Rank exact plugin identities across mention sources

[brsbl]

What was wrong

The composer merged mention sources in fixed source order and ranked plugin rows only by their display title. That let weaker built-in matches outrank exact plugin matches, and it lost installed/catalog plugin identity when a provider used a friendlier visible title. The host also had no bounded, compatibility-safe way for a provider to expose identity aliases without supplying policy-bearing numeric ranks.

What changed

@bb/client-core now owns one stable cross-source policy on desktop and mobile: exact visible-title or identity-alias matches, then prefix matches, then remaining results. Existing source order remains the tie-breaker, and each rendered provider section remains contiguous.

The plugin SDK adds optional experimental PluginMentionItem.experimental_searchAliases. The server validates at most eight non-empty aliases of at most 256 UTF-8 bytes each, normalizes omission to an empty internal list, and never accepts a provider-supplied numeric rank. Desktop and mobile preserve the aliases through route decoding and client mapping, while treating a missing wire field as an empty list for backward compatibility. Exact plugin IDs can therefore beat weaker built-in matches even when the visible plugin title differs.

This is additive only: there are no removals or meaning changes, no SDK/version/engine-floor change, and no host-daemon protocol change. The experimental API is recorded in docs/api_to_audit.md and the plugin-authoring skill.

How you verified

• Rebased conflict-free onto origin/main 8a2150f448c263b51e0e3ce7e229c72e49c0d59d; the cumulative stable patch ID is unchanged. Every required GitHub CI job passed at exact head f1f39af8d30848e875ca50286f666b0ff35e2c68.
• Regression-first client-core test failed before the ranking implementation, then passed; final client-core run: 21 files, 242/242 tests.
• Focused server provider/normalization run: 2 files, 18/18 tests. The unrelated update-resolver group that timed out under full concurrent load passed 16/16 in isolation.
• App, mobile, and plugin-SDK suites passed: app 3,189 tests with 3 skipped; mobile 841 tests; plugin SDK 127 tests.
• Post-rebase focused regressions passed: client-core 3/3, server 14/14, desktop 5/5, mobile 10/10, and plugin SDK 127/127. Turbo typecheck passed all 9 tasks; the repository's registered lint tasks passed 2/2; every changed file passes Prettier.
• Exact origin/main and final-bottom desktop dev apps used the same fictional project, installed-plugin fixture, route/state, and persisted 1280×900 native window bounds. Five repeated query cycles, four viewport captures, and transition widths 389/390/391, 767/768/769, 1023/1024/1025, and 1919/1920/1921 all passed with no horizontal overflow. Full immutable evidence manifest.

Before — fixed source order puts the weaker project match first

After — the exact installed-plugin identity is first

Fixes: no issue; this is the host-policy foundation for the @Plugin reference stack.

BB-Thread-ID: thr_94xb8a4nk2

AGENT GENERATED: by GPT-5.6