@@ -118,6 +118,7 @@ jobs:
         env:
           CBM_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/cbm-artifact
           SMOKE_REQUIRE_UI: "1"
+          SMOKE_REQUIRE_WRAPPERS: "1"
 
       - name: Security audits
         run: |
@@ -224,6 +225,7 @@ jobs:
         env:
           SMOKE_ARCH: ${{ matrix.arch }}
           SMOKE_REQUIRE_UI: "1"
+          SMOKE_REQUIRE_WRAPPERS: "1"
         run: |
           export CBM_SMOKE_ARTIFACT_DIR="$(cygpath -u "$RUNNER_TEMP")/cbm-artifact"
           bash test-infrastructure/vm/vm-smoke.sh
@@ -301,6 +303,7 @@ jobs:
         env:
           CBM_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/cbm-artifact
           SMOKE_REQUIRE_UI: "1"
+          SMOKE_REQUIRE_WRAPPERS: "1"
 
       # The -portable binary is what all linux install/update paths now deliver;
       # it MUST start on old glibc (Debian 11 / RHEL 8 / Ubuntu 20.04). Runs it
 
@@ -232,6 +232,7 @@ jobs:
         env:
           CCACHE_DIR: ${{ github.workspace }}/.ccache
           CCACHE_MAXSIZE: 1000M
+          SMOKE_REQUIRE_WRAPPERS: "1"
 
       - name: Build prod + smoke (macOS)
         if: matrix.os == 'macos-14'
@@ -242,6 +243,7 @@ jobs:
         env:
           CCACHE_DIR: ${{ github.workspace }}/.ccache
           CCACHE_MAXSIZE: 1000M
+          SMOKE_REQUIRE_WRAPPERS: "1"
 
       - name: Build prod + smoke (Windows)
         if: matrix.os == 'windows-latest'
@@ -252,6 +254,7 @@ jobs:
         env:
           CCACHE_DIR: ${{ github.workspace }}/.ccache
           CCACHE_MAXSIZE: 1000M
+          SMOKE_REQUIRE_WRAPPERS: "1"
 
   # ── Waste sanitizer, REPORT-ONLY: memory + CPU waste on this repository and
   #    the per-function scaling lane (Linux). Deliberately NOT in ci-ok's needs:
 
@@ -283,9 +283,15 @@ jobs:
         # move the release tag. (A floating HEAD also broke the 0.8.0 release:
         # HEAD had become a commit touching .github/workflows/, and the App
         # token may not create refs pointing at workflow-modifying commits.)
+        # The Go wrapper is a nested module: `go install
+        # .../pkg/go/cmd/codebase-memory-mcp@vX.Y.Z` and @latest resolve its
+        # versions from pkg/go/v* tags only (without one, Go fetches the whole
+        # repository, which is over its 500 MB module limit).
         run: |
           git tag -f "$VERSION" "$GITHUB_SHA"
           git push origin "$VERSION" --force
+          git tag -f "pkg/go/$VERSION" "$GITHUB_SHA"
+          git push origin "pkg/go/$VERSION" --force
 
       - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
@@ -510,6 +516,12 @@ jobs:
           else
             npm publish --access public --provenance
           fi
+          # `next` is "the newest you can opt into": once a stable release
+          # exists, an older RC must not stay behind it (0.9.1-rc.1 did until
+          # v0.12.1). Re-runnable: dist-tag add is idempotent.
+          if [[ "$RELEASE_VERSION" != *-* ]]; then
+            npm dist-tag add "codebase-memory-mcp@$V" next
+          fi
 
       # ── PyPI ─────────────────────────────────────────────────
       - name: Setup Python
 
@@ -63,7 +63,7 @@ These captures show CBM Lens Beta on 12–13 October 2026, using public source f
 ## Why codebase-memory-mcp
 
