diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 62a6a541..ab53c704 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -965,89 +965,11 @@ jobs:
         run: bash distribution/sync-manifest.test.sh
       - name: Claude-permissions tombstone contract test
         run: bash harness/shell/run-tests.sh components/claude-permissions/claude-permissions.test.sh
-      - name: Plugin-baseline drift-report contract test
-        run: bash harness/shell/run-tests.sh distribution/check-plugin-baseline.test.sh
       - name: Claude-settings target conformance test
         run: bash harness/shell/run-tests.sh distribution/check-claude-settings-targets.test.sh
       - name: Validate production manifest
         run: bash distribution/sync-manifest.sh validate
 
-  # Fleet plugin list vs the dotfiles workstation seed. The two lists are
-  # separate on purpose — the fleet list is the cloud install set and
-  # first-party only, the seed is workstation enablement and additionally
-  # carries third-party entries — but a first-party plugin added to the fleet
-  # list and never reaching the seed is drift nobody sees until someone runs
-  # the comparator by hand, which is how four ids went missing.
-  #
-  # A separate job rather than a step in `distribution`, for the reason the
-  # pr-convention-lockstep job records: this reads a consumer repository over
-  # the network, and that non-hermetic dependency must not contaminate the
-  # hermetic component lane.
-  plugin-seed-drift:
-    if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
-    permissions:
-      contents: read
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    env:
-      HAS_APP_CREDENTIAL: >-
-        ${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID != ''
-            && secrets.STANDARDS_SYNC_APP_PRIVATE_KEY != '' }}
-    steps:
-      - name: Check out
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      # dotfiles is private, so the seed is read through the contents API with
-      # a contents-read token from the standards-sync App — the
-      # pr-convention-lockstep precedent. No new secret: dotfiles is already a
-      # sync target, so it is in that installation, and the token is narrowed
-      # to that one repository. The mint is guarded on the secrets being
-      # present so an absent credential reaches the fetch tokenless and dies
-      # there instead of inside the mint action; the fetch then fails and the
-      # lane goes red. Not a skip either way. Two run kinds see no repository
-      # secrets: fork pull requests, which carry none by design, and
-      # Dependabot pull requests, which resolve the same two names from this
-      # repository's Dependabot secrets. Mirror both there whenever the App
-      # key rotates, or every Dependabot pull request fails this lane too.
-      - name: Mint a contents-read App token for the dotfiles seed
-        id: seed-token
-        if: env.HAS_APP_CREDENTIAL == 'true'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }}
-          private-key: ${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}
-          owner: melodic-software
-          repositories: dotfiles
-          permission-contents: read
-      # Only a fleet plugin the seed never names gates, and `-strict` is how
-      # the comparator says so: exit 3. Plain --compare-seed exits 1 on ANY
-      # divergence, and the steady state carries deliberate per-plugin seed
-      # opt-outs plus one seed-only entry, so that code alone would be red on
-      # every run; grepping the report's prose instead would put the go/no-go
-      # on a message the script is free to reword, which is the same silent
-      # green one layer down. Exit 2 — missing jq, unreadable JSON, a seed
-      # with no claudeSettings.seed.enabledPlugins object — still fails the
-      # lane, so a broken comparator or a structurally broken seed cannot read
-      # as "no drift". The report itself streams to the log either way.
-      - name: Compare the fleet plugin list against the dotfiles seed
-        env:
-          GH_TOKEN: ${{ steps.seed-token.outputs.token }}
-        run: |
-          set -euo pipefail
-          seed="$RUNNER_TEMP/dotfiles-claude.json"
-          gh api -H 'Accept: application/vnd.github.raw+json' \
-            repos/melodic-software/dotfiles/contents/.chezmoidata/claude.json >"$seed"
-          bash distribution/check-plugin-baseline.sh --compare-seed-strict "$seed" && rc=0 || rc=$?
-          case "$rc" in
-            0 | 1) ;;
-            3)
-              echo '::error::the dotfiles seed is missing a plugin the fleet list enables'
-              exit 1
-              ;;
-            *) exit "$rc" ;;
-          esac
-
   exec-bit:
     if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
     permissions:
@@ -1252,7 +1174,6 @@ jobs:
       - cloud-environment
       - mcp-launcher
       - distribution
-      - plugin-seed-drift
       - lefthook
       - exec-bit
       - machine-specific-paths
@@ -1321,7 +1242,6 @@ jobs:
             ${{ needs.harness.result }}
             ${{ needs.cloud-environment.result }}
             ${{ needs.distribution.result }}
-            ${{ needs.plugin-seed-drift.result }}
             ${{ needs.lefthook.result }}
             ${{ needs.exec-bit.result }}
             ${{ needs.machine-specific-paths.result }}
diff --git a/components/cloud-environment/README.md b/components/cloud-environment/README.md
index aee01dfb..22f7d302 100644
--- a/components/cloud-environment/README.md
+++ b/components/cloud-environment/README.md
@@ -60,19 +60,22 @@ its next cache rebuild (see [Update lifecycle](#update-lifecycle)).
 ## Plugin install
 
 Before the repo bootstrap, a generic, data-driven stage installs plugins from
-one settings-shaped file: **the fleet list**,
-[`fleet-plugins.json`](fleet-plugins.json) beside this script, the one place
-the organization's cloud plugin set is declared. The script fetches it from
-the same `raw.githubusercontent.com` path the bootstrap fetches this script
-from, writes it into the snapshot at `/opt/melodic-fleet-plugins.json`
+one settings-shaped file: **the fleet list**. The script fetches the
+melodic-software marketplace catalog,
+[`.claude-plugin/marketplace.json`](https://github.com/melodic-software/claude-code-plugins/blob/main/.claude-plugin/marketplace.json)
+in claude-code-plugins, and enables every plugin whose catalog entry leaves
+`defaultEnabled` unset or sets it `true`; any other value leaves the plugin
+off. It writes the list into the snapshot at
+`/opt/melodic-fleet-plugins.json`
 (falling back to `/tmp/melodic-fleet-plugins.json` with a logged `WARN` when
 `/opt` is unwritable, mirroring the stamp), and installs it. Every snapshot
 gets the fleet whatever repo it was built for, and the snapshot stays
 repo-agnostic.
 
 A repo's own `.claude/settings.json` carries only the deltas it declares
-beyond the fleet (an extra marketplace, a plugin beyond the fleet, or a
-`false` opt-out, which project scope applies over the user-scope install).
+beyond the fleet (an extra marketplace, a `true` opt-in to an off-by-default
+plugin, or a `false` opt-out, which project scope applies over the user-scope
+install).
 Those are not installed by this stage: the
 [repo bootstrap](#repo-bootstrap-handoff) that runs next applies them as an
 overlay on top of this list, from the snapshot copy (see the
@@ -88,17 +91,13 @@ add`, skipping ones already registered) and every `enabledPlugins` entry set
 to `true` is installed (`claude plugin install <id> --scope user -y`,
 skipping ones already installed). Every step is best-effort with a `WARN`
 line to the log; the whole stage skips cleanly when the `claude` CLI or `jq`
-is unavailable, and a failed fleet fetch installs no plugins that build (the
-next rebuild fetches the list again).
-
-The fleet list is settings-shaped on purpose: `jq` expressions written for a
-repo's settings file read it unchanged, and
-[`distribution/check-plugin-baseline.sh`](../../distribution/check-plugin-baseline.sh)
-uses it as the baseline every repo and the dotfiles seed are compared
-against. Every entry in it is `true`; a `false` is a per-repo decision and
-belongs in that repo's own file. To add a plugin to the fleet, add its entry
-here in byte order (`setup.test.sh` checks both), then force a snapshot
-rebuild (see [Update lifecycle](#update-lifecycle)).
+is unavailable, and a failed catalog fetch installs no plugins that build (the
+next rebuild fetches the catalog again).
+
+The fleet list is settings-shaped so the repo bootstrap reads it with the
+same `jq` expressions it uses on a repo's settings file. To add a plugin to or
+remove one from the cloud fleet, change its `defaultEnabled` in the catalog,
+then force a snapshot rebuild (see [Update lifecycle](#update-lifecycle)).
 
 The timing is load-bearing: Claude Code builds its plugin registry at
 process start and never re-reads it, so only installs already in the
@@ -121,7 +120,7 @@ unattended-loop `allow` grants
 ([claude-code-plugins#3172](https://github.com/melodic-software/claude-code-plugins/issues/3172)).
 
