@@ -0,0 +1,13 @@
+---
+'@objectstack/cli': patch
+'@objectstack/runtime': patch
+---
+
+fix(cli): the compiled plugin manifest's filename has one spelling, the runtime's
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+`os plugin build` writes the compiled manifest under the CLI's `MANIFEST_FILENAME`, and `os plugin publish` / `install` exempt that entry from the integrity map by it, while the runtime's reader finds the entry by `COMPILED_PLUGIN_MANIFEST_FILE`. The two were the same string kept by hand. `MANIFEST_FILENAME` is now the runtime's constant itself, so they cannot drift. The filename is unchanged (`objectstack.plugin.json`), so every artifact built before reads the same.
+
+**Public surface (additive):** `@objectstack/runtime` publishes a new subpath, `@objectstack/runtime/compiled-plugin-manifest-file`, exporting `COMPILED_PLUGIN_MANIFEST_FILE`. It is an import-free module, so the CLI reads the constant without loading the runtime's root entry, which every `os plugin` command would otherwise pay for (about a second).
@@ -35,10 +35,18 @@ export default defineConfig({
         find: /^@objectstack\/plugin-hono-server$/,
         replacement: path.resolve(__dirname, '../../plugins/plugin-hono-server/src/index.ts'),
       },
+      // @objectstack/runtime's one published subpath, listed BEFORE the bare
+      // entry below so that entry's prefix match cannot swallow it into
+      // `src/__mocks__/runtime.ts/compiled-plugin-manifest-file` (ENOTDIR). It
+      // is an import-free constant module, so it points at the real source,
+      // not the mock (#28080).
+      {
+        find: /^@objectstack\/runtime\/compiled-plugin-manifest-file$/,
+        replacement: path.resolve(__dirname, '../../runtime/src/compiled-plugin-manifest-file.ts'),
+      },
       // Unchanged in reach from the object entry this array replaced: a bare
       // string `find` still matches by prefix, so the kernel mock keeps exactly
-      // the surface it had. @objectstack/runtime publishes only `.`, so there
-      // is no subpath here for the prefix to swallow.
+      // the surface it had for the root entry.
       {
         find: '@objectstack/runtime',
         replacement: path.resolve(__dirname, 'src/__mocks__/runtime.ts'),
 
@@ -39,6 +39,8 @@ import { createHash } from 'node:crypto';
 import { gzipSync } from 'node:zlib';
 import { readTarGz, type ArchiveFile } from '@objectstack/core';
 import type { ObjectStackManifestParsed } from '@objectstack/spec/kernel';
+// The import-free subpath, not the root entry: see `readOspluginManifest` below.
+import { COMPILED_PLUGIN_MANIFEST_FILE } from '@objectstack/runtime/compiled-plugin-manifest-file';
 
 export { readTar, readTarGz, sha256Hex, MAX_UNPACKED_ARTIFACT_BYTES, type ArchiveFile } from '@objectstack/core';
 
@@ -70,7 +72,13 @@ export function computeIntegrity(files: ArchiveFile[]): Record<string, string> {
   return Object.fromEntries(Object.entries(out).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)));
 }
 
-export const MANIFEST_FILENAME = 'objectstack.plugin.json';
+/**
+ * The compiled manifest's filename: the runtime's own constant, so the entry
+ * `os plugin build` writes is the one the runtime's reader finds, and the
+ * entry publish/install exempt from the integrity map is that same one.
+ * ⛔ Never a second string literal here.
+ */
+export const MANIFEST_FILENAME = COMPILED_PLUGIN_MANIFEST_FILE;
 export const SIGNATURE_FILENAME = 'SIGNATURE';
 export const OSPLUGIN_EXT = '.osplugin';
 
