diff --git a/.changeset/interaction-quality.md b/.changeset/interaction-quality.md
deleted file mode 100644
index 37df82c7..00000000
--- a/.changeset/interaction-quality.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-'@inkcre/client-web': patch
-'@inkcre/core': patch
----
-
-按任务精简 Settings、Peer 与 Extension 界面，统一页面和浏览器标题，补齐场景化加载、刷新失败保留、保存与取消的动作反馈。修正重复检索、任务不存在及日志读取失败的可观察结果，保留失败后的恢复入口。
diff --git a/.changeset/schema-forms-tabs.md b/.changeset/schema-forms-tabs.md
deleted file mode 100644
index 01d5bf10..00000000
--- a/.changeset/schema-forms-tabs.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-'@inkcre/client-web': patch
-'@inkcre/core': patch
-'@inkcre/ext-dev-utils': patch
-'@inkcre/ext-mail': patch
-'@inkcre/ext-memos': patch
-'@inkcre/ext-twitter': patch
----
-
-Source 与 Peer 配置使用可视化表单，保留完整 JSON 编辑模式；Peers 页面可确认删除离线 Peer 并清理其扩展启用记录。Extension 浏览与版本选择交由 Registry，Web 接收精确版本并确认安装；Web 与 Module Federation 扩展统一升级正式 UI 2.2.0，Peer AI 凭据在 schema 中标记为密码输入。
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9baa557f..96f62b15 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,7 @@ jobs:
         run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/*.yml
 
   core-release:
-    name: Resolve stable core release
+    name: Resolve admitted Core release
     runs-on: ubuntu-latest
     outputs:
       contract_revision: ${{ steps.release.outputs.contract_revision }}
@@ -64,7 +64,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Resolve stable once to an immutable release
+      - name: Verify canonical candidate admission boundaries
+        run: node --test scripts/test-core-release.mjs
+
+      - name: Resolve admitted Core once to an immutable release
         id: release
         run: node scripts/resolve-core-release.mjs
 
@@ -121,7 +124,7 @@ jobs:
           --core-package packages/core/package.json
           --artifact-directory extensions/twitter/dist/client-web
 
-      - name: Verify publication recovery over HTTP
+      - name: Verify independent MF publication
         run: node --test scripts/test-extension-publication.mjs scripts/test-core-sdk-publication.mjs
 
   peer-database:
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 9746ff32..fe3f1823 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -1,7 +1,7 @@
 # Repository Architecture
 
