One shell, or it is not a platform

PLUG is not a folder of programs that happen to share a prefix. The distinction is enforced by one rule: PlugDesk is the only shell.

Not "the primary shell". The only one. No Plug App Shell, no PlugDesk Admin Shell, no NP4D shell, no second launcher dashboard. A product that needs its own window chrome to be usable has not been ported yet.

What the rule buys

A product appears in the suite by shipping a module manifest. The shell reads the manifest and renders a tab. Nothing else happens.

The test is blunt: if PlugDesk source had to change for a product's tab to appear, the port failed. That is Gate 13 of the fourteen portability gates, and it is binary — "largely satisfied" is a fail.

The same rule cuts the other way. Products do not import each other's internals. from plug_terminal_host.internal import … is an architecture error, not a shortcut. What is allowed is HTTP, WebSocket, the event bus, or a declared manifest dependency. A contract can be versioned and tested at the boundary; an internal import cannot.

What it costs

Every product has to work twice: standalone on its own, and embedded as a module. That is more work than picking one. It is the price of the property that matters more — a product can be used by someone who wants only that product, and by someone running the whole suite, without two codebases.

Tauri 2 and Rust are the canonical desktop basis. Existing Electron products keep running as legacy_standalone or external_process_adapter and each carries a porting task pack. A new Electron product is not a discussion, it is a blocker.

Changing any of this needs an ADR. Not an exception in the code.