Answer stability round 1: 0 🔴, 4 🟡 (0 misread); own-key rename lookup, test the host translator, name both id kinds in the conflict, keep admin unreserved

src/plugin-host/conflicts.ts

@@ -39,7 +39,7 @@ export function findConflicts(plugins: Plugin[]): PluginConflict[] {
     for (const entry of plugin.profileMenu ?? []) if (entry.id != null) push(entry.id);
   };
   collect(plugins, overrideTargets).forEach((owners, id) => {
-    if (owners.length > 1) out.push({ kind: "nav-id", level: "error", message: `nav id "${id}" used ${owners.length}×; override targets ids, so they must be unique`, plugins: uniq(owners) });
+    if (owners.length > 1) out.push({ kind: "nav-id", level: "error", message: `id "${id}" used ${owners.length}× across nav nodes and profile-menu entries; the menu override targets ids, so they must be unique`, plugins: uniq(owners) });
   });
 
   collect(plugins, (plugin, push) => {

src/plugin-host/discovery.test.ts

@@ -59,7 +59,7 @@ const badCases: Array<{ name: string; files: Record<string, string>; match: RegE
   // The folder name becomes a Postgres identifier, which truncates past 63 bytes.
   { name: "a storage plugin whose folder name overflows a Postgres identifier", files: { [`${"a".repeat(57)}/plugin.ts`]: `export default { apiVersion: "${HOST_API_VERSION}", storage: true };` }, match: /storage.*56 characters/s },
   { name: "reserved dashboard id shadows the gated dashboard", files: { "dashboard/plugin.ts": full("dashboard") }, match: /dashboard.*reserved/s },
-  { name: "duplicate nav id across plugins", files: { "a/plugin.ts": full("a").replace("a:root", "dup"), "b/plugin.ts": full("b").replace("b:root", "dup") }, match: /nav id "dup"/ },
+  { name: "duplicate nav id across plugins", files: { "a/plugin.ts": full("a").replace("a:root", "dup"), "b/plugin.ts": full("b").replace("b:root", "dup") }, match: /id "dup" used 2× across nav nodes and profile-menu entries/ },
   { name: "a route marked public AND permission is contradictory", files: { "contra/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", public: true, permission: "x:read", handler: () => ({ html: "x" }) }] };` }, match: /contra.*public.*permission/s },
   { name: "a nav node marked public AND permission is contradictory", files: { "contranav/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", nav: [{ id: "n", label: "N", public: true, permission: "x:read" }] };` }, match: /contranav.*public.*permission/s },
   { name: "a route marked session AND permission is contradictory", files: { "contrasess/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", session: true, permission: "x:read", handler: () => ({ html: "x" }) }] };` }, match: /contrasess.*session.*permission/s },

src/plugin-host/plugin.test.ts

@@ -95,7 +95,7 @@ test("checkApiVersion: semver compat — equal/patch ok, older minor warns, newe
 
 // Drift guard: every mount but the auth flows is listed by hand, so a new top-level built-in route
 // needs a line here too.
-test("RESERVED_PLUGIN_IDS covers every built-in top-level mount; `home` (the / field) and `admin` (a plugin) are NOT reserved", () => {
+test("RESERVED_PLUGIN_IDS covers every built-in top-level mount; `home` (the / field), `admin` and `auth-admin` (plugins) are NOT reserved", () => {
   const seg = (path: string): string => path.split("/")[1] ?? ""; // first segment of "/x/y"
   const builtins = new Set<string>([
     ...Object.keys(AUTH_FLOWS).map(seg), // /login, /recovery, /registration, /settings, /verification
@@ -109,7 +109,9 @@ test("RESERVED_PLUGIN_IDS covers every built-in top-level mount; `home` (the / f
   for (const id of builtins) assert.ok(RESERVED_PLUGIN_IDS.has(id), `built-in mount "${id}" must be a reserved plugin id`);
   // "/" is owned by the `home` manifest field (not a /<id> route), so it cannot be shadowed and is
   // deliberately not reserved — a plugin folder named "home" is legal. `auth-admin` is likewise free:
-  // the admin screens ship as a drop-in plugin mounted at /auth-admin, not a built-in route.
+  // the admin screens ship as a drop-in plugin mounted at /auth-admin, not a built-in route; and so
+  // is `admin`, the id an operator's pre-0.5 copy of that plugin still carries.
   assert.equal(RESERVED_PLUGIN_IDS.has("home"), false);
   assert.equal(RESERVED_PLUGIN_IDS.has("auth-admin"), false);
+  assert.equal(RESERVED_PLUGIN_IDS.has("admin"), false);
 });