@@ -468,26 +468,29 @@ def _check_identity(self, plugin: BasePlugin) -> PluginError | None:
                 severity="error",
             )
 
-        # Rows 3 and 5: plugin has not declared target_application.
-        # v0.7.0 deprecation warning fires regardless of whether host has
-        # declared app_id; the warning is dropped in v0.8.0 steady state.
-        if plugin_target is None:
+        # Row 3 (v0.9.0): host has declared app_id, plugin has not declared
+        # target_application. Hard filter with missing_target_application.
+        # This was a deprecation warning in v0.7.0; v0.9.0 ships the transition
+        # originally planned for v0.8.0.
+        if self._app_id is not None and plugin_target is None:
             msg = (
                 f"Plugin '{plugin.name}' does not declare target_application. "
-                "Hosts adopting app_id in v0.8.0 or later will filter this "
-                "plugin. Authors should add target_application to remain "
-                "compatible with identity-aware hosts."
+                f"Activation refused by host '{self._app_id}'; declare "
+                f"target_application = '{self._app_id}' in the plugin class."
             )
-            logger.warning(msg)
             return PluginError(
                 name=plugin.name,
                 phase="identity_check",
                 cause=None,
                 user_facing_message=msg,
-                severity="warning",
+                severity="error",
             )
 
-        # Row 4: host has not declared app_id, plugin's claim is unvalidated.
+        # Row 4: host has not declared app_id, plugin has declared target_application.
+        # Plugin's claim is unvalidated; activate silently.
+        # Row 5: both undeclared. Activate silently. The v0.7.0 deprecation
+        # warning previously fired here has been retired in v0.9.0 (the transition
+        # has shipped).
         return None
 
     def _check_api_version(self, plugin: BasePlugin) -> PluginError | None:
@@ -579,9 +582,17 @@ def _activate_with_states(
             if identity_err is not None:
                 errors.append(identity_err)
                 if identity_err.severity == "error":
+                    # Discriminate between mismatch and missing-target cases.
+                    # Mismatch: plugin declared but doesn't match host. Missing:
+                    # plugin has no target_application at all.
+                    identity_reason = (
+                        "wrong_application"
+                        if plugin.target_application is not None
+                        else "missing_target_application"
+                    )
                     states[name] = replace(
                         states[name],
-                        filter_reason="wrong_application",
+                        filter_reason=identity_reason,
                         load_error=identity_err,
                     )
                     self._load_errors[name] = identity_err.user_facing_message
 
@@ -13,6 +13,7 @@
     "not_enabled",
     "disabled",
     "wrong_application",
+    "missing_target_application",
     "incompatible_api_version",
     "incompatible_app_version",
     "dependency_unmet",
 
@@ -155,7 +155,7 @@ def test_plugin_with_target_no_identity_error(self, tmp_path: Path) -> None:
         assert identity_errors == []
 
 
-# --- Matrix row 5: both undeclared (v0.7.0-only deprecation warning, plugin activates) ---
+# --- Matrix row 5: both undeclared (v0.9.0: silent activate, deprecation warning retired) ---
 
 
 class TestBothUndeclared:
@@ -168,46 +168,61 @@ def test_both_undeclared_activates_no_filter(self, tmp_path: Path) -> None:
         assert result.states["undeclared_plugin"].filter_reason is None
 
     def test_both_undeclared_emits_warning(self, tmp_path: Path) -> None:
+        # v0.9.0: the v0.7.0 deprecation warning has been retired. Both-undeclared
+        # is now silent (no warning, no filter, no error). Test name preserved
+        # to mark the historical contract that was flipped.
         cfg = _write_config(tmp_path, ["undeclared_plugin"])
         pm = PluginManager(config_path=str(cfg))
         result = pm.register_plugins([UndeclaredPlugin])
 
-        identity_warnings = [
-            e for e in result.errors if e.phase == "identity_check" and e.severity == "warning"
-        ]
-        assert len(identity_warnings) == 1
-        assert identity_warnings[0].name == "undeclared_plugin"
-        assert "target_application" in identity_warnings[0].user_facing_message
-        assert "v0.8.0" in identity_warnings[0].user_facing_message
+        identity_errors = [e for e in result.errors if e.phase == "identity_check"]
+        assert identity_errors == []
 