 The floor is fetched from the same `raw.githubusercontent.com` host as the
-fleet list, and the merge follows the dotfiles template:
+plugin catalog, and the merge follows the dotfiles template:
 `claudePermissions.allow` and `.deny` are unioned into the file's
 `permissions.allow` and `permissions.deny`, then the floor's `withdraw`
 tombstones are removed from `allow`. The file is never overwritten. Every
@@ -232,12 +231,12 @@ the snapshot.
 - Rollback: environments keep booting from their cached snapshot until
   rebuilt, so reverting the commit and forcing a rebuild restores the prior
   state; in an emergency the bootstrap can pin a commit SHA in the raw URL
-  instead of `main`. The pin covers this script only: the fleet list and the
-  permission floor are still fetched from `main`.
+  instead of `main`. The pin covers this script only: the plugin catalog and
+  the permission floor are still fetched from `main`.
 
 The scope boundary holds as elsewhere in this repository: this component owns
-the shared environment baseline, which includes the fleet plugin list and the
-composition of the fleet permission floor.
+the shared environment baseline, which includes deriving the fleet plugin
+list and composing the fleet permission floor.
 Repo-specific dependencies and plugin deltas belong to each repo's committed
 `.claude/cloud-bootstrap.sh` and `.claude/settings.json` (templates in the
 fleet guide above), never to this script.
diff --git a/components/cloud-environment/fleet-plugins.json b/components/cloud-environment/fleet-plugins.json
deleted file mode 100644
index 65aba6cc..00000000
--- a/components/cloud-environment/fleet-plugins.json
+++ /dev/null
@@ -1,89 +0,0 @@
-{
-  "extraKnownMarketplaces": {
-    "melodic-software": {
-      "source": {
-        "source": "github",
-        "repo": "melodic-software/claude-code-plugins"
-      },
-      "autoUpdate": true
-    }
-  },
-  "enabledPlugins": {
-    "actionlint@melodic-software": true,
-    "adhd@melodic-software": true,
-    "ai-briefing@melodic-software": true,
-    "ai-slop@melodic-software": true,
-    "architecture@melodic-software": true,
-    "attribution@melodic-software": true,
-    "autonomy@melodic-software": true,
-    "bash-format@melodic-software": true,
-    "biome-format@melodic-software": true,
-    "bugs@melodic-software": true,
-    "code-metrics@melodic-software": true,
-    "code-tidying@melodic-software": true,
-    "codebase-health@melodic-software": true,
-    "computer-use@melodic-software": true,
-    "context-budget@melodic-software": true,
-    "context-guard@melodic-software": true,
-    "context7@melodic-software": true,
-    "coupling@melodic-software": true,
-    "debugging@melodic-software": true,
-    "desktop-notification@melodic-software": true,
-    "discipline@melodic-software": true,
-    "discovery@melodic-software": true,
-    "disk-hygiene@melodic-software": true,
-    "docs-hygiene@melodic-software": true,
-    "domain-driven-design@melodic-software": true,
-    "dometrain@melodic-software": true,
-    "education@melodic-software": true,
-    "eol-normalizer@melodic-software": true,
-    "evals@melodic-software": true,
-    "event-storming@melodic-software": true,
-    "firecrawl@melodic-software": true,
-    "github@melodic-software": true,
-    "go-format@melodic-software": true,
-    "guardrails@melodic-software": true,
-    "harness-config@melodic-software": true,
-    "harness-memory@melodic-software": true,
-    "harness-ops@melodic-software": true,
-    "implementation@melodic-software": true,
-    "improvement@melodic-software": true,
-    "instruction-placement@melodic-software": true,
-    "kindle-dedrm@melodic-software": true,
-    "knowledge@melodic-software": true,
-    "machine-health@melodic-software": true,
-    "markdown-format@melodic-software": true,
-    "mcp-tools@melodic-software": true,
-    "miro@melodic-software": true,
-    "mutation-testing@melodic-software": true,
-    "naming@melodic-software": true,
-    "overengineering@melodic-software": true,
-    "performance@melodic-software": true,
-    "planning@melodic-software": true,
-    "playbooks@melodic-software": true,
-    "playgrounds@melodic-software": true,
-    "playwright@melodic-software": true,
-    "plugin-quality@melodic-software": true,
-    "powershell-format@melodic-software": true,
-    "prototype@melodic-software": true,
-    "rate-limit-guard@melodic-software": true,
-    "repo-fleet-hygiene@melodic-software": true,
-    "repo-hygiene@melodic-software": true,
-    "review@melodic-software": true,
-    "ruff-format@melodic-software": true,
-    "session-flow@melodic-software": true,
-    "skill-quality@melodic-software": true,
-    "songwriting@melodic-software": true,
-    "source-control@melodic-software": true,
-    "tdd@melodic-software": true,
-    "testing@melodic-software": true,
-    "toolchain@melodic-software": true,
-    "typos-format@melodic-software": true,
-    "verification@melodic-software": true,
-    "visualization@melodic-software": true,
-    "wizard@melodic-software": true,
-    "work-items@melodic-software": true,
-    "writing@melodic-software": true,
-    "x@melodic-software": true
-  }
-}
diff --git a/components/cloud-environment/setup.sh b/components/cloud-environment/setup.sh
index 17d97e4f..06f489ce 100755
--- a/components/cloud-environment/setup.sh
+++ b/components/cloud-environment/setup.sh
@@ -36,18 +36,19 @@
 # interleaves; the main shell's LOG is untouched by design.
 set -u
 
-SCRIPT_VERSION='2026-10-01.1'
+SCRIPT_VERSION='2026-10-02.1'
 STAMP='/opt/melodic-env-setup.done'
 STAMP_FALLBACK='/tmp/melodic-env-setup.done'
-# Fleet plugin list: the one standards-hosted, settings-shaped file every
-# cloud snapshot installs at user scope (fleet-plugins.json beside this
-# script). It arrives through the same raw.githubusercontent.com host this
-# script does, and is written into the snapshot at FLEET_PLUGINS so each
-# repo's session bootstrap can repair drift from it without a network round
-# trip. It is the only install source at cache build; a repo's own
-# enabledPlugins block carries deltas beyond the fleet, which the session
-# bootstrap applies as an overlay on top of this list.
-FLEET_PLUGINS_URL='https://raw.githubusercontent.com/melodic-software/standards/main/components/cloud-environment/fleet-plugins.json'
+# Fleet plugin list: every plugin in the melodic-software marketplace catalog
+# whose entry leaves defaultEnabled unset or true, derived at cache build
+# (fleet_list_from_catalog) into a settings-shaped file every cloud snapshot
+# installs at user scope. It is written into the snapshot at FLEET_PLUGINS so
+# each repo's session bootstrap can repair drift from it without a network
+# round trip. It is the only install source at cache build; a repo's own
+# enabledPlugins block carries deltas beyond the fleet (false to opt out, true
+# to opt in to an off-by-default plugin), which the session bootstrap applies
+# as an overlay on top of this list.
+FLEET_CATALOG_URL='https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/.claude-plugin/marketplace.json'
 FLEET_PLUGINS='/opt/melodic-fleet-plugins.json'
 FLEET_PLUGINS_FALLBACK='/tmp/melodic-fleet-plugins.json'
 # Fleet permission floor: the reviewed allow/deny set of the
@@ -116,6 +117,25 @@ install_plugins_from() {
     | select(.value == true) | .key' "$file" 2>/dev/null)
 }
 
+# fleet_list_from_catalog <marketplace.json> <out>: write the fleet list, a
+# settings-shaped file that registers the melodic-software marketplace and
+# enables every catalog entry whose defaultEnabled is absent or true; any other
+# value, a mistyped "false" included, leaves the entry off. A catalog whose
+# entries are all off still yields a list with nothing enabled, so a repo's
+# opt-ins overlay it. Returns non-zero and leaves no <out> when the catalog is
+# unreadable or has no entries.
+fleet_list_from_catalog() {
+  jq -e 'select((.plugins | length) > 0) | {
+      extraKnownMarketplaces: {"melodic-software": {source: {source: "github",
+        repo: "melodic-software/claude-code-plugins"}}},
+      enabledPlugins: ([.plugins[]
+        | select(.defaultEnabled == null or .defaultEnabled == true)
+        | {key: "\(.name)@melodic-software", value: true}] | from_entries)
+    }' "$1" >"$2" 2>/dev/null && return 0
+  rm -f "$2" 2>/dev/null
+  return 1
+}
+
 # compose_permissions_floor <floor json> <settings json>: union the floor's
 # claudePermissions.allow and .deny into a Claude Code settings file, then drop
 # the floor's withdraw tombstones from allow, the same shape the dotfiles
@@ -369,15 +389,15 @@ for track in "A gh + powershell|$track_a_log" \
 done
 
