fix(homecore-plugins): use patched Wasmtime runtime

v2/crates/homecore-plugins/Cargo.toml

@@ -5,9 +5,7 @@
 #   - PluginRuntime trait + InProcessRuntime (native Rust, first-party plugins)
 #   - PluginRegistry (load / unload / list)
 #
-# P2 will add the `wasmtime` feature (gated below, default-off) for the real
-# Wasmtime JIT sandbox. wasm3 interpretation mode lands behind `--features wasm3`
-# in P3 for constrained-hardware targets.
+# The `wasmtime` feature gates the audited server-side WebAssembly sandbox.
 
 [package]
 name = "homecore-plugins"
@@ -27,8 +25,6 @@ default = []
 # P2: real Wasmtime JIT sandbox (Cranelift; ~15 MB binary delta on Pi 5).
 # Do not enable in production until the host ABI is frozen (ADR-128 §8 risk).
 wasmtime = ["dep:wasmtime"]
-# P3: wasm3 interpretation mode for constrained hardware (~50 kB).
-wasm3 = ["dep:wasm3"]
 
 [dependencies]
 # HOMECORE state machine — local path (ADR-127).
@@ -60,13 +56,11 @@ hex = "0.4"
 base64 = "0.22"
 
 # Optional Wasmtime runtime (P2, default-off — 30 MB dep).
-# Bumped from 25.0.3 → 42 to remediate RUSTSEC-2026-0095 and RUSTSEC-2026-0096
-# (Cranelift/Winch sandbox-escape CVEs, CVSS 9.0 — iter-11 security sprint HC-03/04).
-# v40 is the newest line compatible with HOMECORE's Rust 1.89 MSRV.
-wasmtime = { version = "40.0.4", optional = true }
+# Upgraded from 25.0.3 to remediate the Cranelift/Winch sandbox advisories;
+# 40.0.4 was subsequently replaced because of RUSTSEC-2026-0114.
+# Patched 36.x retains HOMECORE's Rust 1.89 MSRV.
+wasmtime = { version = "36.0.8", optional = true }
 
-# Optional wasm3 interpretation runtime (P3, default-off).
-wasm3 = { version = "0.3", optional = true }
 
 [dev-dependencies]
 tokio = { version = "1", features = ["sync", "rt", "rt-multi-thread", "time", "macros", "test-util"] }

v2/crates/homecore-plugins/src/lib.rs

@@ -14,14 +14,12 @@
 //! - [`registry`] — `PluginRegistry<R>`: load / unload / list plugins.
 //! - [`error`] — `PluginError` typed error enum.
 //!
-//! ## What's NOT here yet (deferred)
+//! ## Runtime scope
 //!
-//! - `WasmtimeRuntime` (P2, `--features wasmtime`): Cranelift JIT sandbox on
-//!   Pi 5 / x86_64. The runtime-selection question (Wasmtime vs wasm3) is still
-//!   open (ADR-128 §8) and will be resolved in Q2 before P2 begins.
-//! - Host ABI wiring: `hc_state_get`, `hc_state_set`, `hc_event_fire`, etc.
-//!   (P2 — requires ADR-127 state machine API freeze first).
-//! - Config entry lifecycle + hot-load (P3).
+//! - `WasmtimeRuntime` (`--features wasmtime`) provides the Cranelift sandbox.
+//! - Native Rust plugins are compiled into the server; arbitrary native
+//!   dynamic libraries are not loaded.
+//! - The host ABI is deliberately narrow and resource-bounded.
 //!
 //! ## Now enforced (ADR-162)
 //!
@@ -38,7 +36,6 @@
 //! | Feature | Default | Description |
 //! |---------|---------|-------------|
 //! | `wasmtime` | off | Wasmtime Cranelift JIT runtime (P2) |
-//! | `wasm3` | off | wasm3 interpreter runtime for constrained hardware (P3) |
 
 pub mod error;
 pub mod discovery;

v2/crates/homecore-plugins/src/runtime.rs

@@ -1,8 +1,8 @@
 //! `PluginRuntime` trait + `InProcessRuntime` (P1).
 //!
 //! Abstracts over Wasmtime (P2, `--features wasmtime`) and native in-process
-//! Rust plugins (P1, always-on). A third backend, wasm3 (P3), will provide
-//! interpretation mode for constrained hardware.
+//! Rust plugins (P1, always-on). Constrained builds use the compiled-in native
+//! registry rather than an unaudited interpreter backend.
 //!
 //! # Architecture
 //!
@@ -12,7 +12,6 @@
 //!       ▼
 //! PluginRuntime  ◄─── InProcessRuntime  (P1, native Rust, <1 µs call)
 //!                ◄─── WasmtimeRuntime   (P2, Cranelift JIT, ~5 ms cold start)
-//!                ◄─── Wasm3Runtime      (P3, interpreter, ~50 kB, Pi Zero)
 //! ```
 
 use std::sync::Arc;