The client namespace service keeps install and remove for its own members and refuses a Remote method of that name at mount, so the browser could never reach plugins/install. A spec now reads the reserved names off the gateway and checks every @Remote name against them.