Security model

• No plugin can revert a pool operation. Each frame is wrapped in try/catch inside the runtime, and every runtime call is wrapped again in the hypervisor. Degradation always ends at “no plugins ran”.
• No delta permissions. The hypervisor does not take any *ReturnDelta hook permission, so plugins observe, meter, record and price — they can never move a swapper's funds. That is what makes registration safe to leave permissionless.
• Memory is namespaced by scope, not arguments. The runtime opens a scope naming the plugin; only that address may write, only into its own namespace, only until the scope closes.
• Fee bids are clamped at the hypervisor to the pool's band, so no plugin can set a confiscatory fee.
• Slashing burns. Nobody profits from another plugin's failure.
• Wiring is explicit. Contracts trust only addresses bound in the SystemDirectory under a named key; re-binding is a governance action.

Toolchain: solc 0.8.37, EVM osaka. Hook address flags 0x3fc0 — all eight callbacks, nothing else.