 This monorepo implements three logical client-side units across shared packages, applications, and
-independently versioned Extension producers.
+independently built Extension producers.
 
 ```text
 Vue web application -----------+
@@ -32,8 +32,9 @@ locations, not Unit boundaries.
    inbound → non-delegating local implementation.
 3. Content: `Block.getHydratedContent()` → exact Resolver → solved value or safe browser handle →
    registered renderer.
-4. Native Extension: durable enabled intent → exact Release and Host-range preflight → native
-   manifest → initialize/activate; disable reverses lifecycle before removing Peer intent.
+4. Native Extension: exact Peer selection and enabled intent → exact Release and Host-range preflight →
+   native manifest → initialize/activate; disable first records false intent, then releases native
+   runtime resources.
 
 ## Realization Surfaces
 
@@ -41,7 +42,7 @@ locations, not Unit boundaries.
   configuration/authentication, and Extension Host.
 - `apps/client-web/` - Vue SPA, graph/list surfaces, settings, and static Vite artifact.
 - `apps/client-webext/` - WXT browser surfaces and content scripts.
-- `extensions/` - independently versioned native Module Federation producers.
+- `extensions/` - independently built native Module Federation producers.
 - `packages/ext-dev-utils/` - producer development support consumed by applications.
 
 The package graph is ESM-first. Workspace Vite and WXT applications consume `@inkcre/core` source
diff --git a/apps/client-web/CHANGELOG.md b/apps/client-web/CHANGELOG.md
index 915d55eb..f4b85846 100644
--- a/apps/client-web/CHANGELOG.md
+++ b/apps/client-web/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @inkcre/client-web
 
+## 0.1.3
+
+### Patch Changes
+
+- 7307dda: 按任务精简 Settings、Peer 与 Extension 界面，统一页面和浏览器标题，补齐场景化加载、刷新失败保留、保存与取消的动作反馈。修正重复检索、任务不存在及日志读取失败的可观察结果，保留失败后的恢复入口。
+- 插件配置与业务状态在部署内共享；精确分发版本和启用意图分别保存在每个 Peer。Client Web 在同一插件入口管理各 Peer 的安装、版本和运行状态，并采用 Extension management v2。
+
+  原生 SDK 不再提供全局插件版本与 enabled 数组。新版 MF 使用 0.4 SDK 的参与记录接口，历史 MF 需按其 SDK 范围运行或明确选择新版；不会自动改写旧版本选择。Python 与 MF 分别从自己的仓库发布，插件负责共享数据契约兼容。
+
+- 7307dda: Source 与 Peer 配置使用可视化表单，保留完整 JSON 编辑模式；Peers 页面可确认删除离线 Peer 并清理其扩展启用记录。Extension 浏览与版本选择交由 Registry，Web 接收精确版本并确认安装；Web 与 Module Federation 扩展统一升级正式 UI 2.2.0，Peer AI 凭据在 schema 中标记为密码输入。
+- Updated dependencies [7307dda]
+- Updated dependencies
+- Updated dependencies [7307dda]
+  - @inkcre/core@0.4.0
+
 ## 0.1.2
 
 ### Patch Changes
diff --git a/apps/client-web/package.json b/apps/client-web/package.json
index 576b9cbc..f72ce257 100644
--- a/apps/client-web/package.json
+++ b/apps/client-web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@inkcre/client-web",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true,
   "type": "module",
   "scripts": {
@@ -12,7 +12,7 @@
   },
   "dependencies": {
     "@inkcre/core": "workspace:*",
-    "@inkcre/extension-runtime-client-web": "github:InKCre/ext-reg#57dcd80289285620a1fd27a0a48027e56c4ce7b1&path:/runtimes/client-web",
+    "@inkcre/extension-runtime-client-web": "https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz",
     "@inkcre/ui-web": "2.2.1",
     "@module-federation/runtime": "^0.21.4",
     "@supabase/postgrest-js": "^2.84.0",
diff --git a/apps/client-web/src/components/extension/extensionCard/extensionCard.md b/apps/client-web/src/components/extension/extensionCard/extensionCard.md
index 7ef01361..fdb7e70d 100644
--- a/apps/client-web/src/components/extension/extensionCard/extensionCard.md
+++ b/apps/client-web/src/components/extension/extensionCard/extensionCard.md
@@ -1,28 +1,21 @@
 # ExtensionCard
 
-A component that displays an installed Extension and opens focused Peer selection for enablement changes.
+Displays one deployment Extension and its independent native participation on each Peer.
 
-## Props
+The `extension` prop supplies shared identity and configuration; `participations` supplies exact
+Peer/distribution/version selections and enabled intent. `peers`, `livePeerIds` and `currentPeerId`
+identify operation targets and determine local runtime, remote management or offline intent routing.
+`peerSelectionDisabled` prevents mutation while target discovery is unavailable.
 
-- `extension` (InstalledExtension, required): the canonical installed row
-- `peers` (Peer[], required): available Peers, including this browser
-- `livePeerIds` (ReadonlySet<string>, required): server-evaluated online Peers used for management routing
-- `currentPeerId` (string, required): identifies this browser's running Host
-- `peerSelectionDisabled` (boolean): blocks actions while the Peer list is unavailable
+Each Peer row keeps version selection, enablement, actual running version and errors together.
+The component obtains actual runtime status from the host rather than inferring it from enabled
+intent. A selection change affects only that row. Removing a disabled participation retains shared
+configuration and business data. An unobserved remote Host is not assigned a format from its name.
 
-## Emits
+`updated` emits the shared configuration row after a successful save. `participationChanged` asks the
+parent to reload native choices after a successful targeted mutation. The running browser module
+can contribute its own setup dialog; disabling that browser closes its contribution first.
 
-- `updated`: Emitted with the canonical row after Peer, configuration, or version changes
-- `uninstalled`: Emitted after the canonical row is removed
-
-## Features
-
-- Display canonical Extension Name, exact version, and optional nickname
-- Choose one or more eligible Peers in an enable or disable dialog. Each selected Peer uses the existing current Host, remote Host, or durable-intent path. Partial failures remain visible and trigger a fresh installed-row read; no batch rollback or automatic retry occurs.
-- Mount an Extension-owned setup contribution from this browser's running Web Distribution
-- Keep setup availability independent of the Peer selection dialog; disabling this browser closes its setup surface first
-- Link the exact installed release's available global, Core, and Web documentation even when the extension is disabled or has no browser distribution; distinguish missing documentation from failed discovery
-- Edit extension configuration via JSON editor in a dialog
-- Select a published Registry Release and change the exact shared version only while every Peer is disabled
-- Auto-formats configuration as JSON for easier editing
-- Prevents uninstall while any Peer remains enabled
+Configuration editing offers schemas with their exact Peer/distribution/version source, plus JSON
+editing without a schema. Documentation opens for an explicitly selected participation and follows
+Registry-returned links. Missing documentation does not block runtime operations.
diff --git a/apps/client-web/src/components/extension/extensionCard/extensionCard.scss b/apps/client-web/src/components/extension/extensionCard/extensionCard.scss
index 791ec52c..4702eae9 100644
--- a/apps/client-web/src/components/extension/extensionCard/extensionCard.scss
+++ b/apps/client-web/src/components/extension/extensionCard/extensionCard.scss
@@ -62,6 +62,16 @@
     margin: 0;
   }
 
+  &__peer-row {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: space-between;
+    align-items: center;
+    gap: sys-var(space, sm);
+    padding-block: sys-var(space, sm);
+    border-top: 1px solid sys-var(color, border, subtle);
+  }
+
   &__peer-options {
     display: flex;
     flex-direction: column;
diff --git a/apps/client-web/src/components/extension/extensionCard/extensionCard.ts b/apps/client-web/src/components/extension/extensionCard/extensionCard.ts
index 9900293a..e6db1ce8 100644
--- a/apps/client-web/src/components/extension/extensionCard/extensionCard.ts
+++ b/apps/client-web/src/components/extension/extensionCard/extensionCard.ts
@@ -1,9 +1,10 @@
 import { type PropType } from 'vue'
-import type { InstalledExtension, Peer } from '@inkcre/core'
+import type { InstalledExtension, ExtensionParticipation, Peer } from '@inkcre/core'
 
 // --- Props ---
 export const extensionCardProps = {
   extension: { type: Object as PropType<InstalledExtension>, required: true },
+  participations: { type: Array as PropType<ExtensionParticipation[]>, required: true },
   peers: { type: Array as PropType<Peer[]>, required: true },
   livePeerIds: { type: Object as PropType<ReadonlySet<string>>, required: true },
   currentPeerId: { type: String, required: true },
@@ -13,5 +14,5 @@ export const extensionCardProps = {
 // --- Emits ---
 export const extensionCardEmits = {
   updated: (_extension: InstalledExtension) => true,
-  uninstalled: () => true,
+  participationChanged: () => true,
 } as const
diff --git a/apps/client-web/src/components/extension/extensionCard/extensionCard.vue b/apps/client-web/src/components/extension/extensionCard/extensionCard.vue
index cb60bee5..8bf1b901 100644
--- a/apps/client-web/src/components/extension/extensionCard/extensionCard.vue
+++ b/apps/client-web/src/components/extension/extensionCard/extensionCard.vue
@@ -1,5 +1,14 @@
 <script setup lang="ts">
-import { ref, computed, nextTick, shallowRef, watch, type Component } from 'vue'
+import {
+  computed,
+  nextTick,
+  onMounted,
+  onUnmounted,
+  ref,
+  shallowRef,
+  watch,
+  type Component,
+} from 'vue'
 import { useI18n } from 'vue-i18n'
 import {
   InkButton,
@@ -8,496 +17,682 @@ import {
   InkLoading,
   type JsonEditorValidation,
 } from '@inkcre/ui-web'
-import { getExtensionHost, getExtensionRegistry, getExtensionSetupContribution } from '@/core'
-import { configStore, ExtensionRegistryOriginResolver, type Peer } from '@inkcre/core'
 import {
-  getExtensionDocumentation,
+  configStore,
+  ExtensionRegistryOriginResolver,
+  ExtensionModel,
+  ExtensionParticipationModel,
+  PeerOutcomeUnknown,
+  type ExtensionRuntimeStatus,
+  type NativeDistribution,
+  type MetaConfig,
+  type Peer,
+} from '@inkcre/core'
+import {
+  manageExtensionOnPeer,
   sortPublishedReleases,
+  preferredPublishedRelease,
+  RegistryReleaseError,
+  getExtensionDocumentation,
   type ExtensionDocumentationLink,
 } from '@inkcre/extension-runtime-client-web'
+import {
+  extensionHostRestoreState,
+  getExtensionHost,
+  getExtensionRegistry,
+  getExtensionSetupContribution,
+  startExtensionHost,
+  webPeerConnectionState,
+} from '@/core'
 import { extensionCardProps, extensionCardEmits } from './extensionCard'
-import { extensionPeerControlMode, setExtensionPeerEnabled } from '@/extension-peer-control'
+import {
+  extensionPeerControlMode,
+  observeExtensionPeer,
+  selectExtensionPeerVersion,
+  setExtensionPeerEnabled,
+} from '@/extension-peer-control'
 import SchemaConfigEditor from '@/components/schemaConfigEditor/schemaConfigEditor.vue'
 
 const props = defineProps(extensionCardProps)
 const emit = defineEmits(extensionCardEmits)
 const { t } = useI18n()
-
-// --- data ---
-const configPopupOpen = ref(false)
+const statuses = ref<Record<string, ExtensionRuntimeStatus | null>>({})
+const formats = ref<Record<string, NativeDistribution[]>>({})
+const errors = ref<Record<string, string>>({})
+const busyPeer = ref('')
+const refreshing = ref(false)
+const selectedPeer = shallowRef<Peer | null>(null)
+const versionOpen = ref(false)
+const versionLoading = ref(false)
+const versionModel = ref('')
+const distributionModel = ref<NativeDistribution>('module_federation')
+const versionOptions = ref<{ label: string; value: string }[]>([])
+const versionError = ref('')
+const publishedFormats = ref<Partial<Record<NativeDistribution, boolean>>>({})
+const knownPublishedFormats = computed(() =>
+  (['python', 'module_federation'] as const).filter((format) => publishedFormats.value[format])
+)
+let versionRequest = 0
+let documentationRequest = 0
+let active = true
+onUnmounted(() => {
+  active = false
+  versionRequest += 1
+  documentationRequest += 1
+})
+function ownsConnection(meta: MetaConfig): boolean {
+  const current = configStore.metaConfig
+  return (
+    active &&
+    meta.INKCRE_PGREST_URL === current.INKCRE_PGREST_URL &&
+    meta.INKCRE_PEER_ID === current.INKCRE_PEER_ID &&
+    meta.INKCRE_JWT_SECRET === current.INKCRE_JWT_SECRET
+  )
+}
+const documentation = ref<ExtensionDocumentationLink[]>([])
+const docsOpen = ref(false)
+const docsLoading = ref(false)
+const docsError = ref('')
+const docsPeerName = ref('')
+const configOpen = ref(false)
 const configSaving = ref(false)
+const configModel = ref('')
+const schemaPeerId = ref('')
 const configValidation = ref<JsonEditorValidation>()
-const versionPopupOpen = ref<boolean | Promise<boolean>>(false)
-const managementOpen = ref(false)
-function openManagement(): void {
-  operationError.value = null
-  managementOpen.value = true
-}
-const setupPopupOpen = ref(false)
+const configError = ref('')
+const setupOpen = ref(false)
 const setupComponent = shallowRef<Component | null>(null)
 const setupContribution = shallowRef(getExtensionSetupContribution(props.extension.name))
-const peerDialogOpen = ref(false)
-const peerAction = ref<'enable' | 'disable'>('enable')
-const selectedPeerIds = ref<string[]>([])
-const peerActionErrors = ref<string[]>([])
-const updatingPeers = ref(false)
-const isUninstalling = ref(false)
-const operationError = ref<string | null>(null)
-const configModel = ref(JSON.stringify(props.extension.config, null, 2))
-const versionModel = ref(props.extension.version)
-const versionOptions = ref<{ label: string; value: string; description?: string }[]>([])
-const versionLoading = ref(false)
-const versionError = ref<string | null>(null)
-const documentation = shallowRef<ExtensionDocumentationLink[]>([])
-const documentationRetry = ref(0)
-const documentationStatus = ref<'loading' | 'available' | 'missing' | 'unavailable'>('loading')
+const rows = computed(() =>
+  props.peers.map((peer) => ({
+    peer,
+    pin: props.participations.find((row) => row.peer_id === peer.id),
+    status: statuses.value[peer.id],
+  }))
+)
+const schemaOptions = computed(() =>
+  props.participations
+    .filter((row) => row.config_schema && row.distribution)
+    .map((row) => ({
+      label: `${props.peers.find((peer) => peer.id === row.peer_id)?.name ?? row.peer_id} · ${distributionLabel(row.distribution)} ${row.version}`,
+      value: row.peer_id,
+    }))
+)
+const configSchema = computed(
+  () =>
+    props.participations.find((row) => row.peer_id === schemaPeerId.value)?.config_schema ??
+    undefined
+)
 const canSaveConfig = computed(
   () =>
     configValidation.value?.status === 'valid' && configValidation.value.text === configModel.value
 )
-
-// --- computed ---
-watch(
-  () => [props.extension.name, props.extension.version, documentationRetry.value] as const,
-  async ([name, version], _previous, onCleanup) => {
-    let current = true
-    onCleanup(() => {
-      current = false
-    })
-    documentation.value = []
-    documentationStatus.value = 'loading'
-    try {
-      const origin = await new ExtensionRegistryOriginResolver(
-        () => configStore.peerConfig.extension_registry_url
-      ).resolve()
-      const links = await getExtensionDocumentation(origin, name, version)
-      if (!current) return
-      documentation.value = links ?? []
-      documentationStatus.value = links?.length ? 'available' : 'missing'
-    } catch {
-      if (current) documentationStatus.value = 'unavailable'
-    }
-  },
-  { immediate: true }
+const distributionOptions = computed(() =>
+  selectedPeer.value
+    ? supportedFormats(selectedPeer.value).map((format) => ({
+        label: format === 'python' ? 'Python' : 'Module Federation',
+        value: format,
+      }))
+    : []
 )
 
-watch(
-  () => props.extension.config,
-  (config) => {
-    if (!configPopupOpen.value) configModel.value = JSON.stringify(config, null, 2)
-  },
-  { deep: true }
-)
-
-const canUninstall = computed(() => props.extension.enabled.length === 0 && !isUninstalling.value)
-const eligiblePeers = computed(() =>
-  props.peers.filter((peer) => {
-    const alreadyEnabled = props.extension.enabled.includes(peer.id)
-    return peerAction.value === 'disable' ? alreadyEnabled : !alreadyEnabled
-  })
-)
-const hasDeferredSelection = computed(() =>
-  eligiblePeers.value.some(
-    (peer) =>
-      selectedPeerIds.value.includes(peer.id) &&
-      extensionPeerControlMode(peer, props.currentPeerId, props.livePeerIds) === 'desired-state'
-  )
-)
-const peerLabel = (peer: Peer) =>
-  `${peer.name} · ${peer.application_version ? `v${peer.application_version}` : t('peer.versionUnknown')}`
-const closeSetup = async () => {
-  setupPopupOpen.value = false
-  setupComponent.value = null
-  await nextTick()
+function distributionLabel(distribution: NativeDistribution | null): string {
+  return distribution === 'python'
+    ? 'Python'
+    : distribution === 'module_federation'
+      ? 'Module Federation'
+      : t('extension.distributionUnknown')
 }
 
-const openPeerDialog = (action: 'enable' | 'disable') => {
-  peerAction.value = action
-  selectedPeerIds.value = []
-  peerActionErrors.value = []
-  operationError.value = null
-  peerDialogOpen.value = true
+function supportedFormats(peer: Peer): NativeDistribution[] {
+  if (peer.id === props.currentPeerId) return ['module_federation']
+  const observed = formats.value[peer.id]
+  if (observed?.length) return observed
+  const previous = props.participations.find((row) => row.peer_id === peer.id)
+  return previous?.distribution ? [previous.distribution] : []
 }
-
-const applyPeerAction = async () => {
-  if (updatingPeers.value || selectedPeerIds.value.length === 0) return
-  const selectedPeers = eligiblePeers.value.filter((peer) =>
-    selectedPeerIds.value.includes(peer.id)
+function statusText(peerId: string): string {
+  const pin = props.participations.find((row) => row.peer_id === peerId)
+  const status = statuses.value[peerId]
+  if (status?.restart_required)
+    return [
+      status.loaded_version
+        ? t('extension.runningVersion', { version: status.loaded_version })
+        : null,
+      t('extension.restartRequired'),
+    ]
+      .filter(Boolean)
+      .join(' · ')
+  if (status?.running && status.loaded_version)
+    return t('extension.runningVersion', { version: status.loaded_version })
+  if (pin?.distribution === null) return t('extension.needsVersionSelection')
+  if (!status) return t('extension.runtimeUnknown')
+  if (status?.error) return t('extension.startFailed')
+  return t('extension.notRunning')
+}
+function noPublishedDistributionForPeer(peer: Peer): boolean {
+  const supported = supportedFormats(peer)
+  return (
+    supported.length > 0 && supported.every((format) => publishedFormats.value[format] === false)
   )
-  if (selectedPeers.length === 0) return
-  const enabled = peerAction.value === 'enable'
-  updatingPeers.value = true
-  peerActionErrors.value = []
+}
+async function refreshCard(): Promise<void> {
+  // Catalog facts are populated only by an explicit version choice, never by initial card mounting.
+  publishedFormats.value = {}
+  await refreshRuntime()
+}
+let runtimeRequest = 0
+async function refreshRuntime(): Promise<void> {
+  const request = ++runtimeRequest
+  refreshing.value = true
+  const meta = { ...configStore.metaConfig }
+  const host = getExtensionHost()
+  const ownsRefresh = () =>
+    request === runtimeRequest && ownsConnection(meta) && getExtensionHost() === host
   try {
-    if (!enabled && selectedPeerIds.value.includes(props.currentPeerId)) await closeSetup()
-    for (const peer of selectedPeers) {
-      try {
-        const updated = await setExtensionPeerEnabled({
-          name: props.extension.name,
-          peer,
-          currentPeerId: props.currentPeerId,
-          livePeerIds: props.livePeerIds,
-          enabled,
-          manager: getExtensionHost(),
-        })
-        emit('updated', updated)
-      } catch (error) {
-        peerActionErrors.value.push(
-          `${peerLabel(peer)}: ${error instanceof Error ? error.message : String(error)}`
-        )
-      }
-    }
-    if (peerActionErrors.value.length) {
-      try {
-        const latest = await getExtensionHost().get(props.extension.name)
-        if (latest) emit('updated', latest)
-      } catch (error) {
-        peerActionErrors.value.push(error instanceof Error ? error.message : String(error))
-      }
-      selectedPeerIds.value = []
-    } else {
-      peerDialogOpen.value = false
+    if (webPeerConnectionState.value === 'ready' && extensionHostRestoreState.value !== 'failed') {
+      // Restore attempts every enabled module; a failure still leaves per-module status to inspect.
+      await startExtensionHost().catch(() => {})
     }
+    if (!ownsRefresh()) return
+    await Promise.all(
+      props.peers.map(async (peer) => {
+        try {
+          const result = await observeExtensionPeer({
+            name: props.extension.name,
+            peer,
+            currentPeerId: props.currentPeerId,
+            livePeerIds: props.livePeerIds,
+            manager: host,
+          })
+          if (!ownsRefresh()) return
+          formats.value[peer.id] = result.supported_distributions
+          statuses.value[peer.id] = result.status
+          delete errors.value[peer.id]
+        } catch (error) {
+          if (!ownsRefresh()) return
+          statuses.value[peer.id] = null
+          errors.value[peer.id] = error instanceof Error ? error.message : String(error)
+        }
+      })
+    )
+    if (ownsRefresh()) setupContribution.value = getExtensionSetupContribution(props.extension.name)
   } finally {
-    setupContribution.value = getExtensionSetupContribution(props.extension.name)
-    updatingPeers.value = false
+    if (request === runtimeRequest) refreshing.value = false
   }
 }
-
-const onEditConfigClick = () => {
-  configModel.value = JSON.stringify(props.extension.config, null, 2)
-  configValidation.value = undefined
-  operationError.value = null
-  configPopupOpen.value = true
+function currentHostRestoring(peer: Peer): boolean {
+  return peer.id === props.currentPeerId && extensionHostRestoreState.value === 'restoring'
 }
-
-const onSetupClick = () => {
-  const contribution = setupContribution.value
-  if (!contribution) return
-  setupComponent.value = contribution.component
-  setupPopupOpen.value = true
+async function perform(peer: Peer, operation: () => Promise<unknown>): Promise<Error | null> {
+  if (busyPeer.value) return null
+  busyPeer.value = peer.id
+  // A pre-command sample must not replace the status observed after its completion.
+  runtimeRequest += 1
+  delete errors.value[peer.id]
+  let operationError: Error | null = null
+  const meta = { ...configStore.metaConfig }
+  const host = getExtensionHost()
+  const ownsOperation = () => ownsConnection(meta) && getExtensionHost() === host
+  try {
+    if (currentHostRestoring(peer)) await startExtensionHost().catch(() => {})
+    if (!ownsOperation()) return null
+    await operation()
+  } catch (error) {
+    operationError = error instanceof Error ? error : new Error(String(error))
+  } finally {
+    // A failed command may still have persisted its desired intent.
+    if (ownsOperation()) emit('participationChanged')
+    try {
+      if (ownsOperation()) await refreshRuntime()
+    } finally {
+      if (operationError && ownsOperation()) errors.value[peer.id] = operationError.message
+      busyPeer.value = ''
+    }
+  }
+  return operationError
 }
 
-const onChangeVersionClick = async () => {
-  managementOpen.value = false
-  versionModel.value = props.extension.version
-  versionOptions.value = []
-  versionError.value = null
-  versionPopupOpen.value = true
+async function togglePeer(peer: Peer, enabled: boolean): Promise<void> {
+  if (!enabled && peer.id === props.currentPeerId) await closeSetup()
+  await perform(peer, () =>
+    setExtensionPeerEnabled({
+      name: props.extension.name,
+      peer,
+      currentPeerId: props.currentPeerId,
+      livePeerIds: props.livePeerIds,
+      enabled,
+      manager: getExtensionHost(),
+    })
+  )
+}
+async function removePeer(peer: Peer): Promise<void> {
+  await perform(peer, async () => {
+    if (peer.id === props.currentPeerId)
+      return getExtensionHost().uninstall(props.extension.name, peer.id)
+    if (extensionPeerControlMode(peer, props.currentPeerId, props.livePeerIds) === 'remote-host') {
+      await manageExtensionOnPeer(peer.id, { action: 'unselect', extension: props.extension.name })
+      return
+    }
+    const pin = await ExtensionParticipationModel.get(peer.id, props.extension.name)
+    if (pin) await pin.remove()
+  })
+}
+async function openVersion(peer: Peer): Promise<void> {
+  selectedPeer.value = peer
+  versionError.value = ''
+  versionModel.value = ''
+  distributionModel.value =
+    props.participations.find((row) => row.peer_id === peer.id)?.distribution ??
+    supportedFormats(peer)[0] ??
+    'module_federation'
+  versionOpen.value = true
+  await loadVersions()
+}
+async function loadVersions(): Promise<void> {
+  const request = ++versionRequest
+  const distribution = distributionModel.value
+  const peerId = selectedPeer.value?.id
   versionLoading.value = true
+  versionOptions.value = []
+  versionError.value = ''
+  const readPublished = async (format: NativeDistribution) => {
+    try {
+      const catalog = await getExtensionRegistry().getExtension(props.extension.name, format)
+      const releases = sortPublishedReleases(catalog.releases ?? [])
+      if (request === versionRequest) publishedFormats.value[format] = releases.length > 0
+      return releases
+    } catch (error) {
+      if (error instanceof RegistryReleaseError && error.status === 404) {
+        if (request === versionRequest) publishedFormats.value[format] = false
+        return []
+      }
+      if (request === versionRequest) delete publishedFormats.value[format]
+      throw error
+    }
+  }
   try {
-    const record = await getExtensionRegistry().getExtension(props.extension.name)
-    versionOptions.value = sortPublishedReleases(record.releases ?? []).map((release) => ({
+    const releases = await readPublished(distribution)
+    if (request !== versionRequest) return
+    versionOptions.value = releases.map((release) => ({
       label: release.version,
       value: release.version,
-      description: [
-        release.python ? t('extension.hostCore') : null,
-        release.module_federation ? t('extension.hostWeb') : null,
-      ]
-        .filter(Boolean)
-        .join(' · '),
     }))
+    const previous = props.participations.find(
+      (row) => row.peer_id === peerId && row.distribution === distribution
+    )
+    versionModel.value = versionOptions.value.some((option) => option.value === previous?.version)
+      ? previous!.version
+      : (preferredPublishedRelease(releases)?.version ?? '')
+    if (!releases.length) {
+      // On explicit install, show another published native format without implying this Peer supports it.
+      const other: NativeDistribution = distribution === 'python' ? 'module_federation' : 'python'
+      if (publishedFormats.value[other] === undefined) await readPublished(other)
+    }
   } catch (error) {
-    versionError.value = error instanceof Error ? error.message : String(error)
+    if (request === versionRequest)
+      versionError.value = error instanceof Error ? error.message : String(error)
   } finally {
-    versionLoading.value = false
+    if (request === versionRequest) versionLoading.value = false
   }
 }
 
-const onConfirmVersion = () => {
-  if (versionLoading.value || versionError.value || !versionModel.value) return
-  versionPopupOpen.value = (async () => {
+async function saveVersion(): Promise<void> {
+  const peer = selectedPeer.value
+  if (!peer || !versionModel.value || versionLoading.value || busyPeer.value) return
+  const distribution = distributionModel.value
+  const version = versionModel.value
+  const name = props.extension.name
+  const meta = { ...configStore.metaConfig }
+  const host = getExtensionHost()
+  const pickerRequest = versionRequest
+  const ownsSelection = () =>
+    ownsConnection(meta) &&
+    getExtensionHost() === host &&
+    versionOpen.value &&
+    versionRequest === pickerRequest &&
+    selectedPeer.value?.id === peer.id &&
+    distributionModel.value === distribution &&
+    versionModel.value === version
+  const commandError = await perform(peer, () =>
+    selectExtensionPeerVersion({
+      name: props.extension.name,
+      nickname: props.extension.nickname ?? props.extension.name,
+      releases: getExtensionRegistry(),
+      version,
+      distribution,
+      peer,
+      currentPeerId: props.currentPeerId,
+      livePeerIds: props.livePeerIds,
+      manager: getExtensionHost(),
+    })
+  )
+  if (!ownsSelection()) return
+  if (!commandError) {
+    versionOpen.value = false
+  } else if (commandError instanceof PeerOutcomeUnknown) {
+    // This independent read can verify selection through a target Peer restart; never resend select.
     try {
-      operationError.value = null
-      const updatedExtension = await getExtensionHost().changeVersion(
-        props.extension.name,
-        versionModel.value
-      )
-      emit('updated', updatedExtension)
-      return false
-    } catch (error) {
-      operationError.value = error instanceof Error ? error.message : String(error)
-      return true
+      const observed = await ExtensionParticipationModel.readForConnection(meta, peer.id, name)
+      if (
+        ownsSelection() &&
+        observed?.distribution === distribution &&
+        observed.version === version
+      ) {
+        versionOpen.value = false
+      }
+    } catch {
+      // Keep the original unknown outcome until the exact selection can be observed.
     }
-  })()
+  }
 }
-
-const onConfirmConfig = async () => {
+async function openDocumentation(peer: Peer): Promise<void> {
+  const pin = props.participations.find((row) => row.peer_id === peer.id)
+  if (!pin?.distribution) return
+  const request = ++documentationRequest
+  docsPeerName.value = `${peer.name} · ${distributionLabel(pin.distribution)} ${pin.version}`
+  docsOpen.value = true
+  docsLoading.value = true
+  documentation.value = []
+  docsError.value = ''
+  try {
+    const origin = await new ExtensionRegistryOriginResolver(
+      () => configStore.peerConfig.extension_registry_url
+    ).resolve()
+    const links =
+      (await getExtensionDocumentation(
+        origin,
+        props.extension.name,
+        pin.version,
+        pin.distribution
+      )) ?? []
+    if (request === documentationRequest) documentation.value = links
+  } catch (error) {
+    if (request === documentationRequest)
+      docsError.value = error instanceof Error ? error.message : String(error)
+  } finally {
+    if (request === documentationRequest) docsLoading.value = false
+  }
+}
+function openConfig(): void {
+  configModel.value = JSON.stringify(props.extension.config, null, 2)
+  schemaPeerId.value = schemaOptions.value.some((option) => option.value === props.currentPeerId)
+    ? props.currentPeerId
+    : ''
+  configValidation.value = undefined
+  configError.value = ''
+  configOpen.value = true
+}
+async function saveConfig(): Promise<void> {
   if (configSaving.value || !canSaveConfig.value) return
   configSaving.value = true
-  operationError.value = null
   try {
     const config: unknown = JSON.parse(configModel.value)
     if (!config || typeof config !== 'object' || Array.isArray(config))
       throw new Error(t('common.invalidConfig'))
-    const updatedExtension = await getExtensionHost().updateConfig(
-      props.extension.name,
-      config as Record<string, unknown>
-    )
-    emit('updated', updatedExtension)
-    configPopupOpen.value = false
+    const shared = await ExtensionModel.get(props.extension.name)
+    if (!shared) throw new Error('Extension no longer exists.')
+    emit('updated', await shared.updateConfig(config as Record<string, unknown>))
+    configOpen.value = false
   } catch (error) {
-    operationError.value = error instanceof Error ? error.message : t('common.saveFailed')
+    configError.value = error instanceof Error ? error.message : String(error)
   } finally {
     configSaving.value = false
   }
 }
-
-const onUninstall = async () => {
-  operationError.value = null
-  isUninstalling.value = true
-  try {
-    await getExtensionHost().uninstall(props.extension.name)
-    managementOpen.value = false
-    emit('uninstalled')
-  } catch (error) {
-    operationError.value = error instanceof Error ? error.message : String(error)
-  } finally {
-    isUninstalling.value = false
-  }
+function openSetup(): void {
+  setupComponent.value = setupContribution.value?.component ?? null
+  setupOpen.value = !!setupComponent.value
 }
+async function closeSetup(): Promise<void> {
+  setupOpen.value = false
+  setupComponent.value = null
+  await nextTick()
+}
+watch(() => props.livePeerIds, refreshRuntime)
+watch(extensionHostRestoreState, (state) => {
+  if (state === 'restored' || state === 'failed') void refreshRuntime()
+})
+onMounted(refreshRuntime)
 </script>
 
 <template>
-  <div class="extension-card">
-    <div class="extension-card__header">
-      <div class="flex flex-col">
-        <div class="flex flex-row items-center gap-2">
-          <span class="extension-card__id">{{ extension.name }}</span>
-          <span class="extension-card__version">v{{ extension.version }}</span>
-        </div>
-        <span v-if="extension.nickname" class="extension-card__nickname">
-          {{ extension.nickname }}
-        </span>
+  <article class="extension-card" :aria-label="extension.nickname ?? extension.name">
+    <header class="extension-card__header">
+      <div>
+        <span class="extension-card__id">{{ extension.nickname ?? extension.name }}</span>
+        <p class="extension-card__hint">{{ extension.name }}</p>
       </div>
-    </div>
-
-    <div class="extension-card__actions">
-      <InkButton
-        :text="t('extension.enableOnPeers')"
-        size="sm"
-        :disabled="
-          peerSelectionDisabled || !peers.some((peer) => !extension.enabled.includes(peer.id))
-        "
-        @click="openPeerDialog('enable')"
-      />
-      <InkButton
-        :text="t('extension.disableOnPeers')"
-        size="sm"
-        :disabled="
-          peerSelectionDisabled || !peers.some((peer) => extension.enabled.includes(peer.id))
-        "
-        @click="openPeerDialog('disable')"
-      />
-      <InkButton
-        v-if="setupContribution"
-        :text="t('extension.setup')"
-        theme="primary"
-        size="sm"
-        @click="onSetupClick"
-      />
-      <InkButton @click="onEditConfigClick" :text="t('extension.editConfig')" size="sm" />
-      <InkButton
-        :text="t('extension.versionAndRemoval')"
-        size="sm"
-        theme="subtle"
-        @click="openManagement"
-      />
-    </div>
-    <p class="extension-card__hint">
-      {{ t('extension.enabledPeerCount', { count: extension.enabled.length }) }}
-    </p>
-    <InkDialog
-      v-model="managementOpen"
-      :title="t('extension.versionAndRemoval')"
-      :subtitle="`${extension.nickname ?? extension.name} · v${extension.version}`"
-      :show-confirm="false"
-      :cancel-text="t('common.close')"
-      :is-loading="isUninstalling"
+      <div class="extension-card__actions">
+        <InkButton
+          v-if="setupContribution"
+          :text="t('extension.setup')"
+          size="sm"
+          theme="primary"
+          @click="openSetup"
+        />
+        <InkButton :text="t('extension.editConfig')" size="sm" @click="openConfig" />
+        <InkButton
+          :text="t('common.refresh')"
+          size="sm"
+          :is-loading="refreshing"
+          @click="refreshCard"
+        />
+      </div>
+    </header>
+    <h3 class="extension-card__hint">{{ t('extension.usedOnPeers') }}</h3>
+    <section
+      v-for="{ peer, pin, status } in rows"
+      :key="peer.id"
+      class="extension-card__peer-row"
+      :aria-label="peer.name"
     >
+      <div>
+        <strong>{{ peer.name }}</strong
+        ><span v-if="peer.id === currentPeerId"> · {{ t('extension.currentBrowser') }}</span>
+        <p class="extension-card__hint">
+          {{
+            pin
+              ? `${distributionLabel(pin.distribution)} · ${pin.version}`
+              : t('extension.notInstalled')
+          }}
+        </p>
+        <p v-if="pin" class="extension-card__hint">{{ statusText(peer.id) }}</p>
+        <p v-else-if="noPublishedDistributionForPeer(peer)" class="extension-card__hint">
+          {{ t('extension.unavailableOnPeer') }}
+        </p>
+        <p v-if="errors[peer.id] || status?.error" role="alert" class="extension-card__error">
+          {{ errors[peer.id] || status?.error }}
+        </p>
+      </div>
       <div class="extension-card__actions">
         <InkButton
-          @click="onChangeVersionClick"
-          :text="t('extension.changeVersion')"
+          v-if="supportedFormats(peer).length"
+          :text="
+            t(
+              pin
+                ? 'extension.changeVersion'
+                : noPublishedDistributionForPeer(peer)
+                  ? 'extension.unavailableOnPeer'
+                  : 'extension.install'
+            )
+          "
           size="sm"
-          :disabled="extension.enabled.length > 0"
+          :disabled="
+            !!busyPeer ||
+            peerSelectionDisabled ||
+            currentHostRestoring(peer) ||
+            (!pin && noPublishedDistributionForPeer(peer))
+          "
+          @click="openVersion(peer)"
         />
         <InkButton
-          @click="onUninstall"
-          :text="t('extension.uninstall')"
-          theme="danger"
+          v-if="pin?.distribution"
+          :text="
+            t(
+              pin.enabled || status?.running
+                ? 'extension.disableSelected'
+                : 'extension.enableSelected'
+            )
+          "
+          size="sm"
+          :is-loading="busyPeer === peer.id || (currentHostRestoring(peer) && pin.enabled)"
+          :disabled="!!busyPeer || peerSelectionDisabled || currentHostRestoring(peer)"
+          @click="togglePeer(peer, !(pin.enabled || status?.running))"
+        />
+        <InkButton
+          v-if="pin?.distribution"
+          :text="t('extension.documentation')"
+          size="sm"
+          theme="subtle"
+          @click="openDocumentation(peer)"
+        />
+        <InkButton
+          v-if="pin && !pin.enabled && !status?.running"
+          :text="t('extension.removeFromPeer')"
           size="sm"
-          :disabled="!canUninstall"
-          :is-loading="isUninstalling"
+          theme="subtle"
+          :disabled="!!busyPeer || currentHostRestoring(peer)"
+          @click="removePeer(peer)"
         />
       </div>
-
-      <p v-if="extension.enabled.length > 0" class="extension-card__hint">
-        {{ t('extension.uninstallDisabled') }}
-      </p>
-      <p v-else class="extension-card__hint">{{ t('extension.uninstallConfirm') }}</p>
-      <p v-if="operationError" role="alert" class="extension-card__error">{{ operationError }}</p>
-    </InkDialog>
-    <div class="extension-card__documentation">
-      <InkLoading
-        v-if="documentationStatus === 'loading'"
-        variant="spinner"
-        size="xs"
-        :label="t('common.loading')"
-      />
-      <nav
-        v-else-if="documentation.length"
-        class="extension-card__actions"
-        :aria-label="t('extension.documentation')"
-      >
+    </section>
+    <InkDialog
+      v-model="docsOpen"
+      :title="t('extension.documentation')"
+      :subtitle="docsPeerName"
+      :show-confirm="false"
+      :cancel-text="t('common.close')"
+    >
+      <InkLoading v-if="docsLoading" size="xs" variant="spinner" :label="t('common.loading')" />
+      <p v-else-if="docsError" role="alert" class="extension-card__error">{{ docsError }}</p>
+      <nav v-else-if="documentation.length" class="extension-card__actions">
         <a
           v-for="link in documentation"
           :key="link.scope"
           :href="link.entry_url"
           target="_blank"
           rel="noopener noreferrer"
+          >{{ t(`extension.documentationScope.${link.scope}`) }} ↗</a
         >
-          {{ t(`extension.documentationScope.${link.scope}`) }}
-          <span aria-hidden="true"> ↗</span>
-        </a>
       </nav>
-      <p v-else-if="documentationStatus === 'unavailable'" class="extension-card__hint">
-        {{ t('extension.documentationUnavailable') }}
-      </p>
-      <p v-else-if="documentationStatus === 'missing'" class="extension-card__hint">
-        {{ t('extension.documentationMissing') }}
-      </p>
-      <InkButton
-        v-if="documentationStatus === 'unavailable'"
-        :text="t('common.retry')"
-        size="sm"
-        @click="documentationRetry++"
-      />
-    </div>
-
+      <p v-else class="extension-card__hint">{{ t('extension.documentationMissing') }}</p>
+    </InkDialog>
     <InkDialog
-      v-model="peerDialogOpen"
+      v-model="versionOpen"
       :title="
-        t(peerAction === 'enable' ? 'extension.enablePeerTitle' : 'extension.disablePeerTitle', {
-          name: extension.nickname ?? extension.name,
-        })
+        t(
+          participations.some((row) => row.peer_id === selectedPeer?.id)
+            ? 'extension.changeVersionTitle'
+            : selectedPeer && noPublishedDistributionForPeer(selectedPeer)
+              ? 'extension.unavailableOnPeer'
+              : 'extension.install'
+        )
       "
-      :show-cancel="false"
+      :subtitle="selectedPeer?.name"
       :show-confirm="false"
-      :is-loading="updatingPeers"
+      :show-cancel="false"
     >
-      <div class="extension-card__peer-options">
-        <label v-for="peer in eligiblePeers" :key="peer.id" class="extension-card__peer-option">
-          <input
-            v-model="selectedPeerIds"
-            type="checkbox"
-            :value="peer.id"
-            :disabled="updatingPeers"
-          />
-          <span>
-            <span>{{ peerLabel(peer) }}</span>
-            <span v-if="peer.id === currentPeerId" class="extension-card__peer-note">
-              {{ t('extension.currentBrowser') }}
-            </span>
-            <span
-              v-else-if="
-                extensionPeerControlMode(peer, currentPeerId, livePeerIds) === 'desired-state'
-              "
-              class="extension-card__peer-note"
-            >
-              {{ t('extension.desiredStateBrief') }}
-            </span>
-          </span>
-        </label>
-      </div>
-      <p v-if="hasDeferredSelection" class="extension-card__hint">
-        {{ t('extension.desiredStateExplanation') }}
+      <InkDropdown
+        v-if="distributionOptions.length > 1"
+        v-model="distributionModel"
+        :label="t('extension.distribution')"
+        :options="distributionOptions"
