Context. #98740 showed that externalizing a bundled plugin silently breaks core consumers of its public artifacts: the bundled-only resolver (src/plugins/public-surface-loader.ts → src/plugins/public-surface-runtime.ts) never consults installed plugin roots, and missing artifacts are treated as "optional absent". The gateway-auth bypass surface is fixed in #98819 by routing that one consumer through the activation-gated facade seam (tryLoadActivatedBundledPluginPublicSurfaceModuleSync), which resolves bundled locations first and falls back to the manifest-registry record of installed plugins.

Remaining gap. The other public-artifact consumers still resolve bundled-only, so for externalized plugins (today: @openclaw/mattermost; more as externalization proceeds) these plugin-owned contracts silently vanish on packaged installs:

• src/channels/plugins/doctor-contract-api.ts — channel legacy-config rules / compatibility repairs (doctor-contract-api.js)
• src/secrets/channel-contract-api.ts — channel secret contracts (partially registry-aware already; the bundled fast path is not)
• src/channels/plugins/message-tool-api.ts — message-tool discovery adapters
• src/channels/plugins/thread-binding-api.ts — thread-binding hints
• src/media/channel-inbound-roots.ts — media inbound roots
• src/flows/bundled-health-checks.ts — flow health checks
• src/plugins/provider-public-artifacts.ts — provider policy hooks (note: owner resolution deliberately restricts to origin === "bundled"; treat as a product decision, not a mechanical port)

Concrete user impact example. An operator on a packaged ≥2026.6.11 install with @openclaw/mattermost: openclaw doctor --fix no longer applies mattermost's legacyConfigRules/normalizeCompatibilityConfig, and message-tool discovery for mattermost is silently absent unless the full plugin is loaded.

Direction (per #98819 review). Do NOT add an install-record fallback inside the shared bundled loader — an earlier draft did and was reverted because it broadened every surface past its trust boundary (executed disabled plugins' artifact code, escaped store-corruption errors into the gateway request path, no hardlink policy, uncached hot-path probing). Instead, migrate each consumer to the activation-gated facade seam individually, with per-surface review of:

1. whether the surface should execute installed (vs bundled-only) plugin code at all — provider-policy and secret contracts especially;
2. failure semantics (optional-missing sentinel vs propagate);
3. call-site caching (several consumers probe per message/per discovery pass; the facade path resolves per call).

Acceptance criteria.

• Each migrated consumer resolves externalized official plugins' artifacts, gated on plugin activation, with regression tests using generated tiny plugin fixtures.
• Disabled/denied installed plugins never execute artifact code on any surface.
• No new per-message filesystem probing (misses cached at consumer or seam level).
• Provider-policy surface gets an explicit decision (stay bundled-only or open with gating) recorded in src/plugins/CLAUDE.md.

Refs: #98740, #98819 (review findings in PR discussion).