 # Generic plugin install from one settings-shaped file (extraKnownMarketplaces
-# + enabledPlugins): the fleet list at FLEET_PLUGINS_URL, which every snapshot
-# installs whatever repo it was built for. No repo-specific logic — a repo's
+# + enabledPlugins): the fleet list derived from FLEET_CATALOG_URL, which
+# every snapshot installs whatever repo it was built for. No repo-specific logic — a repo's
 # own enabledPlugins block declares deltas beyond the fleet and the repo
 # bootstrap below applies them as an overlay, so the snapshot itself stays the
 # same for every repo built against it. This must happen here, at cache build:
 # Claude Code reads its plugin registry at process start and never re-reads
 # it, so only snapshot-baked installs are loaded at a session's first turn.
 # It must also happen BEFORE the repo bootstrap: that bootstrap's plugin stage
-# reads this fetched list and skips outright when it is absent, so a bootstrap
+# reads this derived list and skips outright when it is absent, so a bootstrap
 # that ran first would bake none of the repo's deltas and leave them to arrive
 # on a later resume.
 # Github-source marketplaces' install/update semantics already handle
@@ -389,16 +409,17 @@ if ! command -v claude >/dev/null 2>&1; then
 elif ! command -v jq >/dev/null 2>&1; then
   log 'plugins: jq not available; skipping'
 else
-  # The fetched copy lands in the snapshot (FLEET_PLUGINS, or its /tmp
+  # The derived list lands in the snapshot (FLEET_PLUGINS, or its /tmp
   # fallback with a WARN, mirroring the stamp) so the repo bootstrap below —
   # and every later drift repair it runs on resume — reads the same list
   # offline. A fetch failure costs this build's plugin install, never the
   # build: the next rebuild fetches again, and a session on a snapshot without
   # the list installs nothing rather than guessing at a set.
   rm -f "$FLEET_PLUGINS" "$FLEET_PLUGINS_FALLBACK" 2>/dev/null
+  catalog_file="$(mktemp 2>/dev/null || echo "/tmp/melodic-fleet-catalog.$$")"
   if curl -fsSL --proto '=https' --retry 2 --retry-delay 3 \
-    "$FLEET_PLUGINS_URL" -o "$FLEET_PLUGINS_FALLBACK" >>"$LOG" 2>&1 &&
-    jq -e '(.enabledPlugins // {}) != {}' "$FLEET_PLUGINS_FALLBACK" >/dev/null 2>&1; then
+    "$FLEET_CATALOG_URL" -o "$catalog_file" >>"$LOG" 2>&1 &&
+    fleet_list_from_catalog "$catalog_file" "$FLEET_PLUGINS_FALLBACK"; then
     fleet_file="$FLEET_PLUGINS_FALLBACK"
     if cp "$FLEET_PLUGINS_FALLBACK" "$FLEET_PLUGINS" 2>/dev/null; then
       rm -f "$FLEET_PLUGINS_FALLBACK" 2>/dev/null
@@ -406,12 +427,12 @@ else
     else
       log "WARN plugins (fleet): $FLEET_PLUGINS unwritable; list kept at $FLEET_PLUGINS_FALLBACK"
     fi
-    log "plugins (fleet): list fetched to $fleet_file ($(jq -r '.enabledPlugins | length' "$fleet_file") entries)"
+    log "plugins (fleet): list derived from the catalog to $fleet_file ($(jq -r '.enabledPlugins | length' "$fleet_file") entries)"
     install_plugins_from "$fleet_file" fleet
   else
-    rm -f "$FLEET_PLUGINS_FALLBACK" 2>/dev/null
-    log 'WARN plugins (fleet): list fetch failed or empty; no plugins install this build'
+    log 'WARN plugins (fleet): catalog fetch failed or held no plugins; no plugins install this build'
   fi
+  rm -f "$catalog_file" 2>/dev/null
 fi
 
 # Bake the checked-out repo's committed bootstrap (.claude/cloud-bootstrap.sh
diff --git a/components/cloud-environment/setup.test.sh b/components/cloud-environment/setup.test.sh
index 10869616..8cff6ec0 100755
--- a/components/cloud-environment/setup.test.sh
+++ b/components/cloud-environment/setup.test.sh
@@ -67,46 +67,71 @@ grep -q '>"\$STAMP_FALLBACK"' "$script"
 rc=$?
 assert_exit 'setup.sh falls back when the primary stamp write fails' 0 "$rc"
 
-# Fleet plugin list: the settings-shaped file every snapshot installs. It must
-# parse, enable everything it names (a false entry is a per-repo delta, not a
-# fleet decision), keep its keys in byte order so a single entry can be
-# flipped without disturbing the rest, and declare every marketplace its
-# entries name.
-fleet="$root/components/cloud-environment/fleet-plugins.json"
-assert_file_exists 'fleet-plugins.json exists beside setup.sh' "$fleet"
-jq empty "$fleet" 2>/dev/null
+# Fleet plugin list: derived at cache build from the marketplace catalog. An
+# entry set true, or with no defaultEnabled at all, is enabled; false or any
+# non-boolean value leaves it out. The output is settings-shaped and
+# registers the marketplace its entries name, which is what both
+# install_plugins_from here and the repo bootstrap read. Sourced via
+# MELODIC_SETUP_LIBONLY so the apt/dotnet/nvm tracks do not run.
+# Do not `shellcheck source=` this: LIBONLY returns immediately, and following
+# it marks the test bodies below unreachable (SC2317).
+# shellcheck disable=SC1090,SC1091
+MELODIC_SETUP_LIBONLY=1 source "$script"
+cat_tmp="$(mktemp -d)"
+cat >"$cat_tmp/catalog.json" <<'JSON'
+{
+  "name": "melodic-software",
+  "plugins": [
+    { "name": "on-explicit", "defaultEnabled": true },
+    { "name": "off", "defaultEnabled": false },
+    { "name": "off-string", "defaultEnabled": "false" },
+    { "name": "on-default" }
+  ]
+}
+JSON
+fleet_list_from_catalog "$cat_tmp/catalog.json" "$cat_tmp/fleet.json"
+rc=$?
+assert_exit 'fleet list derives from a catalog' 0 "$rc"
+assert_eq 'fleet list enables only entries with defaultEnabled absent or true' \
+  '{"on-default@melodic-software":true,"on-explicit@melodic-software":true}' \
+  "$(jq -cS '.enabledPlugins' "$cat_tmp/fleet.json")"
+assert_eq 'fleet list registers the marketplace its entries name' \
+  'melodic-software melodic-software/claude-code-plugins' \
+  "$(jq -r '.extraKnownMarketplaces | to_entries[] | "\(.key) \(.value.source.repo)"' "$cat_tmp/fleet.json")"
+printf '%s' '{"plugins":[{"name":"off","defaultEnabled":false}]}' >"$cat_tmp/alloff.json"
+fleet_list_from_catalog "$cat_tmp/alloff.json" "$cat_tmp/alloff-fleet.json"
+rc=$?
+assert_exit 'an all-off catalog still yields a fleet list for repo opt-ins' 0 "$rc"
+assert_eq 'an all-off catalog enables no plugins' '{}' \
+  "$(jq -c '.enabledPlugins' "$cat_tmp/alloff-fleet.json")"
+printf '%s' '{"plugins":[]}' >"$cat_tmp/empty.json"
+fleet_list_from_catalog "$cat_tmp/empty.json" "$cat_tmp/none.json"
 rc=$?
-assert_exit 'fleet-plugins.json parses' 0 "$rc"
-assert_eq 'fleet-plugins.json enables every entry it names' \
-  '0' "$(jq -r '[.enabledPlugins // {} | to_entries[] | select(.value != true)] | length' "$fleet")"
-assert_eq 'fleet-plugins.json keys are in byte order' \
-  "$(jq -r '.enabledPlugins | keys_unsorted[]' "$fleet" | LC_ALL=C sort)" \
-  "$(jq -r '.enabledPlugins | keys_unsorted[]' "$fleet")"
-assert_eq 'fleet-plugins.json declares every marketplace its entries name' \
-  '' "$(jq -r '(.extraKnownMarketplaces // {} | keys) as $mps
-    | [.enabledPlugins // {} | keys[] | split("@") | .[1:] | join("@")] | unique
-    | map(select(IN($mps[]) | not)) | .[]' "$fleet")"
+assert_nonzero 'a catalog with no entries yields no fleet list' "$rc"
+assert_eq 'a refused derivation leaves no fleet list file' 'absent' \
+  "$([[ -e "$cat_tmp/none.json" ]] && echo present || echo absent)"
+printf '%s' '{"plugins": ' >"$cat_tmp/broken.json"
+fleet_list_from_catalog "$cat_tmp/broken.json" "$cat_tmp/none.json"
+rc=$?
+assert_nonzero 'an unparsable catalog yields no fleet list' "$rc"
+rm -rf "$cat_tmp"
 