+        :disabled="versionLoading || !!busyPeer"
+        @change="loadVersions"
+      />
+      <p v-else class="extension-card__hint">
+        {{ t('extension.distribution') }}: {{ distributionLabel(distributionModel) }}
+      </p>
+      <InkLoading
+        v-if="versionLoading"
+        size="xs"
+        variant="spinner"
+        :label="t('extension.versionsLoading')"
+      />
+      <InkDropdown
+        v-else-if="versionOptions.length"
+        v-model="versionModel"
+        :label="t('extension.version')"
+        :options="versionOptions"
+        :error="versionError"
+        :disabled="!!busyPeer"
+        required
+      />
+      <p
+        v-if="!versionLoading && publishedFormats[distributionModel] === false"
+        class="extension-card__hint"
+      >
+        {{
+          t('extension.noPublishedDistribution', {
+            distribution: distributionLabel(distributionModel),
+          })
+        }}
       </p>
-      <p v-for="error in peerActionErrors" :key="error" role="alert" class="extension-card__error">
-        {{ error }}
+      <p
+        v-if="!versionLoading && !versionOptions.length && knownPublishedFormats.length"
+        class="extension-card__hint"
+      >
+        {{ t('extension.publishedDistributions') }}:
+        {{ knownPublishedFormats.map(distributionLabel).join(', ') }}
       </p>
-      <template #footer>
-        <InkButton
+      <p v-if="versionError" role="alert" class="extension-card__error">{{ versionError }}</p>
+      <p v-if="selectedPeer && errors[selectedPeer.id]" role="alert" class="extension-card__error">
+        {{ errors[selectedPeer.id] }}
+      </p>
+      <template #footer
+        ><InkButton
           :text="t('common.cancel')"
-          :disabled="updatingPeers"
-          @click="peerDialogOpen = false"
-        />
-        <InkButton
-          :text="
-            t(peerAction === 'enable' ? 'extension.enableSelected' : 'extension.disableSelected')
-          "
+          :disabled="!!busyPeer"
+          @click="versionOpen = false" /><InkButton
+          :text="t('common.save')"
           theme="primary"
-          :disabled="selectedPeerIds.length === 0"
-          :is-loading="updatingPeers"
-          @click="applyPeerAction"
-        />
-      </template>
-    </InkDialog>
-
-    <InkDialog
-      v-model="setupPopupOpen"
-      :title="t('extension.setupTitle', { name: extension.nickname ?? extension.name })"
-      :show-cancel="false"
-      :show-confirm="false"
-      :close-on-scrim="false"
-      @update:model-value="(open) => !open && closeSetup()"
-    >
-      <component :is="setupComponent" v-if="setupComponent" @close="closeSetup" />
+          :is-loading="!!busyPeer"
+          :disabled="!versionModel || versionLoading || !!versionError"
+          @click="saveVersion"
+      /></template>
     </InkDialog>
-
     <InkDialog
-      v-model="configPopupOpen"
+      v-model="configOpen"
       :title="t('extension.editConfigTitle')"
-      :is-loading="configSaving"
-      style="width: min(48rem, calc(100vw - 2 * var(--sys-space-md)))"
+      :show-confirm="false"
+      :show-cancel="false"
     >
+      <InkDropdown
+        v-if="schemaOptions.length"
+        v-model="schemaPeerId"
+        :label="t('extension.configSchemaSource')"
+        :options="[{ label: t('extension.jsonConfig'), value: '' }, ...schemaOptions]"
+      />
       <SchemaConfigEditor
         v-model="configModel"
-        :schema="extension.config_schema ?? undefined"
+        :schema="configSchema"
         :label="t('extension.editConfigTitle')"
         :disabled="configSaving"
         @validation="configValidation = $event"
       />
-      <p v-if="operationError" role="alert" class="extension-card__error">{{ operationError }}</p>
-      <template #footer>
-        <InkButton :text="t('common.cancel')" @click="configPopupOpen = false" />
-        <InkButton
+      <p v-if="configError" role="alert" class="extension-card__error">{{ configError }}</p>
+      <template #footer
+        ><InkButton
+          :text="t('common.cancel')"
+          :disabled="configSaving"
+          @click="configOpen = false" /><InkButton
           :text="t('common.save')"
           theme="primary"
-          :disabled="!canSaveConfig"
           :is-loading="configSaving"
-          @click="onConfirmConfig"
-        />
-      </template>
+          :disabled="!canSaveConfig"
+          @click="saveConfig"
+      /></template>
     </InkDialog>
-
     <InkDialog
-      v-model="versionPopupOpen"
-      :title="t('extension.changeVersionTitle')"
-      :show-confirm="!versionLoading && !versionError && versionOptions.length > 0"
-      @confirm="onConfirmVersion"
-    >
-      <div v-if="versionLoading" class="extension-card__loading">
-        <InkLoading variant="spinner" size="xs" :label="t('extension.versionsLoading')" />
-      </div>
-      <InkDropdown
-        v-else
-        v-model="versionModel"
-        :label="t('extension.version')"
-        :options="versionOptions"
-        :error="versionError ?? ''"
-        :disabled="!!versionError"
-        required
-      />
-      <InkButton
-        v-if="versionError"
-        :text="t('common.retry')"
-        size="sm"
-        @click="onChangeVersionClick"
-      />
-      <p v-if="operationError" role="alert" class="extension-card__error">{{ operationError }}</p>
-    </InkDialog>
-  </div>
+      v-model="setupOpen"
+      :title="t('extension.setupTitle', { name: extension.nickname ?? extension.name })"
+      :show-confirm="false"
+      :show-cancel="false"
+      :close-on-scrim="false"
+      @update:model-value="(open) => !open && closeSetup()"
+      ><component :is="setupComponent" v-if="setupComponent" @close="closeSetup"
+    /></InkDialog>
+  </article>
 </template>
-
 <style lang="scss" scoped src="./extensionCard.scss" />
diff --git a/apps/client-web/src/components/info-base/SolvedContentPopup/SolvedContentPopup.vue b/apps/client-web/src/components/info-base/SolvedContentPopup/SolvedContentPopup.vue
index ae67da21..861609d9 100644
--- a/apps/client-web/src/components/info-base/SolvedContentPopup/SolvedContentPopup.vue
+++ b/apps/client-web/src/components/info-base/SolvedContentPopup/SolvedContentPopup.vue
@@ -2,8 +2,9 @@
 import { onUnmounted, ref, shallowRef, watch } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { InkButton, InkLoading, InkPopup } from '@inkcre/ui-web'
-import { Block, getInfoBaseRouter, Resolver } from '@inkcre/core'
+import { Block, getInfoBaseRouter, Resolver, UnknownResolverError } from '@inkcre/core'
 
+import { extensionHostRestoreState } from '@/core'
 import SolvedContentRenderer from '@/components/info-base/SolvedContentRenderer/SolvedContentRenderer.vue'
 import type { SolvedContentPopupProps } from './SolvedContentPopup'
 
@@ -17,6 +18,7 @@ const resolver = shallowRef<Resolver | null>(null)
 const solvedContent = shallowRef<unknown>(null)
 const error = shallowRef<Error | null>(null)
 let generation = 0
+let lookupBeforeRestore = false
 
 async function load(refresh = false): Promise<void> {
   const current = ++generation
@@ -25,6 +27,7 @@ async function load(refresh = false): Promise<void> {
   solvedContent.value = null
   error.value = null
   status.value = 'loading'
+  lookupBeforeRestore = false
   await previous?.dispose()
 
   let next: Resolver | null = null
@@ -35,6 +38,7 @@ async function load(refresh = false): Promise<void> {
       status.value = 'missing'
       return
     }
+    lookupBeforeRestore = ['idle', 'restoring'].includes(extensionHostRestoreState.value)
     const resolverClass = Resolver.getClass(block.resolver)
     next = new resolverClass(block)
     const solved = await next.getSolvedContent({ refresh, materializeMissing: false })
@@ -58,6 +62,17 @@ watch(
   () => void load(),
   { immediate: true }
 )
+// A deep link can arrive before enabled native modules register their resolvers.
+// Retry only that lookup failure when restore finishes; preserve other read failures.
+watch([extensionHostRestoreState, error], ([state, cause]) => {
+  if (
+    ['restored', 'failed'].includes(state) &&
+    lookupBeforeRestore &&
+    cause instanceof UnknownResolverError
+  ) {
+    void load()
+  }
+})
 onUnmounted(() => {
   generation += 1
   void resolver.value?.dispose()
diff --git a/apps/client-web/src/components/peer/peerCard/peerCard.vue b/apps/client-web/src/components/peer/peerCard/peerCard.vue
index 5344053d..0e31206d 100644
--- a/apps/client-web/src/components/peer/peerCard/peerCard.vue
+++ b/apps/client-web/src/components/peer/peerCard/peerCard.vue
@@ -3,7 +3,13 @@ import { computed, ref } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { InkButton, InkDialog, InkInput, type JsonEditorValidation } from '@inkcre/ui-web'
 import SchemaConfigEditor from '@/components/schemaConfigEditor/schemaConfigEditor.vue'
-import { configStore, ExtensionModel, Peer, PeerConfigSchema, PeerManager } from '@inkcre/core'
+import {
+  configStore,
+  ExtensionParticipationModel,
+  Peer,
+  PeerConfigSchema,
+  PeerManager,
+} from '@inkcre/core'
 import { peerCardEmits, peerCardProps } from './peerCard'
 import { currentWebPeer } from '@/core'
 
@@ -87,9 +93,10 @@ const onConfirmDelete = async () => {
       emit('updated')
       return
     }
-    const extensions = await ExtensionModel.list()
+    const extensions = await ExtensionParticipationModel.list(props.peer.id)
     for (const extension of extensions) {
-      if (extension.enabled.includes(props.peer.id)) await extension.disablePeer(props.peer.id)
+      if (extension.enabled) await extension.setEnabled(false)
+      await (await ExtensionParticipationModel.get(props.peer.id, extension.name))?.remove()
     }
     await props.peer.delete()
     deleteOpen.value = false
diff --git a/apps/client-web/src/core.ts b/apps/client-web/src/core.ts
index d937eede..32c76860 100644
--- a/apps/client-web/src/core.ts
+++ b/apps/client-web/src/core.ts
@@ -147,6 +147,10 @@ type ClientExtensionManager = ExtensionManager<ClientExtensionModule>
 
 let extensionHost: ClientExtensionManager | null = null
 let extensionHostStartup: Promise<void> | null = null
+let extensionHostConnection: MetaConfig | null = null
+export const extensionHostRestoreState = Vue.ref<'idle' | 'restoring' | 'restored' | 'failed'>(
+  'idle'
+)
 let extensionRegistry: RegistryReleaseReader | null = null
 let extensionRegistryOrigin: ExtensionRegistryOriginResolver | null = null
 let moduleFederation: ReturnType<typeof createInstance> | null = null
@@ -158,6 +162,8 @@ export const webPeerConnectionState = Vue.ref<
 
 export function initializeExtensionHost(): ClientExtensionManager {
   extensionHostStartup = null
+  extensionHostRestoreState.value = 'idle'
+  extensionHostConnection = { ...configStore.metaConfig }
   extensionRegistryOrigin = new ExtensionRegistryOriginResolver(
     () => configStore.peerConfig.extension_registry_url
   )
@@ -167,6 +173,7 @@ export function initializeExtensionHost(): ClientExtensionManager {
     hostSdk: { name: '@inkcre/core', version: corePackageJson.version },
   })
   extensionHost = new ExtensionManager<ClientExtensionModule>({
+    peerId: configStore.metaConfig.INKCRE_PEER_ID,
     releases: extensionRegistry,
     moduleFederation,
   })
@@ -179,12 +186,24 @@ export function startExtensionHost(): Promise<void> {
     return Promise.reject(new Error('Web Peer lease is not ready for Extension Host startup.'))
   }
   if (extensionHostStartup) return extensionHostStartup
-  const startup = getExtensionHost().startup(configStore.metaConfig.INKCRE_PEER_ID)
-  extensionHostStartup = startup.catch((error: unknown) => {
-    extensionHostStartup = null
-    throw error
-  })
-  return extensionHostStartup
+  extensionHostRestoreState.value = 'restoring'
+  const host = getExtensionHost()
+  const startup = host.startup(configStore.metaConfig.INKCRE_PEER_ID)
+  const restore = startup.then(
+    () => {
+      if (extensionHost !== host || extensionHostStartup !== restore) return
+      extensionHostRestoreState.value = 'restored'
+    },
+    (error: unknown) => {
+      if (extensionHost === host && extensionHostStartup === restore) {
+        extensionHostRestoreState.value = 'failed'
+        extensionHostStartup = null
+      }
+      throw error
+    }
+  )
+  extensionHostStartup = restore
+  return restore
 }
 
 export function getExtensionHost(): ClientExtensionManager {
@@ -225,6 +244,13 @@ export async function adoptWebPeerRuntime(runtime: WebPeerRuntime): Promise<void
 
 async function applyWebPeerParticipation(runtime: WebPeerRuntime, meta: MetaConfig): Promise<void> {
   if (!ownsWebPeerConnection(runtime, meta)) return
+  // Settings drains the old Host before changing database or Peer identity.
+  if (
+    extensionHostConnection?.INKCRE_PEER_ID !== meta.INKCRE_PEER_ID ||
+    extensionHostConnection?.INKCRE_PGREST_URL !== meta.INKCRE_PGREST_URL ||
+    extensionHostConnection?.INKCRE_JWT_SECRET !== meta.INKCRE_JWT_SECRET
+  )
+    initializeExtensionHost()
   if (meta.peer_lease_renew_interval_seconds === 0) {
     webPeerConnectionState.value = 'connecting'
     await JobManager.stopWorker()
@@ -240,6 +266,7 @@ async function applyWebPeerParticipation(runtime: WebPeerRuntime, meta: MetaConf
     await extensionHost?.shutdown()
     if (!ownsWebPeerConnection(runtime, meta)) return
     extensionHostStartup = null
+    extensionHostRestoreState.value = 'idle'
     webPeerConnectionState.value = 'disabled'
     return
   }
@@ -302,6 +329,7 @@ export async function stopWebPeerRuntime(): Promise<void> {
   await extensionHost?.shutdown()
   if (webPeerRuntime !== null) return
   extensionHostStartup = null
+  extensionHostRestoreState.value = 'idle'
 }
 
 /** Drain work against the old connection before configuration changes its database authority. */
diff --git a/apps/client-web/src/extension-peer-control.ts b/apps/client-web/src/extension-peer-control.ts
index a0c79a26..bb604716 100644
--- a/apps/client-web/src/extension-peer-control.ts
+++ b/apps/client-web/src/extension-peer-control.ts
@@ -1,8 +1,17 @@
-import { ExtensionModel, Peer, type InstalledExtension } from '@inkcre/core'
+import {
+  ExtensionModel,
+  ExtensionParticipationModel,
+  Peer,
+  type ExtensionParticipation,
+  type ExtensionRuntimeStatus,
+  type NativeDistribution,
+} from '@inkcre/core'
 import {
   EXTENSION_MANAGEMENT_CAPABILITY,
   manageExtensionOnPeer,
+  readExtensionPeerStatus,
   type ExtensionManager,
+  type RegistryReleaseReader,
 } from '@inkcre/extension-runtime-client-web'
 
 export { EXTENSION_MANAGEMENT_CAPABILITY }
@@ -27,6 +36,31 @@ export function extensionPeerControlMode(
     : 'desired-state'
 }
 
+export async function observeExtensionPeer(input: {
+  name: string
+  peer: Peer
+  currentPeerId: string
+  livePeerIds: ReadonlySet<string>
+  manager: ExtensionManager
+}): Promise<{
+  supported_distributions: NativeDistribution[]
+  status: ExtensionRuntimeStatus | null
+}> {
+  const mode = extensionPeerControlMode(input.peer, input.currentPeerId, input.livePeerIds)
+  if (mode === 'current-runtime') {
+    return {
+      supported_distributions: ['module_federation'],
+      status: await input.manager.getStatus(input.name, input.currentPeerId),
+    }
+  }
+  if (mode === 'desired-state') return { supported_distributions: [], status: null }
+  const response = await readExtensionPeerStatus(input.peer.id, input.name)
+  return {
+    supported_distributions: response.supported_distributions,
+    status: response.extensions.find((row) => row.name === input.name) ?? null,
+  }
+}
+
 export async function setExtensionPeerEnabled(input: {
   name: string
   peer: Peer
@@ -34,7 +68,7 @@ export async function setExtensionPeerEnabled(input: {
   livePeerIds: ReadonlySet<string>
   enabled: boolean
   manager: ExtensionManager
-}): Promise<InstalledExtension> {
+}): Promise<ExtensionParticipation | ExtensionRuntimeStatus> {
   const mode = extensionPeerControlMode(input.peer, input.currentPeerId, input.livePeerIds)
   if (mode === 'current-runtime') {
     return input.enabled
@@ -42,15 +76,51 @@ export async function setExtensionPeerEnabled(input: {
       : input.manager.disable(input.name, input.currentPeerId)
   }
   if (mode === 'desired-state') {
-    const extension = await ExtensionModel.get(input.name)
-    if (!extension) throw new Error(`Extension ${input.name} is not installed.`)
-    return input.enabled
-      ? extension.enablePeer(input.peer.id)
-      : extension.disablePeer(input.peer.id)
+    const participation = await ExtensionParticipationModel.get(input.peer.id, input.name)
+    if (!participation) throw new Error('Select a version for this Peer first.')
+    return participation.setEnabled(input.enabled)
   }
-
   return manageExtensionOnPeer(input.peer.id, {
     action: input.enabled ? 'enable' : 'disable',
     extension: input.name,
   })
 }
+
+export async function selectExtensionPeerVersion(input: {
+  name: string
+  nickname: string
+  releases: RegistryReleaseReader
+  version: string
+  distribution: NativeDistribution
+  peer: Peer
+  currentPeerId: string
+  livePeerIds: ReadonlySet<string>
+  manager: ExtensionManager
+}): Promise<ExtensionParticipation | ExtensionRuntimeStatus> {
+  const mode = extensionPeerControlMode(input.peer, input.currentPeerId, input.livePeerIds)
+  if (mode === 'current-runtime') {
+    if (input.distribution !== 'module_federation')
+      throw new Error('This Peer supports Module Federation.')
+    return input.manager.install({ name: input.name, version: input.version }, input.currentPeerId)
+  }
+  if (mode === 'remote-host') {
+    return manageExtensionOnPeer(input.peer.id, {
+      action: 'select',
+      extension: input.name,
+      distribution: input.distribution,
+      version: input.version,
+    })
+  }
+  await input.releases.getRelease(input.name, input.version, true, input.distribution)
+  const previous = await ExtensionParticipationModel.get(input.peer.id, input.name)
+  if (previous?.distribution !== input.distribution)
+    throw new Error('Connect this Peer to verify its supported distributions.')
+  await ExtensionModel.install({ name: input.name, nickname: input.nickname })
+  return ExtensionParticipationModel.select({
+    name: input.name,
+    peerId: input.peer.id,
+    distribution: input.distribution,
+    version: input.version,
+    expectedVersion: previous.version,
+  })
+}
diff --git a/apps/client-web/src/locales/messages/en.json b/apps/client-web/src/locales/messages/en.json
index 2461d6c9..72bb1e94 100644
--- a/apps/client-web/src/locales/messages/en.json
+++ b/apps/client-web/src/locales/messages/en.json
@@ -159,7 +159,7 @@
     "documentationUnavailable": "Documentation is temporarily unavailable.",
     "registryUnavailable": "The Registry is unavailable",
     "releaseUnavailable": "Unable to load this Extension",
-    "invalidInstallLink": "This installation link needs one Extension ID and one exact version.",
+    "invalidInstallLink": "This installation link needs an Extension ID, distribution and exact version.",
     "connectBeforeInstall": "Connect your deployment in",
     "connectDeployment": "Connect your deployment",
     "connectDeploymentDescription": "Add its connection in Settings to manage Extensions here.",
@@ -181,8 +181,8 @@
     "disableOnPeers": "Disable…",
     "enablePeerTitle": "Enable {name} on Peers",
     "disablePeerTitle": "Disable {name} on Peers",
-    "enableSelected": "Enable selected",
-    "disableSelected": "Disable selected",
+    "enableSelected": "Enable",
+    "disableSelected": "Disable",
     "currentBrowser": "This browser",
     "desiredStateBrief": "Waiting for Peer sync",
     "peerListUnavailable": "The Peer list could not be loaded: {error}",
@@ -191,7 +191,28 @@
     "noneInstalledDescription": "Browse the Registry to add an Extension.",
     "enabledPeerCount": "Enabled on {count} Peer(s).",
     "uninstallDisabled": "Disable every Peer before uninstalling or changing the shared version.",
-    "uninstallConfirm": "Uninstall removes this extension from the deployment. Its configuration will be deleted."
+    "uninstallConfirm": "Uninstall removes this extension from the deployment. Its configuration will be deleted.",
+    "usedOnPeers": "Used on Peers",
+    "restartRequired": "Restart required",
+    "runningVersion": "Running {version}",
+    "needsVersionSelection": "Select a distribution",
+    "pendingApplication": "Pending application",
+    "startFailed": "Unable to start",
+    "notRunning": "Not running",
+    "disabled": "Disabled",
+    "noDistributionRelease": "No published versions for this distribution.",
+    "distributionUnknown": "Distribution unresolved",
+    "notInstalled": "Not installed",
+    "removeFromPeer": "Remove",
+    "distribution": "Distribution",
+    "configSchemaSource": "Configuration form",
+    "jsonConfig": "JSON",
+    "targetPeer": "Peer",
+    "noSupportedPeer": "No connected Peer supports this distribution.",
+    "runtimeUnknown": "Runtime status unavailable",
+    "unavailableOnPeer": "Unavailable on this Peer",
+    "publishedDistributions": "Published distributions",
+    "noPublishedDistribution": "No published {distribution} releases."
   },
   "job": {
     "loadFailed": "Unable to load this job.",
diff --git a/apps/client-web/src/locales/messages/zh-CN.json b/apps/client-web/src/locales/messages/zh-CN.json
index ae168921..c0123707 100644
--- a/apps/client-web/src/locales/messages/zh-CN.json
+++ b/apps/client-web/src/locales/messages/zh-CN.json
@@ -160,7 +160,7 @@
     "documentationUnavailable": "文档暂时不可用。",
     "registryUnavailable": "Registry 暂时不可用",
     "releaseUnavailable": "无法读取此扩展",
-    "invalidInstallLink": "安装链接需要包含一个扩展 ID 和一个精确版本。",
+    "invalidInstallLink": "安装链接需要插件 ID、分发和精确版本。",
     "connectBeforeInstall": "请先在此处连接自己的部署：",
     "connectDeployment": "连接自己的部署",
     "connectDeploymentDescription": "在设置中填入连接信息，即可在此管理扩展。",
@@ -182,8 +182,8 @@
     "disableOnPeers": "停用…",
     "enablePeerTitle": "选择要启用 {name} 的 Peer",
     "disablePeerTitle": "选择要停用 {name} 的 Peer",
-    "enableSelected": "在所选 Peer 上启用",
-    "disableSelected": "在所选 Peer 上停用",
+    "enableSelected": "启用",
+    "disableSelected": "停用",
     "currentBrowser": "当前浏览器",
     "desiredStateBrief": "等待 Peer 同步",
     "peerListUnavailable": "无法加载 Peer 列表：{error}",
@@ -192,7 +192,28 @@
     "noneInstalledDescription": "浏览 Registry，选择要安装的扩展。",
     "enabledPeerCount": "已在 {count} 个 Peer 上启用。",
     "uninstallDisabled": "卸载或变更共享版本前，必须先禁用所有 Peer。",
-    "uninstallConfirm": "卸载会从此部署移除扩展，并删除其配置。"
+    "uninstallConfirm": "卸载会从此部署移除扩展，并删除其配置。",
+    "usedOnPeers": "使用 Peer",
+    "restartRequired": "需要重启",
+    "runningVersion": "正在运行 {version}",
+    "needsVersionSelection": "请选择分发",
+    "pendingApplication": "待应用",
+    "startFailed": "启动失败",
+    "notRunning": "未运行",
+    "disabled": "已停用",
+    "noDistributionRelease": "此分发暂无已发布版本。",
+    "distributionUnknown": "分发待解析",
+    "notInstalled": "未安装",
+    "removeFromPeer": "移除",
+    "distribution": "分发",
+    "configSchemaSource": "配置表单",
+    "jsonConfig": "JSON",
+    "targetPeer": "Peer",
+    "noSupportedPeer": "当前已连接的 Peer 不支持此分发。",
+    "runtimeUnknown": "运行状态未知",
+    "unavailableOnPeer": "此 Peer 不可用",
+    "publishedDistributions": "已发布分发",
+    "noPublishedDistribution": "尚无已发布的 {distribution} 版本。"
   },
   "job": {
     "loadFailed": "无法读取此任务。",
diff --git a/apps/client-web/src/views/extensions/extensions.vue b/apps/client-web/src/views/extensions/extensions.vue
index 4d5773f8..c593ea3d 100644
--- a/apps/client-web/src/views/extensions/extensions.vue
+++ b/apps/client-web/src/views/extensions/extensions.vue
@@ -2,10 +2,19 @@
 import { computed, onMounted, ref, watch } from 'vue'
 import { RouterLink, useRoute, useRouter } from 'vue-router'
 import { useI18n } from 'vue-i18n'
-import { InkButton, InkSkeleton, InkPlaceholder } from '@inkcre/ui-web'
+import { InkButton, InkSkeleton, InkPlaceholder, InkDropdown } from '@inkcre/ui-web'
 import { usePageObjectTitle } from '@/composables/use-page-object-title'
-import { configStore, Peer, PeerManager, type InstalledExtension } from '@inkcre/core'
+import {
+  configStore,
+  Peer,
+  PeerManager,
+  ExtensionParticipationModel,
+  type ExtensionParticipation,
+  type NativeDistribution,
+  type InstalledExtension,
+} from '@inkcre/core'
 import type { ReleaseRecord } from '@inkcre/extension-runtime-client-web'
+import { observeExtensionPeer, selectExtensionPeerVersion } from '@/extension-peer-control'
 import extensionCard from '@/components/extension/extensionCard/extensionCard.vue'
 import {
   getExtensionHost,
@@ -21,6 +30,15 @@ const currentPeerId = configStore.metaConfig.INKCRE_PEER_ID
 const peers = ref<Peer[]>([])
 const livePeerIds = ref<ReadonlySet<string>>(new Set())
 const extensions = ref<InstalledExtension[]>([])
+const participations = ref<ExtensionParticipation[]>([])
+const installPeerId = ref(currentPeerId)
+const installPeers = ref<Peer[]>([])
+const installPeerOptions = computed(() =>
+  installPeers.value.map((peer) => ({ label: peer.name, value: peer.id }))
+)
+const installDistribution = computed<NativeDistribution>(() =>
+  route.query.distribution === 'python' ? 'python' : 'module_federation'
+)
 const peersLoading = ref(false)
 const extensionsLoading = ref(false)
 const extensionError = ref<string | null>(null)
@@ -86,7 +104,12 @@ async function refreshExtensions(): Promise<void> {
   extensionsLoading.value = true
   extensionError.value = null
   try {
-    extensions.value = await getExtensionHost().list()
+    const [shared, selections] = await Promise.all([
+      getExtensionHost().list(),
+      ExtensionParticipationModel.list(),
+    ])
+    extensions.value = shared
+    participations.value = selections
   } catch (error) {
     extensionError.value = error instanceof Error ? error.message : String(error)
   } finally {
@@ -119,14 +142,44 @@ async function loadInstallRelease(): Promise<void> {
   if (!installRequested.value) return
   const name = route.query.install
   const version = route.query.version
-  if (typeof name !== 'string' || typeof version !== 'string') {
+  if (
+    typeof name !== 'string' ||
+    typeof version !== 'string' ||
+    !['python', 'module_federation'].includes(String(route.query.distribution))
+  ) {
     installError.value = t('extension.invalidInstallLink')
     return
   }
   installLoading.value = true
   try {
-    const release = await getExtensionRegistry().getRelease(name, version, true)
-    if (request === releaseRequest) installRelease.value = release
+    const release = await getExtensionRegistry().getRelease(
+      name,
+      version,
+      true,
+      installDistribution.value
+    )
+    if (request === releaseRequest) {
+      installRelease.value = release
+      await refreshPeers()
+      const observations = await Promise.all(
+        availablePeers.value.map(async (peer) => {
+          try {
+            const result = await observeExtensionPeer({
+              name,
+              peer,
+              currentPeerId,
+              livePeerIds: livePeerIds.value,
+              manager: getExtensionHost(),
+            })
+            return result.supported_distributions.includes(installDistribution.value) ? peer : null
+          } catch {
+            return null
+          }
+        })
+      )
+      if (request === releaseRequest)
+        installPeers.value = observations.filter((peer): peer is Peer => peer !== null)
+    }
   } catch (error) {
     if (request === releaseRequest) {
       installError.value = error instanceof Error ? error.message : String(error)
@@ -138,13 +191,24 @@ async function loadInstallRelease(): Promise<void> {
 
 async function installReleaseInDeployment(): Promise<void> {
   const release = installRelease.value
-  if (!release || installing.value || installedMatch.value || !connected.value) return
+  if (!release || installing.value || !connected.value) return
+  const peer = installPeers.value.find((peer) => peer.id === installPeerId.value)
+  if (!peer) return
   installing.value = true
   installError.value = null
   try {
-    updateExtension(
-      await getExtensionHost().install({ name: release.name, version: release.version })
-    )
+    await selectExtensionPeerVersion({
+      name: release.name,
+      nickname: release.nickname,
+      releases: getExtensionRegistry(),
+      version: release.version,
+      distribution: installDistribution.value,
+      peer,
+      currentPeerId,
+      livePeerIds: livePeerIds.value,
+      manager: getExtensionHost(),
+    })
+    await refreshExtensions()
     await router.replace('/extensions')
   } catch (error) {
     installError.value = error instanceof Error ? error.message : String(error)
@@ -160,7 +224,11 @@ function updateExtension(updated: InstalledExtension): void {
     : [...extensions.value, updated].sort((left, right) => left.name.localeCompare(right.name))
 }
 
-watch(() => [route.query.install, route.query.version], loadInstallRelease, { immediate: true })
+watch(
+  () => [route.query.install, route.query.version, route.query.distribution],
+  loadInstallRelease,
+  { immediate: true }
+)
 
 onMounted(() => {
   if (connected.value) {
@@ -225,10 +293,16 @@ onMounted(() => {
               .join(' · ')
           }}
         </p>
-        <p v-if="installedMatch" class="extensions-view__notice">
-          {{ t('extension.installedVersion', { version: installedMatch.version }) }}
+        <InkDropdown
+          v-if="connected"
+          v-model="installPeerId"
+          :label="t('extension.targetPeer')"
+          :options="installPeerOptions"
+        />
+        <p v-if="connected && !installPeers.length" class="extensions-view__notice">
+          {{ t('extension.noSupportedPeer') }}
         </p>
-        <p v-else-if="!connected" class="extensions-view__notice">
+        <p v-if="!connected" class="extensions-view__notice">
           {{ t('extension.connectBeforeInstall') }}
           <RouterLink to="/settings">{{ t('common.settings') }}</RouterLink>
         </p>
@@ -239,10 +313,14 @@ onMounted(() => {
         <p v-if="installError" role="alert" class="extensions-view__error">{{ installError }}</p>
         <div class="extensions-view__install-actions">
           <InkButton
-            v-if="!installedMatch"
             theme="primary"
             :text="t('extension.install')"
-            :disabled="!connected || extensionsLoading || !!extensionError"
+            :disabled="
+              !connected ||
+              extensionsLoading ||
+              !!extensionError ||
+              !installPeers.some((peer) => peer.id === installPeerId)
+            "
             :is-loading="installing"
             @click="installReleaseInDeployment"
           />
@@ -305,12 +383,13 @@ onMounted(() => {
           v-for="extension in extensions"
           :key="extension.name"
           :extension="extension"
+          :participations="participations.filter((row) => row.name === extension.name)"
           :peers="availablePeers"
           :live-peer-ids="livePeerIds"
           :current-peer-id="currentPeerId"
           :peer-selection-disabled="peersLoading || !!peerError"
           @updated="updateExtension"
-          @uninstalled="refreshExtensions"
+          @participation-changed="refreshExtensions"
         />
         <div v-if="extensionError && extensions.length" class="extensions-view__error">
           <p role="alert">{{ t('extension.installedUnavailable') }}</p>
diff --git a/apps/client-webext/CHANGELOG.md b/apps/client-webext/CHANGELOG.md
index 3ba8127d..f552ef4e 100644
--- a/apps/client-webext/CHANGELOG.md
+++ b/apps/client-webext/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @inkcre/client-webext
 
+## 0.1.3
+
+### Patch Changes
+
+- Updated dependencies [7307dda]
+- Updated dependencies
+- Updated dependencies [7307dda]
+  - @inkcre/core@0.4.0
+
 ## 0.1.2
 
 ### Patch Changes
diff --git a/apps/client-webext/package.json b/apps/client-webext/package.json
index fa11129e..6ce54332 100644
--- a/apps/client-webext/package.json
+++ b/apps/client-webext/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@inkcre/client-webext",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true,
   "description": "InKCre's Web extension",
   "type": "module",
diff --git a/contracts/core-release.json b/contracts/core-release.json
index 1ec5c79e..34ced64f 100644
--- a/contracts/core-release.json
+++ b/contracts/core-release.json
@@ -5,5 +5,10 @@
   "runtime_images": {
     "pgvector": "pgvector/pgvector:pg17@sha256:d2ef61f42ef767baa5a1475393303cc235bcd92febd9d7014eddb48b41f3bad0",
     "postgrest": "postgrest/postgrest:v14.15@sha256:2f8e7b656f09db697a8875177694b417b35cb76c21370de07fc54e711e902326"
+  },
+  "canonical_candidate": {
+    "image": "ghcr.io/inkcre/core-py@sha256:c31a852f60b2aed5e4ad3df1352b135884a44fb15d156f08354baf8f468e8071",
+    "source_revision": "c5a8429307442f446adb8816c6cc5c9fa1eb2a58",
+    "contract_revision": "extension-peer-participation-v2"
   }
 }
diff --git a/docs/30-unit-tdd/info-base.md b/docs/30-unit-tdd/info-base.md
index c7d54dcc..457ed89a 100644
--- a/docs/30-unit-tdd/info-base.md
+++ b/docs/30-unit-tdd/info-base.md
@@ -51,7 +51,7 @@ or solved meaning.
 ## Exact Resolver Contracts
 
 `Resolver.getClass(id)` requires an exact registered class. Registration is idempotent only for
-the same class and rejects collisions; there is no default decoder. Core bootstrap independently
+the same class and rejects collisions; there is no default decoder. `Resolver.unregister(id, exactClass)` removes only that class’s registration and returns false when no matching owner remains. Stale module cleanup cannot remove another module’s class. Core bootstrap independently
 registers the versioned text, HTML, image, audio, video, PDF, EPUB, ZIP, and file contracts.
 Extensions register their own namespaced, versioned contracts rather than aliases for retired IDs.
 
@@ -87,7 +87,7 @@ exists while open/render/download remains supported.
 the registered component, and disposes its Resolver on unmount. Graph and editor surfaces use this
 path and never fall back to the persisted pointer string.
 
-`ResolverCache` reuses instances by Block identity plus `updated_at` snapshot. Replacement,
+`ResolverCache` first requires a currently registered class, then reuses instances by Block identity, `updated_at` snapshot, and that exact class identity. A disabled registration cannot return a cached instance; a replacement class disposes and replaces the old instance on the next read. Replacement,
 targeted invalidation, and clearing dispose old instances. Resolver-local hydration, relation, and
 solved-content caches still obey `refresh`; instance reuse does not change authority.
 
diff --git a/docs/30-unit-tdd/native-extension-runtime.md b/docs/30-unit-tdd/native-extension-runtime.md
index 886e819e..7b8df1f9 100644
--- a/docs/30-unit-tdd/native-extension-runtime.md
+++ b/docs/30-unit-tdd/native-extension-runtime.md
@@ -3,7 +3,7 @@
 ## Boundary
 
 The native Extension Runtime spans the browser Web Extension Host, its SDK-owned durable models, and
-independently versioned Module Federation producers. It owns compatibility preflight, executable
+independently built Module Federation producers. It owns compatibility preflight, executable
 loading, runtime lifecycle, and reconciliation with durable enabled intent. Release publication,
 Registry delivery, and deployment workflow remain outside this Unit TDD; cross-unit Extension and
 Registry contracts remain in [`../_shared/`](../_shared/).
@@ -12,15 +12,15 @@ Resolver/content producer semantics belong to [Info-Base](info-base.md). Registr
 artifact delivery belong to
 [First-party Extension Delivery](../40-deployment/native-extension-delivery.md).
 
-There is one native format: an Extension Release may associate a Module Federation distribution.
-The Host consumes that association directly. `@inkcre/extension-runtime-client-web`, maintained in
+The browser supports the Module Federation native distribution. Registry v2 resolves an exact
+`(name, module_federation, version)` release; other Peers independently select their native distributions. `@inkcre/extension-runtime-client-web`, maintained in
 ext-reg, owns the Web Host and Registry consumers. `@inkcre/core` owns the shared models, Peer
 transport, and browser configuration. There is no generic target matcher or cross-format artifact
 manifest.
 
 ## Producer and Host Contract
 
-Each producer is an independently versioned package. Its default export preserves the optional
+Each producer is an independent build package; its package version owns its MF release. Its default export preserves the optional
 native lifecycle methods `initialize`, `activate`, `deactivate`, and `dispose`; host-consumed
 capabilities come from its package entry rather than playground bootstrap code. Extension code
 imports `@inkcre/core` directly.
@@ -50,36 +50,33 @@ passes directly to the current native Module Federation implementation.
 
 ## Durable State and Peer Intent
 
-The Runtime uses `ExtensionModel` from the shared `@inkcre/core` instance for installed state,
-configuration, and per-Peer enabled intent. There is no application-owned `ExtensionStatePort` or
-second PostgREST adapter. The application chooses the targeted Peers for each enable or disable
-action: current-runtime operations use its local Host, online remote Hosts receive management
-commands, and offline enablement changes update desired state through the SDK model. The browser
-uses `PeerManager.listLive()` for this routing decision, matching the Peers page rather than
-comparing a lease timestamp with the browser clock. Selecting
-several Peers performs independent per-Peer operations, preserves successful changes when another
-Peer fails, then reads the canonical installed row before offering another decision. It does not
-invent a batch transaction or retry an ambiguous remote outcome.
-
-`listAdvertisedExtensionManagementPeers` and `manageExtensionOnPeer` in the Runtime own the shared
-management capability contract. The latter delegates once to the exact Peer through the SDK's
-`PeerManager`, validates the installed-row response, and preserves unknown outcomes. Consumers do
-not retry mutations or choose a replacement Peer automatically. Response bodies are not included
-in management errors because configuration validation may echo credentials.
-
-Installed state records exact name and version plus the set of enabled Peer IDs. Registry Web owns
-catalog search and version browsing; its link returns only a name and exact version to the
-client-web Extensions page. Opening the link reads the published Release from this deployment's
-configured Registry and shows a confirmation, but does not write installed state. Confirmation
-uses the deployment-scoped Web Runtime install operation without selecting a Peer or requiring a
-particular Host distribution. A Python-only Release can therefore be installed from the Web
-interface. Installation does not enable either Host, and the shared version still affects every
-Peer. Reopening an installed version does not silently change it; version changes remain an
-explicit management operation.
-
-Version change and uninstall are refused while any Peer remains enabled or a local runtime is
-running. Startup reads canonical installed state and starts only entries enabled for the current
-Peer. Shutdown stops volatile runtimes without changing durable enabled intent.
+The shared `ExtensionModel` owns one deployment identity, display name and configuration. Business
+state remains deployment-scoped and is never cleared by native version changes. The
+`ExtensionParticipationModel` owns each `(name, peer_id)` selection: exact distribution/version,
+enabled intent and configuration schema from that exact selection. No global package version or
+shared enabled array remains writable.
+
+The Extension card displays a single plugin with a row for each Peer. Installation and version
+changes explicitly target that row. The current browser uses its local Host; an online remote Peer
+uses `core.extension.management.v2`; offline operations update an existing exact participation.
+A new remote installation requires a real supported-distribution observation. Peer names and
+application versions do not imply format support. Missing MF releases remain unavailable choices;
+a Python-only plugin does not get a failing browser enable action.
+
+Management responses contain supported distributions and actual loaded versions, running state,
+restart requirements and errors. Database enabled intent is not proof that a sleeping Peer is running.
+The consumer sends each mutation once to its exact target and preserves unknown outcomes. It does
+not retry mutations on another Peer. Configuration forms identify the selected Peer/distribution/
+version that provided their schema; shared configuration has no global last-started schema.
+
+Registry installation links carry `name`, `distribution` and exact `version`. Opening a link only
+reads the release and presents the target Peer choice; confirmation persists that exact target's
+selection without enabling it. Startup reads only current-Peer enabled selections and never follows
+latest. Legacy records with unresolved distribution retain their exact version until the upgraded
+Host resolves its own native format. A missing release requires an explicit replacement selection.
+
+Removing a participation requires it to be disabled and does not remove the plugin's shared identity,
+configuration, authorization state, Sources or info-base content. Another Peer's selection is unchanged.
 
 ## Documentation and Memos Connection
 
@@ -97,7 +94,15 @@ runtime assumption. The contribution obtains the complete server URL from `memos
 it does not read Peer configuration or construct a Memos route. Address-read failures preserve the
 saved token and enabled state. Opening, selecting, and refreshing only read state. Unknown mutation
 outcomes require refreshing before another attempt. The PAT is masked by default; a normal help
-link opens the exact MF release's connection guide.
+link opens the current browser participation's exact MF release connection guide.
+
+The Twitter setup contribution selects an authorization Peer for OAuth requests and callbacks. It
+can open from the browser's running MF distribution before the selected Peer has installed Twitter;
+an explicit enable action selects an available Python release when no pin exists, then enables that
+Peer. Existing exact selections are not replaced by that action. Source, Cron and collection Jobs
+remain shared deployment records; choosing the authorization entry does not bind their future
+execution to that Peer. The interface does not call this a collection-Peer binding or attribute its
+schedule timezone to the selected OAuth entry.
 
 ## Lifecycle and Compensation
 
@@ -107,26 +112,43 @@ The normal lifecycle is:
 load --> initialize --> activate --> deactivate --> dispose
 ```
 
