diff --git a/.sdk-integrity b/.sdk-integrity
index be48a4a..4fea285 100644
--- a/.sdk-integrity
+++ b/.sdk-integrity
@@ -1,3 +1,3 @@
 package=@appos.space/plugin-types
-version=3.0.1
-integrity=sha512-tJ7BPSpaWk8BVJFvO9BKyKIj953ra30bZ9hEnMLtB+VRPqM57MDhO+TEYn69gXFa05OT+BGEwigXvcZ1P8Jd9w==
+version=3.0.2
+integrity=sha512-tOwRoCkCeXe+erbdG6ZAsFE1PKxQlqpnq2KYeTErO2qOWX7gLYRd46X0IdpfUNgWlNwojl9VWVQXD7R6f+t1Vg==
diff --git a/package-lock.json b/package-lock.json
index 64696a6..076465a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6,16 +6,16 @@
     "": {
       "name": "appos-dev-plugin-verify",
       "devDependencies": {
-        "@appos.space/plugin-types": "3.0.1",
+        "@appos.space/plugin-types": "3.0.2",
         "@appos.space/plugin-utils": "3.0.0",
         "@appos.space/view-builders": "3.0.0",
         "typescript": "5.9.3"
       }
     },
     "node_modules/@appos.space/plugin-types": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@appos.space/plugin-types/-/plugin-types-3.0.1.tgz",
-      "integrity": "sha512-tJ7BPSpaWk8BVJFvO9BKyKIj953ra30bZ9hEnMLtB+VRPqM57MDhO+TEYn69gXFa05OT+BGEwigXvcZ1P8Jd9w==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@appos.space/plugin-types/-/plugin-types-3.0.2.tgz",
+      "integrity": "sha512-tOwRoCkCeXe+erbdG6ZAsFE1PKxQlqpnq2KYeTErO2qOWX7gLYRd46X0IdpfUNgWlNwojl9VWVQXD7R6f+t1Vg==",
       "dev": true,
       "license": "MIT"
     },
diff --git a/package.json b/package.json
index 6535751..b2c554b 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "check": "npm run freshness && npm run verify && npm run freshness:compiled"
   },
   "devDependencies": {
-    "@appos.space/plugin-types": "3.0.1",
+    "@appos.space/plugin-types": "3.0.2",
     "@appos.space/plugin-utils": "3.0.0",
     "@appos.space/view-builders": "3.0.0",
     "typescript": "5.9.3"
diff --git a/plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/INDEX.md b/plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/INDEX.md
index cdb702d..1a9317e 100644
--- a/plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/INDEX.md
+++ b/plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/INDEX.md
@@ -1,4 +1,4 @@
-# Bundled SDK type mirror — @appos.space/plugin-types@3.0.1
+# Bundled SDK type mirror — @appos.space/plugin-types@3.0.2
 
 GENERATED by `scripts/check-sdk-freshness.sh --update` — DO NOT EDIT BY HAND.
 
@@ -8,9 +8,9 @@ source; `scripts/check-sdk-freshness.sh` re-verifies this mirror against the
 registry on every CI run.
 
 - package: `@appos.space/plugin-types`
-- version: `3.0.1`
-- dist.integrity: `sha512-tJ7BPSpaWk8BVJFvO9BKyKIj953ra30bZ9hEnMLtB+VRPqM57MDhO+TEYn69gXFa05OT+BGEwigXvcZ1P8Jd9w==`
-- surface (derived from these files): 43 API namespaces on `PluginContext` (of which 21 core-plugin namespaces) + 3 metadata scalars, 135 canonical permission scopes, 5 legacy aliases (deprecated), 1 dynamic `oauth.<provider>` scope family, 3065 lines total
+- version: `3.0.2`
+- dist.integrity: `sha512-tOwRoCkCeXe+erbdG6ZAsFE1PKxQlqpnq2KYeTErO2qOWX7gLYRd46X0IdpfUNgWlNwojl9VWVQXD7R6f+t1Vg==`
+- surface (derived from these files): 43 API namespaces on `PluginContext` (of which 21 core-plugin namespaces) + 3 metadata scalars, 135 canonical permission scopes, 5 legacy aliases (deprecated), 1 dynamic `oauth.<provider>` scope family, 3072 lines total
 - regenerate: `scripts/check-sdk-freshness.sh --update` (after bumping the `@appos.space/plugin-types` devDependency + lockfile)
 - verify: `scripts/check-sdk-freshness.sh`
 