-# Fetch lockstep: the URL setup.sh fetches must name the file this repository
-# publishes, at the same host the README's bootstrap already relies on.
-fleet_url="$(sed -n "s/^FLEET_PLUGINS_URL='\(.*\)'\$/\1/p" "$script")"
-assert_eq 'setup.sh fetches the fleet list from its published path' \
-  'https://raw.githubusercontent.com/melodic-software/standards/main/components/cloud-environment/fleet-plugins.json' \
-  "$fleet_url"
+assert_eq 'setup.sh derives the fleet list from the published catalog' \
+  'https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/.claude-plugin/marketplace.json' \
+  "$(sed -n "s/^FLEET_CATALOG_URL='\(.*\)'\$/\1/p" "$script")"
 fleet_path="$(sed -n "s/^FLEET_PLUGINS='\(.*\)'\$/\1/p" "$script")"
 if [[ -n "$fleet_path" ]]; then
   pass 'setup.sh declares the snapshot path for the fleet list'
 else
   fail 'setup.sh declares the snapshot path for the fleet list' "no FLEET_PLUGINS='...' assignment found"
 fi
-# shellcheck disable=SC2016 # the $ is a literal in the grep pattern
-grep -q '>"\$FLEET_PLUGINS_FALLBACK"\|-o "\$FLEET_PLUGINS_FALLBACK"' "$script"
-rc=$?
-assert_exit 'setup.sh falls back when the snapshot path for the fleet list is unwritable' 0 "$rc"
+# shellcheck disable=SC2016 # the $ is a literal in the needle
+assert_contains 'setup.sh falls back when the snapshot path for the fleet list is unwritable' \
+  "$(cat "$script")" 'fleet_list_from_catalog "$catalog_file" "$FLEET_PLUGINS_FALLBACK"'
 assert_contains 'README documents the fleet list snapshot path' \
   "$(cat "$readme")" "$fleet_path"
-assert_contains 'README documents the fleet list file' \
-  "$(cat "$readme")" 'fleet-plugins.json'
+assert_contains 'README documents the catalog the fleet list derives from' \
+  "$(cat "$readme")" '.claude-plugin/marketplace.json'
 
 # README/script drift guards.
 stamp_path="$(sed -n "s/^STAMP='\(.*\)'\$/\1/p" "$script")"
@@ -182,14 +207,9 @@ fi
 
 # Spawn census for install_plugins_from: two sources must share one
 # marketplace list and one plugin list, the memoization cloud-bootstrap.sh
-# relies on when it reads the fleet list and then the repo overlay. Sourced
-# via MELODIC_SETUP_LIBONLY so the apt/dotnet/nvm tracks do not run.
+# relies on when it reads the fleet list and then the repo overlay.
 # Membership is in-process (no grep -qxF per entry).
 plug_tmp="$(mktemp -d)"
-# Do not `shellcheck source=` this: LIBONLY returns immediately, and following
-# it marks the census body unreachable (SC2317).
-# shellcheck disable=SC1090,SC1091
-MELODIC_SETUP_LIBONLY=1 source "$script"
 mkdir -p "$plug_tmp/bin" "$plug_tmp/counts"
 cat >"$plug_tmp/bin/claude" <<STUB
 #!/usr/bin/env bash
diff --git a/distribution/README.md b/distribution/README.md
index 3e01d4ab..a705ed2e 100644
--- a/distribution/README.md
+++ b/distribution/README.md
@@ -137,64 +137,21 @@ take `--target OWNER/REPO`, and `apply` additionally takes `--target-root DIR`
 for the disposable checkout. The consumer-facing summary of every target
 filter lives in [ESCAPE-HATCHES.md](ESCAPE-HATCHES.md).
 
-### Plugin-catalog drift report
-
-The fleet cloud plugin list,
-[`components/cloud-environment/fleet-plugins.json`](../components/cloud-environment/fleet-plugins.json),
-is the baseline: every cloud snapshot installs it, and each repository's
-checked-in `.claude/settings.json` carries what that repo declares beyond it
-(cloud sessions install the fleet list, then the repo file).
-[`check-plugin-baseline.sh`](check-plugin-baseline.sh) makes divergence
-visible. It is report-only, never an edit, because a repo may diverge on purpose:
-
-```sh
-distribution/check-plugin-baseline.sh                  # every manifest target
-distribution/check-plugin-baseline.sh owner/repo ...   # specific repositories
-distribution/check-plugin-baseline.sh --compare-seed <claude.json>   # dotfiles seed
-distribution/check-plugin-baseline.sh --compare-seed-strict <claude.json>  # gateable
-```
-
-A repository still carrying a full mirrored block reports as matching; one
-that has reduced its block to deltas reports every fleet entry as `missing vs
-baseline`, which is the expected shape during that migration, not drift. The
-`--compare-seed` mode reads a dotfiles data file
-(`claudeSettings.seed.enabledPlugins`) and reports fleet plugins the seed
-never names, fleet plugins the seed opts out of, and seed entries for a fleet
-marketplace that the fleet list lacks; entries for other marketplaces are the
-seed's own. Any of those exits 1. The steady state carries deliberate
-opt-outs, so a gate wants only the first class:
-`--compare-seed-strict` runs the same comparison and prints the same report,
-but exits 3 when the seed is missing a fleet plugin, so a caller keys on an
-exit code rather than on a report line it would have to keep in step by hand.
-Either mode exits 2 on a seed that parses but carries no
-`claudeSettings.seed.enabledPlugins` object, which a comparison would
-otherwise read as an empty seed or as a match.
-
-Fleet mode fetches each target's settings via `gh api`, so it reads private
-repositories with the caller's own auth. Before the per-target diffs it reports
-how the baseline itself compares to each marketplace catalog it declares,
-because measuring every repo against the baseline cannot show the baseline
-falling behind: when a plugin is added to the marketplace and no settings file
-learns about it, every repo reports `matches baseline` while none of them
-installs it, and the gap surfaces only as a slash command that does not
-resolve. Coverage is reported for the baseline alone: a target carrying a
-deliberate subset would otherwise emit that subset as drift on every run. The
-same comparison runs offline for a single pair:
-
-```sh
-distribution/check-plugin-baseline.sh --compare-catalog \
-  <marketplace.json> <settings.json> <marketplace-name>
-```
-
-Each repository also names undeclared catalog plugins in its own cloud
-sessions: `cloud-bootstrap.sh` prints them as an inventory line beside its
-install summary, reading the marketplace clone already on disk.
-
-To propagate a baseline change for a materialized target, edit that repo's file
-under
-`components/claude-settings/targets/` in this repository; sync delivers
-exact bytes. Targets not yet materialized still use ordinary per-repo pull
-requests. The report tells you which entries moved.
+### Cloud plugin baseline
+
+Every cloud snapshot installs each plugin in the melodic-software marketplace
+catalog whose entry leaves `defaultEnabled` unset or sets it `true` (see the
+[cloud-environment component](../components/cloud-environment/README.md#plugin-install)).
+Each repository's checked-in `.claude/settings.json` carries only its deltas
+from that set: `false` to opt out of a plugin, `true` to opt in to an
+off-by-default one. Cloud sessions install the catalog-derived list, then the
+repo file's `true` entries. `cloud-bootstrap.sh` also prints an inventory line
+naming catalog plugins that neither source enables, reading the marketplace
+clone already on disk.
+
+To change a materialized target's deltas, edit that repo's file under
+`components/claude-settings/targets/` in this repository; sync delivers exact
+bytes. Targets not yet materialized still use ordinary per-repo pull requests.
 