+Mail and Twitter define their resolver classes at module import, register them during `initialize`, and unregister only their exact classes during `dispose`. A partially failed initialization is cleaned up by the Host’s existing compensation path without removing another module’s registrations. Module import therefore does not leave capabilities from a failed or stopped runtime behind. Memos has no resolver registrations.
+
 The Host records a runtime as running only after initialization and activation finish. If either
 start phase fails, it compensates through the available reverse lifecycle and preserves both the
 original and cleanup failures when cleanup also fails. Stop deactivates only an active module and
 then disposes it; disposal releases the loaded runtime.
 
-Enable starts the exact runtime before adding the current Peer to durable enabled intent. If
-persistence fails, the Host stops and removes that runtime. If the persisted version changed during
-enable, the Host rolls back the just-added Peer intent and requires a retry against the new exact
-Release.
+An explicit enable or disable command saves its exact participation intent before scheduling native
+lifecycle work. Initial restore consumes enabled intent without rewriting it. The Host serializes
+local lifecycle work per Extension and rechecks the selected coordinate and enabled intent before
+and after executable loading, initialization and activation. A superseded candidate is disposed
+without entering the running projection. Local serialization does not make direct writes by other
+admitted clients atomic; fresh persistent observations remain necessary.
+
+An operation can persist intent and still fail during activation or shutdown. The Extension card
+therefore reads both participation and actual runtime after success or failure and retains the
+operation error. If selection returns an unknown outcome, only an independent read of the original
+connection’s same name, Peer, distribution and version can complete the picker. This read never
+replays a mutation or enables the Peer. Configuration changes, unmount and a newer picker invalidate
+old callbacks; observing a pin does not establish loaded version or running state.
 
-Disable reverses the order: it stops the runtime before removing durable enabled intent. If state
-persistence fails, it restarts the previous exact installed runtime to restore correspondence.
-Combined failures retain both the persistence and compensation errors; they must not be flattened
-into apparent success. Startup isolates failures per enabled extension, retains each runtime error
-for inspection, and reports an aggregate after attempting the remaining entries.
+Version catalogs are read only after an explicit version choice. A native format with no published
+release is distinguished from an unknown or failed read. The card shows an unavailable target only
+when all formats supported by that Peer are known to lack published releases. A Python-only
+catalog can explain why the browser has no compatible choice without guessing from application
+names. An explicit card refresh discards those catalog observations and allows another read.
+
+The Client Web shell opens database views before native Extension restore finishes. A cold deep link can therefore encounter an unregistered Extension resolver. The content popup retries that specific lookup failure after the Host completes restore, while preserving other read failures. Extension cards wait for the same restore before observing current-Peer runtime status; a persisted enabled intent alone does not establish that the module is running.
+
+A restore attempt isolates module failures. Completing the attempt, including an aggregate failure, allows registered resolvers to serve content and exposes each module’s actual status; an unknown resolver after that attempt remains a visible error.
 
 ## Invariants
 
-- Canonical installed/enabled state is accessed through the shared SDK's `ExtensionModel`.
+- Shared identity/configuration and per-Peer native selection have separate SDK models.
 - Compatibility is proven before native executable fetch.
 - The exact Release and native manifest association remain stable through one start attempt.
 - Durable enabled intent and volatile runtime are reconciled with explicit compensation.
 - Producer identity and lifecycle are native Module Federation contracts, not deployment scripts.
+
+Settings 在切换数据库地址、数据库签名密钥或 Peer ID 之前排空旧 Host，连接成功后创建绑定新 Peer 的 Host。同一连接只调整租约选项时保留 Host；旧连接的恢复和管理回调不能改变新 Host 的状态。
diff --git a/docs/40-deployment/native-extension-delivery.md b/docs/40-deployment/native-extension-delivery.md
index 32c96e38..bf1ee79c 100644
--- a/docs/40-deployment/native-extension-delivery.md
+++ b/docs/40-deployment/native-extension-delivery.md
@@ -24,7 +24,7 @@ Extension packages. On a protected `main` push,
   snapshots and SHA-256 digests as the immutable `first-party-extension-candidate` Actions artifact.
   No Registry writes occur until that artifact is retained and checked.
 - Producers are discovered from package metadata. A published Release with an existing Module
-  Federation association is a historical no-op at candidate selection. Missing associations become
+  Federation association is a historical no-op at candidate selection. Missing MF native coordinates become
   fixed candidates; the publish job downloads this run's exact artifact, prepares them with their
   saved provenance, uploads, publishes, and verifies every candidate from the public Registry.
   It never consumes pull-request CI artifacts or rebuilds a publication candidate.
@@ -39,11 +39,47 @@ replace this gate with an empty-check merge or a broader credential.
 Client checks, Pages production, and Pages preview are separate application lifecycles. They cannot
 publish first-party Extensions. Local development and local verification must never publish either.
 
-Python and Module Federation producers for one Extension must target the same exact Release when
-both Hosts are needed. A published Python-only Release may receive its missing Module Federation
-association through the normal publish workflow; existing associations are not overwritten. Select
-the Changesets increment that reaches that Release rather than downgrading the shared installation
-or manually editing generated package versions.
+Python and Module Federation are independent native releases. Each producer owns
+`(extension name, distribution, version)` and publishes only that distribution through Registry v2.
+The Web workflow does not read Core source or a Core version plan. Python publication neither
+selects nor waits for MF, and MF publication neither selects nor waits for Python. Host SDK ranges
+remain native loading requirements; they do not describe cross-distribution business compatibility.
+
+A plugin owns compatibility of its shared configuration, state, Source/Job parameters and stored
+information. Changesets record MF changes even when no Python change is necessary. Published native
+coordinates and saved candidate bytes are immutable; repairs require a new native version.
+
+## Native SDK 0.4 cutover
+
+The Peer-participation protocol removes the SDK's global Extension version and enabled array.
+New first-party MF releases therefore require `@inkcre/core >=0.4.0 <0.5.0`; historical MF releases
+keep their existing declared range and are not silently repinned or declared compatible. Shared
+configuration and business data remain preserved when the user chooses a supported native release.
+
+This breaking cutover prepares the SDK and its in-repository consumers in the same reviewed change.
+The existing `pnpm release:version` command consumes the already-admitted UI intents and the native
+participation intent once, generating SDK 0.4 and independent MF patch releases. The resulting
+Version outputs are committed; no duplicate pending intent remains for the next reconciliation.
+This is the one-time delivery boundary for this cutover. Ordinary feature work continues to submit
+Changesets and use the automated Version PR described above.
+
+Client Web consumes the official Runtime SDK 0.4 tarball and Toolkit 0.5 wheel through exact GitHub
+Release asset URLs and lock-file integrity. Consumers install prebuilt packages without checking
+out Registry SDK source or running its SDK preparation. The Runtime SDK release publisher still
+qualifies its build with the pinned `packages/core` package source and its own frozen tooling; it
+does not install a producer workspace or combine Python and MF source. That bounded build-source
+transition does not establish complete SDK artifact independence. This repository's Core SDK 0.4
+remains workspace-owned until its own protected-main release. Dependency publication, candidate
+qualification and production Extension publication remain separate delivery boundaries.
+
+Required database checks normally resolve the protected Core `stable` artifact. During this cutover,
+`contracts/core-release.json` can admit a `canonical_candidate` with an existing canonical Core
+image digest, its protected-main source SHA and exact database contract revision. The consumer
+checks the image-owned manifest against both expected values and rejects tags, other registries,
+source mismatches and contract mismatches. This reference is populated only after the existing Core
+canonical artifact lane publishes it; a local or preview image is qualification evidence and cannot
+be entered as that canonical candidate. Omitting the entry continues to use stable. This admission
+does not move stable, deploy Core or migrate a production database.
 
 ## Registry Authority and Secret Boundary
 
@@ -55,7 +91,7 @@ the endpoint through repository variable `INKCRE_EXTENSION_REGISTRY_URL`.
 
 The workflow records `source_repository`, `source_revision`, and a release-workflow `build_id` in
 the Module Federation distribution before upload. These Web-distribution provenance facts remain
-independent of any Python distribution attached to the same Registry Release.
+independent of Python release provenance.
 
 Hosted documentation is discovered separately for the exact Release. Browser code follows the
 absolute entry or snapshot URL returned by Registry and never derives a content hostname from the
diff --git a/docs/40-deployment/web-delivery.md b/docs/40-deployment/web-delivery.md
index 1ee3c6f4..54cbfcdc 100644
--- a/docs/40-deployment/web-delivery.md
+++ b/docs/40-deployment/web-delivery.md
@@ -50,6 +50,27 @@ on `main` with `source_sha` equal to its full current SHA. Each dispatch permits
 while the variable remains true; it does not clear the pause or select a newer source silently.
 Restore automatic delivery only after the cutover has been verified.
 
+### Breaking database protocol upgrades
+
+Pages delivery changes the HTML and assets served to new visits; it does not replace JavaScript
+already running in an open tab. Client Web 0.1.2 and Core SDK 0.3 use the global Extension
+`version`, `enabled` and `config_schema` columns. The Peer-participation migration removes those
+columns, so an old tab can fail Extension reads and writes even while unrelated information remains
+readable. Reloading before the matching App is deployed still loads an incompatible client.
+
+The deployment owner coordinates a maintenance window across the affected Core/PostgREST deployment
+and Client Web. Pause browser writes and close old connected tabs before the database cutover. Keep
+the browser's connection settings and Peer ID. Resume use only after the deployment's
+`extension-peer-participation-v2` database and management endpoint are ready and Client Web 0.1.3
+has been deployed, then fully reload each connected tab. A startup error's Retry button performs
+that full reload; it cannot repair an incompatible database or update a tab while it remains open.
+The Core deployment documentation owns backup, migration and service recovery commands.
+
+This maintenance sequence does not install, upgrade or enable Extensions. The new Host restores
+existing enabled intent at the saved exact native version; it never substitutes latest. Historical
+MF releases retain their original SDK range and may require the user to select a supported release
+explicitly. Preserve shared configuration, state and stored information throughout the cutover.
+
 ## Core SDK assets
 
 [`.github/workflows/core-sdk-release.yml`](../../.github/workflows/core-sdk-release.yml) independently
diff --git a/docs/_shared b/docs/_shared
index 7916312c..394f1349 160000
--- a/docs/_shared
+++ b/docs/_shared
@@ -1 +1 @@
-Subproject commit 7916312c12cfaf2ee396d7dc1afffee67d4f0721
+Subproject commit 394f1349f1893cc8bbbbadd27d59ac37bf35c909
diff --git a/extensions/AGENTS.md b/extensions/AGENTS.md
index 6481722b..d03bdbd6 100644
--- a/extensions/AGENTS.md
+++ b/extensions/AGENTS.md
@@ -8,15 +8,17 @@ Host/producer runtime contracts belong to
 
 ## Local Tripwires
 
-- Keep each directory an independently versioned package. Its directory name is the local ID;
+- Keep each directory an independent build package. Its directory name is the local ID;
   `package.json#inkcre.name`, version, nickname, and `module_federation` association are Registry
   identity and compatibility inputs, not playground metadata.
 - Keep production remotes relocatable: `vite.config.ts` must retain `base: './'`, emit the native
   `mf-manifest.json`, and write `dist/client-web`.
 - Export host-consumed capabilities from `src/index.ts`; keep `src/main.ts` limited to the local
   playground. Do not make the Host depend on playground bootstrap behavior.
-- Changes to a native producer must preserve the asset-closure validation and select only affected
-  independently releasable packages in `pnpm changeset`.
+- Changes to a native producer must preserve asset-closure validation. Record its native release intent
+  in a Changeset for that package; its committed package version owns the MF release coordinate.
+- Build and publish only this repository’s MF distributions. Python producers use their own repositories
+  and versions; do not read their source or version to choose an MF release.
 
 ## Required Check
 
diff --git a/extensions/mail/CHANGELOG.md b/extensions/mail/CHANGELOG.md
index a9b47e93..5699da62 100644
--- a/extensions/mail/CHANGELOG.md
+++ b/extensions/mail/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @inkcre/ext-mail
 
+## 0.3.2
+
+### Patch Changes
+
+- 插件配置与业务状态在部署内共享；精确分发版本和启用意图分别保存在每个 Peer。Client Web 在同一插件入口管理各 Peer 的安装、版本和运行状态，并采用 Extension management v2。
+
+  原生 SDK 不再提供全局插件版本与 enabled 数组。新版 MF 使用 0.4 SDK 的参与记录接口，历史 MF 需按其 SDK 范围运行或明确选择新版；不会自动改写旧版本选择。Python 与 MF 分别从自己的仓库发布，插件负责共享数据契约兼容。
+
+- 7307dda: Source 与 Peer 配置使用可视化表单，保留完整 JSON 编辑模式；Peers 页面可确认删除离线 Peer 并清理其扩展启用记录。Extension 浏览与版本选择交由 Registry，Web 接收精确版本并确认安装；Web 与 Module Federation 扩展统一升级正式 UI 2.2.0，Peer AI 凭据在 schema 中标记为密码输入。
+- Updated dependencies [7307dda]
+- Updated dependencies
+- Updated dependencies [7307dda]
+  - @inkcre/core@0.4.0
+
 ## 0.3.1
 
 ### Patch Changes
diff --git a/extensions/mail/package.json b/extensions/mail/package.json
index cb676552..997220f4 100644
--- a/extensions/mail/package.json
+++ b/extensions/mail/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@inkcre/ext-mail",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "private": true,
   "type": "module",
   "scripts": {
@@ -38,7 +38,7 @@
     "nickname": "Mail",
     "module_federation": {
       "host_sdk": "@inkcre/core",
-      "host_sdk_version": ">=0.2.0 <0.4.0"
+      "host_sdk_version": ">=0.4.0 <0.5.0"
     }
   },
   "intent": {
diff --git a/extensions/mail/src/index.ts b/extensions/mail/src/index.ts
index 7940cd2e..5efea160 100644
--- a/extensions/mail/src/index.ts
+++ b/extensions/mail/src/index.ts
@@ -1,12 +1,30 @@
-import type { ExtensionModule } from '@inkcre/core'
+import { Resolver, type ExtensionModule } from '@inkcre/core'
+import {
+  EmailResolver,
+  MailboxResolver,
+  EmailAddressResolver,
+  MailFlagResolver,
+  MailMimePartResolver,
+} from './resolver'
 
-import './resolver'
+const resolvers = [
+  EmailResolver,
+  MailboxResolver,
+  EmailAddressResolver,
+  MailFlagResolver,
+  MailMimePartResolver,
+]
 
 const Extension: ExtensionModule = {
-  async initialize() {},
+  async initialize() {
+    for (const resolver of resolvers) Resolver.register(resolver.type, resolver)
+  },
   async activate() {},
   async deactivate() {},
-  async dispose() {},
+  async dispose() {
+    // Host compensation also calls dispose after a partially failed initialize.
+    for (const resolver of resolvers) Resolver.unregister(resolver.type, resolver)
+  },
 }
 
 export default Extension
diff --git a/extensions/mail/src/resolver.ts b/extensions/mail/src/resolver.ts
index b4093156..40074ce5 100644
--- a/extensions/mail/src/resolver.ts
+++ b/extensions/mail/src/resolver.ts
@@ -73,10 +73,6 @@ export class EmailResolver extends Resolver<string, SolvedEmail> {
   static readonly previewRenderer = markRaw(ContentEmailPreview)
   static readonly solvedContentRenderer = markRaw(ContentEmail)
 
-  static {
-    Resolver.register(EmailResolver.type, EmailResolver)
-  }
-
   protected async _getSolvedContent(options: ProjectionOptions): Promise<SolvedEmail> {
     const root = CanonicalEmailSchema.parse(parseJson(await this.getRawContent(options)))
     const relations = await this.getRelations({ refresh: options.refresh })
@@ -208,10 +204,6 @@ export class MailboxResolver extends JsonMailResolver<CanonicalMailbox> {
   static readonly previewRenderer = markRaw(ContentMailFactPreview)
   static readonly solvedContentRenderer = markRaw(ContentMailFact)
   readonly schema = CanonicalMailboxSchema
-
-  static {
-    Resolver.register(MailboxResolver.type, MailboxResolver)
-  }
 }
 
 export class EmailAddressResolver extends JsonMailResolver<CanonicalEmailAddress> {
@@ -219,10 +211,6 @@ export class EmailAddressResolver extends JsonMailResolver<CanonicalEmailAddress
   static readonly previewRenderer = markRaw(ContentMailFactPreview)
   static readonly solvedContentRenderer = markRaw(ContentMailFact)
   readonly schema = CanonicalEmailAddressSchema
-
-  static {
-    Resolver.register(EmailAddressResolver.type, EmailAddressResolver)
-  }
 }
 
 export class MailFlagResolver extends JsonMailResolver<CanonicalMailFlag> {
@@ -230,10 +218,6 @@ export class MailFlagResolver extends JsonMailResolver<CanonicalMailFlag> {
   static readonly previewRenderer = markRaw(ContentMailFactPreview)
   static readonly solvedContentRenderer = markRaw(ContentMailFact)
   readonly schema = CanonicalMailFlagSchema
-
-  static {
-    Resolver.register(MailFlagResolver.type, MailFlagResolver)
-  }
 }
 
 export class MailMimePartResolver extends Resolver<string, SolvedMimePart> {
@@ -241,10 +225,6 @@ export class MailMimePartResolver extends Resolver<string, SolvedMimePart> {
   static readonly previewRenderer = markRaw(ContentMimePartPreview)
   static readonly solvedContentRenderer = markRaw(ContentMimePart)
 
-  static {
-    Resolver.register(MailMimePartResolver.type, MailMimePartResolver)
-  }
-
   protected async _getSolvedContent(options: ProjectionOptions): Promise<SolvedMimePart> {
     const root = CanonicalMimePartSchema.parse(parseJson(await this.getRawContent(options)))
     const relations = await this.getRelations({
diff --git a/extensions/memos/CHANGELOG.md b/extensions/memos/CHANGELOG.md
index ea1e0368..707e81e4 100644
--- a/extensions/memos/CHANGELOG.md
+++ b/extensions/memos/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @inkcre/ext-memos
 