 
-# --- Matrix row 3: host declared but plugin not declared (deprecation warning) ---
+# --- Matrix row 3 (v0.9.0): host declared but plugin not declared - hard filter ---
 
 
 class TestPluginUndeclaredHostDeclared:
     def test_emits_warning_and_activates(self, tmp_path: Path) -> None:
+        # v0.9.0: this row hard-filters with missing_target_application instead
+        # of the v0.7.0 warn-and-activate behavior. Test name preserved to mark
+        # the historical contract that was flipped.
         cfg = _write_config(tmp_path, ["undeclared_plugin"])
         pm = PluginManager(config_path=str(cfg), app_id="app-a")
         result = pm.register_plugins([UndeclaredPlugin])
 
-        # Plugin still activates
-        assert "undeclared_plugin" in result.activated
-        assert result.states["undeclared_plugin"].filter_reason is None
+        # Plugin does NOT activate
+        assert "undeclared_plugin" not in result.activated
+        state = result.states["undeclared_plugin"]
+        assert state.filter_reason == "missing_target_application"
 
-        # Warning recorded
+        # Error recorded (not warning)
+        identity_errors = [
+            e for e in result.errors if e.phase == "identity_check" and e.severity == "error"
+        ]
+        assert len(identity_errors) == 1
+        assert identity_errors[0].name == "undeclared_plugin"
+        # No warnings in v0.9.0 for this row
         identity_warnings = [
             e for e in result.errors if e.phase == "identity_check" and e.severity == "warning"
         ]
-        assert len(identity_warnings) == 1
-        assert identity_warnings[0].name == "undeclared_plugin"
+        assert identity_warnings == []
 
     def test_warning_message_mentions_v0_8(self, tmp_path: Path) -> None:
+        # v0.9.0: no longer mentions v0.8.0 (the transition has occurred).
+        # Error message now references the host's app_id directly. Test name
+        # preserved to mark the historical contract that was flipped.
         cfg = _write_config(tmp_path, ["undeclared_plugin"])
         pm = PluginManager(config_path=str(cfg), app_id="app-a")
         result = pm.register_plugins([UndeclaredPlugin])
 
-        identity_warnings = [e for e in result.errors if e.severity == "warning"]
-        assert any("v0.8.0" in e.user_facing_message for e in identity_warnings)
+        identity_errors = [e for e in result.errors if e.severity == "error"]
+        assert any(
+            "target_application" in e.user_facing_message and "app-a" in e.user_facing_message
+            for e in identity_errors
+        )
+        # The v0.7.0 "v0.8.0 or later" phrasing must not appear anywhere
+        assert not any("v0.8.0" in e.user_facing_message for e in result.errors)
 
 
 # --- Row 4 guard: plugin declared, host undeclared stays silent (no warning regression) ---
@@ -233,7 +248,11 @@ def test_plugin_declared_host_undeclared_no_warning(self, tmp_path: Path) -> Non
 
 class TestPerCallDedup:
     def test_two_plugins_emit_two_warnings_one_each(self, tmp_path: Path) -> None:
-        """Within a single call, each plugin gets its own warning (one per plugin)."""
+        """v0.9.0: each undeclared plugin gets its own hard-filter error.
+
+        Test name preserved from v0.7.0 (was "warnings"); semantics flipped
+        to errors after the v0.9.0 hard-filter transition.
+        """
         cfg = _write_config(tmp_path, ["undeclared_plugin", "second_undeclared"])
 
         class SecondUndeclaredPlugin(BasePlugin):
@@ -242,18 +261,22 @@ class SecondUndeclaredPlugin(BasePlugin):
         pm = PluginManager(config_path=str(cfg), app_id="app-a")
         result = pm.register_plugins([UndeclaredPlugin, SecondUndeclaredPlugin])
 
-        identity_warnings = [e for e in result.errors if e.severity == "warning"]
-        names = sorted(e.name for e in identity_warnings)
+        identity_errors = [
+            e for e in result.errors if e.phase == "identity_check" and e.severity == "error"
+        ]
+        names = sorted(e.name for e in identity_errors)
         assert names == ["second_undeclared", "undeclared_plugin"]
+        # Both plugins filtered with missing_target_application
+        assert result.states["undeclared_plugin"].filter_reason == "missing_target_application"
+        assert result.states["second_undeclared"].filter_reason == "missing_target_application"
 
     def test_two_manager_instances_emit_warnings_independently(self, tmp_path: Path) -> None:
         """Two separate manager instances each evaluate identity fresh.
 
