add a little more plugin options for people who make plugins that need to be auto loaded.

plugins/docs/bundle-format.md

@@ -85,6 +85,13 @@ Native plugins can choose the Windows loader mode and exported ABI names:
 
 `navbar.icon` accepts a Font Awesome 6 solid icon class such as `fa-cube`, `fa-key`, or `fa-network-wired`. If the plugin is enabled, navbar plugins appear in the Plugin Apps group and open at `/plugins/<id>`.
 
+Client-side bundles can set `autoLoadByDefault: true`. The default is applied only
+after a trusted plugin is enabled automatically or an administrator explicitly
+confirms and enables an untrusted plugin. An existing administrator auto-load
+choice is preserved across reinstalls.
+When the default is applied, compatible connected clients are loaded immediately;
+future clients receive the plugin as they connect.
+
 ## Dashboard Badges
 
 Plugins can contribute compact badges to client cards on the main dashboard. Declare the dashboard integration in `config.json`:

plugins/docs/install-and-manage.md

@@ -53,6 +53,7 @@ Auto-load notes:
 | WASM needs | WASM plugins with unapproved needs are blocked. |
 | Persistence | Auto-load state is saved in `.plugin-state.json`. |
 | Platform matching | WASM is universal; legacy native requires a matching binary. |
+| Bundle default | `autoLoadByDefault: true` enables auto-load only after the plugin passes trusted enablement or an administrator explicitly confirms enablement. |
 
 ## Useful APIs
 

plugins/docs/server-side-plugins.md

@@ -37,8 +37,8 @@ export default {
     ctx.log.info("server plugin started");
   },
 
-  async onEvent(ctx, event) {
-    ctx.log.info(`plugin event from ${event.clientId}`);
+  async onEvent(ctx, clientId, event, payload) {
+    ctx.log.info(`${event} from ${clientId}: ${JSON.stringify(payload)}`);
   },
 
   rpc: {
@@ -53,6 +53,8 @@ export default {
 };
 ```
 
+`onEvent` receives events emitted by that plugin's client module.
+
 ## The `ctx` Object
 
 | Field | Description |