+## 0.3.1
+
+### Patch Changes
+
+- 插件配置与业务状态在部署内共享；精确分发版本和启用意图分别保存在每个 Peer。Client Web 在同一插件入口管理各 Peer 的安装、版本和运行状态，并采用 Extension management v2。
+
+  原生 SDK 不再提供全局插件版本与 enabled 数组。新版 MF 使用 0.4 SDK 的参与记录接口，历史 MF 需按其 SDK 范围运行或明确选择新版；不会自动改写旧版本选择。Python 与 MF 分别从自己的仓库发布，插件负责共享数据契约兼容。
+
+- 7307dda: Source 与 Peer 配置使用可视化表单，保留完整 JSON 编辑模式；Peers 页面可确认删除离线 Peer 并清理其扩展启用记录。Extension 浏览与版本选择交由 Registry，Web 接收精确版本并确认安装；Web 与 Module Federation 扩展统一升级正式 UI 2.2.0，Peer AI 凭据在 schema 中标记为密码输入。
+- Updated dependencies [7307dda]
+- Updated dependencies
+- Updated dependencies [7307dda]
+  - @inkcre/core@0.4.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/extensions/memos/package.json b/extensions/memos/package.json
index 8fa69ca5..d2e3127c 100644
--- a/extensions/memos/package.json
+++ b/extensions/memos/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@inkcre/ext-memos",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "private": true,
   "type": "module",
   "scripts": {
@@ -11,7 +11,7 @@
   },
   "dependencies": {
     "@inkcre/core": "workspace:*",
-    "@inkcre/extension-runtime-client-web": "https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.2.0/inkcre-extension-runtime-client-web-0.2.0.tgz"
+    "@inkcre/extension-runtime-client-web": "https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz"
   },
   "devDependencies": {
     "@inkcre/ext-dev-utils": "workspace:*",
@@ -35,7 +35,7 @@
     "nickname": "Memos",
     "module_federation": {
       "host_sdk": "@inkcre/core",
-      "host_sdk_version": ">=0.3.0 <0.4.0"
+      "host_sdk_version": ">=0.4.0 <0.5.0"
     }
   },
   "intent": {
diff --git a/extensions/memos/src/MemosSetup.vue b/extensions/memos/src/MemosSetup.vue
index 8cbd97c2..67bacf4e 100644
--- a/extensions/memos/src/MemosSetup.vue
+++ b/extensions/memos/src/MemosSetup.vue
@@ -3,6 +3,9 @@ import { computed, inject, onMounted, onUnmounted, ref, shallowRef } from 'vue'
 import { InkButton, InkDropdown, InkForm, InkInput, INK_I18N_KEY } from '@inkcre/ui-web'
 import {
   ExtensionModel,
+  ExtensionParticipationModel,
+  configStore,
+  type ExtensionParticipation,
   PeerOutcomeUnknown,
   type InstalledExtension,
   type Peer,
@@ -10,6 +13,7 @@ import {
 import { manageExtensionOnPeer } from '@inkcre/extension-runtime-client-web'
 import {
   extensionName,
+  ensureMemosParticipation,
   generateToken,
   MemosConnectionError,
   personalAccessToken,
@@ -42,7 +46,15 @@ onUnmounted(() => {
 
 const peer = computed(() => peers.value.find((candidate) => candidate.id === selected.value))
 const savedToken = computed(() => (extension.value ? personalAccessToken(extension.value) : null))
-const enabled = computed(() => extension.value?.enabled.includes(selected.value) ?? false)
+const participations = ref<ExtensionParticipation[]>([])
+const enabled = computed(() =>
+  participations.value.some((row) => row.peer_id === selected.value && row.enabled)
+)
+const localVersion = computed(
+  () =>
+    participations.value.find((row) => row.peer_id === configStore.metaConfig.INKCRE_PEER_ID)
+      ?.version
+)
 const ready = computed(() => loaded.value && address.value && savedToken.value && enabled.value)
 const options = computed(() =>
   peers.value.map((candidate) => ({
@@ -56,11 +68,11 @@ async function loadHelp(version: string) {
   helpStatus.value = 'loading'
   try {
     const url = await readHelpUrl(version)
-    if (!mounted || extension.value?.version !== version) return
+    if (!mounted || localVersion.value !== version) return
     helpUrl.value = url
     helpStatus.value = url ? 'available' : 'missing'
   } catch {
-    if (mounted && extension.value?.version === version) helpStatus.value = 'unavailable'
+    if (mounted && localVersion.value === version) helpStatus.value = 'unavailable'
   }
 }
 
@@ -94,7 +106,11 @@ async function refresh() {
     const current = await readSetup()
     if (!mounted) return
     extension.value = current.extension
-    void loadHelp(current.extension.version)
+    participations.value = (await ExtensionParticipationModel.list()).filter(
+      (row) => row.name === extensionName
+    )
+    if (localVersion.value) void loadHelp(localVersion.value)
+    else helpStatus.value = 'missing'
     peers.value = current.peers
     if (!selected.value && current.peers.length === 1) selected.value = current.peers[0]!.id
     loaded.value = true
@@ -135,22 +151,27 @@ async function prepare() {
     const current = await ExtensionModel.get(extensionName)
     if (!current) throw new Error('Memos is no longer installed.')
     extension.value = current
+    await ensureMemosParticipation(target)
     if (!personalAccessToken(current)) {
       phase = 'save'
       draft.value ||= generateToken()
-      extension.value = await manageExtensionOnPeer(target, {
+      await manageExtensionOnPeer(target, {
         action: 'patch_config',
         extension: extensionName,
         patch: { personal_access_token: draft.value },
       })
     }
     phase = 'enable'
-    if (!extension.value.enabled.includes(target)) {
-      extension.value = await manageExtensionOnPeer(target, {
+    if (!enabled.value) {
+      await manageExtensionOnPeer(target, {
         action: 'enable',
         extension: extensionName,
       })
     }
+    extension.value = await ExtensionModel.get(extensionName)
+    participations.value = (await ExtensionParticipationModel.list()).filter(
+      (row) => row.name === extensionName
+    )
     draft.value = ''
     await loadAddress()
   } catch (cause) {
diff --git a/extensions/memos/src/setup.ts b/extensions/memos/src/setup.ts
index b3227ff1..3b07d5fa 100644
--- a/extensions/memos/src/setup.ts
+++ b/extensions/memos/src/setup.ts
@@ -1,5 +1,7 @@
+import corePackage from '../../../packages/core/package.json'
 import {
   ExtensionModel,
+  ExtensionParticipationModel,
   configStore,
   ExtensionRegistryOriginResolver,
   PeerManager,
@@ -9,6 +11,10 @@ import {
 } from '@inkcre/core'
 import {
   getExtensionDocumentation,
+  RegistryReleaseReader,
+  sortPublishedReleases,
+  manageExtensionOnPeer,
+  readExtensionPeerStatus,
   listAdvertisedExtensionManagementPeers,
 } from '@inkcre/extension-runtime-client-web'
 
@@ -31,7 +37,39 @@ export async function readSetup(): Promise<{ extension: ExtensionModel; peers: P
     listAdvertisedExtensionManagementPeers(),
   ])
   if (!extension) throw new Error('Memos is not installed.')
-  return { extension, peers }
+  const statuses = await Promise.all(
+    peers.map(async (peer) => ({
+      peer,
+      status: await readExtensionPeerStatus(peer.id, extensionName),
+    }))
+  )
+  return {
+    extension,
+    peers: statuses
+      .filter(({ status }) => status.supported_distributions.includes('python'))
+      .map(({ peer }) => peer),
+  }
+}
+
+/** An explicit connection-preparation action may create a native selection, never background restore. */
+export async function ensureMemosParticipation(peerId: string): Promise<void> {
+  if (await ExtensionParticipationModel.get(peerId, extensionName)) return
+  const origin = await new ExtensionRegistryOriginResolver(
+    () => configStore.peerConfig.extension_registry_url
+  ).resolve()
+  const reader = new RegistryReleaseReader({
+    registryOrigin: origin,
+    hostSdk: { name: '@inkcre/core', version: corePackage.version },
+  })
+  const catalog = await reader.getExtension(extensionName, 'python')
+  const release = sortPublishedReleases(catalog.releases ?? [])[0]
+  if (!release) throw new Error('Memos has no published Python distribution.')
+  await manageExtensionOnPeer(peerId, {
+    action: 'select',
+    extension: extensionName,
+    distribution: 'python',
+    version: release.version,
+  })
 }
 
 export class MemosConnectionError extends Error {
@@ -68,7 +106,12 @@ export async function readHelpUrl(version: string): Promise<string | null> {
   const origin = await new ExtensionRegistryOriginResolver(
     () => configStore.peerConfig.extension_registry_url
   ).resolve()
-  const documentation = await getExtensionDocumentation(origin, extensionName, version)
+  const documentation = await getExtensionDocumentation(
+    origin,
+    extensionName,
+    version,
+    'module_federation'
+  )
   const entry = documentation?.find((link) => link.scope === 'module-federation')
   if (!entry) return null
   const url = new URL(entry.entry_url)
diff --git a/extensions/twitter/CHANGELOG.md b/extensions/twitter/CHANGELOG.md
index b4538310..d1fdc7bc 100644
--- a/extensions/twitter/CHANGELOG.md
+++ b/extensions/twitter/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @inkcre/ext-twitter
 
+## 0.4.2
+
+### Patch Changes
+
+- 插件配置与业务状态在部署内共享；精确分发版本和启用意图分别保存在每个 Peer。Client Web 在同一插件入口管理各 Peer 的安装、版本和运行状态，并采用 Extension management v2。
+
+  原生 SDK 不再提供全局插件版本与 enabled 数组。新版 MF 使用 0.4 SDK 的参与记录接口，历史 MF 需按其 SDK 范围运行或明确选择新版；不会自动改写旧版本选择。Python 与 MF 分别从自己的仓库发布，插件负责共享数据契约兼容。
+
+- 7307dda: Source 与 Peer 配置使用可视化表单，保留完整 JSON 编辑模式；Peers 页面可确认删除离线 Peer 并清理其扩展启用记录。Extension 浏览与版本选择交由 Registry，Web 接收精确版本并确认安装；Web 与 Module Federation 扩展统一升级正式 UI 2.2.0，Peer AI 凭据在 schema 中标记为密码输入。
+- Updated dependencies [7307dda]
+- Updated dependencies
+- Updated dependencies [7307dda]
+  - @inkcre/core@0.4.0
+
 ## 0.4.1
 
 ### Patch Changes
diff --git a/extensions/twitter/package.json b/extensions/twitter/package.json
index db78b3ca..fad031c7 100644
--- a/extensions/twitter/package.json
+++ b/extensions/twitter/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@inkcre/ext-twitter",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "private": true,
   "type": "module",
   "scripts": {
@@ -10,7 +10,8 @@
     "type-check": "vue-tsc --noEmit"
   },
   "dependencies": {
-    "@inkcre/core": "workspace:*"
+    "@inkcre/core": "workspace:*",
+    "@inkcre/extension-runtime-client-web": "https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz"
   },
   "devDependencies": {
     "@inkcre/ext-dev-utils": "workspace:*",
@@ -36,7 +37,7 @@
     "nickname": "Twitter",
     "module_federation": {
       "host_sdk": "@inkcre/core",
-      "host_sdk_version": ">=0.2.0 <0.4.0"
+      "host_sdk_version": ">=0.4.0 <0.5.0"
     }
   },
   "intent": {
diff --git a/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.vue b/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.vue
index 636a753e..33dbbc6c 100644
--- a/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.vue
+++ b/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.vue
@@ -182,8 +182,7 @@ async function enableSelectedCore(): Promise<void> {
   if (!api.value || !selectedCandidate.value) return
   await run('enable-core', async () => {
     const extension = await api.value!.enableCore(lifecycle.signal)
-    selectedCandidate.value!.extension = extension
-    selectedCandidate.value!.enabled = extension.enabled.includes(selectedCandidate.value!.peer.id)
+    selectedCandidate.value!.enabled = extension.enabled
     await reloadStatus()
   })
 }
@@ -339,19 +338,16 @@ onBeforeUnmount(() => {
     <template v-else>
       <p v-if="error" class="twitter-setup__error" role="alert">{{ error }}</p>
       <div v-if="currentStep === 0" class="twitter-setup__panel">
-        <h3>Choose a collection Peer</h3>
-        <p class="twitter-setup__hint">
-          This Core Peer handles authorization and bookmark collection.
-        </p>
+        <h3>Choose an authorization Peer</h3>
         <InkForm v-if="candidates.length" layout="col">
           <InkDropdown
             v-model="selectedPeerId"
             :options="peerOptions"
-            label="Core Peer"
+            label="Authorization Peer"
             :editable="!busy"
           />
         </InkForm>
-        <p v-else>No available Core Peer has the Twitter extension installed.</p>
+        <p v-else>No authorization Peer is available.</p>
         <div class="twitter-setup__actions">
           <InkButton
             v-if="selectedCandidate && !selectedCoreEnabled"
@@ -481,7 +477,6 @@ onBeforeUnmount(() => {
               (value: Date) => value.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' })
             "
           />
-          <p class="twitter-setup__hint">Time uses the collection Peer's timezone.</p>
           <InkButton
             text="Continue"
             theme="primary"
@@ -499,9 +494,7 @@ onBeforeUnmount(() => {
           <dt>Bookmark Source</dt>
           <dd>{{ selectedSource?.nickname || `#${selectedSource?.id}` }}</dd>
           <dt>Collection</dt>
-          <dd>
-            Daily at {{ collectionTime }} <span class="twitter-setup__hint">· Peer timezone</span>
-          </dd>
+          <dd>Daily at {{ collectionTime }}</dd>
         </dl>
         <p v-if="setupReady" role="status">Bookmarks will be collected on this schedule.</p>
         <p v-else class="twitter-setup__hint">
diff --git a/extensions/twitter/src/index.ts b/extensions/twitter/src/index.ts
index 7bb8264b..e8d1fcb7 100644
--- a/extensions/twitter/src/index.ts
+++ b/extensions/twitter/src/index.ts
@@ -10,8 +10,8 @@
  * This is the main export loaded by the host application.
  */
 
-import { type ExtensionModule } from '@inkcre/core'
-import './resolver'
+import { Resolver, type ExtensionModule } from '@inkcre/core'
+import { TweetResolver } from './resolver'
 import TwitterSetupWizard from './components/twitterSetupWizard/twitterSetupWizard.vue'
 
 const Extension: ExtensionModule = {
@@ -19,7 +19,9 @@ const Extension: ExtensionModule = {
     component: TwitterSetupWizard,
   },
 
-  async initialize() {},
+  async initialize() {
+    Resolver.register(TweetResolver.type, TweetResolver)
+  },
 
   async activate() {
     console.log('[Twitter Extension] Activated')
@@ -31,7 +33,7 @@ const Extension: ExtensionModule = {
 
   async dispose() {
     console.log('[Twitter Extension] Disposed')
-    // Cleanup resources if needed
+    Resolver.unregister(TweetResolver.type, TweetResolver)
   },
 }
 
diff --git a/extensions/twitter/src/resolver.ts b/extensions/twitter/src/resolver.ts
index ee2bae25..c77cbdfc 100644
--- a/extensions/twitter/src/resolver.ts
+++ b/extensions/twitter/src/resolver.ts
@@ -27,10 +27,6 @@ export class TweetResolver extends Resolver<string, Tweet> {
   static readonly previewRenderer = markRaw(ContentTweetPreview)
   static readonly solvedContentRenderer = markRaw(ContentTweet)
 
-  static {
-    Resolver.register(TweetResolver.type, TweetResolver)
-  }
-
   protected async _getSolvedContent(options: ProjectionOptions): Promise<Tweet> {
     const rawContent = await this.getRawContent(options)
     const tweet = TweetSchema.parse(JSON.parse(rawContent))
diff --git a/extensions/twitter/src/setup-api.ts b/extensions/twitter/src/setup-api.ts
index 579c79a3..96b1b44d 100644
--- a/extensions/twitter/src/setup-api.ts
+++ b/extensions/twitter/src/setup-api.ts
@@ -1,5 +1,14 @@
+import corePackage from '../../../packages/core/package.json'
 import {
-  InstalledExtensionSchema,
+  RegistryReleaseReader,
+  sortPublishedReleases,
+  manageExtensionOnPeer,
+  readExtensionPeerStatus,
+} from '@inkcre/extension-runtime-client-web'
+import {
+  ExtensionParticipationModel,
+  ExtensionRegistryOriginResolver,
+  configStore,
   Cron,
   CronForm,
   ExtensionModel,
@@ -10,12 +19,13 @@ import {
   Source,
   SourceForm,
   type InstalledExtension,
+  type ExtensionRuntimeStatus,
   type JsonValue,
 } from '@inkcre/core'
 import { z } from 'zod'
 
 const EXTENSION_NAME = 'inkcre/twitter'
-const EXTENSION_MANAGEMENT_CAPABILITY = 'core.extension.management.v1'
+const EXTENSION_MANAGEMENT_CAPABILITY = 'core.extension.management.v2'
 const TWITTER_SETUP_STATUS_CAPABILITY = 'inkcre.twitter.setup.status.v1'
 const TWITTER_OAUTH_APP_CONFIGURE_CAPABILITY = 'inkcre.twitter.oauth-app.configure.v1'
 const TWITTER_OAUTH_BEGIN_CAPABILITY = 'inkcre.twitter.oauth.begin.v1'
@@ -91,18 +101,30 @@ function advertises(peer: Peer, capability: string): boolean {
 
 export async function discoverCoreCandidates(signal?: AbortSignal): Promise<CorePeerCandidate[]> {
   signal?.throwIfAborted()
-  const [extension, peers] = await Promise.all([
+  const [extension, peers, participations] = await Promise.all([
     ExtensionModel.get(EXTENSION_NAME),
     PeerManager.listLive(),
+    ExtensionParticipationModel.list(),
   ])
   signal?.throwIfAborted()
   if (!extension) return []
-  return peers
-    .filter((peer) => advertises(peer, EXTENSION_MANAGEMENT_CAPABILITY))
-    .map((peer) => ({
+  const candidates = await Promise.all(
+    peers
+      .filter((peer) => advertises(peer, EXTENSION_MANAGEMENT_CAPABILITY))
+      .map(async (peer) => ({
+        peer,
+        status: await readExtensionPeerStatus(peer.id, EXTENSION_NAME),
+      }))
+  )
+  signal?.throwIfAborted()
+  return candidates
+    .filter(({ status }) => status.supported_distributions.includes('python'))
+    .map(({ peer }) => ({
       peer,
       extension,
-      enabled: extension.enabled.includes(peer.id),
+      enabled: participations.some(
+        (row) => row.name === EXTENSION_NAME && row.peer_id === peer.id && row.enabled
+      ),
       setupAvailable: advertises(peer, TWITTER_SETUP_STATUS_CAPABILITY),
     }))
 }
@@ -110,14 +132,28 @@ export async function discoverCoreCandidates(signal?: AbortSignal): Promise<Core
 export class TwitterSetupAPI {
   constructor(readonly peer: Peer) {}
 
-  enableCore(signal?: AbortSignal): Promise<InstalledExtension> {
-    return delegateTwitterRequest(
-      this.peer,
-      EXTENSION_MANAGEMENT_CAPABILITY,
-      { body: { action: 'enable', extension: EXTENSION_NAME } },
-      InstalledExtensionSchema,
-      signal
-    )
+  async enableCore(signal?: AbortSignal): Promise<ExtensionRuntimeStatus> {
+    const existing = await ExtensionParticipationModel.get(this.peer.id, EXTENSION_NAME)
+    if (!existing) {
+      const origin = await new ExtensionRegistryOriginResolver(
+        () => configStore.peerConfig.extension_registry_url
+      ).resolve()
+      const reader = new RegistryReleaseReader({
+        registryOrigin: origin,
+        hostSdk: { name: '@inkcre/core', version: corePackage.version },
+      })
+      const catalog = await reader.getExtension(EXTENSION_NAME, 'python')
+      const release = sortPublishedReleases(catalog.releases ?? [])[0]
+      if (!release) throw new Error('Twitter has no published Python distribution.')
+      await manageExtensionOnPeer(this.peer.id, {
+        action: 'select',
+        extension: EXTENSION_NAME,
+        distribution: 'python',
+        version: release.version,
+      })
+    }
+    signal?.throwIfAborted()
+    return manageExtensionOnPeer(this.peer.id, { action: 'enable', extension: EXTENSION_NAME })
   }
 
   status(signal?: AbortSignal): Promise<TwitterSetupStatus> {
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index 0f10a4e8..d8f22c20 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @inkcre/core
 
+## 0.4.0
+
+### Minor Changes
+
+- 插件配置与业务状态在部署内共享；精确分发版本和启用意图分别保存在每个 Peer。Client Web 在同一插件入口管理各 Peer 的安装、版本和运行状态，并采用 Extension management v2。
+
+  原生 SDK 不再提供全局插件版本与 enabled 数组。新版 MF 使用 0.4 SDK 的参与记录接口，历史 MF 需按其 SDK 范围运行或明确选择新版；不会自动改写旧版本选择。Python 与 MF 分别从自己的仓库发布，插件负责共享数据契约兼容。
+
+### Patch Changes
+
+- 7307dda: 按任务精简 Settings、Peer 与 Extension 界面，统一页面和浏览器标题，补齐场景化加载、刷新失败保留、保存与取消的动作反馈。修正重复检索、任务不存在及日志读取失败的可观察结果，保留失败后的恢复入口。
+- 7307dda: Source 与 Peer 配置使用可视化表单，保留完整 JSON 编辑模式；Peers 页面可确认删除离线 Peer 并清理其扩展启用记录。Extension 浏览与版本选择交由 Registry，Web 接收精确版本并确认安装；Web 与 Module Federation 扩展统一升级正式 UI 2.2.0，Peer AI 凭据在 schema 中标记为密码输入。
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index c2de786f..fa1df6e9 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@inkcre/core",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "files": [
     "dist"
   ],
diff --git a/packages/core/src/database/database.generated.ts b/packages/core/src/database/database.generated.ts
index b8901e9d..1273484e 100644
--- a/packages/core/src/database/database.generated.ts
+++ b/packages/core/src/database/database.generated.ts
@@ -366,33 +366,66 @@ export type Database = {
           },
         ]
       }
+      extension_peer_participations: {
+        Row: {
+          config_schema: Json | null
+          distribution: string | null
+          enabled: boolean
+          name: string
+          peer_id: string
+          version: string
+        }
+        Insert: {
+          config_schema?: Json | null
+          distribution?: string | null
+          enabled?: boolean
+          name: string
+          peer_id: string
+          version: string
+        }
+        Update: {
+          config_schema?: Json | null
+          distribution?: string | null
+          enabled?: boolean
+          name?: string
+          peer_id?: string
+          version?: string
+        }
+        Relationships: [
+          {
+            foreignKeyName: 'extension_peer_participations_name_fkey'
+            columns: ['name']
+            isOneToOne: false
+            referencedRelation: 'extensions'
+            referencedColumns: ['name']
+          },
+          {
+            foreignKeyName: 'extension_peer_participations_peer_id_fkey'
+            columns: ['peer_id']
+            isOneToOne: false
+            referencedRelation: 'peers'
+            referencedColumns: ['id']
+          },
+        ]
+      }
       extensions: {
         Row: {
           config: Json
-          config_schema: Json | null
-          enabled: string[]
           name: string
           nickname: string | null
           state: Json
-          version: string
         }
         Insert: {
           config?: Json
-          config_schema?: Json | null
-          enabled?: string[]
           name: string
           nickname?: string | null
           state?: Json
-          version: string
         }
         Update: {
           config?: Json
-          config_schema?: Json | null
-          enabled?: string[]
           name?: string
           nickname?: string | null
           state?: Json
-          version?: string
         }
         Relationships: []
       }
@@ -827,24 +860,6 @@ export type Database = {
         Args: { peer: string; ttl_seconds: number }
         Returns: string
       }
-      set_extension_peer_enabled: {
-        Args: { p_enabled: boolean; p_name: string; p_peer_id: string }
-        Returns: {
-          config: Json
-          config_schema: Json | null
-          enabled: string[]
-          name: string
-          nickname: string | null
-          state: Json
-          version: string
-        }[]
-        SetofOptions: {
-          from: '*'
-          to: 'extensions'
-          isOneToOne: false
-          isSetofReturn: true
-        }
-      }
     }
     Enums: {
       jobstatus: 'pending' | 'running' | 'finished' | 'failed' | 'timed_out' | 'aborted'
diff --git a/packages/core/src/database/runtime-contract.generated.json b/packages/core/src/database/runtime-contract.generated.json
index 320ae1ef..98a2645f 100644
--- a/packages/core/src/database/runtime-contract.generated.json
+++ b/packages/core/src/database/runtime-contract.generated.json
@@ -1,6 +1,6 @@
 {
   "format": 1,
-  "revision": "peer-runtime-identity-v1",
+  "revision": "extension-peer-participation-v2",
   "protocol": {
     "format": 1,
     "schema": "inkcre"
diff --git a/packages/core/src/extension/index.ts b/packages/core/src/extension/index.ts
index 91de33c3..a2980716 100644
--- a/packages/core/src/extension/index.ts
+++ b/packages/core/src/extension/index.ts
@@ -1,4 +1,11 @@
 export {
+  NativeDistributionSchema,
+  ExtensionParticipationSchema,
+  ExtensionParticipationModel,
+  ExtensionRuntimeStatusSchema,
+  type NativeDistribution,
+  type ExtensionParticipation,
+  type ExtensionRuntimeStatus,
   ExtensionNameSchema,
   ExtensionVersionSchema,
   InstalledExtensionSchema,
diff --git a/packages/core/src/extension/model.ts b/packages/core/src/extension/model.ts
index cc9f4380..ac3500c2 100644
--- a/packages/core/src/extension/model.ts
+++ b/packages/core/src/extension/model.ts
@@ -2,6 +2,8 @@ import { parse as parseSemVer } from 'semver'
 import type { Component } from 'vue'
 import { z } from 'zod'
 import { APIError, DBAPIClient } from '../base'
+import { MetaConfigSchema, type MetaConfig } from '../config'
+import { signDatabaseToken } from '../auth'
 
 const EXTENSION_NAME_PATTERN =
   /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/
@@ -20,29 +22,50 @@ export const ExtensionVersionSchema = z.string().refine(
   { error: 'Extension version must be strict SemVer without build metadata.' }
 )
 
-/** One deployment-wide installed Extension row. */
+export const NativeDistributionSchema = z.enum(['python', 'module_federation'])
+export type NativeDistribution = z.infer<typeof NativeDistributionSchema>
+
+/** Shared identity and configuration; native versions belong to individual Peers. */
 export const InstalledExtensionSchema = z.object({
   name: ExtensionNameSchema,
-  version: ExtensionVersionSchema,
-  enabled: z.array(z.uuid()).default([]),
   nickname: z.string().nullable(),
   config: z.record(z.string(), z.unknown()).default({}),
-  config_schema: z.record(z.string(), z.unknown()).nullable(),
 })
-
-export const InstallExtensionInputSchema = InstalledExtensionSchema.pick({
-  name: true,
-  version: true,
+export const InstallExtensionInputSchema = z.object({
+  name: ExtensionNameSchema,
+  version: ExtensionVersionSchema,
 })
-
 export type InstalledExtension = z.infer<typeof InstalledExtensionSchema>
 export type InstallExtensionInput = z.infer<typeof InstallExtensionInputSchema>
-export interface ExtensionModelInstallInput extends InstallExtensionInput {
+export interface ExtensionModelInstallInput {
+  name: string
   nickname: string
 }
 
