diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 49a3464..13bacea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,10 +1,11 @@
 # The Go gates for this plugin's own module.
 #
-# The stock plugin repos carry no Go CI (their candies were thin); THIS one
-# ships a real Go module with a vendored device client, so the rulebook's
-# "tests that can fail" (R7) requires a gate that actually runs them:
-# gofmt, the configured golangci-lint set, the formatter-class diff,
-# go vet, and the unit tests (which drive a fake JetKVM device).
+# This repo ships a REAL Go module (the cua provider + its client, CUE schema, and
+# unit tests), so the rulebook's "tests that can fail" (R7) requires a gate that
+# actually RUNS them: gofmt, golangci-lint, go vet, and the unit tests. The candy
+# manifest gate (deploy.yml `charly box validate`) checks the manifest, not the Go
+# code, and the bed exercises verb DISPATCH, not the unit tests — so this workflow
+# is the only place the module's tests run.
 name: ci
 
 on:
@@ -28,23 +29,23 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version-file: candy/plugin-jetkvm/go.mod
-          cache-dependency-path: candy/plugin-jetkvm/go.sum
+          go-version-file: candy/plugin-cua/go.mod
+          cache-dependency-path: candy/plugin-cua/go.sum
 
       - name: gofmt
-        working-directory: candy/plugin-jetkvm
+        working-directory: candy/plugin-cua
         run: test -z "$(gofmt -l .)"
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v7
         with:
           version: v2.13.2
-          working-directory: candy/plugin-jetkvm
+          working-directory: candy/plugin-cua
 
       - name: go vet
-        working-directory: candy/plugin-jetkvm
+        working-directory: candy/plugin-cua
         run: go vet ./...
 
       - name: go test
-        working-directory: candy/plugin-jetkvm
+        working-directory: candy/plugin-cua
         run: go test ./...
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f229461..ce070f2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -22,7 +22,7 @@ jobs:
 
       - name: Fetch the pinned charly source (CI-time temp checkout)
         run: |
-          git clone --depth 1 --branch v2026.258.0219 https://github.com/opencharly/charly.git /tmp/charly
+          git clone --depth 1 --branch v2026.269.1034 https://github.com/opencharly/charly.git /tmp/charly
 
       - uses: actions/setup-go@v5
         with:
diff --git a/.gitignore b/.gitignore
index 32494b0..764600c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,20 @@
+# Build output
 /bin/
 *.test
+
+# charly run artifacts
+.check/
+
+# Go workspace files — this is a STANDALONE module (charly's loader builds it
+# with GOWORK=off), so a workspace file here would only mask module resolution.
+go.work
+go.work.sum
+
+# charly-generated build context ignores + build output
+.containerignore
+.dockerignore
+.build/
+
+# Migration rollback backups (charly migrate writes <file>.bak.<unix-ts>)
+*.bak
+*.bak.*
diff --git a/candy/plugin-cua/client.go b/candy/plugin-cua/client.go
index c65a07f..5c19596 100644
--- a/candy/plugin-cua/client.go
+++ b/candy/plugin-cua/client.go
@@ -16,7 +16,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"os"
 	"strings"
 
 	"github.com/opencharly/plugin-cua/candy/plugin-cua/params"
@@ -111,9 +110,3 @@ func jsonArgs(m map[string]any) string {
 func shellSingleQuote(s string) string {
 	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
 }
-
-// hostname is a small helper for evidence rows.
-func hostname() string {
-	h, _ := os.Hostname()
-	return h
-}
diff --git a/candy/plugin-cua/kind.go b/candy/plugin-cua/kind.go
index c7a2378..4e3aeb8 100644
--- a/candy/plugin-cua/kind.go
+++ b/candy/plugin-cua/kind.go
@@ -106,16 +106,6 @@ func applyDeviceDefaults(in *params.CuaInput, dev *params.CuaDeviceInput) {
 	}
 }
 
-// kindCapability advertises the plugin's kind:cua capability — the entity's
-// self-contained CUE schema, served over the same Describe channel as the verb.
-func kindCapability() sdk.ProvidedCapability {
-	return sdk.ProvidedCapability{
-		Class:    "kind",
-		Word:     kindWord,
-		InputDef: "#CuaDeviceInput",
-	}
-}
-
 // deviceCanonicalJSON is the OpLoad body decode: the host validates the authored entity
 // against #CuaDeviceInput, then this re-marshals it canonically.
 func deviceCanonicalJSON(paramsJSON []byte) (json.RawMessage, error) {