docs: 35 plugins / 471 tests; AGENT.md sheds the last appPaths-era advice

Author: melvincarvalho

AGENT.md

@@ -11,7 +11,7 @@ Out-of-tree plugins for [JavaScript Solid
 Server](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer),
 built on its **#206 loader** (`createServer({ plugins })`, JSS ≥ 0.0.215).
 It is an *experiment*: prove the plugin api by using it, and treat every
-wall you hit as a finding, not a blocker. **33 plugins, 386 tests today.**
+wall you hit as a finding, not a blocker. **35 plugins, 471 tests today.**
 
 ### The one rule that makes the experiment valid
 
@@ -132,7 +132,8 @@ Full ranking in `NOTES.md`. The ones you'll hit:
    const port = await probePort();
    const base = `http://127.0.0.1:${port}`;
    const jss2 = await startJss({ port, idp: true,
-     appPaths: ['/api'],                                       // only if you own fixed roots
+     // fixed roots outside your prefix: api.reservePath in activate (#602),
+     // NOT appPaths — see the mastodon/bluesky/activitypub/matrix retrofits
      plugins: [{ ...entry, config: { baseUrl: base, loopbackUrl: base } }] });
    // ... drive real HTTP/WS against jss.base / jss.wsBase ...  then: await jss.close();
    ```
@@ -197,7 +198,7 @@ Full ranking in `NOTES.md`. The ones you'll hit:
 ## Current state
 
 35 plugins (7 ports + 28 features) + the two-server `federation-demo/`,
-456 tests, all green (`npm test`).
+471 tests, all green (`npm test`).
 A four-axis security review ([SECURITY.md](./SECURITY.md)) hardened the
 inbound-federation and query surfaces; the WAC-deferral pattern held.
 `compose.test.js` runs every plugin on a single server from pure config.

ISSUES.md

@@ -119,7 +119,7 @@ shipped upstream** (the loader plus four seams and the id fix in JSS
 0.0.218/0.0.219, each consumed here), **2 more plugin-able with no
 blocker**, **4 clusters blocked on a named seam** (each with a
 proof-of-need consumer), the rest core-by-nature or product-scale.
-**35 plugins total, 456 tests** (plus the two-server `federation-demo/`
+**35 plugins total, 471 tests** (plus the two-server `federation-demo/`
 scenario). The plugin api reaches most of the backlog today; ranked by
 demand, the seams that would unlock the most next are `api.authorize`
 (4 consumers, 3 hard-blocked) and `api.events` (7 consumers — matrix

NEXT.md

@@ -8,7 +8,7 @@ plugin), `NOTES.md` (the findings/seams — the real deliverable), and
 
 ## Where things stand
 
-- **35 plugins, 456 tests, all green** (`npm test`; the three
+- **35 plugins, 471 tests, all green** (`npm test`; the three
   `notifications/` fs.watch tests need a free inotify instance — see
   Footguns), all pushed to
   `github.com/JavaScriptSolidServer/plugins` (branch `gh-pages`).

README.md

@@ -99,7 +99,7 @@ Plus one directory that is a scenario, not a plugin:
 over loopback (webfinger discovery, a cross-origin Follow, plugin-signed
 delivery); run `node federation-demo/demo.js` for the narrated version.
 
-**456 tests, all green** (`npm test`), including `compose.test.js` — all
+**471 tests, all green** (`npm test`), including `compose.test.js` — all
 thirty-five plugins on one server from pure config, pods + WAC intact
 beside them. Findings consolidated in [NOTES.md](./NOTES.md); the full
 plugin-tagged backlog triaged in [ISSUES.md](./ISSUES.md); the build guide