 
@@ -0,0 +1,33 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The compiled manifest's filename has ONE spelling (#28080): the CLI's
+ * `MANIFEST_FILENAME` (the entry `os plugin build` writes, the entry publish
+ * and install exempt from the integrity map) is the runtime's
+ * `COMPILED_PLUGIN_MANIFEST_FILE` (the entry `readCompiledPluginManifest`
+ * finds), not a hand-kept twin of it.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readCompiledPluginManifest } from '@objectstack/runtime';
+import { COMPILED_PLUGIN_MANIFEST_FILE } from '@objectstack/runtime/compiled-plugin-manifest-file';
+import { MANIFEST_FILENAME, computeIntegrity } from '../src/utils/osplugin.js';
+
+describe('the compiled manifest filename', () => {
+  it("is the runtime's constant", () => {
+    expect(MANIFEST_FILENAME).toBe(COMPILED_PLUGIN_MANIFEST_FILE);
+  });
+
+  it("names the entry the runtime's reader finds, and the entry the integrity map leaves out", () => {
+    const manifest = {
+      id: 'com.acme.demo', name: 'Demo', version: '1.2.0', type: 'plugin',
+      runtime: 'sandbox', packaging: 'bundled', main: 'dist/index.mjs',
+    };
+    const files = [
+      { path: 'dist/index.mjs', data: new Uint8Array(Buffer.from('export const x = 1;\n')) },
+      { path: MANIFEST_FILENAME, data: new Uint8Array(Buffer.from(JSON.stringify(manifest))) },
+    ];
+    expect(readCompiledPluginManifest(files).ok).toBe(true);
+    expect(Object.keys(computeIntegrity(files))).toEqual(['dist/index.mjs']);
+  });
+});
@@ -17,6 +17,16 @@
         "types": "./dist/index.d.cts",
         "default": "./dist/index.cjs"
       }
+    },
+    "./compiled-plugin-manifest-file": {
+      "import": {
+        "types": "./dist/compiled-plugin-manifest-file.d.ts",
+        "default": "./dist/compiled-plugin-manifest-file.js"
+      },
+      "require": {
+        "types": "./dist/compiled-plugin-manifest-file.d.cts",
+        "default": "./dist/compiled-plugin-manifest-file.cjs"
+      }
     }
   },
   "scripts": {
 
@@ -0,0 +1,17 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The filename of the compiled manifest at an `.osplugin` artifact's root
+ * (ADR-0025 §3.2): the ONE spelling. `os plugin build` writes the entry under
+ * it, `os plugin publish` / `install` exempt it from the integrity map, and
+ * `readCompiledPluginManifest` finds it by it. The CLI imports this constant,
+ * so build and the runtime cannot drift onto two names.
+ *
+ * It lives in a module with no imports, published as its own subpath
+ * (`@objectstack/runtime/compiled-plugin-manifest-file`), because the CLI
+ * reads it from `utils/osplugin.ts`, which every `os plugin` command loads:
+ * the package's root entry costs about a second of load time that
+ * `os plugin build` and `os plugin sign` never need. ⛔ Keep this module free
+ * of imports, or the subpath stops being cheap.
+ */
+export const COMPILED_PLUGIN_MANIFEST_FILE = 'objectstack.plugin.json';
@@ -18,9 +18,10 @@
 
 import { formatZodIssue } from '@objectstack/spec';
 import { ManifestSchema, type ObjectStackManifestParsed } from '@objectstack/spec/kernel';
+import { COMPILED_PLUGIN_MANIFEST_FILE } from './compiled-plugin-manifest-file.js';
 
-/** The manifest at an artifact's root. */
-export const COMPILED_PLUGIN_MANIFEST_FILE = 'objectstack.plugin.json';
+/** The manifest at an artifact's root (its one spelling, shared with the CLI). */
+export { COMPILED_PLUGIN_MANIFEST_FILE };
 
 /** An artifact entry, as `readTarGz` answers it. */
 export interface CompiledManifestEntry {
 
@@ -5,7 +5,9 @@ import { defineConfig } from 'tsup';
 import { dropSourcesContent } from '../../scripts/tsup-drop-sources-content.mjs';
 
 export default defineConfig({
-  entry: ['src/index.ts'],
+  // `compiled-plugin-manifest-file` is its own import-free entry, so the CLI
+  // reads the manifest filename without loading the root entry (#28080).
+  entry: ['src/index.ts', 'src/compiled-plugin-manifest-file.ts'],
   splitting: false,
   sourcemap: true,
   clean: true,