docs(plugin-dev): 补记「装上≠生效」——旧内核上装 timer 仍走内置工厂

loadOne 先查 factories[name]，命中就不再读 plugin.bin；旧内核里内置 timer 工厂还在，所以落盘安装后 plugin_status 仍是 builtin=true / tools=[timer_set]，外部版本要等内核升级重启（工厂消失）才真正接管。plgreload 在这中间是空动作。

这样「先装插件再升级内核」的顺序约束才有可执行的含义：先落盘，再换二进制重启。

(cherry picked from commit 9e72898170386526425f8abe474d0f9622242422)

assets/docs/en/PLUGIN_DEV.md

@@ -848,6 +848,14 @@ Internal: records are stored in SQLite `disabled_plugins` table (`name`, `disabl
 > **fails silently**: no error, the tools simply vanish (the LLM cannot see them, which
 > surfaces as "reminders are gone" with nothing in the logs to explain it).
 >
+> ⚠ **Installed is not the same as in effect**: on the **old kernel**, installing the timer
+> plugin still goes through the built-in factory (`loadOne` checks `factories[name]` first and
+> never reaches `plugin.bin`), so the external build is not loaded at all —
+> `plugin_status("timer")` keeps reporting `builtin=true`, `tools=["timer_set"]`. The
+> hand-over only happens **after the kernel upgrade restarts** (the factory is gone, so the
+> external bin finally loads). Correct sequence: install to disk first, then swap the binary
+> and restart — the `plgreload` in between is a no-op.
+>
 > The external version is also a strict superset: the built-in one only had `timer_set`, and
 > in-flight countdowns were lost on restart; the external one adds `timer_list` / `timer_cancel`
 > and persists pending timers across restarts.