 ## Adopting a new repository
 
diff --git a/distribution/check-plugin-baseline.sh b/distribution/check-plugin-baseline.sh
deleted file mode 100755
index 9da53b22..00000000
--- a/distribution/check-plugin-baseline.sh
+++ /dev/null
@@ -1,311 +0,0 @@
-#!/usr/bin/env bash
-# Report-only fleet drift check for the plugin catalog each repo declares.
-#
-# The baseline is the fleet cloud plugin list,
-# components/cloud-environment/fleet-plugins.json — the settings-shaped file
-# every cloud snapshot installs at user scope, so its enabledPlugins set and
-# marketplace declarations are the reference. Each target repository's checked
-# in .claude/settings.json carries what that repo declares beyond the fleet
-# (and, until it drops its mirrored block, the whole fleet again); this script
-# only makes divergence from the baseline visible, it never edits anything. A
-# repo may diverge on purpose — the signal is the diff existing, not the diff
-# being wrong.
-#
-# Usage:
-#   distribution/check-plugin-baseline.sh [owner/repo ...]
-#     No arguments: checks every target listed in sync-manifest.yml, fetching
-#     each repo's .claude/settings.json@HEAD via `gh api` (works for private
-#     repositories with the caller's gh auth).
-#   distribution/check-plugin-baseline.sh --compare <baseline.json> <candidate.json>
-#     Offline single comparison between two settings files (also what the
-#     test exercises).
-#   distribution/check-plugin-baseline.sh --compare-catalog <catalog.json> <settings.json> <marketplace>
-#     Offline coverage of one marketplace catalog by one settings file.
-#   distribution/check-plugin-baseline.sh --compare-seed <seed.json> [baseline.json]
-#     Offline comparison of the fleet list against a dotfiles seed
-#     (.chezmoidata/claude.json, claudeSettings.seed.enabledPlugins): the
-#     personal-machine list and the cloud list are two files on purpose, and
-#     this is what keeps them from drifting apart unnoticed.
-#   distribution/check-plugin-baseline.sh --compare-seed-strict <seed.json> [baseline.json]
-#     The same comparison, with one divergence class raised to its own exit
-#     code: a fleet plugin the seed never names exits 3. Opt-in, so callers of
-#     --compare-seed keep today's semantics; a gate uses this instead of
-#     grepping the report's prose for a message that is free to be reworded.
-#
-# Exit status: 0 always in report mode (drift is a signal, not a failure);
-# the --compare* modes exit 1 when the candidate diverges, 2 on a usage error
-# or a file jq cannot read or whose shape it cannot use, and (strict seed mode
-# only) 3 when the seed is missing a fleet plugin, so callers can script them.
-set -euo pipefail
-
-root="$(git rev-parse --show-toplevel)"
-baseline="$root/components/cloud-environment/fleet-plugins.json"
-
-# compare_settings <baseline.json> <candidate.json> <label>
-# Prints the candidate's divergence from the baseline: enabledPlugins entries
-# missing (in baseline, not candidate), extra (in candidate, not baseline),
-# and marketplace declarations whose name or source differ. Always returns 0
-# (so callers under set -e need no condition context — .shellcheckrc's SC2310);
-# divergence is signaled through the DIVERGED global instead.
-DIVERGED=0
-compare_settings() {
-  local base="$1" cand="$2" label="$3" diverged=0 line
-
-  # One jq pass emits every divergence as a tagged line so the two settings
-  # files are parsed once rather than three times (enabledPlugins missing,
-  # enabledPlugins extra, marketplace keys/sources). compare_catalog already
-  # uses this tagged-row shape.
-  # tr -d '\r' throughout: a Windows jq emits CRLF, and a carried CR corrupts
-  # the reported names (and, in fleet mode, the repo slug handed to gh api).
-  local diff
-  diff=$(jq -r --slurpfile b "$base" '
-    ([$b[0].enabledPlugins // {} | to_entries[] | select(.value == true) | .key]
-     - [.enabledPlugins // {} | to_entries[] | select(.value == true) | .key]
-     | map("missing vs baseline: " + .))
-    + ([.enabledPlugins // {} | to_entries[] | select(.value == true) | .key]
-       - [$b[0].enabledPlugins // {} | to_entries[] | select(.value == true) | .key]
-       | map("beyond baseline: " + .))
-    + ((.extraKnownMarketplaces // {}) as $c
-       | ($b[0].extraKnownMarketplaces // {}) as $bm
-       | (($bm | keys) - ($c | keys) | map("marketplace missing vs baseline: " + .))
-         + (($c | keys) - ($bm | keys) | map("marketplace beyond baseline: " + .))
-         + ([($bm | keys)[] as $k
-             | select(($c[$k] != null) and ($c[$k].source != $bm[$k].source))
-             | "marketplace source differs: " + $k]))
-    | .[]' "$cand" 2>/dev/null | tr -d '\r' || true)
-  while IFS= read -r line; do
-    [[ -n "$line" ]] || continue
-    printf '%s: %s\n' "$label" "$line"
-    diverged=1
-  done <<EOF
-$diff
-EOF
-
-  if [[ "$diverged" -eq 0 ]]; then
-    printf '%s: matches baseline\n' "$label"
-  else
-    DIVERGED=1
-  fi
-  return 0
-}
-
-# compare_catalog <catalog.json> <settings.json> <marketplace> <label>
-# Prints what a settings file does not say about a marketplace's catalog:
-# plugins the catalog carries that the file never enables, and entries it
-# enables that the catalog no longer offers. This is the check the per-repo
-# comparison structurally cannot make — every repo is measured against the
-# baseline, so a baseline trailing its catalog reports the whole fleet as
-# matching while none of it declares the newer plugins, and the gap surfaces
-# only when someone types a slash command that does not resolve. Always
-# returns 0 (.shellcheckrc's SC2310); divergence signals through DIVERGED.
-compare_catalog() {
-  local catalog="$1" settings="$2" mp="$3" label="$4" diverged=0 line
-
-  # One jq pass emits both directions, each line tagged, so the catalog is
-  # read and the marketplace's entries projected once rather than twice.
-  # The "@<marketplace>" suffix is stripped by length rather than by sub():
-  # the name is interpolated text, and sub() would read any regex
-  # metacharacter in it as syntax.
-  local diff
-  diff=$(jq -r --arg mp "$mp" --slurpfile c "$catalog" '
-    [$c[0].plugins[]?.name] as $names
-    | [.enabledPlugins // {} | to_entries[] | select(.value == true) | .key
-       | select(endswith("@" + $mp)) | .[:length - ($mp | length) - 1]] as $declared
-    | (($names - $declared) | map("in catalog, not declared: " + . + "@" + $mp))
-      + (($declared - $names) | map("declared, not in catalog: " + . + "@" + $mp))
-    | .[]' "$settings" 2>/dev/null | tr -d '\r' || true)
-
-  while IFS= read -r line; do
-    [[ -n "$line" ]] || continue
-    printf '%s: %s\n' "$label" "$line"
-    diverged=1
-  done <<EOF
-$diff
-EOF
-
-  if [[ "$diverged" -eq 0 ]]; then
-    printf '%s: covers the catalog\n' "$label"
-  else
-    DIVERGED=1
-  fi
-  return 0
-}
-
-# compare_seed <baseline.json> <seed.json> <label>
-# Compares the fleet list with a dotfiles seed (.chezmoidata/claude.json),
-# restricted to the marketplaces the fleet list declares: a fleet plugin the
-# seed never names, a fleet plugin the seed sets to false (a personal opt-out,
-# reported as such, not as drift), and a seed entry set to true for a fleet
-# marketplace that the fleet list does not carry. A seed false for a plugin
