  type PackageContinuation,
+  type PackageEventEmitter,
+  type PackageServiceCaller,
+} from './in-process-package-runtime.js';
+import type { InstalledEventPackage } from './plugin-hook-manifest.js';
+
+/** One trusted Hook plugin activation backed by a live in-process module. */
+export class PluginHookActivation {
+  readonly #runtime: InProcessPackageActivation;
+  readonly #ownsRuntime: boolean;
+
+  constructor(
+    readonly installedPackage: InstalledEventPackage,
+    readonly configuration: Readonly<Record<string, string | number | boolean>> = Object.freeze({}),
+    emitEvent?: PackageEventEmitter,
+    callService?: PackageServiceCaller,
+    runtime?: InProcessPackageActivation,
+  ) {
+    this.#runtime =
+      runtime ??
+      new InProcessPackageActivation(
+        asToolPackage(installedPackage),
+        configuration,
+        emitEvent,
+        callService,
+      );
+    this.#ownsRuntime = runtime === undefined;
+  }
+
+  events(): readonly ExtensionEventDefinition[] {
+    return Object.freeze(
+      this.installedPackage.manifest.events.map((event) => Object.freeze({ ...event })),
+    );
+  }
+
+  listeners(): readonly ExtensionEventListenerContribution[] {
+    return Object.freeze(
+      this.installedPackage.manifest.listeners.map((declaration) =>
+        Object.freeze({
+          ...declaration,
+          invoke: (
+            payload: unknown,
+            context: ExtensionEventInvocationContext,
+            next?: PackageContinuation,
+          ) => this.#invoke(declaration.handler, payload, context, next),
+        }),
+      ),
+    );
+  }
+
+  services(): readonly ExtensionServiceContribution[] {
+    return Object.freeze(
+      this.installedPackage.manifest.services.map((service) =>
+        Object.freeze({
+          ...service,
+          invoke: (method: string, input: unknown, context: ExtensionServiceInvocationContext) => {
+            const definition = service.methods.find((candidate) => candidate.name === method);
+            if (!definition)
+              throw new Error(`Service method is not declared: ${service.name}.${method}`);
+            return this.#invokeService(definition.handler, input, context);
+          },
+        }),
+      ),
+    );
+  }
+
+  timers(): readonly ExtensionTimerContribution[] {
+    return Object.freeze(
+      this.installedPackage.manifest.timers.map((timer) =>
+        Object.freeze({
+          ...timer,
+          configuration: this.configuration,
+          invoke: (payload: unknown, context: ExtensionTimerInvocationContext) =>
+            this.#invokeTimer(timer.handler, payload, context),
+        }),
+      ),
+    );
+  }
+
+  async healthCheck(): Promise<void> {
+    if (
+      this.installedPackage.manifest.listeners.length === 0 &&
+      this.installedPackage.manifest.services.length === 0 &&
+      this.installedPackage.manifest.timers.length === 0
+    )
+      return;
+    await this.#runtime.healthCheck([
+      ...this.installedPackage.manifest.listeners.map(({ handler }) => handler),
+      ...this.installedPackage.manifest.services.flatMap(({ methods }) =>
+        methods.map(({ handler }) => handler),
+      ),
+      ...this.installedPackage.manifest.timers.map(({ handler }) => handler),
+    ]);
+  }
+
+  async dispose(): Promise<void> {
+    if (this.#ownsRuntime) await this.#runtime.dispose();
+  }
+
+  async #invoke(
+    handler: string,
+    payload: unknown,
+    context: ExtensionEventInvocationContext,
+    next?: PackageContinuation,
+  ): Promise<unknown> {
+    return await this.#runtime.invokeRaw(
+      handler,
+      payload,
+      {
+        sessionId: context.sessionId,
+        ...(context.runId ? { runId: context.runId } : {}),
+        turnId: context.turnId,
+        cwd: context.cwd,
+        toolCallId: `event-listener:${handler}`,
+        abortSignal: context.signal,
+        permissionMode: context.permissionMode,
+        origin: context.origin,
+        eventDepth: context.eventDepth,
+      },
+      next,
+    );
+  }
+
+  async #invokeService(
+    handler: string,
+    input: unknown,
+    context: ExtensionServiceInvocationContext,
+  ): Promise<unknown> {
+    return await this.#runtime.invokeRaw(handler, input, {
+      sessionId: context.sessionId,
+      ...(context.runId ? { runId: context.runId } : {}),
+      turnId: context.turnId,
+      cwd: context.cwd,
+      toolCallId: `service:${handler}`,
+      abortSignal: context.signal,
+      permissionMode: context.permissionMode,
+      origin: context.origin,
+      serviceDepth: context.serviceDepth,
+    });
+  }
+
+  async #invokeTimer(
+    handler: string,
+    payload: unknown,
+    context: ExtensionTimerInvocationContext,
+  ): Promise<unknown> {
+    return await this.#runtime.invokeRaw(handler, payload, {
+      sessionId: context.sessionId,
+      turnId: context.turnId,
+      cwd: context.cwd,
+      toolCallId: `timer:${handler}:${context.scheduledAt}`,
+      abortSignal: context.signal,
+      permissionMode: context.permissionMode,
+      origin: context.origin,
+    });
+  }
+}
+
+function asToolPackage(installed: InstalledEventPackage): InstalledToolPackage {
+  const manifest: ToolPackageManifest = Object.freeze({
+    schemaVersion: 1,
+    id: installed.extensionId,
+    entry: installed.manifest.entry,
+    tools: Object.freeze([
+      ...installed.manifest.listeners.map((listener) =>
+        Object.freeze({
+          name: listener.id,
+          description: `${listener.event} Event Listener`,
+          handler: listener.handler,
+          inputSchema: Object.freeze({}),
+          recoveryMode: 'never_auto_retry' as const,
+        }),
+      ),
+      ...installed.manifest.services.flatMap((service) =>
+        service.methods.map((method) =>
+          Object.freeze({
+            name: `${service.name}.${method.name}`,
+            description: method.description || `${service.name}.${method.name} Service method`,
+            handler: method.handler,
+            inputSchema: method.inputSchema,
+            recoveryMode: 'never_auto_retry' as const,
+          }),
+        ),
+      ),
+      ...installed.manifest.timers.map((timer) =>
+        Object.freeze({
+          name: `timer.${timer.id}`,
+          description: `${timer.id} Timer handler`,
+          handler: timer.handler,
+          inputSchema: Object.freeze({}),
+          recoveryMode: 'never_auto_retry' as const,
+        }),
+      ),
+    ]),
+    permissions: installed.manifest.permissions,
+  });
+  return Object.freeze({
+    extensionId: installed.extensionId,
+    root: installed.root,
+    entry: installed.entry,
+    manifest,
+  });
+}
diff --git a/packages/runtime-host/src/server/plugin-hook-manifest.ts b/packages/runtime-host/src/server/plugin-hook-manifest.ts
new file mode 100644
index 0000000000..ea37648c0d
--- /dev/null
+++ b/packages/runtime-host/src/server/plugin-hook-manifest.ts
@@ -0,0 +1,375 @@
+import { isCanonicalExtensionId } from '@maka/runtime/plugin-runtime';
+import {
+  type ExtensionEventDispatchMode,
+  validateExtensionEventDefinition,
+  validateExtensionEventListener,
+} from '@maka/runtime/extension-event-contributions';
+import {
+  validateExtensionServiceContribution,
+  type ExtensionServiceMethodDefinition,
+} from '@maka/runtime/extension-service-contributions';
+import { validateExtensionTimerContribution } from '@maka/runtime/extension-timer-contributions';
+import {
+  boundedString,
+  compareString,
+  exactRecord,
+  optionalExactRecord,
+  packagePath,
+} from './plugin-runtime-manifest.js';
+
+const ID_PATTERN = /^[A-Za-z][A-Za-z0-9._-]{0,127}$/u;
+
+export interface EventPackageManifestEvent {
+  readonly name: string;
+  readonly description: string;
+  readonly mode: ExtensionEventDispatchMode;
+  readonly payloadSchema: Readonly<Record<string, unknown>>;
+  readonly resultSchema?: Readonly<Record<string, unknown>>;
+}
+
+export interface EventPackageManifestListener {
+  readonly id: string;
+  readonly event: string;
+  readonly handler: string;
+  readonly priority: number;
+  readonly timeoutMs: number;
+}
+
+export interface EventPackageManifestService {
+  readonly name: string;
+  readonly version: string;
+  readonly description: string;
+  readonly methods: readonly ExtensionServiceMethodDefinition[];
+}
+
+export interface EventPackageManifestTimer {
+  readonly id: string;
+  readonly handler: string;
+  readonly intervalMs: number;
+  readonly initialDelayMs: number;
+  readonly timeoutMs: number;
+  readonly payload?: unknown;
+}
+
+export interface EventPackageManifest {
+  readonly schemaVersion: 1;
+  readonly id: string;
+  readonly entry: string;
+  readonly events: readonly EventPackageManifestEvent[];
+  readonly listeners: readonly EventPackageManifestListener[];
+  readonly services: readonly EventPackageManifestService[];
+  readonly timers: readonly EventPackageManifestTimer[];
+  readonly permissions: {
+    readonly workspace: 'none' | 'read' | 'write';
+    readonly network: boolean;
+  };
+}
+
+export interface InstalledEventPackage {
+  readonly extensionId: string;
+  readonly root: string;
+  readonly entry: string;
+  readonly manifest: EventPackageManifest;
+}
+
+export class PluginHookManifestError extends Error {
+  readonly name = 'PluginHookManifestError';
+
+  constructor(
+    readonly code: 'not_found' | 'invalid_package' | 'already_installed' | 'persistence_failed',
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+export function decodeEventPackageManifest(value: unknown): EventPackageManifest {
+  const root = optionalExactRecord(value, [
+    'schemaVersion',
+    'id',
+    'displayName',
+    'description',
+    'dependencies',
+    'configuration',
+    'runtime',
+    'ui',
+  ]);
+  const runtime = optionalExactRecord(root.runtime, [
+    'entry',
+    'tools',
+    'events',
+    'listeners',
+    'services',
+    'timers',
+    'permissions',
+  ]);
+  const record = {
+    schemaVersion: root.schemaVersion,
+    id: root.id,
+    entry: runtime.entry,
+    events: runtime.events ?? [],
+    listeners: runtime.listeners ?? [],
+    services: runtime.services ?? [],
+    timers: runtime.timers ?? [],
+    permissions: runtime.permissions,
+  };
+  if (record.schemaVersion !== 1) throw invalidPackage('Event package schemaVersion must be 1');
+  const id = boundedString(record.id, 'Event id', 128);
+  if (!isCanonicalExtensionId(id)) throw invalidPackage('Event package id is invalid');
+  const entry = packagePath(record.entry, 'Event entry');
+  if (!entry.endsWith('.mjs')) throw invalidPackage('Event package entry must be an .mjs file');
+  if (!Array.isArray(record.events) || record.events.length > 64) {
+    throw invalidPackage('Event package events must contain at most 64 definitions');
+  }
+  if (!Array.isArray(record.listeners) || record.listeners.length > 64) {
+    throw invalidPackage('Event package listeners must contain at most 64 definitions');
+  }
+  const servicesSource = record.services ?? [];
+  if (!Array.isArray(servicesSource) || servicesSource.length > 64) {
+    throw invalidPackage('Event package services must contain at most 64 definitions');
+  }
+  const timersSource = record.timers ?? [];
+  if (!Array.isArray(timersSource) || timersSource.length > 64) {
+    throw invalidPackage('Event package timers must contain at most 64 definitions');
+  }
+  if (
+    record.events.length === 0 &&
+    record.listeners.length === 0 &&
+    servicesSource.length === 0 &&
+    timersSource.length === 0
+  ) {
+    throw invalidPackage(
+      'Event package must declare at least one Event, Listener, Service, or Timer',
+    );
+  }
+  const eventNames = new Set<string>();
+  const events = record.events.map((value, index): EventPackageManifestEvent => {
+    const event = optionalExactRecord(value, [
+      'name',
+      'description',
+      'mode',
+      'payloadSchema',
+      'resultSchema',
+    ]);
+    const name = boundedString(event.name, `Event events[${index}].name`, 192);
+    const description = optionalDescription(
+      event.description,
+      `Event events[${index}].description`,
+    );
+    const payloadSchema = requireJsonSchema(event.payloadSchema, name);
+    const mode = (event.mode ?? 'emit') as ExtensionEventDispatchMode;
+    const resultSchema =
+      event.resultSchema === undefined ? undefined : requireJsonSchema(event.resultSchema, name);
+    if (eventNames.has(name)) throw invalidPackage(`Event definition repeats: ${name}`);
+    eventNames.add(name);
+    const definition = Object.freeze({
+      name,
+      description,
+      mode,
+      payloadSchema,
+      ...(resultSchema ? { resultSchema } : {}),
+    });
+    try {
+      validateExtensionEventDefinition(id, definition);
+    } catch (error) {
+      throw invalidPackage(
+        error instanceof Error ? error.message : `Event definition is invalid: ${name}`,
+        error,
+      );
+    }
+    return definition;
+  });
+  const listenerIds = new Set<string>();
+  const listeners = record.listeners.map((value, index): EventPackageManifestListener => {
+    const listener = optionalExactRecord(value, [
+      'id',
+      'event',
+      'handler',
+      'priority',
+      'timeoutMs',
+    ]);
+    const listenerId = boundedString(listener.id, `Event listeners[${index}].id`, 128);
+    const event = boundedString(listener.event, `Event listeners[${index}].event`, 192);
+    const handler = boundedString(listener.handler, `Event listeners[${index}].handler`, 128);
+    const priority = listener.priority === undefined ? 0 : listener.priority;
+    const timeoutMs = listener.timeoutMs === undefined ? 3_000 : listener.timeoutMs;
+    if (listenerIds.has(`${event}\0${listenerId}`))
+      throw invalidPackage(`Event Listener repeats: ${event}:${listenerId}`);
+    listenerIds.add(`${event}\0${listenerId}`);
+    if (!ID_PATTERN.test(listenerId) || !ID_PATTERN.test(handler))
+      throw invalidPackage(`Event Listener identity is invalid: ${listenerId}`);
+    const contribution = {
+      id: listenerId,
+      event,
+      handler,
+      priority: priority as number,
+      timeoutMs: timeoutMs as number,
+      invoke: async () => undefined,
+    };
+    try {
+      validateExtensionEventListener(contribution);
+    } catch (error) {
+      throw invalidPackage(
+        error instanceof Error ? error.message : `Event Listener is invalid: ${listenerId}`,
+        error,
+      );
+    }
+    return Object.freeze({
+      id: listenerId,
+      event,
+      handler,
+      priority: priority as number,
+      timeoutMs: timeoutMs as number,
+    });
+  });
+  const permissions = exactRecord(record.permissions, ['workspace', 'network']);
+  if (
+    permissions.workspace !== 'none' &&
+    permissions.workspace !== 'read' &&
+    permissions.workspace !== 'write'
+  ) {
+    throw invalidPackage('Extension Runtime workspace permission is invalid');
+  }
+  if (typeof permissions.network !== 'boolean')
+    throw invalidPackage('Event package network permission is invalid');
+  const serviceNames = new Set<string>();
+  const services = servicesSource.map((value, index): EventPackageManifestService => {
+    const service = optionalExactRecord(value, ['name', 'version', 'description', 'methods']);
+    const name = boundedString(service.name, `Event services[${index}].name`, 192);
+    const version = boundedString(service.version, `Event services[${index}].version`, 128);
+    const description = optionalDescription(
+      service.description,
+      `Event services[${index}].description`,
+    );
+    if (
+      !Array.isArray(service.methods) ||
+      service.methods.length === 0 ||
+      service.methods.length > 64
+    )
+      throw invalidPackage(`Service methods are invalid: ${name}`);
+    if (serviceNames.has(name)) throw invalidPackage(`Service definition repeats: ${name}`);
+    serviceNames.add(name);
+    const methodNames = new Set<string>();
+    const methods = service.methods.map(
+      (methodValue, methodIndex): ExtensionServiceMethodDefinition => {
+        const method = optionalExactRecord(methodValue, [
+          'name',
+          'description',
+          'handler',
+          'inputSchema',
+          'outputSchema',
+          'timeoutMs',
+        ]);
+        const methodName = boundedString(
+          method.name,
+          `Event services[${index}].methods[${methodIndex}].name`,
+          128,
+        );
+        if (methodNames.has(methodName))
+          throw invalidPackage(`Service method repeats: ${name}.${methodName}`);
+        methodNames.add(methodName);
+        return Object.freeze({
+          name: methodName,
+          description: optionalDescription(method.description, `Service method description`),
+          handler: boundedString(method.handler, `Service method handler`, 128),
+          inputSchema: requireJsonSchema(method.inputSchema, `${name}.${methodName}.input`),
+          outputSchema: requireJsonSchema(method.outputSchema, `${name}.${methodName}.output`),
+          timeoutMs: (method.timeoutMs ?? 3_000) as number,
+        });
+      },
+    );
+    const contribution = {
+      name,
+      version,
+      description,
+      methods,
+      invoke: async () => undefined,
+    };
+    try {
+      validateExtensionServiceContribution(id, contribution);
+    } catch (error) {
+      throw invalidPackage(
+        error instanceof Error ? error.message : `Service definition is invalid: ${name}`,
+        error,
+      );
+    }
+    return Object.freeze({ name, version, description, methods: Object.freeze(methods) });
+  });
+  const timerIds = new Set<string>();
+  const timers = timersSource.map((value, index): EventPackageManifestTimer => {
+    const timer = optionalExactRecord(value, [
+      'id',
+      'handler',
+      'intervalMs',
+      'initialDelayMs',
+      'timeoutMs',
+      'payload',
+    ]);
+    const id = boundedString(timer.id, `Event timers[${index}].id`, 128);
+    if (timerIds.has(id)) throw invalidPackage(`Timer definition repeats: ${id}`);
+    timerIds.add(id);
+    const definition = Object.freeze({
+      id,
+      handler: boundedString(timer.handler, `Event timers[${index}].handler`, 128),
+      intervalMs: (timer.intervalMs ?? 60_000) as number,
+      initialDelayMs: (timer.initialDelayMs ?? timer.intervalMs ?? 60_000) as number,
+      timeoutMs: (timer.timeoutMs ?? 3_000) as number,
+      ...(timer.payload === undefined ? {} : { payload: structuredClone(timer.payload) }),
+    });
+    try {
+      validateExtensionTimerContribution({
+        ...definition,
+        configuration: Object.freeze({}),
+        invoke: async () => undefined,
+      });
+    } catch (error) {
+      throw invalidPackage(
+        error instanceof Error ? error.message : `Timer definition is invalid: ${id}`,
+        error,
+      );
+    }
+    return definition;
+  });
+  return Object.freeze({
+    schemaVersion: 1,
+    id,
+    entry,
+    events: Object.freeze(events.sort((left, right) => compareString(left.name, right.name))),
+    listeners: Object.freeze(
+      listeners.sort(
+        (left, right) =>
+          left.event.localeCompare(right.event) ||
+          right.priority - left.priority ||
+          compareString(left.id, right.id),
+      ),
+    ),
+    services: Object.freeze(services.sort((left, right) => compareString(left.name, right.name))),
+    timers: Object.freeze(timers.sort((left, right) => compareString(left.id, right.id))),
+    permissions: Object.freeze({ workspace: permissions.workspace, network: permissions.network }),
+  });
+}
+
+function requireJsonSchema(value: unknown, name: string): Readonly<Record<string, unknown>> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw invalidPackage(`Event payloadSchema must be an object: ${name}`);
+  }
+  let encoded: string;
+  try {
+    encoded = JSON.stringify(value);
+  } catch (error) {
+    throw invalidPackage(`Event payloadSchema is not JSON: ${name}`, error);
+  }
+  if (Buffer.byteLength(encoded, 'utf8') > 64 * 1024)
+    throw invalidPackage(`Event payloadSchema is too large: ${name}`);
+  return Object.freeze(structuredClone(value as Record<string, unknown>));
+}
+
+function optionalDescription(value: unknown, label: string): string {
+  if (value === undefined || value === '') return '';
+  return boundedString(value, label, 4096);
+}
+
+function invalidPackage(message: string, cause?: unknown): PluginHookManifestError {
+  return new PluginHookManifestError('invalid_package', message, { cause });
+}
diff --git a/packages/runtime-host/src/server/plugin-package-store.ts b/packages/runtime-host/src/server/plugin-package-store.ts
new file mode 100644
index 0000000000..2c4c8bae27
--- /dev/null
+++ b/packages/runtime-host/src/server/plugin-package-store.ts
@@ -0,0 +1,292 @@
+import { randomUUID } from 'node:crypto';
+import type { Dirent } from 'node:fs';
+import { mkdir, readFile, readdir, rename, rm, stat } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { isCanonicalExtensionId } from '@maka/runtime/plugin-runtime';
+import {
+  type ExtensionPackageManifest,
+  loadExtensionPackageManifest,
+} from './extension-package-manifest.js';
+import {
+  type InstalledEventPackage,
+  type EventPackageManifest,
+  decodeEventPackageManifest,
+} from './plugin-hook-manifest.js';
+import {
+  type InstalledToolPackage,
+  type PackageFile,
+  type ToolPackageManifest,
+  decodeToolPackageManifest,
+  readSourcePackage,
+  syncDirectory,
+  syncTree,
+  writeStoredFile,
+} from './plugin-runtime-manifest.js';
+import {
+  type InstalledUiPackage,
+  type UiPackageManifest,
+  decodeUiPackageManifest,
+} from './plugin-ui-manifest.js';
+
+const STORE_DIRECTORY = 'plugin-packages-v2';
+const MANIFEST_FILE = 'maka.extension.json';
+
+export interface InstalledPluginPackage {
+  readonly extensionId: string;
+  readonly root: string;
+  readonly manifest: ExtensionPackageManifest;
+  readonly toolManifest?: ToolPackageManifest;
+  readonly uiManifest?: UiPackageManifest;
+  readonly eventManifest?: EventPackageManifest;
+}
+
+export class PluginPackageStoreError extends Error {
+  readonly name = 'PluginPackageStoreError';
+
+  constructor(
+    readonly code: 'not_found' | 'invalid_package' | 'already_installed' | 'persistence_failed',
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+/** One trusted package directory per Extension identity. */
+export class PluginPackageStore {
+  readonly root: string;
+
+  constructor(controlDirectory: string) {
+    this.root = join(controlDirectory, STORE_DIRECTORY);
+  }
+
+  async install(sourcePath: string): Promise<InstalledPluginPackage> {
+    const files = await readFiles(sourcePath);
+    const decoded = await decodePackage(sourcePath, files);
+    const target = join(this.root, decoded.manifest.id);
+    const staging = join(this.root, `.staging-${randomUUID()}`);
+    const previous = join(this.root, `.previous-${randomUUID()}`);
+    let committed = false;
+    try {
+      await mkdir(this.root, { recursive: true, mode: 0o700 });
+      await mkdir(staging, { mode: 0o700 });
+      for (const file of files) await writeStoredFile(staging, file);
+      await syncTree(staging, files);
+      await rename(target, previous).catch((error: NodeJS.ErrnoException) => {
+        if (error.code !== 'ENOENT') throw error;
+      });
+      await rename(staging, target);
+      committed = true;
+      await syncDirectory(this.root);
+      await rm(previous, { recursive: true, force: true });
+      return freezeInstalled(target, decoded);
+    } catch (error) {
+      if (!committed) await rename(previous, target).catch(() => undefined);
+      throw persistence(`Unable to install Plugin package ${decoded.manifest.id}`, error);
+    } finally {
+      if (!committed) await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+  }
+
+  async list(): Promise<readonly InstalledPluginPackage[]> {
+    let packages: Dirent[];
+    try {
+      packages = await readdir(this.root, { withFileTypes: true });
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return Object.freeze([]);
+      throw persistence('Unable to list installed Plugin packages', error);
+    }
+    const installed: InstalledPluginPackage[] = [];
+    for (const item of packages.sort(compareDirent)) {
+      if (!item.isDirectory() || !isCanonicalExtensionId(item.name)) continue;
+      installed.push(await this.load(item.name));
+    }
+    return Object.freeze(installed);
+  }
+
+  async load(extensionId: string): Promise<InstalledPluginPackage> {
+    requireIdentity(extensionId);
+    const root = join(this.root, extensionId);
+    try {
+      if (!(await stat(root)).isDirectory()) {
+        throw invalid('Installed Plugin package is not a directory');
+      }
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+        throw new PluginPackageStoreError(
+          'not_found',
+          `Plugin package is not installed: ${extensionId}`,
+        );
+      }
+      if (error instanceof PluginPackageStoreError) throw error;
+      throw persistence(`Unable to read Plugin package ${extensionId}`, error);
+    }
+    const files = await readFiles(root);
+    const decoded = await decodePackage(root, files);
+    if (decoded.manifest.id !== extensionId) {
+      throw invalid(`Installed Plugin package identity check failed: ${extensionId}`);
+    }
+    return freezeInstalled(root, decoded);
+  }
+
+  async loadTool(extensionId: string): Promise<InstalledToolPackage> {
+    const installed = await this.load(extensionId);
+    if (!installed.toolManifest) throw invalid(`Plugin has no Tool contributions: ${extensionId}`);
+    return Object.freeze({
+      extensionId,
+      root: installed.root,
+      entry: join(installed.root, ...installed.toolManifest.entry.split('/')),
+      manifest: installed.toolManifest,
+    });
+  }
+
+  async loadUi(extensionId: string): Promise<InstalledUiPackage> {
+    const installed = await this.load(extensionId);
+    if (!installed.uiManifest) throw invalid(`Plugin has no UI contributions: ${extensionId}`);
+    return Object.freeze({
+      extensionId,
+      root: installed.root,
+      manifest: installed.uiManifest,
+    });
+  }
+
+  async loadEvent(extensionId: string): Promise<InstalledEventPackage> {
+    const installed = await this.load(extensionId);
+    if (!installed.eventManifest) throw invalid(`Plugin has no Hook contributions: ${extensionId}`);
+    return Object.freeze({
+      extensionId,
+      root: installed.root,
+      entry: join(installed.root, ...installed.eventManifest.entry.split('/')),
+      manifest: installed.eventManifest,
+    });
+  }
+
+  async readText(
+    installed: Pick<InstalledPluginPackage, 'root'>,
+    relativePath: string,
+  ): Promise<string> {
+    const content = await readFile(join(installed.root, ...relativePath.split('/')));
+    try {
+      return new TextDecoder('utf-8', { fatal: true }).decode(content);
+    } catch (error) {
+      throw invalid(`Plugin package file is not valid UTF-8: ${relativePath}`, error);
+    }
+  }
+
+  async readDocument(
+    installed: Pick<InstalledPluginPackage, 'root'>,
+    relativePath: string,
+  ): Promise<string> {
+    return await this.readText(installed, relativePath);
+  }
+
+  async uninstall(extensionId: string): Promise<void> {
+    await this.load(extensionId);
+    const target = join(this.root, extensionId);
+    try {
+      await rm(target, { recursive: true, force: false });
+      await syncDirectory(this.root).catch(() => undefined);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+        throw persistence(`Unable to uninstall Plugin package ${extensionId}`, error);
+      }
+    }
+  }
+}
+
+interface DecodedPackage {
+  readonly manifest: ExtensionPackageManifest;
+  readonly toolManifest?: ToolPackageManifest;
+  readonly uiManifest?: UiPackageManifest;
+  readonly eventManifest?: EventPackageManifest;
+}
+
+async function decodePackage(root: string, files: readonly PackageFile[]): Promise<DecodedPackage> {
+  const manifestFile = files.find(({ path }) => path === MANIFEST_FILE);
+  if (!manifestFile) throw invalid(`Plugin package is missing ${MANIFEST_FILE}`);
+  let manifest: ExtensionPackageManifest;
+  try {
+    const loaded = await loadExtensionPackageManifest(root);
+    if (!loaded) throw invalid(`Plugin package is missing ${MANIFEST_FILE}`);
+    manifest = loaded;
+  } catch (error) {
+    throw invalid(error instanceof Error ? error.message : 'Plugin manifest is invalid', error);
+  }
+  let raw: Record<string, unknown>;
+  try {
+    raw = JSON.parse(manifestFile.content.toString('utf8')) as Record<string, unknown>;
+  } catch (error) {
+    throw invalid('Plugin manifest is invalid JSON', error);
+  }
+  const runtime = raw.runtime as Record<string, unknown> | undefined;
+  const hasTools = Array.isArray(runtime?.tools) && runtime.tools.length > 0;
+  const hasEvents = ['events', 'listeners', 'services', 'timers'].some(
+    (key) => Array.isArray(runtime?.[key]) && (runtime[key] as unknown[]).length > 0,
+  );
+  const hasUi = raw.ui !== undefined;
+  if (!hasTools && !hasEvents && !hasUi) {
+    throw invalid('Plugin package must declare Tool, UI, or Hook contributions');
+  }
+  try {
+    const toolManifest = hasTools ? decodeToolPackageManifest(raw) : undefined;
+    const eventManifest = hasEvents ? decodeEventPackageManifest(raw) : undefined;
+    const uiManifest = hasUi ? decodeUiPackageManifest(raw) : undefined;
+    const paths = new Set(files.map(({ path }) => path));
+    if (toolManifest && !paths.has(toolManifest.entry)) {
+      throw invalid(`Plugin runtime entry does not exist: ${toolManifest.entry}`);
+    }
+    if (eventManifest && !paths.has(eventManifest.entry)) {
+      throw invalid(`Plugin runtime entry does not exist: ${eventManifest.entry}`);
+    }
+    if (uiManifest) {
+      for (const item of uiManifest.ui) {
+        if (!paths.has(item.document))
+          throw invalid(`Plugin UI document does not exist: ${item.document}`);
+      }
+      if (uiManifest.host && !paths.has(uiManifest.host.entry)) {
+        throw invalid(`Plugin UI Host entry does not exist: ${uiManifest.host.entry}`);
+      }
+    }
+    return Object.freeze({
+      manifest,
+      ...(toolManifest ? { toolManifest } : {}),
+      ...(uiManifest ? { uiManifest } : {}),
+      ...(eventManifest ? { eventManifest } : {}),
+    });
+  } catch (error) {
+    throw invalid(
+      error instanceof Error ? error.message : 'Plugin contributions are invalid',
+      error,
+    );
+  }
+}
+
+async function readFiles(root: string): Promise<readonly PackageFile[]> {
+  try {
+    return await readSourcePackage(root);
+  } catch (error) {
+    throw invalid(error instanceof Error ? error.message : 'Plugin package is invalid', error);
+  }
+}
+
+function freezeInstalled(root: string, decoded: DecodedPackage): InstalledPluginPackage {
+  return Object.freeze({ extensionId: decoded.manifest.id, root, ...decoded });
+}
+
+function requireIdentity(extensionId: string): void {
+  if (!isCanonicalExtensionId(extensionId)) {
+    throw invalid('Plugin package identity is invalid');
+  }
+}
+
+function compareDirent(left: Dirent, right: Dirent): number {
+  return left.name.localeCompare(right.name);
+}
+
+function invalid(message: string, cause?: unknown): PluginPackageStoreError {
+  return new PluginPackageStoreError('invalid_package', message, { cause });
+}
+
+function persistence(message: string, cause?: unknown): PluginPackageStoreError {
+  return new PluginPackageStoreError('persistence_failed', message, { cause });
+}
diff --git a/packages/runtime-host/src/server/plugin-runtime-manifest.ts b/packages/runtime-host/src/server/plugin-runtime-manifest.ts
new file mode 100644
index 0000000000..5ec7448c9b
--- /dev/null
+++ b/packages/runtime-host/src/server/plugin-runtime-manifest.ts
@@ -0,0 +1,401 @@
+import { constants, type Dirent } from 'node:fs';
+import { mkdir, open, readdir, realpath, rename, rm, stat } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { dirname, isAbsolute, join, posix, resolve } from 'node:path';
+import type { ToolCategory } from '@maka/core/permission';
+import type { ToolRecoveryMode } from '@maka/core/runtime-event';
+import { isCanonicalExtensionId } from '@maka/runtime/plugin-runtime';
+
+const MANIFEST_FILE = 'maka.extension.json';
+const MAX_FILES = 128;
+const MAX_FILE_BYTES = 4 * 1024 * 1024;
+const MAX_PACKAGE_BYTES = 8 * 1024 * 1024;
+const MAX_MANIFEST_BYTES = 256 * 1024;
+const TOOL_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,127}$/u;
+const CATEGORIES = new Set<ToolCategory>([
+  'read',
+  'web_read',
+  'file_write',
+  'fs_destructive',
+  'shell_safe',
+  'shell_unsafe',
+  'git_destructive',
+  'network_send',
+  'subagent',
+  'computer_use',
+  'client_capability',
+]);
+const RECOVERY_MODES = new Set<ToolRecoveryMode>([
+  'replay_safe',
+  'idempotent',
+  'reconcile',
+  'reattach',
+  'outcome_unknown',
+  'never_auto_retry',
+]);
+
+export type ToolPackageWorkspacePermission = 'none' | 'read' | 'write';
+
+export interface ToolPackageManifestTool {
+  readonly name: string;
+  readonly description: string;
+  readonly handler: string;
+  readonly inputSchema: Readonly<Record<string, unknown>>;
+  readonly displayName?: string;
+  readonly category?: ToolCategory;
+  readonly recoveryMode?: ToolRecoveryMode;
+  readonly visualization?: { readonly stateKey: string };
+}
+
+export interface ToolPackageManifest {
+  readonly schemaVersion: 1;
+  readonly id: string;
+  readonly entry: string;
+  readonly tools: readonly ToolPackageManifestTool[];
+  readonly permissions: {
+    readonly workspace: ToolPackageWorkspacePermission;
+    readonly network: boolean;
+  };
+}
+
+export interface InstalledToolPackage {
+  readonly extensionId: string;
+  readonly root: string;
+  readonly entry: string;
+  readonly manifest: ToolPackageManifest;
+}
+
+export class PluginPackageManifestError extends Error {
+  readonly name = 'PluginPackageManifestError';
+
+  constructor(
+    readonly code: 'not_found' | 'invalid_package' | 'already_installed' | 'persistence_failed',
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+export interface PackageFile {
+  readonly path: string;
+  readonly content: Buffer;
+}
+
+/** Decode the runtime contribution view of one Extension package. */
+export function decodeToolPackageManifest(value: unknown): ToolPackageManifest {
+  const root = optionalExactRecord(value, [
+    'schemaVersion',
+    'id',
+    'displayName',
+    'description',
+    'dependencies',
+    'configuration',
+    'runtime',
+    'ui',
+  ]);
+  const runtime = exactRecord(root.runtime, [
+    'entry',
+    'tools',
+    'events',
+    'listeners',
+    'services',
+    'timers',
+    'permissions',
+  ]);
+  const record = {
+    schemaVersion: root.schemaVersion,
+    id: root.id,
+    entry: runtime.entry,
+    tools: runtime.tools,
+    permissions: runtime.permissions,
+  };
+  if (record.schemaVersion !== 1) throw invalidPackage('Tool package schemaVersion must be 1');
+  const id = requireId(record.id);
+  const entry = packagePath(record.entry, 'entry');
+  if (!entry.endsWith('.mjs')) throw invalidPackage('Tool package entry must be an .mjs file');
+  if (!Array.isArray(record.tools) || record.tools.length === 0 || record.tools.length > 64) {
+    throw invalidPackage('Tool package must declare between 1 and 64 Tools');
+  }
+  const names = new Set<string>();
+  const tools = record.tools.map((value, index): ToolPackageManifestTool => {
+    const tool = optionalExactRecord(value, [
+      'name',
+      'description',
+      'handler',
+      'inputSchema',
+      'displayName',
+      'category',
+      'recoveryMode',
+      'visualization',
+    ]);
+    const name = boundedString(tool.name, `tools[${index}].name`, 128);
+    if (!TOOL_NAME_PATTERN.test(name)) throw invalidPackage(`Tool name is invalid: ${name}`);
+    const key = name.toLowerCase();
+    if (names.has(key)) throw invalidPackage(`Tool package repeats Tool name: ${name}`);
+    names.add(key);
+    const handler = boundedString(tool.handler, `tools[${index}].handler`, 128);
+    if (!TOOL_NAME_PATTERN.test(handler))
+      throw invalidPackage(`Tool handler is invalid: ${handler}`);
+    const inputSchema = jsonSchema(tool.inputSchema, `tools[${index}].inputSchema`);
+    const displayName = optionalBoundedString(tool.displayName, `tools[${index}].displayName`, 128);
+    const category = optionalEnum(tool.category, CATEGORIES, `tools[${index}].category`);
+    const recoveryMode = optionalEnum(
+      tool.recoveryMode,
+      RECOVERY_MODES,
+      `tools[${index}].recoveryMode`,
+    );
+    const visualization =
+      tool.visualization === undefined ? undefined : exactRecord(tool.visualization, ['stateKey']);
+    const stateKey = visualization
+      ? boundedString(visualization.stateKey, `tools[${index}].visualization.stateKey`, 128)
+      : undefined;
+    if (stateKey && !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(stateKey)) {
+      throw invalidPackage(`Tool visualization state key is invalid: ${stateKey}`);
+    }
+    return Object.freeze({
+      name,
+      description: boundedString(tool.description, `tools[${index}].description`, 4096),
+      handler,
+      inputSchema,
+      ...(displayName ? { displayName } : {}),
+      ...(category ? { category } : {}),
+      ...(recoveryMode ? { recoveryMode } : {}),
+      ...(stateKey ? { visualization: Object.freeze({ stateKey }) } : {}),
+    });
+  });
+  const permissions = exactRecord(record.permissions, ['workspace', 'network']);
+  const workspace = permissions.workspace;
+  if (workspace !== 'none' && workspace !== 'read' && workspace !== 'write') {
+    throw invalidPackage('Tool package workspace permission is invalid');
+  }
+  if (typeof permissions.network !== 'boolean') {
+    throw invalidPackage('Tool package network permission is invalid');
+  }
+  return Object.freeze({
+    schemaVersion: 1,
+    id,
+    entry,
+    tools: Object.freeze(tools),
+    permissions: Object.freeze({ workspace, network: permissions.network }),
+  });
+}
+
+export async function readSourcePackage(sourcePath: string): Promise<readonly PackageFile[]> {
+  if (typeof sourcePath !== 'string' || sourcePath.length === 0 || !isAbsolute(sourcePath)) {
+    throw invalidPackage('Tool package sourcePath must be absolute');
+  }
+  let root: string;
+  try {
+    root = await realpath(resolve(sourcePath));
+    if (!(await stat(root)).isDirectory())
+      throw invalidPackage('Tool package source is not a directory');
+  } catch (error) {
+    if (error instanceof PluginPackageManifestError) throw error;
+    throw invalidPackage('Tool package source directory is unavailable', error);
+  }
+  const paths: string[] = [];
+  await collectFiles(root, '', paths);
+  if (paths.length === 0 || paths.length > MAX_FILES) {
+    throw invalidPackage(`Tool package must contain between 1 and ${MAX_FILES} files`);
+  }
+  const files: PackageFile[] = [];
+  let total = 0;
+  for (const path of paths.sort(compareString)) {
+    const absolute = join(root, ...path.split('/'));
+    let handle: Awaited<ReturnType<typeof open>> | undefined;
+    try {
+      handle = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
+      const metadata = await handle.stat();
+      if (!metadata.isFile()) throw invalidPackage(`Tool package contains a non-file: ${path}`);
+      if (metadata.size > MAX_FILE_BYTES)
+        throw invalidPackage(`Tool package file is too large: ${path}`);
+      const content = await handle.readFile();
+      total += content.byteLength;
+      if (total > MAX_PACKAGE_BYTES) throw invalidPackage('Tool package exceeds its size limit');
+      files.push(Object.freeze({ path, content }));
+    } catch (error) {
+      if (error instanceof PluginPackageManifestError) throw error;
+      throw invalidPackage(`Unable to read Tool package file: ${path}`, error);
+    } finally {
+      await handle?.close().catch(() => undefined);
+    }
+  }
+  return Object.freeze(files);
+}
+
+async function collectFiles(root: string, directory: string, paths: string[]): Promise<void> {
+  const absolute = directory ? join(root, ...directory.split('/')) : root;
+  const entries = await readdir(absolute, { withFileTypes: true });
+  for (const entry of entries.sort(compareDirent)) {
+    if (entry.name === '.git') continue;
+    const path = directory ? `${directory}/${entry.name}` : entry.name;
+    packagePath(path, 'file path');
+    if (entry.isSymbolicLink())
+      throw invalidPackage(`Tool package may not contain symlinks: ${path}`);
+    if (entry.isDirectory()) await collectFiles(root, path, paths);
+    else if (entry.isFile()) paths.push(path);
+    else throw invalidPackage(`Tool package contains an unsupported entry: ${path}`);
+    if (paths.length > MAX_FILES) throw invalidPackage('Tool package contains too many files');
+  }
+}
+
+export async function writeStoredFile(root: string, file: PackageFile): Promise<void> {
+  const target = join(root, ...file.path.split('/'));
+  await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+  const handle = await open(target, 'wx', 0o600);
+  try {
+    await handle.writeFile(file.content);
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
+export async function syncTree(root: string, files: readonly PackageFile[]): Promise<void> {
+  const directories = new Set<string>([root]);
+  for (const file of files) {
+    let directory = dirname(join(root, ...file.path.split('/')));
+    while (directory.startsWith(root)) {
+      directories.add(directory);
+      if (directory === root) break;
+      directory = dirname(directory);
+    }
+  }
+  for (const directory of [...directories].sort((a, b) => b.length - a.length)) {
+    await syncDirectory(directory);
+  }
+}
+
+export async function syncDirectory(path: string): Promise<void> {
+  const handle = await open(path, 'r');
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
+export function packagePath(value: unknown, label: string): string {
+  const path = boundedString(value, label, 512);
+  if (
+    path.includes('\\') ||
+    path.includes('\0') ||
+    path.startsWith('/') ||
+    path.endsWith('/') ||
+    posix.normalize(path) !== path ||
+    path.split('/').some((segment) => segment === '' || segment === '.' || segment === '..')
+  ) {
+    throw invalidPackage(`Tool package ${label} is invalid`);
+  }
+  return path;
+}
+
+function requireId(value: unknown): string {
+  const id = boundedString(value, 'id', 128);
+  if (!validId(id)) throw invalidPackage('Tool package id is invalid');
+  return id;
+}
+
+function validId(value: string): boolean {
+  return isCanonicalExtensionId(value);
+}
+
+export function boundedString(value: unknown, label: string, maxBytes: number): string {
+  if (
+    typeof value !== 'string' ||
+    value.length === 0 ||
+    Buffer.byteLength(value, 'utf8') > maxBytes ||
+    /[\r\n\0]/u.test(value)
+  ) {
+    throw invalidPackage(`Tool package ${label} is invalid`);
+  }
+  return value;
+}
+
+function optionalBoundedString(
+  value: unknown,
+  label: string,
+  maxBytes: number,
+): string | undefined {
+  return value === undefined ? undefined : boundedString(value, label, maxBytes);
+}
+
+function optionalEnum<T extends string>(
+  value: unknown,
+  allowed: ReadonlySet<T>,
+  label: string,
+): T | undefined {
+  if (value === undefined) return undefined;
+  if (typeof value !== 'string' || !allowed.has(value as T)) {
+    throw invalidPackage(`Tool package ${label} is invalid`);
+  }
+  return value as T;
+}
+
+function jsonSchema(value: unknown, label: string): Readonly<Record<string, unknown>> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw invalidPackage(`Tool package ${label} must be a JSON Schema object`);
+  }
+  try {
+    const encoded = JSON.stringify(value);
+    if (Buffer.byteLength(encoded, 'utf8') > 64 * 1024) {
+      throw invalidPackage(`Tool package ${label} exceeds its size limit`);
+    }
+    return Object.freeze(structuredClone(value as Record<string, unknown>));
+  } catch (error) {
+    if (error instanceof PluginPackageManifestError) throw error;
+    throw invalidPackage(`Tool package ${label} is not JSON-serializable`, error);
+  }
+}
+
+export function exactRecord(value: unknown, keys: readonly string[]): Record<string, unknown> {
+  const record = optionalExactRecord(value, keys);
+  if (keys.some((key) => !Object.hasOwn(record, key))) {
+    throw invalidPackage('Tool package record fields are invalid');
+  }
+  return record;
+}
+
+export function optionalExactRecord(
+  value: unknown,
+  keys: readonly string[],
+): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw invalidPackage('Tool package record is invalid');
+  }
+  const record = value as Record<string, unknown>;
+  if (Object.keys(record).some((key) => !keys.includes(key))) {
+    throw invalidPackage('Tool package record contains unknown fields');
+  }
+  return record;
+}
+
+export function parseJson(encoded: Buffer): unknown {
+  try {
+    return JSON.parse(encoded.toString('utf8'));
+  } catch (error) {
+    throw invalidPackage('Tool package manifest is not valid JSON', error);
+  }
+}
+
+function sameManifest(left: ToolPackageManifest, right: ToolPackageManifest): boolean {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+function invalidPackage(message: string, cause?: unknown): PluginPackageManifestError {
+  return new PluginPackageManifestError('invalid_package', message, { cause });
+}
+
+function persistenceFailure(message: string, cause?: unknown): PluginPackageManifestError {
+  const detail = cause instanceof Error && cause.message ? `: ${cause.message}` : '';
+  return new PluginPackageManifestError('persistence_failed', `${message}${detail}`, { cause });
+}
+
+export function compareDirent(left: Dirent, right: Dirent): number {
+  return compareString(left.name, right.name);
+}
+
+export function compareString(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
diff --git a/packages/runtime-host/src/server/plugin-ui-manifest.ts b/packages/runtime-host/src/server/plugin-ui-manifest.ts
new file mode 100644
index 0000000000..b6f819e387
--- /dev/null
+++ b/packages/runtime-host/src/server/plugin-ui-manifest.ts
@@ -0,0 +1,251 @@
+import { posix } from 'node:path';
+import { isCanonicalExtensionId } from '@maka/runtime/plugin-runtime';
+import {
+  EXTENSION_UI_SURFACES,
+  type ExtensionUiSurface,
+} from '@maka/runtime/extension-ui-contributions';
+
+export interface UiPackageManifestContribution {
+  readonly id: string;
+  readonly surface: ExtensionUiSurface;
+  readonly slot?: string;
+  readonly slots: readonly string[];
+  readonly priority: number;
+  readonly document: string;
+}
+
+export interface UiPackageHostMethod {
+  readonly name: string;
+  readonly handler: string;
+}
+
+export interface UiPackageManifestHost {
+  readonly entry: string;
+  readonly methods: readonly UiPackageHostMethod[];
+}
+
+export interface UiPackageManifest {
+  readonly schemaVersion: 1;
+  readonly id: string;
+  readonly ui: readonly UiPackageManifestContribution[];
+  readonly host?: UiPackageManifestHost;
+  readonly permissions: {
+    readonly network: boolean;
+    readonly hostState: boolean;
+    readonly sessionAccess: boolean;
+  };
+}
+
+export interface InstalledUiPackage {
+  readonly extensionId: string;
+  readonly root: string;
+  readonly manifest: UiPackageManifest;
+}
+
+export class PluginUiManifestError extends Error {
+  readonly name = 'PluginUiManifestError';
+  constructor(
+    readonly code: 'not_found' | 'invalid_package' | 'already_installed' | 'persistence_failed',
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+/** Decode client contributions from the unified Extension manifest. */
+export function decodeUiPackageManifest(value: unknown): UiPackageManifest {
+  const root = exactRecord(value, [
+    'schemaVersion',
+    'id',
+    ...(value && typeof value === 'object' && Object.hasOwn(value, 'displayName')
+      ? ['displayName']
+      : []),
+    ...(value && typeof value === 'object' && Object.hasOwn(value, 'description')
+      ? ['description']
+      : []),
+    ...(value && typeof value === 'object' && Object.hasOwn(value, 'dependencies')
+      ? ['dependencies']
+      : []),
+    ...(value && typeof value === 'object' && Object.hasOwn(value, 'configuration')
+      ? ['configuration']
+      : []),
+    ...(value && typeof value === 'object' && Object.hasOwn(value, 'runtime') ? ['runtime'] : []),
+    'ui',
+  ]);
+  const uiValue = root.ui as Record<string, unknown> | null;
+  const candidate = uiValue;
+  const record = exactRecord(
+    uiValue,
+    candidate && Object.hasOwn(candidate, 'host')
+      ? ['contributions', 'host', 'permissions']
+      : ['contributions', 'permissions'],
+  );
+  if (root.schemaVersion !== 1) throw invalidPackage('Extension schemaVersion must be 1');
+  const id = requireId(root.id);
+  if (
+    !Array.isArray(record.contributions) ||
+    record.contributions.length === 0 ||
+    record.contributions.length > 16
+  ) {
+    throw invalidPackage('UI package must declare between 1 and 16 contributions');
+  }
+  const ids = new Set<string>();
+  const ui = record.contributions.map((value, index): UiPackageManifestContribution => {
+    const candidate = value as Record<string, unknown> | null;
+    const item = exactRecord(value, [
+      'id',
+      'surface',
+      'priority',
+      'document',
+      ...(candidate && Object.hasOwn(candidate, 'slot') ? ['slot'] : []),
+      ...(candidate && Object.hasOwn(candidate, 'slots') ? ['slots'] : []),
+    ]);
+    const contributionId = boundedString(item.id, `ui[${index}].id`, 128);
+    if (ids.has(contributionId))
+      throw invalidPackage(`UI contribution id repeats: ${contributionId}`);
+    ids.add(contributionId);
+    if (!EXTENSION_UI_SURFACES.includes(item.surface as ExtensionUiSurface)) {
+      throw invalidPackage(`UI contribution surface is invalid: ${String(item.surface)}`);
+    }
+    if (
+      (item.surface === 'app.slot' &&
+        (typeof item.slot !== 'string' ||
+          !/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/u.test(item.slot))) ||
+      (item.surface !== 'app.slot' && item.slot !== undefined)
+    ) {
+      throw invalidPackage('UI contribution slot is invalid');
+    }
+    if (!Number.isSafeInteger(item.priority) || Math.abs(item.priority as number) > 10_000) {
+      throw invalidPackage('UI contribution priority is invalid');
+    }
+    if (
+      item.slots !== undefined &&
+      (!Array.isArray(item.slots) ||
+        item.slots.length > 32 ||
+        item.slots.some(
+          (slot) =>
+            typeof slot !== 'string' ||
+            !/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/u.test(slot) ||
+            Buffer.byteLength(slot, 'utf8') > 128,
+        ) ||
+        new Set(item.slots).size !== item.slots.length)
+    ) {
+      throw invalidPackage('UI contribution child slots are invalid');
+    }
+    return Object.freeze({
+      id: contributionId,
+      surface: item.surface as ExtensionUiSurface,
+      ...(item.slot === undefined ? {} : { slot: item.slot as string }),
+      slots: Object.freeze((item.slots as string[] | undefined) ?? []),
+      priority: item.priority as number,
+      document: packagePath(item.document, `ui[${index}].document`),
+    });
+  });
+  const permissionRecord = record.permissions as Record<string, unknown> | null;
+  const permissionKeys = ['network'];
+  if (permissionRecord && Object.hasOwn(permissionRecord, 'hostState')) {
+    permissionKeys.push('hostState');
+  }
+  if (permissionRecord && Object.hasOwn(permissionRecord, 'sessionAccess')) {
+    permissionKeys.push('sessionAccess');
+  }
+  const permissions = exactRecord(record.permissions, permissionKeys);
+  if (typeof permissions.network !== 'boolean')
+    throw invalidPackage('UI network permission is invalid');
+  if (permissions.hostState !== undefined && typeof permissions.hostState !== 'boolean')
+    throw invalidPackage('UI Host state permission is invalid');
+  if (permissions.sessionAccess !== undefined && typeof permissions.sessionAccess !== 'boolean')
+    throw invalidPackage('UI Session access permission is invalid');
+  if (permissions.sessionAccess === true && !ui.some(({ surface }) => surface === 'app.root')) {
+    throw invalidPackage('Only a complete app.root UI may request Session access');
+  }
+  const host = record.host === undefined ? undefined : decodeHost(record.host);
+  return Object.freeze({
+    schemaVersion: 1,
+    id,
+    ui: Object.freeze(ui),
+    ...(host ? { host } : {}),
+    permissions: Object.freeze({
+      network: permissions.network,
+      hostState: permissions.hostState === true,
+      sessionAccess: permissions.sessionAccess === true,
+    }),
+  });
+}
+
+function decodeHost(value: unknown): UiPackageManifestHost {
+  const record = exactRecord(value, ['entry', 'methods']);
+  const entry = packagePath(record.entry, 'host.entry');
+  if (!entry.endsWith('.mjs')) throw invalidPackage('UI Host entry must be an .mjs file');
+  if (!Array.isArray(record.methods) || record.methods.length === 0 || record.methods.length > 64) {
+    throw invalidPackage('UI Host must declare between 1 and 64 methods');
+  }
+  const names = new Set<string>();
+  const methods = record.methods.map((value, index) => {
+    const method = exactRecord(value, ['name', 'handler']);
+    const name = boundedString(method.name, `host.methods[${index}].name`, 128);
+    const handler = boundedString(method.handler, `host.methods[${index}].handler`, 128);
+    if (
+      !/^[A-Za-z][A-Za-z0-9_-]{0,127}$/u.test(name) ||
+      !/^[A-Za-z][A-Za-z0-9_-]{0,127}$/u.test(handler)
+    ) {
+      throw invalidPackage('UI Host method name or handler is invalid');
+    }
+    if (names.has(name)) throw invalidPackage(`UI Host method repeats: ${name}`);
+    names.add(name);
+    return Object.freeze({ name, handler });
+  });
+  return Object.freeze({ entry, methods: Object.freeze(methods) });
+}
+
+function packagePath(value: unknown, label: string): string {
+  const path = boundedString(value, label, 512);
+  if (
+    path.includes('\\') ||
+    path.startsWith('/') ||
+    path.endsWith('/') ||
+    posix.normalize(path) !== path ||
+    path.split('/').some((part) => !part || part === '.' || part === '..')
+  )
+    throw invalidPackage(`UI package ${label} is invalid`);
+  return path;
+}
+
+function requireId(value: unknown): string {
+  const id = boundedString(value, 'id', 128);
+  if (!isCanonicalExtensionId(id)) throw invalidPackage('UI package id is invalid');
+  return id;
+}
+
+function boundedString(value: unknown, label: string, maxBytes: number): string {
+  if (
+    typeof value !== 'string' ||
+    !value ||
+    Buffer.byteLength(value, 'utf8') > maxBytes ||
+    /[\r\n\0]/u.test(value)
+  )
+    throw invalidPackage(`UI package ${label} is invalid`);
+  return value;
+}
+
+function exactRecord(value: unknown, keys: readonly string[]): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw invalidPackage('UI package record is invalid');
+  const record = value as Record<string, unknown>;
+  if (
+    Object.keys(record).some((key) => !keys.includes(key)) ||
+    keys.some((key) => !Object.hasOwn(record, key))
+  ) {
+    throw invalidPackage('UI package record fields are invalid');
+  }
+  return record;
+}
+
+function invalidPackage(message: string, cause?: unknown): PluginUiManifestError {
+  return new PluginUiManifestError('invalid_package', message, { cause });
+}
+
+function compareString(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
diff --git a/packages/runtime-host/src/server/session-catalog-coordinator.ts b/packages/runtime-host/src/server/session-catalog-coordinator.ts
index ae953c7da0..80ad21cd8a 100644
--- a/packages/runtime-host/src/server/session-catalog-coordinator.ts
+++ b/packages/runtime-host/src/server/session-catalog-coordinator.ts
@@ -114,6 +114,7 @@ export interface HostSessionCatalogCoordinatorOptions {
   readonly continuity: SessionContinuity;
   readonly workspaceResolver: HostWorkspaceResolver;
   readonly requestDrain: () => void;
+  readonly onCreated?: (sessionId: string, cwd: string) => void | Promise<void>;
 }
 
