fix: retain unrecorded legacy state roots

[ScriptedAlchemy]

Summary

• require a legacy compatibility receipt to record the exact derived stateRoot before it can authorize recursive purge
• retain current-environment fallback roots as unproven across CLI plan/execution, keep-data remnants, public-host cleanup, Doctor, and generated install.mjs
• keep fix: manage derived state across lifecycle #642 recorded-root compatibility explicit in Doctor and clarify AB7332 plus English/Chinese lifecycle documentation

Reproduction

• pnpm exec rstest --config rstest.config.ts packages/agent-bundle/tests/uninstall.test.ts -t 'never derives legacy receipt purge ownership' — failed before the fix: the current XDG_STATE_HOME sentinel root appeared in data.paths with outcome: purged
• pnpm exec rstest --config rstest.config.ts packages/agent-bundle/tests/install-surface.test.ts -t 'emitted install.mjs never derives legacy purge ownership' — failed before the fix: generated install.mjs --uninstall --plan listed the unrelated current-environment directory for removal
• pnpm exec rstest --config rstest.config.ts packages/agent-bundle/tests/doctor.test.ts -t 'reports a current-environment legacy state root' — Doctor reported unrecorded, retained while uninstall planned a purge

Validation

Branch includes current origin/main (5fc8de37c9).

• pnpm build && pnpm typecheck && pnpm lint && pnpm test:unit — passed; unit: 4,397 passed, 6 skipped (4,403 total)
• pnpm exec rstest --config rstest.config.ts packages/agent-bundle/tests/install.test.ts packages/agent-bundle/tests/uninstall.test.ts packages/agent-bundle/tests/doctor.test.ts packages/agent-bundle/tests/install-surface.test.ts — 170 passed
• pnpm docs:site:build — passed; locale drift 0, diagnostics coverage complete, 0 broken links / 28,305 anchors

Deslop

Deslop: GPT-5.6 Sol, 1 edit: removed the unreachable public-host stateRoot purge branch.

Self-review

Reviewer: Claude Fable 5.1 Thinking High.

Initial findings: the #642 recorded-stateRoot positive branch lacked regression coverage; Doctor omitted a recorded historical root when the current environment resolved elsewhere; and the public-host positive stateRoot branch was unreachable.

Disposition: fixed all three. CLI and generated-installer tests now prove recorded derived roots remain purgeable while a changed current-environment sentinel survives; Doctor lists both the current unrecorded root and recorded purgeable root and keys AB7332 recovery to the full purgeable set; public-host receipts without modern state metadata always retain current-derived roots. The final re-review at 98a425d4db found no concrete merge risks and marked the branch safe to merge.

Closes #685

[changeset-bot]

🦋 Changeset detected

Latest commit: 98a425d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.