@@ -19,7 +19,7 @@ registry on every CI run.
 | colors.d.ts | bb57988f9a884aac5688adfc3e498e92617dfae257829a78aae1ed18ae051a95 |
 | core.d.ts | 3e951ef56e6148879fbe92d592399711f4bad5556f1549233ec3d32d0d9c49f9 |
 | fonts.d.ts | a0fbe8f1c761bc1d5418ac5b15f2ba7c1bd33be14dd3a0bc3f007b84d28335e2 |
-| globals.d.ts | a70c80ddc1ae463ff414784074aac43e9c10fb34f4ab540f443a910d1d97ec3b |
+| globals.d.ts | 4ce44988507311b0098a55ad10c07a7e7f44850100aaf66fe9c3e5a0574d8d43 |
 | icons.d.ts | 67d8c54c447c0f8b5a8f28f6375dc1956b68770221ff3028c0b73d8d039b546e |
 | index.d.ts | 7299f52226d577aa8ad6160357a8dee2e02f90bb19a18f93ec31d605f5756b27 |
 | namespaces-core-plugins.d.ts | 1b6c76836a6cfc87a3699ab40b8f6fd19d2c88bc8d6f90cd4ca6604d236cb7f6 |
diff --git a/plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/globals.d.ts b/plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/globals.d.ts
index d26a25c..aa3454b 100644
--- a/plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/globals.d.ts
+++ b/plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/globals.d.ts
@@ -45,8 +45,9 @@ declare global {
          * `toString()` and `toJSON()`, so template literals, `String(u)` and
          * `JSON.stringify(u)` all yield the href.
          *
-         * Pinned divergence: pre-percent-encoded query values are DOUBLE-encoded
-         * on an href round-trip (`%3A` → `%253A`).
+         * Pre-percent-encoded query values round-trip VERBATIM (`%3A` stays
+         * `%3A`) — no double-encoding on the href path. See the {@link URL} var
+         * declaration's divergence notes.
          */
         readonly href: string;
         /** Lowercased scheme followed by `":"` (e.g. `"https:"`). */
@@ -159,8 +160,6 @@ declare global {
      * - Default ports are RETAINED in `href`/`port` (`:443` is not dropped).
      * - An empty path stays `""` (WHATWG would give `"/"`).
      * - Out-of-range ports are accepted.
-     * - Pre-percent-encoded query values double-encode on an href round-trip
-     *   (`%3A` → `%253A`).
      * - `hostname` is lowercased and IPv6 literals come WITHOUT brackets;
      *   `host`/`origin` re-bracket them (`https://[::1]:8443/x` → hostname
      *   `"::1"`, host `"[::1]:8443"`, origin `"https://[::1]:8443"`).
@@ -168,6 +167,14 @@ declare global {
      *   (scheme-less inputs like `"not a url"` are rejected by the validity
      *   predicate, not by Foundation's parser).
      *
+     * NOT a divergence: pre-percent-encoded query values round-trip VERBATIM
+     * on href (`%3A` stays `%3A`, matching WHATWG). The widely-reported
+     * `%3A` → `%253A` double-encode reproduces only via Foundation's
+     * `URLComponents.queryItems` construction path, which this API never
+     * uses — the host parses with `URL(string:)` and serializes with
+     * `absoluteString`, and pins the verbatim round-trip in its coherence
+     * tests.
+     *
      * ## Out-of-subset surface (fails loudly, never silently wrong)
      *
      * - `url.searchParams`: absent from these types; the runtime getter