 interface ResolvedSessionModel {
@@ -142,6 +143,7 @@ export class HostSessionCatalogCoordinator {
   readonly #continuity: SessionContinuity;
   readonly #workspaceResolver: HostWorkspaceResolver;
   readonly #requestDrain: () => void;
+  readonly #onCreated: HostSessionCatalogCoordinatorOptions['onCreated'];
 
   constructor(options: HostSessionCatalogCoordinatorOptions) {
     this.#stores = options.stores;
@@ -151,6 +153,7 @@ export class HostSessionCatalogCoordinator {
     this.#continuity = options.continuity;
     this.#workspaceResolver = options.workspaceResolver;
     this.#requestDrain = options.requestDrain;
+    this.#onCreated = options.onCreated;
   }
 
   async resolveExternalSessionImportTarget(): Promise<Omit<CreateSessionInput, 'cwd' | 'name'>> {
@@ -364,6 +367,9 @@ export class HostSessionCatalogCoordinator {
               );
             }
             await this.#continuity.refreshCanonical(input.sessionId, lease);
+            await Promise.resolve(this.#onCreated?.(input.sessionId, workspace.cwd)).catch(
+              () => undefined,
+            );
             return createSuccess(
               projectSessionCatalogRecord(await this.#stores.readCatalogRecord(input.sessionId)),
             );
diff --git a/packages/runtime-host/src/server/session-retirement-coordinator.ts b/packages/runtime-host/src/server/session-retirement-coordinator.ts
index 357a1d0ce0..8c4c78410c 100644
--- a/packages/runtime-host/src/server/session-retirement-coordinator.ts
+++ b/packages/runtime-host/src/server/session-retirement-coordinator.ts
@@ -107,6 +107,7 @@ export interface HostSessionRetirementCoordinatorOptions {
   readonly worktrees?: Pick<SubagentWorktreeExecutor, 'retire'>;
   readonly requestDrain: () => void;
   readonly memoryExtractionLane: MemoryExtractionSessionLane;
+  readonly onDisposed?: (sessionId: string, cwd: string) => void | Promise<void>;
 }
 
 interface StableFamily {
@@ -160,6 +161,7 @@ export class HostSessionRetirementCoordinator {
   readonly #worktrees: HostSessionRetirementCoordinatorOptions['worktrees'];
   readonly #requestDrain: () => void;
   readonly #memoryExtractionLane: MemoryExtractionSessionLane;
+  readonly #onDisposed: HostSessionRetirementCoordinatorOptions['onDisposed'];
   readonly #cleanupQueue = new Set<string>();
   readonly #retiredWorktrees = new Map<string, SubagentWorkspaceBinding>();
   #cleanupWorker: Promise<void> | null = null;
@@ -187,6 +189,7 @@ export class HostSessionRetirementCoordinator {
     this.#worktrees = options.worktrees;
     this.#requestDrain = options.requestDrain;
     this.#memoryExtractionLane = options.memoryExtractionLane;
+    this.#onDisposed = options.onDisposed;
   }
 
   async recover(): Promise<void> {
@@ -245,6 +248,13 @@ export class HostSessionRetirementCoordinator {
             'archived',
           );
           committed = true;
+          await Promise.all(
+            [...committable.records.values()].map((record) =>
+              Promise.resolve(this.#onDisposed?.(record.header.id, record.header.cwd)).catch(
+                () => undefined,
+              ),
+            ),
+          );
           handles.goal.commit();
           handles.scheduledTasks.commit();
           await this.#graphWake.retireSessions(family.sessionIds);
@@ -307,6 +317,13 @@ export class HostSessionRetirementCoordinator {
             versionedFamily(committable),
           );
           committed = true;
+          await Promise.all(
+            [...committable.records.values()].map((record) =>
+              Promise.resolve(this.#onDisposed?.(record.header.id, record.header.cwd)).catch(
+                () => undefined,
+              ),
+            ),
+          );
           handles.goal.commit();
           handles.scheduledTasks.commit();
           await this.#graphWake.retireSessions(family.sessionIds);
diff --git a/packages/runtime-host/src/server/ui-package-service.ts b/packages/runtime-host/src/server/ui-package-service.ts
new file mode 100644
index 0000000000..e96d10c763
--- /dev/null
+++ b/packages/runtime-host/src/server/ui-package-service.ts
@@ -0,0 +1,75 @@
+import type { MakaToolContext } from '@maka/runtime/tool-runtime';
+import { join } from 'node:path';
+import { InProcessPackageActivation } from './in-process-package-runtime.js';
+import type { InstalledToolPackage, ToolPackageManifest } from './plugin-runtime-manifest.js';
+import type { InstalledUiPackage } from './plugin-ui-manifest.js';
+
+/** Executes a trusted UI package's private Host methods in process. */
+export class UiPackageService {
+  async healthCheck(installed: InstalledUiPackage): Promise<void> {
+    if (!installed.manifest.host) return;
+    const runtimePackage = asRuntimePackage(installed);
+    const activation = new InProcessPackageActivation(runtimePackage);
+    try {
+      await activation.healthCheck(runtimePackage.manifest.tools.map(({ handler }) => handler));
+    } finally {
+      await activation.dispose();
+    }
+  }
+
+  async invoke(
+    installed: InstalledUiPackage,
+    methodName: string,
+    args: unknown,
+    signal: AbortSignal,
+  ): Promise<unknown> {
+    const declaration = installed.manifest.host?.methods.find(({ name }) => name === methodName);
+    if (!declaration) throw new Error(`UI Host method is not declared: ${methodName}`);
+    const activation = new InProcessPackageActivation(asRuntimePackage(installed));
+    const context: MakaToolContext = {
+      sessionId: `ui:${installed.extensionId}`,
+      turnId: `ui-host:${methodName}`,
+      cwd: installed.root,
+      toolCallId: `ui-host:${methodName}`,
+      abortSignal: signal,
+      emitOutput: () => undefined,
+    };
+    try {
+      return await activation.invoke(declaration.handler, args, context);
+    } finally {
+      await activation.dispose();
+    }
+  }
+}
+
+function asRuntimePackage(installed: InstalledUiPackage): InstalledToolPackage {
+  const host = installed.manifest.host;
+  if (!host) throw new Error('UI package does not declare a Host service');
+  const manifest: ToolPackageManifest = {
+    schemaVersion: 1,
+    id: installed.extensionId,
+    entry: host.entry,
+    tools: Object.freeze(
+      host.methods.map(({ name, handler }) =>
+        Object.freeze({
+          name,
+          description: `Private UI Host method ${name}`,
+          handler,
+          inputSchema: Object.freeze({}),
+          category: 'network_send' as const,
+          recoveryMode: 'never_auto_retry' as const,
+        }),
+      ),
+    ),
+    permissions: Object.freeze({
+      workspace: 'none' as const,
+      network: installed.manifest.permissions.network,
+    }),
+  };
+  return Object.freeze({
+    extensionId: installed.extensionId,
+    root: installed.root,
+    entry: join(installed.root, ...host.entry.split('/')),
+    manifest: Object.freeze(manifest),
+  });
+}
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index 4ea647d4a8..0fb9afb511 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -31,6 +31,19 @@
     "./runtime-event-read-model": "./dist/runtime-event-read-model.js",
     "./runtime-resume": "./dist/runtime-resume.js",
     "./runtime-kernel": "./dist/runtime-kernel.js",
+    "./plugin-kernel": "./dist/plugin-kernel.js",
+    "./plugin-runtime": "./dist/plugin-runtime.js",
+    "./plugin-composition-loader": "./dist/plugin-composition-loader.js",
+    "./plugin-tool-service": "./dist/plugin-tool-service.js",
+    "./plugin-ui-service": "./dist/plugin-ui-service.js",
+    "./plugin-hook-service": "./dist/plugin-hook-service.js",
+    "./extension-tool-contributions": "./dist/extension-tool-contributions.js",
+    "./extension-ui-contributions": "./dist/extension-ui-contributions.js",
+    "./extension-event-contributions": "./dist/extension-event-contributions.js",
+    "./extension-dispatch": "./dist/extension-dispatch.js",
+    "./extension-core-events": "./dist/extension-core-events.js",
+    "./extension-service-contributions": "./dist/extension-service-contributions.js",
+    "./extension-timer-contributions": "./dist/extension-timer-contributions.js",
     "./invocation-context": "./dist/invocation-context.js",
     "./ai-sdk-flow": "./dist/ai-sdk-flow.js",
     "./stream-graph-readiness": "./dist/stream-graph-readiness.js",
@@ -111,6 +124,7 @@
     "./tool-result-archive-capability": "./dist/tool-result-archive-capability.js",
     "./tool-result-archive-resource": "./dist/tool-result-archive-resource.js",
     "./tool-runtime": "./dist/tool-runtime.js",
+    "./hooks/engine": "./dist/hooks/engine.js",
     "./web-fetch-tool": "./dist/web-fetch-tool.js",
     "./web-search-tool": "./dist/web-search-tool.js",
     "./xai-oauth-enrollment": "./dist/xai-oauth-enrollment.js"
@@ -128,12 +142,12 @@
     "@ai-sdk/google": "4.0.39",
     "@ai-sdk/openai": "4.0.36",
     "@ai-sdk/openai-compatible": "3.0.27",
-    "@openai/agents-core": "0.14.3",
     "@larksuiteoapi/node-sdk": "1.72.0",
     "@maka/code-mode": "0.1.0",
     "@maka/core": "0.1.0",
     "@modelcontextprotocol/sdk": "1.30.0",
     "@mozilla/readability": "^0.6.0",
+    "@openai/agents-core": "0.14.3",
     "@slack/socket-mode": "^3.0.0",
     "@slack/web-api": "^8.0.0",
     "@wecom/aibot-node-sdk": "1.0.7",
diff --git a/packages/runtime/src/__tests__/agent-graph-supervisor-wake.test.ts b/packages/runtime/src/__tests__/agent-graph-supervisor-wake.test.ts
index 82981a36c3..72dc03e5c8 100644
--- a/packages/runtime/src/__tests__/agent-graph-supervisor-wake.test.ts
+++ b/packages/runtime/src/__tests__/agent-graph-supervisor-wake.test.ts
@@ -156,6 +156,45 @@ describe('Agent Graph supervisor wake delivery', () => {
     }
   });
 
+  test('does not retry a provider billing failure', async () => {
+    const store = createSqliteSessionMetadataStore(':memory:');
+    let turns = 0;
+    const coordinator = new AgentGraphSupervisorWakeCoordinator({
+      activityRegistry: new SessionActivityRegistry(),
+      wakeStore: store,
+      readSnapshot: async () => snapshot(),
+      startTurn: async (_sessionId, input): Promise<GoalTurnOutcome> => {
+        turns += 1;
+        return {
+          kind: 'errored',
+          turnId: input.turnId,
+          reason: 'Turn ended with provider_billing',
+        };
+      },
+      inspectAttempt: async () => 'missing',
+      newId: sequentialIds(),
+    });
+    try {
+      coordinator.notify('root-session', reconciliation());
+      await coordinator.waitForIdle();
+
+      const wake = await store.readAgentGraphSupervisorWake('graph-1', 'graph-1:snapshot-1');
+      assert.equal(turns, 1);
+      assert.equal(wake?.status, 'superseded');
+      assert.equal(wake?.attemptCount, 1);
+      assert.equal(wake?.failureReason, 'non_retryable:errored: Turn ended with provider_billing');
+      assert.deepEqual(
+        (await store.listAgentGraphSupervisorWakeAttempts('graph-1', 'graph-1:snapshot-1')).map(
+          (candidate) => candidate.status,
+        ),
+        ['superseded'],
+      );
+    } finally {
+      await coordinator.close();
+      store.close();
+    }
+  });
+
   test('aggressively compacts after a context overflow before delivering a fresh turn', async () => {
     const store = createSqliteSessionMetadataStore(':memory:');
     let turns = 0;
diff --git a/packages/runtime/src/__tests__/ai-sdk-backend.test.ts b/packages/runtime/src/__tests__/ai-sdk-backend.test.ts
index 51901a2e81..7c51c1f0dd 100644
--- a/packages/runtime/src/__tests__/ai-sdk-backend.test.ts
+++ b/packages/runtime/src/__tests__/ai-sdk-backend.test.ts
@@ -81,6 +81,409 @@ import type { OpenAiResponsesSemanticBaseline } from '../openai-responses-contin
 import type { OpenAiResponsesTransportState } from '../openai-responses-websocket.js';
 import { getAIModel } from '../model-factory.js';
 
+describe('AiSdkBackend Extension middleware lifecycle', () => {
+  test('wraps the live LLM stream through core around middleware', async () => {
+    let observedLiveStream = false;
+    const preToolUseHooks: NonNullable<AiSdkBackendInput['preToolUseHooks']> = {
+      prepareTurn() {},
+      releaseTurn() {},
+      async runPreToolUse() {
+        return { denied: false, audits: [], auditWriteFailures: [] };
+      },
+      async runCoreMiddleware(event, payload, _signal, _context, next) {
+        assert.equal(event, 'maka.llm.stream');
+        assert.ok(payload && typeof payload === 'object');
+        const result = (await next(payload)) as ModelStreamResult;
+        observedLiveStream = typeof result.events[Symbol.asyncIterator] === 'function';
+        return result;
+      },
+    };
+    const backend = createTestAiSdkBackend({
+      sessionId: 'session-1',
+      header: header(),
+      appendMessage: async () => {},
+      connection: connection(),
+      apiKey: 'sk-test',
+      modelId: 'mock-model-id',
+      modelFactory: () => completionModel(),
+      tools: [],
+      preToolUseHooks,
+      newId: idGenerator(),
+      now: monotonicClock(),
+    });
+
+    await drain(backend.send({ turnId: 'turn-1', text: 'hello', context: [] }));
+
+    assert.equal(observedLiveStream, true);
+  });
+
+  test('transforms the provider prompt and observes a completed Run', async () => {
+    const model = completionModel();
+    const calls: Array<{ event: string; payload: unknown }> = [];
+    const preToolUseHooks: NonNullable<AiSdkBackendInput['preToolUseHooks']> = {
+      prepareTurn() {},
+      releaseTurn() {},
+      async runPreToolUse() {
+        return { denied: false, audits: [], auditWriteFailures: [] };
+      },
+      async runCoreEvent(event, payload) {
+        calls.push({ event, payload: structuredClone(payload) });
+        return {
+          result: event === 'maka.user-prompt.submit' ? { text: 'hooked prompt' } : payload,
+          delivered: 1,
+          failed: 0,
+        };
+      },
+    };
+    const backend = createTestAiSdkBackend({
+      sessionId: 'session-1',
+      header: header(),
+      appendMessage: async () => {},
+      connection: connection(),
+      apiKey: 'sk-test',
+      modelId: 'mock-model-id',
+      modelFactory: () => model,
+      tools: [],
+      preToolUseHooks,
+      newId: idGenerator(),
+      now: monotonicClock(),
+    });
+
+    await drain(backend.send({ turnId: 'turn-1', text: 'original prompt', context: [] }));
+
+    assert.equal(
+      calls.some(({ event }) => event === 'maka.user-prompt.submit'),
+      true,
+    );
+    assert.equal(JSON.stringify(compactPrompt(model)).includes('hooked prompt'), true);
+    assert.equal(
+      calls.some(
+        ({ event, payload }) =>
+          event === 'maka.agent.status' && (payload as { status?: unknown }).status === 'completed',
+      ),
+      true,
+    );
+  });
+
+  test('dispatches typed core seams and consumes their transformed request', async () => {
+    const model = completionModel();
+    const calls: Array<{ event: string; payload: unknown }> = [];
+    const preToolUseHooks: NonNullable<AiSdkBackendInput['preToolUseHooks']> = {
+      prepareTurn() {},
+      releaseTurn() {},
+      async runPreToolUse() {
+        return { denied: false, audits: [], auditWriteFailures: [] };
+      },
+      async runCoreEvent(event, payload) {
+        calls.push({ event, payload: structuredClone(payload) });
+        if (event === 'maka.system-prompt.assemble') {
+          return {
+            result: { ...(payload as object), prompt: 'ASSEMBLED SYSTEM' },
+            delivered: 1,
+            failed: 0,
+          };
+        }
+        if (event === 'maka.agent.request') {
+          return {
+            result: { ...(payload as object), systemPrompt: 'REQUEST SYSTEM' },
+            delivered: 1,
+            failed: 0,
+          };
+        }
+        return { result: payload, delivered: 1, failed: 0 };
+      },
+    };
+    const backend = createTestAiSdkBackend({
+      sessionId: 'session-1',
+      header: header(),
+      appendMessage: async () => {},
+      connection: connection(),
+      apiKey: 'sk-test',
+      modelId: 'mock-model-id',
+      modelFactory: () => model,
+      systemPrompt: 'BASE SYSTEM',
+      tools: [],
+      preToolUseHooks,
+      newId: idGenerator(),
+      now: monotonicClock(),
+    });
+
+    await drain(backend.send({ turnId: 'turn-1', text: 'original prompt', context: [] }));
+
+    const events = calls.map(({ event }) => event);
+    for (const expected of [
+      'maka.system-prompt.assemble',
+      'maka.agent.pre-step',
+      'maka.agent.request',
+      'maka.agent.turn-stopping',
+      'maka.agent.status',
+      'maka.session.event',
+      'maka.session.flush',
+    ]) {
+      assert.equal(events.includes(expected), true, `missing core event: ${expected}`);
+    }
+    assert.equal(JSON.stringify(compactPrompt(model)).includes('REQUEST SYSTEM'), true);
+    assert.equal(JSON.stringify(compactPrompt(model)).includes('ASSEMBLED SYSTEM'), false);
+  });
+
+  test('lets a turn-stopping core listener continue the Agent Loop with an instruction', async () => {
+    const { model, callCount } = countingToolLoopModel(0);
+    let stoppingCalls = 0;
+    const preToolUseHooks: NonNullable<AiSdkBackendInput['preToolUseHooks']> = {
+      prepareTurn() {},
+      releaseTurn() {},
+      async runPreToolUse() {
+        return { denied: false, audits: [], auditWriteFailures: [] };
+      },
+      async runCoreEvent(event, payload) {
+        if (event === 'maka.agent.turn-stopping') {
+          stoppingCalls += 1;
+          if (stoppingCalls === 1) {
+            return {
+              result: { continue: true, instruction: 'Inspect once more before stopping.' },
+              delivered: 1,
+              failed: 0,
+            };
+          }
+        }
+        return { result: payload, delivered: 0, failed: 0 };
+      },
+    };
+    const backend = createTestAiSdkBackend({
+      sessionId: 'session-1',
+      header: header(),
+      appendMessage: async () => {},
+      connection: connection(),
+      apiKey: 'sk-test',
+      modelId: 'mock-model-id',
+      modelFactory: () => model,
+      tools: [],
+      preToolUseHooks,
+      newId: idGenerator(),
+      now: monotonicClock(),
+    });
+
+    await drain(backend.send({ turnId: 'turn-1', text: 'check carefully', context: [] }));
+
+    assert.equal(callCount(), 2);
+    assert.equal(stoppingCalls, 2);
+  });
+
+  test('observes real child-agent settlement through subagent start and end seams', async () => {
+    const coreEvents: Array<{ event: string; payload: unknown }> = [];
+    const preToolUseHooks: NonNullable<AiSdkBackendInput['preToolUseHooks']> = {
+      prepareTurn() {},
+      releaseTurn() {},
+      async runPreToolUse() {
+        return { denied: false, audits: [], auditWriteFailures: [] };
+      },
+      async runCoreEvent(event, payload) {
+        if (event === 'maka.subagent.start' || event === 'maka.subagent.end') {
+          coreEvents.push({ event, payload: structuredClone(payload) });
+        }
+        return { result: payload, delivered: 1, failed: 0 };
+      },
+    };
+    const backend = createTestAiSdkBackend({
+      sessionId: 'session-1',
+      header: header(),
+      appendMessage: async () => {},
+      connection: connection(),
+      apiKey: 'sk-test',
+      modelId: 'mock-model-id',
+      modelFactory: () => completionModel(),
+      tools: [],
+      preToolUseHooks,
+      spawnChildAgent: async () => ({ ok: true, summary: 'child complete' }),
+      newId: idGenerator(),
+      now: monotonicClock(),
+    });
+    const tool: MakaTool = {
+      name: 'ChildProbe',
+      description: 'Spawn one child Agent.',
+      parameters: {},
+      categoryHint: 'subagent',
+      impl: async (_args, context) => {
+        assert.ok(context.spawnChildAgent);
+        return await context.spawnChildAgent({
+          spec: { id: 'reader', name: 'Reader', systemPrompt: 'Read carefully.' },
+          prompt: 'Inspect the evidence.',
+        });
+      },
+    };
+    backendInternals(backend).openTurnScope({
+      turnId: 'turn-1',
+      runId: 'run-1',
+      text: '',
+      context: [],
+    } as never);
+
+    const result = await runtimeExecute(backend, tool, 'turn-1', { push: () => undefined })(
+      {},
+      { toolCallId: 'child-probe', abortSignal: new AbortController().signal },
+    );
+
+    assert.deepEqual(result, { ok: true, summary: 'child complete' });
+    assert.deepEqual(coreEvents, [
+      {
+        event: 'maka.subagent.start',
+        payload: { parentRunId: 'run-1', name: 'Reader', prompt: 'Inspect the evidence.' },
+      },
+      {
+        event: 'maka.subagent.end',
+        payload: { parentRunId: 'run-1', name: 'Reader', outcome: 'completed' },
+      },
+    ]);
+  });
+
+  test('dispatches request-error before a non-retryable provider failure becomes terminal', async () => {
+    const requestErrors: unknown[] = [];
+    let providerCalls = 0;
+    const model = new MockLanguageModelV4({
+      doStream: async () => {
+        providerCalls += 1;
+        throw new APICallError({
+          message: 'request rejected',
+          url: 'https://provider.invalid/v1/messages',
+          requestBodyValues: {},
+          statusCode: 400,
+          responseHeaders: {},
+        });
+      },
+    });
+    const preToolUseHooks: NonNullable<AiSdkBackendInput['preToolUseHooks']> = {
+      prepareTurn() {},
+      releaseTurn() {},
+      async runPreToolUse() {
+        return { denied: false, audits: [], auditWriteFailures: [] };
+      },
+      async runCoreEvent(event, payload) {
+        if (event === 'maka.agent.request-error') requestErrors.push(structuredClone(payload));
+        return { result: undefined, delivered: 0, failed: 0 };
+      },
+    };
+    const backend = createTestAiSdkBackend({
+      sessionId: 'session-1',
+      header: header(),
+      appendMessage: async () => {},
+      connection: connection(),
+      apiKey: 'sk-test',
+      modelId: 'mock-model-id',
+      modelFactory: () => model,
+      tools: [],
+      preToolUseHooks,
+      providerRetrySleep: async () => {},
+      newId: idGenerator(),
+      now: monotonicClock(),
+    });
+
+    const events: SessionEvent[] = [];
+    for await (const event of backend.send({
+      turnId: 'turn-request-error',
+      text: 'fail once',
+      context: [],
+    })) {
+      events.push(event);
+    }
+
+    assert.equal(providerCalls, 1);
+    assert.equal(requestErrors.length, 1);
+    assert.equal((requestErrors[0] as { retryable?: unknown }).retryable, false);
+    assert.equal(events.find((event) => event.type === 'complete')?.stopReason, 'error');
+  });
+
+  test('reports an abandoned provider stream as an aborted Run', async () => {
+    const outcomes: unknown[] = [];
+    const preToolUseHooks: NonNullable<AiSdkBackendInput['preToolUseHooks']> = {
+      prepareTurn() {},
+      releaseTurn() {},
+      async runPreToolUse() {
+        return { denied: false, audits: [], auditWriteFailures: [] };
+      },
+      async runCoreEvent(event, payload) {
+        if (event === 'maka.agent.status') outcomes.push(structuredClone(payload));
+        return { result: payload, delivered: 1, failed: 0 };
+      },
+    };
+    const backend = createTestAiSdkBackend({
+      sessionId: 'session-1',
+      header: header(),
+      appendMessage: async () => {},
+      connection: connection(),
+      apiKey: 'sk-test',
+      modelId: 'mock-model-id',
+      modelFactory: () => textCompletionModel('partial'),
+      tools: [],
+      preToolUseHooks,
+      newId: idGenerator(),
+      now: monotonicClock(),
+    });
+    const iterator = backend
+      .send({ turnId: 'turn-1', text: 'original prompt', context: [] })
+      [Symbol.asyncIterator]();
+
+    const first = await iterator.next();
+    assert.equal(first.done, false);
+    await iterator.return?.();
+
+    assert.equal(
+      outcomes.some((value) => (value as { status?: unknown }).status === 'aborted'),
+      true,
+    );
+  });
+
+  test('settles RunEnd before exposing the terminal complete event', async () => {
+    const calls: string[] = [];
+    const preToolUseHooks: NonNullable<AiSdkBackendInput['preToolUseHooks']> = {
+      prepareTurn() {},
+      releaseTurn() {},
+      async runPreToolUse() {
+        return { denied: false, audits: [], auditWriteFailures: [] };
+      },
+      async runCoreEvent(event, payload) {
+        if (event === 'maka.user-prompt.submit' || event === 'maka.agent.status') {
+          calls.push(
+            event === 'maka.agent.status'
+              ? `${event}:${String((payload as { status?: unknown }).status)}`
+              : event,
+          );
+        }
+        return { result: payload, delivered: 1, failed: 0 };
+      },
+    };
+    const backend = createTestAiSdkBackend({
+      sessionId: 'session-1',
+      header: header(),
+      appendMessage: async () => {},
+      connection: connection(),
+      apiKey: 'sk-test',
+      modelId: 'mock-model-id',
+      modelFactory: () => textCompletionModel('done'),
+      tools: [],
+      preToolUseHooks,
+      newId: idGenerator(),
+      now: monotonicClock(),
+    });
+    const iterator = backend
+      .send({ turnId: 'turn-1', text: 'original prompt', context: [] })
+      [Symbol.asyncIterator]();
+
+    try {
+      for (;;) {
+        const next = await iterator.next();
+        assert.equal(next.done, false);
+        if (next.value.type !== 'complete') continue;
+        assert.equal(calls.includes('maka.user-prompt.submit'), true);
+        assert.equal(calls.includes('maka.agent.status:running'), true);
+        assert.equal(calls.includes('maka.agent.status:completed'), true);
+        break;
+      }
+    } finally {
+      await iterator.return?.();
+    }
+  });
+});
+
 describe('AiSdkBackend ApplyPatch routing', () => {
   test('advertises apply_patch only to supported native OpenAI models', async () => {
     for (const [providerType, modelId, expected] of [
@@ -5718,6 +6121,93 @@ describe('AiSdkBackend model history', () => {
 });
 
