fix(group): keep no-change updates of pending manual native registrations read-only

.github/workflows/agentplugins-native-clients.yml

@@ -55,7 +55,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: false
       - name: Verify native matrix safety and evidence gates
         shell: bash

.github/workflows/agentplugins-npm-publish.yml

@@ -177,7 +177,7 @@ jobs:
           package-manager-cache: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
       - name: Verify metadata, signatures, provenance, and isolated lifecycle
         env:

.github/workflows/agentplugins-release.yml

@@ -115,7 +115,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         if: ${{ inputs.publish_release != true }}
         with:
-          go-version: 1.26.9
+          go-version: 1.26.10
           cache: false
       - name: Verify exact release-bound Directory bootstrap
         if: ${{ inputs.publish_release != true }}
@@ -187,7 +187,7 @@ jobs:
           ref: ${{ needs.validate.outputs.commit }}
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.9
+          go-version: 1.26.10
           cache: false
       - name: Build exact-version binary
         env:

.github/workflows/agentplugins-released-native-clients.yml

@@ -133,7 +133,7 @@ jobs:
           path: producer-source
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/authoring-frozen-native.yml

@@ -118,7 +118,7 @@ jobs:
           NODE
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.9
+          go-version: 1.26.10
           cache: false
       - name: Acquire and extract the same checked preparation ZIP
         env:

.github/workflows/authoring-milestone-a-e2e.yml

@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
@@ -111,7 +111,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         if: runner.os == 'macOS'
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: false
       - name: Check Darwin writable acquisition and separate read-only regressions
         if: runner.os == 'macOS'

.github/workflows/authoring-native.yml

@@ -51,7 +51,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # ci.yml
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           architecture: ${{ matrix.arch == 'amd64' && 'x64' || matrix.arch }}
           cache: false
       - name: Prepare disposable second NTFS filesystem on Windows ARM64
@@ -94,7 +94,7 @@ jobs:
           go env -json GOOS GOARCH GOHOSTOS GOHOSTARCH GOVERSION GOROOT > "$NATIVE_ROOT/evidence/go-env.json"
           test "$(go env GOHOSTOS)/$(go env GOHOSTARCH)" = "$EXPECTED_OS/$EXPECTED_ARCH"
           test "$(go env GOOS)/$(go env GOARCH)" = "$EXPECTED_OS/$EXPECTED_ARCH"
-          test "$(go env GOVERSION)" = go1.26.9
+          test "$(go env GOVERSION)" = go1.26.10
           # Node is used only for generated JavaScript syntax checks (--check).
           unset NODE_OPTIONS NODE_PATH
           node --version > "$NATIVE_ROOT/evidence/node-version.txt"
@@ -206,7 +206,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           architecture: x64
           cache: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/codeql.yml

@@ -32,7 +32,7 @@ jobs:
       - if: matrix.language == 'go'
         uses: actions/setup-go@v6
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - uses: github/codeql-action/init@v4

.github/workflows/core-fast.yml

@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
       - name: Qualify native Windows transition privacy and durable recovery
         working-directory: install/integrationctl/agentplugins
@@ -66,7 +66,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
       - name: Qualify native Windows managed stdio process-tree ownership
         working-directory: install/integrationctl/agentplugins
@@ -96,7 +96,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -127,7 +127,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       # Same target as the local preflight, so a green run here means the same
@@ -171,7 +171,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       # The core carries 39 platform-tagged files; only a real cross build
@@ -197,7 +197,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       # test-core does not compile the authoring commands, terminal prompts,

.github/workflows/coverage.yml

@@ -29,7 +29,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - name: Collect Go coverage

.github/workflows/darwin-terminal-cancel.yml

@@ -29,7 +29,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: false
       - name: Reproduce failure on the public pre-fix library
         shell: bash

.github/workflows/docs-canary.yml

@@ -28,7 +28,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - name: Install pinned docs toolchain

.github/workflows/docs-pages.yml

@@ -41,7 +41,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.0.0

.github/workflows/docs.yml

@@ -33,7 +33,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - uses: actions/setup-python@v6

.github/workflows/extended.yml

@@ -29,7 +29,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - name: Run extended evidence lane

.github/workflows/govulncheck.yml

@@ -38,7 +38,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - name: Run govulncheck

.github/workflows/landing.yml

@@ -33,7 +33,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
@@ -132,7 +132,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       # Keep docs on its own packageManager; landing uses a newer lockfile format.