-        This validates the design choice: per-call (and therefore
-        per-manager-instance) semantics produce identical behavior regardless
-        of whether consumers manage the PluginManager as a singleton or
-        recreate it per request. The same undeclared plugin registered into
-        two managers produces a warning in each.
+        Validates the per-call (and therefore per-manager-instance) semantics
+        survive the v0.9.0 hard-filter transition: same undeclared plugin
+        registered into two managers produces an error in each, independently.
+        Test name preserved from v0.7.0 (was "warnings"); semantics flipped.
         """
         cfg = _write_config(tmp_path, ["undeclared_plugin"])
 
@@ -263,36 +286,38 @@ def test_two_manager_instances_emit_warnings_independently(self, tmp_path: Path)
         pm2 = PluginManager(config_path=str(cfg), app_id="app-a")
         result2 = pm2.register_plugins([UndeclaredPlugin])
 
-        w1 = [e for e in result1.errors if e.phase == "identity_check" and e.severity == "warning"]
-        w2 = [e for e in result2.errors if e.phase == "identity_check" and e.severity == "warning"]
+        e1 = [e for e in result1.errors if e.phase == "identity_check" and e.severity == "error"]
+        e2 = [e for e in result2.errors if e.phase == "identity_check" and e.severity == "error"]
 
-        assert len(w1) == 1
-        assert len(w2) == 1
-        assert w1[0].name == "undeclared_plugin"
-        assert w2[0].name == "undeclared_plugin"
+        assert len(e1) == 1
+        assert len(e2) == 1
+        assert e1[0].name == "undeclared_plugin"
+        assert e2[0].name == "undeclared_plugin"
 
 
 # --- register_plugin logger.warning emission for warning case ---
 
 
 class TestRegisterPluginWarningLogged:
     def test_undeclared_plugin_logs_warning(self, tmp_path: Path, caplog: Any) -> None:
-        import logging
+        """v0.9.0: register_plugin filters undeclared plugins when host has app_id.
 
+        Was: warn-and-activate (v0.7.0). Now: hard filter, plugin not activated,
+        get_load_errors() carries the entry. Test name preserved from v0.7.0;
+        semantics flipped.
+        """
         cfg = _write_config(tmp_path, [])
         pm = PluginManager(config_path=str(cfg), app_id="app-a")
         plugin = UndeclaredPlugin()
-        with caplog.at_level(logging.WARNING):
-            pm.register_plugin(plugin)
+        pm.register_plugin(plugin)
 
-        # Plugin still activates
-        assert "undeclared_plugin" in [p.name for p in pm.get_active_plugins()]
-        # Warning logged
-        assert any(
-            "target_application" in record.message and "undeclared_plugin" in record.message
-            for record in caplog.records
-            if record.levelno == logging.WARNING
-        )
+        # Plugin does NOT activate
+        assert "undeclared_plugin" not in [p.name for p in pm.get_active_plugins()]
+        # Filter recorded in load_errors with the new error message
+        errors = pm.get_load_errors()
+        assert "undeclared_plugin" in errors
+        assert "target_application" in errors["undeclared_plugin"]
+        assert "app-a" in errors["undeclared_plugin"]
 
 
 # --- Identity check fires before version checks ---
@@ -398,6 +423,13 @@ def test_filter_reason_includes_wrong_application(self) -> None:
 
         assert "wrong_application" in get_args(FilterReason)
 
+    def test_filter_reason_includes_missing_target_application(self) -> None:
+        from typing import get_args
+
+        from pluginforge.state import FilterReason
+
+        assert "missing_target_application" in get_args(FilterReason)
+
     def test_error_phase_includes_identity_check(self) -> None:
         from typing import get_args