 describe('AiSdkBackend error surfaces', () => {
+  test('repairs nested JSON container strings only when the tool schema rejects the wire input', async () => {
+    const durable = durableTurnHarness('turn-1', 'define the UI');
+    const executions: unknown[] = [];
+    let streamCalls = 0;
+    const model = new MockLanguageModelV4({
+      doStream: async () => {
+        streamCalls += 1;
+        const chunks: LanguageModelV4StreamPart[] =
+          streamCalls === 1
+            ? [
+                { type: 'stream-start', warnings: [] },
+                {
+                  type: 'tool-call',
+                  toolCallId: 'define-ui-1',
+                  toolName: 'define_package',
+                  input: JSON.stringify({
+                    id: 'dev.maka.example',
+                    ui: JSON.stringify([{ id: 'stage', surface: 'app.root' }]),
+                  }),
+                },
+                {
+                  type: 'finish',
+                  finishReason: { unified: 'tool-calls', raw: 'tool_calls' },
+                  usage: {
+                    inputTokens: { total: 1, noCache: 1, cacheRead: 0, cacheWrite: 0 },
+                    outputTokens: { total: 1, text: 0, reasoning: 0 },
+                  },
+                },
+              ]
+            : [
+                { type: 'stream-start', warnings: [] },
+                {
+                  type: 'finish',
+                  finishReason: { unified: 'stop', raw: 'stop' },
+                  usage: {
+                    inputTokens: { total: 1, noCache: 1, cacheRead: 0, cacheWrite: 0 },
+                    outputTokens: { total: 1, text: 1, reasoning: 0 },
+                  },
+                },
+              ];
+        return {
+          stream: simulateReadableStream({
+            chunks,
+            initialDelayInMs: null,
+            chunkDelayInMs: null,
+          }),
+        };
+      },
+    });
+    const backend = createTestAiSdkBackend({
+      sessionId: 'session-1',
+      header: header(),
+      appendMessage: async () => {},
+      connection: connection(),
+      apiKey: 'sk-test',
+      modelId: 'mock-model-id',
+      modelFactory: () => model,
+      tools: [
+        {
+          ...testTool(
+            'define_package',
+            z.object({
+              id: z.string(),
+              ui: z.array(z.object({ id: z.string(), surface: z.string() })),
+            }),
+          ),
+          impl: async (input: unknown) => {
+            executions.push(input);
+            return { ok: true };
+          },
+        },
+      ],
+      loadTurnRuntimeEvents: durable.loadTurnRuntimeEvents,
+      newId: idGenerator(),
+      now: monotonicClock(),
+    });
+
+    await drainDurably(backend.send(durable.input()), durable);
+
+    assert.deepEqual(executions, [
+      {
+        id: 'dev.maka.example',
+        ui: [{ id: 'stage', surface: 'app.root' }],
+      },
+    ]);
+  });
+
   test('generalizes model setup errors before emitting renderer events', async () => {
     const backend = createTestAiSdkBackend({
       sessionId: 'session-1',
diff --git a/packages/runtime/src/__tests__/extension-dispatch.test.ts b/packages/runtime/src/__tests__/extension-dispatch.test.ts
new file mode 100644
index 0000000000..3c1ab7a804
--- /dev/null
+++ b/packages/runtime/src/__tests__/extension-dispatch.test.ts
@@ -0,0 +1,290 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { dispatchExtensionHandlers } from '../extension-dispatch.js';
+
+test('dispatches transform, bail, serial, and contained failures deterministically', async () => {
+  const signal = new AbortController().signal;
+  const transform = await dispatchExtensionHandlers({
+    mode: 'transform',
+    payload: { count: 1 },
+    signal,
+    handlers: [
+      {
+        identity: 'a',
+        invoke: async (value) => ({ count: (value as { count: number }).count + 1 }),
+      },
+      { identity: 'bad', invoke: async () => await Promise.reject(new Error('contained')) },
+      {
+        identity: 'b',
+        invoke: async (value) => ({ count: (value as { count: number }).count * 3 }),
+      },
+    ],
+  });
+  assert.deepEqual(transform.value, { count: 6 });
+  assert.deepEqual(
+    transform.settlements.map(({ status }) => status),
+    ['fulfilled', 'rejected', 'fulfilled'],
+  );
+
+  const bail = await dispatchExtensionHandlers({
+    mode: 'bail',
+    payload: {},
+    signal,
+    handlers: [
+      { identity: 'empty', invoke: async () => undefined },
+      { identity: 'answer', invoke: async () => ({ answer: 42 }) },
+      { identity: 'unreached', invoke: async () => ({ answer: 0 }) },
+    ],
+  });
+  assert.deepEqual(bail.value, { answer: 42 });
+  assert.equal(bail.stopped, true);
+  assert.deepEqual(
+    bail.settlements.map(({ identity }) => identity),
+    ['empty', 'answer'],
+  );
+
+  const serial = await dispatchExtensionHandlers({
+    mode: 'serial',
+    payload: { id: 'x' },
+    signal,
+    handlers: [
+      { identity: 1, invoke: async () => 'one' },
+      { identity: 2, invoke: async () => 'two' },
+    ],
+  });
+  assert.deepEqual(serial.value, ['one', 'two']);
+});
+
+test('parallel dispatch overlaps handlers and gate stops at first denial', async () => {
+  const signal = new AbortController().signal;
+  let active = 0;
+  let peak = 0;
+  const parallel = await dispatchExtensionHandlers({
+    mode: 'parallel',
+    payload: { id: 1 },
+    signal,
+    handlers: [1, 2, 3].map((identity) => ({
+      identity,
+      invoke: async () => {
+        active += 1;
+        peak = Math.max(peak, active);
+        await new Promise((resolve) => setTimeout(resolve, 5));
+        active -= 1;
+        return identity;
+      },
+    })),
+  });
+  assert.equal(peak, 3);
+  assert.deepEqual(parallel.value, [1, 2, 3]);
+
+  const gate = await dispatchExtensionHandlers({
+    mode: 'gate',
+    payload: {},
+    signal,
+    handlers: [
+      { identity: 'allow', invoke: async () => ({ decision: 'allow' }) },
+      { identity: 'deny', invoke: async () => ({ decision: 'deny', reason: 'blocked' }) },
+      { identity: 'unreached', invoke: async () => ({ decision: 'allow' }) },
+    ],
+  });
+  assert.equal(gate.denied, true);
+  assert.equal(gate.reason, 'blocked');
+  assert.deepEqual(
+    gate.settlements.map(({ identity }) => identity),
+    ['allow', 'deny'],
+  );
+});
+
+test('every mode has a deterministic empty-handler identity', async () => {
+  const signal = new AbortController().signal;
+  const payload = { value: 7 };
+  const expected = new Map<string, unknown>([
+    ['emit', payload],
+    ['parallel', []],
+    ['serial', []],
+    ['bail', undefined],
+    ['transform', payload],
+    ['observe', payload],
+    ['gate', payload],
+  ]);
+
+  for (const [mode, value] of expected) {
+    const result = await dispatchExtensionHandlers({
+      mode: mode as Parameters<typeof dispatchExtensionHandlers>[0]['mode'],
+      payload,
+      signal,
+      handlers: [],
+    });
+    assert.deepEqual(result.value, value, `${mode} returned the wrong identity`);
+    assert.deepEqual(result.settlements, []);
+    assert.equal(result.stopped, false);
+    assert.equal(result.denied, false);
+  }
+});
+
+test('bail ignores empty and failed answers, then stops on the first value', async () => {
+  const invoked: string[] = [];
+  const result = await dispatchExtensionHandlers({
+    mode: 'bail',
+    payload: { question: 'answer' },
+    signal: new AbortController().signal,
+    handlers: [
+      {
+        identity: 'undefined',
+        invoke: async () => {
+          invoked.push('undefined');
+          return undefined;
+        },
+      },
+      {
+        identity: 'failed',
+        invoke: async () => {
+          invoked.push('failed');
+          throw new Error('contained');
+        },
+      },
+      {
+        identity: 'answer',
+        invoke: async () => {
+          invoked.push('answer');
+          return { value: 42 };
+        },
+      },
+      {
+        identity: 'unreached',
+        invoke: async () => {
+          invoked.push('unreached');
+          return { value: 0 };
+        },
+      },
+    ],
+  });
+
+  assert.deepEqual(invoked, ['undefined', 'failed', 'answer']);
+  assert.deepEqual(result.value, { value: 42 });
+  assert.equal(result.stopped, true);
+  assert.deepEqual(
+    result.settlements.map(({ status }) => status),
+    ['fulfilled', 'rejected', 'fulfilled'],
+  );
+});
+
+test('dispatch clones handler inputs and propagates cancellation authority', async () => {
+  const payload = { nested: { value: 1 } };
+  const isolated = await dispatchExtensionHandlers({
+    mode: 'serial',
+    payload,
+    signal: new AbortController().signal,
+    handlers: [
+      {
+        identity: 'mutator',
+        invoke: async (value) => {
+          (value as typeof payload).nested.value = 99;
+          return 'mutated-private-copy';
+        },
+      },
+      {
+        identity: 'observer',
+        invoke: async (value) => (value as typeof payload).nested.value,
+      },
+    ],
+  });
+  assert.deepEqual(payload, { nested: { value: 1 } });
+  assert.deepEqual(isolated.value, ['mutated-private-copy', 1]);
+
+  const controller = new AbortController();
+  await assert.rejects(
+    dispatchExtensionHandlers({
+      mode: 'serial',
+      payload,
+      signal: controller.signal,
+      handlers: [
+        {
+          identity: 'abort',
+          invoke: async () => {
+            controller.abort(new Error('authority revoked'));
+            return 'ignored';
+          },
+        },
+        { identity: 'unreached', invoke: async () => 'unreached' },
+      ],
+    }),
+    /authority revoked/u,
+  );
+});
+
+test('around middleware wraps the final continuation and can transform live values', async () => {
+  const order: string[] = [];
+  const live = new AbortController();
+  const result = await dispatchExtensionHandlers({
+    mode: 'around',
+    payload: { value: 1, signal: live.signal },
+    signal: live.signal,
+    handlers: [
+      {
+        identity: 'outer',
+        invoke: async (value, next) => {
+          order.push('outer:before');
+          const downstream = (await next?.({ ...(value as object), value: 2 })) as {
+            value: number;
+          };
+          order.push('outer:after');
+          return { value: downstream.value + 1 };
+        },
+      },
+      {
+        identity: 'inner',
+        invoke: async (value, next) => {
+          order.push('inner:before');
+          const downstream = await next?.(value);
+          order.push('inner:after');
+          return downstream;
+        },
+      },
+    ],
+    final: async (value) => {
+      order.push('final');
+      assert.equal((value as { signal: AbortSignal }).signal, live.signal);
+      return value;
+    },
+  });
+  assert.deepEqual(order, ['outer:before', 'inner:before', 'final', 'inner:after', 'outer:after']);
+  assert.deepEqual(result.value, { value: 3 });
+  assert.equal(result.stopped, false);
+});
+
+test('around middleware may short-circuit and next is single-use', async () => {
+  let reachedFinal = false;
+  const short = await dispatchExtensionHandlers({
+    mode: 'around',
+    payload: 'input',
+    signal: new AbortController().signal,
+    handlers: [{ identity: 'stop', invoke: async () => 'cached' }],
+    final: async () => {
+      reachedFinal = true;
+      return 'final';
+    },
+  });
+  assert.equal(short.value, 'cached');
+  assert.equal(short.stopped, true);
+  assert.equal(reachedFinal, false);
+
+  await assert.rejects(
+    dispatchExtensionHandlers({
+      mode: 'around',
+      payload: 'input',
+      signal: new AbortController().signal,
+      handlers: [
+        {
+          identity: 'twice',
+          invoke: async (value, next) => {
+            await next?.(value);
+            return await next?.(value);
+          },
+        },
+      ],
+      final: async (value) => value,
+    }),
+    /only be called once/u,
+  );
+});
diff --git a/packages/runtime/src/__tests__/hooks-engine.test.ts b/packages/runtime/src/__tests__/hooks-engine.test.ts
new file mode 100644
index 0000000000..32b409fd95
--- /dev/null
+++ b/packages/runtime/src/__tests__/hooks-engine.test.ts
@@ -0,0 +1,329 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import type { PreToolUseHookInput, ResolvedHookDefinition } from '@maka/core/hooks';
+import {
+  createHookCommandRunner,
+  HOOK_EXECUTION_MARKER,
+  type HookCommandRunner,
+} from '../hooks/command-runner.js';
+import { createHookExecutionLimiter, createPreToolUseHookDispatcher } from '../hooks/engine.js';
+
+describe('PreToolUse Hook engine', () => {
+  it('freezes one snapshot per turn and skips untrusted matching definitions', async () => {
+    let loads = 0;
+    let runs = 0;
+    const dispatcher = createPreToolUseHookDispatcher({
+      loadSnapshot: async () => {
+        loads += 1;
+        return [definition({ trusted: false })];
+      },
+      commandRunner: {
+        run: async () => {
+          runs += 1;
+          return result(0);
+        },
+      },
+    });
+    const first = await dispatcher.runPreToolUse(
+      hookInput('turn-1'),
+      new AbortController().signal,
+      { invocationId: 'invocation-1' },
+    );
+    await dispatcher.runPreToolUse(hookInput('turn-1'), new AbortController().signal, {
+      invocationId: 'invocation-1',
+    });
+    await dispatcher.runPreToolUse(hookInput('turn-2'), new AbortController().signal, {
+      invocationId: 'invocation-2',
+    });
+    assert.equal(loads, 2);
+    assert.equal(runs, 0);
+    assert.equal(first.denied, false);
+    assert.equal(first.audits[0]?.status, 'skipped_untrusted');
+  });
+
+  it('retains every active Turn snapshot until that Turn is released', async () => {
+    let revision = 1;
+    let loads = 0;
+    const dispatcher = createPreToolUseHookDispatcher({
+      loadSnapshot: async () => {
+        loads += 1;
+        return [definition({ id: `revision-${revision}`, trusted: false })];
+      },
+    });
+    for (let index = 1; index <= 9; index += 1) dispatcher.prepareTurn(`turn-${index}`);
+    await Promise.resolve();
+    revision = 2;
+
+    const retained = await dispatcher.runPreToolUse(
+      hookInput('turn-1'),
+      new AbortController().signal,
+      { invocationId: 'invocation-1' },
+    );
+    assert.equal(retained.audits[0]?.handlerId, 'revision-1');
+    assert.equal(loads, 9);
+
+    dispatcher.releaseTurn('turn-1');
+    const reloaded = await dispatcher.runPreToolUse(
+      hookInput('turn-1'),
+      new AbortController().signal,
+      { invocationId: 'invocation-1-reloaded' },
+    );
+    assert.equal(reloaded.audits[0]?.handlerId, 'revision-2');
+    assert.equal(loads, 10);
+  });
+
+  it('runs matching handlers concurrently and reports denials in configuration order', async () => {
+    let active = 0;
+    let maxActive = 0;
+    const runner: HookCommandRunner = {
+      run: async (definition) => {
+        active += 1;
+        maxActive = Math.max(maxActive, active);
+        await new Promise((resolve) => setTimeout(resolve, definition.id === 'first' ? 20 : 1));
+        active -= 1;
+        return {
+          ...result(2),
+          stderr: `${definition.id} denied`,
+        };
+      },
+    };
+    const dispatcher = createPreToolUseHookDispatcher({
+      loadSnapshot: async () => [
+        definition({ id: 'first', definitionOrder: 0 }),
+        definition({ id: 'second', definitionOrder: 1 }),
+      ],
+      commandRunner: runner,
+    });
+    const output = await dispatcher.runPreToolUse(
+      hookInput('turn-1'),
+      new AbortController().signal,
+      { invocationId: 'invocation-1' },
+    );
+    assert.equal(maxActive, 2);
+    assert.equal(output.denied, true);
+    assert.equal(output.reason, 'first denied\nsecond denied');
+    assert.deepEqual(
+      output.audits.map((audit) => audit.handlerId),
+      ['first', 'second'],
+    );
+  });
+
+  it('shares one concurrency ceiling across simultaneous dispatchers and sessions', async () => {
+    let active = 0;
+    let maxActive = 0;
+    let release!: () => void;
+    const gate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const runner: HookCommandRunner = {
+      run: async () => {
+        active += 1;
+        maxActive = Math.max(maxActive, active);
+        await gate;
+        active -= 1;
+        return result(0);
+      },
+    };
+    const limiter = createHookExecutionLimiter(2);
+    const createDispatcher = () =>
+      createPreToolUseHookDispatcher({
+        loadSnapshot: async () => [
+          definition({ id: 'first', definitionOrder: 0 }),
+          definition({ id: 'second', definitionOrder: 1 }),
+        ],
+        commandRunner: runner,
+        executionLimiter: limiter,
+      });
+    const first = createDispatcher().runPreToolUse(
+      hookInput('turn-1'),
+      new AbortController().signal,
+      { invocationId: 'invocation-1' },
+    );
+    const second = createDispatcher().runPreToolUse(
+      { ...hookInput('turn-2'), session_id: 'session-2' },
+      new AbortController().signal,
+      { invocationId: 'invocation-2' },
+    );
+    await new Promise<void>((resolve) => setImmediate(resolve));
+    assert.equal(maxActive, 2);
+    release();
+    await Promise.all([first, second]);
+    assert.equal(maxActive, 2);
+  });
+
+  it('fails open on handler and audit failures but preserves an explicit denial', async () => {
+    const dispatcher = createPreToolUseHookDispatcher({
+      loadSnapshot: async () => [
+        definition({ id: 'failed', definitionOrder: 0 }),
+        definition({ id: 'denied', definitionOrder: 1 }),
+      ],
+      commandRunner: {
+        run: async (definition) =>
+          definition.id === 'failed'
+            ? { ...result(1), stderr: 'crashed' }
+            : { ...result(2), stderr: 'policy denial' },
+      },
+      recordAudit: async () => {
+        throw new Error('audit unavailable');
+      },
+    });
+    const output = await dispatcher.runPreToolUse(
+      hookInput('turn-1'),
+      new AbortController().signal,
+      { invocationId: 'invocation-1' },
+    );
+    assert.equal(output.denied, true);
+    assert.equal(output.reason, 'policy denial');
+    assert.deepEqual(
+      output.audits.map((audit) => audit.status),
+      ['failed', 'denied'],
+    );
+    assert.equal(output.auditWriteFailures.length, 2);
+  });
+
+  it('passes versioned JSON on stdin and accepts structured deny output', async () => {
+    const runner = createHookCommandRunner();
+    const structured = JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: 'structured policy denial',
+      },
+    });
+    const dispatcher = createPreToolUseHookDispatcher({
+      loadSnapshot: async () => [
+        definition({
+          command: process.execPath,
+          args: [
+            '-e',
+            `let s='';process.stdin.on('data',c=>s+=c);process.stdin.on('end',()=>{const x=JSON.parse(s);if(x.schema_version!==1||x.tool_name!=='Bash')process.exit(9);process.stdout.write(${JSON.stringify(structured)})})`,
+          ],
+        }),
+      ],
+      commandRunner: runner,
+    });
+    const output = await dispatcher.runPreToolUse(
+      hookInput('turn-1'),
+      new AbortController().signal,
+      { invocationId: 'invocation-1' },
+    );
+    assert.equal(output.denied, true);
+    assert.equal(output.reason, 'structured policy denial');
+  });
+
+  it('marks Hook children and refuses execution in a Host recursively started by a Hook', async () => {
+    const runner = createHookCommandRunner();
+    const markerProbe = await runner.run(
+      definition({
+        command: process.execPath,
+        args: [
+          '-e',
+          `process.exit(process.env[${JSON.stringify(HOOK_EXECUTION_MARKER)}] === '1' ? 0 : 9)`,
+        ],
+      }),
+      hookInput('turn-1'),
+      new AbortController().signal,
+    );
+    assert.equal(markerProbe.exitCode, 0);
+
+    const previous = process.env[HOOK_EXECUTION_MARKER];
+    process.env[HOOK_EXECUTION_MARKER] = '1';
+    try {
+      const recursive = await runner.run(
+        definition({ command: process.execPath, args: ['-e', 'process.exit(99)'] }),
+        hookInput('turn-recursive'),
+        new AbortController().signal,
+      );
+      assert.equal(recursive.exitCode, null);
+      assert.equal(recursive.spawnError, 'Recursive Hook execution is not allowed');
+    } finally {
+      if (previous === undefined) delete process.env[HOOK_EXECUTION_MARKER];
+      else process.env[HOOK_EXECUTION_MARKER] = previous;
+    }
+  });
+
+  it('terminates timed-out Hook process trees and fails open', async () => {
+    const dispatcher = createPreToolUseHookDispatcher({
+      loadSnapshot: async () => [
+        definition({
+          command: process.execPath,
+          args: ['-e', 'setInterval(()=>{},1000)'],
+          timeoutMs: 100,
+        }),
+      ],
+    });
+    const output = await dispatcher.runPreToolUse(
+      hookInput('turn-1'),
+      new AbortController().signal,
+      { invocationId: 'invocation-1' },
+    );
+    assert.equal(output.denied, false);
+    assert.equal(output.audits[0]?.status, 'failed');
+    assert.equal(output.audits[0]?.message, 'Hook timed out');
+  });
+
+  it('terminates Hook process trees when the Turn is aborted', async () => {
+    const dispatcher = createPreToolUseHookDispatcher({
+      loadSnapshot: async () => [
+        definition({
+          command: process.execPath,
+          args: ['-e', 'setInterval(()=>{},1000)'],
+          timeoutMs: 5_000,
+        }),
+      ],
+    });
+    const controller = new AbortController();
+    const pending = dispatcher.runPreToolUse(hookInput('turn-1'), controller.signal, {
+      invocationId: 'invocation-1',
+    });
+    setTimeout(() => controller.abort(), 50);
+    const output = await pending;
+    assert.equal(output.denied, false);
+    assert.equal(output.audits[0]?.status, 'failed');
+    assert.equal(output.audits[0]?.message, 'Hook aborted with the Turn');
+  });
+});
+
+function definition(input: Partial<ResolvedHookDefinition> = {}): ResolvedHookDefinition {
+  return {
+    id: 'policy',
+    eventName: 'PreToolUse',
+    matcher: 'Bash',
+    command: '/usr/bin/true',
+    args: [],
+    timeoutMs: 1_000,
+    source: 'user',
+    sourceOrder: 0,
+    definitionOrder: 0,
+    projectIdentity: 'user',
+    definitionHash: `sha256:${'a'.repeat(64)}`,
+    trusted: true,
+    ...input,
+  };
+}
+
+function hookInput(turnId: string): PreToolUseHookInput {
+  return {
+    schema_version: 1,
+    hook_event_name: 'PreToolUse',
+    session_id: 'session-1',
+    turn_id: turnId,
+    run_id: `run-${turnId}`,
+    tool_use_id: 'tool-use-1',
+    tool_name: 'Bash',
+    tool_input: { command: 'git push' },
+    cwd: process.cwd(),
+    permission_mode: 'ask',
+    origin: 'provider',
+  };
+}
+
+function result(exitCode: number) {
+  return {
+    exitCode,
+    stdout: '',
+    stderr: '',
+    timedOut: false,
+    aborted: false,
+  };
+}
diff --git a/packages/runtime/src/__tests__/model-adapter.test.ts b/packages/runtime/src/__tests__/model-adapter.test.ts
index f7dd926252..bb1c22447f 100644
--- a/packages/runtime/src/__tests__/model-adapter.test.ts
+++ b/packages/runtime/src/__tests__/model-adapter.test.ts
@@ -273,6 +273,81 @@ describe('ModelAdapter stream and error normalization', () => {
     ]);
   });
 
+  test('decodes one JSON layer from a double-encoded Maka-owned tool call', () => {
+    const adapter = newAdapter();
+    type Chunk = Parameters<typeof adapter.translateChunk>[0];
+
+    assert.deepEqual(
+      adapter.translateChunk({
+        type: 'tool-call',
+        toolCallId: 'tool-double-encoded',
+        toolName: 'define_package',
+        input: JSON.stringify({ id: 'dev.maka.example', version: '1.0.0' }),
+        providerExecuted: false,
+      } as unknown as Chunk),
+      [
+        {
+          kind: 'tool-call',
+          toolCall: {
+            type: 'tool-call',
+            toolCallId: 'tool-double-encoded',
+            toolName: 'define_package',
+            input: { id: 'dev.maka.example', version: '1.0.0' },
+            providerExecuted: false,
+          },
+        },
+      ],
+    );
+  });
+
+  test('bounds decoding when a provider adds several JSON string layers', () => {
+    const adapter = newAdapter();
+    type Chunk = Parameters<typeof adapter.translateChunk>[0];
+
+    const input = { id: 'dev.maka.example', version: '1.0.0' };
+    let wireInput: unknown = input;
+    for (let depth = 0; depth < 5; depth += 1) wireInput = JSON.stringify(wireInput);
+    const [translated] = adapter.translateChunk({
+      type: 'tool-call',
+      toolCallId: 'tool-provider-double-encoded',
+      toolName: 'define_package',
+      input: wireInput,
+      providerExecuted: false,
+    } as unknown as Chunk);
+
+    assert.deepEqual(
+      translated?.kind === 'tool-call' ? translated.toolCall.input : undefined,
+      input,
+    );
+  });
+
+  test('preserves a non-JSON string tool input for normal validation', () => {
+    const adapter = newAdapter();
+    type Chunk = Parameters<typeof adapter.translateChunk>[0];
+
+    assert.deepEqual(
+      adapter.translateChunk({
+        type: 'tool-call',
+        toolCallId: 'tool-malformed',
+        toolName: 'Read',
+        input: '{not-json',
+        providerExecuted: false,
+      } as unknown as Chunk),
+      [
+        {
+          kind: 'tool-call',
+          toolCall: {
+            type: 'tool-call',
+            toolCallId: 'tool-malformed',
+            toolName: 'Read',
+            input: '{not-json',
+            providerExecuted: false,
+          },
+        },
+      ],
+    );
+  });
+
   test('normalizes provider-executed search results and text citation metadata', () => {
     const adapter = newAdapter();
     type Chunk = Parameters<typeof adapter.translateChunk>[0];
diff --git a/packages/runtime/src/__tests__/plugin-composition-loader.test.ts b/packages/runtime/src/__tests__/plugin-composition-loader.test.ts
new file mode 100644
index 0000000000..394e2d763a
--- /dev/null
+++ b/packages/runtime/src/__tests__/plugin-composition-loader.test.ts
@@ -0,0 +1,206 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { Context, type Plugin } from '../plugin-kernel.js';
+import { z } from 'zod';
+import { MakaCompositionLoader } from '../plugin-composition-loader.js';
+import { PluginToolService } from '../plugin-tool-service.js';
+import type { MakaCompositionEntry, MakaPluginPackage } from '../plugin-runtime.js';
+
+test('composition tree supports nested groups and repeated package instances', async () => {
+  const activations: string[] = [];
+  const plugin = ((ctx: Context, config: { label: string }) => {
+    activations.push(`${ctx.maka!.entryId}:${config.label}`);
+    ctx.effect(() => () => activations.push(`dispose:${ctx.maka!.entryId}`), 'fixture');
+  }) as Plugin;
+  const loader = new MakaCompositionLoader();
+  await loader.install(pkg('fixture', plugin));
+  await loader.create('profile', {
+    id: 'group',
+    children: [
+      entry('first', 'fixture', { label: 'one' }),
+      entry('second', 'fixture', { label: 'two' }),
+    ],
+  });
+  assert.deepEqual(activations, ['first:one', 'second:two']);
+  assert.deepEqual(
+    loader.inspectTree('profile').map(({ id }) => id),
+    ['group'],
+  );
+  assert.deepEqual(
+    loader.inspect('group').children.map(({ id }) => id),
+    ['first', 'second'],
+  );
+  assert.equal(loader.root.kernelFibers().length, 3, 'root plus one real Fiber per package Entry');
+  await loader.remove('first');
+  assert.equal(loader.inspect('second').status, 'active');
+  assert.ok(activations.includes('dispose:first'));
+  await loader.close();
+});
+
+test('missing injected service enters pending and activates when provided', async () => {
+  let started = 0;
+  const plugin = Object.assign(
+    () => {
+      started += 1;
+    },
+    { inject: ['fixtureService'] },
+  );
+  const loader = new MakaCompositionLoader();
+  await loader.install(pkg('consumer', plugin));
+  await loader.create('profile', entry('consumer-one', 'consumer'));
+  assert.equal(loader.inspect('consumer-one').status, 'pending');
+  loader.root.provide('fixtureService', { value: 1 });
+  await loader.awaitSettled();
+  assert.equal(loader.inspect('consumer-one').status, 'active');
+  assert.equal(started, 1);
+  await loader.close();
+});
+
+test('config update uses the existing Fiber and preserves entry identity', async () => {
+  const values: number[] = [];
+  const plugin = (_ctx: Context, config: { value: number }) => {
+    values.push(config.value);
+  };
+  const loader = new MakaCompositionLoader();
+  await loader.install(pkg('configurable', plugin));
+  const initial = await loader.create(
+    'profile',
+    entry('configurable-one', 'configurable', { value: 1 }),
+  );
+  const updated = await loader.update('configurable-one', { config: { value: 2 } });
+  assert.equal(updated.id, initial.id);
+  assert.equal(updated.generation, initial.generation);
+  assert.equal(loader.snapshot().generation, 2);
+  assert.deepEqual(values, [1, 2]);
+  await loader.close();
+});
+
+test('package reload is atomic when the candidate Fiber fails', async () => {
+  const live = new Set<string>();
+  const current = (ctx: Context) => {
+    live.add(ctx.maka!.entryId);
+    return () => live.delete(ctx.maka!.entryId);
+  };
+  const failed = () => {
+    throw new Error('candidate exploded');
+  };
+  const loader = new MakaCompositionLoader();
+  await loader.install(pkg('atomic', current));
+  await loader.create('profile', entry('atomic-one', 'atomic'));
+  await assert.rejects(() => loader.install(pkg('atomic', failed)), /candidate exploded/u);
+  assert.equal(loader.inspect('atomic-one').status, 'active');
+  assert.deepEqual([...live], ['atomic-one']);
+  await loader.close();
+});
+
+test('package reload replaces only affected Entry subtrees', async () => {
+  const activations: string[] = [];
+  const loader = new MakaCompositionLoader();
+  await loader.install(
+    pkg('changing', (ctx: Context) => {
+      activations.push(`changing:${ctx.maka!.generation}`);
+    }),
+  );
+  await loader.install(
+    pkg('stable', (ctx: Context) => {
+      activations.push(`stable:${ctx.maka!.generation}`);
+    }),
+  );
+  await loader.create('profile', entry('changing-entry', 'changing'));
+  await loader.create('profile', entry('stable-entry', 'stable'));
+  const stableGeneration = loader.inspect('stable-entry').generation;
+
+  await loader.install(
+    pkg('changing', (ctx: Context) => {
+      activations.push(`changed:${ctx.maka!.generation}`);
+    }),
+  );
+
+  assert.notEqual(loader.inspect('changing-entry').generation, undefined);
+  assert.equal(loader.inspect('stable-entry').generation, stableGeneration);
+  assert.equal(activations.filter((item) => item.startsWith('stable:')).length, 1);
+  await loader.close();
+});
+
+test('Tool registrations are staged and owned by the entry Fiber', async () => {
+  const root = new Context();
+  await root.plugin(PluginToolService);
+  const loader = new MakaCompositionLoader({ root });
+  const plugin = Object.assign(
+    (ctx: Context, config: { suffix: string }) => {
+      ctx.tools.register({
+        name: `hello_${config.suffix}`,
+        description: 'fixture',
+        parameters: z.object({}),
+        impl: async () => config.suffix,
+      });
+    },
+    { inject: ['tools'] },
+  );
+  await loader.install(pkg('tool-owner', plugin));
+  await loader.create('profile', entry('tool-a', 'tool-owner', { suffix: 'a' }));
+  await loader.create('profile', entry('tool-b', 'tool-owner', { suffix: 'b' }));
+  assert.deepEqual(
+    root.tools.inspect('profile').map(({ toolName }) => toolName),
+    ['hello_a', 'hello_b'],
+  );
+  await loader.remove('tool-a');
+  assert.deepEqual(
+    root.tools.inspect('profile').map(({ toolName }) => toolName),
+    ['hello_b'],
+  );
+  await loader.close();
+});
+
+test('snapshot replacement restores ordered roots and descendants', async () => {
+  const loader = new MakaCompositionLoader();
+  await loader.install(pkg('snapshot', () => undefined));
+  await loader.replaceSnapshot({
+    schemaVersion: 1,
+    generation: 41,
+    roots: {
+      profile: [entry('profile-entry', 'snapshot')],
+      desktopUi: [{ id: 'ui-group', children: [entry('ui-entry', 'snapshot')] }],
+      sessions: { s1: [entry('session-entry', 'snapshot')] },
+    },
+  });
+  assert.equal(loader.snapshot().generation >= 41, true);
+  assert.deepEqual(
+    loader.inspectTree().map(({ id }) => id),
+    ['profile-entry', 'ui-group', 'session-entry'],
+  );
+  assert.equal(loader.inspect('ui-entry').parentId, 'ui-group');
+  await loader.close();
+});
+
+test('composition apply batches EntryTree operations under one generation check', async () => {
+  const loader = new MakaCompositionLoader();
+  await loader.install(pkg('batch', () => undefined));
+  const initial = loader.snapshot().generation;
+  const changed = await loader.apply({
+    baseGeneration: initial,
+    operations: [
+      { type: 'insert', entry: entry('batch-a', 'batch') },
+      { type: 'insert', parentId: 'batch-a', entry: { id: 'batch-group' } },
+      { type: 'update', entryId: 'batch-group', patch: { disabled: true } },
+    ],
+  });
+  assert.deepEqual(
+    changed.map(({ id }) => id),
+    ['batch-a', 'batch-group', 'batch-group'],
+  );
+  assert.equal(loader.inspect('batch-group').disabled, true);
+  await assert.rejects(
+    () => loader.apply({ baseGeneration: initial, operations: [] }),
+    /Composition generation changed/u,
+  );
+  await loader.close();
+});
+
+function pkg(packageId: string, host: Plugin): MakaPluginPackage {
+  return Object.freeze({ packageId, host });
+}
+
+function entry(id: string, packageId: string, config?: unknown): MakaCompositionEntry {
+  return Object.freeze({ id, packageId, ...(config === undefined ? {} : { config }) });
+}
diff --git a/packages/runtime/src/__tests__/plugin-kernel.test.ts b/packages/runtime/src/__tests__/plugin-kernel.test.ts
new file mode 100644
index 0000000000..611fb83cc3
--- /dev/null
+++ b/packages/runtime/src/__tests__/plugin-kernel.test.ts
@@ -0,0 +1,122 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { Context, FiberState, type Plugin } from '../plugin-kernel.js';
+
+declare module '../plugin-kernel.js' {
+  interface Context {
+    fixture?: { readonly value: string };
+  }
+}
+
+test('injected plugins wait for Services and reload when ownership changes', async () => {
+  const root = new Context();
+  const lifecycle: string[] = [];
+  const consumer = Object.assign(
+    (ctx: Context) => {
+      const value = ctx.fixture?.value;
+      lifecycle.push(`load:${value}`);
+      return () => lifecycle.push(`dispose:${value}`);
+    },
+    { inject: ['fixture'] },
+  ) satisfies Plugin;
+
+  const fiber = root.plugin(consumer);
+  await fiber.await();
+  assert.equal(fiber.state, FiberState.PENDING);
+
+  const removeFirst = root.provide('fixture', { value: 'first' });
+  await fiber.await();
+  assert.equal(fiber.state, FiberState.ACTIVE);
+  assert.deepEqual(lifecycle, ['load:first']);
+
+  await removeFirst();
+  await fiber.await();
+  assert.equal(fiber.state, FiberState.PENDING);
+  assert.deepEqual(lifecycle, ['load:first', 'dispose:first']);
+
+  root.provide('fixture', { value: 'second' });
+  await fiber.await();
+  assert.equal(fiber.state, FiberState.ACTIVE);
+  assert.deepEqual(lifecycle, ['load:first', 'dispose:first', 'load:second']);
+  await root.fiber.dispose();
+});
+
+test('Service isolation keeps sibling implementations independent', async () => {
+  const root = new Context();
+  root.provide('fixture', { value: 'root' });
+  const isolated = root.isolate('fixture');
+  isolated.provide('fixture', { value: 'isolated' });
+
+  assert.equal(root.get<{ value: string }>('fixture')?.value, 'root');
+  assert.equal(isolated.get<{ value: string }>('fixture')?.value, 'isolated');
+  assert.equal(root.extend().get<{ value: string }>('fixture')?.value, 'root');
+  await root.fiber.dispose();
+});
+
+test('Fiber update preserves identity and disposes Effects in reverse order', async () => {
+  const root = new Context();
+  const lifecycle: string[] = [];
+  const plugin = (ctx: Context, config: { value: number }) => {
+    lifecycle.push(`load:${config.value}`);
+    ctx.effect(() => () => lifecycle.push(`first:${config.value}`), 'first');
+    ctx.effect(() => () => lifecycle.push(`second:${config.value}`), 'second');
+  };
+  const fiber = root.plugin(plugin, { value: 1 });
+  await fiber.await();
+  const id = fiber.id;
+
+  await fiber.update({ value: 2 });
+  assert.equal(fiber.id, id);
+  assert.deepEqual(lifecycle, ['load:1', 'second:1', 'first:1', 'load:2']);
+  assert.deepEqual(
+    fiber.getEffects().map(({ label }) => label),
+    ['first', 'second'],
+  );
+  await root.fiber.dispose();
+});
+
+test('event dispatch supports emit, parallel, serial, bail, and waterfall', async () => {
+  const root = new Context();
+  const emitted: string[] = [];
+  root.on('emit', (value) => emitted.push(`one:${String(value)}`));
+  root.on('emit', (value) => emitted.push(`two:${String(value)}`));
+  root.emit('emit', 1);
+  assert.deepEqual(emitted, ['one:1', 'two:1']);
+
+  const parallel: string[] = [];
+  root.on('parallel', async () => {
+    await Promise.resolve();
+    parallel.push('one');
+  });
+  root.on('parallel', () => parallel.push('two'));
+  await root.parallel('parallel');
+  assert.deepEqual(parallel.sort(), ['one', 'two']);
+
+  root.on('serial', () => undefined);
+  root.on('serial', () => 'stop');
+  root.on('serial', () => 'unreachable');
+  assert.equal(await root.serial('serial'), 'stop');
+
+  root.on('bail', () => false);
+  root.on('bail', () => 42);
+  assert.equal(root.bail('bail'), 42);
+
+  root.on('waterfall', (value, next) => `outer(${String((next as () => unknown)())}:${value})`);
+  root.on('waterfall', (value, next) => `inner(${String((next as () => unknown)())}:${value})`);
+  assert.equal(root.waterfall('waterfall', 'x', () => 'base'), 'outer(inner(base:x):x)');
+  await root.fiber.dispose();
+});
+
+test('intercept configuration is inherited without mutating parent Contexts', async () => {
+  const root = new Context();
+  const child = root.intercept('fixture', { child: true });
+  const grandchild = child.intercept('fixture', { grandchild: true });
+
+  assert.deepEqual(root.interceptConfig('fixture'), []);
+  assert.deepEqual(child.interceptConfig('fixture'), [{ child: true }]);
+  assert.deepEqual(grandchild.interceptConfig('fixture'), [
+    { child: true },
+    { grandchild: true },
+  ]);
+  await root.fiber.dispose();
+});
diff --git a/packages/runtime/src/__tests__/runtime-event-read-model.test.ts b/packages/runtime/src/__tests__/runtime-event-read-model.test.ts
index 172b380e9a..2c7ba9472d 100644
--- a/packages/runtime/src/__tests__/runtime-event-read-model.test.ts
+++ b/packages/runtime/src/__tests__/runtime-event-read-model.test.ts
@@ -1687,6 +1687,19 @@ const ACTION_COVERAGE_SAMPLES: ActionCoverageSamples = {
     },
   },
   runtimeProtocol: { action: { toolBoundary: 't1_after_preflight_v1' } },
+  hookCompleted: {
+    action: {
+      eventName: 'PreToolUse',
+      handlerId: 'coverage-hook',
+      definitionHash: 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+      source: 'user',
+      toolUseId: 'coverage-tool',
+      toolName: 'Bash',
+      status: 'allowed',
+      durationMs: 1,
+    },
+    event: { refs: { toolCallId: 'coverage-tool' } },
+  },
 };
 
 describe('RuntimeEventActions projection coverage', () => {
diff --git a/packages/runtime/src/__tests__/session-manager.test.ts b/packages/runtime/src/__tests__/session-manager.test.ts
index f242bf0b32..ab52c918b0 100644
--- a/packages/runtime/src/__tests__/session-manager.test.ts
+++ b/packages/runtime/src/__tests__/session-manager.test.ts
@@ -97,6 +97,8 @@ import {
   LOCAL_READ_AGENT_DEFINITION,
   LOCAL_READ_AGENT_ID,
   LOCAL_READ_AGENT_PROFILE,
+  TOOL_AUTHOR_AGENT_ID,
+  UI_AUTHOR_AGENT_ID,
   WEB_RESEARCH_AGENT_DEFINITION,
   WEB_RESEARCH_AGENT_ID,
 } from '../agent-catalog.js';
@@ -11492,6 +11494,8 @@ describe('SessionManager permission mode updates', () => {
       LOCAL_READ_AGENT_ID,
       WEB_RESEARCH_AGENT_ID,
       IMPLEMENTATION_AGENT_ID,
+      TOOL_AUTHOR_AGENT_ID,
+      UI_AUTHOR_AGENT_ID,
     ]);
     expect(list.definitions[0]?.availability).toEqual({ status: 'available' });
     expect(list.definitions[0]?.contract.defaultWriteBack).toBe('summary');
@@ -11499,7 +11503,7 @@ describe('SessionManager permission mode updates', () => {
     expect(list.definitions[1]?.availability).toEqual({
       status: 'unavailable',
       reason: 'missing_tools',
-      missingTools: ['WebSearch'],
+      missingTools: ['WebSearch', 'WebFetch'],
     });
     expect(list.definitions[2]?.availability).toEqual({
       status: 'unavailable',
@@ -11507,6 +11511,16 @@ describe('SessionManager permission mode updates', () => {
       workspace: AGENT_WORKSPACE_WORKTREE,
       requiredRuntime: 'worktree_child_executor',
     });
+    expect(list.definitions[3]?.availability).toEqual({
+      status: 'unavailable',
+      reason: 'missing_tools',
+      missingTools: ['inspect_package', 'define_package'],
+    });
+    expect(list.definitions[4]?.availability).toEqual({
+      status: 'unavailable',
+      reason: 'missing_tools',
+      missingTools: ['inspect_package', 'define_package'],
+    });
     expect(list.runs.map((agent) => agent.runId)).toEqual(['child-run']);
     expect(list.executions.map((agent) => agent.execution)).toEqual([
       {
diff --git a/packages/runtime/src/__tests__/subagent-tools.test.ts b/packages/runtime/src/__tests__/subagent-tools.test.ts
index 768844f2cc..d0f5658614 100644
--- a/packages/runtime/src/__tests__/subagent-tools.test.ts
+++ b/packages/runtime/src/__tests__/subagent-tools.test.ts
@@ -20,10 +20,17 @@ import {
   LOCAL_READ_AGENT_ID,
   LOCAL_READ_AGENT_DEFINITION,
   LOCAL_READ_AGENT_PROFILE,
+  TOOL_AUTHOR_AGENT_DEFINITION,
+  TOOL_AUTHOR_AGENT_ID,
+  TOOL_AUTHOR_AGENT_PROFILE,
+  UI_AUTHOR_AGENT_DEFINITION,
+  UI_AUTHOR_AGENT_ID,
+  UI_AUTHOR_AGENT_PROFILE,
   WEB_RESEARCH_AGENT_ID,
   WEB_RESEARCH_AGENT_DEFINITION,
   WEB_RESEARCH_AGENT_PROFILE,
   assertAgentDefinitionRunnable,
+  buildToolsForAgentDefinition,
   evaluateAgentDefinitionAvailability,
   evaluateAgentDefinitionToolAccess,
   listBuiltinAgentDefinitions,
@@ -164,7 +171,7 @@ describe('subagent tools', () => {
     expect(localRead?.availability).toEqual({ status: 'available' });
   });
 
-  test('built-in catalog exposes web-research with only WebSearch and no local or write tools', () => {
+  test('built-in catalog exposes web-research with either search or direct fetch and no local tools', () => {
     const withWebSearch = listBuiltinAgentDefinitions({
       tools: [
         testCatalogTool('Read', 'read'),
@@ -174,9 +181,20 @@ describe('subagent tools', () => {
       ],
     });
     const webResearch = withWebSearch.find((definition) => definition.id === WEB_RESEARCH_AGENT_ID);
-    expect(webResearch?.tools).toEqual(['WebSearch']);
+    expect(webResearch?.tools).toEqual(['WebSearch', 'WebFetch']);
     expect(webResearch?.availability).toEqual({ status: 'available' });
 
+    const withWebFetch = listBuiltinAgentDefinitions({
+      tools: [testCatalogTool('WebFetch', 'web_read')],
+    }).find((definition) => definition.id === WEB_RESEARCH_AGENT_ID);
+    expect(withWebFetch?.availability).toEqual({ status: 'available' });
+    expect(
+      buildToolsForAgentDefinition(
+        [testCatalogTool('WebFetch', 'web_read')],
+        WEB_RESEARCH_AGENT_DEFINITION,
+      ).map((tool) => tool.name),
+    ).toEqual(['WebFetch']);
+
     expect(
       listBuiltinAgentDefinitions({
         tools: [
@@ -188,7 +206,7 @@ describe('subagent tools', () => {
     ).toEqual({
       status: 'unavailable',
       reason: 'missing_tools',
-      missingTools: ['WebSearch'],
+      missingTools: ['WebSearch', 'WebFetch'],
     });
   });
 
@@ -225,6 +243,67 @@ describe('subagent tools', () => {
     });
   });
 
+  test('built-in catalog exposes Tool author only with the bounded authoring surface', () => {
+    const tools = [
+      testCatalogTool('Read', 'read'),
+      testCatalogTool('Glob', 'read'),
+      testCatalogTool('Grep', 'read'),
+      testCatalogTool('inspect_package', 'read'),
+      testCatalogTool('define_package', 'file_write'),
+      testCatalogTool('manage_package', 'file_write'),
+      testCatalogTool('manage_package', 'file_write'),
+      testCatalogTool('invoke_tool', 'shell_unsafe'),
+    ];
+    const definition = listBuiltinAgentDefinitions({ tools }).find(
+      (candidate) => candidate.id === TOOL_AUTHOR_AGENT_ID,
+    );
+    expect(definition?.availability).toEqual({ status: 'available' });
+    expect(definition?.profile).toBe(TOOL_AUTHOR_AGENT_PROFILE);
+    expect(definition?.tools).toEqual([
+      'Read',
+      'Glob',
+      'Grep',
+      'inspect_package',
+      'define_package',
+    ]);
+    expect(TOOL_AUTHOR_AGENT_DEFINITION.contract.workspace).toBe(AGENT_WORKSPACE_SAME_WORKSPACE);
+    expect(TOOL_AUTHOR_AGENT_DEFINITION.contract.defaultWriteBack).toBe(AGENT_WRITE_BACK_SUMMARY);
+    expect(TOOL_AUTHOR_AGENT_DEFINITION.tools).not.toContain('manage_package');
+    expect(TOOL_AUTHOR_AGENT_DEFINITION.tools).not.toContain('invoke_tool');
+    expect(TOOL_AUTHOR_AGENT_DEFINITION.tools).not.toContain('Write');
+    expect(TOOL_AUTHOR_AGENT_DEFINITION.tools).not.toContain('Bash');
+  });
+
+  test('built-in catalog exposes UI author only with the bounded authoring surface', () => {
+    const tools = [
+      testCatalogTool('Read', 'read'),
+      testCatalogTool('Glob', 'read'),
+      testCatalogTool('Grep', 'read'),
+      testCatalogTool('inspect_package', 'read'),
+      testCatalogTool('define_package', 'file_write'),
+      testCatalogTool('manage_package', 'file_write'),
+      testCatalogTool('publish_ui_state', 'file_write'),
+    ];
+    const definition = listBuiltinAgentDefinitions({ tools }).find(
+      (candidate) => candidate.id === UI_AUTHOR_AGENT_ID,
+    );
+    expect(definition?.availability).toEqual({ status: 'available' });
+    expect(definition?.profile).toBe(UI_AUTHOR_AGENT_PROFILE);
+    expect(definition?.tools).toEqual([
+      'Read',
+      'Glob',
+      'Grep',
+      'inspect_package',
+      'define_package',
+    ]);
+    expect(UI_AUTHOR_AGENT_DEFINITION.contract.workspace).toBe(AGENT_WORKSPACE_SAME_WORKSPACE);
+    expect(UI_AUTHOR_AGENT_DEFINITION.contract.defaultWriteBack).toBe(AGENT_WRITE_BACK_SUMMARY);
+    expect(UI_AUTHOR_AGENT_DEFINITION.tools).not.toContain('manage_package');
+    expect(UI_AUTHOR_AGENT_DEFINITION.tools).not.toContain('publish_ui_state');
+    expect(UI_AUTHOR_AGENT_DEFINITION.tools).not.toContain('Write');
+    expect(UI_AUTHOR_AGENT_DEFINITION.tools).not.toContain('Bash');
+  });
+
   test('agent definition policy uses the explicit tool allowlist', () => {
     expect(
       evaluateAgentDefinitionToolAccess(
@@ -302,6 +381,7 @@ describe('subagent tools', () => {
         categoryHint: 'web_read',
         impl: async () => ({}),
       },
+      testCatalogTool('WebFetch', 'web_read'),
       {
         name: 'ExploreAgent',
         description: 'deterministic exploration',
@@ -309,6 +389,14 @@ describe('subagent tools', () => {
         categoryHint: 'subagent',
         impl: async () => ({}),
       },
+      testCatalogTool('inspect_package', 'read'),
+      testCatalogTool('define_package', 'file_write'),
+      testCatalogTool('manage_package', 'file_write'),
+      testCatalogTool('invoke_tool', 'shell_unsafe'),
+      testCatalogTool('inspect_package', 'read'),
+      testCatalogTool('define_package', 'file_write'),
+      testCatalogTool('manage_package', 'file_write'),
+      testCatalogTool('publish_ui_state', 'file_write'),
     ]);
 
     expect(tools.map((tool) => tool.name)).toEqual([
@@ -316,24 +404,30 @@ describe('subagent tools', () => {
       'Glob',
       'Grep',
       'WebSearch',
+      'WebFetch',
       'Write',
       'Edit',
       'apply_patch',
       'Bash',
       'WriteStdin',
       'StopBackgroundTask',
+      'inspect_package',
+      'define_package',
     ]);
     expect([...CHILD_AGENT_TOOL_NAMES]).toEqual([
       'Read',
       'Glob',
       'Grep',
       'WebSearch',
+      'WebFetch',
       'Write',
       'Edit',
       'apply_patch',
       'Bash',
       'WriteStdin',
       'StopBackgroundTask',
+      'inspect_package',
+      'define_package',
     ]);
   });
 
diff --git a/packages/runtime/src/__tests__/tool-runtime-sqlite-boundary.test.ts b/packages/runtime/src/__tests__/tool-runtime-sqlite-boundary.test.ts
index 9d7f4e53b4..9e10939a82 100644
--- a/packages/runtime/src/__tests__/tool-runtime-sqlite-boundary.test.ts
+++ b/packages/runtime/src/__tests__/tool-runtime-sqlite-boundary.test.ts
@@ -17,6 +17,70 @@ import type { InvocationContext } from '../invocation-context.js';
 import { MAX_ACTIVE_SUBAGENT_TOOLS_PER_TURN, ToolRuntime, type MakaTool } from '../tool-runtime.js';
 
 describe('ToolRuntime with real SQLite boundary', () => {
+  it('keeps a PreToolUse denial on the generic lane before T1 and never calls the tool', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'maka-tool-sqlite-hook-deny-'));
+    const store = createSqliteRuntimeStore(join(root, 'runtime.sqlite'));
+    try {
+      let implementationCalls = 0;
+      const events: SessionEvent[] = [];
+      const runtime = createTestToolRuntime({
+        sessionId: 'session-1',
+        header: header(),
+        connection: connection(),
+        modelId: 'model-1',
+        appendMessage: async () => {},
+        newId: nextId(),
+        now: nextNow(),
+        getPermissionPauseTarget: () => null,
+        runId: 'run-1',
+        invocationId: 'invocation-1',
+        runtimeCommitSink: store,
+        preToolUseHooks: {
+          prepareTurn: () => {},
+          releaseTurn: () => {},
+          runPreToolUse: async () => ({
+            denied: true,
+            reason: 'Policy denied this command',
+            audits: [],
+            auditWriteFailures: [],
+          }),
+        },
+      });
+      const tool: MakaTool<Record<string, never>, string> = {
+        name: 'Bash',
+        description: 'fixture',
+        parameters: { type: 'object', additionalProperties: false },
+        impl: async () => {
+          implementationCalls += 1;
+          return 'should not run';
+        },
+      };
+      const settlement = await runtime.settleToolCall({
+        tool,
+        turnId: 'turn-1',
+        toolCallId: 'provider-call-1',
+        input: {},
+        abortSignal: new AbortController().signal,
+        eventSink: {
+          push: (event) => events.push(event),
+          pushAndWaitUntilConsumed: async (event) => {
+            events.push(event);
+          },
+        },
+      });
+      assert.equal(implementationCalls, 0);
+      assert.match(JSON.stringify(settlement.result), /Policy denied this command/u);
+      const toolStart = events.find((event) => event.type === 'tool_start');
+      assert.ok(toolStart && toolStart.type === 'tool_start');
+      assert.equal(toolStart.operationId, undefined);
+      assert.equal(events.filter((event) => event.type === 'tool_result').length, 1);
+      assert.deepEqual(await store.readImmutableRuntimeEvents('session-1', 'run-1'), []);
+    } finally {
+      store.close();
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   it('replays raw MCP model arguments without persisting the execution binding', async () => {
     const root = await mkdtemp(join(tmpdir(), 'maka-tool-sqlite-mcp-args-'));
     const store = createSqliteRuntimeStore(join(root, 'runtime.sqlite'));
diff --git a/packages/runtime/src/agent-catalog.ts b/packages/runtime/src/agent-catalog.ts
index 0a59a9188d..f403a23b69 100644
--- a/packages/runtime/src/agent-catalog.ts
+++ b/packages/runtime/src/agent-catalog.ts
@@ -17,6 +17,10 @@ export const WEB_RESEARCH_AGENT_ID = 'web-research';
 export const WEB_RESEARCH_AGENT_PROFILE = 'web_research';
 export const IMPLEMENTATION_AGENT_ID = 'implementation';
 export const IMPLEMENTATION_AGENT_PROFILE = 'implementation';
+export const TOOL_AUTHOR_AGENT_ID = 'tool-author';
+export const TOOL_AUTHOR_AGENT_PROFILE = 'tool_author';
+export const UI_AUTHOR_AGENT_ID = 'ui-author';
+export const UI_AUTHOR_AGENT_PROFILE = 'ui_author';
 export const BUILTIN_AGENT_PROFILES = SUBAGENT_PROFILES;
 export const AGENT_INVOCATION_FOREGROUND = 'foreground';
 export const AGENT_CONTEXT_ISOLATED = 'isolated';
@@ -35,10 +39,11 @@ export type AgentWriteBackMode =
   | 'decision'
   | 'artifact'
   | 'patch';
-export type AgentToolGroup = 'file_edit';
+export type AgentToolGroup = 'file_edit' | 'web_research';
 
 const AGENT_TOOL_GROUP_ALTERNATIVES = {
   file_edit: [['Write', 'Edit'], ['apply_patch']],
+  web_research: [['WebSearch'], ['WebFetch']],
 } as const satisfies Record<AgentToolGroup, readonly (readonly string[])[]>;
 
 export interface AgentProfileContract {
@@ -139,7 +144,7 @@ export const WEB_RESEARCH_AGENT_DEFINITION: AgentDefinition = {
   id: WEB_RESEARCH_AGENT_ID,
   profile: WEB_RESEARCH_AGENT_PROFILE,
   name: 'Web Research',
-  description: 'Network-backed web research with WebSearch only.',
+  description: 'Network-backed web research with search or direct page fetching.',
   contract: {
     capability: 'web_research',
     invocation: AGENT_INVOCATION_FOREGROUND,
@@ -149,10 +154,11 @@ export const WEB_RESEARCH_AGENT_DEFINITION: AgentDefinition = {
     supportedWriteBack: [AGENT_WRITE_BACK_SUMMARY],
   },
   permissionMode: 'execute',
-  tools: ['WebSearch'],
+  tools: ['WebSearch', 'WebFetch'],
+  toolGroups: ['web_research'],
   systemPrompt: [
     'You are a foreground web-research child agent.',
-    'Use only the provided WebSearch tool.',
+    'Use only the provided WebSearch and WebFetch tools. Use WebFetch when the task names a concrete URL and WebSearch when discovery is required.',
     'Do not read local files, use shell, browser, write, or nested agent tools.',
     'Return concise findings with source titles and URLs for every external claim.',
     'Separate sourced facts from your own inference.',
@@ -195,10 +201,66 @@ export const IMPLEMENTATION_AGENT_DEFINITION: AgentDefinition = {
   ].join('\n'),
 };
 