-# outside the fleet list is an opt-out of nothing and is not reported.
-# Entries for other marketplaces are the seed's own business. Always returns
-# 0 (.shellcheckrc's SC2310); divergence signals through DIVERGED, and the
-# one class a gate acts on — a fleet plugin the seed never names — through
-# SEED_MISSING. That flag is why the message prefix is a variable handed to jq
-# rather than a literal inside the filter: the text a caller would otherwise
-# grep for is defined once, three lines from the only match against it, so
-# rewording it cannot silently turn a gate green.
-SEED_MISSING=0
-compare_seed() {
-  local base="$1" seed="$2" label="$3" diverged=0 line
-  local missing_prefix='in fleet list, not in seed: '
-
-  local diff
-  diff=$(jq -r --slurpfile b "$base" --arg missing "$missing_prefix" '
-    ($b[0].extraKnownMarketplaces // {} | keys) as $mps
-    | ($b[0].enabledPlugins // {} | to_entries | map(select(.value == true) | .key)) as $fleet
-    | (.claudeSettings.seed.enabledPlugins // {}) as $seed
-    | ($seed | to_entries
-        | map(select(.key | split("@") | .[1:] | join("@") | IN($mps[])))) as $scoped
-    | ($scoped | map(.key)) as $seed_keys
-    | ($scoped | map(select(.value == true) | .key)) as $seed_enabled
-    | ($scoped | map(select(.value == false) | .key)) as $opted_out
-    | (($fleet - $seed_keys) | map($missing + .))
-      + (($fleet - ($fleet - $opted_out)) | map("in fleet list, seed opts out: " + .))
-      + (($seed_enabled - $fleet) | map("in seed, not in fleet list: " + .))
-    | .[]' "$seed" 2>/dev/null | tr -d '\r' || true)
-
-  while IFS= read -r line; do
-    [[ -n "$line" ]] || continue
-    printf '%s: %s\n' "$label" "$line"
-    diverged=1
-    if [[ "$line" == "$missing_prefix"* ]]; then
-      SEED_MISSING=1
-    fi
-  done <<EOF
-$diff
-EOF
-
-  if [[ "$diverged" -eq 0 ]]; then
-    printf '%s: matches the fleet list\n' "$label"
-  else
-    DIVERGED=1
-  fi
-  return 0
-}
-
-# Every mode judges with jq; a missing jq or an unparsable settings file must
-# be a loud usage error, never an empty diff read as "matches baseline".
-command -v jq >/dev/null 2>&1 || {
-  echo 'check-plugin-baseline: jq is required' >&2
-  exit 2
-}
-
-# require_parses <file> <label> — refuse to compare what jq cannot read.
-require_parses() {
-  jq empty "$1" 2>/dev/null || {
-    printf 'check-plugin-baseline: %s is not valid JSON: %s\n' "$2" "$1" >&2
-    exit 2
-  }
-}
-
-# require_seed_shape <file> — a file can parse as JSON and still carry no
-# usable plugin list. When claudeSettings.seed.enabledPlugins is absent, or is
-# a scalar, or the root is an array, the comparison either reads the seed as
-# empty (reporting the whole fleet as missing) or dies inside jq, where the
-# filter's `2>/dev/null || true` swallows the error and an empty diff reports
-# "matches the fleet list". Both are wrong about a broken file, so refuse it
-# with the same loud code an unparsable one gets.
-require_seed_shape() {
-  jq -e '.claudeSettings?.seed?.enabledPlugins? // null | type == "object"' \
-    "$1" >/dev/null 2>&1 || {
-    printf 'check-plugin-baseline: %s has no claudeSettings.seed.enabledPlugins object\n' "$1" >&2
-    exit 2
-  }
-}
-
-if [[ "${1:-}" == "--compare-catalog" ]]; then
-  [[ $# -eq 4 ]] || {
-    echo 'usage: check-plugin-baseline.sh --compare-catalog <catalog.json> <settings.json> <marketplace>' >&2
-    exit 2
-  }
-  require_parses "$2" 'catalog'
-  require_parses "$3" 'settings'
-  compare_catalog "$2" "$3" "$4" "$(basename "$3")"
-  exit "$DIVERGED"
-fi
-
-if [[ "${1:-}" == "--compare-seed" || "${1:-}" == "--compare-seed-strict" ]]; then
-  [[ $# -eq 2 || $# -eq 3 ]] || {
-    echo 'usage: check-plugin-baseline.sh --compare-seed[-strict] <seed.json> [baseline.json]' >&2
-    exit 2
-  }
-  seed_base="${3:-$baseline}"
-  require_parses "$2" 'seed'
-  require_seed_shape "$2"
-  require_parses "$seed_base" 'baseline'
-  compare_seed "$seed_base" "$2" "$(basename "$2")"
-  if [[ "$1" == "--compare-seed-strict" && "$SEED_MISSING" -eq 1 ]]; then
-    exit 3
-  fi
-  exit "$DIVERGED"
-fi
-
-if [[ "${1:-}" == "--compare" ]]; then
-  [[ $# -eq 3 ]] || {
-    echo 'usage: check-plugin-baseline.sh --compare <baseline.json> <candidate.json>' >&2
-    exit 2
-  }
-  require_parses "$2" 'baseline'
-  require_parses "$3" 'candidate'
-  compare_settings "$2" "$3" "$(basename "$3")"
-  exit "$DIVERGED"
-fi
-
-command -v gh >/dev/null 2>&1 || {
-  echo 'check-plugin-baseline: gh CLI is required for fleet mode' >&2
-  exit 2
-}
-
-require_parses "$baseline" 'baseline'
-
-repos="$*"
-if [[ -z "$repos" ]]; then
-  # Target enumeration belongs to the engine, not to a second YAML parser:
-  # `matrix` is the same primitive the sync workflow consumes. The engine
-  # rejects absolute paths, so run it from the repo root with relative ones.
-  repos=$(cd "$root" && bash distribution/sync-manifest.sh matrix \
-    --source-root . --manifest distribution/sync-manifest.yml |
-    jq -r '.include[].repo' | tr -d '\r')
-fi
-
-tmp="$(mktemp -d)"
-trap 'rm -rf "$tmp"' EXIT
-
-# Catalog coverage first, and for the baseline only: it is the reference every
-# per-repo diff below is taken against, so a baseline that has fallen behind
-# its marketplace makes the whole fleet report "matches baseline" while no repo
-# declares the newer plugins. Per-repo catalog coverage is deliberately not
-# reported — a target that carries a deliberate subset (see the manifest's
-# per-target settings components) would emit that subset as drift on every run.
-# Report-only, like the rest of this script: a plugin left undeclared on
-# purpose is a decision, and the signal is the gap existing, not being wrong.
-mps=$(jq -r '(.extraKnownMarketplaces // {}) | to_entries[]
-  | select(.value.source.source == "github" and (.value.source.repo // "") != "")
-  | [.key, .value.source.repo] | @tsv' "$baseline" 2>/dev/null | tr -d '\r' || true)
-while IFS=$'\t' read -r mp_name mp_repo; do
-  [[ -n "$mp_name" ]] || continue
-  if gh api -H 'Accept: application/vnd.github.raw+json' \
-    "repos/$mp_repo/contents/.claude-plugin/marketplace.json" >"$tmp/catalog.json" 2>/dev/null &&
-    jq empty "$tmp/catalog.json" 2>/dev/null; then
-    compare_catalog "$tmp/catalog.json" "$baseline" "$mp_name" "baseline vs $mp_name"
-  else
-    printf 'baseline vs %s: no readable catalog at %s\n' "$mp_name" "$mp_repo"
-  fi
-done <<EOF
-$mps
-EOF
-
-for repo in $repos; do
-  # The raw media type returns the file bytes directly — no base64 step, whose
-  # decode flag differs between GNU (-d) and BSD/macOS (-D).
-  if gh api -H 'Accept: application/vnd.github.raw+json' \
-    "repos/$repo/contents/.claude/settings.json" >"$tmp/candidate.json" 2>/dev/null &&
-    jq empty "$tmp/candidate.json" 2>/dev/null; then
-    compare_settings "$baseline" "$tmp/candidate.json" "$repo"
-  else
-    printf '%s: no readable .claude/settings.json (repo declares nothing)\n' "$repo"
-  fi
-done
-
-exit 0
diff --git a/distribution/check-plugin-baseline.test.sh b/distribution/check-plugin-baseline.test.sh
deleted file mode 100755
index bada08fa..00000000
--- a/distribution/check-plugin-baseline.test.sh
+++ /dev/null
@@ -1,359 +0,0 @@
-#!/usr/bin/env bash
-# Tests check-plugin-baseline.sh's four offline comparison modes and the exit
-# code each one contracts for. Report lines carry the label of the file being