 - **Indexing performance**: Linux kernel (28M LOC, 75K files) in 3 minutes. RAM-first pipeline: LZ4 compression, in-memory SQLite, fused Aho-Corasick pattern matching. Memory released after indexing.
-- **Plug and play**: native executable plus authenticated release-owned assets for macOS (arm64/amd64), Linux (arm64/amd64), and Windows (amd64). The native install needs no Docker, language runtime, or API keys. Download → `install` → restart agent → done.
+- **Plug and play**: native executable plus authenticated release-owned assets for macOS (arm64/amd64), Linux (arm64/amd64), and Windows (arm64/amd64). The native install needs no Docker, language runtime, or API keys. Download → `install` → restart agent → done.
 - **162 languages**: vendored tree-sitter grammars compiled into the binary. No separate parser installation.
 - **About 120× fewer tokens in the reported five-query comparison**: ~3,400 tokens vs ~412,000 via file-by-file search. See [Performance](#performance) for the scope and sources.
 - **45 supported automatic/conditional client surfaces**: `install` configures detected clients and safely activates conditional clients only when their documented platform, marker, or explicit existing config path is present. See [Multi-Agent Support](#multi-agent-support) for the complete matrix and manual/UI-only boundaries.
@@ -360,7 +360,7 @@ The install script placed beside the binary is **reported, not deleted**: uninst
 - **Auto-sync**: Background watcher detects file changes in the project an MCP session is working in and re-indexes it automatically (other indexed repos: re-run `index_repository`)
 - **Route nodes**: REST endpoints are first-class graph entities
 - **CLI mode**: `codebase-memory-mcp cli search_graph --project my-project --name-pattern ".*Handler.*"`
-- **Available on**: npm, PyPI, Homebrew, Scoop, Winget, Chocolatey, AUR, `go install`
+- **Available on**: npm, PyPI, Homebrew, Scoop, AUR, `go install`
 
 ### Indexing modes
 
 
@@ -540,7 +540,7 @@ <h2>How do I install codebase-memory-mcp?</h2>
             Warp MCP, JetBrains AI/ACP, GitHub Copilot coding agent, Jules, CodeRabbit, Replit, BLACKBOX AI,
             Plandex, and SWE-agent. Warp is counted above for its detected skill installation; its MCP connection
             remains manual. Windows users run <code>install.ps1</code>. Also available via <code>npm</code>,
-            <code>pip</code>, Homebrew, Scoop, Winget, Chocolatey, AUR, and <code>go install</code>.
+            <code>pip</code>, Homebrew, Scoop, AUR, and <code>go install</code>.
         </p>
         <p class="muted">
             Lifecycle installation follows documented context contracts: Qoder uses <code>SessionStart</code>,
@@ -805,7 +805,7 @@ <h3>Does it support semantic or natural-language code search?</h3>
 
         <h3>Do I need Docker or a runtime?</h3>
         <p>The native install needs no language runtime. It is a native executable with authenticated release-owned
-           assets for macOS (arm64/amd64), Linux (arm64/amd64), and Windows (amd64); npm, PyPI, and Go wrapper
+           assets for macOS (arm64/amd64), Linux (arm64/amd64), and Windows (arm64/amd64); npm, PyPI, and Go wrapper
            installations naturally use their package runtime.</p>
 
         <h3>How does it stay up to date as I edit code?</h3>
 
@@ -15,7 +15,7 @@
 - Supported agents: 45 automatic/conditional client surfaces (39 automatically detected + 6 conditional/explicit): Claude Code, Codex CLI, Gemini CLI, Zed, OpenCode, Antigravity, Aider, KiloCode, VS Code, Cursor, Windsurf, Augment / Auggie, OpenClaw, Kiro, Junie, Hermes, OpenHands, Cline, Warp, Qwen Code, GitHub Copilot CLI, Factory Droid, Crush, Goose, Mistral Vibe, Grok Build, Qoder CLI, Kimi Code CLI, GitLab Duo CLI, Rovo Dev CLI, Amp, Devin CLI / Local, Tabnine, Continue / cn, Visual Studio, TRAE, Roo Code, Amazon Q Developer IDE, CodeBuddy Code CLI, IBM Bob IDE, IBM Bob Shell, Pochi, Pi, Oh My Pi (omp), and Sourcegraph Cody.
 - Agent profiles: documented custom-agent formats receive Scout (fast/provisional), Verify (default/task-directed), and Auditor (bounded/full verification) definitions. Every direct tier checks exact path/scope coverage with check_index_coverage and falls back to source for flagged gaps; unsafe child-MCP formats use explicit parent handoff. Kiro and Junie use positive-allowlist Scout/Analysis server profiles (7/11 tools); Qoder combines named-server selection with exact tier-specific MCP tool IDs, while Factory uses exact registered IDs without additive whole-server exposure. Foreign Junie aliases are preserved and force parent handoff.
 - Performance: Linux kernel (28M LOC, 75K files) full index in 3 minutes → 4.81M nodes, 7.72M edges; Cypher queries in under 1ms.
-- Distribution: verified runtime set (native executable plus authenticated release-owned assets); fully static Linux builds are available in the `-portable` archives. Also available through npm, PyPI, Homebrew, Scoop, Winget, Chocolatey, AUR, and `go install`.
+- Distribution: verified runtime set (native executable plus authenticated release-owned assets); fully static Linux builds are available in the `-portable` archives. Also available through npm, PyPI, Homebrew, Scoop, AUR, and `go install`.
 
 ## Links