-const EXTENSION_MANAGEMENT_PROJECTION =
-  'name,version,enabled,nickname,config,config_schema' as const
+export const ExtensionParticipationSchema = z.object({
+  name: ExtensionNameSchema,
+  peer_id: z.uuid(),
+  distribution: NativeDistributionSchema.nullable(),
+  version: ExtensionVersionSchema,
+  enabled: z.boolean(),
+  config_schema: z.record(z.string(), z.unknown()).nullable(),
+})
+export type ExtensionParticipation = z.infer<typeof ExtensionParticipationSchema>
+export const ExtensionRuntimeStatusSchema = ExtensionParticipationSchema.omit({
+  version: true,
+}).extend({
+  version: ExtensionVersionSchema.nullable(),
+  supported_distributions: z.array(NativeDistributionSchema),
+  loaded_version: ExtensionVersionSchema.nullable(),
+  running: z.boolean(),
+  restart_required: z.boolean(),
+  operation: z.string().nullable(),
+  error: z.string().nullable(),
+})
+export type ExtensionRuntimeStatus = z.infer<typeof ExtensionRuntimeStatusSchema>
+
+const EXTENSION_PROJECTION = 'name,nickname,config' as const
+const PARTICIPATION_PROJECTION = 'name,peer_id,distribution,version,enabled,config_schema' as const
 
 export class ExtensionPersistenceError extends Error {
   constructor(operation: string, cause?: unknown) {
@@ -53,32 +76,21 @@ export class ExtensionPersistenceError extends Error {
   }
 }
 
-/** Rich deployment Extension aggregate backed by the canonical PostgREST relation. */
 export class ExtensionModel implements InstalledExtension {
   static readonly #dbApi = new DBAPIClient<'extensions'>('extensions')
-
   readonly name: string
-  readonly version: string
-  readonly enabled: string[]
   readonly nickname: string | null
   readonly config: Record<string, unknown>
-  readonly config_schema: Record<string, unknown> | null
 
   constructor(row: InstalledExtension) {
     const parsed = InstalledExtensionSchema.parse(row)
     this.name = parsed.name
-    this.version = parsed.version
-    this.enabled = parsed.enabled
     this.nickname = parsed.nickname
     this.config = parsed.config
-    this.config_schema = parsed.config_schema
   }
 
   static async list(): Promise<ExtensionModel[]> {
-    const response = await this.#dbApi
-      .from()
-      .select(EXTENSION_MANAGEMENT_PROJECTION)
-      .order('name', { ascending: true })
+    const response = await this.#dbApi.from().select(EXTENSION_PROJECTION).order('name')
     assertSuccess(response, 'list')
     return InstalledExtensionSchema.array()
       .parse(response.data ?? [])
@@ -88,7 +100,7 @@ export class ExtensionModel implements InstalledExtension {
   static async get(name: string): Promise<ExtensionModel | null> {
     const response = await this.#dbApi
       .from()
-      .select(EXTENSION_MANAGEMENT_PROJECTION)
+      .select(EXTENSION_PROJECTION)
       .eq('name', name)
       .maybeSingle()
     assertSuccess(response, 'read')
@@ -96,123 +108,237 @@ export class ExtensionModel implements InstalledExtension {
   }
 
   static async install(input: ExtensionModelInstallInput): Promise<ExtensionModel> {
-    const coordinate = InstallExtensionInputSchema.parse(input)
-    const exact = InstalledExtensionSchema.parse({
-      ...coordinate,
-      nickname: input.nickname,
-      enabled: [],
-      config: {},
-      config_schema: null,
-    })
-    const existing = await this.get(exact.name)
-    if (existing) {
-      if (existing.version === exact.version) return existing
-      throw new ExtensionPersistenceError(
-        'install',
-        new Error(
-          `${exact.name} is already installed at ${existing.version}; disable every Peer before an explicit version change.`
-        )
-      )
-    }
-
+    const name = ExtensionNameSchema.parse(input.name)
+    const existing = await this.get(name)
+    if (existing) return existing
+    // A competing Peer can create the shared identity; never overwrite its configuration.
     const response = await this.#dbApi
-      .insert({
-        name: exact.name,
-        version: exact.version,
-        nickname: exact.nickname,
-        config: exact.config,
-        config_schema: exact.config_schema,
-      })
-      .select(EXTENSION_MANAGEMENT_PROJECTION)
-      .single()
-    assertSuccess(response, 'install')
-    return this.fromRow(response.data)
-  }
-
-  async changeVersion(version: string, nickname: string): Promise<ExtensionModel> {
-    const exactVersion = ExtensionVersionSchema.parse(version)
-    const response = await ExtensionModel.#dbApi
-      .update({ version: exactVersion, nickname, config_schema: null })
-      .eq('name', this.name)
-      .filter('enabled', 'eq', '{}')
-      .select(EXTENSION_MANAGEMENT_PROJECTION)
-      .maybeSingle()
-    assertSuccess(response, 'change version')
-    if (response.data === null) {
-      throw new ExtensionPersistenceError(
-        'change version',
-        new Error(`Extension ${this.name} is missing or still enabled on a Peer.`)
+      .from()
+      .upsert(
+        { name, nickname: input.nickname, config: {}, state: {} },
+        { onConflict: 'name', ignoreDuplicates: true }
       )
-    }
-    return ExtensionModel.fromRow(response.data)
+    assertSuccess(response, 'install')
+    const installed = await this.get(name)
+    if (!installed) throw new ExtensionPersistenceError('install')
+    return installed
   }
 
   async updateConfig(config: Record<string, unknown>): Promise<ExtensionModel> {
     const response = await ExtensionModel.#dbApi
       .update({ config })
       .eq('name', this.name)
-      .select(EXTENSION_MANAGEMENT_PROJECTION)
+      .select(EXTENSION_PROJECTION)
       .single()
     assertSuccess(response, 'update config')
     return ExtensionModel.fromRow(response.data)
   }
 
-  enablePeer(peerId: string): Promise<ExtensionModel> {
-    return this.setPeerEnabled(peerId, true)
-  }
-
-  disablePeer(peerId: string): Promise<ExtensionModel> {
-    return this.setPeerEnabled(peerId, false)
-  }
-
   async uninstall(): Promise<void> {
+    const participations = await ExtensionParticipationModel.list()
+    if (participations.some((row) => row.name === this.name)) {
+      throw new ExtensionPersistenceError(
+        'uninstall',
+        new Error('Remove every Peer participation before deleting the shared Extension.')
+      )
+    }
     const response = await ExtensionModel.#dbApi
       .from()
       .delete()
       .eq('name', this.name)
-      .filter('enabled', 'eq', '{}')
       .select('name')
     assertSuccess(response, 'uninstall')
-    const deletedRows = InstalledExtensionSchema.pick({ name: true }).array().parse(response.data)
-    if (deletedRows.length !== 1) {
+    if (response.data?.length !== 1) throw new ExtensionPersistenceError('uninstall')
+  }
+
+  private static fromRow(row: unknown): ExtensionModel {
+    return new ExtensionModel(InstalledExtensionSchema.parse(row))
+  }
+}
+
+/** One exact native selection. Runtime facts are obtained from the hosting Peer. */
+export class ExtensionParticipationModel implements ExtensionParticipation {
+  static readonly #dbApi = new DBAPIClient<'extension_peer_participations'>(
+    'extension_peer_participations'
+  )
+  readonly name: string
+  readonly peer_id: string
+  readonly distribution: NativeDistribution | null
+  readonly version: string
+  readonly enabled: boolean
+  readonly config_schema: Record<string, unknown> | null
+
+  constructor(row: ExtensionParticipation) {
+    const parsed = ExtensionParticipationSchema.parse(row)
+    this.name = parsed.name
+    this.peer_id = parsed.peer_id
+    this.distribution = parsed.distribution
+    this.version = parsed.version
+    this.enabled = parsed.enabled
+    this.config_schema = parsed.config_schema
+  }
+
+  static async list(peerId?: string): Promise<ExtensionParticipationModel[]> {
+    let query = this.#dbApi.from().select(PARTICIPATION_PROJECTION).order('name')
+    if (peerId) query = query.eq('peer_id', peerId)
+    const response = await query
+    assertSuccess(response, 'list participation')
+    return ExtensionParticipationSchema.array()
+      .parse(response.data ?? [])
+      .map(this.fromRow)
+  }
+
+  static async get(peerId: string, name: string): Promise<ExtensionParticipationModel | null> {
+    const response = await this.#dbApi
+      .from()
+      .select(PARTICIPATION_PROJECTION)
+      .eq('peer_id', peerId)
+      .eq('name', name)
+      .maybeSingle()
+    assertSuccess(response, 'read participation')
+    return response.data === null ? null : this.fromRow(response.data)
+  }
+
+  /** Read a selection snapshot from the original connection, without creating a cross-connection mutator. */
+  static async readForConnection(
+    meta: MetaConfig,
+    peerId: string,
+    name: string
+  ): Promise<ExtensionParticipation | null> {
+    const exact = MetaConfigSchema.parse(meta)
+    const database = new DBAPIClient<'extension_peer_participations'>(
+      'extension_peer_participations',
+      undefined,
+      'inkcre',
+      exact.INKCRE_PGREST_URL,
+      () => signDatabaseToken(exact.INKCRE_JWT_SECRET)
+    )
+    const response = await database
+      .from()
+      .select(PARTICIPATION_PROJECTION)
+      .eq('peer_id', peerId)
+      .eq('name', name)
+      .maybeSingle()
+    assertSuccess(response, 'observe selection')
+    return response.data === null ? null : ExtensionParticipationSchema.parse(response.data)
+  }
+
+  static async select(input: {
+    peerId: string
+    name: string
+    distribution: NativeDistribution
+    version: string
+    expectedVersion?: string
+  }): Promise<ExtensionParticipationModel> {
+    const exact = ExtensionParticipationSchema.parse({
+      name: input.name,
+      peer_id: input.peerId,
+      distribution: input.distribution,
+      version: input.version,
+      enabled: false,
+      config_schema: null,
+    })
+    const existing = await this.get(exact.peer_id, exact.name)
+    if (!existing) {
+      if (input.expectedVersion !== undefined)
+        throw new ExtensionPersistenceError(
+          'select version',
+          new Error('The previous selection no longer exists.')
+        )
+      const response = await this.#dbApi.insert(exact).select(PARTICIPATION_PROJECTION).single()
+      assertSuccess(response, 'select version')
+      return this.fromRow(response.data)
+    }
+    if (input.expectedVersion !== undefined && existing.version !== input.expectedVersion) {
       throw new ExtensionPersistenceError(
-        'uninstall',
-        new Error(`Extension ${this.name} is missing or still enabled on a Peer.`)
+        'select version',
+        new Error('The Peer selection changed; refresh and retry.')
       )
     }
+    if (existing.distribution === exact.distribution && existing.version === exact.version)
+      return existing
+    const expected = input.expectedVersion ?? existing.version
+    let query = this.#dbApi
+      .update({ distribution: exact.distribution, version: exact.version, config_schema: null })
+      .eq('peer_id', exact.peer_id)
+      .eq('name', exact.name)
+      .eq('version', expected)
+    // Resolving a legacy pin must not replace a selection made by another Host.
+    query =
+      existing.distribution === null
+        ? query.is('distribution', null)
+        : query.eq('distribution', existing.distribution)
+    const response = await query.select(PARTICIPATION_PROJECTION).maybeSingle()
+    assertSuccess(response, 'select version')
+    if (!response.data)
+      throw new ExtensionPersistenceError(
+        'select version',
+        new Error('The Peer selection changed; refresh and retry.')
+      )
+    return this.fromRow(response.data)
   }
 
-  private async setPeerEnabled(peerId: string, enabled: boolean): Promise<ExtensionModel> {
-    const response = await ExtensionModel.#dbApi
-      .rpc('set_extension_peer_enabled', {
-        p_name: this.name,
-        p_peer_id: peerId,
-        p_enabled: enabled,
-      })
-      .select(EXTENSION_MANAGEMENT_PROJECTION)
-    assertSuccess(response, enabled ? 'enable Peer' : 'disable Peer')
-    const updated = InstalledExtensionSchema.array().parse(response.data ?? [])[0]
-    if (!updated) {
+  async setEnabled(enabled: boolean): Promise<ExtensionParticipationModel> {
+    return this.updateExact({ enabled }, enabled ? 'enable Peer' : 'disable Peer')
+  }
+
+  async updateConfigSchema(
+    config_schema: Record<string, unknown> | null
+  ): Promise<ExtensionParticipationModel> {
+    return this.updateExact({ config_schema }, 'update config schema')
+  }
+
+  async remove(): Promise<void> {
+    const response = await ExtensionParticipationModel.#dbApi
+      .from()
+      .delete()
+      .eq('peer_id', this.peer_id)
+      .eq('name', this.name)
+      .eq('enabled', false)
+      .eq('version', this.version)
+      .select('name')
+    assertSuccess(response, 'remove participation')
+    if (response.data?.length !== 1)
       throw new ExtensionPersistenceError(
-        enabled ? 'enable Peer' : 'disable Peer',
-        new Error(`Extension ${this.name} does not exist.`)
+        'remove participation',
+        new Error('Disable this Peer or refresh its selection first.')
       )
-    }
-    return ExtensionModel.fromRow(updated)
   }
 
-  private static fromRow(row: unknown): ExtensionModel {
-    return new ExtensionModel(InstalledExtensionSchema.parse(row))
+  private async updateExact(
+    values: Record<string, unknown>,
+    operation: string
+  ): Promise<ExtensionParticipationModel> {
+    let query = ExtensionParticipationModel.#dbApi
+      .update(values)
+      .eq('peer_id', this.peer_id)
+      .eq('name', this.name)
+      .eq('version', this.version)
+    query =
+      this.distribution === null
+        ? query.is('distribution', null)
+        : query.eq('distribution', this.distribution)
+    const response = await query.select(PARTICIPATION_PROJECTION).maybeSingle()
+    assertSuccess(response, operation)
+    if (!response.data)
+      throw new ExtensionPersistenceError(
+        operation,
+        new Error('The Peer selection changed; refresh and retry.')
+      )
+    return ExtensionParticipationModel.fromRow(response.data)
+  }
+
+  private static fromRow(row: unknown): ExtensionParticipationModel {
+    return new ExtensionParticipationModel(ExtensionParticipationSchema.parse(row))
   }
 }
 
 function assertSuccess(response: { error?: { message: string } | null }, operation: string): void {
-  if (response.error) {
+  if (response.error)
     throw new ExtensionPersistenceError(
       operation,
       new APIError(response.error.message, 0, response.error)
     )
-  }
 }
 
 /** Setup UI contributed by one already-running Web Extension. */
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index 530c9a2e..767c6154 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -21,6 +21,13 @@ export {
   InstalledExtensionSchema,
   InstallExtensionInputSchema,
   ExtensionModel,
+  NativeDistributionSchema,
+  ExtensionParticipationSchema,
+  ExtensionParticipationModel,
+  ExtensionRuntimeStatusSchema,
+  type NativeDistribution,
+  type ExtensionParticipation,
+  type ExtensionRuntimeStatus,
   ExtensionPersistenceError,
   type ExtensionModule,
   type ExtensionSetupContribution,
diff --git a/packages/core/src/info-base/resolvers/base.ts b/packages/core/src/info-base/resolvers/base.ts
index 759bfdb8..f02d4838 100644
--- a/packages/core/src/info-base/resolvers/base.ts
+++ b/packages/core/src/info-base/resolvers/base.ts
@@ -105,6 +105,13 @@ export abstract class Resolver<RawContentT = unknown, SolvedContentT = RawConten
     this.resolverClasses.set(type, resolverClass)
   }
 
+  /** Release only the exact class registered by this native module. */
+  static unregister(type: string, resolverClass: ResolverClass): boolean {
+    if (this.resolverClasses.get(type) !== resolverClass) return false
+    this.resolverClasses.delete(type)
+    return true
+  }
+
   static getClass(type: string): ResolverClass {
     const resolverClass = this.resolverClasses.get(type)
     if (!resolverClass) throw new UnknownResolverError(type)
diff --git a/packages/core/src/info-base/resolvers/cache.ts b/packages/core/src/info-base/resolvers/cache.ts
index 3d58628c..d2598b4f 100644
--- a/packages/core/src/info-base/resolvers/cache.ts
+++ b/packages/core/src/info-base/resolvers/cache.ts
@@ -39,22 +39,23 @@ export class ResolverCache {
     block: Block,
     relations?: Relation[]
   ): Promise<T> {
+    // A disabled or replaced native module cannot serve its old cached resolver.
+    const resolverClass = Resolver.getClass(block.resolver)
     const cached = this.cache.get(block.id)
 
     // Check if cache is valid (block hasn't been updated)
     if (cached) {
       const cachedTime = cached.blockUpdatedAt.getTime()
       const currentTime = block.updated_at?.getTime() ?? 0
-      if (cachedTime === currentTime) {
+      if (cachedTime === currentTime && cached.resolver.constructor === resolverClass) {
         return cached.resolver as T
       }
-      // Block was updated, invalidate cache entry
+      // Block content or its registered native implementation changed.
       void cached.resolver.dispose()
       this.cache.delete(block.id)
     }
 
     // Create new resolver and cache it
-    const resolverClass = Resolver.getClass(block.resolver)
     const resolver = new resolverClass(block, relations)
 
     this.cache.set(block.id, {
diff --git a/packages/ext-dev-utils/CHANGELOG.md b/packages/ext-dev-utils/CHANGELOG.md
index c7b08b87..b0eaa34e 100644
--- a/packages/ext-dev-utils/CHANGELOG.md
+++ b/packages/ext-dev-utils/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @inkcre/ext-dev-utils
 
+## 0.1.3
+
+### Patch Changes
+
+- 7307dda: Source 与 Peer 配置使用可视化表单，保留完整 JSON 编辑模式；Peers 页面可确认删除离线 Peer 并清理其扩展启用记录。Extension 浏览与版本选择交由 Registry，Web 接收精确版本并确认安装；Web 与 Module Federation 扩展统一升级正式 UI 2.2.0，Peer AI 凭据在 schema 中标记为密码输入。
+- Updated dependencies [7307dda]
+- Updated dependencies
+- Updated dependencies [7307dda]
+  - @inkcre/core@0.4.0
+
 ## 0.1.2
 
 ### Patch Changes
diff --git a/packages/ext-dev-utils/package.json b/packages/ext-dev-utils/package.json
index 680244f1..0556d2d4 100644
--- a/packages/ext-dev-utils/package.json
+++ b/packages/ext-dev-utils/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@inkcre/ext-dev-utils",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
diff --git a/pdm.lock b/pdm.lock
index a13054f4..c7356992 100644
--- a/pdm.lock
+++ b/pdm.lock
@@ -5,7 +5,7 @@
 groups = ["default"]
 strategy = ["inherit_metadata"]
 lock_version = "4.5.0"
-content_hash = "sha256:bb96fd8f2ae26ebe087a8994dd781ca818e851daa167633222c620945f45a29a"
+content_hash = "sha256:77a001505a2f494975d2202b886d5313e46fe384487711409a5163a5d10f1841"
 
 [[metadata.targets]]
 requires_python = "==3.13.*"
@@ -34,18 +34,18 @@ files = [
 
 [[package]]
 name = "anyio"
-version = "4.14.2"
+version = "4.15.1"
 requires_python = ">=3.10"
 summary = "High-level concurrency and networking framework on top of asyncio or Trio"
 groups = ["default"]
 dependencies = [
     "exceptiongroup>=1.0.2; python_version < \"3.11\"",
     "idna>=2.8",
-    "typing-extensions>=4.5; python_version < \"3.13\"",
+    "typing-extensions>=4.16.0; python_version < \"3.15\"",
 ]
 files = [
-    {file = "anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494"},
-    {file = "anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f"},
+    {file = "anyio-4.15.1-py3-none-any.whl", hash = "sha256:6152fdbbf9a77fdec97731721bebf7c4c44f7c29b424b0065826173efc7ed101"},
+    {file = "anyio-4.15.1.tar.gz", hash = "sha256:9f28306018cbd6d329e64a36d58256edff76dd996fe423bc957326e578b82a94"},
 ]
 
 [[package]]
@@ -61,28 +61,13 @@ files = [
 
 [[package]]
 name = "click"
-version = "8.4.2"
+version = "8.5.0"
 requires_python = ">=3.10"
 summary = "Composable command line interface toolkit"
 groups = ["default"]
-dependencies = [
-    "colorama; platform_system == \"Windows\"",
-]
 files = [
-    {file = "click-8.4.2-py3-none-any.whl", hash = "sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76"},
-    {file = "click-8.4.2.tar.gz", hash = "sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6"},
-]
-
-[[package]]
-name = "colorama"
-version = "0.4.6"
-requires_python = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
-summary = "Cross-platform colored terminal text."
-groups = ["default"]
-marker = "platform_system == \"Windows\""
-files = [
-    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
-    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+    {file = "click-8.5.0-py3-none-any.whl", hash = "sha256:255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360"},
+    {file = "click-8.5.0.tar.gz", hash = "sha256:ba0d2089de75ea0310e2dde03160e6ca10009947fb95a182f9b54021bb272e34"},
 ]
 
 [[package]]
@@ -130,20 +115,20 @@ files = [
 
 [[package]]
 name = "idna"
-version = "3.18"
+version = "3.20"
 requires_python = ">=3.9"
 summary = "Internationalized Domain Names in Applications (IDNA)"
 groups = ["default"]
 files = [
-    {file = "idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2"},
-    {file = "idna-3.18.tar.gz", hash = "sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848"},
+    {file = "idna-3.20-py3-none-any.whl", hash = "sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c"},
+    {file = "idna-3.20.tar.gz", hash = "sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44"},
 ]
 
 [[package]]
 name = "inkcre-extension-toolkit"
-version = "0.2.1"
+version = "0.5.0"
 requires_python = "<3.14,>=3.12"
-url = "https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.2.1/inkcre_extension_toolkit-0.2.1-py3-none-any.whl"
+url = "https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.5.0/inkcre_extension_toolkit-0.5.0-py3-none-any.whl"
 summary = "Developer and delivery tooling for InKCre Extensions"
 groups = ["default"]
 dependencies = [
@@ -152,25 +137,25 @@ dependencies = [
     "semantic-version<3,>=2.10",
 ]
 files = [
-    {file = "inkcre_extension_toolkit-0.2.1-py3-none-any.whl", hash = "sha256:fffaad86db43d998731bfee69e992fa02d18ea2b428fdd00bda5ed6e311bf3de"},
+    {file = "inkcre_extension_toolkit-0.5.0-py3-none-any.whl", hash = "sha256:f690aefd4bfc61862c468ed73e9518057bd86453042f05ebb0394b7003015f82"},
 ]
 
 [[package]]
 name = "inkcre-extension-toolkit"
-version = "0.2.1"
+version = "0.5.0"
 extras = ["cli"]
 requires_python = "<3.14,>=3.12"
-url = "https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.2.1/inkcre_extension_toolkit-0.2.1-py3-none-any.whl"
+url = "https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.5.0/inkcre_extension_toolkit-0.5.0-py3-none-any.whl"
 summary = "Developer and delivery tooling for InKCre Extensions"
 groups = ["default"]
 dependencies = [
     "httpx<0.29,>=0.28",
-    "inkcre-extension-toolkit @ https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.2.1/inkcre_extension_toolkit-0.2.1-py3-none-any.whl",
+    "inkcre-extension-toolkit @ https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.5.0/inkcre_extension_toolkit-0.5.0-py3-none-any.whl",
     "typer<0.22,>=0.21",
     "wheel<0.48,>=0.46",
 ]
 files = [
-    {file = "inkcre_extension_toolkit-0.2.1-py3-none-any.whl", hash = "sha256:fffaad86db43d998731bfee69e992fa02d18ea2b428fdd00bda5ed6e311bf3de"},
+    {file = "inkcre_extension_toolkit-0.5.0-py3-none-any.whl", hash = "sha256:f690aefd4bfc61862c468ed73e9518057bd86453042f05ebb0394b7003015f82"},
 ]
 
 [[package]]
@@ -211,47 +196,47 @@ files = [
 
 [[package]]
 name = "pydantic"
-version = "2.13.4"
-requires_python = ">=3.9"
+version = "2.14.1"
+requires_python = ">=3.10"
 summary = "Data validation using Python type hints"
 groups = ["default"]
 dependencies = [
     "annotated-types>=0.6.0",
-    "pydantic-core==2.46.4",
-    "typing-extensions>=4.14.1",
-    "typing-inspection>=0.4.2",
+    "pydantic-core==2.50.1",
+    "typing-extensions>=4.16.0",
+    "typing-inspection>=0.4.4",
 ]
 files = [
-    {file = "pydantic-2.13.4-py3-none-any.whl", hash = "sha256:45a282cde31d808236fd7ea9d919b128653c8b38b393d1c4ab335c62924d9aba"},
-    {file = "pydantic-2.13.4.tar.gz", hash = "sha256:c40756b57adaa8b1efeeced5c196f3f3b7c435f90e84ea7f443901bec8099ef6"},
+    {file = "pydantic-2.14.1-py3-none-any.whl", hash = "sha256:9195d967ec791692a04438115466764fb8b9a27b31f14a760437694f40d6b454"},
+    {file = "pydantic-2.14.1.tar.gz", hash = "sha256:94f478203dd03404682a1ada216965651dd74b1d2d5ffd62e00e0837caab5c26"},
 ]
 