.github/workflows/lint.yml

@@ -51,7 +51,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       # Correctness and style on changed lines only: the legacy tree predates the

.github/workflows/live.yml

@@ -45,7 +45,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - name: Run live evidence lane

.github/workflows/opencode-sdk.yml

@@ -55,7 +55,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: false
       - name: Check neutral wire decoder
         working-directory: sdk

.github/workflows/physical-profile-native.yml

@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: false
       - name: Create canonical Windows TEST temp root
         if: runner.os == 'Windows'

.github/workflows/polyglot-smoke.yml

@@ -40,7 +40,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       - uses: actions/setup-node@v6

.github/workflows/registry-compatibility-mirror.yml

@@ -43,7 +43,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.9"
+          go-version: "1.26.10"
           cache: false
 
       # Keep docs on its own packageManager; landing uses a newer lockfile format.

.github/workflows/terminal-ui.yml

@@ -39,7 +39,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: false
       - name: Focused contracts and frozen release build
         id: build

.github/workflows/terminal-windows-diagnostic.yml

@@ -22,7 +22,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: false
       - name: Focused native contracts
         working-directory: cli

.github/workflows/vscode-local-native.yml

@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
-          go-version: '1.26.9'
+          go-version: '1.26.10'
           cache: false
       - name: Qualify exact public renderer on native system shell
         run: |
@@ -81,7 +81,7 @@ jobs:
             GOPROXY=off GOSUMDB=off GOMAXPROCS=2 U2_REQUIRE_NATIVE="$U2_REQUIRE_NATIVE")
           "${native_env[@]}" "$go_bin" env -json GOHOSTOS GOOS GOARCH GOVERSION > "$scratch/evidence/go-env.json"
           test "$("${native_env[@]}" "$go_bin" env GOHOSTOS)" = "$U2_REQUIRE_NATIVE"
-          test "$("${native_env[@]}" "$go_bin" env GOVERSION)" = go1.26.9
+          test "$("${native_env[@]}" "$go_bin" env GOVERSION)" = go1.26.10
           set +e
           "${native_env[@]}" "$go_bin" test -p 2 -count=1 -timeout=3m -json ./vscodelocalhooks \
             > "$scratch/evidence/test.json" 2> "$scratch/evidence/test.stderr"

Makefile

@@ -3,7 +3,7 @@
 GOCACHE ?= /tmp/plugin-kit-ai-gocache
 export GOCACHE
 
-SECURITY_GOTOOLCHAIN ?= go1.26.9
+SECURITY_GOTOOLCHAIN ?= go1.26.10
 
 EXTENDED_TEST_ARGS ?=
 REQUIRED_TEST_TIMEOUT ?= 20m

cli/README.md

@@ -100,7 +100,7 @@ go build -o bin/plugin-kit-ai ./cli/cmd/plugin-kit-ai
 
 Choose the lane that matches the delivery model you need today. Expand later from the same repo when the product needs more outputs.
 
-Maintainer note: building the checked-in monorepo workspace currently requires Go `1.26.9` for the CLI module and CI lanes. Generated Go plugin projects stay on the public Go SDK path with Go `1.22+`.
+Maintainer note: building the checked-in monorepo workspace currently requires Go `1.26.10` for the CLI module and CI lanes. Generated Go plugin projects stay on the public Go SDK path with Go `1.22+`.
 ## Fast Local Plugin
 
 For repo-local plugins where fast iteration matters more than packaged distribution:

cli/cmd/agentplugins/release_workflow_test.go

@@ -33,7 +33,7 @@ func TestStableReleaseRequiresVerifiedReproducibleBootstrapBeforeBuild(t *testin
 		t.Fatal("Directory bootstrap gate must be in validate before build")
 	}
 	for _, required := range []string{
-		"go-version: 1.26.9",
+		"go-version: 1.26.10",
 		"node-version: \"22.21.1\"",
 		"GOWORK: \"off\"",
 		"GOTOOLCHAIN: local",

cli/go.mod

@@ -2,7 +2,7 @@ module github.com/777genius/plugin-kit-ai/cli
 
 go 1.25.8
 
-toolchain go1.26.9
+toolchain go1.26.10
 
 replace github.com/777genius/plugin-kit-ai/sdk => ../sdk
 

cli/internal/agentpluginscli/add_result.go

@@ -102,7 +102,7 @@ func renderHumanAddOutcome(writer io.Writer, result usecase.AddResult) error {
 		_, err := fmt.Fprintln(writer, message+"\nNext: "+nextLocalLifecycleAction(result))
 		return err
 	}
-	if result.NoChange {
+	if result.NoChange && fullyInstalled(result.Activation) {
 		_, _ = fmt.Fprintln(writer, terminaltheme.For(writer).Text(terminaltheme.Muted, "Already installed and lifecycle verification is complete. No changes made."))
 		return nil
 	}

go.mod

@@ -2,4 +2,4 @@ module github.com/777genius/plugin-kit-ai
 
 go 1.22
 
-toolchain go1.26.9
+toolchain go1.26.10