Function parse_returned_extensions 

pub fn parse_returned_extensions(
    response: &Value,
    inbound: &Extensions,
) -> Result<Option<OwnedExtensions>, HostError>

Rebuild an OwnedExtensions from the worker’s response, or None.

None means “no modified extensions” and is the documented no-change signal: the worker omits the field. Omission rather than an echo is deliberate — a JSON round trip allocates new Arcs, so an echoed immutable slot is indistinguishable from a forged one under validate_immutable’s pointer check. Omitting is the only representation that reads cleanly as “nothing changed”.

inbound is the filtered view this plugin was sent. Its Arcs are reused for immutable slots so the executor’s pointer-identity check passes; only the tiers a plugin may legitimately write are taken from the wire.

This function does not decide whether a change is allowed — the executor’s merge does, via validate_immutable, the monotonic label check, and the write tokens carried on inbound. Malformed slot JSON is an error: a plugin that returned a security object the host cannot parse has not made “no change”, and silently dropping it would hide the failure.