Until now, Mediabot’s API v3 plugins lived like visiting witches and wizards: carefully admitted, precisely supervised, and quietly sent home whenever the castle restarted. That was an excellent safety spell while the new corridor was experimental—but a poor long-term arrangement for an operator-approved deployment.

MB766 gives those decisions a proper Ministry ledger. 🏰

What the ledger remembers

The core now records only the pieces of operator intent needed to reconstruct an API v3 deployment:

• the validated local package name;
• the exact capabilities granted to it;
• its typed per-channel policies and configuration;
• whether the package was enabled or disabled.

The document is owned by Mediabot, written atomically with private permissions, and kept apart from both plugin application data and the old plugins.AUTOLOAD machinery. Installing a package still grants nothing. Every manifest remains default-off, and only a successful Partyline decision enters the ledger. 🗝️

A cautious morning roll call 🦉

At startup, Mediabot waits until its event loop, metrics and scheduler are ready. It then validates the entire ledger before inviting any v3 package back into the castle. The restore is local and deterministic: no owl is sent to the network, no package path is trusted from disk, and every manifest is checked by the normal runtime again.

A malformed, oversized, symlinked or structurally unknown ledger is rejected as a whole. Mediabot itself still starts. If one well-formed entry names a missing or newly invalid package, that failure is isolated and logged while the remaining entries continue their own roll call. One troublesome portrait can no longer lock the Great Hall doors. 🛡️

Rollback remains a first-class spell ↩️

Persistence does not weaken the controls that made API v3 safe:

• policy off immediately restores the historical channel path and persists that safer posture;
• disable stops the package but retains its reviewed configuration;
• unload restores the exact saved command handlers and removes the package from the next boot.

If the private ledger cannot be updated, the corresponding Partyline mutation is rolled back in memory instead of pretending that a temporary decision is durable.

Proof in the development castle ✨

The acceptance probe deliberately uses hello-v3, which spans a command, an event subscription and a scheduled job without changing user data. It enables the package in observe on #test, restarts Mediabot, and checks that the full runtime and silent policy return intact. It then unloads the package, restarts once more, and confirms that nothing returns.

With this sealed boot ledger in place, the next controlled move can focus on quotes-v3: observe first, authoritative promotion second, and a production pilot only after the development evidence is clean. The corridor now remembers what the operators decided—no more, no less. 🪄