docs(plugins): grade the security debt against the code

Two of the five bullets overstated the problem. The postMessage `'*'` is
forced by null-origin sandboxing and both hosts already validated `e.source`;
the real hole was the client trusting anyone, now closed. The CSP bullet is
not a repair — there is no network permission on this surface to honour, so
honouring one is a feature.

Marks the grants bullet half fixed, and says what the remaining half needs:
a hash of the served `.ui.js` in `UIPluginListItem`.

Author: joepio

planning/plugins.md

@@ -306,16 +306,34 @@ Front-end plugins already ship (#1197), and today they are the weakest
 boundary in the system — more practical authority than server-side WASM, with
 less review:
 
-- iframe CSP is `connect-src *` regardless of manifest; the `network`
-  permission gates only server-side WASM.
-- Grants live at `atomic.plugins.ui.<namespace.name>` in local storage, keyed
-  by neither drive nor artifact hash, so a same-named plugin on another drive
-  or any replacement version silently inherits consent.
-- `postMessage` uses target origin `'*'` on both sides; messages are
-  unvalidated and unversioned.
-- Implicit read scope includes anything parented under the page's `isA` class
-  resources — intended for schema reads, actually a broad widening.
-- `pluginFile` changing auto-executes an install.
+- **Open.** iframe CSP is `connect-src *` regardless of manifest. Not a
+  one-line fix: `PluginUIManifest` carries only `css`, so there is no network
+  permission on this surface to honour — the `network` permission gates
+  server-side WASM. Plumbing one in is a feature, not a repair.
+- **Half fixed.** Grants lived at `atomic.plugins.ui.<namespace.name>`, so
+  consent given to a plugin on your drive was inherited by any plugin of the
+  same name on a drive someone else shared with you. They are keyed by the
+  plugin resource's subject now, which is unique per drive. Consent still
+  survives the plugin's code being **replaced**, because nothing identifies
+  the artifact; that needs the server to publish a hash of the served
+  `.ui.js` in `UIPluginListItem`, which the client would fold into the key.
+- **Fixed, and it was misdescribed.** `postMessage` does use `'*'`, but it is
+  forced: both frames are sandboxed without `allow-same-origin`, so every end
+  is null-origin and there is no origin to name. Both hosts already validated
+  `e.source` against the frame. The real hole was the other direction — the
+  `@tomic/plugin` client accepted `message` events from anyone, so anything
+  able to post into the frame could answer a pending request or push a
+  `resource-notification` and hand the plugin a resource that does not exist.
+  It checks `e.source === window.parent` now. Messages remain **unversioned**.
+- **Open.** Implicit read scope includes anything parented under the page's
+  `isA` class resources — intended for schema reads, actually a broad
+  widening. Narrowing it changes what already-installed plugins can see, so it
+  wants a deprecation, not a patch.
+- **Open, and arguably by design.** `pluginFile` changing auto-executes an
+  install — but only for someone who can already write the plugin resource,
+  which is the rights model working. What makes it sharp is the artifact half
+  of the grants bullet above: replace the code and the old consent still
+  applies. Fix that and this mostly stops mattering.
 
 This is cheap to fix now and expensive once third parties exist.