+export const TOOL_AUTHOR_AGENT_DEFINITION: AgentDefinition = {
+  definitionVersion: 1,
+  id: TOOL_AUTHOR_AGENT_ID,
+  profile: TOOL_AUTHOR_AGENT_PROFILE,
+  name: 'Tool Author',
+  description:
+    'Build, install, and sandbox-test immutable Tool package candidates without editing the workspace or activating them for the parent Agent.',
+  contract: {
+    capability: TOOL_AUTHOR_AGENT_PROFILE,
+    invocation: AGENT_INVOCATION_FOREGROUND,
+    context: AGENT_CONTEXT_ISOLATED,
+    workspace: AGENT_WORKSPACE_SAME_WORKSPACE,
+    defaultWriteBack: AGENT_WRITE_BACK_SUMMARY,
+    supportedWriteBack: [AGENT_WRITE_BACK_SUMMARY],
+  },
+  permissionMode: 'execute',
+  tools: ['Read', 'Glob', 'Grep', 'inspect_package', 'define_package'],
+  systemPrompt: [
+    'You are a foreground Tool author child agent.',
+    'Use inspect_package before authoring, then define_package to install one Extension. Put Tool contributions under runtime.tools; the parent Agent will independently activate or reject it with manage_package.',
+    'Runtime source is ESM only and must export one default handler object, for example: export default { HandlerName: async (args, context) => ({ ok: true }) }; Never use module.exports or CommonJS exports.',
+    'After define_package succeeds, its replayed function_call intentionally contains accepted/redacted source and contribution summary fields instead of the full arguments. This is privacy-preserving history, not a failed or incomplete call.',
+    'Do not modify workspace source files and do not ask the parent Agent to install source code for you.',
+    'You cannot activate a Tool for the parent Session. Return the installed extension id, declared Tool names, permissions, and concrete test evidence so the parent can independently accept or reject it.',
+  ].join('\n'),
+};
+
+export const UI_AUTHOR_AGENT_DEFINITION: AgentDefinition = {
+  definitionVersion: 1,
+  id: UI_AUTHOR_AGENT_ID,
+  profile: UI_AUTHOR_AGENT_PROFILE,
+  name: 'UI Author',
+  description:
+    'Build, install, and sandbox-test immutable UI package candidates without editing the workspace or activating them for the parent Agent.',
+  contract: {
+    capability: UI_AUTHOR_AGENT_PROFILE,
+    invocation: AGENT_INVOCATION_FOREGROUND,
+    context: AGENT_CONTEXT_ISOLATED,
+    workspace: AGENT_WORKSPACE_SAME_WORKSPACE,
+    defaultWriteBack: AGENT_WRITE_BACK_SUMMARY,
+    supportedWriteBack: [AGENT_WRITE_BACK_SUMMARY],
+  },
+  permissionMode: 'execute',
+  tools: ['Read', 'Glob', 'Grep', 'inspect_package', 'define_package'],
+  systemPrompt: [
+    'You are a foreground UI author child agent.',
+    'Use inspect_package before authoring, then define_package to install one Extension. Put UI contributions under ui.contributions; the parent Agent will independently activate or reject it with manage_package.',
+    'For a permitted app.root Session bridge, window.makaUI.sessions.list() resolves to an object shaped as { sessions: [{ id, lastMessageAt, ... }] }, not an array. Destructure or read result.sessions before choosing a Session. window.makaUI.sessions.send({ sessionId, text }) resolves to { ok, sessionId, turnId }; window.makaUI.sessions.stop(sessionId) resolves to { ok: true }.',
+    'After define_package succeeds, its replayed function_call intentionally contains accepted/redacted document summary fields instead of the full HTML. This is privacy-preserving history, not a failed or incomplete call.',
+    'Do not modify workspace source files and do not ask the parent Agent to install source code for you.',
+    'You cannot activate, publish state to, reload, stop, or delete a UI for the parent Desktop scope. Return the installed extension id, contribution ids, permissions, and concrete test evidence so the parent can independently accept or reject it.',
+  ].join('\n'),
+};
+
 export const BUILTIN_AGENT_DEFINITIONS: readonly AgentDefinition[] = [
   LOCAL_READ_AGENT_DEFINITION,
   WEB_RESEARCH_AGENT_DEFINITION,
   IMPLEMENTATION_AGENT_DEFINITION,
+  TOOL_AUTHOR_AGENT_DEFINITION,
+  UI_AUTHOR_AGENT_DEFINITION,
 ];
 
 export function listBuiltinAgentDefinitions(
diff --git a/packages/runtime/src/agent-graph-supervisor-wake.ts b/packages/runtime/src/agent-graph-supervisor-wake.ts
index a265b9ab8e..e0f39daaec 100644
--- a/packages/runtime/src/agent-graph-supervisor-wake.ts
+++ b/packages/runtime/src/agent-graph-supervisor-wake.ts
@@ -525,6 +525,16 @@ export class AgentGraphSupervisorWakeCoordinator {
             return;
           }
           lastFailure = wakeOutcomeFailure(outcome);
+          if (isNonRetryableSupervisorFailure(lastFailure)) {
+            await this.#input.wakeStore.completeAgentGraphSupervisorWakeAttempt({
+              graphId: wake.graphId,
+              wakeId: wake.wakeId,
+              attemptId,
+              status: 'superseded',
+              failureReason: `non_retryable:${lastFailure}`.slice(0, 4_000),
+            });
+            return;
+          }
           await this.#markRetryable(wake.graphId, wake.wakeId, attemptId, lastFailure);
           if (outcome.kind === 'context_overflow' || isSupervisorContextOverflow(lastFailure)) {
             overflowAttempt = { attemptId, turnId, failureReason: lastFailure };
@@ -532,6 +542,16 @@ export class AgentGraphSupervisorWakeCoordinator {
         } catch (error) {
           if (this.#sessionWakesSuppressed(wake.rootSessionId)) return;
           lastFailure = errorMessage(error);
+          if (isNonRetryableSupervisorFailure(lastFailure)) {
+            await this.#input.wakeStore.completeAgentGraphSupervisorWakeAttempt({
+              graphId: wake.graphId,
+              wakeId: wake.wakeId,
+              attemptId,
+              status: 'superseded',
+              failureReason: `non_retryable:${lastFailure}`.slice(0, 4_000),
+            });
+            return;
+          }
           await this.#markRetryable(wake.graphId, wake.wakeId, attemptId, lastFailure);
           if (isSupervisorContextOverflow(lastFailure)) {
             overflowAttempt = { attemptId, turnId, failureReason: lastFailure };
@@ -821,6 +841,11 @@ function isSupervisorContextOverflow(failureReason: string): boolean {
   );
 }
 
+function isNonRetryableSupervisorFailure(failureReason: string): boolean {
+  const normalized = failureReason.toLowerCase();
+  return normalized.includes('provider_billing') || normalized.includes('provider billing');
+}
+
 function projectAgentGraphSupervisorPartialResult(
   snapshot: AgentGraphClientSnapshot,
 ): AgentGraphSupervisorPartialResult {
diff --git a/packages/runtime/src/ai-sdk-backend.ts b/packages/runtime/src/ai-sdk-backend.ts
index b9293f0834..1e81c9a08d 100644
--- a/packages/runtime/src/ai-sdk-backend.ts
+++ b/packages/runtime/src/ai-sdk-backend.ts
@@ -134,6 +134,7 @@ import type { SubagentExecutionRef } from './subagent-execution.js';
 import {
   ModelAdapter,
   type ModelFactoryInput,
+  type ModelAdapterStreamInput,
   type NormalizedAiSdkUsage,
   type ModelStreamResult,
   type RepairableAiSdkToolCall,
@@ -402,6 +403,105 @@ function providerToolResultContent(
   return { kind: 'web_search', provider: 'model', query, rows };
 }
 
+function transformedPromptText(payload: unknown, fallback: string): string {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return fallback;
+  const text = (payload as { text?: unknown }).text;
+  return typeof text === 'string' && Buffer.byteLength(text, 'utf8') <= 1024 * 1024
+    ? text
+    : fallback;
+}
+
+function transformedSystemPrompt(
+  payload: unknown,
+  fallback: string | undefined,
+): string | undefined {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return fallback;
+  const prompt = (payload as { prompt?: unknown }).prompt;
+  if (typeof prompt !== 'string' || Buffer.byteLength(prompt, 'utf8') > 2 * 1024 * 1024)
+    return fallback;
+  return prompt.length > 0 ? prompt : undefined;
+}
+
+function transformedRequestMessages(
+  payload: unknown,
+  fallback: readonly ModelMessage[],
+): ModelMessage[] {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return [...fallback];
+  const messages = (payload as { messages?: unknown }).messages;
+  if (!Array.isArray(messages) || messages.length > 10_000) return [...fallback];
+  try {
+    const encoded = JSON.stringify(messages);
+    if (Buffer.byteLength(encoded, 'utf8') > 8 * 1024 * 1024) return [...fallback];
+    return structuredClone(messages) as ModelMessage[];
+  } catch {
+    return [...fallback];
+  }
+}
+
+function transformedProviderRequest(
+  payload: unknown,
+  fallback: {
+    readonly messages: readonly ModelMessage[];
+    readonly systemPrompt: string | undefined;
+    readonly activeTools: readonly string[];
+  },
+): { messages: ModelMessage[]; systemPrompt: string | undefined; activeTools: string[] } {
+  const record =
+    payload && typeof payload === 'object' && !Array.isArray(payload)
+      ? (payload as Record<string, unknown>)
+      : undefined;
+  const messages = transformedRequestMessages(record, fallback.messages);
+  const systemPrompt = transformedSystemPrompt(
+    record && Object.hasOwn(record, 'systemPrompt')
+      ? { prompt: record.systemPrompt === null ? '' : record.systemPrompt }
+      : undefined,
+    fallback.systemPrompt,
+  );
+  const allowed = new Set(fallback.activeTools);
+  const activeTools =
+    Array.isArray(record?.activeTools) &&
+    record.activeTools.every((name) => typeof name === 'string' && allowed.has(name))
+      ? [...new Set(record.activeTools as string[])]
+      : [...fallback.activeTools];
+  return { messages, systemPrompt, activeTools };
+}
+
+function extensionRetryDecision(payload: unknown): { retry: boolean; delayMs?: number } {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return { retry: false };
+  const record = payload as Record<string, unknown>;
+  const delayMs =
+    Number.isSafeInteger(record.delayMs) &&
+    (record.delayMs as number) >= 0 &&
+    (record.delayMs as number) <= 60_000
+      ? (record.delayMs as number)
+      : undefined;
+  return { retry: record.retry === true, ...(delayMs === undefined ? {} : { delayMs }) };
+}
+
+function extensionContinuationDecision(payload: unknown): {
+  continue: boolean;
+  instruction: string;
+} {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload))
+    return { continue: false, instruction: '' };
+  const record = payload as Record<string, unknown>;
+  if (
+    record.continue !== true ||
+    typeof record.instruction !== 'string' ||
+    record.instruction.length === 0 ||
+    Buffer.byteLength(record.instruction, 'utf8') > 64 * 1024
+  ) {
+    return { continue: false, instruction: '' };
+  }
+  return { continue: true, instruction: record.instruction };
+}
+
+function safeExtensionError(error: unknown): { name: string; message: string } {
+  const name = error instanceof Error ? error.name : 'Error';
+  const message = error instanceof Error ? error.message : String(error);
+  return { name: name.slice(0, 128), message: message.slice(0, 4_000) };
+}
+
 function providerWebSearchQuery(input: unknown): string {
   let value = input;
   if (typeof input === 'string') {
@@ -697,6 +797,13 @@ export interface AiSdkBackendInput extends AiSdkCompactionCapabilities {
   // ── Process-singleton deps ─────────────────────────────────────────────
   /** Canonical-named tools available this session. */
   tools: MakaTool[];
+  /**
+   * Optional trusted catalog reader. When present, Runtime snapshots the full
+   * Core + Extension Tool surface once at the beginning of every `send()`.
+   * The returned tools still pass through apply-patch routing, availability,
+   * argument validation, permission, sandbox, and ToolRuntime settlement.
+   */
+  resolveTools?: () => readonly MakaTool[];
   /** Active profile and enforcement capability snapshot for this session backend. */
   sandboxDiagnosticsSnapshot?: SandboxDiagnosticsSnapshot;
   /** Diagnostic-only Plan Mode/execution identity snapshot. */
@@ -749,6 +856,8 @@ export interface AiSdkBackendInput extends AiSdkCompactionCapabilities {
   openAiResponsesTransportState?: OpenAiResponsesTransportState;
   /** Optional fire-and-forget telemetry hook. Tool implementations remain unaware. */
   recordToolInvocation?: ToolTelemetryRecorder;
+  /** User/project PreToolUse policy dispatcher, frozen per turn by its snapshot loader. */
+  preToolUseHooks?: ToolRuntimeInput['preToolUseHooks'];
   /** Optional Phase 2 SQLite T1/T2 boundary for real tool execution. */
   runtimeCommitSink?: RuntimeCommitSink;
   /** Durable session-lifetime cumulative usage checkpoint after each completed provider step. */
@@ -821,6 +930,8 @@ export interface AiSdkBackendInput extends AiSdkCompactionCapabilities {
     sessionId: string;
     turnId: string;
     runId: string;
+    /** Exact Host Tool snapshot selected for this send, when this is the main call. */
+    tools?: readonly MakaTool[];
   }) => void | Promise<void>;
   /**
    * Optional artifact recorder. Runtime derives only deterministic candidates
@@ -1042,7 +1153,7 @@ export class AiSdkBackend implements AgentBackend {
   private readonly maxSteps: number | undefined;
   private readonly providerRetrySleep: (delayMs: number, signal: AbortSignal) => Promise<void>;
   private readonly modelAdapter: ModelAdapter;
-  private readonly toolAvailabilityRuntime: ToolAvailabilityRuntime;
+  private readonly memoryTools: readonly MakaTool[];
   private readonly applyPatchProfile: ApplyPatchProfile | null;
 
   /**
@@ -1103,14 +1214,8 @@ export class AiSdkBackend implements AgentBackend {
       appendTurnTailPrompt: (content, turnTailPrompt) =>
         this.appendTurnTailPrompt(content, turnTailPrompt),
     });
-    if (
-      input.tools.some(
-        (tool) => tool.name === MEMORY_REMEMBER_TOOL_NAME || tool.name === MEMORY_EXTRACT_TOOL_NAME,
-      )
-    ) {
-      throw new Error('Long-term Memory trigger tool names are reserved by Runtime');
-    }
-    const memoryTools = input.memoryExtraction
+    validateHostToolSnapshot(input.tools);
+    this.memoryTools = input.memoryExtraction
       ? buildMemoryExtractionTriggerTools({
           capabilities: input.memoryExtraction,
           snapshot: (trigger, context) => this.memorySourceSnapshot(trigger, context),
@@ -1128,14 +1233,28 @@ export class AiSdkBackend implements AgentBackend {
       : [];
     const runtime = resolveModelRuntime(input.connection, input.modelId);
     this.applyPatchProfile = runtime.applyPatchProfile;
-    const modelTools = routeApplyPatchTools(input.tools, this.applyPatchProfile);
-    this.toolAvailabilityRuntime = new ToolAvailabilityRuntime(
-      // The archive decoder is a runtime protocol tool, not a host binding:
-      // this session's placeholders name it, so this session advertises it.
-      bindToolResultArchiveDecoder([...modelTools, ...memoryTools], input.toolResultArchive),
-      input.toolAvailability,
-      buildInvalidMakaTool(),
-    );
+  }
+
+  private snapshotToolAvailability(): {
+    readonly hostTools: readonly MakaTool[];
+    readonly runtime: ToolAvailabilityRuntime;
+  } {
+    const hostTools = Object.freeze([...(this.input.resolveTools?.() ?? this.input.tools)]);
+    validateHostToolSnapshot(hostTools);
+    const modelTools = routeApplyPatchTools(hostTools, this.applyPatchProfile);
+    return {
+      hostTools,
+      runtime: new ToolAvailabilityRuntime(
+        // The archive decoder is a runtime protocol tool, not a host binding:
+        // this session's placeholders name it, so this session advertises it.
+        bindToolResultArchiveDecoder(
+          [...modelTools, ...this.memoryTools],
+          this.input.toolResultArchive,
+        ),
+        this.input.toolAvailability,
+        buildInvalidMakaTool(),
+      ),
+    };
   }
 
   private memorySourceSnapshot(
@@ -1242,7 +1361,46 @@ export class AiSdkBackend implements AgentBackend {
       ...(identity.invocationId ? { invocationId: identity.invocationId } : {}),
       materializeDefaultToolResultOutput: ({ toolCallId, output }) =>
         this.materializeToolResultOutput(identity.scope().imageBudget, output, false, toolCallId),
-      spawnChildAgent: input.spawnChildAgent,
+      ...(input.spawnChildAgent
+        ? {
+            spawnChildAgent: async (
+              childInput: Parameters<NonNullable<typeof input.spawnChildAgent>>[0],
+            ) => {
+              const scope = identity.scope();
+              await input.preToolUseHooks?.runCoreEvent?.(
+                'maka.subagent.start',
+                {
+                  parentRunId: childInput.parentRunId,
+                  name: childInput.spec.name,
+                  prompt: childInput.prompt,
+                },
+                childInput.abortSignal,
+                this.coreEventContext(scope),
+              );
+              let outcome: 'completed' | 'failed' = 'failed';
+              try {
+                const result = await input.spawnChildAgent!(childInput);
+                outcome = 'completed';
+                return result;
+              } finally {
+                try {
+                  await input.preToolUseHooks?.runCoreEvent?.(
+                    'maka.subagent.end',
+                    {
+                      parentRunId: childInput.parentRunId,
+                      name: childInput.spec.name,
+                      outcome,
+                    },
+                    new AbortController().signal,
+                    this.coreEventContext(scope),
+                  );
+                } catch {
+                  // Observe-only subagent events cannot replace child settlement.
+                }
+              }
+            },
+          }
+        : {}),
       spawnChildSession: input.spawnChildSession,
       prepareChildAgentResume: input.prepareChildAgentResume,
       resumeChildAgent: input.resumeChildAgent,
@@ -1251,6 +1409,7 @@ export class AiSdkBackend implements AgentBackend {
       readChildAgentOutput: input.readChildAgentOutput,
       getRunTrace: () => identity.scope().runTrace,
       recordToolInvocation: input.recordToolInvocation,
+      preToolUseHooks: input.preToolUseHooks,
       runtimeCommitSink: input.runtimeCommitSink,
       recordToolArtifacts: input.recordToolArtifacts,
     });
@@ -1325,9 +1484,85 @@ export class AiSdkBackend implements AgentBackend {
     // Run, an unreadable attachment). A leaked scope would be permanent: nothing
     // overwrites a Set entry, and stop()/dispose() only iterate it.
     const scope = this.openTurnScope(input);
+    let preparedInput = input;
+    // Default to aborted so an abandoned async iterator cannot be reported as
+    // a completed Run. Normal exhaustion is the only path that promotes it.
+    let outcome: 'completed' | 'failed' | 'aborted' = 'aborted';
+    let runEndDispatched = false;
+    const hookContext = {
+      invocationId: input.invocationId ?? input.runId ?? input.turnId,
+      sessionId: this.input.sessionId,
+      runId: input.runId ?? input.turnId,
+      turnId: input.turnId,
+      cwd: this.input.header.cwd,
+      permissionMode: this.input.header.permissionMode,
+      origin: 'provider' as const,
+    };
+    const dispatchRunEnd = async () => {
+      if (runEndDispatched) return;
+      runEndDispatched = true;
+      try {
+        await this.input.preToolUseHooks?.runCoreEvent?.(
+          'maka.agent.status',
+          { status: outcome, modelId: this.input.modelId },
+          new AbortController().signal,
+          hookContext,
+        );
+      } catch {
+        // Observe-only Extension Hooks are fail-open and cannot replace turn settlement.
+      }
+    };
     try {
-      yield* this.sendWithinScope(scope, input);
+      const promptResult = await this.input.preToolUseHooks?.runCoreEvent?.(
+        'maka.user-prompt.submit',
+        { text: input.text },
+        scope.abortController.signal,
+        hookContext,
+      );
+      const transformedText = transformedPromptText(promptResult?.result, input.text);
+      if (transformedText !== input.text) preparedInput = { ...input, text: transformedText };
+      await this.input.preToolUseHooks?.runCoreEvent?.(
+        'maka.agent.status',
+        { status: 'running', modelId: this.input.modelId },
+        scope.abortController.signal,
+        hookContext,
+      );
+      for await (const event of this.sendWithinScope(scope, preparedInput)) {
+        try {
+          await this.input.preToolUseHooks?.runCoreEvent?.(
+            'maka.session.event',
+            { event },
+            scope.abortController.signal,
+            hookContext,
+          );
+          if (event.type === 'complete') {
+            await this.input.preToolUseHooks?.runCoreEvent?.(
+              'maka.session.flush',
+              { stopReason: event.stopReason },
+              scope.abortController.signal,
+              hookContext,
+            );
+          }
+        } catch (error) {
+          if (scope.abortController.signal.aborted) throw error;
+          // Observability listeners are contained and cannot fail the Agent turn.
+        }
+        if (event.type === 'complete') {
+          outcome = 'completed';
+          // The Flow forwards the terminal event to its own consumer. That
+          // consumer is allowed to stop pulling immediately, so a RunEnd left
+          // in this generator's finally block may never commit. Settle the
+          // lifecycle Hook before the terminal event becomes observable.
+          await dispatchRunEnd();
+        }
+        yield event;
+      }
+      if (!runEndDispatched) outcome = 'completed';
+    } catch (error) {
+      outcome = scope.abortController.signal.aborted ? 'aborted' : 'failed';
+      throw error;
     } finally {
+      await dispatchRunEnd();
       await this.cleanupAfterTurn(scope);
     }
   }
@@ -1511,14 +1746,6 @@ export class AiSdkBackend implements AgentBackend {
         toSandboxRunTraceProjection(this.input.sandboxDiagnosticsSnapshot),
       );
     }
-    const providerRequestTracker = this.createProviderRequestTracker({
-      turnId,
-      callKind: 'main',
-      modelId: this.input.modelId,
-      runId: scope.runId,
-    });
-    const providerRequestTraceId = providerRequestTracker?.traceId;
-
     // --- Resolve model (API key already attached at construct time) ---
     let model: unknown;
     try {
@@ -1570,11 +1797,20 @@ export class AiSdkBackend implements AgentBackend {
       throw new Error(`Invalid tool mode: ${String(requestedToolMode)}`);
     }
     const toolMode = requestedToolMode;
-    if (toolMode === 'code_mode' && this.input.tools.some((tool) => tool.name === 'exec')) {
+    const toolSnapshot = this.snapshotToolAvailability();
+    const providerRequestTracker = this.createProviderRequestTracker({
+      turnId,
+      callKind: 'main',
+      modelId: this.input.modelId,
+      runId: scope.runId,
+      tools: toolSnapshot.hostTools,
+    });
+    const providerRequestTraceId = providerRequestTracker?.traceId;
+    if (toolMode === 'code_mode' && toolSnapshot.hostTools.some((tool) => tool.name === 'exec')) {
       throw new Error('Tool name "exec" is reserved for Code Mode.');
     }
     const plan = projectToolModePlan(
-      this.toolAvailabilityRuntime.prepare(
+      toolSnapshot.runtime.prepare(
         (input.runtimeContext ?? []).filter((event) => event.turnId !== turnId),
         requiredOrchestrationTools,
       ),
@@ -2060,6 +2296,7 @@ export class AiSdkBackend implements AgentBackend {
         let providerOutcome: ModelStepOutcome;
         let finishReason: ModelFinishReason = 'stop';
         let terminalProviderError: unknown;
+        let extensionContinuationCount = 0;
         agentLoop: for (;;) {
           await this.drainSteeringInto(scope, input, queue);
           if (this.input.loadTurnRuntimeEvents) {
@@ -2072,6 +2309,17 @@ export class AiSdkBackend implements AgentBackend {
             if (missingSteering.length > 0)
               requestMessages = [...requestMessages, ...missingSteering];
           }
+          const preStepResult = await this.input.preToolUseHooks?.runCoreEvent?.(
+            'maka.agent.pre-step',
+            {
+              stepNumber: runtimeSteps,
+              modelId: this.input.modelId,
+              messages: requestMessages,
+            },
+            turnAbortController.signal,
+            this.coreEventContext(scope),
+          );
+          requestMessages = transformedRequestMessages(preStepResult?.result, requestMessages);
           const shaped = requestProjection
             ? await requestProjection({
                 completedSteps: completedProviderSteps,
@@ -2146,11 +2394,32 @@ export class AiSdkBackend implements AgentBackend {
             // rebuilt in place by overflow recovery, and the boundary it folded
             // under must travel with that rebuild, not with the step.
             const historyCompactBoundary = requestHistoryCompactBoundary();
-            result = await this.modelAdapter.startStream({
-              model,
+            const requestHookResult = await this.input.preToolUseHooks?.runCoreEvent?.(
+              'maka.agent.request',
+              {
+                stepNumber: runtimeSteps,
+                attempt: providerAttempt,
+                modelId: this.input.modelId,
+                messages: attemptMessages,
+                systemPrompt: requestSystemPrompt ?? null,
+                activeTools: activeToolsForRequest,
+              },
+              turnAbortController.signal,
+              this.coreEventContext(scope),
+            );
+            const hookedRequest = transformedProviderRequest(requestHookResult?.result, {
               messages: attemptMessages,
-              tools: modelTools,
+              systemPrompt: requestSystemPrompt,
               activeTools: activeToolsForRequest,
+            });
+            scope.memorySourceMessages = [...hookedRequest.messages];
+            scope.memorySourceSystemPrompt = hookedRequest.systemPrompt;
+            scope.memorySourceActiveTools = [...hookedRequest.activeTools];
+            const streamInput: ModelAdapterStreamInput = {
+              model,
+              messages: hookedRequest.messages,
+              tools: modelTools,
+              activeTools: hookedRequest.activeTools,
               onStreamActivity: () => requestWatchdog?.markActivity(),
               repairToolCall: async ({
                 toolCall,
@@ -2169,7 +2438,7 @@ export class AiSdkBackend implements AgentBackend {
                   error,
                 });
               },
-              system: requestSystemPrompt,
+              system: hookedRequest.systemPrompt,
               abortSignal: AbortSignal.any([
                 turnAbortController.signal,
                 providerRequestAbortController.signal,
@@ -2177,7 +2446,22 @@ export class AiSdkBackend implements AgentBackend {
               ...(providerRequestTracker ? { providerRequestTracker } : {}),
               ...(historyCompactBoundary ? { historyCompactBoundary } : {}),
               continuationKey: scope.turnId,
-            });
+            };
+            const startStream = (value: unknown): Promise<ModelStreamResult> => {
+              if (!value || typeof value !== 'object' || Array.isArray(value)) {
+                throw new Error('llm/stream middleware payload must be a request object');
+              }
+              return this.modelAdapter.startStream(value as ModelAdapterStreamInput);
+            };
+            result = this.input.preToolUseHooks?.runCoreMiddleware
+              ? ((await this.input.preToolUseHooks.runCoreMiddleware(
+                  'maka.llm.stream',
+                  streamInput,
+                  turnAbortController.signal,
+                  this.coreEventContext(scope),
+                  startStream,
+                )) as ModelStreamResult)
+              : await startStream(streamInput);
 
             for await (const event of result.events) {
               if (scope.aborted) break;
@@ -2384,6 +2668,20 @@ export class AiSdkBackend implements AgentBackend {
                 settledWatchdogTimeout || providerOutcome.kind === 'completed'
                   ? this.modelAdapter.normalizeFailure(attemptFailure)
                   : providerOutcome.failure;
+              const requestErrorResult = await this.input.preToolUseHooks?.runCoreEvent?.(
+                'maka.agent.request-error',
+                {
+                  stepNumber: runtimeSteps,
+                  attempt: providerAttempt,
+                  modelId: this.input.modelId,
+                  error: safeExtensionError(failure),
+                  retryable: failure.retryable,
+                  noObservableOutput: attemptHasNoObservableOutput(),
+                },
+                turnAbortController.signal,
+                this.coreEventContext(scope),
+              );
+              const extensionRetry = extensionRetryDecision(requestErrorResult?.result);
               if (scope.loopStopRequested) {
                 terminalProviderError = settledWatchdogTimeout?.error ?? failure;
                 break agentLoop;
@@ -2438,7 +2736,10 @@ export class AiSdkBackend implements AgentBackend {
                 incompleteStreamRetryCount < MAX_INCOMPLETE_STREAM_RETRIES_PER_STEP &&
                 incompleteStreamHasNoObservableOutput;
               if (
-                (failure.retryable || idleWatchdogRecovery || incompleteStreamRecovery) &&
+                (failure.retryable ||
+                  extensionRetry.retry ||
+                  idleWatchdogRecovery ||
+                  incompleteStreamRecovery) &&
                 providerAttempt < MAX_PROVIDER_ATTEMPTS_PER_STEP &&
                 stepBudgetRemains &&
                 (attemptHasNoObservableOutput() || idleWatchdogRecovery || incompleteStreamRecovery)
@@ -2454,7 +2755,9 @@ export class AiSdkBackend implements AgentBackend {
                 // The failed request did not return authoritative usage. Keep
                 // effectiveness recoverable, but fail final metering closed.
                 sawUnusableStepUsage = true;
-                const delayMs = providerRetryDelayMs(providerAttempt, failure.retryAfterMs);
+                const delayMs =
+                  extensionRetry.delayMs ??
+                  providerRetryDelayMs(providerAttempt, failure.retryAfterMs);
                 const nextAttempt = providerAttempt + 1;
                 const maxAttempts =
                   idleWatchdogRecovery || incompleteStreamRecovery
@@ -2563,7 +2866,7 @@ export class AiSdkBackend implements AgentBackend {
                     : {}),
                   input:
                     requestedTool !== undefined
-                      ? toolCall.input
+                      ? decodeToolCallInput(toolCall.input, requestedTool.parameters)
                       : {
                           tool: toolCall.toolName,
                           error: 'returned tool is unavailable',
@@ -2639,6 +2942,29 @@ export class AiSdkBackend implements AgentBackend {
             currentStepMessageId = this.newId();
             continue agentLoop;
           }
+          if (!stepLimitReached && !scope.loopStopRequested && !scope.aborted) {
+            const stoppingResult = await this.input.preToolUseHooks?.runCoreEvent?.(
+              'maka.agent.turn-stopping',
+              {
+                stepNumber: runtimeSteps,
+                modelId: this.input.modelId,
+                finishReason,
+                assistantText: scope.finalAssistantText ?? '',
+              },
+              turnAbortController.signal,
+              this.coreEventContext(scope),
+            );
+            const continuation = extensionContinuationDecision(stoppingResult?.result);
+            if (continuation.continue && extensionContinuationCount < 3) {
+              extensionContinuationCount += 1;
+              requestMessages = [
+                ...requestMessages,
+                { role: 'user', content: continuation.instruction } satisfies ModelMessage,
+              ];
+              currentStepMessageId = this.newId();
+              continue agentLoop;
+            }
+          }
           break agentLoop;
         }
 
@@ -3180,6 +3506,7 @@ export class AiSdkBackend implements AgentBackend {
     turnId: string;
     callKind: ModelCallKind;
     modelId: string;
+    tools?: readonly MakaTool[];
     /**
      * Stated by every caller, never defaulted: an unattributed provider request
      * is silently dropped by usage accounting, so the compiler has to be the
@@ -3201,6 +3528,7 @@ export class AiSdkBackend implements AgentBackend {
               sessionId: this.sessionId,
               turnId: input.turnId,
               runId,
+              ...(input.tools ? { tools: input.tools } : {}),
             })
         : undefined;
     if (!persistCapture && !accounting && !beforeDispatch) return undefined;
@@ -4383,8 +4711,9 @@ export class AiSdkBackend implements AgentBackend {
 
   private async resolveSystemPrompt(scope: TurnScope): Promise<string | undefined> {
     const turnId = scope.turnId;
+    let prompt: string | undefined;
     if (typeof this.input.systemPrompt === 'function') {
-      return await this.input.systemPrompt({
+      prompt = await this.input.systemPrompt({
         sessionId: this.sessionId,
         turnId,
         ...(scope.runId ? { runId: scope.runId } : {}),
@@ -4393,8 +4722,28 @@ export class AiSdkBackend implements AgentBackend {
         emitSkillCatalogTrace: (message, data) =>
           scope.runTrace?.emit('skill', 'skill_catalog_built', message, data),
       });
+    } else {
+      prompt = this.input.systemPrompt;
     }
-    return this.input.systemPrompt;
+    const result = await this.input.preToolUseHooks?.runCoreEvent?.(
+      'maka.system-prompt.assemble',
+      { prompt: prompt ?? '', modelId: this.input.modelId },
+      scope.abortController.signal,
+      this.coreEventContext(scope),
+    );
+    return transformedSystemPrompt(result?.result, prompt);
+  }
+
+  private coreEventContext(scope: TurnScope) {
+    return {
+      invocationId: scope.runId ?? scope.turnId,
+      sessionId: this.sessionId,
+      runId: scope.runId ?? scope.turnId,
+      turnId: scope.turnId,
+      cwd: this.input.header.cwd,
+      permissionMode: this.input.header.permissionMode,
+      origin: 'provider' as const,
+    };
   }
 
   private async resolveTurnTailPrompt(turnId: string): Promise<string | undefined> {
@@ -4660,12 +5009,62 @@ function describeUnrepairableToolCall(input: {
 }
 
 function parseToolCallInput(raw: unknown): unknown {
-  if (typeof raw !== 'string') return raw;
+  const decoded = decodeToolCallInput(raw);
+  return typeof decoded === 'string' ? undefined : decoded;
+}
+
+function decodeToolCallInput(raw: unknown, parameters?: unknown): unknown {
+  let parsed = raw;
+  for (let depth = 0; depth < 8 && typeof parsed === 'string'; depth += 1) {
+    try {
+      parsed = JSON.parse(parsed);
+    } catch {
+      return parsed;
+    }
+  }
+  if (toolParametersAccept(parameters, parsed)) return parsed;
+  const nestedDecoded = decodeNestedJsonContainers(parsed, 0);
+  if (toolParametersAccept(parameters, nestedDecoded)) return nestedDecoded;
+  return parsed;
+}
+
+function toolParametersAccept(parameters: unknown, input: unknown): boolean {
+  if (
+    !parameters ||
+    typeof parameters !== 'object' ||
+    !('safeParse' in parameters) ||
+    typeof parameters.safeParse !== 'function'
+  ) {
+    return false;
+  }
   try {
-    return JSON.parse(raw);
+    return parameters.safeParse(input).success === true;
   } catch {
-    return undefined;
+    return false;
+  }
+}
+
+function decodeNestedJsonContainers(input: unknown, depth: number): unknown {
+  if (depth >= 8) return input;
+  if (typeof input === 'string') {
+    const trimmed = input.trimStart();
+    if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) return input;
+    try {
+      return decodeNestedJsonContainers(JSON.parse(input), depth + 1);
+    } catch {
+      return input;
+    }
+  }
+  if (Array.isArray(input)) {
+    return input.map((value) => decodeNestedJsonContainers(value, depth + 1));
   }
+  if (!input || typeof input !== 'object') return input;
+  return Object.fromEntries(
+    Object.entries(input).map(([key, value]) => [
+      key,
+      decodeNestedJsonContainers(value, depth + 1),
+    ]),
+  );
 }
 
 function buildInvalidMakaTool(): MakaTool<{ tool?: string; error?: string }, never> {
@@ -4686,6 +5085,21 @@ function buildInvalidMakaTool(): MakaTool<{ tool?: string; error?: string }, nev
   };
 }
 