 [[package]]
 name = "pydantic-core"
-version = "2.46.4"
-requires_python = ">=3.9"
+version = "2.50.1"
+requires_python = ">=3.10"
 summary = "Core functionality for Pydantic validation and serialization"
 groups = ["default"]
 dependencies = [
-    "typing-extensions>=4.14.1",
+    "typing-extensions>=4.16.0",
 ]
 files = [
-    {file = "pydantic_core-2.46.4-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:5d5902252db0d3cedf8d4a1bc68f70eeb430f7e4c7104c8c476753519b423008"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:c94f0688e7b8d0a67abf40e57a7eaaecd17cc9586706a31b76c031f63df052b4"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f027324c56cd5406ca49c124b0db10e56c69064fec039acc571c29020cc87c76"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:e739fee756ba1010f8bcccb534252e85a35fe45ae92c295a06059ce58b74ccd3"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9d56801be94b86a9da183e5f3766e6310752b99ff647e38b09a9500d88e46e76"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2412e734dcb48da14d4e4006b82b46b74f2518b8a26ee7e58c6844a6cd6d03c4"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9551187363ffc0de2a00b2e47c25aeaeb1020b69b668762966df15fc5659dd5a"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-manylinux_2_31_riscv64.whl", hash = "sha256:0186750b482eefa11d7f435892b09c5c606193ef3375bcf94aa00ae6bfb66262"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:5855698a4856556d86e8e6cd8434bc3ac0314ee8e12089ae0e143f64c6256e4e"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:cbaf13819775b7f769bf4a1f066cb6df7a28d4480081a589828ef190226881cd"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:633147d34cf4550417f12e2b1a0383973bdf5cdfde212cb09e9a581cf10820be"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:82cf5301172168103724d49a1444d3378cb20cdee30b116a1bd6031236298a5d"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-win32.whl", hash = "sha256:9fa8ae11da9e2b3126c6426f147e0fba88d96d65921799bb30c6abd1cb2c97fb"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-win_amd64.whl", hash = "sha256:6b3ace8194b0e5204818c92802dcdca7fc6d88aabbb799d7c795540d9cd6d292"},
-    {file = "pydantic_core-2.46.4-cp313-cp313-win_arm64.whl", hash = "sha256:184c081504d17f1c1066e430e117142b2c77d9448a97f7b65c6ac9fd9aee238d"},
-    {file = "pydantic_core-2.46.4.tar.gz", hash = "sha256:62f875393d7f270851f20523dd2e29f082bcc82292d66db2b64ea71f64b6e1c1"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:d5e062c01286d861fd6a1c4ff6e063547b3e713067f2df033c0ff97ac2ca006b"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0c003c3b7f49debb893d2d85ae099ac5959c9839e2f330fadb1fcdf7a6594482"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:409e0ea40ec30d9158f33574fd758e689f6045a0f2596701828c27816ca9687d"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:131059670f1d2444269b8585cb888963994871932447c08b39ac6a51fcfef658"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:6dbcbee53bf17196a7f745aa9bf5a9603953a1e365b1f020be3207c676a3e7c4"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:325c23f3e35cfbf0fe3486fa5f7260d1e45885173002d30a28ca019994124255"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:17e722e156d0444ecaefbe640bdb60928752bf2013e2b7a11cdb099aaae19bec"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-manylinux_2_31_riscv64.whl", hash = "sha256:aa8224f10880d9bf1b5993988ba153d42a8b4f3f4f511f93b1f09c93ff613c72"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:41bc8237121bd8dc8d888dfd6279fc166ffc88c1f1bf3a8bf00869680533ca4c"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:45c6266d071c241f2a168d45bf8c54344f0effce35e7e6b73afdec11f3687568"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:1deeacb112d14d3f4fcb16b165f7dbaf76c70ba6e82f37ba042bdab51970a0b8"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:1c96fd793b73d1b92e65570132505498fe7b21eaef73cdf74e67e5dfba7ac9e4"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-win32.whl", hash = "sha256:06ead20d39ffd6f2f6f2a8f8a6de67ff8bb1b4f14a8a30e058502514ee2ac685"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-win_amd64.whl", hash = "sha256:7816e98acc08119dc0f340ab167048ecc54126316330c1f0caf7c6756c88e28f"},
+    {file = "pydantic_core-2.50.1-cp313-cp313-win_arm64.whl", hash = "sha256:c17799a62c142d61b8a3c51752a7cbc87fe2ad4ccfab10e628a77b405075c662"},
+    {file = "pydantic_core-2.50.1.tar.gz", hash = "sha256:e50d7b94baac6c7d09927fa5ca5800a0c7ee5015c7fcff65beb3a1931b5a6e09"},
 ]
 
 [[package]]
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 02b5b18a..200205eb 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -96,8 +96,8 @@ importers:
         specifier: workspace:*
         version: link:../../packages/core
       '@inkcre/extension-runtime-client-web':
-        specifier: github:InKCre/ext-reg#57dcd80289285620a1fd27a0a48027e56c4ce7b1&path:/runtimes/client-web
-        version: https://codeload.github.com/InKCre/ext-reg/tar.gz/57dcd80289285620a1fd27a0a48027e56c4ce7b1#path:/runtimes/client-web(@inkcre/core@packages+core)(@module-federation/runtime@0.21.6)
+        specifier: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz
+        version: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz(@inkcre/core@packages+core)(@module-federation/runtime@0.21.6)
       '@inkcre/ui-web':
         specifier: 2.2.1
         version: 2.2.1(unocss@66.7.5(vite@7.3.6(@types/node@22.17.2)(jiti@2.7.0)(lightningcss@1.33.0)(sass-embedded@1.90.0)(sass@1.101.6)(yaml@2.9.0)))(vue@3.5.40(typescript@5.9.3))
@@ -354,8 +354,8 @@ importers:
         specifier: workspace:*
         version: link:../../packages/core
       '@inkcre/extension-runtime-client-web':
-        specifier: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.2.0/inkcre-extension-runtime-client-web-0.2.0.tgz
-        version: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.2.0/inkcre-extension-runtime-client-web-0.2.0.tgz(@inkcre/core@packages+core)(@module-federation/runtime@0.22.1)
+        specifier: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz
+        version: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz(@inkcre/core@packages+core)(@module-federation/runtime@0.22.1)
       '@vueuse/core':
         specifier: ^14.0.0
         version: 14.3.0(vue@3.5.40(typescript@5.9.3))
@@ -402,6 +402,9 @@ importers:
       '@inkcre/core':
         specifier: workspace:*
         version: link:../../packages/core
+      '@inkcre/extension-runtime-client-web':
+        specifier: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz
+        version: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz(@inkcre/core@packages+core)(@module-federation/runtime@0.22.1)
       '@vueuse/core':
         specifier: ^14.0.0
         version: 14.3.0(vue@3.5.40(typescript@5.9.3))
@@ -1399,18 +1402,11 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@inkcre/extension-runtime-client-web@https://codeload.github.com/InKCre/ext-reg/tar.gz/57dcd80289285620a1fd27a0a48027e56c4ce7b1#path:/runtimes/client-web':
-    resolution: {gitHosted: true, integrity: sha512-WydOwa8HJ4/aGdk0vhlUV+CzmkWNeQ7KY6YV1F5NXEG07L1pf3Tm4rawOFdFZnLQBbu3AYpQ5IPlhpIfD5r/fg==, path: /runtimes/client-web, tarball: https://codeload.github.com/InKCre/ext-reg/tar.gz/57dcd80289285620a1fd27a0a48027e56c4ce7b1}
-    version: 0.2.0
-    peerDependencies:
-      '@inkcre/core': '>=0.3.0 <0.4.0'
-      '@module-federation/runtime': '>=0.21.4 <0.23.0'
-
-  '@inkcre/extension-runtime-client-web@https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.2.0/inkcre-extension-runtime-client-web-0.2.0.tgz':
-    resolution: {integrity: sha512-Rj39VKGY32qMAiYjoxZbmGR1dnEdQsNpVWjPBKor7beqE5WDpU9BAw7YMOCkouf6WxeX9jt8Ap70RbDkkKEyuQ==, tarball: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.2.0/inkcre-extension-runtime-client-web-0.2.0.tgz}
-    version: 0.2.0
+  '@inkcre/extension-runtime-client-web@https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz':
+    resolution: {integrity: sha512-MksnAY9JEYyRnkmESIo15lqbz4C+iCpF/WFlHiDhpcTlFaTW9R/Mtu/P4DmwocpTxLPbSHiVIED0gVhbfpldSw==, tarball: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz}
+    version: 0.4.0
     peerDependencies:
-      '@inkcre/core': '>=0.3.0 <0.4.0'
+      '@inkcre/core': '>=0.4.0 <0.5.0'
       '@module-federation/runtime': '>=0.21.4 <0.23.0'
 
   '@inkcre/ui-web@2.2.1':
@@ -7422,14 +7418,14 @@ snapshots:
   '@img/sharp-win32-x64@0.35.2':
     optional: true
 
-  '@inkcre/extension-runtime-client-web@https://codeload.github.com/InKCre/ext-reg/tar.gz/57dcd80289285620a1fd27a0a48027e56c4ce7b1#path:/runtimes/client-web(@inkcre/core@packages+core)(@module-federation/runtime@0.21.6)':
+  '@inkcre/extension-runtime-client-web@https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz(@inkcre/core@packages+core)(@module-federation/runtime@0.21.6)':
     dependencies:
       '@inkcre/core': link:packages/core
       '@module-federation/runtime': 0.21.6
       semver: 7.8.5
       zod: 4.1.12
 
-  '@inkcre/extension-runtime-client-web@https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.2.0/inkcre-extension-runtime-client-web-0.2.0.tgz(@inkcre/core@packages+core)(@module-federation/runtime@0.22.1)':
+  '@inkcre/extension-runtime-client-web@https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.4.0/inkcre-extension-runtime-client-web-0.4.0.tgz(@inkcre/core@packages+core)(@module-federation/runtime@0.22.1)':
     dependencies:
       '@inkcre/core': link:packages/core
       '@module-federation/runtime': 0.22.1
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 6b990557..5d4b9c54 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -8,7 +8,6 @@ catalog:
   vue-tsc: 3.3.8
 
 allowBuilds:
-  '@inkcre/extension-runtime-client-web@https://codeload.github.com/InKCre/ext-reg/tar.gz/57dcd80289285620a1fd27a0a48027e56c4ce7b1#path:/runtimes/client-web': true
   '@parcel/watcher': false
   esbuild: false
   sharp: false
diff --git a/pyproject.toml b/pyproject.toml
index d6a6b93e..7608be97 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,9 +3,9 @@ name = "inkcre-client-web-tooling"
 version = "0.0.0"
 description = "Repository-level development tooling for the InKCre Web monorepo"
 requires-python = ">=3.13,<3.14"
-# Gate: generate and commit pdm.lock only after this immutable Toolkit wheel is published.
+# The exact Toolkit package source is admitted for this protocol cutover; canonical wheels remain the normal delivery boundary.
 dependencies = [
-  "inkcre-extension-toolkit[cli] @ https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.2.1/inkcre_extension_toolkit-0.2.1-py3-none-any.whl",
+  "inkcre-extension-toolkit[cli] @ https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.5.0/inkcre_extension_toolkit-0.5.0-py3-none-any.whl",
 ]
 
 [tool.pdm]
diff --git a/scripts/core-release-lib.mjs b/scripts/core-release-lib.mjs
index bc8dd1e5..1e2ad08f 100644
--- a/scripts/core-release-lib.mjs
+++ b/scripts/core-release-lib.mjs
@@ -23,6 +23,27 @@ export function validateCoreReleaseConfig(config) {
   ) {
     throw new Error('core release config must select InKCre/core-py stable')
   }
+  if (config.canonical_candidate !== undefined) {
+    const candidate = config.canonical_candidate
+    if (
+      !candidate ||
+      !digestPattern.test(candidate.image) ||
+      !sourceRevisionPattern.test(candidate.source_revision) ||
+      typeof candidate.contract_revision !== 'string' ||
+      !candidate.contract_revision
+    ) {
+      throw new Error(
+        'canonical Core candidate requires a published repository digest, exact source SHA and database contract revision'
+      )
+    }
+    if (
+      Object.keys(candidate).some(
+        (key) => !['image', 'source_revision', 'contract_revision'].includes(key)
+      )
+    ) {
+      throw new Error('canonical Core candidate contains unsupported fields')
+    }
+  }
   for (const name of ['pgvector', 'postgrest']) {
     const image = config.runtime_images?.[name]
     if (typeof image !== 'string' || !image.includes('@sha256:')) {
@@ -143,6 +164,24 @@ export function localDocker(args, options = {}) {
   }).trim()
 }
 
+/** A reviewed canonical candidate can advance consumer admission without moving stable. */
+export function resolveConfiguredCoreRelease(runDocker, config) {
+  validateCoreReleaseConfig(config)
+  const candidate = config.canonical_candidate
+  if (!candidate) return resolveCoreRelease(runDocker, config.stable_image)
+  runDocker(['pull', candidate.image], { timeout: 300_000 })
+  const release = inspectCoreRelease(runDocker, candidate.image)
+  if (
+    release.manifest.source_revision !== candidate.source_revision ||
+    release.manifest.contract_revision !== candidate.contract_revision
+  ) {
+    throw new Error(
+      'canonical Core candidate source or database contract does not match its admission'
+    )
+  }
+  return release
+}
+
 export function resolveCoreRelease(runDocker, stableImage) {
   if (!stableImagePattern.test(stableImage)) {
     throw new Error(`unexpected core stable image: ${stableImage}`)
diff --git a/scripts/database-runtime-lib.mjs b/scripts/database-runtime-lib.mjs
index 1861d61d..74d84dc9 100644
--- a/scripts/database-runtime-lib.mjs
+++ b/scripts/database-runtime-lib.mjs
@@ -9,7 +9,7 @@ import { SignJWT } from 'jose'
 import {
   inspectCoreRelease,
   readJson,
-  resolveCoreRelease,
+  resolveConfiguredCoreRelease,
   stableJson,
   validateCoreReleaseConfig,
 } from './core-release-lib.mjs'
@@ -30,7 +30,7 @@ export const CORE_PEER_ID = '00000000-0000-4000-8000-000000000002'
 const CORE_CAPABILITIES = new Map([
   ['core.semantic_retrieval.v1', { method: 'POST', path: '/semantic-retrieval' }],
   ['core.organization.rumination.v1', { method: 'POST', path: '/organization/ruminate' }],
-  ['core.extension.management.v1', { method: 'POST', path: '/extension-management' }],
+  ['core.extension.management.v2', { method: 'POST', path: '/extension-management/v2' }],
 ])
 
 export function validateInstance(instance) {
@@ -229,7 +229,7 @@ export async function runtimeState(instance, { create = false } = {}) {
   const runDocker = (args, options) => runDatabaseDocker(provider, args, options)
   const release = process.env.INKCRE_CORE_IMAGE
     ? inspectCoreRelease(runDocker, process.env.INKCRE_CORE_IMAGE)
-    : resolveCoreRelease(runDocker, releaseConfig.stable_image)
+    : resolveConfiguredCoreRelease(runDocker, releaseConfig)
   const localPorts = {
     postgres: await availablePort(),
     core: await availablePort(),
diff --git a/scripts/publish-first-party-extensions.mjs b/scripts/publish-first-party-extensions.mjs
index 1ca0d481..86be1912 100644
--- a/scripts/publish-first-party-extensions.mjs
+++ b/scripts/publish-first-party-extensions.mjs
@@ -73,12 +73,20 @@ async function request(url, options, fetchImplementation) {
 }
 
 function releaseUrl(registryUrl, name, version) {
-  return new URL(`/v1/extensions/${name}/releases/${version}`, registryUrl)
+  return new URL(
+    `/v2/extensions/${name}/distributions/module_federation/releases/${version}`,
+    registryUrl
+  )
 }
 
 async function publicRelease(url, fetchImplementation) {
   try {
     const release = await request(url, {}, fetchImplementation)
+    assert.equal(
+      release.distribution,
+      'module_federation',
+      'Registry returned a different native distribution'
+    )
     assert.equal(release.state, 'published', `cannot deliver a ${release.state} Release`)
     return release
   } catch (error) {
@@ -231,7 +239,10 @@ export async function publishCandidates(options) {
     const prepare = await readFile(path.join(candidateDirectory, 'prepare.json'))
     // prepare is idempotent and also checks immutable provenance before a resumed publication.
     await request(
-      new URL(`/v1/extensions/${candidate.name}/releases`, registryUrl),
+      new URL(
+        `/v2/extensions/${candidate.name}/distributions/module_federation/releases`,
+        registryUrl
+      ),
       {
         method: 'POST',
         headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
diff --git a/scripts/resolve-core-release.mjs b/scripts/resolve-core-release.mjs
index e587a9b0..f7ebb94b 100644
--- a/scripts/resolve-core-release.mjs
+++ b/scripts/resolve-core-release.mjs
@@ -1,14 +1,18 @@
 import { appendFile } from 'node:fs/promises'
 import { fileURLToPath } from 'node:url'
 
-import { readJson, resolveCoreRelease, validateCoreReleaseConfig } from './core-release-lib.mjs'
+import {
+  readJson,
+  resolveConfiguredCoreRelease,
+  validateCoreReleaseConfig,
+} from './core-release-lib.mjs'
 import { resolveDatabaseProviderConfig, runDatabaseDocker } from './database-provider.mjs'
 
 const repoRoot = fileURLToPath(new URL('..', import.meta.url))
 const config = validateCoreReleaseConfig(await readJson(`${repoRoot}/contracts/core-release.json`))
 const provider = resolveDatabaseProviderConfig()
 const runDocker = (args, options) => runDatabaseDocker(provider, args, options)
-const release = resolveCoreRelease(runDocker, config.stable_image)
+const release = resolveConfiguredCoreRelease(runDocker, config)
 
 if (process.env.GITHUB_OUTPUT) {
   await appendFile(
diff --git a/scripts/sync-database-contract.mjs b/scripts/sync-database-contract.mjs
index acafb17e..193bc4af 100644
--- a/scripts/sync-database-contract.mjs
+++ b/scripts/sync-database-contract.mjs
@@ -7,7 +7,7 @@ import {
   inspectCoreRelease,
   projectDatabaseCompatibilityContract,
   readJson,
-  resolveCoreRelease,
+  resolveConfiguredCoreRelease,
   stableJson,
   validateCoreReleaseConfig,
 } from './core-release-lib.mjs'
@@ -29,7 +29,7 @@ const provider = resolveDatabaseProviderConfig()
 const runDocker = (dockerArgs, options) => runDatabaseDocker(provider, dockerArgs, options)
 const release = requestedImage
   ? inspectCoreRelease(runDocker, requestedImage)
-  : resolveCoreRelease(runDocker, config.stable_image)
+  : resolveConfiguredCoreRelease(runDocker, config)
 const instance = `typegen-${createHash('sha256')
   .update(`${repoRoot}/${process.pid}/${Date.now()}`)
   .digest('hex')
diff --git a/scripts/test-core-release.mjs b/scripts/test-core-release.mjs
new file mode 100644
index 00000000..eb473665
--- /dev/null
+++ b/scripts/test-core-release.mjs
@@ -0,0 +1,61 @@
+import assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { resolveConfiguredCoreRelease, validateCoreReleaseConfig } from './core-release-lib.mjs'
+
+const source = 'a'.repeat(40)
+const image = `ghcr.io/inkcre/core-py@sha256:${'b'.repeat(64)}`
+const revision = 'extension-peer-participation-v2'
+const config = {
+  format: 1,
+  repository: 'InKCre/core-py',
+  stable_image: 'ghcr.io/inkcre/core-py:stable',
+  runtime_images: { pgvector: 'pgvector@sha256:1', postgrest: 'postgrest@sha256:2' },
+  canonical_candidate: { image, source_revision: source, contract_revision: revision },
+}
+const artifact = (path) => ({ path, sha256: 'c'.repeat(64), size: 1 })
+function dockerFor(sourceRevision = source, contractRevision = revision) {
+  return (args) => {
+    if (args[0] === 'pull') return ''
+    if (args.includes('schema'))
+      return JSON.stringify({
+        format: 1,
+        source_revision: sourceRevision,
+        contract_revision: contractRevision,
+        schema: artifact('/app/database-contract/database-schema.sql'),
+        roles: artifact('/app/database-contract/database-roles.sql'),
+        runtime_contract: artifact('/app/database-contract/runtime-contract.json'),
+      })
+    return JSON.stringify({
+      format: 1,
+      revision: contractRevision,
+      source_revision: sourceRevision,
+      protocol: { schema: 'inkcre' },
+      jwt: { algorithm: 'HS256', role: 'authenticated' },
+    })
+  }
+}
+
+test('consumer admission rejects unknown candidate origin, source and contract', () => {
+  assert.equal(resolveConfiguredCoreRelease(dockerFor(), config).image, image)
+  assert.throws(
+    () => resolveConfiguredCoreRelease(dockerFor('d'.repeat(40)), config),
+    /source or database contract/
+  )
+  assert.throws(
+    () => resolveConfiguredCoreRelease(dockerFor(source, 'old-contract'), config),
+    /source or database contract/
+  )
+  for (const invalid of [
+    'ghcr.io/inkcre/core-py:preview',
+    image.replace('ghcr.io', 'other.example'),
+  ]) {
+    assert.throws(
+      () =>
+        validateCoreReleaseConfig({
+          ...config,
+          canonical_candidate: { ...config.canonical_candidate, image: invalid },
+        }),
+      /requires a published repository digest/
+    )
+  }
+})
diff --git a/scripts/test-extension-publication.mjs b/scripts/test-extension-publication.mjs
index f7234eff..2bf589b9 100644
--- a/scripts/test-extension-publication.mjs
+++ b/scripts/test-extension-publication.mjs
@@ -6,6 +6,7 @@ import { createServer } from 'node:http'
 import os from 'node:os'
 import path from 'node:path'
 import { test } from 'node:test'
+import { verifyPublicModuleFederation } from './verify-native-extension-distribution.mjs'
 import {
   captureCandidates,
   checkCandidates,
@@ -27,7 +28,7 @@ test('a rerun cannot replace a missing or expired release candidate', () => {
 // A real HTTP fault-injection boundary for the publisher, not a replacement Registry implementation.
 test('an unknown MF-only upload resumes the saved ZIP and verifies even an existing association', async () => {
   const workspace = await mkdtemp(path.join(os.tmpdir(), 'inkcre-publication-test-'))
-  const registryUrl = 'https://registry.example.test'
+  let registryUrl = 'https://registry.example.test'
   const prefix = '/extensions/test/source/1.0.0/module-federation/'
   const build = path.join(workspace, 'extensions/source/dist/client-web')
   const uploaded = path.join(workspace, 'uploaded')
@@ -50,6 +51,7 @@ test('an unknown MF-only upload resumes the saved ZIP and verifies even an exist
         nickname: 'Source',
         version: '1.0.0',
         state: 'published',
+        distribution: 'module_federation',
         module_federation: {
           host_sdk: '@inkcre/core',
           host_sdk_version: '>=0.2.0 <0.4.0',
@@ -91,7 +93,7 @@ test('an unknown MF-only upload resumes the saved ZIP and verifies even an exist
           return json(200, record())
         }
       }
-      if (req.url.startsWith('/v1/'))
+      if (req.url.startsWith('/v2/'))
         return json(published ? 200 : 404, published ? record() : { detail: 'not found' })
       if (!published) return json(404, { detail: 'not found' })
       const relativePath = req.url.slice(prefix.length)
@@ -144,6 +146,7 @@ test('an unknown MF-only upload resumes the saved ZIP and verifies even an exist
     server.listen(0, '127.0.0.1')
     await once(server, 'listening')
     const origin = `http://127.0.0.1:${server.address().port}`
+    registryUrl = origin
     const options = {
       workspace,
       registryUrl,
@@ -156,6 +159,15 @@ test('an unknown MF-only upload resumes the saved ZIP and verifies even an exist
       },
       fetchImplementation: (url, init) => fetch(new URL(new URL(url).pathname, origin), init),
     }
+    await assert.rejects(
+      verifyPublicModuleFederation({
+        registryUrl: 'http://registry.example.test',
+        packagePath: path.join(workspace, 'extensions/source/package.json'),
+        corePackagePath: path.join(workspace, 'packages/core/package.json'),
+        artifactDirectory: build,
+      }),
+      /HTTPS or loopback HTTP/
+    )
     await captureCandidates(options)
     assert.equal(writes, 0, 'capturing a candidate must not mutate the Registry')
     // A rebuild could produce other bytes; publication must still use the retained ZIP.
diff --git a/scripts/verify-native-extension-distribution.mjs b/scripts/verify-native-extension-distribution.mjs
index 8261bc1b..772f38f5 100644
--- a/scripts/verify-native-extension-distribution.mjs
+++ b/scripts/verify-native-extension-distribution.mjs
@@ -172,10 +172,14 @@ export async function verifyPublicModuleFederation({
     artifactDirectory,
   })
   const registry = new URL(registryUrl)
-  assert.equal(registry.protocol, 'https:', 'Registry URL must use HTTPS')
+  const loopback = ['127.0.0.1', 'localhost', '[::1]'].includes(registry.hostname)
+  assert.ok(
+    registry.protocol === 'https:' || (registry.protocol === 'http:' && loopback),
+    'Registry URL must use HTTPS or loopback HTTP'
+  )
   const [namespace, name] = local.name.split('/')
   const releaseUrl = new URL(
-    `/v1/extensions/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/releases/${encodeURIComponent(local.version)}`,
+    `/v2/extensions/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/distributions/module_federation/releases/${encodeURIComponent(local.version)}`,
     registry
   )
   const releaseResponse = await fetchImplementation(releaseUrl, {
@@ -194,17 +198,19 @@ export async function verifyPublicModuleFederation({
       nickname: release.nickname,
       version: release.version,
       state: release.state,
-      module_federation: release.module_federation,
+      distribution: release.distribution,
+      module_federation: {
+        host_sdk: release.module_federation?.host_sdk,
+        host_sdk_version: release.module_federation?.host_sdk_version,
+      },
     },
     {
       name: local.name,
       nickname: local.nickname,
       version: local.version,
       state: 'published',
-      module_federation: {
-        manifest_url: `/extensions/${local.name}/${local.version}/module-federation/mf-manifest.json`,
-        ...local.module_federation,
-      },
+      distribution: 'module_federation',
+      module_federation: local.module_federation,
     },
     'public exact Release differs from checked association'
   )
@@ -322,6 +328,7 @@ export function previewRelease(local) {
     nickname: local.nickname,
     version: local.version,
     state: 'published',
+    distribution: 'module_federation',
     module_federation: {
       manifest_url: `/extensions/${local.name}/${local.version}/module-federation/mf-manifest.json`,
       ...local.module_federation,
diff --git a/scripts/verify-pages-deployment.mjs b/scripts/verify-pages-deployment.mjs
index fdb0d57b..a76ad6f9 100644
--- a/scripts/verify-pages-deployment.mjs
+++ b/scripts/verify-pages-deployment.mjs
@@ -86,7 +86,7 @@ if (previewProducer) {
     throw new Error('preview producer is missing inkcre.name or version')
   }
   const [namespace, name] = extensionName.split('/')
-  const releasePath = `/v1/extensions/${namespace}/${name}/releases/${extensionVersion}`
+  const releasePath = `/v2/extensions/${namespace}/${name}/distributions/module_federation/releases/${extensionVersion}`
   const release = await readPreviewResponse(releasePath).then((response) => response.json())
   if (release.name !== extensionName || release.version !== extensionVersion) {
     throw new Error('preview exact Release differs from its producer metadata')
diff --git a/tests/e2e/mail-info-base.spec.ts b/tests/e2e/mail-info-base.spec.ts
index 21bc40fa..128310c4 100644
--- a/tests/e2e/mail-info-base.spec.ts
+++ b/tests/e2e/mail-info-base.spec.ts
@@ -128,6 +128,32 @@ test('Mail is used through the generic InfoBase navigation host', async ({ page
     })
   ).toBeVisible()
 
