plugins declare the host binaries they need, and the installer checks

Offscale was self-sufficient. Music is not — it shells out to ffmpeg and
ffprobe — and the way it fails without them is the reason this is a check
rather than a line in a README.

It does not fail. Missing ffprobe means the indexer catches the spawn error
and returns a track carrying its filename and nothing else: no title, artist,
album, duration or embedded lyrics. It then walks the whole library, writes a
complete cache tree and reports success. Five swallowed catches, no log, no
counter, and the only tell is coversSaved: 0 in a report nobody reads.

So `osDependencies` is a manifest field: the binary to probe on PATH, why it
is needed, and a package name per package manager. The shape is taken from
scripts/setup-old/setup.sh rather than invented — probe the binary, case on
$PM — and the names are per-manager rather than canonical-with-overrides
because lib/packages.sh already recorded why that indirection was rejected.
Probing the binary is what makes "built-in on this OS" free: on PATH means the
package map is never consulted.

Four decisions worth naming.

Missing and uninstallable REFUSES the install, first, before a table is
created or a row written — so there is nothing to undo, and the alternative is
a plugin that installs, answers 200 and quietly produces nothing.

The status is on GET /api/plugins and rendered before the button, because the
owner is deciding whether to let the server run a package manager as root and
that needs answering first. Installing by hand and watching it flip to present
is the escape hatch on a machine without passwordless sudo.

Package names get a deliberately narrow regex and reach Bun.spawn as an argv
ARRAY, never a shell. Both halves are load-bearing: the regex means a
metacharacter cannot get there, argv means it would be an argument rather than
syntax if it did. Narrower than package managers actually accept — no `:`, no
`+` version pins — because a plugin needing one wants a conversation.

Success is OBSERVED, not inferred: after installing, the binaries are re-probed.
A package manager exiting 0 having installed something that does not provide
the binary is exactly the failure this exists to catch.

installCommand mirrors lib/packages.sh's pkg_install_now exactly, including
apt's non-interactive environment, so there is one definition of "install a
package" rather than two that drift. sudo always gets -n: under PM2 a password
prompt is not a slow path, it is a hang. brew never escalates.

Verified live. ffmpeg and ffprobe were absent on this machine all evening; the
page showed both missing with the exact root command, the install streamed
`dependencies: installing ffmpeg with apt` then `ffprobe, ffmpeg now on PATH`,
and X-Audio-Duration appeared on a stream response for the first time. The
refusal path was exercised against a temporary probe dependency: HTTP 400,
steps: [], reason named.

THIS CHANGED THE MACHINE: ffmpeg 6.1.1-3ubuntu5 is now installed via apt.

Found on the way: a manifest is read once per process. Discovery does
`await import()` and the module cache holds it, so editing a manifest changes
nothing until pm2 restart officer — including `outdated`. Cost ten minutes and
is now in the runbook.

bunx tsgo clean. 797 tests, 787 pass, 7 fail — the same seven, +25 new.

plugins/EXTRACTING-A-PLUGIN.md

@@ -39,6 +39,11 @@ web/panels.ts      panels — REQUIRED with web/
 web/layout.ts      layout — REQUIRED with web/
 ```
 
+**A host binary is the one exception, and it goes in the manifest** — the tree cannot say it. Declare
+`osDependencies` when your plugin shells out to something: the binary to probe on PATH, why it is needed,
+and a package name per package manager. Absent means self-sufficient, which offscale and example are.
+Music added the field; see its PLUGIN.md for what it is guarding against.
+
 `appName` is the **directory name**. The sidecar runtime is the **file extension**.
 
 **Nothing may branch on provenance** except `mountPrefix()`. First-party and third-party differing
@@ -121,6 +126,10 @@ A normal refresh is enough; the shell is `no-store`. When the log's last line ap
 - **Moving a `*.test.ts` into `plugins/` used to stop it running, silently.** `[test] root` was `./src`
   until music; it is now `.`. If that ever goes back, every extraction quietly shrinks the suite. Compare
   the FILE COUNT across a run, not just pass/fail — that is the only thing that shows it.
+- **A manifest is read once per server process.** Discovery does `await import(manifest.ts)`, and the
+  module cache holds it for the lifetime of the process — so editing a manifest while developing changes
+  nothing until `pm2 restart officer`. Costs ten minutes the first time, because the plugins page keeps
+  cheerfully showing the old values. `outdated` cannot notice a version bump without a restart either.
 - **A plugin importing platform code is fine (`@@/…`); the reverse is not.** If something in `src/` imports
   from your feature and cannot move — a widget, a relay — that piece stays, and the boundary goes around
   it. Find those before you plan the split; they decide it for you.