+function validateHostToolSnapshot(tools: readonly MakaTool[]): void {
+  const names = new Map<string, string>();
+  for (const tool of tools) {
+    const key = tool.name.toLowerCase();
+    if (key === MEMORY_REMEMBER_TOOL_NAME || key === MEMORY_EXTRACT_TOOL_NAME) {
+      throw new Error('Long-term Memory trigger tool names are reserved by Runtime');
+    }
+    const existing = names.get(key);
+    if (existing) {
+      throw new Error(`Tool names "${existing}" and "${tool.name}" conflict`);
+    }
+    names.set(key, tool.name);
+  }
+}
+
 function priorReplayFailureTrace(replay: {
   gate: string;
   diagnostics: readonly { code: string }[];
diff --git a/packages/runtime/src/extension-core-events.ts b/packages/runtime/src/extension-core-events.ts
new file mode 100644
index 0000000000..bccb6b3327
--- /dev/null
+++ b/packages/runtime/src/extension-core-events.ts
@@ -0,0 +1,51 @@
+import type { ExtensionDispatchMode } from './extension-dispatch.js';
+
+export const EXTENSION_CORE_EVENTS = Object.freeze({
+  'maka.agent.pre-step': 'transform',
+  'maka.user-prompt.submit': 'transform',
+  'maka.agent.request': 'transform',
+  'maka.tools.execute': 'around',
+  'maka.llm.stream': 'around',
+  'maka.agent.request-error': 'bail',
+  'maka.system-prompt.assemble': 'transform',
+  'maka.agent.turn-stopping': 'bail',
+  'maka.session.created': 'observe',
+  'maka.session.event': 'observe',
+  'maka.session.flush': 'observe',
+  'maka.session.disposed': 'observe',
+  'maka.agent.status': 'observe',
+  'maka.subagent.start': 'observe',
+  'maka.subagent.end': 'observe',
+} satisfies Readonly<Record<string, ExtensionDispatchMode>>);
+
+export type ExtensionCoreEventName = keyof typeof EXTENSION_CORE_EVENTS;
+
+export function isExtensionCoreEventName(value: string): value is ExtensionCoreEventName {
+  return Object.hasOwn(EXTENSION_CORE_EVENTS, value);
+}
+
+export function validateExtensionCoreEventPayload(
+  event: ExtensionCoreEventName,
+  payload: unknown,
+): unknown {
+  if (EXTENSION_CORE_EVENTS[event] === 'around') return payload;
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+    throw new Error(`Core Extension Event payload must be an object: ${event}`);
+  }
+  let encoded: string;
+  try {
+    encoded = JSON.stringify(payload);
+  } catch (error) {
+    throw new Error(`Core Extension Event payload must be JSON serializable: ${event}`, {
+      cause: error,
+    });
+  }
+  if (Buffer.byteLength(encoded, 'utf8') > 8 * 1024 * 1024) {
+    throw new Error(`Core Extension Event payload exceeds its size limit: ${event}`);
+  }
+  const record = payload as Record<string, unknown>;
+  if (event === 'maka.system-prompt.assemble' && typeof record.prompt !== 'string') {
+    throw new Error('system-prompt/assemble payload requires prompt');
+  }
+  return structuredClone(payload);
+}
diff --git a/packages/runtime/src/extension-dispatch.ts b/packages/runtime/src/extension-dispatch.ts
new file mode 100644
index 0000000000..c9ab2b0e94
--- /dev/null
+++ b/packages/runtime/src/extension-dispatch.ts
@@ -0,0 +1,213 @@
+export const EXTENSION_DISPATCH_MODES = [
+  'emit',
+  'parallel',
+  'serial',
+  'bail',
+  'transform',
+  'observe',
+  'gate',
+  'around',
+] as const;
+
+export type ExtensionDispatchMode = (typeof EXTENSION_DISPATCH_MODES)[number];
+
+export interface ExtensionDispatchHandler<TIdentity> {
+  readonly identity: TIdentity;
+  invoke(value: unknown, next?: (value?: unknown) => unknown | Promise<unknown>): Promise<unknown>;
+}
+
+export interface ExtensionDispatchSettlement<TIdentity> {
+  readonly identity: TIdentity;
+  readonly status: 'fulfilled' | 'rejected';
+  readonly value?: unknown;
+  readonly error?: unknown;
+}
+
+export interface ExtensionDispatchResult<TIdentity> {
+  readonly mode: ExtensionDispatchMode;
+  /** Final transform value, first bail result, serial/parallel results, or the original payload. */
+  readonly value: unknown;
+  readonly stopped: boolean;
+  readonly denied: boolean;
+  readonly reason?: string;
+  readonly settlements: readonly ExtensionDispatchSettlement<TIdentity>[];
+}
+
+/**
+ * Product-independent Extension dispatch kernel.
+ *
+ * Handler failures are contained in settlements. Abort is the only exceptional
+ * path because the caller no longer owns authority to continue dispatching.
+ */
+export async function dispatchExtensionHandlers<TIdentity>(input: {
+  readonly mode: ExtensionDispatchMode;
+  readonly payload: unknown;
+  readonly handlers: readonly ExtensionDispatchHandler<TIdentity>[];
+  readonly signal: AbortSignal;
+  readonly final?: (value: unknown) => unknown | Promise<unknown>;
+}): Promise<ExtensionDispatchResult<TIdentity>> {
+  if (!EXTENSION_DISPATCH_MODES.includes(input.mode)) {
+    throw new Error(`Unsupported Extension dispatch mode: ${String(input.mode)}`);
+  }
+  throwIfAborted(input.signal);
+  if (input.mode === 'around') return await dispatchAround(input);
+  if (input.mode === 'parallel') return await dispatchParallel(input);
+
+  const settlements: ExtensionDispatchSettlement<TIdentity>[] = [];
+  const serialValues: unknown[] = [];
+  // A bail lane has no answer until a handler supplies one. Using the input
+  // payload as its initial value makes an unhandled bail indistinguishable from
+  // a listener answer and can violate an unrelated result schema.
+  let current = input.mode === 'bail' ? undefined : clone(input.payload);
+  let stopped = false;
+  let denied = false;
+  let reason: string | undefined;
+
+  for (const handler of input.handlers) {
+    throwIfAborted(input.signal);
+    try {
+      const argument = input.mode === 'transform' ? clone(current) : clone(input.payload);
+      const value = await handler.invoke(argument);
+      settlements.push(Object.freeze({ identity: handler.identity, status: 'fulfilled', value }));
+      switch (input.mode) {
+        case 'serial':
+          serialValues.push(clone(value));
+          break;
+        case 'bail':
+          if (value !== undefined && value !== null) {
+            current = clone(value);
+            stopped = true;
+          }
+          break;
+        case 'transform':
+          if (value !== undefined && value !== null) current = clone(value);
+          break;
+        case 'gate': {
+          const decision = gateDecision(value);
+          if (decision?.decision === 'deny') {
+            denied = true;
+            reason = decision.reason;
+            current = clone(value);
+            stopped = true;
+          }
+          break;
+        }
+        case 'emit':
+        case 'observe':
+          break;
+      }
+    } catch (error) {
+      if (input.signal.aborted) throwIfAborted(input.signal);
+      settlements.push(Object.freeze({ identity: handler.identity, status: 'rejected', error }));
+    }
+    if (stopped) break;
+  }
+
+  const value =
+    input.mode === 'serial'
+      ? Object.freeze(serialValues)
+      : input.mode === 'emit' || input.mode === 'observe'
+        ? clone(input.payload)
+        : current;
+  return Object.freeze({
+    mode: input.mode,
+    value,
+    stopped,
+    denied,
+    ...(reason ? { reason } : {}),
+    settlements: Object.freeze(settlements),
+  });
+}
+
+async function dispatchAround<TIdentity>(input: {
+  readonly mode: 'around' | ExtensionDispatchMode;
+  readonly payload: unknown;
+  readonly handlers: readonly ExtensionDispatchHandler<TIdentity>[];
+  readonly signal: AbortSignal;
+  readonly final?: (value: unknown) => unknown | Promise<unknown>;
+}): Promise<ExtensionDispatchResult<TIdentity>> {
+  const settlements: ExtensionDispatchSettlement<TIdentity>[] = [];
+  let reachedFinal = false;
+  const invokeAt = async (index: number, value: unknown): Promise<unknown> => {
+    throwIfAborted(input.signal);
+    const handler = input.handlers[index];
+    if (!handler) {
+      reachedFinal = true;
+      return input.final ? await input.final(value) : value;
+    }
+    let nextCalled = false;
+    const next = async (nextValue: unknown = value): Promise<unknown> => {
+      if (nextCalled) throw new Error('Extension middleware next() may only be called once');
+      nextCalled = true;
+      return await invokeAt(index + 1, nextValue);
+    };
+    try {
+      const result = await handler.invoke(value, next);
+      settlements.push(
+        Object.freeze({ identity: handler.identity, status: 'fulfilled', value: result }),
+      );
+      return result;
+    } catch (error) {
+      settlements.push(Object.freeze({ identity: handler.identity, status: 'rejected', error }));
+      throw error;
+    }
+  };
+  const value = await invokeAt(0, input.payload);
+  return Object.freeze({
+    mode: 'around',
+    value,
+    stopped: !reachedFinal,
+    denied: false,
+    settlements: Object.freeze(settlements),
+  });
+}
+
+async function dispatchParallel<TIdentity>(input: {
+  readonly mode: 'parallel' | ExtensionDispatchMode;
+  readonly payload: unknown;
+  readonly handlers: readonly ExtensionDispatchHandler<TIdentity>[];
+  readonly signal: AbortSignal;
+}): Promise<ExtensionDispatchResult<TIdentity>> {
+  const settlements = await Promise.all(
+    input.handlers.map(async (handler): Promise<ExtensionDispatchSettlement<TIdentity>> => {
+      throwIfAborted(input.signal);
+      try {
+        const value = await handler.invoke(clone(input.payload));
+        return Object.freeze({ identity: handler.identity, status: 'fulfilled', value });
+      } catch (error) {
+        if (input.signal.aborted) throwIfAborted(input.signal);
+        return Object.freeze({ identity: handler.identity, status: 'rejected', error });
+      }
+    }),
+  );
+  throwIfAborted(input.signal);
+  return Object.freeze({
+    mode: 'parallel',
+    value: Object.freeze(
+      settlements.filter((item) => item.status === 'fulfilled').map((item) => clone(item.value)),
+    ),
+    stopped: false,
+    denied: false,
+    settlements: Object.freeze(settlements),
+  });
+}
+
+function gateDecision(value: unknown): { decision: 'allow' | 'deny'; reason?: string } | undefined {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const record = value as Record<string, unknown>;
+  if (record.decision !== 'allow' && record.decision !== 'deny') return undefined;
+  return {
+    decision: record.decision,
+    ...(typeof record.reason === 'string' && record.reason.length > 0
+      ? { reason: record.reason.slice(0, 4_000) }
+      : {}),
+  };
+}
+
+function throwIfAborted(signal: AbortSignal): void {
+  if (signal.aborted) throw signal.reason ?? new DOMException('Aborted', 'AbortError');
+}
+
+function clone<T>(value: T): T {
+  return value === undefined ? value : structuredClone(value);
+}
diff --git a/packages/runtime/src/extension-event-contributions.ts b/packages/runtime/src/extension-event-contributions.ts
new file mode 100644
index 0000000000..fe454fd58d
--- /dev/null
+++ b/packages/runtime/src/extension-event-contributions.ts
@@ -0,0 +1,465 @@
+import { z } from 'zod';
+import type { MakaContributionContext } from './plugin-runtime.js';
+import type { ExtensionDispatchMode } from './extension-dispatch.js';
+
+export type ExtensionEventDispatchMode = ExtensionDispatchMode;
+
+export interface ExtensionEventInvocationContext {
+  readonly sessionId: string;
+  readonly runId?: string;
+  readonly turnId: string;
+  readonly cwd: string;
+  readonly permissionMode: string;
+  readonly origin: 'provider' | 'code_mode' | 'host';
+  readonly configuration: Readonly<Record<string, string | number | boolean>>;
+  readonly signal: AbortSignal;
+  /** Host-owned recursion guard; Extension workers do not control this value. */
+  readonly eventDepth?: number;
+}
+
+export interface ExtensionEventDefinition {
+  readonly name: string;
+  readonly description: string;
+  /** Legacy definitions default to notification-style emit. */
+  readonly mode?: ExtensionEventDispatchMode;
+  readonly payloadSchema: Readonly<Record<string, unknown>>;
+  readonly resultSchema?: Readonly<Record<string, unknown>>;
+}
+
+export interface ExtensionEventListenerContribution {
+  readonly id: string;
+  readonly event: string;
+  readonly handler: string;
+  readonly priority: number;
+  readonly timeoutMs: number;
+  invoke(
+    payload: unknown,
+    context: ExtensionEventInvocationContext,
+    next?: (value?: unknown) => unknown | Promise<unknown>,
+  ): Promise<unknown>;
+}
+
+export interface ExtensionEventDefinitionInspection extends Omit<ExtensionEventDefinition, 'mode'> {
+  readonly mode: ExtensionEventDispatchMode;
+  readonly entryId: string;
+  readonly scopeId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+}
+
+export interface ExtensionEventListenerInspection extends ExtensionEventListenerContribution {
+  readonly entryId: string;
+  readonly scopeId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+}
+
+interface RegisteredEvent extends ExtensionEventDefinitionInspection {
+  readonly token: symbol;
+  readonly schema: z.ZodType;
+  readonly resultValidator?: z.ZodType;
+}
+
+interface RegisteredListener extends ExtensionEventListenerInspection {
+  readonly token: symbol;
+}
+
+export class ExtensionEventContributionError extends Error {
+  readonly name = 'ExtensionEventContributionError';
+
+  constructor(
+    readonly code: 'invalid_event' | 'event_conflict' | 'event_not_found' | 'invalid_payload',
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+/** Lifecycle-owned registry for plugin-defined Event contracts and Listeners. */
+export class ExtensionEventContributionRegistry {
+  readonly #events = new Map<string, RegisteredEvent[]>();
+  readonly #listeners = new Map<string, RegisteredListener[]>();
+
+  registerEvent(
+    context: MakaContributionContext,
+    definition: ExtensionEventDefinition,
+  ): () => void {
+    validateExtensionEventDefinition(context.extensionId, definition);
+    let schema: z.ZodType;
+    let resultValidator: z.ZodType | undefined;
+    try {
+      schema = z.fromJSONSchema(definition.payloadSchema);
+      if (definition.resultSchema) resultValidator = z.fromJSONSchema(definition.resultSchema);
+    } catch (error) {
+      throw new ExtensionEventContributionError(
+        'invalid_event',
+        `Event payload schema is unsupported: ${definition.name}`,
+        { cause: error },
+      );
+    }
+    const current = this.#events.get(context.scopeId) ?? [];
+    const conflict = current.find(
+      (entry) =>
+        entry.name === definition.name &&
+        (entry.entryId !== context.entryId || entry.extensionId !== context.extensionId),
+    );
+    if (conflict) {
+      throw new ExtensionEventContributionError(
+        'event_conflict',
+        `Event "${definition.name}" is already provided by entry ${conflict.entryId}`,
+      );
+    }
+    const entry: RegisteredEvent = Object.freeze({
+      entryId: context.entryId,
+      scopeId: context.scopeId,
+      extensionId: context.extensionId,
+      generation: context.generation,
+      name: definition.name,
+      description: definition.description,
+      mode: definition.mode ?? 'emit',
+      payloadSchema: structuredClone(definition.payloadSchema),
+      ...(definition.resultSchema
+        ? { resultSchema: structuredClone(definition.resultSchema) }
+        : {}),
+      schema,
+      ...(resultValidator ? { resultValidator } : {}),
+      token: Symbol(definition.name),
+    });
+    this.#events.set(context.scopeId, [...current, entry]);
+    return () => removeRegistered(this.#events, context.scopeId, entry.token);
+  }
+
+  registerListener(
+    context: MakaContributionContext,
+    listener: ExtensionEventListenerContribution,
+  ): () => void {
+    validateExtensionEventListener(listener);
+    const current = this.#listeners.get(context.scopeId) ?? [];
+    const conflict = current.find(
+      (entry) =>
+        entry.event === listener.event &&
+        entry.id === listener.id &&
+        (entry.entryId !== context.entryId || entry.extensionId !== context.extensionId),
+    );
+    if (conflict) {
+      throw new ExtensionEventContributionError(
+        'event_conflict',
+        `Listener "${listener.id}" for ${listener.event} is already owned by entry ${conflict.entryId}`,
+      );
+    }
+    const entry: RegisteredListener = Object.freeze({
+      entryId: context.entryId,
+      scopeId: context.scopeId,
+      extensionId: context.extensionId,
+      generation: context.generation,
+      ...listener,
+      token: Symbol(listener.id),
+    });
+    this.#listeners.set(context.scopeId, [...current, entry]);
+    return () => removeRegistered(this.#listeners, context.scopeId, entry.token);
+  }
+
+  inspectEvents(
+    scopeIds: readonly string[],
+    committed?: readonly { readonly entryId: string; readonly generation: number }[],
+  ): readonly ExtensionEventDefinitionInspection[] {
+    const generations = committedGenerations(committed);
+    const resolved = new Map<string, RegisteredEvent>();
+    for (const scopeId of scopeIds) {
+      for (const entry of this.#events.get(scopeId) ?? []) {
+        if (generations && generations.get(entry.entryId) !== entry.generation) continue;
+        resolved.set(entry.name, entry);
+      }
+    }
+    return Object.freeze(
+      [...resolved.values()]
+        .map(({ token: _token, schema: _schema, resultValidator: _result, ...entry }) =>
+          Object.freeze(entry),
+        )
+        .sort((left, right) => left.name.localeCompare(right.name)),
+    );
+  }
+
+  inspectListeners(
+    scopeIds: readonly string[],
+    committed?: readonly { readonly entryId: string; readonly generation: number }[],
+  ): readonly ExtensionEventListenerInspection[] {
+    const generations = committedGenerations(committed);
+    const resolved = new Map<string, RegisteredListener>();
+    for (const scopeId of scopeIds) {
+      for (const entry of this.#listeners.get(scopeId) ?? []) {
+        if (generations && generations.get(entry.entryId) !== entry.generation) continue;
+        resolved.set(`${entry.event}\0${entry.extensionId}\0${entry.id}`, entry);
+      }
+    }
+    return Object.freeze(
+      [...resolved.values()]
+        .map(({ token: _token, ...entry }) => Object.freeze(entry))
+        .sort(compareListener),
+    );
+  }
+
+  parsePayload(
+    scopeIds: readonly string[],
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+    event: string,
+    payload: unknown,
+  ): unknown {
+    let encoded: string;
+    try {
+      encoded = JSON.stringify(payload);
+    } catch (error) {
+      throw new ExtensionEventContributionError(
+        'invalid_payload',
+        `Event payload is not JSON: ${event}`,
+        { cause: error },
+      );
+    }
+    if (encoded === undefined || Buffer.byteLength(encoded, 'utf8') > 256 * 1024) {
+      throw new ExtensionEventContributionError(
+        'invalid_payload',
+        `Event payload exceeds its size limit: ${event}`,
+      );
+    }
+    const generations = committedGenerations(committed)!;
+    let definition: RegisteredEvent | undefined;
+    for (const scopeId of scopeIds) {
+      const candidate = (this.#events.get(scopeId) ?? []).find(
+        (entry) => entry.name === event && generations.get(entry.entryId) === entry.generation,
+      );
+      if (candidate) definition = candidate;
+    }
+    if (!definition) {
+      throw new ExtensionEventContributionError(
+        'event_not_found',
+        `Active Extension event is not defined: ${event}`,
+      );
+    }
+    const parsed = definition.schema.safeParse(payload);
+    if (!parsed.success) {
+      throw new ExtensionEventContributionError(
+        'invalid_payload',
+        `Event payload does not match ${event}: ${z.prettifyError(parsed.error)}`,
+      );
+    }
+    return structuredClone(parsed.data);
+  }
+
+  resolveDefinition(
+    scopeIds: readonly string[],
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+    event: string,
+  ): ExtensionEventDefinitionInspection {
+    const definition = this.#definition(scopeIds, committed, event);
+    const { token: _token, schema: _schema, resultValidator: _result, ...inspection } = definition;
+    return Object.freeze(inspection);
+  }
+
+  parseResult(
+    scopeIds: readonly string[],
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+    event: string,
+    value: unknown,
+  ): unknown {
+    const definition = this.#definition(scopeIds, committed, event);
+    // No bail listener answered. The result schema describes actual answers,
+    // not the absence of one.
+    if (definition.mode === 'bail' && value === undefined) return undefined;
+    const validator =
+      definition.mode === 'transform' ? definition.schema : definition.resultValidator;
+    if (!validator) return structuredClone(value);
+    if ((definition.mode === 'parallel' || definition.mode === 'serial') && Array.isArray(value)) {
+      return Object.freeze(
+        value.map((item) => {
+          const parsed = validator.safeParse(item);
+          if (!parsed.success) {
+            throw new ExtensionEventContributionError(
+              'invalid_payload',
+              `Event result does not match ${event}: ${z.prettifyError(parsed.error)}`,
+            );
+          }
+          return structuredClone(parsed.data);
+        }),
+      );
+    }
+    const parsed = validator.safeParse(value);
+    if (!parsed.success) {
+      throw new ExtensionEventContributionError(
+        'invalid_payload',
+        `Event result does not match ${event}: ${z.prettifyError(parsed.error)}`,
+      );
+    }
+    return structuredClone(parsed.data);
+  }
+
+  #definition(
+    scopeIds: readonly string[],
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+    event: string,
+  ): RegisteredEvent {
+    const generations = committedGenerations(committed)!;
+    let definition: RegisteredEvent | undefined;
+    for (const scopeId of scopeIds) {
+      const candidate = (this.#events.get(scopeId) ?? []).find(
+        (entry) => entry.name === event && generations.get(entry.entryId) === entry.generation,
+      );
+      if (candidate) definition = candidate;
+    }
+    if (!definition) {
+      throw new ExtensionEventContributionError(
+        'event_not_found',
+        `Active Extension event is not defined: ${event}`,
+      );
+    }
+    return definition;
+  }
+}
+
+export function contributeExtensionEvent(
+  context: MakaContributionContext,
+  registry: ExtensionEventContributionRegistry,
+  definition: ExtensionEventDefinition,
+): void {
+  ownRegistration(context, `event:${definition.name}`, registry.registerEvent(context, definition));
+}
+
+export function contributeExtensionEventListener(
+  context: MakaContributionContext,
+  registry: ExtensionEventContributionRegistry,
+  listener: ExtensionEventListenerContribution,
+): void {
+  ownRegistration(
+    context,
+    `listener:${listener.event}:${listener.id}`,
+    registry.registerListener(context, listener),
+  );
+}
+
+export function validateExtensionEventDefinition(
+  extensionId: string,
+  definition: ExtensionEventDefinition,
+): void {
+  if (!definition || typeof definition !== 'object') invalid('Event definition is required');
+  if (!canonicalName(definition.name)) invalid('Event name is invalid');
+  if (!definition.name.startsWith(`${extensionId}.`)) {
+    invalid(`Event name must be owned by the Extension namespace: ${extensionId}.`);
+  }
+  if (
+    typeof definition.description !== 'string' ||
+    Buffer.byteLength(definition.description, 'utf8') > 4096
+  ) {
+    invalid('Event description is invalid');
+  }
+  if (!definition.payloadSchema || typeof definition.payloadSchema !== 'object') {
+    invalid('Event payload schema is required');
+  }
+  let encoded: string;
+  try {
+    encoded = JSON.stringify(definition.payloadSchema);
+  } catch (error) {
+    throw new ExtensionEventContributionError('invalid_event', 'Event payload schema is invalid', {
+      cause: error,
+    });
+  }
+  if (Buffer.byteLength(encoded, 'utf8') > 64 * 1024) invalid('Event payload schema is too large');
+  const mode = definition.mode ?? 'emit';
+  if (!['emit', 'parallel', 'serial', 'bail', 'transform', 'observe', 'gate'].includes(mode)) {
+    invalid('Event dispatch mode is invalid');
+  }
+  if ((mode === 'parallel' || mode === 'serial' || mode === 'bail') && !definition.resultSchema) {
+    invalid(`${mode} Event requires a result schema`);
+  }
+  if (definition.resultSchema) {
+    let resultEncoded: string;
+    try {
+      resultEncoded = JSON.stringify(definition.resultSchema);
+    } catch (error) {
+      throw new ExtensionEventContributionError('invalid_event', 'Event result schema is invalid', {
+        cause: error,
+      });
+    }
+    if (Buffer.byteLength(resultEncoded, 'utf8') > 64 * 1024)
+      invalid('Event result schema is too large');
+  }
+}
+
+export function validateExtensionEventListener(listener: ExtensionEventListenerContribution): void {
+  if (!listener || typeof listener !== 'object') invalid('Event Listener is required');
+  if (!canonicalId(listener.id)) invalid('Event Listener id is invalid');
+  if (!canonicalName(listener.event)) invalid('Event Listener event is invalid');
+  if (!canonicalId(listener.handler)) invalid('Event Listener handler is invalid');
+  if (!Number.isSafeInteger(listener.priority) || Math.abs(listener.priority) > 10_000) {
+    invalid('Event Listener priority is invalid');
+  }
+  if (
+    !Number.isSafeInteger(listener.timeoutMs) ||
+    listener.timeoutMs < 10 ||
+    listener.timeoutMs > 120_000
+  ) {
+    invalid('Event Listener timeout is invalid');
+  }
+  if (typeof listener.invoke !== 'function') invalid('Event Listener invoke function is required');
+}
+
+function ownRegistration(
+  context: MakaContributionContext,
+  id: string,
+  unregister: () => void,
+): void {
+  try {
+    context.ownEffect(id, unregister);
+  } catch (error) {
+    unregister();
+    throw error;
+  }
+}
+
+function removeRegistered<T extends { readonly token: symbol }>(
+  registry: Map<string, T[]>,
+  scopeId: string,
+  token: symbol,
+): void {
+  const active = registry.get(scopeId);
+  if (!active) return;
+  const next = active.filter((entry) => entry.token !== token);
+  if (next.length > 0) registry.set(scopeId, next);
+  else registry.delete(scopeId);
+}
+
+function committedGenerations(
+  committed?: readonly { readonly entryId: string; readonly generation: number }[],
+): Map<string, number> | undefined {
+  return committed
+    ? new Map(committed.map(({ entryId, generation }) => [entryId, generation]))
+    : undefined;
+}
+
+function compareListener(
+  left: ExtensionEventListenerInspection,
+  right: ExtensionEventListenerInspection,
+): number {
+  return (
+    left.event.localeCompare(right.event) ||
+    right.priority - left.priority ||
+    left.extensionId.localeCompare(right.extensionId) ||
+    left.generation - right.generation ||
+    left.id.localeCompare(right.id)
+  );
+}
+
+function canonicalId(value: unknown): value is string {
+  return typeof value === 'string' && /^[A-Za-z][A-Za-z0-9._-]{0,127}$/u.test(value);
+}
+
+function canonicalName(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length <= 192 &&
+    /^[A-Za-z][A-Za-z0-9_-]*(?:\.[A-Za-z][A-Za-z0-9_-]*)+$/u.test(value)
+  );
+}
+
+function invalid(message: string): never {
+  throw new ExtensionEventContributionError('invalid_event', message);
+}
diff --git a/packages/runtime/src/extension-service-contributions.ts b/packages/runtime/src/extension-service-contributions.ts
new file mode 100644
index 0000000000..3c99d66fc9
--- /dev/null
+++ b/packages/runtime/src/extension-service-contributions.ts
@@ -0,0 +1,292 @@
+import { z } from 'zod';
+import type { MakaContributionContext } from './plugin-runtime.js';
+
+export interface ExtensionServiceInvocationContext {
+  readonly sessionId: string;
+  readonly runId?: string;
+  readonly turnId: string;
+  readonly cwd: string;
+  readonly permissionMode: string;
+  readonly origin: 'provider' | 'code_mode' | 'host';
+  readonly configuration: Readonly<Record<string, string | number | boolean>>;
+  readonly signal: AbortSignal;
+  readonly callerExtensionId?: string;
+  readonly serviceDepth?: number;
+}
+
+export interface ExtensionServiceMethodDefinition {
+  readonly name: string;
+  readonly description: string;
+  readonly handler: string;
+  readonly inputSchema: Readonly<Record<string, unknown>>;
+  readonly outputSchema: Readonly<Record<string, unknown>>;
+  readonly timeoutMs: number;
+}
+
+export interface ExtensionServiceContribution {
+  readonly name: string;
+  readonly version: string;
+  readonly description: string;
+  readonly methods: readonly ExtensionServiceMethodDefinition[];
+  invoke(
+    method: string,
+    input: unknown,
+    context: ExtensionServiceInvocationContext,
+  ): Promise<unknown>;
+}
+
+export interface ExtensionServiceContributionInspection extends ExtensionServiceContribution {
+  readonly entryId: string;
+  readonly scopeId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+}
+
+interface RegisteredService extends ExtensionServiceContributionInspection {
+  readonly token: symbol;
+  readonly validators: ReadonlyMap<string, { input: z.ZodType; output: z.ZodType }>;
+}
+
+export class ExtensionServiceContributionError extends Error {
+  readonly name = 'ExtensionServiceContributionError';
+  constructor(
+    readonly code:
+      | 'invalid_service'
+      | 'service_conflict'
+      | 'service_not_found'
+      | 'method_not_found'
+      | 'invalid_input'
+      | 'invalid_output',
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+/** Scope-aware, lifecycle-owned typed Service registry. */
+export class ExtensionServiceContributionRegistry {
+  readonly #scopes = new Map<string, RegisteredService[]>();
+
+  register(
+    context: MakaContributionContext,
+    contribution: ExtensionServiceContribution,
+  ): () => void {
+    validateExtensionServiceContribution(context.extensionId, contribution);
+    const current = this.#scopes.get(context.scopeId) ?? [];
+    const conflict = current.find(
+      (entry) => entry.name === contribution.name && entry.entryId !== context.entryId,
+    );
+    if (conflict) {
+      throw new ExtensionServiceContributionError(
+        'service_conflict',
+        `Service "${contribution.name}" is already provided by entry ${conflict.entryId}`,
+      );
+    }
+    const validators = new Map<string, { input: z.ZodType; output: z.ZodType }>();
+    try {
+      for (const method of contribution.methods) {
+        validators.set(method.name, {
+          input: z.fromJSONSchema(method.inputSchema),
+          output: z.fromJSONSchema(method.outputSchema),
+        });
+      }
+    } catch (error) {
+      throw new ExtensionServiceContributionError(
+        'invalid_service',
+        `Service JSON Schema is unsupported: ${contribution.name}`,
+        { cause: error },
+      );
+    }
+    const entry: RegisteredService = Object.freeze({
+      entryId: context.entryId,
+      scopeId: context.scopeId,
+      extensionId: context.extensionId,
+      generation: context.generation,
+      ...contribution,
+      methods: Object.freeze(contribution.methods.map((method) => Object.freeze({ ...method }))),
+      validators,
+      token: Symbol(contribution.name),
+    });
+    this.#scopes.set(context.scopeId, [...current, entry]);
+    return () => removeRegistered(this.#scopes, context.scopeId, entry.token);
+  }
+
+  inspect(
+    scopeIds: readonly string[],
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+  ): readonly ExtensionServiceContributionInspection[] {
+    const generations = new Map(committed.map(({ entryId, generation }) => [entryId, generation]));
+    const resolved = new Map<string, RegisteredService>();
+    for (const scopeId of scopeIds) {
+      for (const entry of this.#scopes.get(scopeId) ?? []) {
+        if (generations.get(entry.entryId) !== entry.generation) continue;
+        resolved.set(entry.name, entry);
+      }
+    }
+    return Object.freeze(
+      [...resolved.values()]
+        .map(({ token: _token, validators: _validators, ...entry }) => Object.freeze(entry))
+        .sort((left, right) => left.name.localeCompare(right.name)),
+    );
+  }
+
+  async call(
+    scopeIds: readonly string[],
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+    service: string,
+    method: string,
+    input: unknown,
+    context: ExtensionServiceInvocationContext,
+  ): Promise<unknown> {
+    const entry = this.#resolve(scopeIds, committed, service);
+    const definition = entry.methods.find((candidate) => candidate.name === method);
+    if (!definition) {
+      throw new ExtensionServiceContributionError(
+        'method_not_found',
+        `Service method is not defined: ${service}.${method}`,
+      );
+    }
+    const validators = entry.validators.get(method)!;
+    const parsedInput = validators.input.safeParse(input);
+    if (!parsedInput.success) {
+      throw new ExtensionServiceContributionError(
+        'invalid_input',
+        `Service input does not match ${service}.${method}: ${z.prettifyError(parsedInput.error)}`,
+      );
+    }
+    const result = await entry.invoke(method, structuredClone(parsedInput.data), context);
+    const parsedOutput = validators.output.safeParse(result);
+    if (!parsedOutput.success) {
+      throw new ExtensionServiceContributionError(
+        'invalid_output',
+        `Service output does not match ${service}.${method}: ${z.prettifyError(parsedOutput.error)}`,
+      );
+    }
+    return structuredClone(parsedOutput.data);
+  }
+
+  #resolve(
+    scopeIds: readonly string[],
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+    service: string,
+  ): RegisteredService {
+    const generations = new Map(committed.map(({ entryId, generation }) => [entryId, generation]));
+    let resolved: RegisteredService | undefined;
+    for (const scopeId of scopeIds) {
+      const candidate = (this.#scopes.get(scopeId) ?? []).find(
+        (entry) => entry.name === service && generations.get(entry.entryId) === entry.generation,
+      );
+      if (candidate) resolved = candidate;
+    }
+    if (!resolved) {
+      throw new ExtensionServiceContributionError(
+        'service_not_found',
+        `Active Extension Service is not defined: ${service}`,
+      );
+    }
+    return resolved;
+  }
+}
+
+export function contributeExtensionService(
+  context: MakaContributionContext,
+  registry: ExtensionServiceContributionRegistry,
+  contribution: ExtensionServiceContribution,
+): void {
+  context.runtimeContext.provide(`service:${contribution.name}`, contribution);
+  const unregister = registry.register(context, contribution);
+  try {
+    context.ownEffect(`service:${contribution.name}`, unregister);
+  } catch (error) {
+    unregister();
+    throw error;
+  }
+}
+
+export function validateExtensionServiceContribution(
+  extensionId: string,
+  contribution: ExtensionServiceContribution,
+): void {
+  if (!contribution || typeof contribution !== 'object')
+    invalid('Service contribution is required');
+  if (!canonicalName(contribution.name) || !contribution.name.startsWith(`${extensionId}.`)) {
+    invalid(`Service name must be owned by the Extension namespace: ${extensionId}.`);
+  }
+  if (
+    typeof contribution.version !== 'string' ||
+    contribution.version.length === 0 ||
+    contribution.version.length > 128
+  )
+    invalid('Service version is invalid');
+  if (
+    typeof contribution.description !== 'string' ||
+    Buffer.byteLength(contribution.description, 'utf8') > 4096
+  )
+    invalid('Service description is invalid');
+  if (
+    !Array.isArray(contribution.methods) ||
+    contribution.methods.length === 0 ||
+    contribution.methods.length > 64
+  )
+    invalid('Service methods are invalid');
+  const methods = new Set<string>();
+  for (const method of contribution.methods) {
+    if (!canonicalId(method.name) || !canonicalId(method.handler))
+      invalid('Service method identity is invalid');
+    if (methods.has(method.name)) invalid(`Service method repeats: ${method.name}`);
+    methods.add(method.name);
+    if (
+      typeof method.description !== 'string' ||
+      Buffer.byteLength(method.description, 'utf8') > 4096
+    )
+      invalid('Service method description is invalid');
+    if (!jsonSchema(method.inputSchema) || !jsonSchema(method.outputSchema))
+      invalid('Service method schemas are invalid');
+    if (
+      !Number.isSafeInteger(method.timeoutMs) ||
+      method.timeoutMs < 10 ||
+      method.timeoutMs > 120_000
+    )
+      invalid('Service method timeout is invalid');
+  }
+  if (typeof contribution.invoke !== 'function') invalid('Service invoke function is required');
+}
+
+function jsonSchema(value: unknown): boolean {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  try {
+    const encoded = JSON.stringify(value);
+    return Buffer.byteLength(encoded, 'utf8') <= 64 * 1024;
+  } catch {
+    return false;
+  }
+}
+
+function canonicalId(value: unknown): value is string {
+  return typeof value === 'string' && /^[A-Za-z][A-Za-z0-9._-]{0,127}$/u.test(value);
+}
+
+function canonicalName(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length <= 192 &&
+    /^[A-Za-z][A-Za-z0-9_-]*(?:\.[A-Za-z][A-Za-z0-9_-]*)+$/u.test(value)
+  );
+}
+
+function removeRegistered<T extends { readonly token: symbol }>(
+  registry: Map<string, T[]>,
+  scopeId: string,
+  token: symbol,
+): void {
+  const current = registry.get(scopeId);
+  if (!current) return;
+  const next = current.filter((entry) => entry.token !== token);
+  if (next.length > 0) registry.set(scopeId, next);
+  else registry.delete(scopeId);
+}
+
+function invalid(message: string): never {
+  throw new ExtensionServiceContributionError('invalid_service', message);
+}
diff --git a/packages/runtime/src/extension-timer-contributions.ts b/packages/runtime/src/extension-timer-contributions.ts
new file mode 100644
index 0000000000..a68ee17c8f
--- /dev/null
+++ b/packages/runtime/src/extension-timer-contributions.ts
@@ -0,0 +1,100 @@
+import type { MakaContributionContext } from './plugin-runtime.js';
+
+export interface ExtensionTimerInvocationContext {
+  readonly sessionId: string;
+  readonly turnId: string;
+  readonly cwd: string;
+  readonly permissionMode: string;
+  readonly origin: 'host';
+  readonly configuration: Readonly<Record<string, string | number | boolean>>;
+  readonly signal: AbortSignal;
+  readonly scheduledAt: number;
+}
+
+export interface ExtensionTimerContribution {
+  readonly id: string;
+  readonly intervalMs: number;
+  readonly initialDelayMs: number;
+  readonly timeoutMs: number;
+  readonly handler: string;
+  readonly configuration: Readonly<Record<string, string | number | boolean>>;
+  readonly payload?: unknown;
+  invoke(payload: unknown, context: ExtensionTimerInvocationContext): Promise<unknown>;
+}
+
+export interface ExtensionTimerContributionInspection {
+  readonly entryId: string;
+  readonly scopeId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+  readonly id: string;
+  readonly intervalMs: number;
+  readonly nextRunAt: number;
+  readonly running: boolean;
+  readonly lastStartedAt?: number;
+  readonly lastSucceededAt?: number;
+  readonly lastError?: string;
+}
+
+export interface ExtensionTimerAuthority {
+  register(
+    context: MakaContributionContext,
+    contribution: ExtensionTimerContribution,
+  ): Promise<() => void | Promise<void>>;
+}
+
+export async function contributeExtensionTimer(
+  context: MakaContributionContext,
+  authority: ExtensionTimerAuthority,
+  contribution: ExtensionTimerContribution,
+): Promise<void> {
+  validateExtensionTimerContribution(contribution);
+  const unregister = await authority.register(context, contribution);
+  try {
+    context.ownEffect(`timer:${contribution.id}`, unregister);
