chore(docs)!: regenerate the recipe corpus after the coordinator rename

src/content/docs/recipes/automation/crabbox-deploy.md

@@ -15,7 +15,7 @@ Crabbox (https://github.com/openclaw/crabbox) leases or selects a runner,
 syncs the current working tree, runs commands remotely, streams output,
 records evidence, and releases the target. In OpenCharly the CLI
 (`layer-crabbox` candy), the Node.js/PostgreSQL coordinator
-(`pod-crabbox` candy, supervised, postgres-backed), and the `crabbox:`
+(`pod-crabbox-coordinator` candy, supervised, postgres-backed), and the `crabbox:`
 check verb (`plugin-crabbox`) compose into a FULLY-LOCAL control plane:
 CLI -> broker at loopback :8080 -> postgres :5432 -> leases via
 `--provider local-container` on the box's nested rootless podman.
@@ -42,7 +42,7 @@ For container lifecycle use `charly` commands -- see [`/charly-core:service`](/r
 - `layer-crabbox` (v2026.247.0855) — the CLI binary at /usr/local/bin/crabbox
   (pinned GoReleaser archive), prerequisites composed (layer-gh /
   layer-ssh-client / rsync / curl), plan checks: version/providers/doctor.
-- `pod-crabbox` (v2026.247.1016) — the coordinator: built from the pinned
+- `pod-crabbox-coordinator` (v2026.247.1016) — the coordinator: built from the pinned
   upstream tag in-image, supervised at priority 20 (after postgres), port
   8080, /v1/health + /v1/ready, start wrapper waiting for the database.
 - `plugin-crabbox` (v2026.247.1021) — the `crabbox:` check verb (three

src/content/docs/recipes/check/crabbox.md

@@ -16,7 +16,7 @@ and its optional local Node.js/PostgreSQL coordinator, served
 out-of-process over go-plugin gRPC by `opencharly/plugin-crabbox`.
 Install the CLI with [`/charly-tools:crabbox-cli`](/recipes/tools/crabbox-cli/) (opencharly/layer-crabbox)
 and the coordinator with [`/charly-crabbox:crabbox-coordinator`](/recipes/crabbox/crabbox-coordinator/)
-(opencharly/pod-crabbox).
+(opencharly/pod-crabbox-coordinator).
 
 ## Why it is not the `command:`/`http:` verbs
 

src/content/docs/recipes/index.md

@@ -280,7 +280,7 @@ Self-contained skills for running the comfyui image-generation/diffusion image.
 
 ### charly-crabbox
 
-Self-contained skills for the crabbox image family: the Crabbox CLI (layer-crabbox), the local Node/PostgreSQL coordinator (pod-crabbox) and the `crabbox:` check verb (plugin-crabbox) — the fully-local remote-execution control plane.
+Self-contained skills for the crabbox image family: the Crabbox CLI (layer-crabbox), the local Node/PostgreSQL coordinator (pod-crabbox-coordinator) and the `crabbox:` check verb (plugin-crabbox) — the fully-local remote-execution control plane.
 
 - [crabbox-coordinator](/recipes/crabbox/crabbox-coordinator/)
 
@@ -590,7 +590,7 @@ Development internals for charly contributors — Go source map, install-plan IR
 - [marketplace](/recipes/internals/marketplace/)
 - [ovmf](/recipes/internals/ovmf/)
 - [plugin](/recipes/internals/plugin/)
-- [plugin-nerdctl](/recipes/internals/plugin-nerdctl/)
+- [plugin-containerd](/recipes/internals/plugin-containerd/)
 - [repo-setup](/recipes/internals/repo-setup/)
 - [root-cause-analyzer](/recipes/internals/root-cause-analyzer/)
 - [skills](/recipes/internals/skills/)

src/content/docs/recipes/internals/plugin-nerdctl.md → src/content/docs/recipes/internals/plugin-containerd.md

@@ -1,13 +1,13 @@
 ---
-title: "plugin-nerdctl"
+title: "plugin-containerd"
 description: "The out-of-tree charly ENGINE plugin serving engine:containerd (verb:containerd / command:containerd) — every engine op delegates to container.InvokeEngineOp."
 ---
 
 <!-- DO-NOT-EDIT — generated by `charly docs generate`; the opencharly/docs repo's deploy workflow regenerates this tree against its pinned charly checkout. -->
 
 *Recipe card from the `charly-internals` plugin (Development — contributor internals).*
 
-# plugin-nerdctl
+# plugin-containerd
 
 The out-of-tree charly ENGINE plugin serving `engine:containerd` (plus the
 `verb:containerd` / `command:containerd` convenience words).
@@ -55,7 +55,25 @@ mode-split workload users, `address`, `namespace`, `privilege_prefix`,
 `substrates`, `runtime_handlers`) is served by the spec module's engine body —
 one table, no copy here.
 
+## The read-only check verb (`verb:containerd`)
+
+`containerd: <method>` is a READ-ONLY check verb (W3.9). Its typed input is
+`#ContainerdInput` with `method` as the PRIMARY field, so `containerd: info`
+desugars to `{method: "info"}`. It drives the venue's own tooling over the host
+executor reverse channel; each method catches a defect nothing else does:
+
+| method | measures | visible skip (names the mechanism) |
+|---|---|---|
+| `info` | daemon id + mode from `nerdctl info` **SecurityOptions** (never `Plugins`) | — |
+| `runtimes` | the declared CRI handlers (`crictl info`) | `crictl` not installed |
+| `cdi_devices` | devices in the **client's** CDI spec dirs (`/etc/cdi`, `/var/run/cdi`) | — (an absent dir is an empty, passing list; a malformed spec FAILS) |
+| `criu_preflight` | `criu check --unprivileged --feature seccomp_suspend`: rc **and** the supported line; `--extra` is never used | `criu` not installed |
+| `krun_guest` | one throwaway probe guest (`--rm`): kernel, arch, CPU features | no probe `image:`, no `/dev/kvm`, handler not declared |
+| `image` | an image present in a **named** namespace | — |
+
+A skip is never a silent pass: an assertion that cannot run is not green.
+
 ## Use when
 
-Working with the `engine:containerd` provider, the plugin-nerdctl candy, or the
-engine provider-class placement model.
+Working with the `engine:containerd` provider, the `containerd:` check verb, the
+plugin-containerd candy, or the engine provider-class placement model.