P1 fixes: outbox no_handlers, HTML sanitization, WebSocket plugin check, fail-closed plugin gate, plugin admin-only

app/core/outbox.py

@@ -174,12 +174,30 @@ async def process_outbox_batch(
             payload_dict = payload
 
         try:
+            # Enrich payload with event metadata for idempotency
+            payload_dict.setdefault("_event_id", str(event_id))
+            payload_dict.setdefault("_event_name", event_name)
+            payload_dict.setdefault("_event_timestamp", datetime.now(timezone.utc).isoformat())
+            
             results = await event_bus.publish_with_results(event_name, payload_dict)
+            
+            # Check if any handlers were registered at all
+            handler_count = len(results)
             # If any handler raised, treat as failure
             handler_errors = [r for r in results if r is not None]
             if handler_errors:
                 raise handler_errors[0]
-            await db.execute(_MARK_PUBLISHED_SQL, {"id": str(event_id)})
+            
+            if handler_count == 0:
+                # No handlers registered — mark as 'no_handlers' not 'published'
+                # This prevents events from silently disappearing
+                await db.execute(
+                    text("UPDATE event_outbox SET status = 'no_handlers', published_at = now() WHERE id = :id"),
+                    {"id": str(event_id)},
+                )
+                logger.warning("Outbox event %s (%s) had no handlers registered", event_id, event_name)
+            else:
+                await db.execute(_MARK_PUBLISHED_SQL, {"id": str(event_id)})
             published_count += 1
         except Exception as exc:
             logger.error(