fix(plugins): preserve document path encoding

Keep OS-native path data intact across IPC instead of replacing non-UTF-8 bytes.

Refs #901

crates/ocs_plugin_api/ARCHITECTURE.md

@@ -49,7 +49,7 @@ The host and each plugin run in separate OS processes. The host re-executes itse
 - `OCS_PLUGIN_MAX_API_VERSION` can cap the accepted major at runtime (e.g. `4` to disable V5).
 - A plugin built against major `N` runs on a host whose major is `>= N` because new vtable entries and enum variants are appended at the end.
 - V4 introduces the **acadrust gate**: plugins targeting API v4 or later must resolve the same `acadrust` source as the host (see [`src/version_info.rs`](src/version_info.rs)).
-- V5 introduces `BuiltinPlugin::on_load`, invoked once after the runner connects.
+- V5 introduces `BuiltinPlugin::on_load` and tab-keyed document paths.
 
 The runtime enforces three gates:
 

crates/ocs_plugin_api/README.md

@@ -18,7 +18,7 @@ enum variants at the end, so older plugins continue to load on newer hosts.
 | **V2** | Out-of-process runner | Synchronous commands + interactive point collection (`HostApi::start_interactive`) | Baseline |
 | **V3** | Out-of-process runner | Local cached `document()`/`document_mut()` + shared-memory `DocumentReader`/`document_view` for large reads | New vtable entries appended; new `PluginRequest`/`PluginResponse` variants appended |
 | **V4** | Out-of-process runner over a multiplexed local socket | Full-duplex notifications + asynchronous REPL `ExecuteCode` | New `HostToPluginV4`/`PluginToHostV4` frame layer; `BuiltinPlugin::on_notification` and `start_execute_code` appended to trait |
-| **V5** | V4 multiplexed runner | One-shot `BuiltinPlugin::on_load` initialization | Lifecycle callback appended to `BuiltinPlugin` |
+| **V5** | V4 multiplexed runner | One-shot initialization + tab-keyed document paths | `BuiltinPlugin::on_load` and `HostApi::document_path` appended to the traits |
 
 The host controls which generations are accepted at runtime through
 `OCS_PLUGIN_MAX_API_VERSION` (e.g. `2` for V2-only mode, `4` to disable V5). The
@@ -28,6 +28,7 @@ back to `API_VERSION_MIN_SUPPORTED = 2`.
 V5 calls `BuiltinPlugin::on_load` once after the runner connects and before the
 first user command. Plugins can cache `HostApi::plugin_request_sender()` there
 for worker-thread access. A panic in the callback fails plugin loading.
+`HostApi::document_path(tab_id)` returns the saved path for a document tab.
 
 ### High-level layout
 

crates/ocs_plugin_api/src/host.rs

@@ -542,9 +542,8 @@ pub trait HostApi {
     }
 
     /// Return the filesystem path of the document in tab `tab_id`, if any.
-    /// Added after API v4; appended at the very end so older plugins compiled
-    /// without it keep stable vtable indices. The default returns `None`;
-    /// in-process hosts should override it to expose the real path.
+    /// Added in API v5. The default returns `None`; in-process hosts should
+    /// override it to expose the real path.
     fn document_path(&self, tab_id: u64) -> Option<PathBuf> {
         let _ = tab_id;
         None

crates/ocs_plugin_api/src/ipc/protocol.rs

@@ -136,7 +136,7 @@ pub enum PluginRequest {
     CloseDocumentViewV4 { tab_id: u64 },
     /// V4: ask the host for the stable tab identifier of the active tab.
     GetTabId,
-    /// V4: ask the host for the filesystem path of the document in `tab_id`.
+    /// V5: ask the host for the filesystem path of the document in `tab_id`.
     DocumentPath { tab_id: u64 },
 }
 
@@ -162,8 +162,8 @@ pub enum PluginResponse {
     },
     /// V4: stable tab identifier of the active tab.
     TabId(u64),
-    /// V4: filesystem path of the document in the requested tab, if any.
-    DocumentPath(Option<String>),
+    /// V5: filesystem path of the document in the requested tab, if any.
+    DocumentPath(Option<std::ffi::OsString>),
 }
 
 /// Messages sent from the host to the plugin runner.

crates/ocs_plugin_api/src/ipc/server.rs

@@ -74,8 +74,8 @@ pub fn handle_plugin_request(
             PluginResponse::Ok
         }
         GetTabId => PluginResponse::TabId(host.tab_id()),
-        DocumentPath { tab_id } => {
-            PluginResponse::DocumentPath(host.document_path(tab_id).map(|p| p.to_string_lossy().to_string()))
-        }
+        DocumentPath { tab_id } => PluginResponse::DocumentPath(
+            host.document_path(tab_id).map(|path| path.into_os_string()),
+        ),
     }
 }

docs/plugin-architecture.md

@@ -130,6 +130,7 @@ pub trait BuiltinPlugin: Send + Sync {
     fn manifest(&self) -> &'static PluginManifest;
     fn ribbon(&self) -> Box<dyn CadModule>;            // the ribbon tab
     fn dispatch(&self, host: &mut dyn HostApi, cmd: &str) -> bool;
+    fn on_load(&mut self, host: &mut dyn HostApi) {}
 }
 ```
 
@@ -146,6 +147,7 @@ concrete types:
 | Command line | `push_info`, `push_output`, `push_error` |
 | Undo / dirty | `push_undo`, `set_dirty` |
 | Tab | `tab_index()` |
+| Document identity (V5) | `document_path(tab_id)` returns the saved path for a document tab. |
 | Notifications (V4) | `on_notification` receives `HostNotification::SelectionChangedV4 { tab_id, handles }` when the active tab's selection changes, plus `DocumentChangedV4` / `DocumentTabClosed`. |
 
 ### `export_plugin!` — the C-ABI export