+  } catch (error) {
+    await unregister();
+    throw error;
+  }
+}
+
+export function validateExtensionTimerContribution(contribution: ExtensionTimerContribution): void {
+  if (!contribution || typeof contribution !== 'object') invalid('Timer contribution is required');
+  if (!canonicalId(contribution.id) || !canonicalId(contribution.handler))
+    invalid('Timer identity is invalid');
+  if (
+    !Number.isSafeInteger(contribution.intervalMs) ||
+    contribution.intervalMs < 1_000 ||
+    contribution.intervalMs > 30 * 24 * 60 * 60 * 1_000
+  )
+    invalid('Timer intervalMs must be between 1 second and 30 days');
+  if (
+    !Number.isSafeInteger(contribution.initialDelayMs) ||
+    contribution.initialDelayMs < 0 ||
+    contribution.initialDelayMs > 30 * 24 * 60 * 60 * 1_000
+  )
+    invalid('Timer initialDelayMs is invalid');
+  if (
+    !Number.isSafeInteger(contribution.timeoutMs) ||
+    contribution.timeoutMs < 10 ||
+    contribution.timeoutMs > 120_000
+  )
+    invalid('Timer timeoutMs is invalid');
+  if (contribution.payload !== undefined) {
+    try {
+      if (Buffer.byteLength(JSON.stringify(contribution.payload), 'utf8') > 64 * 1024)
+        invalid('Timer payload is too large');
+    } catch {
+      invalid('Timer payload must be JSON serializable');
+    }
+  }
+  if (typeof contribution.invoke !== 'function') invalid('Timer invoke function is required');
+}
+
+function canonicalId(value: unknown): value is string {
+  return typeof value === 'string' && /^[A-Za-z][A-Za-z0-9._-]{0,127}$/u.test(value);
+}
+
+function invalid(message: string): never {
+  throw new Error(message);
+}
diff --git a/packages/runtime/src/extension-tool-contributions.ts b/packages/runtime/src/extension-tool-contributions.ts
new file mode 100644
index 0000000000..9c3a429ddf
--- /dev/null
+++ b/packages/runtime/src/extension-tool-contributions.ts
@@ -0,0 +1,291 @@
+import type { MakaContributionContext } from './plugin-runtime.js';
+import type { MakaTool } from './tool-runtime.js';
+
+const RESERVED_TOOL_NAMES = new Set([
+  'exec',
+  'invalid',
+  'load_tools',
+  'memory_extract',
+  'memory_remember',
+]);
+
+export type ExtensionToolContributionErrorCode =
+  | 'invalid_tool'
+  | 'reserved_tool_name'
+  | 'tool_name_conflict';
+
+export class ExtensionToolContributionError extends Error {
+  readonly name = 'ExtensionToolContributionError';
+
+  constructor(
+    readonly code: ExtensionToolContributionErrorCode,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+export interface ExtensionToolContributionInspection {
+  readonly scopeId: string;
+  readonly entryId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+  readonly toolName: string;
+}
+
+interface RegisteredExtensionTool extends ExtensionToolContributionInspection {
+  readonly key: string;
+  readonly tool: MakaTool;
+  readonly token: symbol;
+  retired: boolean;
+  failures: number;
+  circuitOpen: boolean;
+}
+
+export interface ExtensionToolContributionRegistryOptions {
+  /** Core Tool names protected from Extension shadowing at activation time. */
+  readonly protectedToolNames?: (scopeId: string) => readonly string[];
+  readonly invocationTimeoutMs?: number;
+  readonly failureThreshold?: number;
+}
+
+/**
+ * Typed contribution surface for trusted Extension Tools.
+ *
+ * The registry owns only extension entries. `compose` merges those entries with
+ * the protected Core Tool catalog and rejects every ambiguous name instead of
+ * relying on a later map conversion to choose a winner.
+ */
+export class ExtensionToolContributionRegistry {
+  readonly #byScope = new Map<string, Map<string, RegisteredExtensionTool>>();
+
+  constructor(private readonly options: ExtensionToolContributionRegistryOptions = {}) {}
+
+  register(
+    context: Pick<MakaContributionContext, 'entryId' | 'scopeId' | 'extensionId' | 'generation'>,
+    tool: MakaTool,
+  ): () => void {
+    validateContext(context);
+    validateTool(tool);
+    const key = toolNameKey(tool.name);
+    if (RESERVED_TOOL_NAMES.has(key)) {
+      throw new ExtensionToolContributionError(
+        'reserved_tool_name',
+        `Tool name "${tool.name}" is reserved by Runtime`,
+      );
+    }
+    const protectedName = this.options
+      .protectedToolNames?.(context.scopeId)
+      .find((name) => toolNameKey(name) === key);
+    if (protectedName) {
+      throw new ExtensionToolContributionError(
+        'tool_name_conflict',
+        `Extension Tool "${tool.name}" conflicts with protected Core Tool "${protectedName}"`,
+      );
+    }
+    let scope = this.#byScope.get(context.scopeId);
+    if (!scope) {
+      scope = new Map();
+      this.#byScope.set(context.scopeId, scope);
+    }
+    const existing = scope.get(key);
+    if (
+      existing &&
+      (existing.entryId !== context.entryId || existing.extensionId !== context.extensionId)
+    ) {
+      throw new ExtensionToolContributionError(
+        'tool_name_conflict',
+        `Tool name "${tool.name}" is already contributed by entry ${existing.entryId}`,
+      );
+    }
+    const token = Symbol(tool.name);
+    let entry!: RegisteredExtensionTool;
+    const guardedTool: MakaTool =
+      this.options.invocationTimeoutMs === undefined && this.options.failureThreshold === undefined
+        ? tool
+        : {
+            ...tool,
+            impl: async (args: any, context: Parameters<typeof tool.impl>[1]) => {
+              if (entry.retired)
+                throw new Error(`Extension Tool "${tool.name}" is no longer active`);
+              if (entry.circuitOpen)
+                throw new Error(
+                  `Extension Tool "${tool.name}" circuit is open after repeated failures`,
+                );
+              const timeoutMs = this.options.invocationTimeoutMs ?? 30_000;
+              let timer: ReturnType<typeof setTimeout> | undefined;
+              try {
+                const result = await Promise.race([
+                  Promise.resolve(tool.impl(args, context)),
+                  new Promise<never>((_, reject) => {
+                    timer = setTimeout(
+                      () => reject(new Error(`Extension Tool "${tool.name}" timed out`)),
+                      timeoutMs,
+                    );
+                  }),
+                ]);
+                entry.failures = 0;
+                return result;
+              } catch (error) {
+                entry.failures += 1;
+                if (entry.failures >= (this.options.failureThreshold ?? 3))
+                  entry.circuitOpen = true;
+                throw error;
+              } finally {
+                if (timer) clearTimeout(timer);
+              }
+            },
+          };
+    entry = {
+      key,
+      scopeId: context.scopeId,
+      entryId: context.entryId,
+      extensionId: context.extensionId,
+      generation: context.generation,
+      toolName: tool.name,
+      tool: guardedTool,
+      token,
+      retired: false,
+      failures: 0,
+      circuitOpen: false,
+    };
+    scope.set(key, entry);
+
+    // Idempotent and generation-safe: a stale disposer cannot delete a newer
+    // registration that reused the same name after this entry was removed.
+    return () => {
+      const currentScope = this.#byScope.get(context.scopeId);
+      if (currentScope?.get(key)?.token !== token) {
+        entry.retired = true;
+        return;
+      }
+      if (existing && !existing.retired) currentScope.set(key, existing);
+      else currentScope.delete(key);
+      entry.retired = true;
+      if (currentScope.size === 0) this.#byScope.delete(context.scopeId);
+    };
+  }
+
+  compose(scopeId: string, coreTools: readonly MakaTool[]): readonly MakaTool[] {
+    validateIdentity('scopeId', scopeId);
+    const byName = new Map<string, MakaTool>();
+    for (const tool of coreTools) {
+      validateTool(tool, { allowProviderTool: true });
+      const key = toolNameKey(tool.name);
+      const existing = byName.get(key);
+      if (existing) {
+        throw new ExtensionToolContributionError(
+          'tool_name_conflict',
+          `Core Tool names "${existing.name}" and "${tool.name}" conflict`,
+        );
+      }
+      byName.set(key, tool);
+    }
+    for (const entry of this.#scopeEntries(scopeId)) {
+      const existing = byName.get(entry.key);
+      if (existing) {
+        throw new ExtensionToolContributionError(
+          'tool_name_conflict',
+          `Extension Tool "${entry.toolName}" conflicts with Core Tool "${existing.name}"`,
+        );
+      }
+      byName.set(entry.key, entry.tool);
+    }
+    return Object.freeze(
+      [...byName.values()].sort((left, right) => compareString(left.name, right.name)),
+    );
+  }
+
+  inspect(scopeId: string): readonly ExtensionToolContributionInspection[] {
+    validateIdentity('scopeId', scopeId);
+    return Object.freeze(
+      this.#scopeEntries(scopeId).map((entry) =>
+        Object.freeze({
+          scopeId: entry.scopeId,
+          entryId: entry.entryId,
+          extensionId: entry.extensionId,
+          generation: entry.generation,
+          toolName: entry.toolName,
+        }),
+      ),
+    );
+  }
+
+  #scopeEntries(scopeId: string): RegisteredExtensionTool[] {
+    return [...(this.#byScope.get(scopeId)?.values() ?? [])].sort((left, right) =>
+      compareString(left.toolName, right.toolName),
+    );
+  }
+}
+
+/** Register one Tool and make its registry entry activation-owned atomically. */
+export function contributeExtensionTool(
+  context: MakaContributionContext,
+  registry: ExtensionToolContributionRegistry,
+  tool: MakaTool,
+): void {
+  const unregister = registry.register(context, tool);
+  try {
+    context.ownEffect(`tool:${tool.name}`, unregister);
+  } catch (error) {
+    unregister();
+    throw error;
+  }
+}
+
+function validateContext(
+  context: Pick<MakaContributionContext, 'entryId' | 'scopeId' | 'extensionId' | 'generation'>,
+): void {
+  validateIdentity('entryId', context.entryId);
+  validateIdentity('scopeId', context.scopeId);
+  validateIdentity('extensionId', context.extensionId);
+  if (!Number.isSafeInteger(context.generation) || context.generation <= 0) {
+    throw new ExtensionToolContributionError('invalid_tool', 'Fiber generation is required');
+  }
+}
+
+function validateIdentity(label: string, value: string): void {
+  if (typeof value !== 'string' || value.length === 0 || /[\r\n\0]/.test(value)) {
+    throw new ExtensionToolContributionError('invalid_tool', `Invalid ${label}`);
+  }
+}
+
+function validateTool(tool: MakaTool, options: { allowProviderTool?: boolean } = {}): void {
+  if (!tool || typeof tool !== 'object') {
+    throw new ExtensionToolContributionError('invalid_tool', 'Tool definition is required');
+  }
+  if (
+    typeof tool.name !== 'string' ||
+    tool.name.length === 0 ||
+    tool.name.length > 128 ||
+    /[\r\n\0]/.test(tool.name)
+  ) {
+    throw new ExtensionToolContributionError('invalid_tool', 'Tool requires a valid name');
+  }
+  if (typeof tool.description !== 'string' || typeof tool.impl !== 'function') {
+    throw new ExtensionToolContributionError(
+      'invalid_tool',
+      `Tool "${tool.name}" requires a description and implementation`,
+    );
+  }
+  if (tool.parameters === undefined) {
+    throw new ExtensionToolContributionError(
+      'invalid_tool',
+      `Tool "${tool.name}" requires an input schema`,
+    );
+  }
+  if (tool.providerTool && !options.allowProviderTool) {
+    throw new ExtensionToolContributionError(
+      'invalid_tool',
+      `Extension Tool "${tool.name}" cannot claim a provider-native Runtime protocol`,
+    );
+  }
+}
+
+function toolNameKey(name: string): string {
+  return name.toLowerCase();
+}
+
+function compareString(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
diff --git a/packages/runtime/src/extension-ui-contributions.ts b/packages/runtime/src/extension-ui-contributions.ts
new file mode 100644
index 0000000000..10ece443cc
--- /dev/null
+++ b/packages/runtime/src/extension-ui-contributions.ts
@@ -0,0 +1,294 @@
+import { createHash } from 'node:crypto';
+import type { MakaContributionContext } from './plugin-runtime.js';
+
+export const EXTENSION_UI_DOCUMENT_MAX_BYTES = 1024 * 1024;
+export const EXTENSION_UI_SURFACES = ['app.root', 'app.overlay', 'app.slot'] as const;
+export type ExtensionUiSurface = (typeof EXTENSION_UI_SURFACES)[number];
+export const EXTENSION_UI_SLOT_PATTERN = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/u;
+
+export interface ExtensionUiContribution {
+  readonly id: string;
+  readonly surface: ExtensionUiSurface;
+  /** Named composition seat. Required only for app.slot contributions. */
+  readonly slot?: string;
+  /** Child composition seats declared by this contribution. */
+  readonly slots?: readonly string[];
+  readonly priority: number;
+  readonly document: string;
+  /** Sandboxed documents are offline unless this explicit capability is true. */
+  readonly network: boolean;
+  readonly hostState?: boolean;
+  readonly hostMethods?: readonly string[];
+  /** Explicit authority for a full-root document to drive Maka Sessions. */
+  readonly sessionAccess?: boolean;
+}
+
+export interface ExtensionUiContributionInspection {
+  readonly scopeId: string;
+  readonly entryId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+  readonly id: string;
+  readonly surface: ExtensionUiSurface;
+  readonly slot?: string;
+  readonly slots: readonly string[];
+  readonly priority: number;
+  readonly document: string;
+  readonly documentSha256: string;
+  readonly network: boolean;
+  readonly hostState: boolean;
+  readonly hostMethods: readonly string[];
+  readonly sessionAccess: boolean;
+}
+
+export type ExtensionUiReadiness = 'pending' | 'ready' | 'failed';
+
+export interface ExtensionUiReadinessInspection {
+  readonly entryId: string;
+  readonly generation: number;
+  readonly status: ExtensionUiReadiness;
+  readonly diagnostic?: string;
+}
+
+export class ExtensionUiContributionError extends Error {
+  readonly name = 'ExtensionUiContributionError';
+
+  constructor(
+    readonly code: 'invalid_ui' | 'ui_id_conflict',
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+interface RegisteredUi extends ExtensionUiContributionInspection {
+  readonly token: symbol;
+}
+
+/**
+ * Typed, renderer-agnostic UI contribution registry.
+ *
+ * Entries are retained by activation token rather than overwritten. That is
+ * important during current/candidate updates: readers select only the exact
+ * Fiber generations committed by the lifecycle kernel, so an activating candidate is
+ * never exposed before the Entry commit and the current UI never blinks out.
+ */
+export class ExtensionUiContributionRegistry {
+  readonly #byScope = new Map<string, RegisteredUi[]>();
+  readonly #readiness = new Map<string, ExtensionUiReadinessInspection>();
+
+  setReadiness(
+    scopeId: string,
+    entryId: string,
+    generation: number,
+    status: ExtensionUiReadiness,
+    diagnostic?: string,
+  ): void {
+    validateIdentity('scopeId', scopeId);
+    this.#readiness.set(
+      `${scopeId}\u0000${entryId}`,
+      Object.freeze({
+        entryId,
+        generation,
+        status,
+        ...(diagnostic ? { diagnostic } : {}),
+      }),
+    );
+  }
+
+  inspectReadiness(scopeId?: string): readonly ExtensionUiReadinessInspection[] {
+    return Object.freeze(
+      [...this.#readiness.entries()]
+        .filter(([key]) => !scopeId || key.startsWith(`${scopeId}\u0000`))
+        .map(([, value]) => value),
+    );
+  }
+
+  register(
+    context: Pick<MakaContributionContext, 'entryId' | 'scopeId' | 'extensionId' | 'generation'>,
+    contribution: ExtensionUiContribution,
+  ): () => void {
+    validateContext(context);
+    validateExtensionUiContribution(contribution);
+    const entries = this.#byScope.get(context.scopeId) ?? [];
+    const conflict = entries.find(
+      (entry) =>
+        entry.id === contribution.id &&
+        (entry.entryId !== context.entryId || entry.extensionId !== context.extensionId),
+    );
+    if (conflict) {
+      throw new ExtensionUiContributionError(
+        'ui_id_conflict',
+        `UI contribution "${contribution.id}" is already owned by entry ${conflict.entryId}`,
+      );
+    }
+    const entry: RegisteredUi = Object.freeze({
+      // ExtensionActivationContext also carries runtime-only capabilities such as
+      // AbortSignal and effect/dependency functions. Never retain those in the UI
+      // inspection record: inspections cross the durable Tool-result boundary.
+      entryId: context.entryId,
+      scopeId: context.scopeId,
+      extensionId: context.extensionId,
+      generation: context.generation,
+      ...contribution,
+      slots: Object.freeze([...(contribution.slots ?? [])]),
+      hostState: contribution.hostState === true,
+      hostMethods: Object.freeze([...(contribution.hostMethods ?? [])]),
+      sessionAccess: contribution.sessionAccess === true,
+      documentSha256: createHash('sha256').update(contribution.document).digest('hex'),
+      token: Symbol(contribution.id),
+    });
+    entries.push(entry);
+    this.#byScope.set(context.scopeId, entries);
+    let disposed = false;
+    return () => {
+      if (disposed) return;
+      disposed = true;
+      const current = this.#byScope.get(context.scopeId);
+      if (!current) return;
+      const index = current.findIndex(({ token }) => token === entry.token);
+      if (index >= 0) current.splice(index, 1);
+      if (current.length === 0) this.#byScope.delete(context.scopeId);
+      this.#readiness.delete(`${context.scopeId}\u0000${context.entryId}`);
+    };
+  }
+
+  inspect(
+    scopeId: string,
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+  ): readonly ExtensionUiContributionInspection[] {
+    validateIdentity('scopeId', scopeId);
+    const generations = new Map(committed.map(({ entryId, generation }) => [entryId, generation]));
+    return Object.freeze(
+      (this.#byScope.get(scopeId) ?? [])
+        .filter((entry) => generations.get(entry.entryId) === entry.generation)
+        .map(({ token: _token, ...entry }) => Object.freeze(entry))
+        .sort(compareUi),
+    );
+  }
+}
+
+export function contributeExtensionUi(
+  context: MakaContributionContext,
+  registry: ExtensionUiContributionRegistry,
+  contribution: ExtensionUiContribution,
+): void {
+  const unregister = registry.register(context, contribution);
+  try {
+    context.ownEffect(`ui:${contribution.id}`, unregister);
+  } catch (error) {
+    unregister();
+    throw error;
+  }
+}
+
+export function validateExtensionUiContribution(contribution: ExtensionUiContribution): void {
+  if (!contribution || typeof contribution !== 'object') {
+    throw new ExtensionUiContributionError('invalid_ui', 'UI contribution is required');
+  }
+  validateIdentity('UI contribution id', contribution.id);
+  if (!EXTENSION_UI_SURFACES.includes(contribution.surface)) {
+    throw new ExtensionUiContributionError('invalid_ui', 'UI surface is invalid');
+  }
+  if (contribution.surface === 'app.slot') {
+    if (
+      typeof contribution.slot !== 'string' ||
+      !EXTENSION_UI_SLOT_PATTERN.test(contribution.slot) ||
+      Buffer.byteLength(contribution.slot, 'utf8') > 128
+    ) {
+      throw new ExtensionUiContributionError('invalid_ui', 'UI slot name is invalid');
+    }
+  } else if (contribution.slot !== undefined) {
+    throw new ExtensionUiContributionError(
+      'invalid_ui',
+      'Only an app.slot contribution may declare a slot name',
+    );
+  }
+  if (
+    contribution.slots !== undefined &&
+    (!Array.isArray(contribution.slots) ||
+      contribution.slots.length > 32 ||
+      contribution.slots.some(
+        (slot) =>
+          typeof slot !== 'string' ||
+          !EXTENSION_UI_SLOT_PATTERN.test(slot) ||
+          Buffer.byteLength(slot, 'utf8') > 128,
+      ) ||
+      new Set(contribution.slots).size !== contribution.slots.length)
+  ) {
+    throw new ExtensionUiContributionError('invalid_ui', 'UI child slots are invalid');
+  }
+  if (!Number.isSafeInteger(contribution.priority) || Math.abs(contribution.priority) > 10_000) {
+    throw new ExtensionUiContributionError('invalid_ui', 'UI priority is invalid');
+  }
+  if (
+    typeof contribution.document !== 'string' ||
+    contribution.document.length === 0 ||
+    Buffer.byteLength(contribution.document, 'utf8') > EXTENSION_UI_DOCUMENT_MAX_BYTES
+  ) {
+    throw new ExtensionUiContributionError('invalid_ui', 'UI document is invalid or too large');
+  }
+  if (typeof contribution.network !== 'boolean') {
+    throw new ExtensionUiContributionError('invalid_ui', 'UI network capability is invalid');
+  }
+  if (contribution.hostState !== undefined && typeof contribution.hostState !== 'boolean') {
+    throw new ExtensionUiContributionError('invalid_ui', 'UI Host state capability is invalid');
+  }
+  if (contribution.sessionAccess !== undefined && typeof contribution.sessionAccess !== 'boolean') {
+    throw new ExtensionUiContributionError('invalid_ui', 'UI Session access capability is invalid');
+  }
+  if (contribution.sessionAccess === true && contribution.surface !== 'app.root') {
+    throw new ExtensionUiContributionError(
+      'invalid_ui',
+      'Only a complete app.root UI may request Session access',
+    );
+  }
+  if (
+    contribution.hostMethods !== undefined &&
+    (!Array.isArray(contribution.hostMethods) ||
+      contribution.hostMethods.length > 64 ||
+      contribution.hostMethods.some(
+        (method) => typeof method !== 'string' || !/^[A-Za-z][A-Za-z0-9_-]{0,127}$/u.test(method),
+      ))
+  ) {
+    throw new ExtensionUiContributionError('invalid_ui', 'UI Host methods are invalid');
+  }
+}
+
+function validateContext(
+  context: Pick<MakaContributionContext, 'entryId' | 'scopeId' | 'extensionId' | 'generation'>,
+): void {
+  validateIdentity('entryId', context.entryId);
+  validateIdentity('scopeId', context.scopeId);
+  validateIdentity('extensionId', context.extensionId);
+  if (!Number.isSafeInteger(context.generation) || context.generation <= 0) {
+    throw new ExtensionUiContributionError('invalid_ui', 'Fiber generation is required');
+  }
+}
+
+function validateIdentity(label: string, value: string): void {
+  if (
+    typeof value !== 'string' ||
+    value.length === 0 ||
+    Buffer.byteLength(value, 'utf8') > 128 ||
+    /[\r\n\0]/u.test(value)
+  ) {
+    throw new ExtensionUiContributionError('invalid_ui', `Invalid ${label}`);
+  }
+}
+
+function compareUi(
+  left: ExtensionUiContributionInspection,
+  right: ExtensionUiContributionInspection,
+): number {
+  return (
+    compareString(left.surface, right.surface) ||
+    right.priority - left.priority ||
+    compareString(left.extensionId, right.extensionId) ||
+    compareString(left.id, right.id)
+  );
+}
+
+function compareString(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
diff --git a/packages/runtime/src/hooks/command-runner.ts b/packages/runtime/src/hooks/command-runner.ts
new file mode 100644
index 0000000000..b7fb4bd3b5
--- /dev/null
+++ b/packages/runtime/src/hooks/command-runner.ts
@@ -0,0 +1,166 @@
+import { spawn } from 'node:child_process';
+import type { PreToolUseHookInput, ResolvedHookDefinition } from '@maka/core/hooks';
+import { BashTailBuffer } from '../bash-tail-buffer.js';
+import {
+  DEFAULT_PROCESS_IO_DRAIN_TIMEOUT_MS,
+  manageChildProcessLifecycle,
+} from '../child-process-lifecycle.js';
+import { DEFAULT_PROCESS_TERMINATION_GRACE_MS } from '../process-tree-terminator.js';
+
+const HOOK_OUTPUT_LIMIT = 64 * 1024;
+export const HOOK_EXECUTION_MARKER = 'MAKA_HOOK_EXECUTION' as const;
+
+export interface HookCommandResult {
+  exitCode: number | null;
+  stdout: string;
+  stderr: string;
+  timedOut: boolean;
+  aborted: boolean;
+  spawnError?: string;
+}
+
+export interface HookCommandRunner {
+  run(
+    definition: ResolvedHookDefinition,
+    input: PreToolUseHookInput,
+    abortSignal: AbortSignal,
+  ): Promise<HookCommandResult>;
+}
+
+export function createHookCommandRunner(): HookCommandRunner {
+  return { run: runHookCommand };
+}
+
+async function runHookCommand(
+  definition: ResolvedHookDefinition,
+  input: PreToolUseHookInput,
+  abortSignal: AbortSignal,
+): Promise<HookCommandResult> {
+  if (abortSignal.aborted) return emptyResult({ aborted: true });
+  if (process.env[HOOK_EXECUTION_MARKER] !== undefined) {
+    return emptyResult({ spawnError: 'Recursive Hook execution is not allowed' });
+  }
+  let child: ReturnType<typeof spawn>;
+  try {
+    child = spawn(definition.command, definition.args, {
+      cwd: input.cwd,
+      env: minimalHookEnvironment(),
+      shell: false,
+      detached: process.platform !== 'win32',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  } catch (error) {
+    return emptyResult({ spawnError: errorMessage(error) });
+  }
+
+  const stdout = new BashTailBuffer(HOOK_OUTPUT_LIMIT);
+  const stderr = new BashTailBuffer(HOOK_OUTPUT_LIMIT);
+  child.stdout?.setEncoding('utf8');
+  child.stderr?.setEncoding('utf8');
+  child.stdout?.on('data', (chunk: string) => stdout.push(chunk));
+  child.stderr?.on('data', (chunk: string) => stderr.push(chunk));
+
+  const lifecycle = manageChildProcessLifecycle(
+    child,
+    [
+      ...(child.stdout ? [{ key: 'stdout' as const, stream: child.stdout }] : []),
+      ...(child.stderr ? [{ key: 'stderr' as const, stream: child.stderr }] : []),
+    ],
+    {
+      killGraceMs: DEFAULT_PROCESS_TERMINATION_GRACE_MS,
+      ioDrainTimeoutMs: DEFAULT_PROCESS_IO_DRAIN_TIMEOUT_MS,
+    },
+  );
+
+  let timedOut = false;
+  let aborted = false;
+  let inputError: string | undefined;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    lifecycle.terminate();
+  }, definition.timeoutMs);
+  const abort = () => {
+    aborted = true;
+    lifecycle.terminate();
+  };
+  abortSignal.addEventListener('abort', abort, { once: true });
+
+  try {
+    await writeHookInput(child.stdin, input).catch((error) => {
+      inputError = errorMessage(error);
+      lifecycle.terminate();
+    });
+    const result = await lifecycle.completion;
+    return {
+      exitCode: result.exitCode,
+      stdout: stdout.value(),
+      stderr: stderr.value(),
+      timedOut,
+      aborted,
+      ...(inputError ? { spawnError: `Failed to write Hook stdin: ${inputError}` } : {}),
+    };
+  } catch (error) {
+    return {
+      ...emptyResult({ spawnError: errorMessage(error) }),
+      stdout: stdout.value(),
+      stderr: stderr.value(),
+      timedOut,
+      aborted,
+    };
+  } finally {
+    clearTimeout(timer);
+    abortSignal.removeEventListener('abort', abort);
+  }
+}
+
+function writeHookInput(
+  stdin: NodeJS.WritableStream | null,
+  input: PreToolUseHookInput,
+): Promise<void> {
+  if (!stdin) return Promise.reject(new Error('Hook stdin is unavailable'));
+  return new Promise((resolve, reject) => {
+    const onError = (error: Error) => reject(error);
+    stdin.once('error', onError);
+    stdin.end(`${JSON.stringify(input)}\n`, () => {
+      stdin.removeListener('error', onError);
+      resolve();
+    });
+  });
+}
+
+function minimalHookEnvironment(): NodeJS.ProcessEnv {
+  const keep = [
+    'PATH',
+    'HOME',
+    'LANG',
+    'LC_ALL',
+    'LC_CTYPE',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'SystemRoot',
+    'ComSpec',
+    'PATHEXT',
+  ];
+  const env: NodeJS.ProcessEnv = {};
+  for (const key of keep) {
+    if (process.env[key] !== undefined) env[key] = process.env[key];
+  }
+  env[HOOK_EXECUTION_MARKER] = '1';
+  return env;
+}
+
+function emptyResult(input: { aborted?: boolean; spawnError?: string }): HookCommandResult {
+  return {
+    exitCode: null,
+    stdout: '',
+    stderr: '',
+    timedOut: false,
+    aborted: input.aborted ?? false,
+    ...(input.spawnError ? { spawnError: input.spawnError } : {}),
+  };
+}
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
diff --git a/packages/runtime/src/hooks/engine.ts b/packages/runtime/src/hooks/engine.ts
new file mode 100644
index 0000000000..e7159f4d6a
--- /dev/null
+++ b/packages/runtime/src/hooks/engine.ts
@@ -0,0 +1,331 @@
+import type {
+  HookCompletedAudit,
+  PreToolUseHookInput,
+  ResolvedHookDefinition,
+} from '@maka/core/hooks';
+import {
+  createHookCommandRunner,
+  type HookCommandResult,
+  type HookCommandRunner,
+} from './command-runner.js';
+import { hookMatcherMatches } from './matcher.js';
+import type { ExtensionCoreEventName } from '../extension-core-events.js';
+
+const DEFAULT_CONCURRENCY = 8;
+const MAX_DENIAL_REASON_CHARS = 4_000;
+const MAX_AUDIT_MESSAGE_CHARS = 4_000;
+
+export interface HookDispatchResult {
+  denied: boolean;
+  reason?: string;
+  audits: HookCompletedAudit[];
+  auditWriteFailures: string[];
+}
+
+export interface PreToolUseHookDispatcher {
+  prepareTurn(turnId: string): void;
+  releaseTurn(turnId: string): void;
+  runPreToolUse(
+    input: PreToolUseHookInput,
+    abortSignal: AbortSignal,
+    context: HookDispatchRuntimeContext,
+  ): Promise<HookDispatchResult>;
+  /** Typed Agent/Session seam dispatched through the unified Extension Event kernel. */
+  runCoreEvent?(
+    event: ExtensionCoreEventName,
+    payload: unknown,
+    abortSignal: AbortSignal,
+    context: ExtensionHookDispatchRuntimeContext,
+  ): Promise<ExtensionCoreEventDispatchResult>;
+  /** Trusted in-process around middleware. The final continuation owns the real operation. */
+  runCoreMiddleware?(
+    event: 'maka.tools.execute' | 'maka.llm.stream',
+    payload: unknown,
+    abortSignal: AbortSignal,
+    context: ExtensionHookDispatchRuntimeContext,
+    final: (value: unknown) => unknown | Promise<unknown>,
+  ): Promise<unknown>;
+}
+
+export interface HookDispatchRuntimeContext {
+  invocationId: string;
+}
+
+export interface ExtensionHookDispatchRuntimeContext extends HookDispatchRuntimeContext {
+  sessionId: string;
+  runId: string;
+  turnId: string;
+  cwd: string;
+  permissionMode: string;
+  origin: 'provider' | 'code_mode';
+}
+
+export interface ExtensionCoreEventDispatchResult {
+  readonly result: unknown;
+  readonly delivered: number;
+  readonly failed: number;
+}
+
+export interface PreToolUseHookDispatcherInput {
+  loadSnapshot(turnId: string): Promise<readonly ResolvedHookDefinition[]>;
+  recordAudit?: (
+    input: PreToolUseHookInput,
+    audit: HookCompletedAudit,
+    context: HookDispatchRuntimeContext,
+  ) => Promise<void>;
+  commandRunner?: HookCommandRunner;
+  now?: () => number;
+  concurrency?: number;
+  executionLimiter?: HookExecutionLimiter;
+}
+
+export interface HookExecutionLimiter {
+  run<T>(operation: () => Promise<T>): Promise<T>;
+}
+
+export function createHookExecutionLimiter(
+  concurrency = DEFAULT_CONCURRENCY,
+): HookExecutionLimiter {
+  if (!Number.isInteger(concurrency) || concurrency < 1) {
+    throw new Error('Hook concurrency must be a positive integer');
+  }
+  let active = 0;
+  const queued: Array<() => void> = [];
+  const drain = () => {
+    while (active < concurrency && queued.length > 0) queued.shift()?.();
+  };
+  return {
+    run<T>(operation: () => Promise<T>): Promise<T> {
+      return new Promise<T>((resolve, reject) => {
+        queued.push(() => {
+          active += 1;
+          void Promise.resolve()
+            .then(operation)
+            .then(resolve, reject)
+            .finally(() => {
+              active -= 1;
+              drain();
+            });
+        });
+        drain();
+      });
+    },
+  };
+}
+
+export function createPreToolUseHookDispatcher(
+  input: PreToolUseHookDispatcherInput,
+): PreToolUseHookDispatcher {
+  const commandRunner = input.commandRunner ?? createHookCommandRunner();
+  const now = input.now ?? Date.now;
+  const concurrency = input.concurrency ?? DEFAULT_CONCURRENCY;
+  const executionLimiter = input.executionLimiter ?? createHookExecutionLimiter(concurrency);
+  const snapshots = new Map<string, Promise<readonly ResolvedHookDefinition[]>>();
+
+  const snapshotForTurn = (turnId: string): Promise<readonly ResolvedHookDefinition[]> => {
+    let snapshot = snapshots.get(turnId);
+    if (!snapshot) {
+      snapshot = input.loadSnapshot(turnId);
+      snapshots.set(turnId, snapshot);
+    }
+    return snapshot;
+  };
+
+  return {
+    prepareTurn(turnId) {
+      void snapshotForTurn(turnId).catch(() => {});
+    },
+    releaseTurn(turnId) {
+      snapshots.delete(turnId);
+    },
+    async runPreToolUse(hookInput, abortSignal, context) {
+      const definitions = await snapshotForTurn(hookInput.turn_id);
+      const matching = definitions.filter((definition) =>
+        hookMatcherMatches(definition.matcher, hookInput.tool_name),
+      );
+      const audits = await mapConcurrent(matching, concurrency, async (definition) => {
+        if (!definition.trusted) {
+          return auditFor(definition, hookInput, 'skipped_untrusted', 0, 'Review required');
+        }
+        const startedAt = now();
+        const result = await executionLimiter.run(() =>
+          commandRunner.run(definition, hookInput, abortSignal),
+        );
+        return auditFromCommandResult(
+          definition,
+          hookInput,
+          result,
+          Math.max(0, now() - startedAt),
+        );
+      });
+      const auditWriteFailures: string[] = [];
+      if (input.recordAudit) {
+        for (const audit of audits) {
+          try {
+            await input.recordAudit(hookInput, audit, context);
+          } catch (error) {
+            auditWriteFailures.push(errorMessage(error));
+          }
+        }
+      }
+      const denials = audits.filter((audit) => audit.status === 'denied');
+      return {
+        denied: denials.length > 0,
+        ...(denials.length > 0
+          ? {
+              reason: boundText(
+                denials
+                  .map((audit) => audit.message || `Hook ${audit.handlerId} denied this tool call.`)
+                  .join('\n'),
+                MAX_DENIAL_REASON_CHARS,
+              ),
+            }
+          : {}),
+        audits,
+        auditWriteFailures,
+      };
+    },
+  };
+}
+
+function auditFromCommandResult(
+  definition: ResolvedHookDefinition,
+  input: PreToolUseHookInput,
+  result: HookCommandResult,
+  durationMs: number,
+): HookCompletedAudit {
+  if (result.aborted) {
+    return auditFor(definition, input, 'failed', durationMs, 'Hook aborted with the Turn');
+  }
+  if (result.timedOut) {
+    return auditFor(definition, input, 'failed', durationMs, 'Hook timed out');
+  }
+  if (result.spawnError) {
+    return auditFor(definition, input, 'failed', durationMs, result.spawnError);
+  }
+  if (result.exitCode === 2) {
+    return auditFor(
+      definition,
+      input,
+      'denied',
+      durationMs,
+      result.stderr.trim() || `Hook ${definition.id} denied this tool call.`,
+    );
+  }
+  if (result.exitCode !== 0) {
+    return auditFor(
+      definition,
+      input,
+      'failed',
+      durationMs,
+      `Hook exited with code ${String(result.exitCode)}`,
+    );
+  }
+  const stdout = result.stdout.trim();
+  if (!stdout) return auditFor(definition, input, 'allowed', durationMs);
+  try {
+    const decision = parseStructuredDecision(stdout);
+    return auditFor(
+      definition,
+      input,
+      decision.decision === 'deny' ? 'denied' : 'allowed',
+      durationMs,
+      decision.reason,
+    );
+  } catch (error) {
+    return auditFor(definition, input, 'failed', durationMs, errorMessage(error));
+  }
+}
+
+function parseStructuredDecision(stdout: string): { decision: 'allow' | 'deny'; reason?: string } {
+  const root = exactRecord(JSON.parse(stdout), ['hookSpecificOutput'], 'Hook output');
+  const output = exactRecord(
+    root.hookSpecificOutput,
+    ['hookEventName', 'permissionDecision', 'permissionDecisionReason'],
+    'hookSpecificOutput',
+  );
+  if (output.hookEventName !== 'PreToolUse') {
+    throw new Error('hookSpecificOutput.hookEventName must be PreToolUse');
+  }
+  if (output.permissionDecision !== 'allow' && output.permissionDecision !== 'deny') {
+    throw new Error('hookSpecificOutput.permissionDecision must be allow or deny');
+  }
+  if (
+    output.permissionDecisionReason !== undefined &&
+    typeof output.permissionDecisionReason !== 'string'
+  ) {
+    throw new Error('hookSpecificOutput.permissionDecisionReason must be a string');
+  }
+  return {
+    decision: output.permissionDecision,
+    ...(output.permissionDecisionReason
+      ? { reason: boundText(output.permissionDecisionReason, MAX_AUDIT_MESSAGE_CHARS) }
+      : {}),
+  };
+}
+
+function auditFor(
+  definition: ResolvedHookDefinition,
+  input: PreToolUseHookInput,
+  status: HookCompletedAudit['status'],
+  durationMs: number,
+  message?: string,
+): HookCompletedAudit {
+  return {
+    eventName: 'PreToolUse',
+    handlerId: definition.id,
+    definitionHash: definition.definitionHash,
+    source: definition.source,
+    toolUseId: input.tool_use_id,
+    toolName: input.tool_name,
+    status,
+    durationMs,
+    ...(message ? { message: boundText(message, MAX_AUDIT_MESSAGE_CHARS) } : {}),
+  };
+}
+
+async function mapConcurrent<T, R>(
+  values: readonly T[],
+  concurrency: number,
+  worker: (value: T) => Promise<R>,
+): Promise<R[]> {
+  if (!Number.isInteger(concurrency) || concurrency < 1) {
+    throw new Error('Hook concurrency must be a positive integer');
+  }
+  const results = new Array<R>(values.length);
+  let next = 0;
+  await Promise.all(
+    Array.from({ length: Math.min(concurrency, values.length) }, async () => {
+      while (next < values.length) {
+        const index = next;
+        next += 1;
+        results[index] = await worker(values[index]!);
+      }
+    }),
+  );
+  return results;
+}
+
+function exactRecord(
+  value: unknown,
+  keys: readonly string[],
+  label: string,
+): Record<string, unknown> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  const record = value as Record<string, unknown>;
+  const allowed = new Set(keys);
+  const unknown = Object.keys(record).find((key) => !allowed.has(key));
+  if (unknown) throw new Error(`${label} contains unknown field: ${unknown}`);
+  return record;
+}
+
+function boundText(value: string, maxChars: number): string {
+  if (value.length <= maxChars) return value;
+  return `${value.slice(0, Math.max(0, maxChars - 1))}…`;
+}
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
diff --git a/packages/runtime/src/hooks/matcher.ts b/packages/runtime/src/hooks/matcher.ts
new file mode 100644
index 0000000000..82b55c41d7
--- /dev/null
+++ b/packages/runtime/src/hooks/matcher.ts
@@ -0,0 +1,11 @@
+export function hookMatcherMatches(matcher: string, toolName: string): boolean {
+  for (const token of matcher.split('|')) {
+    if (token === '*') return true;
+    if (token.endsWith('*')) {
+      if (toolName.startsWith(token.slice(0, -1))) return true;
+      continue;
+    }
+    if (token === toolName) return true;
+  }
+  return false;
+}
diff --git a/packages/runtime/src/model-adapter.ts b/packages/runtime/src/model-adapter.ts
index 01b5782f7f..4cd500c660 100644
--- a/packages/runtime/src/model-adapter.ts
+++ b/packages/runtime/src/model-adapter.ts
@@ -858,10 +858,7 @@ function translateChunk(
         type: 'tool-call',
         toolCallId: chunk.toolCallId,
         toolName: chunk.toolName,
-        input:
-          chunk.providerExecuted === true
-            ? parseProviderExecutedToolInput(chunk.input ?? chunk.args)
-            : (chunk.input ?? chunk.args),
+        input: parseWireToolInput(chunk.input ?? chunk.args),
         ...(chunk.providerExecuted !== undefined
           ? { providerExecuted: chunk.providerExecuted }
           : {}),
@@ -878,13 +875,16 @@ function translateChunk(
   }
 }
 
