every plugin route renders a workspace, and it is not a rule you can forget

an exclusionary rule, made structural. a plugin does not render a screen: it
contributes panels and says how they are arranged, and the shell renders
WorkspaceView around them.

    web/panels.ts   appRegistryMetas — at least one panel
    web/layout.ts   defaultLayout — how they are arranged

both required the moment web/ exists, and missing either is refused at discovery
by name and with the reason. tested:

    probeplug: has a web/ directory but is missing web/layout.ts.
    Every plugin route renders a Workspace: contribute panels and a layout,
    not a screen.

there is deliberately no way to export a component. one that could would be free
to render a bare div, a full-page form, or its own navigation, and the platform
would become a shell hosting strangers' layouts rather than one application.
non-compliance is not so much refused as unrepresentable — there is nowhere to
put a screen.

the shell registers <prefix> and <prefix>/:section, exactly as the core screens
do, so a plugin's sections stay addressable and cmd-clickable, and panels read
useParams independently rather than passing state between themselves.
appTypes.allowed is pinned to that plugin's own keys, so a persisted layout
naming something else falls back instead of rendering another plugin's panel
inside this screen.

the example plugin is rebuilt to model it — two panels, a layout, one of them
calling its own /api/example/ping through useClient — because the reference
implementation is what everyone copies.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/offscale-plugin.md

@@ -480,6 +480,35 @@ export const manifest = {
 } as const;
 ```
 
+### THE RULE: every plugin route renders a Workspace with at least one panel
+
+Exclusionary, and enforced by shape rather than by review. A plugin **does not render a screen.** It
+contributes panels and says how they are arranged; the shell renders `WorkspaceView` around them.
+
+```
+web/panels.ts   exports appRegistryMetas — at least one panel
+web/layout.ts   exports defaultLayout — how they are arranged
+```
+
+Both are required the moment `web/` exists. Missing either and the plugin is **refused at discovery**, by
+name and with the reason:
+
+```
+probeplug: has a web/ directory but is missing web/layout.ts.
+Every plugin route renders a Workspace: contribute panels and a layout, not a screen.
+```
+
+There is deliberately no way to export a component. A plugin that could would be free to render a bare
+div, a full-page form, its own navigation — and the platform would become a shell hosting strangers'
+layouts rather than one application. Non-compliance is not refused so much as **unrepresentable**: there
+is nowhere to put a screen.
+
+The shell registers the pair `<prefix>` and `<prefix>/:section`, exactly as the core screens do
+(`/headscale/:section`), so a plugin's sections stay addressable, linkable and cmd-clickable. Panels read
+`useParams` independently — nothing is passed between them, so they cannot disagree. `appTypes.allowed`
+is pinned to that plugin's own panel keys, so a persisted layout naming something else falls back rather
+than rendering another plugin's panel inside this one.
+
 ### Everything the tree can say, the tree says
 
 The manifest holds only what a directory listing genuinely cannot tell you: an identity fact, or something