+  // Keep native restore behind the initial content lookup to exercise a cold deep link.
+  let releaseNativeModule!: () => void
+  const nativeModuleReady = new Promise<void>((resolve) => {
+    releaseNativeModule = resolve
+  })
+  const nativeEntryPattern = '**/remoteEntry.js'
+  await page.route(nativeEntryPattern, async (route) => {
+    await nativeModuleReady
+    await route.continue()
+  })
+  try {
+    await page.goto(`/info-base/graph/blocks/${graph.email}/content`)
+    await expect(page.locator('.solved-content-popup')).toContainText(
+      'Unknown resolver ID: extensions.mail.email.v1'
+    )
+    releaseNativeModule()
+    await expect(
+      page.getByRole('heading', {
+        name: 'Re: A deep module is measured by the promise it hides',
+      })
+    ).toBeVisible()
+  } finally {
+    releaseNativeModule()
+    await page.unroute(nativeEntryPattern)
+  }
+
   const html = page.frameLocator('iframe[title="Email HTML body"]')
   await expect(
     html.getByRole('heading', { name: 'Deep modules preserve a small promise' })
diff --git a/tests/e2e/peer-database.spec.ts b/tests/e2e/peer-database.spec.ts
index 1014933f..ea9f9e11 100644
--- a/tests/e2e/peer-database.spec.ts
+++ b/tests/e2e/peer-database.spec.ts
@@ -245,30 +245,33 @@ test('a pending initial lease does not block pages or admit the browser worker',
   let extensionReads = 0
   let enabledReleaseReads = 0
   let leasePending = false
-  await page.route('**/extensions?**', async (route) => {
+  await page.route('**/extension_peer_participations?**', async (route) => {
     extensionReads++
     await route.fulfill({
       headers: { 'Access-Control-Allow-Origin': '*' },
       json: [
         {
           name: 'e2e/lease-order',
+          peer_id: '00000000-0000-4000-8000-000000000001',
+          distribution: 'module_federation',
           version: '1.0.0',
-          enabled: ['00000000-0000-4000-8000-000000000001'],
-          nickname: null,
-          config: {},
+          enabled: true,
           config_schema: null,
         },
       ],
     })
   })
-  await page.route('**/v1/extensions/e2e/lease-order/releases/1.0.0', async (route) => {
-    enabledReleaseReads++
-    await route.fulfill({
-      status: 404,
-      headers: { 'Access-Control-Allow-Origin': '*' },
-      json: { detail: 'isolated missing release' },
-    })
-  })
+  await page.route(
+    '**/v2/extensions/e2e/lease-order/distributions/module_federation/releases/1.0.0',
+    async (route) => {
+      enabledReleaseReads++
+      await route.fulfill({
+        status: 404,
+        headers: { 'Access-Control-Allow-Origin': '*' },
+        json: { detail: 'isolated missing release' },
+      })
+    }
+  )
   await page.route('**/jobs?**', async (route) => {
     workerRequests++
     await route.continue()
@@ -532,7 +535,7 @@ test('zero participation persists, stays idle, and a custom interval resumes lea
     if (new URL(route.request().url()).searchParams.get('status') === 'eq.pending') scans++
     await route.fulfill({ headers: { 'Access-Control-Allow-Origin': '*' }, json: [] })
   })
-  await page.route('**/extensions?**', async (route) => {
+  await page.route('**/extension_peer_participations?**', async (route) => {
     extensionReads++
     await route.fulfill({ headers: { 'Access-Control-Allow-Origin': '*' }, json: [] })
   })
@@ -790,47 +793,72 @@ test('disabling participation drains a dispatched claim before saving configurat
   }
 })
 
-test('Registry install and multi-Peer enablement require explicit confirmation', async ({
+test('Registry confirmation selects one Peer and offline enablement preserves other native pins', async ({
   page,
 }) => {
   const extensionName = 'e2e/handoff'
   const endpoint = `${postgrestUrl}extensions?name=eq.${encodeURIComponent(extensionName)}`
+  const selections = `${postgrestUrl}extension_peer_participations?name=eq.${encodeURIComponent(extensionName)}`
   const authorization = `Bearer ${await token()}`
+  const headers = { Authorization: authorization, 'Content-Type': 'application/json' }
   const peerIds = [crypto.randomUUID(), crypto.randomUUID()]
-  await page.route('**/v1/extensions/e2e/handoff/releases/1.0.0', (route) =>
-    route.fulfill({
-      headers: { 'Access-Control-Allow-Origin': '*' },
-      json: {
-        name: extensionName,
-        nickname: 'Handoff check',
-        version: '1.0.0',
-        state: 'published',
-      },
-    })
+  await page.route(
+    '**/v2/extensions/e2e/handoff/distributions/module_federation/releases/1.0.0',
+    (route) =>
+      route.fulfill({
+        headers: { 'Access-Control-Allow-Origin': '*' },
+        json: {
+          name: extensionName,
+          nickname: 'Handoff check',
+          version: '1.0.0',
+          distribution: 'module_federation',
+          state: 'published',
+          python: null,
+          module_federation: {
+            host_sdk: '@inkcre/core',
+            host_sdk_version: '>=0.2.0 <1.0.0',
+            manifest_url: '/extensions/e2e/handoff/1.0.0/module-federation/mf-manifest.json',
+          },
+        },
+      })
   )
-
+  const readPins = async () => {
+    const response = await fetch(
+      `${selections}&select=peer_id,distribution,version,enabled&order=peer_id`,
+      { headers }
+    )
+    const body = await response.json()
+    expect(response.ok, JSON.stringify({ status: response.status, body })).toBe(true)
+    return body
+  }
   try {
-    await page.goto('/extensions?install=e2e%2Fhandoff&version=1.0.0')
+    await page.goto(
+      '/extensions?install=e2e%2Fhandoff&distribution=module_federation&version=1.0.0'
+    )
     await expect(page.getByRole('heading', { name: 'Handoff check' })).toBeVisible()
-    const before = await fetch(`${endpoint}&select=name`, {
-      headers: { Authorization: authorization },
-    })
-    expect(before.ok ? await before.json() : null).toEqual([])
-
+    expect(await readPins()).toEqual([])
     await page.getByRole('button', { name: 'Install', exact: true }).click()
     await expect(page).toHaveURL(/\/extensions$/)
-    await expect
-      .poll(async () => {
-        const response = await fetch(`${endpoint}&select=name,version,enabled`, {
-          headers: { Authorization: authorization },
-        })
-        return response.ok ? await response.json() : null
-      })
-      .toEqual([{ name: extensionName, version: '1.0.0', enabled: [] }])
-
+    await expect.poll(readPins).toEqual([
+      {
+        peer_id: '00000000-0000-4000-8000-000000000001',
+        distribution: 'module_federation',
+        version: '1.0.0',
+        enabled: false,
+      },
+    ])
+    const seeded = await fetch(endpoint, {
+      method: 'PATCH',
+      headers,
+      body: JSON.stringify({
+        config: { mailbox: 'preserved' },
+        state: { account: { id: 'saved-account' }, cursor: 'saved-cursor' },
+      }),
+    })
+    expect(seeded.status).toBe(204)
     const createdPeers = await fetch(`${postgrestUrl}peers`, {
       method: 'POST',
-      headers: { Authorization: authorization, 'Content-Type': 'application/json' },
+      headers,
       body: JSON.stringify(
         peerIds.map((id, index) => ({
           id,
@@ -844,78 +872,319 @@ test('Registry install and multi-Peer enablement require explicit confirmation',
       ),
     })
     expect(createdPeers.status).toBe(201)
+    const pins = await fetch(`${postgrestUrl}extension_peer_participations`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(
+        peerIds.map((peer_id, index) => ({
+          name: extensionName,
+          peer_id,
+          distribution: 'python',
+          version: index ? '2.0.0' : '1.0.0',
+          enabled: false,
+          config_schema: null,
+        }))
+      ),
+    })
+    expect(pins.status).toBe(201)
     await page.reload()
+    const first = page
+      .getByRole('article', { name: 'Handoff check' })
+      .getByRole('region', { name: 'E2E Peer 1' })
+    // Each row is its explicit target; one mutation cannot move the other Peer’s pin.
+    await first.getByRole('button', { name: 'Enable', exact: true }).click()
+    await expect
+      .poll(
+        async () =>
+          (await readPins())?.find((row: { peer_id: string }) => row.peer_id === peerIds[0])
+            ?.enabled
+      )
+      .toBe(true)
+    expect(
+      (await readPins())?.find((row: { peer_id: string }) => row.peer_id === peerIds[1])
+    ).toMatchObject({ distribution: 'python', version: '2.0.0', enabled: false })
+    await first.getByRole('button', { name: 'Disable', exact: true }).click()
+    await expect
+      .poll(
+        async () =>
+          (await readPins())?.find((row: { peer_id: string }) => row.peer_id === peerIds[0])
+            ?.enabled
+      )
+      .toBe(false)
+    await first.getByRole('button', { name: 'Remove', exact: true }).click()
+    await expect
+      .poll(async () =>
+        (await readPins())?.some((row: { peer_id: string }) => row.peer_id === peerIds[0])
+      )
+      .toBe(false)
+    const shared = await fetch(`${endpoint}&select=name,config,state`, { headers })
+    expect(await shared.json()).toEqual([
+      {
+        name: extensionName,
+        config: { mailbox: 'preserved' },
+        state: { account: { id: 'saved-account' }, cursor: 'saved-cursor' },
+      },
+    ])
+    expect(
+      (await readPins())?.find((row: { peer_id: string }) => row.peer_id === peerIds[1])
+    ).toMatchObject({ version: '2.0.0', enabled: false })
+  } finally {
+    await fetch(selections, { method: 'DELETE', headers })
+    await fetch(endpoint, { method: 'DELETE', headers })
+    await fetch(`${postgrestUrl}peers?id=in.(${peerIds.join(',')})`, { method: 'DELETE', headers })
+  }
+})
 
-    await page.getByRole('button', { name: 'Enable…' }).click()
-    const dialog = page.getByRole('dialog')
-    await dialog.getByRole('checkbox', { name: /E2E Peer 1/ }).check()
-    await dialog.getByRole('button', { name: 'Cancel' }).click()
-    const readEnabled = async () => {
-      const response = await fetch(`${endpoint}&select=enabled`, {
-        headers: { Authorization: authorization },
+test('Python-only availability is explicit and Registry read failures remain unknown', async ({
+  page,
+}) => {
+  const localName = `python-only-${Date.now()}`
+  const name = `e2e/${localName}`
+  const headers = { Authorization: `Bearer ${await token()}`, 'Content-Type': 'application/json' }
+  let catalogReads = 0
+  let fail = false
+  await page.route(`**/v2/extensions/e2e/${localName}/distributions/*`, async (route) => {
+    catalogReads++
+    if (route.request().url().endsWith('/module_federation')) {
+      await route.fulfill({
+        status: fail ? 503 : 404,
+        headers: { 'Access-Control-Allow-Origin': '*' },
+        json: { detail: fail ? 'Registry unavailable' : 'Native distribution not found' },
+      })
+    } else {
+      await route.fulfill({
+        headers: { 'Access-Control-Allow-Origin': '*' },
+        json: {
+          name,
+          nickname: 'Python-only fixture',
+          releases: [
+            {
+              name,
+              nickname: 'Python-only fixture',
+              distribution: 'python',
+              version: '1.0.0',
+              state: 'published',
+              module_federation: null,
+              python: {
+                host_sdk: 'core-py',
+                host_sdk_version: '>=0.3.0',
+                project: 'inkcre-python-fixture',
+                simple_url: 'https://registry.example.invalid/simple/',
+                entry_point: {
+                  group: 'inkcre.extensions',
+                  name: 'fixture',
+                  object: 'fixture:Extension',
+                },
+              },
+            },
+          ],
+        },
       })
-      return response.ok ? (await response.json())[0]?.enabled : null
     }
-    expect(await readEnabled()).toEqual([])
-
-    await page.getByRole('button', { name: 'Enable…' }).click()
-    await dialog.getByRole('checkbox', { name: /E2E Peer 1/ }).check()
-    await dialog.getByRole('checkbox', { name: /E2E Peer 2/ }).check()
-    await dialog.getByRole('button', { name: 'Enable selected' }).click()
-    await expect(dialog).toBeHidden()
-    await expect.poll(readEnabled).toEqual(expect.arrayContaining(peerIds))
-
-    await page.goto('/peers')
+  })
+  try {
+    expect(
+      (
+        await fetch(`${postgrestUrl}extensions`, {
+          method: 'POST',
+          headers,
+          body: JSON.stringify({ name, nickname: 'Python-only fixture', config: {}, state: {} }),
+        })
+      ).status
+    ).toBe(201)
+    await page.goto('/extensions')
+    const card = page.getByRole('article', { name: 'Python-only fixture', exact: true })
+    const browser = card.locator('.extension-card__peer-row').filter({ hasText: 'This browser' })
+    await expect(browser).toBeVisible()
+    expect(catalogReads).toBe(0)
+    await browser.getByRole('button', { name: 'Install', exact: true }).click()
+    const unavailable = page.getByRole('dialog', { name: 'Unavailable on this Peer', exact: true })
+    await expect(unavailable).toContainText('Distribution: Module Federation')
+    await expect(unavailable).toContainText('Published distributions: Python')
+    await expect(unavailable.getByRole('button', { name: 'Save', exact: true })).toBeDisabled()
+    await expect(unavailable.getByText('Version', { exact: true })).toHaveCount(0)
+    await unavailable.getByRole('button', { name: 'Cancel', exact: true }).click()
     await expect(
-      page.locator('.peer-card', { hasText: 'This browser' }).getByRole('button', {
-        name: 'Delete Peer',
-      })
-    ).toHaveCount(0)
-    const peerToDelete = page.locator('.peer-card', { hasText: peerIds[0] })
-    await peerToDelete.getByRole('button', { name: 'Delete Peer' }).click()
-    const deleteDialog = page.getByRole('dialog', { name: 'Delete Peer' })
-    await deleteDialog.getByRole('button', { name: 'Cancel' }).click()
-    await expect(peerToDelete).toBeVisible()
-    await expect.poll(readEnabled).toEqual(expect.arrayContaining(peerIds))
-    await peerToDelete.getByRole('button', { name: 'Delete Peer' }).click()
-    const deleteEndpoint = `${postgrestUrl}peers?id=eq.${peerIds[0]}`
-    let releaseDelete!: () => void
-    const pendingDelete = new Promise<void>((resolve) => {
-      releaseDelete = resolve
-    })
-    await page.route(deleteEndpoint, async (route) => {
-      if (route.request().method() === 'DELETE') await pendingDelete
-      await route.continue()
+      browser.getByRole('button', { name: 'Unavailable on this Peer', exact: true })
+    ).toBeDisabled()
+    fail = true
+    await card.getByRole('button', { name: 'Refresh', exact: true }).click()
+    await browser.getByRole('button', { name: 'Install', exact: true }).click()
+    const retry = page.getByRole('dialog', { name: 'Install', exact: true })
+    await expect(retry.getByRole('alert')).toContainText('503')
+    await expect(retry).not.toContainText('No published Module Federation releases.')
+    await expect(retry.getByRole('button', { name: 'Save', exact: true })).toBeDisabled()
+  } finally {
+    await fetch(`${postgrestUrl}extensions?name=eq.${encodeURIComponent(name)}`, {
+      method: 'DELETE',
+      headers,
     })
-    await deleteDialog.getByRole('button', { name: 'Delete Peer' }).click()
-    try {
-      await expect(deleteDialog.getByRole('button', { name: 'Delete Peer' })).toHaveAttribute(
-        'aria-busy',
-        'true'
-      )
-      const cancel = deleteDialog.getByRole('button', { name: 'Cancel' })
-      await expect(cancel).toBeDisabled()
-      await expect(cancel).not.toHaveAttribute('aria-busy', 'true')
-      await expect(cancel.locator('.ink-button__loading')).toHaveCount(0)
-    } finally {
-      releaseDelete()
-    }
-    await expect(peerToDelete).toBeHidden()
-    await page.unroute(deleteEndpoint)
-    await expect.poll(readEnabled).toEqual([peerIds[1]])
+  }
+})
 
+test('failed remote enablement reads back persisted intent without claiming a running module', async ({
+  page,
+}) => {
+  const name = `e2e/failed-intent-${Date.now()}`
+  const peerId = crypto.randomUUID()
+  const authorization = `Bearer ${await token()}`
+  const headers = { Authorization: authorization, 'Content-Type': 'application/json' }
+  const managementUrl = `${coreUrl}e2e-extension-management/v2`
+  const selectionUrl = `${postgrestUrl}extension_peer_participations?name=eq.${encodeURIComponent(name)}&peer_id=eq.${peerId}`
+  let enabled = false
+  let holdNextStatus = false
+  let releaseStaleStatus!: () => void
+  const staleGate = new Promise<void>((resolve) => {
+    releaseStaleStatus = resolve
+  })
+  let markStaleRequested!: () => void
+  const staleRequested = new Promise<void>((resolve) => {
+    markStaleRequested = resolve
+  })
+  await page.route(managementUrl, async (route) => {
+    if (route.request().method() === 'OPTIONS') {
+      await route.fulfill({
+        headers: {
+          'Access-Control-Allow-Origin': '*',
+          'Access-Control-Allow-Headers': '*',
+          'Access-Control-Allow-Methods': 'POST, OPTIONS',
+        },
+      })
+      return
+    }
+    const command = route.request().postDataJSON()
+    if (command.action === 'enable') {
+      const saved = await fetch(selectionUrl, {
+        method: 'PATCH',
+        headers,
+        body: JSON.stringify({ enabled: true }),
+      })
+      expect(saved.status).toBe(204)
+      enabled = true
+      await route.fulfill({
+        status: 500,
+        headers: { 'Access-Control-Allow-Origin': '*' },
+        json: { message: 'Native activation failed after saving intent.' },
+      })
+      return
+    }
+    expect(command.action).toBe('status')
+    const stale = holdNextStatus
+    if (stale) {
+      holdNextStatus = false
+      markStaleRequested()
+      await staleGate
+    }
+    await route.fulfill({
+      headers: { 'Access-Control-Allow-Origin': '*' },
+      json: {
+        peer_id: peerId,
+        supported_distributions: ['python'],
+        extensions: [
+          {
+            name,
+            peer_id: peerId,
+            supported_distributions: ['python'],
+            distribution: 'python',
+            version: '1.0.0',
+            enabled,
+            config_schema: null,
+            loaded_version: stale ? '1.0.0' : null,
+            running: stale,
+            restart_required: false,
+            operation: null,
+            error: enabled ? 'Native activation failed.' : null,
+          },
+        ],
+      },
+    })
+  })
+  try {
+    expect(
+      (
+        await fetch(`${postgrestUrl}peers`, {
+          method: 'POST',
+          headers,
+          body: JSON.stringify({
+            id: peerId,
+            name: 'Intent failure Peer',
+            labels: ['e2e'],
+            config: {},
+            config_schema: {},
+            lease_expires_at: new Date(Date.now() + 60_000).toISOString(),
+            capabilities: [
+              {
+                id: 'core.extension.management.v2',
+                inbound: {
+                  protocol: 'core.peer.protocol.http.v1',
+                  parameters: { method: 'POST', url: managementUrl },
+                },
+              },
+            ],
+          }),
+        })
+      ).status
+    ).toBe(201)
+    expect(
+      (
+        await fetch(`${postgrestUrl}extensions`, {
+          method: 'POST',
+          headers,
+          body: JSON.stringify({ name, nickname: 'Intent failure', config: {}, state: {} }),
+        })
+      ).status
+    ).toBe(201)
+    expect(
+      (
+        await fetch(`${postgrestUrl}extension_peer_participations`, {
+          method: 'POST',
+          headers,
+          body: JSON.stringify({
+            name,
+            peer_id: peerId,
+            distribution: 'python',
+            version: '1.0.0',
+            enabled: false,
+            config_schema: null,
+          }),
+        })
+      ).status
+    ).toBe(201)
     await page.goto('/extensions')
-    await page.getByRole('button', { name: 'Disable…' }).click()
-    await dialog.getByRole('checkbox', { name: /E2E Peer 2/ }).check()
-    await dialog.getByRole('button', { name: 'Disable selected' }).click()
-    await expect(dialog).toBeHidden()
-    await expect.poll(readEnabled).toEqual([])
+    const card = page.getByRole('article', { name: 'Intent failure', exact: true })
+    const peer = card
+      .locator('.extension-card__peer-row')
+      .filter({ hasText: 'Intent failure Peer' })
+    await expect(peer.getByRole('button', { name: 'Enable', exact: true })).toBeEnabled()
+    await expect(card.getByRole('button', { name: 'Refresh', exact: true })).toBeEnabled()
+    holdNextStatus = true
+    await card.getByRole('button', { name: 'Refresh', exact: true }).click()
+    await staleRequested
+    await peer.getByRole('button', { name: 'Enable', exact: true }).click()
+    await expect(peer.getByRole('alert')).toBeVisible()
+    await expect(peer.getByRole('button', { name: 'Disable', exact: true })).toBeEnabled()
+    await expect(peer).not.toContainText('Running 1.0.0')
+    const staleResponse = page.waitForResponse(managementUrl)
+    releaseStaleStatus()
+    await (await staleResponse).finished()
+    await page.evaluate(
+      () =>
+        new Promise<void>((resolve) =>
+          requestAnimationFrame(() => requestAnimationFrame(() => resolve()))
+        )
+    )
+    await expect(peer).not.toContainText('Running 1.0.0')
+    const persisted = await fetch(selectionUrl, { headers })
+    expect(persisted.status).toBe(200)
+    expect((await persisted.json())[0].enabled).toBe(true)
   } finally {
-    await fetch(endpoint, { method: 'DELETE', headers: { Authorization: authorization } })
-    await fetch(`${postgrestUrl}peers?id=in.(${peerIds.join(',')})`, {
+    releaseStaleStatus()
+    await fetch(selectionUrl, { method: 'DELETE', headers })
+    await fetch(`${postgrestUrl}extensions?name=eq.${encodeURIComponent(name)}`, {
       method: 'DELETE',
-      headers: { Authorization: authorization },
+      headers,
     })
+    await fetch(`${postgrestUrl}peers?id=eq.${peerId}`, { method: 'DELETE', headers })
   }
 })
 
@@ -1001,6 +1270,19 @@ test('Settings export restores the complete browser experience', async ({ page }
   const alternateId = crypto.randomUUID()
   const authorization = `Bearer ${await token()}`
   const endpoint = `${postgrestUrl}peers?id=eq.${alternateId}`
+  const extensionName = `e2e/switch-${crypto.randomUUID()}`
+  const headers = { Authorization: authorization, 'Content-Type': 'application/json' }
+  const created = await fetch(`${postgrestUrl}extensions`, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify({
+      name: extensionName,
+      nickname: 'Host identity switch',
+      config: {},
+      state: {},
+    }),
+  })
+  expect(created.status).toBe(201)
   try {
     await page.goto('/settings')
     const downloadPromise = page.waitForEvent('download')
@@ -1051,7 +1333,19 @@ test('Settings export restores the complete browser experience', async ({ page }
     await expect(
       page.getByRole('checkbox', { name: 'Enable telemetry', exact: true })
     ).not.toBeChecked()
+    // Import changes Peer identity without reloading this document: the Host must bind the new ID.
+    await page.getByRole('button', { name: 'Menu', exact: true }).click()
+    await page.getByRole('button', { name: 'Extensions', exact: true }).click()
+    const row = page
+      .getByRole('article', { name: 'Host identity switch', exact: true })
+      .getByRole('region')
+      .filter({ hasText: 'This browser' })
+    await expect(row.getByRole('button', { name: 'Install', exact: true })).toBeEnabled()
+    await expect(
+      row.getByText('The runtime belongs to a different Peer.', { exact: true })
+    ).toHaveCount(0)
   } finally {
+    await fetch(`${postgrestUrl}extensions?name=eq.${extensionName}`, { method: 'DELETE', headers })
     const cleanup = await fetch(endpoint, {
       method: 'DELETE',
       headers: { Authorization: authorization },
@@ -1192,18 +1486,19 @@ test('core Peer publishes and serves its exact capability inbounds', async ({ pa
       )
       const peers = await peersResponse.json()
       const management = peers[0]?.capabilities?.find(
-        (capability: { id: string }) => capability.id === 'core.extension.management.v1'
+        (capability: { id: string }) => capability.id === 'core.extension.management.v2'
       )
       const execution = await fetch(management.inbound.parameters.url, {
         method: management.inbound.parameters.method,
         headers: { Authorization: authorization, 'Content-Type': 'application/json' },
-        body: JSON.stringify({ action: 'disable', extension: 'e2e/not-installed' }),
+        body: JSON.stringify({ action: 'status', extension: 'e2e/not-installed' }),
       })
       return {
         peersStatus: peersResponse.status,
         capabilities: peers[0]?.capabilities,
         leaseExpiresAt: peers[0]?.lease_expires_at,
         executionStatus: execution.status,
+        executionBody: await execution.json(),
       }
     },
     { postgrestUrl, authorization }
@@ -1213,10 +1508,10 @@ test('core Peer publishes and serves its exact capability inbounds', async ({ pa
   expect(Date.parse(result.leaseExpiresAt)).toBeGreaterThan(Date.now())
   expect(result.capabilities).toEqual([
     {
-      id: 'core.extension.management.v1',
+      id: 'core.extension.management.v2',
       inbound: {
         protocol: 'core.peer.protocol.http.v1',
-        parameters: { method: 'POST', url: `${coreUrl}extension-management` },
+        parameters: { method: 'POST', url: `${coreUrl}extension-management/v2` },
       },
     },
     {
@@ -1241,7 +1536,12 @@ test('core Peer publishes and serves its exact capability inbounds', async ({ pa
       },
     },
   ])
-  expect(result.executionStatus).toBe(404)
+  expect(result.executionStatus).toBe(200)
+  expect(result.executionBody).toEqual({
+    peer_id: '00000000-0000-4000-8000-000000000002',
+    supported_distributions: ['python'],
+    extensions: [],
+  })
 })
 
 test('Block Inspector delegates rumination through the discovered Peer', async ({ page }) => {