diff --git a/CLAUDE.md b/CLAUDE.md
index ba396ad..d4eded1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -57,7 +57,7 @@ All Go code lives in a single `ts` package (no subpackages).
 - **UK English** in docs and comments (colour, organisation)
 - **Error wrapping:** `fmt.Errorf("coredeno: <context>: %w", err)`
 - **Test naming:** `_Good`, `_Bad`, `_Ugly` suffixes for test functions
-- **Thread safety:** `Sidecar` and `DenoClient` use `sync.RWMutex`
+- **Thread safety:** `Sidecar` uses `sync.RWMutex`; `DenoClient` uses `sync.Mutex`
 - **Security model:** Empty permission lists deny all access; reserved store namespaces (prefixed `_`) blocked from modules; path matching uses boundary checks to prevent `"data"` matching `"data-secrets"`
 
 ## Testing
diff --git a/coredeno.go b/coredeno.go
index 0563aab..89a9d93 100644
--- a/coredeno.go
+++ b/coredeno.go
@@ -18,7 +18,7 @@ type Options struct {
 	DenoSocketPath string            // Unix socket path for Deno's gRPC server (DenoService)
 	AppRoot        string            // app root directory (sandboxed I/O)
 	StoreDBPath    string            // SQLite DB path (default: AppRoot/.core/store.db)
-	PublicKey      ed25519.PublicKey  // ed25519 public key for manifest verification (optional)
+	PublicKey      ed25519.PublicKey // ed25519 public key for manifest verification (optional)
 	SidecarArgs    []string          // args passed to the sidecar process
 }
 
diff --git a/integration_test.go b/integration_test.go
index 24e2974..18262c0 100644
--- a/integration_test.go
+++ b/integration_test.go
@@ -10,18 +10,15 @@ import (
 	"testing"
 	"time"
 
-	pb "forge.lthn.ai/core/ts/proto"
-	core "forge.lthn.ai/core/go/pkg/core"
 	"forge.lthn.ai/core/go-scm/marketplace"
+	core "forge.lthn.ai/core/go/pkg/core"
+	pb "forge.lthn.ai/core/ts/proto"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
 
-// unused import guard
-var _ = pb.NewCoreServiceClient
-
 func findDeno(t *testing.T) string {
 	t.Helper()
 	denoPath, err := exec.LookPath("deno")
@@ -38,7 +35,7 @@ func findDeno(t *testing.T) string {
 // runtimeEntryPoint returns the absolute path to runtime/main.ts.
 func runtimeEntryPoint(t *testing.T) string {
 	t.Helper()
-	// We're in pkg/coredeno/ during test, runtime is a subdir
+	// runtime/ is a subdir of the package root
 	abs, err := filepath.Abs("runtime/main.ts")
 	require.NoError(t, err)
 	require.FileExists(t, abs)
diff --git a/listener_test.go b/listener_test.go
index e37c655..a9d4b1d 100644
--- a/listener_test.go
+++ b/listener_test.go
@@ -7,9 +7,9 @@ import (
 	"testing"
 	"time"
 
-	pb "forge.lthn.ai/core/ts/proto"
 	io "forge.lthn.ai/core/go-io"
 	"forge.lthn.ai/core/go-io/store"
+	pb "forge.lthn.ai/core/ts/proto"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
diff --git a/server.go b/server.go
index 2a5c0cd..7330b87 100644
--- a/server.go
+++ b/server.go
@@ -6,10 +6,10 @@ import (
 	"fmt"
 	"strings"
 
-	pb "forge.lthn.ai/core/ts/proto"
 	io "forge.lthn.ai/core/go-io"
-	"forge.lthn.ai/core/go-scm/manifest"
 	"forge.lthn.ai/core/go-io/store"
+	"forge.lthn.ai/core/go-scm/manifest"
+	pb "forge.lthn.ai/core/ts/proto"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/server_test.go b/server_test.go
index fbd09e8..7b34258 100644
--- a/server_test.go
+++ b/server_test.go
@@ -5,10 +5,10 @@ import (
 	"fmt"
 	"testing"
 
-	pb "forge.lthn.ai/core/ts/proto"
 	io "forge.lthn.ai/core/go-io"
-	"forge.lthn.ai/core/go-scm/manifest"
 	"forge.lthn.ai/core/go-io/store"
+	"forge.lthn.ai/core/go-scm/manifest"
+	pb "forge.lthn.ai/core/ts/proto"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc/codes"
@@ -163,7 +163,7 @@ func TestProcessStart_Bad_PermissionDenied(t *testing.T) {
 func TestProcessStart_Bad_NoProcessService(t *testing.T) {
 	srv := newTestServer(t)
 	srv.RegisterModule(&manifest.Manifest{
-		Code: "no-proc-mod",
+		Code:        "no-proc-mod",
 		Permissions: manifest.Permissions{Run: []string{"echo"}},
 	})
 	_, err := srv.ProcessStart(context.Background(), &pb.ProcessStartRequest{
diff --git a/service.go b/service.go
index 9e7cea4..98a5140 100644
--- a/service.go
+++ b/service.go
@@ -7,11 +7,11 @@ import (
 	"path/filepath"
 	"time"
 
-	core "forge.lthn.ai/core/go/pkg/core"
 	io "forge.lthn.ai/core/go-io"
+	"forge.lthn.ai/core/go-io/store"
 	"forge.lthn.ai/core/go-scm/manifest"
 	"forge.lthn.ai/core/go-scm/marketplace"
-	"forge.lthn.ai/core/go-io/store"
+	core "forge.lthn.ai/core/go/pkg/core"
 )
 
 // Service wraps the CoreDeno sidecar as a framework service.
@@ -134,7 +134,7 @@ func (s *Service) OnStartup(ctx context.Context) error {
 	// 8. Create installer and auto-load installed modules
 	if opts.AppRoot != "" {
 		modulesDir := filepath.Join(opts.AppRoot, "modules")
-		s.installer = marketplace.NewInstaller(modulesDir, s.store)
+		s.installer = marketplace.NewInstaller(medium, modulesDir, s.store)
 
 		if s.denoClient != nil {
 			installed, listErr := s.installer.Installed()
diff --git a/service_test.go b/service_test.go
index 49843fe..c8f3b32 100644
--- a/service_test.go
+++ b/service_test.go
@@ -7,8 +7,8 @@ import (
 	"testing"
 	"time"
 
-	pb "forge.lthn.ai/core/ts/proto"
 	core "forge.lthn.ai/core/go/pkg/core"
+	pb "forge.lthn.ai/core/ts/proto"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"