Best possible solution:

Land only after maintainers accept the fallback cutover and there is real package or upgrade proof that the affected bundled channels resolve their canonical sidecars; otherwise keep the shipped fallback until a deprecation path is explicit.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a refactor PR, not a bug report with a current-main failure to reproduce. Source review can verify the loader behavior, but the remaining gate is package/upgrade proof after the cutover.

Is this the best way to solve the issue?

Unclear as merge-ready until upgrade proof exists: the source shape is cleaner and keeps external plugin fallback discovery intact, but removing the shipped bundled fallback is a maintainer compatibility decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against a3d5e5bc7247.

Label changes:

• add P2: This is a normal-priority cleanup with broad channel/plugin-loader reach and compatibility-sensitive fallback removal, but no urgent user-facing regression is proven.
• add merge-risk: 🚨 compatibility: Merging removes shipped bundled fallback paths and several broad sidecar exports, so existing package or upgrade layouts could fail if canonical sidecars are not present.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists targeted tests, tsgo, autoreview, and a Telegram mock SUT E2E, but no after-fix real packaged or upgrade run of the loader, doctor, or secret path. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a normal-priority cleanup with broad channel/plugin-loader reach and compatibility-sensitive fallback removal, but no urgent user-facing regression is proven.
• merge-risk: 🚨 compatibility: Merging removes shipped bundled fallback paths and several broad sidecar exports, so existing package or upgrade layouts could fail if canonical sidecars are not present.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists targeted tests, tsgo, autoreview, and a Telegram mock SUT E2E, but no after-fix real packaged or upgrade run of the loader, doctor, or secret path. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

PR surface:

Source -109, Tests +78. Total -31 across 29 files.

What I checked:

• Repository policy applied: Root policy treats plugin APIs, fallback behavior, startup/setup, config loading, and upgrade-sensitive paths as merge risks that need explicit review rather than routine cleanup. (AGENTS.md:30, a3d5e5bc7247)
• Doctor fallback removed: On the PR head, bundled channel doctor loading calls only doctor-contract-api.js, returns undefined only for missing public artifacts, and throws other loader errors. (src/channels/plugins/doctor-contract-api.ts:34, 48cf443ff2c6)
• Secret fallback narrowed for bundled channels: On the PR head, bundled channel secret loading calls only secret-contract-api.js, while external plugin discovery still searches secret-contract-api before contract-api. (src/secrets/channel-contract-api.ts:72, 48cf443ff2c6)
• Session-binding test seam moved: The registry-backed session binding helper now imports session-binding-contract-api instead of the broad contract-api artifact. (src/channels/plugins/contracts/test-helpers/registry-session-binding.ts:59, 48cf443ff2c6)
• Regression coverage added: The PR adds fast-path assertions that missing doctor and secret sidecars do not probe broad contract-api.js, plus a build-entry guard against duplicate dedicated exports in broad sidecars. (test/scripts/bundled-plugin-build-entries.test.ts:223, 48cf443ff2c6)
• History provenance: Current-main blame and log tie the existing broad fallback loaders to commit 440284f, which is the central code path this PR refactors. (src/secrets/channel-contract-api.ts:46, 440284f87955)

Likely related people:

• shakkernerd: Current-main blame and file history show commit 440284f carrying the bundled doctor and secret fallback loaders that this PR changes. (role: recent area contributor; confidence: medium; commits: 440284f87955; files: src/channels/plugins/doctor-contract-api.ts, src/secrets/channel-contract-api.ts, extensions/telegram/contract-api.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.