-# judged in every mode.
-#
-#   --compare <baseline> <candidate>
-#     0 identical settings; 1 a missing/extra enabledPlugins entry, a
-#     candidate-only marketplace or a diverging marketplace source; 2 an
-#     unparsable candidate, which must never read as an empty diff.
-#   --compare-catalog <catalog> <settings> <marketplace>
-#     0 the settings cover the catalog; 1 a catalog plugin the settings never
-#     enable or a declaration the catalog dropped; 2 an unparsable catalog.
-#     Another marketplace's entries are out of scope, and the marketplace name
-#     is stripped as a literal suffix, not a pattern.
-#   --compare-seed <seed> [baseline]
-#     0 the seed carries every fleet entry; 1 a fleet plugin the seed opts out
-#     of or names beyond the fleet list; 2 an unparsable seed, or one whose
-#     shape require_seed_shape rejects — a missing, scalar or non-object
-#     claudeSettings.seed.enabledPlugins, or an array root.
-#   --compare-seed-strict <seed> [baseline]
-#     The same comparison with one class raised: 3 when a fleet plugin is
-#     absent from the seed. Opt-outs and seed-only entries stay 1, a matching
-#     seed stays 0, a broken seed stays 2, and plain --compare-seed keeps
-#     reporting the same gap as 1.
-#
-# Three non-mode checks ride along: the script parses under `bash -n`,
-# --compare batches its structural jq into one pass plus two parse checks, and
-# the fleet list the baseline points at exists and is what the script reads.
-set -uo pipefail
-root="$(git rev-parse --show-toplevel)"
-# shellcheck source=harness/shell/lib.sh
-source "$root/harness/shell/lib.sh"
-
-script="$root/distribution/check-plugin-baseline.sh"
-
-bash -n "$script" 2>/dev/null
-rc=$?
-assert_exit 'check-plugin-baseline.sh parses (bash -n)' 0 "$rc"
-
-tmp="$(mktemp -d)"
-trap 'rm -rf "$tmp"' EXIT
-
-cat >"$tmp/baseline.json" <<'JSON'
-{
-  "extraKnownMarketplaces": {
-    "melodic-software": {
-      "source": { "source": "github", "repo": "melodic-software/claude-code-plugins" }
-    }
-  },
-  "enabledPlugins": {
-    "alpha@melodic-software": true,
-    "beta@melodic-software": true,
-    "gamma@melodic-software": false
-  }
-}
-JSON
-
-cp "$tmp/baseline.json" "$tmp/same.json"
-out="$(bash "$script" --compare "$tmp/baseline.json" "$tmp/same.json")"
-rc=$?
-assert_exit 'identical settings exit 0' 0 "$rc"
-assert_contains 'identical settings report a match' "$out" 'matches baseline'
-
-# Spawn census: --compare used to run three jq filters over the same pair
-# (missing plugins, extra plugins, marketplace diffs). One tagged pass is
-# enough. require_parses still calls jq empty once per file.
-mkdir -p "$tmp/jq-bin" "$tmp/jq-count"
-cat >"$tmp/jq-bin/jq" <<'SH'
-#!/usr/bin/env bash
-COUNT_DIR="${COUNT_DIR:?}"
-echo $(($(cat "$COUNT_DIR/jq" 2>/dev/null || echo 0) + 1)) >"$COUNT_DIR/jq"
-exec "$REAL_JQ" "$@"
-SH
-chmod +x "$tmp/jq-bin/jq"
-: >"$tmp/jq-count/jq"
-real_jq="$(command -v jq)"
-COUNT_DIR="$tmp/jq-count" REAL_JQ="$real_jq" PATH="$tmp/jq-bin:$PATH" \
-  bash "$script" --compare "$tmp/baseline.json" "$tmp/same.json" >/dev/null
-assert_eq '--compare batches structural jq into one pass plus two parse checks' '3' \
-  "$(cat "$tmp/jq-count/jq")"
-
-cat >"$tmp/drift.json" <<'JSON'
-{
-  "extraKnownMarketplaces": {
-    "melodic-software": {
-      "source": { "source": "github", "repo": "someone-else/claude-code-plugins" }
-    },
-    "third-party": {
-      "source": { "source": "github", "repo": "vendor/marketplace" }
-    }
-  },
-  "enabledPlugins": {
-    "alpha@melodic-software": true,
-    "gamma@melodic-software": true,
-    "delta@third-party": true
-  }
-}
-JSON
-
-out="$(bash "$script" --compare "$tmp/baseline.json" "$tmp/drift.json")"
-rc=$?
-assert_exit 'diverging settings exit 1' 1 "$rc"
-assert_contains 'a baseline-enabled plugin absent from the candidate is reported' \
-  "$out" 'missing vs baseline: beta@melodic-software'
-assert_contains 'a candidate-only enabled plugin is reported' \
-  "$out" 'beyond baseline: delta@third-party'
-assert_contains 'a baseline-disabled plugin enabled by the candidate is reported' \
-  "$out" 'beyond baseline: gamma@melodic-software'
-assert_contains 'a candidate-only marketplace is reported' \
-  "$out" 'marketplace beyond baseline: third-party'
-assert_contains 'a diverging marketplace source is reported' \
-  "$out" 'marketplace source differs: melodic-software'
-assert_contains 'report lines carry the candidate label' \
-  "$out" 'drift.json:'
-
-# An unparsable candidate must be a loud usage error, never an empty diff
-# read as "matches baseline".
-printf 'not json' >"$tmp/broken.json"
-out="$(bash "$script" --compare "$tmp/baseline.json" "$tmp/broken.json" 2>&1)"
-rc=$?
-assert_exit 'malformed candidate exits 2' 2 "$rc"
-assert_contains 'malformed candidate is named' "$out" 'not valid JSON'
-
-# --- catalog coverage (--compare-catalog) -----------------------------------
-# The blind spot the per-repo comparison cannot see: when the baseline itself
-# trails the marketplace, every repo still reports "matches baseline" while
-# none of them declares the newer plugins.
-cat >"$tmp/catalog.json" <<'JSON'
-{
-  "plugins": [
-    { "name": "alpha", "source": "./plugins/alpha" },
-    { "name": "beta", "source": "./plugins/beta" },
-    { "name": "gamma", "source": "./plugins/gamma" },
-    { "name": "newcomer", "source": "./plugins/newcomer" }
-  ]
-}
-JSON
-
-out="$(bash "$script" --compare-catalog "$tmp/catalog.json" "$tmp/baseline.json" melodic-software)"
-rc=$?
-assert_exit 'a baseline trailing the catalog exits 1' 1 "$rc"
-assert_contains 'a catalog plugin the baseline never enables is reported' \
-  "$out" 'in catalog, not declared: newcomer@melodic-software'
-assert_contains 'a catalog plugin the baseline disables is reported' \
-  "$out" 'in catalog, not declared: gamma@melodic-software'
-assert_not_contains 'an enabled plugin present in the catalog is not reported' \
-  "$out" 'alpha@melodic-software'
-assert_contains 'catalog report lines carry the settings label' \
-  "$out" 'baseline.json:'
-
-# Entries for another marketplace are out of this catalog's scope: reporting
-# them would make every third-party plugin look retired.
-cat >"$tmp/covering.json" <<'JSON'
-{
-  "enabledPlugins": {
-    "alpha@melodic-software": true,
-    "beta@melodic-software": true,
-    "gamma@melodic-software": true,
-    "newcomer@melodic-software": true,
-    "delta@third-party": true
-  }
-}
-JSON
-
-out="$(bash "$script" --compare-catalog "$tmp/catalog.json" "$tmp/covering.json" melodic-software)"
-rc=$?
-assert_exit 'full catalog coverage exits 0' 0 "$rc"
-assert_contains 'full coverage reports a match' "$out" 'covers the catalog'
-assert_not_contains 'another marketplace is out of scope' "$out" 'delta@third-party'
-
-# A plugin dropped from the catalog leaves a declaration installing nothing.
-cat >"$tmp/retired.json" <<'JSON'
-{
-  "enabledPlugins": {
-    "alpha@melodic-software": true,
-    "beta@melodic-software": true,
-    "gamma@melodic-software": true,
-    "newcomer@melodic-software": true,
-    "removed@melodic-software": true
-  }
-}
-JSON
-
-out="$(bash "$script" --compare-catalog "$tmp/catalog.json" "$tmp/retired.json" melodic-software)"
-rc=$?
-assert_exit 'a declaration the catalog dropped exits 1' 1 "$rc"