-function parseProviderExecutedToolInput(input: unknown): unknown {
-  if (typeof input !== 'string') return input;
-  try {
-    return JSON.parse(input);
-  } catch {
-    return input;
+function parseWireToolInput(input: unknown): unknown {
+  let parsed = input;
+  for (let depth = 0; depth < 8 && typeof parsed === 'string'; depth += 1) {
+    try {
+      parsed = JSON.parse(parsed);
+    } catch {
+      return parsed;
+    }
   }
+  return parsed;
 }
 
 export function lowerModelTools(tools: ModelToolSet): Record<string, unknown> {
diff --git a/packages/runtime/src/plugin-composition-loader.ts b/packages/runtime/src/plugin-composition-loader.ts
new file mode 100644
index 0000000000..b0daf5dca1
--- /dev/null
+++ b/packages/runtime/src/plugin-composition-loader.ts
@@ -0,0 +1,761 @@
+import { Context, type Fiber, type Inject, type Plugin } from './plugin-kernel.js';
+import {
+  fiberStateName,
+  type MakaCompositionEntry,
+  type MakaCompositionEntryInspection,
+  type MakaCompositionApplyInput,
+  type MakaCompositionSnapshot,
+  type MakaPluginMetadata,
+  type MakaPluginPackage,
+  type MakaPluginRootId,
+  MakaPluginRuntimeError,
+  MakaPluginTransactionBuffer,
+  type MakaPluginTransaction,
+  validateCompositionEntry,
+  validatePluginPackage,
+  validatePluginRootId,
+} from './plugin-runtime.js';
+
+interface LiveEntry {
+  spec: MakaCompositionEntry;
+  readonly rootId: MakaPluginRootId;
+  parent?: LiveEntry;
+  context: Context;
+  fiber?: Fiber;
+  generation?: number;
+  readonly children: LiveEntry[];
+  diagnostic?: string;
+}
+
+const FIBER_PENDING = 0;
+const FIBER_FAILED = 3;
+
+interface LiveRoot {
+  readonly id: MakaPluginRootId;
+  readonly context: Context;
+  readonly entries: LiveEntry[];
+}
+
+export interface MakaCompositionLoaderOptions {
+  readonly root?: Context;
+  readonly transaction?: (context: Context) => MakaPluginTransaction | undefined;
+}
+
+export class MakaCompositionLoader {
+  readonly root: Context;
+  readonly #packages = new Map<string, MakaPluginPackage>();
+  readonly #roots = new Map<MakaPluginRootId, LiveRoot>();
+  readonly #entries = new Map<string, LiveEntry>();
+  readonly #isolationLabels = new Map<string, symbol>();
+  readonly #transaction?: (context: Context) => MakaPluginTransaction | undefined;
+  #compositionGeneration = 0;
+  #fiberGeneration = 0;
+  #mutation: Promise<void> = Promise.resolve();
+
+  constructor(options: MakaCompositionLoaderOptions = {}) {
+    this.root = options.root ?? new Context();
+    this.#transaction = options.transaction;
+  }
+
+  install(pkg: MakaPluginPackage): Promise<void> {
+    return this.#mutate(async () => {
+      validatePluginPackage(pkg);
+      const previous = this.#packages.get(pkg.packageId);
+      this.#packages.set(pkg.packageId, freezePackage(pkg));
+      if (!previous) return;
+      try {
+        // A package reload is a runtime projection change, not a persistent
+        // version change. Replace only the affected Entry subtrees so unrelated
+        // Fibers retain their identity and effects.
+        await this.#reloadPackage(pkg.packageId);
+      } catch (error) {
+        this.#packages.set(pkg.packageId, previous);
+        throw error;
+      }
+    });
+  }
+
+  uninstall(packageId: string): Promise<void> {
+    return this.#mutate(async () => {
+      if (!this.#packages.has(packageId)) {
+        throw new MakaPluginRuntimeError(
+          'package_not_found',
+          `Plugin package is not installed: ${packageId}`,
+        );
+      }
+      const user = [...this.#entries.values()].find((entry) => entry.spec.packageId === packageId);
+      if (user) {
+        throw new MakaPluginRuntimeError(
+          'package_in_use',
+          `Plugin package is used by entry ${user.spec.id}`,
+        );
+      }
+      this.#packages.delete(packageId);
+    });
+  }
+
+  create(
+    rootId: MakaPluginRootId,
+    entry: MakaCompositionEntry,
+    parentId?: string,
+    position = Infinity,
+  ): Promise<MakaCompositionEntryInspection> {
+    return this.apply({
+      operations: [{ type: 'insert', rootId, entry, parentId, position }],
+    }).then(([inspection]) => inspection!);
+  }
+
+  update(
+    entryId: string,
+    patch: Partial<Omit<MakaCompositionEntry, 'id' | 'children'>>,
+  ): Promise<MakaCompositionEntryInspection> {
+    return this.apply({ operations: [{ type: 'update', entryId, patch }] }).then(
+      ([inspection]) => inspection!,
+    );
+  }
+
+  move(
+    entryId: string,
+    newParentId?: string,
+    position = Infinity,
+  ): Promise<MakaCompositionEntryInspection> {
+    return this.apply({
+      operations: [{ type: 'move', entryId, parentId: newParentId, position }],
+    }).then(([inspection]) => inspection!);
+  }
+
+  enable(entryId: string): Promise<MakaCompositionEntryInspection> {
+    return this.update(entryId, { disabled: false });
+  }
+
+  disable(entryId: string): Promise<MakaCompositionEntryInspection> {
+    return this.update(entryId, { disabled: true });
+  }
+
+  apply(input: MakaCompositionApplyInput): Promise<readonly MakaCompositionEntryInspection[]> {
+    return this.#mutate(async () => {
+      if (
+        input.baseGeneration !== undefined &&
+        input.baseGeneration !== this.#compositionGeneration
+      )
+        throw new MakaPluginRuntimeError(
+          'invalid_entry',
+          `Composition generation changed from ${input.baseGeneration} to ${this.#compositionGeneration}`,
+        );
+      const before = this.snapshot();
+      const inspections: MakaCompositionEntryInspection[] = [];
+      let appliedOperations = 0;
+      try {
+        for (const operation of input.operations) {
+          switch (operation.type) {
+            case 'insert': {
+              const entry = await this.#insert(
+                operation.rootId ?? this.#inferRoot(operation.parentId),
+                operation.entry,
+                operation.parentId,
+                operation.position,
+              );
+              inspections.push(this.#inspect(entry));
+              appliedOperations += 1;
+              break;
+            }
+            case 'update': {
+              const entry = await this.#update(operation.entryId, operation.patch);
+              inspections.push(this.#inspect(entry));
+              appliedOperations += 1;
+              break;
+            }
+            case 'move': {
+              const entry = await this.#move(
+                operation.entryId,
+                operation.parentId,
+                operation.position,
+              );
+              inspections.push(this.#inspect(entry));
+              appliedOperations += 1;
+              break;
+            }
+            case 'remove':
+              await this.#remove(operation.entryId);
+              appliedOperations += 1;
+              break;
+          }
+        }
+      } catch (error) {
+        // A candidate can fail before changing the live tree. Rebuilding in
+        // that case would unnecessarily dispose the current Fiber and lose
+        // its registered contributions.
+        if (appliedOperations > 0) await this.#replaceSnapshot(before);
+        throw error;
+      }
+      if (input.operations.length > 0) this.#compositionGeneration += 1;
+      return Object.freeze(inspections);
+    });
+  }
+
+  replaceSubtree(
+    entryId: string,
+    entry: MakaCompositionEntry,
+  ): Promise<MakaCompositionEntryInspection> {
+    return this.#mutate(async () => {
+      const current = this.#requireEntry(entryId);
+      if (entry.id !== entryId) {
+        throw new MakaPluginRuntimeError(
+          'invalid_entry',
+          'Replacement subtree must preserve entry id',
+        );
+      }
+      validateCompositionEntry(entry);
+      const descendantIds = new Set([...walk(entry)].map((item) => item.id));
+      for (const id of descendantIds) {
+        const existing = this.#entries.get(id);
+        if (existing && !isWithin(existing, current)) {
+          throw new MakaPluginRuntimeError(
+            'entry_exists',
+            `Composition entry already exists: ${id}`,
+          );
+        }
+      }
+      return this.#replace(current, freezeEntry(entry));
+    });
+  }
+
+  remove(entryId: string): Promise<void> {
+    return this.apply({ operations: [{ type: 'remove', entryId }] }).then(() => undefined);
+  }
+
+  inspectTree(rootId?: MakaPluginRootId): readonly MakaCompositionEntryInspection[] {
+    const roots = rootId ? [this.#root(rootId)] : [...this.#roots.values()];
+    return Object.freeze(
+      roots.flatMap((root) => root.entries.map((entry) => this.#inspect(entry))),
+    );
+  }
+
+  inspect(entryId: string): MakaCompositionEntryInspection {
+    return this.#inspect(this.#requireEntry(entryId));
+  }
+
+  installedPackages(): readonly { readonly packageId: string }[] {
+    return Object.freeze(
+      [...this.#packages.values()]
+        .map(({ packageId }) => Object.freeze({ packageId }))
+        .sort((left, right) => left.packageId.localeCompare(right.packageId)),
+    );
+  }
+
+  package(packageId: string): MakaPluginPackage {
+    const pkg = this.#packages.get(packageId);
+    if (!pkg) {
+      throw new MakaPluginRuntimeError(
+        'package_not_found',
+        `Plugin package is not installed: ${packageId}`,
+      );
+    }
+    return pkg;
+  }
+
+  async awaitSettled(): Promise<void> {
+    while (true) {
+      const tasks = [...this.#entries.values()].flatMap((entry) =>
+        entry.fiber?.inertia ? [entry.fiber.inertia] : [],
+      );
+      if (!tasks.length) return;
+      await Promise.allSettled(tasks);
+    }
+  }
+
+  snapshot(): MakaCompositionSnapshot {
+    const encode = (rootId: MakaPluginRootId): readonly MakaCompositionEntry[] =>
+      Object.freeze((this.#roots.get(rootId)?.entries ?? []).map((entry) => serialize(entry)));
+    const sessions: Record<string, readonly MakaCompositionEntry[]> = {};
+    for (const root of this.#roots.values()) {
+      if (root.id.startsWith('session:'))
+        sessions[root.id.slice('session:'.length)] = encode(root.id);
+    }
+    return Object.freeze({
+      schemaVersion: 1,
+      generation: this.#compositionGeneration,
+      roots: Object.freeze({
+        profile: encode('profile'),
+        desktopUi: encode('desktop-ui'),
+        sessions: Object.freeze(sessions),
+      }),
+    });
+  }
+
+  replaceSnapshot(snapshot: MakaCompositionSnapshot): Promise<void> {
+    return this.#mutate(() => this.#replaceSnapshot(snapshot));
+  }
+
+  async #replaceSnapshot(snapshot: MakaCompositionSnapshot): Promise<void> {
+    if (snapshot.schemaVersion !== 1)
+      throw new MakaPluginRuntimeError('invalid_entry', 'Unsupported composition snapshot');
+    const specs = new Map<MakaPluginRootId, readonly MakaCompositionEntry[]>([
+      ['profile', snapshot.roots.profile],
+      ['desktop-ui', snapshot.roots.desktopUi],
+      ...Object.entries(snapshot.roots.sessions).map(
+        ([id, entries]) => [`session:${id}` as MakaPluginRootId, entries] as const,
+      ),
+    ]);
+    const stagedRoots = new Map<MakaPluginRootId, LiveRoot>();
+    const stagedIds = new Set<string>();
+    try {
+      for (const [rootId, entries] of specs) {
+        validatePluginRootId(rootId);
+        const context = this.root.extend({ makaRootId: rootId });
+        const root: LiveRoot = { id: rootId, context, entries: [] };
+        stagedRoots.set(rootId, root);
+        for (const spec of entries) {
+          validateCompositionEntry(spec);
+          for (const item of walk(spec)) {
+            if (stagedIds.has(item.id))
+              throw new MakaPluginRuntimeError(
+                'entry_exists',
+                `Composition entry already exists: ${item.id}`,
+              );
+            stagedIds.add(item.id);
+          }
+          root.entries.push(await this.#stage(spec, rootId, undefined, context, false));
+        }
+      }
+      for (const root of stagedRoots.values())
+        for (const entry of root.entries) await this.#commitSubtree(entry);
+    } catch (error) {
+      await Promise.allSettled(
+        [...stagedRoots.values()].flatMap((root) =>
+          [...root.entries].reverse().map((entry) => this.#dispose(entry)),
+        ),
+      );
+      throw error;
+    }
+    const previous = [...this.#roots.values()];
+    this.#roots.clear();
+    this.#entries.clear();
+    for (const [rootId, root] of stagedRoots) {
+      this.#roots.set(rootId, root);
+      for (const entry of root.entries) this.#index(entry);
+    }
+    this.#compositionGeneration = Math.max(this.#compositionGeneration, snapshot.generation);
+    await Promise.allSettled(
+      previous.flatMap((root) => [...root.entries].reverse().map((entry) => this.#dispose(entry))),
+    );
+  }
+
+  async close(): Promise<void> {
+    await this.#mutate(async () => {
+      const roots = [...this.#roots.values()];
+      this.#roots.clear();
+      this.#entries.clear();
+      await Promise.allSettled(
+        roots.flatMap((root) => [...root.entries].reverse().map((entry) => this.#dispose(entry))),
+      );
+      await this.root.fiber.dispose();
+    });
+  }
+
+  async #replace(
+    current: LiveEntry,
+    spec: MakaCompositionEntry,
+  ): Promise<MakaCompositionEntryInspection> {
+    const parentContext = current.parent?.context ?? this.#root(current.rootId).context;
+    const candidate = await this.#stage(spec, current.rootId, current.parent, parentContext, false);
+    try {
+      await this.#commitSubtree(candidate);
+    } catch (error) {
+      await this.#dispose(candidate);
+      current.diagnostic = diagnostic(error);
+      throw error;
+    }
+    const siblings = current.parent?.children ?? this.#root(current.rootId).entries;
+    const index = siblings.indexOf(current);
+    this.#unindex(current);
+    siblings[index] = candidate;
+    this.#index(candidate);
+    await this.#dispose(current);
+    return this.#inspect(candidate);
+  }
+
+  async #reloadPackage(packageId: string): Promise<void> {
+    const affected = [...this.#entries.values()].filter(
+      (entry) =>
+        entry.spec.packageId === packageId &&
+        !ancestors(entry).some((ancestor) => ancestor.spec.packageId === packageId),
+    );
+    if (!affected.length) return;
+    const candidates: { readonly current: LiveEntry; readonly replacement: LiveEntry }[] = [];
+    try {
+      for (const current of affected) {
+        const replacement = await this.#stage(
+          serialize(current),
+          current.rootId,
+          current.parent,
+          current.parent?.context ?? this.#root(current.rootId).context,
+          false,
+        );
+        candidates.push({ current, replacement });
+      }
+      for (const { replacement } of candidates) await this.#commitSubtree(replacement);
+    } catch (error) {
+      await Promise.allSettled(candidates.map(({ replacement }) => this.#dispose(replacement)));
+      throw error;
+    }
+    for (const { current, replacement } of candidates) {
+      const siblings = current.parent?.children ?? this.#root(current.rootId).entries;
+      const index = siblings.indexOf(current);
+      this.#unindex(current);
+      siblings[index] = replacement;
+      this.#index(replacement);
+    }
+    await Promise.allSettled(candidates.map(({ current }) => this.#dispose(current)));
+  }
+
+  async #rebind(entry: LiveEntry): Promise<void> {
+    const replacement = await this.#stage(
+      serialize(entry),
+      entry.rootId,
+      entry.parent,
+      entry.parent?.context ?? this.#root(entry.rootId).context,
+      false,
+    );
+    await this.#commitSubtree(replacement);
+    const siblings = entry.parent?.children ?? this.#root(entry.rootId).entries;
+    const index = siblings.indexOf(entry);
+    this.#unindex(entry);
+    siblings[index] = replacement;
+    this.#index(replacement);
+    await this.#dispose(entry);
+  }
+
+  async #stage(
+    spec: MakaCompositionEntry,
+    rootId: MakaPluginRootId,
+    parent: LiveEntry | undefined,
+    parentContext: Context,
+    ancestorDisabled: boolean,
+  ): Promise<LiveEntry> {
+    let context = parentContext.extend({ makaEntryId: spec.id });
+    for (const [service, label] of Object.entries(spec.isolate ?? {})) {
+      const symbol = label === true ? Symbol(`${spec.id}:${service}`) : this.#isolationLabel(label);
+      context = context.isolate(service, symbol);
+    }
+    for (const [service, config] of Object.entries(spec.intercept ?? {}))
+      context = context.intercept(service, config);
+    const live: LiveEntry = { spec: freezeEntry(spec), rootId, parent, context, children: [] };
+    const disabled = ancestorDisabled || spec.disabled === true;
+    if (!disabled && spec.packageId) {
+      const pkg = this.#packages.get(spec.packageId);
+      if (!pkg)
+        throw new MakaPluginRuntimeError(
+          'package_not_found',
+          `Plugin package is not installed: ${spec.packageId}`,
+        );
+      if (!pkg.host)
+        throw new MakaPluginRuntimeError(
+          'invalid_package',
+          `Plugin package has no Host plugin: ${spec.packageId}`,
+        );
+      const generation = ++this.#fiberGeneration;
+      const metadata: MakaPluginMetadata = Object.freeze({
+        rootId,
+        entryId: spec.id,
+        packageId: spec.packageId,
+        generation,
+      });
+      context = context.extend({ maka: metadata });
+      const transaction = this.#transaction?.(context) ?? new MakaPluginTransactionBuffer(context);
+      if (transaction) context = context.extend({ makaTransaction: transaction });
+      live.context = context;
+      live.generation = generation;
+      const plugin = entryPlugin(pkg.host, spec.inject);
+      live.fiber = context.plugin(plugin, spec.config);
+      try {
+        await live.fiber.await();
+        if (live.fiber.state === FIBER_FAILED) throw new Error(`Plugin Fiber failed: ${spec.id}`);
+      } catch (error) {
+        live.diagnostic = diagnostic(error);
+        await live.fiber.dispose().catch(() => undefined);
+        await transaction?.rollback();
+        throw new MakaPluginRuntimeError(
+          'activation_failed',
+          `Unable to activate entry ${spec.id}: ${diagnostic(error)}`,
+          { cause: error },
+        );
+      }
+    }
+    try {
+      for (const child of spec.children ?? [])
+        live.children.push(await this.#stage(child, rootId, live, live.context, disabled));
+    } catch (error) {
+      await this.#dispose(live);
+      throw error;
+    }
+    return live;
+  }
+
+  async #commitSubtree(entry: LiveEntry): Promise<void> {
+    await entry.context.makaTransaction?.commit();
+    for (const child of entry.children) await this.#commitSubtree(child);
+  }
+
+  async #dispose(entry: LiveEntry): Promise<void> {
+    await Promise.allSettled([...entry.children].reverse().map((child) => this.#dispose(child)));
+    await entry.context.makaTransaction?.rollback();
+    if (entry.fiber) await entry.fiber.dispose();
+  }
+
+  #root(rootId: MakaPluginRootId): LiveRoot {
+    validatePluginRootId(rootId);
+    let root = this.#roots.get(rootId);
+    if (!root) {
+      root = { id: rootId, context: this.root.extend({ makaRootId: rootId }), entries: [] };
+      this.#roots.set(rootId, root);
+    }
+    return root;
+  }
+
+  #inferRoot(parentId: string | undefined): MakaPluginRootId {
+    if (!parentId) return 'profile';
+    return this.#requireEntry(parentId).rootId;
+  }
+
+  async #insert(
+    rootId: MakaPluginRootId,
+    entry: MakaCompositionEntry,
+    parentId?: string,
+    position = Infinity,
+  ): Promise<LiveEntry> {
+    validatePluginRootId(rootId);
+    validateCompositionEntry(entry);
+    this.#assertUniqueSubtree(entry);
+    const root = this.#root(rootId);
+    const parent = parentId ? this.#requireEntry(parentId) : undefined;
+    if (parent && parent.rootId !== rootId)
+      throw new MakaPluginRuntimeError(
+        'invalid_entry',
+        'Composition entries cannot move between roots',
+      );
+    const live = await this.#stage(entry, rootId, parent, parent?.context ?? root.context, false);
+    await this.#commitSubtree(live);
+    const siblings = parent?.children ?? root.entries;
+    siblings.splice(Math.min(position, siblings.length), 0, live);
+    this.#index(live);
+    return live;
+  }
+
+  async #update(
+    entryId: string,
+    patch: Partial<Omit<MakaCompositionEntry, 'id' | 'children'>>,
+  ): Promise<LiveEntry> {
+    const current = this.#requireEntry(entryId);
+    const next = freezeEntry({
+      ...current.spec,
+      ...patch,
+      id: current.spec.id,
+      children: current.spec.children,
+    });
+    validateCompositionEntry(next);
+    const structural =
+      next.packageId !== current.spec.packageId ||
+      JSON.stringify(next.inject ?? null) !== JSON.stringify(current.spec.inject ?? null) ||
+      JSON.stringify(next.isolate ?? null) !== JSON.stringify(current.spec.isolate ?? null) ||
+      JSON.stringify(next.intercept ?? null) !== JSON.stringify(current.spec.intercept ?? null);
+    if (!structural && current.fiber && next.disabled !== true && current.spec.disabled !== true) {
+      await current.fiber.update(next.config);
+      current.spec = next;
+      current.diagnostic = undefined;
+      return current;
+    }
+    return this.#replace(current, next).then((inspection) => this.#requireEntry(inspection.id));
+  }
+
+  async #move(entryId: string, newParentId?: string, position = Infinity): Promise<LiveEntry> {
+    const entry = this.#requireEntry(entryId);
+    const parent = newParentId ? this.#requireEntry(newParentId) : undefined;
+    if (parent && parent.rootId !== entry.rootId)
+      throw new MakaPluginRuntimeError(
+        'invalid_entry',
+        'Composition entries cannot move between roots',
+      );
+    for (let ancestor = parent; ancestor; ancestor = ancestor.parent)
+      if (ancestor === entry)
+        throw new MakaPluginRuntimeError(
+          'dependency_cycle',
+          `Entry ${entryId} cannot contain itself`,
+        );
+    const source = entry.parent?.children ?? this.#root(entry.rootId).entries;
+    source.splice(source.indexOf(entry), 1);
+    entry.parent = parent;
+    const target = parent?.children ?? this.#root(entry.rootId).entries;
+    target.splice(Math.min(position, target.length), 0, entry);
+    await this.#rebind(entry);
+    return this.#requireEntry(entryId);
+  }
+
+  async #remove(entryId: string): Promise<void> {
+    const entry = this.#requireEntry(entryId);
+    const siblings = entry.parent?.children ?? this.#root(entry.rootId).entries;
+    siblings.splice(siblings.indexOf(entry), 1);
+    this.#unindex(entry);
+    await this.#dispose(entry);
+  }
+
+  #requireEntry(entryId: string): LiveEntry {
+    const entry = this.#entries.get(entryId);
+    if (!entry)
+      throw new MakaPluginRuntimeError(
+        'entry_not_found',
+        `Composition entry not found: ${entryId}`,
+      );
+    return entry;
+  }
+
+  #assertUniqueSubtree(entry: MakaCompositionEntry): void {
+    const local = new Set<string>();
+    for (const item of walk(entry)) {
+      if (local.has(item.id) || this.#entries.has(item.id))
+        throw new MakaPluginRuntimeError(
+          'entry_exists',
+          `Composition entry already exists: ${item.id}`,
+        );
+      local.add(item.id);
+    }
+  }
+
+  #index(entry: LiveEntry): void {
+    this.#entries.set(entry.spec.id, entry);
+    for (const child of entry.children) this.#index(child);
+  }
+
+  #unindex(entry: LiveEntry): void {
+    this.#entries.delete(entry.spec.id);
+    for (const child of entry.children) this.#unindex(child);
+  }
+
+  #inspect(entry: LiveEntry): MakaCompositionEntryInspection {
+    const inject = Array.isArray(entry.spec.inject)
+      ? entry.spec.inject
+      : Object.keys(entry.spec.inject ?? {});
+    const waitingFor =
+      entry.fiber?.state === FIBER_PENDING
+        ? inject.filter((name) => entry.context.get(name) === undefined)
+        : [];
+    return Object.freeze({
+      id: entry.spec.id,
+      rootId: entry.rootId,
+      ...(entry.parent ? { parentId: entry.parent.spec.id } : {}),
+      ...(entry.spec.packageId ? { packageId: entry.spec.packageId } : {}),
+      ...(entry.spec.config === undefined ? {} : { config: structuredClone(entry.spec.config) }),
+      disabled: isDisabled(entry),
+      status:
+        entry.spec.disabled === true
+          ? 'disabled'
+          : entry.fiber
+            ? fiberStateName(entry.fiber.state)
+            : 'active',
+      ...(entry.generation === undefined ? {} : { generation: entry.generation }),
+      waitingFor: Object.freeze(waitingFor),
+      effects: Object.freeze(entry.fiber?.getEffects().map(({ label }) => label) ?? []),
+      children: Object.freeze(entry.children.map((child) => this.#inspect(child))),
+      ...(entry.diagnostic ? { diagnostic: entry.diagnostic } : {}),
+    });
+  }
+
+  #isolationLabel(label: string): symbol {
+    let symbol = this.#isolationLabels.get(label);
+    if (!symbol) {
+      symbol = Symbol(label);
+      this.#isolationLabels.set(label, symbol);
+    }
+    return symbol;
+  }
+
+  #mutate<T>(operation: () => Promise<T>): Promise<T> {
+    const result = this.#mutation.then(operation, operation);
+    this.#mutation = result.then(
+      () => undefined,
+      () => undefined,
+    );
+    return result;
+  }
+}
+
+function entryPlugin(plugin: Plugin, inject: MakaCompositionEntry['inject']): Plugin {
+  const combined = mergeInject((plugin as Plugin.Base).inject, inject);
+  return {
+    name: (plugin as Plugin.Base).name ?? 'maka-entry',
+    ...(combined ? { inject: combined } : {}),
+    ...((plugin as Plugin.Base).Config ? { Config: (plugin as Plugin.Base).Config } : {}),
+    apply(ctx: Context, config: unknown) {
+      if (typeof plugin !== 'function') return plugin.apply(ctx, config as never);
+      if (isConstructor(plugin)) return Reflect.construct(plugin, [ctx, config]);
+      return (plugin as Plugin.Function)(ctx, config as never);
+    },
+  };
+}
+
+function isConstructor(value: Function): boolean {
+  return /^class\s/u.test(Function.prototype.toString.call(value));
+}
+
+function ancestors(entry: LiveEntry): LiveEntry[] {
+  const result: LiveEntry[] = [];
+  for (let current = entry.parent; current; current = current.parent) result.push(current);
+  return result;
+}
+
+function mergeInject(
+  left: Inject | undefined,
+  right: MakaCompositionEntry['inject'],
+): Inject | undefined {
+  if (!left && !right) return undefined;
+  const output: Record<string, unknown> = {};
+  for (const source of [left, right]) {
+    if (Array.isArray(source)) for (const name of source) output[name] = null;
+    else Object.assign(output, source ?? {});
+  }
+  return output;
+}
+
+function freezePackage(pkg: MakaPluginPackage): MakaPluginPackage {
+  return Object.freeze({ ...pkg, contributions: Object.freeze([...(pkg.contributions ?? [])]) });
+}
+
+function freezeEntry(entry: MakaCompositionEntry): MakaCompositionEntry {
+  return Object.freeze({
+    ...entry,
+    ...(entry.inject && !Array.isArray(entry.inject)
+      ? { inject: Object.freeze({ ...entry.inject }) }
+      : entry.inject
+        ? { inject: Object.freeze([...entry.inject]) }
+        : {}),
+    ...(entry.isolate ? { isolate: Object.freeze({ ...entry.isolate }) } : {}),
+    ...(entry.intercept ? { intercept: Object.freeze({ ...entry.intercept }) } : {}),
+    children: Object.freeze((entry.children ?? []).map(freezeEntry)),
+  });
+}
+
+function serialize(entry: LiveEntry): MakaCompositionEntry {
+  return freezeEntry({ ...entry.spec, children: entry.children.map(serialize) });
+}
+
+function* walk(entry: MakaCompositionEntry): Generator<MakaCompositionEntry> {
+  yield entry;
+  for (const child of entry.children ?? []) yield* walk(child);
+}
+
+function isWithin(entry: LiveEntry, root: LiveEntry): boolean {
+  for (let current: LiveEntry | undefined = entry; current; current = current.parent)
+    if (current === root) return true;
+  return false;
+}
+
+function isDisabled(entry: LiveEntry): boolean {
+  for (let current: LiveEntry | undefined = entry; current; current = current.parent) {
+    if (current.spec.disabled === true) return true;
+  }
+  return false;
+}
+
+function diagnostic(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
diff --git a/packages/runtime/src/plugin-hook-service.ts b/packages/runtime/src/plugin-hook-service.ts
new file mode 100644
index 0000000000..1b069906d8
--- /dev/null
+++ b/packages/runtime/src/plugin-hook-service.ts
@@ -0,0 +1,79 @@
+import { Service, type Context } from './plugin-kernel.js';
+import {
+  type ExtensionEventDefinition,
+  type ExtensionEventDefinitionInspection,
+  type ExtensionEventListenerContribution,
+  type ExtensionEventListenerInspection,
+  ExtensionEventContributionRegistry,
+} from './extension-event-contributions.js';
+import { pluginIdentity, registerPluginContribution } from './plugin-runtime.js';
+
+declare module './plugin-kernel.js' {
+  interface Context {
+    hooks: PluginHookService;
+  }
+}
+
+export class PluginHookService extends Service {
+  readonly registry = new ExtensionEventContributionRegistry();
+
+  constructor(ctx: Context) {
+    super(ctx, 'hooks');
+  }
+
+  define(definition: ExtensionEventDefinition): void {
+    const identity = pluginIdentity(this.ctx);
+    const registry = this.registry;
+    registerPluginContribution(this.ctx, `event:${definition.name}`, () =>
+      registry.registerEvent(identity as never, definition),
+    );
+  }
+
+  on(listener: ExtensionEventListenerContribution): void {
+    const identity = pluginIdentity(this.ctx);
+    const registry = this.registry;
+    registerPluginContribution(this.ctx, `listener:${listener.event}:${listener.id}`, () =>
+      registry.registerListener(identity as never, listener),
+    );
+  }
+
+  inspectEvents(
+    rootIds: readonly string[],
+    committed?: readonly { readonly entryId: string; readonly generation: number }[],
+  ): readonly ExtensionEventDefinitionInspection[] {
+    return this.registry.inspectEvents(rootIds, committed);
+  }
+
+  inspectListeners(
+    rootIds: readonly string[],
+    committed?: readonly { readonly entryId: string; readonly generation: number }[],
+  ): readonly ExtensionEventListenerInspection[] {
+    return this.registry.inspectListeners(rootIds, committed);
+  }
+
+  parsePayload(
+    rootIds: readonly string[],
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+    event: string,
+    payload: unknown,
+  ): unknown {
+    return this.registry.parsePayload(rootIds, committed, event, payload);
+  }
+
+  resolveDefinition(
+    rootIds: readonly string[],
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+    event: string,
+  ): ExtensionEventDefinitionInspection {
+    return this.registry.resolveDefinition(rootIds, committed, event);
+  }
+
+  parseResult(
+    rootIds: readonly string[],
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+    event: string,
+    result: unknown,
+  ): unknown {
+    return this.registry.parseResult(rootIds, committed, event, result);
+  }
+}
diff --git a/packages/runtime/src/plugin-kernel.ts b/packages/runtime/src/plugin-kernel.ts
new file mode 100644
index 0000000000..9e04a10c2a
--- /dev/null
+++ b/packages/runtime/src/plugin-kernel.ts
@@ -0,0 +1,885 @@
+export type Awaitable<T> = T | PromiseLike<T>;
+
+export type Disposable<T = void | Promise<void>> = () => T;
+
+export type Inject = readonly string[] | Readonly<Record<string, unknown>>;
+
+export const enum FiberState {
+  PENDING,
+  LOADING,
+  ACTIVE,
+  FAILED,
+  DISPOSED,
+  UNLOADING,
+}
+
+export interface EffectMeta {
+  readonly label: string;
+  readonly children: readonly EffectMeta[];
+}
+
+export interface StandardSchema {
+  readonly '~standard': {
+    validate(value: unknown):
+      | { readonly value: unknown; readonly issues?: undefined }
+      | { readonly issues: readonly { readonly message: string }[] }
+      | Promise<
+          | { readonly value: unknown; readonly issues?: undefined }
+          | { readonly issues: readonly { readonly message: string }[] }
+        >;
+  };
+}
+
+export type Plugin<T = unknown> =
+  | Plugin.Function<T>
+  | Plugin.Constructor<T>
+  | Plugin.Object<T>;
+
+export namespace Plugin {
+  export interface Base {
+    readonly name?: string;
+    readonly inject?: Inject;
+    readonly Config?: StandardSchema;
+  }
+
+  export type Function<T = unknown> = Base & ((ctx: Context, config: T) => unknown);
+
+  export type Constructor<T = unknown> = Base & (new (ctx: Context, config: T) => unknown);
+
+  export interface Object<T = unknown> extends Base {
+    apply(ctx: Context, config: T): unknown;
+  }
+}
+
+export interface EventOptions {
+  readonly prepend?: boolean;
+  readonly global?: boolean;
+}
+
+interface ServiceImplementation {
+  readonly name: string;
+  readonly label: symbol;
+  readonly fiber: Fiber;
+  value: unknown;
+  readonly check?: () => boolean;
+}
+
+interface Hook {
+  readonly context: Context;
+  readonly listener: (...args: unknown[]) => unknown;
+  readonly global: boolean;
+}
+
+interface Accessor {
+  readonly owner: Fiber;
+  readonly get: (this: Context, receiver: unknown) => unknown;
+  readonly set?: (this: Context, value: unknown, receiver: unknown) => boolean;
+}
+
+interface PluginRuntime {
+  readonly callback: Function;
+  readonly fibers: Set<Fiber>;
+  readonly name?: string;
+  readonly Config?: StandardSchema;
+}
+
+interface KernelState {
+  readonly root: Context;
+  readonly services: Map<symbol, ServiceImplementation>;
+  readonly serviceLabels: Map<string, symbol>;
+  readonly runtimes: Map<Function, PluginRuntime>;
+  readonly listeners: Map<PropertyKey, Hook[]>;
+  readonly accessors: Map<PropertyKey, Accessor>;
+  readonly fibers: Set<Fiber>;
+  nextFiberId: number;
+  closed: boolean;
+}
+
+const contextBrand = Symbol.for('maka.plugin-kernel.context');
+const effectMeta = Symbol('maka.plugin-kernel.effect-meta');
+
+export interface Logger {
+  readonly name: string;
+  error(value: unknown, ...values: unknown[]): void;
+  warn(value: unknown, ...values: unknown[]): void;
+  info(value: unknown, ...values: unknown[]): void;
+  debug(value: unknown, ...values: unknown[]): void;
+}
+
+export interface LoggerService extends Logger {
+  (name?: string): Logger;
+}
+
+export interface Context {
+  root: Context;
+  parent?: Context;
+  fiber: Fiber;
+  readonly logger: LoggerService;
+  [Context.filter]?: (listenerContext: Context) => boolean;
+}
+
+export class Context {
+  static readonly effect = effectMeta;
+  static readonly filter = Symbol('maka.plugin-kernel.filter');
+
+  readonly [contextBrand] = true;
+  readonly #kernel: KernelState;
+  readonly #isolation: Readonly<Record<string, symbol>>;
+  readonly #intercepts: Readonly<Record<string, readonly unknown[]>>;
+  readonly #proxy: Context;
+
+  static is(value: unknown): value is Context {
+    return Boolean((value as { readonly [contextBrand]?: boolean } | undefined)?.[contextBrand]);
+  }
+
+  constructor();
+  constructor(
+    kernel?: KernelState,
+    parent?: Context,
+    fiber?: Fiber,
+    isolation?: Readonly<Record<string, symbol>>,
+    intercepts?: Readonly<Record<string, readonly unknown[]>>,
+    meta?: object,
+  );
+  constructor(
+    kernel?: KernelState,
+    parent?: Context,
+    fiber?: Fiber,
+    isolation?: Readonly<Record<string, symbol>>,
+    intercepts?: Readonly<Record<string, readonly unknown[]>>,
+    meta: object = {},
+  ) {
+    this.parent = parent;
+    this.#isolation = isolation ?? parent?._isolation() ?? Object.freeze({});
+    this.#intercepts = intercepts ?? parent?._intercepts() ?? Object.freeze({});
+    if (kernel) {
+      this.#kernel = kernel;
+      this.root = kernel.root;
+      this.fiber = fiber ?? parent?.fiber ?? kernel.root.fiber;
+    } else {
+      const placeholder = {} as KernelState;
+      this.#kernel = placeholder;
+      this.root = this;
+      const rootFiber = Fiber.root(this);
+      this.fiber = rootFiber;
+      Object.assign(placeholder, {
+        root: this,
+        services: new Map(),
+        serviceLabels: new Map(),
+        runtimes: new Map(),
+        listeners: new Map(),
+        accessors: new Map(),
+        fibers: new Set([rootFiber]),
+        nextFiberId: 0,
+        closed: false,
+      } satisfies KernelState);
+    }
+    Object.assign(this, meta);
+    Object.defineProperty(this, 'logger', {
+      enumerable: true,
+      configurable: false,
+      value: createLoggerService(() => this.fiber.name),
+    });
+    this.#proxy = new Proxy(this, contextProxy);
+    return this.#proxy;
+  }
+
+  extend(meta: object = {}): this {
+    this.#assertOpen();
+    return new Context(
+      this.#kernel,
+      this,
+      this.fiber,
+      this.#isolation,
+      this.#intercepts,
+      meta,
+    ) as this;
+  }
+
+  isolate(name: string, label = Symbol(name)): this {
+    validateServiceName(name);
+    return new Context(
+      this.#kernel,
+      this,
+      this.fiber,
+      Object.freeze({ ...this.#isolation, [name]: label }),
+      this.#intercepts,
+    ) as this;
+  }
+
+  intercept(name: string, config: unknown): this {
+    validateServiceName(name);
+    const existing = this.#intercepts[name] ?? [];
+    return new Context(
+      this.#kernel,
+      this,
+      this.fiber,
+      this.#isolation,
+      Object.freeze({ ...this.#intercepts, [name]: Object.freeze([...existing, config]) }),
+    ) as this;
+  }
+
+  plugin<P extends Plugin>(plugin: P, config?: unknown): Fiber & PromiseLike<Fiber> {
+    this.#assertOpen();
+    const callback = resolvePlugin(plugin);
+    let runtime = this.#kernel.runtimes.get(callback);
+    if (!runtime) {
+      runtime = {
+        callback,
+        fibers: new Set(),
+        name: plugin.name,
+        Config: plugin.Config,
+      };
+      this.#kernel.runtimes.set(callback, runtime);
+    }
+    const fiber = new Fiber(this, plugin, config, normalizeInject(plugin.inject), runtime);
+    return new Proxy(fiber, {
+      get(target, property, receiver) {
+        if (property === 'then') {
+          return <TResult1 = Fiber, TResult2 = never>(
+            onFulfilled?: ((value: Fiber) => TResult1 | PromiseLike<TResult1>) | null,
+            onRejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,
+          ): PromiseLike<TResult1 | TResult2> =>
+            target.await().then(
+              () => (onFulfilled ? onFulfilled(target) : (target as unknown as TResult1)),
+              onRejected ?? undefined,
+            );
+        }
+        const value = Reflect.get(target, property, receiver);
+        return typeof value === 'function' ? value.bind(target) : value;
+      },
+    }) as Fiber & PromiseLike<Fiber>;
+  }
+
+  inject(inject: Inject, callback: Plugin.Function<void>): Fiber & PromiseLike<Fiber> {
+    return this.plugin(Object.assign(callback, { inject }));
+  }
+
+  effect(execute: () => unknown, label = 'anonymous'): Disposable<Promise<void>> {
+    return this.fiber.effect(execute, label);
+  }
+
+  provide(name: string, value?: unknown, check?: () => boolean): Disposable<Promise<void>> {
+    validateServiceName(name);
+    const label = this.#label(name);
+    if (this.#kernel.services.has(label)) {
+      throw new Error(`Service is already provided in this scope: ${name}`);
+    }
+    return this.effect(() => {
+      const implementation: ServiceImplementation = {
+        name,
+        label,
+        value,
+        fiber: this.fiber,
+        check,
+      };
+      this.#kernel.services.set(label, implementation);
+      this.#notifyService(name, label);
+      return async () => {
+        if (this.#kernel.services.get(label) !== implementation) return;
+        this.#kernel.services.delete(label);
+        await Promise.allSettled(this.#notifyService(name, label).map((fiber) => fiber.await()));
+      };
+    }, `ctx.provide(${JSON.stringify(name)})`);
+  }
+
+  get<T = unknown>(name: string, strict = true): T | undefined {
+    const implementation = this.#implementation(name);
+    if (!implementation) return undefined;
+    if (strict && implementation.fiber.state !== FiberState.ACTIVE) return undefined;
+    if (implementation.check && !implementation.check.call(implementation.value)) return undefined;
+    return (implementation.value instanceof Service
+      ? implementation.value._bind(this.#proxy)
+      : implementation.value) as T;
+  }
+
+  set(name: string, value: unknown): boolean {
+    const implementation = this.#implementation(name);
+    if (!implementation) throw new Error(`Cannot set missing Service: ${name}`);
+    if (implementation.fiber !== this.fiber) {
+      throw new Error(`Cannot mutate Service owned by another Fiber: ${name}`);
+    }
+    implementation.value = value;
+    this.#notifyService(name, implementation.label);
+    return true;
+  }
+
+  accessor(
+    name: string,
+    options: {
+      readonly get: (this: Context, receiver: unknown) => unknown;
+      readonly set?: (this: Context, value: unknown, receiver: unknown) => boolean;
+    },
+  ): Disposable<Promise<void>> {
+    if (this.#kernel.accessors.has(name)) throw new Error(`Context property already exists: ${name}`);
+    return this.effect(() => {
+      const accessor = { owner: this.fiber, ...options };
+      this.#kernel.accessors.set(name, accessor);
+      return () => {
+        if (this.#kernel.accessors.get(name) === accessor) this.#kernel.accessors.delete(name);
+      };
+    }, `ctx.accessor(${JSON.stringify(name)})`);
+  }
+
+  mixin(source: string | object, names: readonly string[] | Readonly<Record<string, string>>): void {
+    const entries = Array.isArray(names)
+      ? names.map((name) => [name, name] as const)
+      : Object.entries(names);
+    for (const [sourceName, targetName] of entries) {
+      this.accessor(targetName, {
+        get(receiver) {
+          const target = typeof source === 'string' ? this.get(source) : source;
+          const value = Reflect.get(target as object, sourceName, receiver ?? target);
+          return typeof value === 'function' ? value.bind(target) : value;
+        },
+        set(value, receiver) {
+          const target = typeof source === 'string' ? this.get(source) : source;
+          return Reflect.set(target as object, sourceName, value, receiver ?? target);
+        },
+      });
+    }
+  }
+
+  on(
+    name: PropertyKey,
+    listener: (...args: unknown[]) => unknown,
+    options: boolean | EventOptions = {},
+  ): Disposable<boolean> {
+    this.#assertOpen();
+    const normalized = typeof options === 'boolean' ? { prepend: options } : options;
+    const hook: Hook = { context: this, listener, global: normalized.global === true };
+    const hooks = this.#kernel.listeners.get(name) ?? [];
+    if (normalized.prepend) hooks.unshift(hook);
+    else hooks.push(hook);
+    this.#kernel.listeners.set(name, hooks);
+    let active = true;
+    const unregister = () => {
+      if (!active) return false;
+      active = false;
+      const index = hooks.indexOf(hook);
+      if (index >= 0) hooks.splice(index, 1);
+      if (!hooks.length) this.#kernel.listeners.delete(name);
+      return index >= 0;
+    };
+    this.effect(() => unregister, `ctx.on(${String(name)})`);
+    return unregister;
+  }
+
+  once(
+    name: PropertyKey,
+    listener: (...args: unknown[]) => unknown,
+    options: boolean | EventOptions = {},
+  ): Disposable<boolean> {
+    let unregister: Disposable<boolean>;
+    unregister = this.on(
+      name,
+      (...args) => {
+        unregister();
+        return listener(...args);
+      },
+      options,
+    );
+    return unregister;
+  }
+
+  emit(...input: unknown[]): void {
+    const { hooks, args } = this.#dispatch(input);
+    for (const hook of hooks) hook.listener(...args);
+  }
+
+  async parallel(...input: unknown[]): Promise<void> {
+    const { hooks, args } = this.#dispatch(input);
+    const settled = await Promise.allSettled(hooks.map((hook) => hook.listener(...args)));
+    const errors = settled
+      .filter((result): result is PromiseRejectedResult => result.status === 'rejected')
+      .map(({ reason }) => reason);
+    if (errors.length) throw new AggregateError(errors);
+  }
+
+  async serial(...input: unknown[]): Promise<unknown> {
+    const { hooks, args } = this.#dispatch(input);
+    for (const hook of hooks) {
+      const result = await hook.listener(...args);
+      if (result !== undefined && result !== null && result !== false) return result;
+    }
+  }
+
+  bail(...input: unknown[]): unknown {
+    const { hooks, args } = this.#dispatch(input);
+    for (const hook of hooks) {
+      const result = hook.listener(...args);
+      if (result !== undefined && result !== null && result !== false) return result;
+    }
+  }
+
+  waterfall(...input: unknown[]): unknown {
+    const { hooks, args } = this.#dispatch(input);
+    const terminal = args.pop();
+    if (typeof terminal !== 'function') throw new TypeError('Waterfall requires a terminal callback');
+    const callbacks = hooks.map(({ listener }) => listener);
+    const next = (): unknown => {
+      const callback = callbacks.shift() ?? terminal;
+      return callback(...args, next);
+    };
+    return next();
+  }
+
+  interceptConfig(name: string): readonly unknown[] {
+    return this.#intercepts[name] ?? [];
+  }
+
+  kernelFibers(): readonly Fiber[] {
+    return Object.freeze([...this.#kernel.fibers]);
+  }
+
+  #dispatch(input: readonly unknown[]): { readonly hooks: readonly Hook[]; readonly args: unknown[] } {
+    const args = [...input];
+    const thisArg = Context.is(args[0]) ? (args.shift() as Context) : undefined;
+    const name = args.shift();
+    if (typeof name !== 'string' && typeof name !== 'symbol') {
+      throw new TypeError('Event name must be a string or symbol');
+    }
+    const filter = thisArg?.[Context.filter];
+    const hooks = (this.#kernel.listeners.get(name) ?? []).filter(
+      (hook) => hook.global || !filter || filter(hook.context),
+    );
+    return { hooks, args };
+  }
+
+  #implementation(name: string): ServiceImplementation | undefined {
+    return this.#kernel.services.get(this.#label(name));
+  }
+
+  #label(name: string): symbol {
+    const isolated = this.#isolation[name];
+    if (isolated) return isolated;
+    let label = this.#kernel.serviceLabels.get(name);
+    if (!label) {
+      label = Symbol(name);
+      this.#kernel.serviceLabels.set(name, label);
+    }
+    return label;
+  }
+
+  #notifyService(name: string, label: symbol): Fiber[] {
+    const fibers: Fiber[] = [];
+    for (const fiber of this.#kernel.fibers) {
+      if (!fiber.requires(name) || fiber.serviceLabel(name) !== label) continue;
+      fiber.refreshDependencies();
+      fibers.push(fiber);
+    }
+    return fibers;
+  }
+
+  #assertOpen(): void {
+    if (this.#kernel.closed || this.fiber.state === FiberState.DISPOSED) {
+      throw new Error('Plugin Context is disposed');
+    }
+  }
+
+  _kernel(): KernelState {
+    return this.#kernel;
+  }
+
+  _label(name: string): symbol {
+    return this.#label(name);
+  }
+
+  _isolation(): Readonly<Record<string, symbol>> {
+    return this.#isolation;
+  }
+
+  _intercepts(): Readonly<Record<string, readonly unknown[]>> {
+    return this.#intercepts;
+  }
+}
+
+const contextProxy: ProxyHandler<Context> = {
+  get(target, property, receiver) {
+    if (Reflect.has(target, property)) {
+      const value = Reflect.get(target, property, receiver);
+      return typeof value === 'function' && Object.hasOwn(Context.prototype, property)
+        ? value.bind(target)
+        : value;
+    }
+    const accessor = target._kernel().accessors.get(property);
+    if (accessor) return accessor.get.call(receiver as Context, receiver);
+    if (typeof property === 'string') {
+      const service = target.get(property);
+      if (service !== undefined) return service;
+    }
+    for (let ancestor = target.parent; ancestor; ancestor = ancestor.parent) {
+      if (Object.hasOwn(ancestor, property)) return Reflect.get(ancestor, property);
+    }
+  },
+  set(target, property, value, receiver) {
+    if (Reflect.has(target, property)) return Reflect.set(target, property, value, receiver);
+    const accessor = target._kernel().accessors.get(property);
+    if (accessor?.set) return accessor.set.call(receiver as Context, value, receiver);
+    if (typeof property === 'string' && target.get(property, false) !== undefined) {
+      return target.set(property, value);
+    }
+    return Reflect.set(target, property, value, receiver);
+  },
+  has(target, property) {
+    return (
+      Reflect.has(target, property) ||
+      target._kernel().accessors.has(property) ||
+      (typeof property === 'string' && target.get(property, false) !== undefined) ||
+      hasAncestorProperty(target.parent, property)
+    );
+  },
+};
+
+function hasAncestorProperty(context: Context | undefined, property: PropertyKey): boolean {
+  for (let ancestor = context; ancestor; ancestor = ancestor.parent) {
+    if (Object.hasOwn(ancestor, property)) return true;
+  }
+  return false;
+}
+
+export class Fiber {
+  readonly id: number;
+  readonly ctx: Context;
+  readonly parent: Context;
+  readonly plugin?: Plugin;
+  readonly inject: Readonly<Record<string, unknown>>;
+  state: FiberState;
+  config: unknown;
+  inertia?: Promise<void>;
+  error?: unknown;
+
+  readonly #runtime?: PluginRuntime;
+  readonly #children = new Set<Fiber>();
+  readonly #effects: Array<Disposable<Awaitable<void>> & { [effectMeta]?: EffectMeta }> = [];
+  readonly #services = new Map<string, unknown>();
+  #disposed = false;
+  #transition: Promise<void> = Promise.resolve();
+
+  static root(context: Context): Fiber {
+    return new Fiber(context, undefined, undefined, {}, undefined, true);
+  }
+
+  constructor(
+    parent: Context,
+    plugin: Plugin | undefined,
+    config: unknown,
+    inject: Readonly<Record<string, unknown>>,
+    runtime: PluginRuntime | undefined,
+    root = false,
+  ) {
+    this.parent = parent;
+    this.plugin = plugin;
+    this.config = config;
+    this.inject = inject;
+    this.#runtime = runtime;
+    const kernel = parent._kernel();
+    this.id = root ? 0 : ++kernel.nextFiberId;
+    this.state = root ? FiberState.ACTIVE : FiberState.PENDING;
+    this.ctx = root
+      ? parent
+      : new Context(
+          kernel,
+          parent,
+          this,
+          undefined,
+          undefined,
+        );
+    if (!root) {
+      kernel.fibers.add(this);
+      runtime?.fibers.add(this);
+      parent.fiber.#children.add(this);
+      this.refreshDependencies();
+    }
+  }
+
+  get name(): string {
+    return this.#runtime?.name || this.plugin?.name || (this.id === 0 ? 'root' : `plugin-${this.id}`);
+  }
+
+  requires(name: string): boolean {
+    return Object.hasOwn(this.inject, name);
+  }
+
+  serviceLabel(name: string): symbol {
+    return this.ctx._label(name);
+  }
+
+  refreshDependencies(): void {
+    if (this.#disposed || !this.plugin) return;
+    const next = new Map<string, unknown>();
+    for (const name of Object.keys(this.inject)) {
+      const implementation = this.ctx.get(name);
+      if (implementation === undefined) {
+        this.#services.clear();
+        if (this.state === FiberState.ACTIVE || this.state === FiberState.FAILED) {
+          this.#enqueue(async () => {
+            await this.#unload(FiberState.PENDING);
+          });
+        } else {
+          this.#setState(FiberState.PENDING);
+        }
+        return;
+      }
+      next.set(name, implementation);
+    }
+    const changed =
+      next.size !== this.#services.size ||
+      [...next].some(([name, value]) => this.#services.get(name) !== value);
+    this.#services.clear();
+    for (const [name, value] of next) this.#services.set(name, value);
+    if (this.state === FiberState.PENDING || this.state === FiberState.FAILED) {
+      this.#enqueue(() => this.#load());
+    } else if (this.state === FiberState.ACTIVE && changed) {
+      this.#enqueue(async () => {
+        await this.#unload(FiberState.PENDING);
+        await this.#load();
+      });
+    }
+  }
+
+  effect(execute: () => unknown, label = 'anonymous'): Disposable<Promise<void>> {
+    if (this.#disposed || this.state === FiberState.UNLOADING) {
+      throw new Error('Cannot create an Effect on an inactive Fiber');
+    }
+    const disposers: Disposable<Awaitable<void>>[] = [];
+    let setup: unknown;
+    let disposed = false;
+    const collect = (value: unknown): void => {
+      if (typeof value === 'function') disposers.push(value as Disposable<Awaitable<void>>);
+      else if (value !== undefined && value !== null) {
+        throw new TypeError('Plugin Effect must return a disposer');
+      }
+    };
+    const run = async (): Promise<void> => {
+      const result = execute();
+      setup = result;
+      if (isAsyncIterable(result)) {
+        for await (const value of result) collect(value);
+      } else if (isIterable(result)) {
+        for (const value of result) collect(value);
+      } else {
+        collect(await result);
+      }
+    };
+    const setupTask = run();
+    const dispose = Object.assign(async () => {
+      if (disposed) return;
+      disposed = true;
+      await setupTask.catch(() => undefined);
+      for (const cleanup of disposers.reverse()) await cleanup();
+      const index = this.#effects.indexOf(dispose);
+      if (index >= 0) this.#effects.splice(index, 1);
+    }, { [effectMeta]: Object.freeze({ label, children: Object.freeze([]) }) });
+    this.#effects.push(dispose);
+    setupTask.catch(async (error) => {
+      await dispose();
+      this.error = error;
+    });
+    void setup;
+    return dispose;
+  }
+
+  getEffects(): readonly EffectMeta[] {
+    return Object.freeze(
+      this.#effects.flatMap((dispose) => (dispose[effectMeta] ? [dispose[effectMeta]] : [])),
+    );
+  }
+
+  async await(): Promise<void> {
+    await this.inertia;
+    if (this.state === FiberState.FAILED) throw this.error;
+  }
+
+  async restart(): Promise<void> {
+    if (this.#disposed) throw new Error('Cannot restart a disposed Fiber');
+    await this.#enqueue(async () => {
+      await this.#unload(FiberState.PENDING);
+      if (this.#dependenciesAvailable()) await this.#load();
+    });
+  }
+
+  async update(config: unknown): Promise<void> {
+    if (this.#disposed) throw new Error('Cannot update a disposed Fiber');
+    const previous = this.config;
+    this.config = config;
+    try {
+      await this.restart();
+    } catch (error) {
+      this.config = previous;
+      throw error;
+    }
+  }
+
+  async dispose(): Promise<void> {
+    if (this.#disposed) return this.inertia;
+    this.#disposed = true;
+    await this.#enqueue(async () => {
+      await this.#unload(FiberState.DISPOSED);
+      const kernel = this.parent._kernel();
+      kernel.fibers.delete(this);
+      this.#runtime?.fibers.delete(this);
+      this.parent.fiber.#children.delete(this);
+      if (this.id === 0) kernel.closed = true;
+    });
+  }
+
+  #enqueue(operation: () => Promise<void>): Promise<void> {
+    const task = this.#transition.then(operation, operation);
+    this.#transition = task.catch(() => undefined);
+    const settled = task.finally(() => {
+      if (this.inertia === settled) this.inertia = undefined;
+    });
+    this.inertia = settled;
+    return settled;
+  }
+
+  async #load(): Promise<void> {
+    if (this.#disposed || !this.plugin || !this.#dependenciesAvailable()) return;
+    this.error = undefined;
+    this.#setState(FiberState.LOADING);
+    try {
+      const config = await validateConfig(this.#runtime?.Config, this.config);
+      this.config = config;
+      const output = await invokePlugin(this.plugin, this.ctx, config);
+      if (typeof output === 'function') this.effect(() => output, `plugin:${this.name}`);
+      else if (
+        output !== undefined &&
+        output !== null &&
+        !(typeof this.plugin === 'function' && isConstructor(this.plugin))
+      ) {
+        throw new TypeError('Plugin must return a disposer or nothing');
+      }
+      this.#setState(FiberState.ACTIVE);
+    } catch (error) {
+      this.error = error;
+      await this.#disposeEffects();
+      this.#setState(FiberState.FAILED);
+      throw error;
+    }
+  }
+
+  async #unload(nextState: FiberState): Promise<void> {
+    if (this.state === FiberState.DISPOSED) return;
+    this.#setState(FiberState.UNLOADING);
+    await Promise.allSettled([...this.#children].reverse().map((child) => child.dispose()));
+    await this.#disposeEffects();
+    this.#setState(nextState);
+  }
+
+  async #disposeEffects(): Promise<void> {
+    for (const dispose of [...this.#effects].reverse()) await dispose();
+  }
+
+  #dependenciesAvailable(): boolean {
+    return Object.keys(this.inject).every((name) => this.ctx.get(name) !== undefined);
+  }
+
+  #setState(state: FiberState): void {
+    const previous = this.state;
+    this.state = state;
+    if (previous !== state) this.ctx.emit('internal/status', this, previous);
+  }
+}
+
+export abstract class Service<T = unknown> {
+  readonly name: string;
+  readonly #contexts = new WeakMap<Context, this>();
+
+  constructor(protected readonly ctx: Context, name: string) {
+    this.name = name;
+    ctx.provide(name, this);
+  }
+
+  _bind(context: Context): this {
+    const cached = this.#contexts.get(context);
+    if (cached) return cached;
+    const bound = new Proxy(this, {
+      get: (target, property, receiver) => {
+        if (property === 'ctx') return context;
+        const value = Reflect.get(target, property, receiver);
+        return typeof value === 'function' ? value.bind(receiver) : value;
+      },
+    });
+    this.#contexts.set(context, bound);
+    return bound;
+  }
+
+  protected resolveConfig(base?: T, head?: T): T {
+    const values = [base, ...this.ctx.interceptConfig(this.name), head].filter(
+      (value): value is T => value !== undefined,
+    );
+    return Object.assign({}, ...values);
+  }
+}
+
+function normalizeInject(inject: Inject | undefined): Readonly<Record<string, unknown>> {
+  if (!inject) return Object.freeze({});
+  if (Array.isArray(inject)) {
+    return Object.freeze(Object.fromEntries(inject.map((name) => [name, null])));
+  }
+  return Object.freeze({ ...inject });
+}
+
+function resolvePlugin(plugin: Plugin): Function {
+  if (typeof plugin === 'function') return plugin;
+  if (plugin && typeof plugin.apply === 'function') return plugin.apply;
+  throw new TypeError('Plugin must be a function, class, or object with apply()');
+}
+
+async function invokePlugin(plugin: Plugin, context: Context, config: unknown): Promise<unknown> {
+  if (typeof plugin === 'function') {
+    if (isConstructor(plugin)) return Reflect.construct(plugin, [context, config]);
+    return (plugin as Plugin.Function)(context, config);
+  }
+  return plugin.apply(context, config);
+}
+
+function isConstructor(value: Function): boolean {
+  return /^class\s/u.test(Function.prototype.toString.call(value));
+}
+
+async function validateConfig(schema: StandardSchema | undefined, value: unknown): Promise<unknown> {
+  if (!schema) return value;
+  const result = await schema['~standard'].validate(value);
+  if ('issues' in result && result.issues) {
+    throw new TypeError(result.issues.map(({ message }) => message).join('; '));
+  }
+  return result.value;
+}
+
+function validateServiceName(name: string): void {
+  if (!/^[A-Za-z][A-Za-z0-9._:-]*$/u.test(name)) throw new TypeError(`Invalid Service name: ${name}`);
+}
+
+function isIterable(value: unknown): value is Iterable<unknown> {
+  return Boolean(value && typeof (value as Iterable<unknown>)[Symbol.iterator] === 'function');
+}
+
+function isAsyncIterable(value: unknown): value is AsyncIterable<unknown> {
+  return Boolean(
+    value && typeof (value as AsyncIterable<unknown>)[Symbol.asyncIterator] === 'function',
+  );
+}
+
+function createLoggerService(name: () => string): LoggerService {
+  const create = (explicit?: string): Logger => {
+    const loggerName = explicit || name();
+    return {
+      name: loggerName,
+      error: (value, ...values) => console.error(`[${loggerName}]`, value, ...values),
+      warn: (value, ...values) => console.warn(`[${loggerName}]`, value, ...values),
+      info: (value, ...values) => console.info(`[${loggerName}]`, value, ...values),
+      debug: (value, ...values) => console.debug(`[${loggerName}]`, value, ...values),
+    };
+  };
+  const callable = ((explicit?: string) => create(explicit)) as LoggerService;
+  Object.defineProperties(callable, {
+    name: { value: 'logger' },
+    error: { value: (value: unknown, ...values: unknown[]) => create().error(value, ...values) },
+    warn: { value: (value: unknown, ...values: unknown[]) => create().warn(value, ...values) },
+    info: { value: (value: unknown, ...values: unknown[]) => create().info(value, ...values) },
+    debug: { value: (value: unknown, ...values: unknown[]) => create().debug(value, ...values) },
+  });
+  return callable;
+}
diff --git a/packages/runtime/src/plugin-runtime.ts b/packages/runtime/src/plugin-runtime.ts
new file mode 100644
index 0000000000..88da13801f
--- /dev/null
+++ b/packages/runtime/src/plugin-runtime.ts
@@ -0,0 +1,345 @@
+import type { Context, FiberState, Plugin } from './plugin-kernel.js';
+
+const ID_PATTERN = /^[a-z][a-z0-9]*(?:[._:-][a-z0-9]+)*$/u;
+
+export type MakaPluginRootId = 'profile' | 'desktop-ui' | `session:${string}`;
+
+export interface MakaPluginPackage {
+  readonly packageId: string;
+  readonly host?: Plugin;
+  readonly client?: Plugin;
+  readonly contributions?: readonly MakaPluginContribution[];
+}
+
+export interface MakaPluginContribution {
+  readonly id: string;
+  readonly kind: 'tool' | 'ui' | 'hook' | 'service' | 'timer' | string;
+}
+
+export interface MakaCompositionEntry {
+  readonly id: string;
+  readonly packageId?: string;
+  readonly config?: unknown;
+  readonly disabled?: boolean;
+  readonly inject?: readonly string[] | Readonly<Record<string, unknown>>;
+  readonly isolate?: Readonly<Record<string, true | string>>;
+  readonly intercept?: Readonly<Record<string, unknown>>;
+  readonly children?: readonly MakaCompositionEntry[];
+}
+
+export interface MakaCompositionSnapshot {
+  readonly schemaVersion: 1;
+  readonly generation: number;
+  readonly roots: {
+    readonly profile: readonly MakaCompositionEntry[];
+    readonly desktopUi: readonly MakaCompositionEntry[];
+    readonly sessions: Readonly<Record<string, readonly MakaCompositionEntry[]>>;
+  };
+}
+
+export type MakaCompositionOperation =
+  | {
+      readonly type: 'insert';
+      readonly rootId?: MakaPluginRootId;
+      readonly parentId?: string;
+      readonly entry: MakaCompositionEntry;
+      readonly position?: number;
+    }
+  | {
+      readonly type: 'update';
+      readonly entryId: string;
+      readonly patch: Partial<Omit<MakaCompositionEntry, 'id' | 'children'>>;
+    }
+  | {
+      readonly type: 'move';
+      readonly entryId: string;
+      readonly parentId?: string;
+      readonly position?: number;
+    }
+  | { readonly type: 'remove'; readonly entryId: string };
+
+export interface MakaCompositionApplyInput {
+  readonly baseGeneration?: number;
+  readonly operations: readonly MakaCompositionOperation[];
+}
+
+export type MakaCompositionEntryStatus =
+  | 'disabled'
+  | 'pending'
+  | 'loading'
+  | 'active'
+  | 'failed'
+  | 'unloading'
+  | 'disposed';
+
+export interface MakaCompositionEntryInspection {
+  readonly id: string;
+  readonly rootId: MakaPluginRootId;
+  readonly parentId?: string;
+  readonly packageId?: string;
+  readonly config?: unknown;
+  readonly disabled: boolean;
+  readonly status: MakaCompositionEntryStatus;
+  readonly generation?: number;
+  readonly waitingFor: readonly string[];
+  readonly effects: readonly string[];
+  readonly children: readonly MakaCompositionEntryInspection[];
+  readonly diagnostic?: string;
+}
+
+export interface MakaPluginMountInput {
+  readonly entryId: string;
+  readonly rootId: string;
+  readonly packageId: string;
+  readonly config?: unknown;
+}
+
+export interface MakaPluginMountInspection {
+  readonly entryId: string;
+  readonly rootId: string;
+  readonly packageId: string;
+  readonly enabled: boolean;
+  readonly status: MakaCompositionEntryStatus;
+  readonly current?: { readonly generation: number };
+  readonly waitingFor: readonly string[];
+  readonly pendingCleanupEffects: number;
+  readonly diagnostic?: { readonly message: string };
+}
+
+export interface MakaRuntimeCompositionEntry {
+  readonly entryId: string;
+  readonly packageId: string;
+  readonly generation: number;
+  readonly contributions: readonly MakaPluginContribution[];
+}
+
+export interface MakaRuntimeCompositionSnapshot {
+  readonly schemaVersion: 1;
+  readonly rootId: string;
+  readonly digest: `sha256:${string}`;
+  readonly entries: readonly MakaRuntimeCompositionEntry[];
+}
+
+export interface MakaPluginMetadata {
+  readonly rootId: MakaPluginRootId;
+  readonly entryId: string;
+  readonly packageId: string;
+  readonly generation: number;
+}
+
+export interface MakaContributionIdentity {
+  readonly entryId: string;
+  readonly scopeId: string;
+  readonly extensionId: string;
+  readonly generation: number;
+}
+
+export interface MakaContributionContext extends MakaContributionIdentity {
+  readonly signal: AbortSignal;
+  readonly runtimeContext: Context;
+  ownEffect(label: string, dispose: () => void | Promise<void>): void;
+  dependency<T = unknown>(packageId: string): T;
+}
+
+export interface MakaPluginTransaction {
+  stage(label: string, register: () => () => void | Promise<void>, owner?: Context): void;
+  commit(): void | Promise<void>;
+  rollback(): void | Promise<void>;
+}
+
+declare module './plugin-kernel.js' {
+  interface Context {
+    maka?: MakaPluginMetadata;
+    makaTransaction?: MakaPluginTransaction;
+  }
+}
+
+export class MakaPluginRuntimeError extends Error {
+  readonly name = 'MakaPluginRuntimeError';
+
+  constructor(
+    readonly code:
+      | 'invalid_package'
+      | 'package_exists'
+      | 'package_not_found'
+      | 'package_in_use'
+      | 'invalid_entry'
+      | 'entry_exists'
+      | 'entry_not_found'
+      | 'dependency_cycle'
+      | 'activation_failed',
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+export function validatePluginPackage(pkg: MakaPluginPackage): void {
+  validatePluginId(pkg.packageId, 'packageId');
+  if (!pkg.host && !pkg.client) {
+    throw new MakaPluginRuntimeError(
+      'invalid_package',
+      `Plugin package ${pkg.packageId} has no host or client plugin`,
+    );
+  }
+}
+
+export function validateCompositionEntry(entry: MakaCompositionEntry): void {
+  validatePluginId(entry.id, 'entry id');
+  if (entry.packageId !== undefined) {
+    validatePluginId(entry.packageId!, 'packageId');
+  }
+  for (const key of Object.keys(entry.isolate ?? {})) validateServiceName(key);
+  for (const key of Object.keys(entry.intercept ?? {})) validateServiceName(key);
+  for (const dependency of Array.isArray(entry.inject)
+    ? entry.inject
+    : Object.keys(entry.inject ?? {})) {
+    validateServiceName(dependency);
+  }
+  const childIds = new Set<string>();
+  for (const child of entry.children ?? []) {
+    validateCompositionEntry(child);
+    if (childIds.has(child.id)) {
+      throw new MakaPluginRuntimeError(
+        'entry_exists',
+        `Entry ${entry.id} repeats child ${child.id}`,
+      );
+    }
+    childIds.add(child.id);
+  }
+}
+
+export function validatePluginRootId(rootId: string): asserts rootId is MakaPluginRootId {
+  if (
+    rootId !== 'profile' &&
+    rootId !== 'desktop-ui' &&
+    !(rootId.startsWith('session:') && rootId.length > 'session:'.length)
+  ) {
+    throw new MakaPluginRuntimeError('invalid_entry', `Invalid composition root: ${rootId}`);
+  }
+}
+
+export function pluginIdentity(ctx: Context): MakaContributionIdentity {
+  const metadata = ctx.maka;
+  if (!metadata) {
+    throw new MakaPluginRuntimeError(
+      'activation_failed',
+      'Contribution registration requires a composition entry Context',
+    );
+  }
+  return Object.freeze({
+    entryId: metadata.entryId,
+    scopeId: metadata.rootId,
+    extensionId: metadata.packageId,
+    generation: metadata.generation,
+  });
+}
+
+export function ownPluginEffect(
+  ctx: Context,
+  label: string,
+  dispose: () => void | Promise<void>,
+): void {
+  ctx.effect(() => dispose, label);
+}
+
+export function registerPluginContribution(
+  ctx: Context,
+  label: string,
+  register: () => () => void | Promise<void>,
+): void {
+  if (ctx.makaTransaction) {
+    ctx.makaTransaction.stage(label, register, ctx);
+    return;
+  }
+  const dispose = register();
+  ownPluginEffect(ctx, label, dispose);
+}
+
+export class MakaPluginTransactionBuffer implements MakaPluginTransaction {
+  readonly #registrations: Array<{
+    readonly label: string;
+    readonly register: () => () => void | Promise<void>;
+    readonly owner: Context;
+  }> = [];
+  #state: 'staging' | 'committed' | 'rolled_back' = 'staging';
+
+  constructor(private readonly context: Context) {}
+
+  stage(label: string, register: () => () => void | Promise<void>, owner = this.context): void {
+    if (this.#state === 'committed') {
+      const dispose = register();
+      ownPluginEffect(owner, label, dispose);
+      return;
+    }
+    if (this.#state === 'rolled_back') {
+      throw new MakaPluginRuntimeError(
+        'activation_failed',
+        `Cannot stage contribution after transaction is ${this.#state}`,
+      );
+    }
+    this.#registrations.push({ label, register, owner });
+  }
+
+  async commit(): Promise<void> {
+    if (this.#state === 'committed') return;
+    if (this.#state === 'rolled_back') {
+      throw new MakaPluginRuntimeError(
+        'activation_failed',
+        'Cannot commit a rolled back transaction',
+      );
+    }
+    const registered: Array<() => void | Promise<void>> = [];
+    try {
+      for (const item of this.#registrations) {
+        const dispose = item.register();
+        registered.push(dispose);
+        ownPluginEffect(item.owner, item.label, dispose);
+      }
+      this.#state = 'committed';
+      this.#registrations.length = 0;
+    } catch (error) {
+      for (const dispose of registered.reverse()) await dispose();
+      this.#state = 'rolled_back';
+      this.#registrations.length = 0;
+      throw error;
+    }
+  }
+
+  rollback(): void {
+    if (this.#state !== 'staging') return;
+    this.#state = 'rolled_back';
+    this.#registrations.length = 0;
+  }
+}
+
+export function fiberStateName(state: FiberState): MakaCompositionEntryStatus {
+  return ['pending', 'loading', 'active', 'failed', 'disposed', 'unloading'][
+    state
+  ] as MakaCompositionEntryStatus;
+}
+
+export function isCanonicalPluginId(value: unknown): value is string {
+  return typeof value === 'string' && value.length <= 128 && ID_PATTERN.test(value);
+}
+
+export const isCanonicalExtensionId = isCanonicalPluginId;
+
+export function isCanonicalExtensionScopeId(value: unknown): value is string {
+  return (
+    typeof value === 'string' && value.length <= 128 && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u.test(value)
+  );
+}
+
+function validatePluginId(value: unknown, label: string): asserts value is string {
+  if (!isCanonicalPluginId(value)) {
+    throw new MakaPluginRuntimeError('invalid_entry', `Invalid ${label}`);
+  }
+}
+
+function validateServiceName(value: string): void {
+  if (!/^[A-Za-z][A-Za-z0-9._:-]{0,255}$/u.test(value)) {
+    throw new MakaPluginRuntimeError('invalid_entry', `Invalid service name: ${value}`);
+  }
+}
diff --git a/packages/runtime/src/plugin-tool-service.ts b/packages/runtime/src/plugin-tool-service.ts
new file mode 100644
index 0000000000..79e09c44d9
--- /dev/null
+++ b/packages/runtime/src/plugin-tool-service.ts
@@ -0,0 +1,38 @@
+import { Service, type Context } from './plugin-kernel.js';
+import type { MakaTool } from './tool-runtime.js';
+import {
+  ExtensionToolContributionRegistry,
+  type ExtensionToolContributionInspection,
+  type ExtensionToolContributionRegistryOptions,
+} from './extension-tool-contributions.js';
+import { pluginIdentity, registerPluginContribution } from './plugin-runtime.js';
+
+declare module './plugin-kernel.js' {
+  interface Context {
+    tools: PluginToolService;
+  }
+}
+
+export class PluginToolService extends Service {
+  readonly registry: ExtensionToolContributionRegistry;
+
+  constructor(ctx: Context, options: ExtensionToolContributionRegistryOptions = {}) {
+    super(ctx, 'tools');
+    this.registry = new ExtensionToolContributionRegistry(options);
+  }
+
+  register(tool: MakaTool): void {
+    const identity = pluginIdentity(this.ctx);
+    registerPluginContribution(this.ctx, `tool:${tool.name}`, () =>
+      this.registry.register(identity, tool),
+    );
+  }
+
+  compose(rootId: string, coreTools: readonly MakaTool[]): readonly MakaTool[] {
+    return this.registry.compose(rootId, coreTools);
+  }
+
+  inspect(rootId: string): readonly ExtensionToolContributionInspection[] {
+    return this.registry.inspect(rootId);
+  }
+}
diff --git a/packages/runtime/src/plugin-ui-service.ts b/packages/runtime/src/plugin-ui-service.ts
new file mode 100644
index 0000000000..b8f74f5fa7
--- /dev/null
+++ b/packages/runtime/src/plugin-ui-service.ts
@@ -0,0 +1,62 @@
+import { Service, type Context } from './plugin-kernel.js';
+import {
+  type ExtensionUiContribution,
+  type ExtensionUiContributionInspection,
+  ExtensionUiContributionRegistry,
+  type ExtensionUiReadiness,
+  type ExtensionUiReadinessInspection,
+} from './extension-ui-contributions.js';
+import { pluginIdentity, registerPluginContribution } from './plugin-runtime.js';
+
+declare module './plugin-kernel.js' {
+  interface Context {
+    ui: PluginUiService;
+  }
+}
+
+export class PluginUiService extends Service {
+  readonly registry = new ExtensionUiContributionRegistry();
+
+  constructor(ctx: Context) {
+    super(ctx, 'ui');
+  }
+
+  register(contribution: ExtensionUiContribution): void {
+    const identity = pluginIdentity(this.ctx);
+    const registry = this.registry;
+    registerPluginContribution(this.ctx, `ui:${contribution.id}`, () =>
+      registry.register(identity, contribution),
+    );
+  }
+
+  inspect(
+    rootId: string,
+    committed: readonly { readonly entryId: string; readonly generation: number }[],
+  ): readonly ExtensionUiContributionInspection[] {
+    return this.registry.inspect(rootId, committed);
+  }
+
+  setReadiness(
+    entryId: string,
+    generation: number,
+    status: ExtensionUiReadiness,
+    diagnostic?: string,
+  ): void {
+    const identity = pluginIdentity(this.ctx);
+    this.registry.setReadiness(identity.scopeId, entryId, generation, status, diagnostic);
+  }
+
+  setReadinessForRoot(
+    rootId: string,
+    entryId: string,
+    generation: number,
+    status: ExtensionUiReadiness,
+    diagnostic?: string,
+  ): void {
+    this.registry.setReadiness(rootId, entryId, generation, status, diagnostic);
+  }
+
+  inspectReadiness(rootId?: string): readonly ExtensionUiReadinessInspection[] {
+    return this.registry.inspectReadiness(rootId);
+  }
+}
diff --git a/packages/runtime/src/runtime-event-read-model.ts b/packages/runtime/src/runtime-event-read-model.ts
index b679e7e895..e237d753c2 100644
--- a/packages/runtime/src/runtime-event-read-model.ts
+++ b/packages/runtime/src/runtime-event-read-model.ts
@@ -321,6 +321,12 @@ export function projectRuntimeEventsToStoredMessages(
       projected = true;
     }
 
