## Problem ### 1. GetCommands full-clone `Registry::GetCommands` locks `CommandRegistry`, clones the entire `HashMap<String, CommandHandler<Wry>>`, and returns the clone. With 200+ commands registered in a typical session, this is 200+ `Arc::clone` calls plus a full `HashMap` reallocation on every call. The returned value is a disconnected snapshot — callers cannot observe mutations that occur after the call returns. **File:** `Source/ApplicationState/State/ExtensionState/ExtensionRegistry/ExtensionRegistry.rs` ### 2. Silent poison discard All accessors use `self.SomeMutex.lock().ok().map(...).unwrap_or_default()`. If any thread panics while holding one of these mutexes, every subsequent read silently returns an empty value (`HashMap::new()`, `Vec::new()`). There is no log, no error, and no way for the caller to distinguish "no commands registered" from "all commands lost due to panic". The `MapLockError` helper exists in `ApplicationState.rs` for exactly this case but is not used here. ## Fix 1. Replace `GetCommands` with a closure-based API: ```rust pub fn WithCommands<F, T>(&self, f: F) -> T where F: FnOnce(&HashMap<String, CommandHandler<Wry>>) -> T { let guard = self.CommandRegistry .lock() .unwrap_or_else(|e| { dev_log!("lifecycle", "error: [ExtensionRegistry] CommandRegistry poisoned: {}", e); e.into_inner() }); f(&*guard) } ``` 2. Replace all `lock().ok().map(...).unwrap_or_default()` patterns across this file with `unwrap_or_else(|e| { dev_log!(...); e.into_inner() })`. ## Additional Scope for Same PR - `RegisterCommand` logs `"[ExtensionRegistry] Command registered"` without logging the command name. Add the name to the log line (it is in scope). - Apply the same closure-based API to `GetExtensionScanPaths` and `GetEnabledProposedAPIs`. - Add an overflow guard to `GetNextProviderHandle`: `fetch_add` with `Relaxed` ordering wraps silently at `u32::MAX`. Log an error if the counter crosses `u32::MAX / 2`.