-assert_contains 'a plugin no longer in the catalog is reported' \
-  "$out" 'declared, not in catalog: removed@melodic-software'
-
-# A marketplace name is interpolated text, not a pattern: a regex
-# metacharacter in it must strip as a literal suffix.
-cat >"$tmp/dotted.json" <<'JSON'
-{
-  "enabledPlugins": {
-    "alpha@my.market": true
-  }
-}
-JSON
-
-cat >"$tmp/dotted-catalog.json" <<'JSON'
-{ "plugins": [ { "name": "alpha", "source": "./plugins/alpha" } ] }
-JSON
-
-out="$(bash "$script" --compare-catalog "$tmp/dotted-catalog.json" "$tmp/dotted.json" 'my.market')"
-rc=$?
-assert_exit 'a marketplace name with a regex metacharacter exits 0' 0 "$rc"
-assert_contains 'the metacharacter name matches literally' "$out" 'covers the catalog'
-
-# An unreadable catalog must be a loud usage error, never an empty diff read
-# as "covers the catalog".
-out="$(bash "$script" --compare-catalog "$tmp/broken.json" "$tmp/baseline.json" melodic-software 2>&1)"
-rc=$?
-assert_exit 'malformed catalog exits 2' 2 "$rc"
-assert_contains 'malformed catalog is named' "$out" 'not valid JSON'
-
-# --- fleet baseline file -----------------------------------------------------
-# Fleet mode's baseline is the cloud plugin list the cloud-environment
-# component installs, not this repository's own settings; it must exist and
-# parse, or every fleet run would be a usage error.
-fleet="$root/components/cloud-environment/fleet-plugins.json"
-assert_file_exists 'the fleet list the baseline points at exists' "$fleet"
-grep -q 'components/cloud-environment/fleet-plugins.json' "$script"
-rc=$?
-assert_exit 'check-plugin-baseline.sh takes its baseline from the fleet list' 0 "$rc"
-
-# --- dotfiles seed comparison (--compare-seed) ------------------------------
-# The personal-machine seed and the cloud list are two files on purpose; this
-# mode is what keeps them from drifting apart unnoticed. Only the fleet's own
-# marketplaces are in scope, and a seed false is reported as an opt-out, not
-# as a missing entry.
-cat >"$tmp/seed.json" <<'JSON'
-{
-  "claudeSettings": {
-    "seed": {
-      "enabledPlugins": {
-        "alpha@melodic-software": true,
-        "beta@melodic-software": false,
-        "delta@third-party": true,
-        "epsilon@melodic-software": true,
-        "zeta@melodic-software": false
-      }
-    }
-  }
-}
-JSON
-out="$(bash "$script" --compare-seed "$tmp/seed.json" "$tmp/baseline.json")"
-rc=$?
-assert_exit 'a diverging seed exits 1' 1 "$rc"
-assert_contains 'a fleet plugin the seed opts out of is reported as an opt-out' \
-  "$out" 'in fleet list, seed opts out: beta@melodic-software'
-assert_contains 'a seed entry for a fleet marketplace the fleet lacks is reported' \
-  "$out" 'in seed, not in fleet list: epsilon@melodic-software'
-assert_not_contains 'a seed opt-out of a plugin outside the fleet list is not a gap' \
-  "$out" 'zeta@melodic-software'
-assert_not_contains 'a seed entry for another marketplace is out of scope' \
-  "$out" 'delta@third-party'
-assert_not_contains 'a fleet-disabled entry is not demanded of the seed' \
-  "$out" 'gamma@melodic-software'
-assert_contains 'seed report lines carry the seed label' "$out" 'seed.json:'
-
-cat >"$tmp/seed-match.json" <<'JSON'
-{
-  "claudeSettings": {
-    "seed": {
-      "enabledPlugins": {
-        "alpha@melodic-software": true,
-        "beta@melodic-software": true,
-        "delta@third-party": false
-      }
-    }
-  }
-}
-JSON
-out="$(bash "$script" --compare-seed "$tmp/seed-match.json" "$tmp/baseline.json")"
-rc=$?
-assert_exit 'a seed carrying every fleet entry exits 0' 0 "$rc"
-assert_contains 'a matching seed reports a match' "$out" 'matches the fleet list'
-
-out="$(bash "$script" --compare-seed "$tmp/broken.json" "$tmp/baseline.json" 2>&1)"
-rc=$?
-assert_exit 'malformed seed exits 2' 2 "$rc"
-assert_contains 'malformed seed is named' "$out" 'not valid JSON'
-
-# A seed that parses can still carry no usable plugin list. Reading one as an
-# empty seed reports the whole fleet as missing; a structural jq error inside
-# compare_seed is swallowed and reports a match. Both are wrong about a broken
-# file, so the shape is checked before the comparison and exits 2 like any
-# other unreadable input.
-cat >"$tmp/seed-scalar.json" <<'JSON'
-{ "claudeSettings": { "seed": { "enabledPlugins": "oops" } } }
-JSON
-out="$(bash "$script" --compare-seed "$tmp/seed-scalar.json" "$tmp/baseline.json" 2>&1)"
-rc=$?
-assert_exit 'a seed whose enabledPlugins is a scalar exits 2' 2 "$rc"
-assert_contains 'a scalar enabledPlugins is named' \
-  "$out" 'no claudeSettings.seed.enabledPlugins object'
-assert_not_contains 'a scalar enabledPlugins never reports a match' \
-  "$out" 'matches the fleet list'
-
-cat >"$tmp/seed-no-key.json" <<'JSON'
-{ "claudeSettings": { "seed": {} } }
-JSON
-out="$(bash "$script" --compare-seed "$tmp/seed-no-key.json" "$tmp/baseline.json" 2>&1)"
-rc=$?
-assert_exit 'a seed with no enabledPlugins key exits 2' 2 "$rc"
-
-printf '[]' >"$tmp/seed-array.json"
-out="$(bash "$script" --compare-seed "$tmp/seed-array.json" "$tmp/baseline.json" 2>&1)"
-rc=$?
-assert_exit 'a seed whose root is an array exits 2' 2 "$rc"
-assert_not_contains 'an array root never reports a match' "$out" 'matches the fleet list'
-
-# --- strict seed comparison (--compare-seed-strict) -------------------------
-# The CI gate acts on exactly one divergence class — a fleet plugin the seed
-# never names — and must not decide that by grepping this script's prose. The
-# strict mode raises that class to exit 3; the message below is asserted in
-# the same breath, so rewording it without moving the flag trips here first.
-cat >"$tmp/seed-gap.json" <<'JSON'
-{
-  "claudeSettings": {
-    "seed": {
-      "enabledPlugins": {
-        "alpha@melodic-software": true,
-        "delta@third-party": true
-      }
-    }
-  }
-}
-JSON
-out="$(bash "$script" --compare-seed-strict "$tmp/seed-gap.json" "$tmp/baseline.json")"
-rc=$?
-assert_exit 'a seed missing a fleet plugin exits 3 under --compare-seed-strict' 3 "$rc"
-assert_contains 'the missing fleet plugin is still reported in the log' \
-  "$out" 'in fleet list, not in seed: beta@melodic-software'
-
-# Existing callers of --compare-seed keep today's semantics: the same gap is
-# ordinary divergence, exit 1.
-out="$(bash "$script" --compare-seed "$tmp/seed-gap.json" "$tmp/baseline.json")"
-rc=$?
-assert_exit 'the same gap stays exit 1 under plain --compare-seed' 1 "$rc"
-
-# Only that class raises the code: a seed carrying every fleet key but opting
-# out of one still diverges (exit 1), and strict mode must not escalate it,
-# because the real seed's steady state is exactly this shape.
-out="$(bash "$script" --compare-seed-strict "$tmp/seed.json" "$tmp/baseline.json")"
-rc=$?
-assert_exit 'opt-outs and seed-only entries stay exit 1 under --compare-seed-strict' 1 "$rc"
-assert_contains 'the opt-out is still reported' \
-  "$out" 'in fleet list, seed opts out: beta@melodic-software'
-
-out="$(bash "$script" --compare-seed-strict "$tmp/seed-match.json" "$tmp/baseline.json")"
-rc=$?
-assert_exit 'a matching seed exits 0 under --compare-seed-strict' 0 "$rc"
-
-out="$(bash "$script" --compare-seed-strict "$tmp/seed-scalar.json" "$tmp/baseline.json" 2>&1)"
-rc=$?
-assert_exit 'a structurally broken seed exits 2 under --compare-seed-strict' 2 "$rc"
-
-[[ $FAILED -eq 0 ]] || exit 1