+    if (event.actions?.hookCompleted) {
+      // Lifecycle Hook results are bounded policy/audit facts. A denial's
+      // synthetic function response owns the provider-visible row.
+      projected = true;
+    }
+
     if (isContinuationStartRuntimeEvent(event)) {
       // Continuation start is a canonical lineage/recovery fact with no
       // legacy chat row. Its following model events own the visible output.
diff --git a/packages/runtime/src/tool-runtime.ts b/packages/runtime/src/tool-runtime.ts
index 23b4e35569..b88b5e293a 100644
--- a/packages/runtime/src/tool-runtime.ts
+++ b/packages/runtime/src/tool-runtime.ts
@@ -78,6 +78,7 @@ import {
   type RuntimeInteractionClosureReason,
   type RuntimeUserQuestionClosureReason,
 } from './interaction-authority.js';
+import type { PreToolUseHookDispatcher } from './hooks/engine.js';
 
 export interface ResolvedMakaToolCall {
   tool: MakaTool;
@@ -437,6 +438,8 @@ export interface ToolRuntimeInput {
   getRunTrace?: () => RunTraceLike | null;
   recordToolInvocation?: ToolTelemetryRecorder;
   recordToolArtifacts?: ToolArtifactRecorder;
+  /** Immutable-per-turn user/project policy Hook dispatcher. */
+  preToolUseHooks?: PreToolUseHookDispatcher;
   /** Optional Phase 2 T1/T2 commit boundary for hosts that persist RuntimeEvents. */
   runtimeCommitSink?: RuntimeCommitSink;
 }
@@ -525,6 +528,7 @@ export class ToolRuntime {
     this.turnId = input.turnId;
     this.hostedInteraction = hosted;
     this.readExecutionBoundary = input.readExecutionBoundary;
+    input.preToolUseHooks?.prepareTurn(this.turnId);
   }
 
   async endTurn(reason: 'completed' | 'aborted' = 'completed'): Promise<void> {
@@ -589,6 +593,7 @@ export class ToolRuntime {
     // Bounded, not open-ended: every rejection above has already been
     // dispatched, and running impls observe the turn abort signal.
     await Promise.allSettled([...this.activeToolSettlements]);
+    this.input.preToolUseHooks?.releaseTurn(turnId);
     if (boundarySettlementErrors.length > 0) {
       throw new AggregateError(
         boundarySettlementErrors,
@@ -1259,6 +1264,78 @@ export class ToolRuntime {
       return this.errorReturn(SUBAGENT_TOOL_LIMIT_MESSAGE);
     }
 
+    if (this.input.preToolUseHooks) {
+      let hookResult;
+      try {
+        hookResult = await this.input.preToolUseHooks.runPreToolUse(
+          {
+            schema_version: 1,
+            hook_event_name: 'PreToolUse',
+            session_id: this.input.sessionId,
+            turn_id: turnId,
+            run_id: runId ?? turnId,
+            tool_use_id: toolUseId,
+            tool_name: tool.name,
+            tool_input: structuredClone(executionArgs),
+            cwd: this.input.header.cwd,
+            permission_mode: this.input.header.permissionMode,
+            origin: ctx.origin,
+          },
+          ctx.abortSignal,
+          { invocationId: invocationId ?? runId ?? turnId },
+        );
+      } catch (error) {
+        if (ctx.abortSignal.aborted) {
+          this.releaseSubagentSlot(tool);
+          throw ctx.abortSignal.reason ?? new DOMException('Aborted', 'AbortError');
+        }
+        trace?.emit('tool', 'tool_failed', 'PreToolUse Hook dispatcher failed open', {
+          toolUseId,
+          toolName: tool.name,
+          status: 'warning',
+          errorClass: 'HookDispatcherFailure',
+        });
+      }
+      if (ctx.abortSignal.aborted) {
+        this.releaseSubagentSlot(tool);
+        throw ctx.abortSignal.reason ?? new DOMException('Aborted', 'AbortError');
+      }
+      if (hookResult) {
+        for (const audit of hookResult.audits) {
+          if (audit.status === 'failed' || audit.status === 'skipped_untrusted') {
+            trace?.emit('tool', 'tool_failed', 'PreToolUse Hook did not produce a decision', {
+              toolUseId,
+              toolName: tool.name,
+              hookId: audit.handlerId,
+              hookStatus: audit.status,
+              errorClass: 'HookFailure',
+            });
+          }
+        }
+        if (hookResult.auditWriteFailures.length > 0) {
+          trace?.emit('tool', 'tool_failed', 'PreToolUse Hook audit write failed', {
+            toolUseId,
+            toolName: tool.name,
+            failureCount: hookResult.auditWriteFailures.length,
+            errorClass: 'HookAuditFailure',
+          });
+        }
+        if (hookResult.denied) {
+          this.releaseSubagentSlot(tool);
+          const reason = hookResult.reason ?? 'A PreToolUse Hook denied this tool call.';
+          await refuseBeforeDispatch(reason);
+          trace?.emit('tool', 'tool_failed', 'PreToolUse Hook denied tool execution', {
+            toolUseId,
+            toolName: tool.name,
+            status: 'error',
+            errorClass: 'HookDenied',
+          });
+          this.recordLoopGateOutcome(callSignature, true);
+          return this.errorReturn(reason);
+        }
+      }
+    }
+
     let durableAttempt: DurableToolAttempt | undefined;
     try {
       durableAttempt = await this.prepareDurableToolAttempt({
@@ -1304,9 +1381,8 @@ export class ToolRuntime {
       const pauseTarget = this.input.getPermissionPauseTarget();
       pauseTarget?.pause();
       try {
-        const runId = this.input.runId;
         const executionBoundary = clientCapabilityBoundary ?? (await this.readExecutionBoundary());
-        const result = await tool.impl(structuredClone(executionArgs) as never, {
+        const toolContext: MakaToolContext = {
           sessionId: this.input.sessionId,
           turnId,
           ...(runId ? { runId } : {}),
@@ -1366,7 +1442,39 @@ export class ToolRuntime {
               ctx.abortSignal,
               queue,
             ),
-        });
+        };
+        const invokeTool = async (payload: unknown): Promise<unknown> => {
+          if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+            throw new Error('tools/execute middleware payload must be an object');
+          }
+          const record = payload as { toolName?: unknown; toolInput?: unknown };
+          if (record.toolName !== tool.name) {
+            throw new Error('tools/execute middleware cannot redirect to another Tool');
+          }
+          return await tool.impl(record.toolInput as never, toolContext);
+        };
+        const middlewarePayload = {
+          toolName: tool.name,
+          toolInput: structuredClone(executionArgs),
+          context: toolContext,
+        };
+        let result = this.input.preToolUseHooks?.runCoreMiddleware
+          ? await this.input.preToolUseHooks.runCoreMiddleware(
+              'maka.tools.execute',
+              middlewarePayload,
+              ctx.abortSignal,
+              {
+                invocationId: invocationId ?? runId ?? turnId,
+                sessionId: this.input.sessionId,
+                runId: runId ?? turnId,
+                turnId,
+                cwd: this.input.header.cwd,
+                permissionMode: this.input.header.permissionMode,
+                origin: ctx.origin,
+              },
+              invokeTool,
+            )
+          : await invokeTool(middlewarePayload);
         if (
           ctx.maxResultBytes !== undefined &&
           serializedByteLength(result, ctx.maxResultBytes) > ctx.maxResultBytes
@@ -1503,6 +1611,7 @@ export class ToolRuntime {
         err,
       );
       if (terminalFailure) {
+        const transformedFailure = coerceResultContent(terminalFailure.content);
         if (terminalFailure.sandboxDenied) {
           const denialKey = sandboxDenialKey(tool.name, this.input.header.cwd, executionArgs);
           this.recentSandboxDenials.add(denialKey);
@@ -1519,7 +1628,7 @@ export class ToolRuntime {
         }
         const durationMs = Math.max(0, this.input.now() - startedAt);
         const durableOutcome = await durableAttempt?.commitOutcome(
-          terminalFailure.content,
+          transformedFailure,
           true,
           durationMs,
         );
@@ -1530,7 +1639,7 @@ export class ToolRuntime {
           ts: this.input.now(),
           toolUseId,
           isError: true,
-          content: terminalFailure.content,
+          content: transformedFailure,
           durationMs,
           ...activityIdentity,
         };
@@ -1543,7 +1652,7 @@ export class ToolRuntime {
           toolUseId,
           ...(durableOutcome ? { operationId: durableOutcome.operationId } : {}),
           isError: true,
-          content: terminalFailure.content,
+          content: transformedFailure,
           durationMs,
           ...activityIdentity,
         } satisfies ToolResultEvent);
@@ -1561,9 +1670,9 @@ export class ToolRuntime {
             tool.categoryHint === 'computer_use'
               ? summarizePersistedArgs(persistedArgs)
               : summarizeArgs(tool.name, executionArgs),
-          resultSummary: summarizeToolResultForTelemetry(terminalFailure.content),
+          resultSummary: summarizeToolResultForTelemetry(transformedFailure),
           bytesIn: byteLength(persistedArgs),
-          bytesOut: byteLength(terminalFailure.content),
+          bytesOut: byteLength(transformedFailure),
           startedAt,
         });
         trace?.emit('tool', 'tool_failed', 'Tool execution failed', {
@@ -1576,7 +1685,7 @@ export class ToolRuntime {
         });
         return this.errorReturn(terminalFailure.message);
       }
-      const msg =
+      let msg =
         err instanceof ToolResultLimitError
           ? err.message
           : tool.categoryHint === 'computer_use'
diff --git a/packages/storage/package.json b/packages/storage/package.json
index 6bab3801f0..dfd05be1b6 100644
--- a/packages/storage/package.json
+++ b/packages/storage/package.json
@@ -38,7 +38,9 @@
     "./model-call-ledger": "./dist/model-call-ledger.js",
     "./usage-stores": "./dist/usage-stores.js",
     "./workspace-identity": "./dist/workspace-identity.js",
-    "./write-queue": "./dist/write-queue.js"
+    "./write-queue": "./dist/write-queue.js",
+    "./hook-config-store": "./dist/hook-config-store.js",
+    "./hook-trust-store": "./dist/hook-trust-store.js"
   },
   "scripts": {
     "clean": "node ../../scripts/clean-paths.mjs dist tsconfig.tsbuildinfo",
diff --git a/packages/storage/src/__tests__/hook-config-store.test.ts b/packages/storage/src/__tests__/hook-config-store.test.ts
new file mode 100644
index 0000000000..cc0e9675e2
--- /dev/null
+++ b/packages/storage/src/__tests__/hook-config-store.test.ts
@@ -0,0 +1,120 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, it } from 'node:test';
+import { createHookConfigStore, normalizeHookConfig } from '../hook-config-store.js';
+import { createHookTrustStore } from '../hook-trust-store.js';
+
+describe('Hook config store', () => {
+  it('normalizes the bounded command-only v1 contract', () => {
+    const config = normalizeHookConfig({
+      version: 1,
+      hooks: {
+        PreToolUse: [
+          {
+            matcher: 'Bash|mcp__github__*',
+            hooks: [
+              {
+                id: 'policy',
+                type: 'command',
+                command: '/usr/bin/true',
+              },
+            ],
+          },
+        ],
+      },
+    });
+    assert.deepEqual(config.hooks.PreToolUse?.[0]?.hooks[0], {
+      id: 'policy',
+      type: 'command',
+      command: '/usr/bin/true',
+      args: [],
+      timeoutMs: 3_000,
+      enabled: true,
+    });
+  });
+
+  it('rejects unknown fields, shell strings, arbitrary globs, and duplicate ids', () => {
+    assert.throws(
+      () => normalizeHookConfig({ version: 1, hooks: {}, typo: true }),
+      /unknown field/u,
+    );
+    assert.throws(
+      () =>
+        normalizeHookConfig({
+          version: 1,
+          hooks: {
+            PreToolUse: [
+              {
+                matcher: 'B*sh',
+                hooks: [{ id: 'x', type: 'command', command: '/usr/bin/true' }],
+              },
+            ],
+          },
+        }),
+      /matcher is invalid/u,
+    );
+    assert.throws(
+      () =>
+        normalizeHookConfig({
+          version: 1,
+          hooks: {
+            PreToolUse: [
+              {
+                hooks: [
+                  { id: 'same', type: 'command', command: '/usr/bin/true' },
+                  { id: 'same', type: 'command', command: '/usr/bin/false' },
+                ],
+              },
+            ],
+          },
+        }),
+      /Duplicate/u,
+    );
+    assert.throws(
+      () =>
+        normalizeHookConfig({
+          version: 1,
+          hooks: {
+            PreToolUse: [{ hooks: [{ id: 'x', type: 'command', command: 'echo unsafe' }] }],
+          },
+        }),
+      /absolute path/u,
+    );
+  });
+
+  it('persists private config and exact-hash trust records atomically', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'maka-hooks-store-'));
+    try {
+      const configStore = createHookConfigStore(root);
+      await configStore.set({
+        version: 1,
+        hooks: {
+          PreToolUse: [
+            {
+              matcher: 'Bash',
+              hooks: [{ id: 'policy', type: 'command', command: '/usr/bin/true' }],
+            },
+          ],
+        },
+      });
+      assert.equal((await configStore.get()).hooks.PreToolUse?.[0]?.matcher, 'Bash');
+      assert.match(await readFile(join(root, 'hooks.json'), 'utf8'), /"policy"/u);
+
+      const trustStore = createHookTrustStore(root);
+      const hash = `sha256:${'a'.repeat(64)}` as const;
+      await trustStore.trust({
+        definitionHash: hash,
+        source: 'user',
+        projectIdentity: 'user',
+        trustedAt: 123,
+      });
+      assert.equal((await trustStore.get()).trustedDefinitions[0]?.definitionHash, hash);
+      await trustStore.revoke(hash);
+      assert.deepEqual((await trustStore.get()).trustedDefinitions, []);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/packages/storage/src/hook-config-store.ts b/packages/storage/src/hook-config-store.ts
new file mode 100644
index 0000000000..ff33374af0
--- /dev/null
+++ b/packages/storage/src/hook-config-store.ts
@@ -0,0 +1,209 @@
+import { randomUUID } from 'node:crypto';
+import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join } from 'node:path';
+import {
+  HOOK_CONFIG_VERSION,
+  createDefaultHookConfig,
+  type HookCommandConfig,
+  type HookConfigFile,
+  type HookMatcherGroupConfig,
+} from '@maka/core/hooks';
+
+const MAX_CONFIG_BYTES = 1_048_576;
+const MAX_HANDLERS = 128;
+const MAX_ID_LENGTH = 128;
+const MAX_STRING_LENGTH = 8_192;
+const DEFAULT_TIMEOUT_MS = 3_000;
+const MIN_TIMEOUT_MS = 100;
+const MAX_TIMEOUT_MS = 30_000;
+
+export interface HookConfigStore {
+  get(): Promise<HookConfigFile>;
+  set(config: HookConfigFile): Promise<HookConfigFile>;
+}
+
+export function createHookConfigStore(stateRoot: string): HookConfigStore {
+  return new FileHookConfigStore(join(stateRoot, 'hooks.json'));
+}
+
+export async function readHookConfigFile(path: string): Promise<HookConfigFile> {
+  let text: string;
+  try {
+    text = await readFile(path, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return createDefaultHookConfig();
+    throw error;
+  }
+  if (Buffer.byteLength(text, 'utf8') > MAX_CONFIG_BYTES) {
+    throw new Error('Hook config exceeds 1 MiB');
+  }
+  return normalizeHookConfig(JSON.parse(text));
+}
+
+export function normalizeHookConfig(value: unknown): HookConfigFile {
+  const root = recordWithKeys(value, ['version', 'hooks'], 'Hook config');
+  if (root.version !== HOOK_CONFIG_VERSION) {
+    throw new Error(`Unsupported Hook config version: ${String(root.version)}`);
+  }
+  const hooks = recordWithKeys(root.hooks, ['PreToolUse'], 'hooks');
+  const rawGroups = hooks.PreToolUse ?? [];
+  if (!Array.isArray(rawGroups)) throw new Error('hooks.PreToolUse must be an array');
+
+  const ids = new Set<string>();
+  let handlerCount = 0;
+  const groups: HookMatcherGroupConfig[] = rawGroups.map((rawGroup, groupIndex) => {
+    const group = recordWithKeys(rawGroup, ['matcher', 'hooks'], `PreToolUse[${groupIndex}]`);
+    const matcher = normalizeMatcher(group.matcher, groupIndex);
+    if (!Array.isArray(group.hooks)) {
+      throw new Error(`PreToolUse[${groupIndex}].hooks must be an array`);
+    }
+    const handlers = group.hooks.map((rawHandler, handlerIndex) => {
+      handlerCount += 1;
+      if (handlerCount > MAX_HANDLERS) {
+        throw new Error(`Hook config exceeds ${MAX_HANDLERS} handlers`);
+      }
+      const handler = normalizeHandler(rawHandler, groupIndex, handlerIndex);
+      if (ids.has(handler.id)) throw new Error(`Duplicate Hook handler id: ${handler.id}`);
+      ids.add(handler.id);
+      return handler;
+    });
+    return { matcher, hooks: handlers };
+  });
+
+  return {
+    version: HOOK_CONFIG_VERSION,
+    hooks: groups.length > 0 ? { PreToolUse: groups } : {},
+  };
+}
+
+class FileHookConfigStore implements HookConfigStore {
+  private queue: Promise<void> = Promise.resolve();
+
+  constructor(private readonly path: string) {}
+
+  get(): Promise<HookConfigFile> {
+    return this.serial(() => readHookConfigFile(this.path));
+  }
+
+  async set(config: HookConfigFile): Promise<HookConfigFile> {
+    const normalized = normalizeHookConfig(config);
+    return this.serial(async () => {
+      await writePrivateJson(this.path, normalized, '.hooks-');
+      return normalized;
+    });
+  }
+
+  private async serial<T>(operation: () => Promise<T>): Promise<T> {
+    const previous = this.queue;
+    let release!: () => void;
+    this.queue = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  }
+}
+
+function normalizeMatcher(value: unknown, groupIndex: number): string {
+  if (value === undefined) return '*';
+  const matcher = boundedString(value, `PreToolUse[${groupIndex}].matcher`, 1_024);
+  const tokens = matcher.split('|');
+  if (
+    tokens.some(
+      (token) =>
+        !token ||
+        token.trim() !== token ||
+        token.includes('\0') ||
+        (token.includes('*') && !/^[^*]+\*$/u.test(token) && token !== '*'),
+    )
+  ) {
+    throw new Error(`PreToolUse[${groupIndex}].matcher is invalid`);
+  }
+  return matcher;
+}
+
+function normalizeHandler(
+  value: unknown,
+  groupIndex: number,
+  handlerIndex: number,
+): HookCommandConfig {
+  const label = `PreToolUse[${groupIndex}].hooks[${handlerIndex}]`;
+  const handler = recordWithKeys(
+    value,
+    ['id', 'type', 'command', 'args', 'timeoutMs', 'enabled'],
+    label,
+  );
+  const id = boundedString(handler.id, `${label}.id`, MAX_ID_LENGTH);
+  if (handler.type !== 'command') throw new Error(`${label}.type must be command`);
+  const command = boundedString(handler.command, `${label}.command`, MAX_STRING_LENGTH);
+  if (!isAbsolute(command)) throw new Error(`${label}.command must be an absolute path`);
+  const args = handler.args === undefined ? [] : normalizeArgs(handler.args, `${label}.args`);
+  const timeoutMs = handler.timeoutMs === undefined ? DEFAULT_TIMEOUT_MS : handler.timeoutMs;
+  if (
+    !Number.isInteger(timeoutMs) ||
+    (timeoutMs as number) < MIN_TIMEOUT_MS ||
+    (timeoutMs as number) > MAX_TIMEOUT_MS
+  ) {
+    throw new Error(`${label}.timeoutMs must be between ${MIN_TIMEOUT_MS} and ${MAX_TIMEOUT_MS}`);
+  }
+  const enabled = handler.enabled === undefined ? true : handler.enabled;
+  if (typeof enabled !== 'boolean') throw new Error(`${label}.enabled must be boolean`);
+  return { id, type: 'command', command, args, timeoutMs: timeoutMs as number, enabled };
+}
+
+function normalizeArgs(value: unknown, label: string): string[] {
+  if (!Array.isArray(value) || value.length > 1_000) throw new Error(`${label} must be an array`);
+  return value.map((item, index) =>
+    boundedString(item, `${label}[${index}]`, MAX_STRING_LENGTH, true),
+  );
+}
+
+function boundedString(value: unknown, label: string, max: number, allowEmpty = false): string {
+  if (
+    typeof value !== 'string' ||
+    (!allowEmpty && !value.trim()) ||
+    value.length > max ||
+    value.includes('\0')
+  ) {
+    throw new Error(`${label} must be a valid string`);
+  }
+  return value;
+}
+
+function recordWithKeys(
+  value: unknown,
+  keys: readonly string[],
+  label: string,
+): Record<string, unknown> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  const record = value as Record<string, unknown>;
+  const allowed = new Set(keys);
+  const unknown = Object.keys(record).find((key) => !allowed.has(key));
+  if (unknown) throw new Error(`${label} contains unknown field: ${unknown}`);
+  return record;
+}
+
+async function writePrivateJson(path: string, value: unknown, prefix: string): Promise<void> {
+  const dir = dirname(path);
+  await mkdir(dir, { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') await chmod(dir, 0o700);
+  const tempPath = join(dir, `${prefix}${randomUUID()}.tmp`);
+  try {
+    await writeFile(tempPath, `${JSON.stringify(value, null, 2)}\n`, {
+      encoding: 'utf8',
+      mode: 0o600,
+      flag: 'wx',
+    });
+    if (process.platform !== 'win32') await chmod(tempPath, 0o600);
+    await rename(tempPath, path);
+    if (process.platform !== 'win32') await chmod(path, 0o600);
+  } finally {
+    await rm(tempPath, { force: true }).catch(() => {});
+  }
+}
diff --git a/packages/storage/src/hook-trust-store.ts b/packages/storage/src/hook-trust-store.ts
new file mode 100644
index 0000000000..a5e2b5cd88
--- /dev/null
+++ b/packages/storage/src/hook-trust-store.ts
@@ -0,0 +1,175 @@
+import { randomUUID } from 'node:crypto';
+import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import {
+  HOOK_TRUST_VERSION,
+  createDefaultHookTrust,
+  type HookSource,
+  type HookTrustFile,
+  type HookTrustRecord,
+} from '@maka/core/hooks';
+
+const MAX_TRUST_BYTES = 1_048_576;
+const MAX_RECORDS = 4_096;
+const HASH_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+
+export interface HookTrustStore {
+  get(): Promise<HookTrustFile>;
+  trust(record: HookTrustRecord): Promise<HookTrustFile>;
+  revoke(definitionHash: string): Promise<HookTrustFile>;
+}
+
+export function createHookTrustStore(stateRoot: string): HookTrustStore {
+  return new FileHookTrustStore(join(stateRoot, 'hook-trust.json'));
+}
+
+export function normalizeHookTrust(value: unknown): HookTrustFile {
+  const root = exactRecord(value, ['version', 'trustedDefinitions'], 'Hook trust');
+  if (root.version !== HOOK_TRUST_VERSION) {
+    throw new Error(`Unsupported Hook trust version: ${String(root.version)}`);
+  }
+  if (!Array.isArray(root.trustedDefinitions) || root.trustedDefinitions.length > MAX_RECORDS) {
+    throw new Error(`trustedDefinitions must contain at most ${MAX_RECORDS} records`);
+  }
+  const seen = new Set<string>();
+  const records = root.trustedDefinitions.map((value, index) => {
+    const label = `trustedDefinitions[${index}]`;
+    const record = exactRecord(
+      value,
+      ['definitionHash', 'source', 'projectIdentity', 'trustedAt'],
+      label,
+    );
+    if (typeof record.definitionHash !== 'string' || !HASH_PATTERN.test(record.definitionHash)) {
+      throw new Error(`${label}.definitionHash is invalid`);
+    }
+    if (seen.has(record.definitionHash)) throw new Error(`Duplicate trusted definition hash`);
+    seen.add(record.definitionHash);
+    if (record.source !== 'user' && record.source !== 'project') {
+      throw new Error(`${label}.source is invalid`);
+    }
+    if (
+      typeof record.projectIdentity !== 'string' ||
+      !record.projectIdentity ||
+      record.projectIdentity.length > 8_192
+    ) {
+      throw new Error(`${label}.projectIdentity is invalid`);
+    }
+    if (!Number.isFinite(record.trustedAt) || (record.trustedAt as number) < 0) {
+      throw new Error(`${label}.trustedAt is invalid`);
+    }
+    return {
+      definitionHash: record.definitionHash as `sha256:${string}`,
+      source: record.source as HookSource,
+      projectIdentity: record.projectIdentity,
+      trustedAt: record.trustedAt as number,
+    };
+  });
+  return { version: HOOK_TRUST_VERSION, trustedDefinitions: records };
+}
+
+class FileHookTrustStore implements HookTrustStore {
+  private queue: Promise<void> = Promise.resolve();
+
+  constructor(private readonly path: string) {}
+
+  get(): Promise<HookTrustFile> {
+    return this.serial(() => this.read());
+  }
+
+  trust(record: HookTrustRecord): Promise<HookTrustFile> {
+    const normalizedRecord = normalizeHookTrust({
+      version: HOOK_TRUST_VERSION,
+      trustedDefinitions: [record],
+    }).trustedDefinitions[0]!;
+    return this.serial(async () => {
+      const current = await this.read();
+      const next = normalizeHookTrust({
+        version: HOOK_TRUST_VERSION,
+        trustedDefinitions: [
+          ...current.trustedDefinitions.filter(
+            (candidate) => candidate.definitionHash !== normalizedRecord.definitionHash,
+          ),
+          normalizedRecord,
+        ],
+      });
+      await this.write(next);
+      return next;
+    });
+  }
+
+  revoke(definitionHash: string): Promise<HookTrustFile> {
+    return this.serial(async () => {
+      const current = await this.read();
+      const next: HookTrustFile = {
+        version: HOOK_TRUST_VERSION,
+        trustedDefinitions: current.trustedDefinitions.filter(
+          (record) => record.definitionHash !== definitionHash,
+        ),
+      };
+      await this.write(next);
+      return next;
+    });
+  }
+
+  private async read(): Promise<HookTrustFile> {
+    let text: string;
+    try {
+      text = await readFile(this.path, 'utf8');
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return createDefaultHookTrust();
+      throw error;
+    }
+    if (Buffer.byteLength(text, 'utf8') > MAX_TRUST_BYTES) {
+      throw new Error('Hook trust file exceeds 1 MiB');
+    }
+    return normalizeHookTrust(JSON.parse(text));
+  }
+
+  private async write(value: HookTrustFile): Promise<void> {
+    const dir = dirname(this.path);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    if (process.platform !== 'win32') await chmod(dir, 0o700);
+    const tempPath = join(dir, `.hook-trust-${randomUUID()}.tmp`);
+    try {
+      await writeFile(tempPath, `${JSON.stringify(value, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+        flag: 'wx',
+      });
+      if (process.platform !== 'win32') await chmod(tempPath, 0o600);
+      await rename(tempPath, this.path);
+      if (process.platform !== 'win32') await chmod(this.path, 0o600);
+    } finally {
+      await rm(tempPath, { force: true }).catch(() => {});
+    }
+  }
+
+  private async serial<T>(operation: () => Promise<T>): Promise<T> {
+    const previous = this.queue;
+    let release!: () => void;
+    this.queue = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  }
+}
+
+function exactRecord(
+  value: unknown,
+  keys: readonly string[],
+  label: string,
+): Record<string, unknown> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  const record = value as Record<string, unknown>;
+  const allowed = new Set(keys);
+  const unknown = Object.keys(record).find((key) => !allowed.has(key));
+  if (unknown) throw new Error(`${label} contains unknown field: ${unknown}`);
+  return record;
+}
diff --git a/packages/storage/src/index.ts b/packages/storage/src/index.ts
index 1d20cd2810..50eb7b83d3 100644
--- a/packages/storage/src/index.ts
+++ b/packages/storage/src/index.ts
@@ -132,6 +132,8 @@ export type {
 } from './operational-state-store.js';
 export * from './operational-state-backup.js';
 export * from './mcp-config-store.js';
+export * from './hook-config-store.js';
+export * from './hook-trust-store.js';
 export * from './workspace-identity.js';
 export * from './memory-bundle-store.js';
 export * from './long-term-memory-store.js';
diff --git a/packages/ui/src/module-hub-selector.tsx b/packages/ui/src/module-hub-selector.tsx
index f024949795..a7ab0ea769 100644
--- a/packages/ui/src/module-hub-selector.tsx
+++ b/packages/ui/src/module-hub-selector.tsx
@@ -2,7 +2,7 @@ import type { ReactNode } from 'react';
 import { Tab, TabList } from '@astryxdesign/core';
 import type { AutomationModule, ExtensionModule } from './nav-selection.js';
 import { useUiLocale } from './locale-context.js';
-import { ICON_SIZE, Blocks, CalendarCheck, Plug, Sun } from './icons.js';
+import { ICON_SIZE, Blocks, CalendarCheck, Monitor, Plug, Sun } from './icons.js';
 import { getSharedUiCopy } from './shared-ui-copy.js';
 
 export type ModuleHubHeader = {
@@ -51,6 +51,7 @@ export function ModuleHubSelector(props: ModuleHubSelectorProps) {
     const options = [
       ['skills', copy.extensions.skills, <Blocks key="skills" size={ICON_SIZE.chrome} aria-hidden="true" />],
       ['mcp', copy.extensions.mcp, <Plug key="mcp" size={ICON_SIZE.chrome} aria-hidden="true" />],
+      ['ui', copy.extensions.ui, <Monitor key="ui" size={ICON_SIZE.chrome} aria-hidden="true" />],
     ] as const;
     const selectedLabel = options.find(([value]) => value === props.value)?.[1] ?? copy.extensions.skills;
     return (
diff --git a/packages/ui/src/nav-selection.ts b/packages/ui/src/nav-selection.ts
index e04a4315cd..c6c6f35dfa 100644
--- a/packages/ui/src/nav-selection.ts
+++ b/packages/ui/src/nav-selection.ts
@@ -1,5 +1,5 @@
 export type SessionFilter = 'chats' | 'flagged' | 'archived';
-export type ExtensionModule = 'skills' | 'mcp';
+export type ExtensionModule = 'skills' | 'mcp' | 'ui';
 export type AutomationModule = 'scheduled-tasks' | 'daily-review';
 
 export type NavSelection =
diff --git a/packages/ui/src/session-list-panel.tsx b/packages/ui/src/session-list-panel.tsx
index f7841b7ea9..7d3657a978 100644
--- a/packages/ui/src/session-list-panel.tsx
+++ b/packages/ui/src/session-list-panel.tsx
@@ -16,7 +16,7 @@ import { SessionSidebarFooter, SessionSidebarNav, type SidebarUpdateReminder } f
 import { ICON_SIZE, Clock, FolderOpen } from './icons.js';
 import { useUiLocale } from './locale-context.js';
 import { getConversationCopy } from './conversation-copy.js';
-import type { Ref } from 'react';
+import type { ReactNode, Ref } from 'react';
 
 export type SessionViewMode = 'conversation' | 'project';
 
@@ -54,6 +54,8 @@ export function SessionListPanel(props: {
   onNew(): void;
   onImport?(): void;
   rowActions?: SessionRowActions;
+  /** Product-owned extension seat rendered above the permanent footer. */
+  footerExtension?: ReactNode;
 }) {
   const copy = getConversationCopy(useUiLocale()).sessions;
   const {
@@ -144,11 +146,14 @@ export function SessionListPanel(props: {
           />
         }
         footer={
-          <SessionSidebarFooter
-            updateReminder={props.updateReminder}
-            onOpenSettings={props.onOpenSettings}
-            onOpenUpdate={props.onOpenUpdate}
-          />
+          <>
+            {props.footerExtension}
+            <SessionSidebarFooter
+              updateReminder={props.updateReminder}
+              onOpenSettings={props.onOpenSettings}
+              onOpenUpdate={props.onOpenUpdate}
+            />
+          </>
         }
       >
         {!collapsed ? (
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index 296b7a52b0..82f53b3933 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -53,6 +53,7 @@ export interface SharedUiCopy {
       selectorLabel: (module: string) => string;
       skills: string;
       mcp: string;
+      ui: string;
     };
     automations: {
       title: string;
@@ -159,6 +160,7 @@ const SHARED_UI_COPY = {
         selectorLabel: (module) => `扩展内容：${module}`,
         skills: '技能',
         mcp: 'MCP',
+        ui: 'UI',
       },
       automations: {
         title: '定时任务',
@@ -248,6 +250,7 @@ const SHARED_UI_COPY = {
         selectorLabel: (module) => `Extension content: ${module}`,
         skills: 'Skills',
         mcp: 'MCP',
+        ui: 'UI',
       },
       automations: {
         title: 'Scheduled tasks',
diff --git a/scripts/extension-startup-benchmark.mjs b/scripts/extension-startup-benchmark.mjs
new file mode 100644
index 0000000000..95e3703174
--- /dev/null
+++ b/scripts/extension-startup-benchmark.mjs
@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+import { performance } from 'node:perf_hooks';
+import electron from 'electron';
+import { buildFixtureEnv } from './fixture-env.mjs';
+
+const options = parseOptions(process.argv.slice(2));
+const roots = [
+  { name: 'baseline', root: options.baseline },
+  { name: 'candidate', root: options.candidate },
+];
+const measurements = new Map(roots.map(({ name }) => [name, []]));
+
+for (let iteration = 0; iteration < options.iterations; iteration += 1) {
+  for (const subject of iteration % 2 === 0 ? roots : [...roots].reverse()) {
+    measurements.get(subject.name).push(await measure(subject.root, iteration));
+  }
+}
+
+const result = Object.fromEntries(
+  [...measurements].map(([name, values]) => [name, summarize(values)]),
+);
+const regression = ((result.candidate.p95Ms - result.baseline.p95Ms) / result.baseline.p95Ms) * 100;
+console.log(
+  JSON.stringify(
+    {
+      iterations: options.iterations,
+      metric: 'Electron spawn to first did-finish-load diagnostic, clean isolated profile',
+      ...result,
+      p95RegressionPercent: round(regression),
+      passesFivePercentGate: regression <= 5,
+    },
+    null,
+    2,
+  ),
+);
+
+function parseOptions(arguments_) {
+  const values = new Map();
+  for (let index = 0; index < arguments_.length; index += 2) {
+    values.set(arguments_[index], arguments_[index + 1]);
+  }
+  const baseline = resolveRequired(values.get('--baseline'), '--baseline');
+  const candidate = resolveRequired(values.get('--candidate'), '--candidate');
+  const iterations = Number(values.get('--iterations') ?? 20);
+  if (!Number.isSafeInteger(iterations) || iterations < 5 || iterations > 100) {
+    throw new Error('--iterations must be an integer from 5 to 100');
+  }
+  return { baseline, candidate, iterations };
+}
+
+function resolveRequired(value, label) {
+  if (typeof value !== 'string' || !value || !isAbsolute(value)) {
+    throw new Error(`${label} must be an absolute repository path`);
+  }
+  return resolve(value);
+}
+
+async function measure(root, iteration) {
+  const profile = await mkdtemp(join(tmpdir(), 'maka-extension-startup-'));
+  const isolatedHome = join(profile, 'isolated-home');
+  await mkdir(isolatedHome, { recursive: true });
+  const environment = buildFixtureEnv(profile, isolatedHome);
+  environment.MAKA_REAL_WINDOW_SMOKE = '1';
+  const started = performance.now();
+  const child = spawn(electron, ['.', `--user-data-dir=${profile}`], {
+    cwd: join(root, 'apps', 'desktop'),
+    env: environment,
+    stdio: ['ignore', 'pipe', 'pipe'],
+    detached: process.platform !== 'win32',
+  });
+  let output = '';
+  try {
+    return await new Promise((resolveMeasurement, rejectMeasurement) => {
+      const timeout = setTimeout(
+        () => rejectMeasurement(new Error(`startup timed out at iteration ${iteration}`)),
+        20_000,
+      );
+      const settle = (error, value) => {
+        clearTimeout(timeout);
+        if (error) rejectMeasurement(error);
+        else resolveMeasurement(value);
+      };
+      child.once('error', (error) => settle(error));
+      child.once('exit', (code, signal) =>
+        settle(new Error(`Electron exited before load: code=${code} signal=${signal}`)),
+      );
+      child.stdout.on('data', (chunk) => {
+        output += chunk.toString();
+        if (!output.includes('"stage":"after-load"')) return;
+        settle(undefined, performance.now() - started);
+      });
+      child.stderr.on('data', (chunk) => {
+        output += chunk.toString();
+      });
+    });
+  } finally {
+    await stop(child);
+    await rm(profile, { recursive: true, force: true });
+  }
+}
+
+async function stop(child) {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  if (process.platform === 'win32') {
+    child.kill('SIGKILL');
+  } else if (child.pid) {
+    try {
+      process.kill(-child.pid, 'SIGKILL');
+    } catch (error) {
+      if (error.code !== 'ESRCH') throw error;
+    }
+  }
+  await new Promise((resolveExit) => {
+    if (child.exitCode !== null || child.signalCode !== null) resolveExit();
+    else child.once('exit', resolveExit);
+  });
+}
+
+function summarize(values) {
+  const sorted = [...values].sort((left, right) => left - right);
+  return {
+    p50Ms: round(percentile(sorted, 0.5)),
+    p95Ms: round(percentile(sorted, 0.95)),
+    minMs: round(sorted[0]),
+    maxMs: round(sorted.at(-1)),
+  };
+}
+
+function percentile(sorted, fraction) {
+  return sorted[Math.ceil(sorted.length * fraction) - 1];
+}
+
+function round(value) {
+  return Math.round(value * 1000) / 1000;
+}