refactor(install): delete legacy receipt and state readers

[ScriptedAlchemy]

Summary

Delete the installer's readers of old on-disk formats. #810 kept these to upgrade or remove older installs in place. The owner chose to drop them. An install the current format cannot prove is ours is now foreign, so the installer refuses it instead of adopting or purging it.

Removal matrix

Removed	Callers migrated	Deleted surface
Format-1 receipts (agent-bundle-install-receipt/1)	install, uninstall, doctor, emitted install.mjs	legacyInstallReceiptFormat, receipt synthesis, migratedFrom, AB7329
Receipt-less "legacy" ownership	same, plus Workbench discovery client	installSurfaceMarkerFiles, ownership 'legacy', identical-copy adoption, forced-legacy, isRuntimeStateRemnant
In-tree <plugin root>/state (pre-#640)	doctor, uninstall, format.ts	stateSource 'legacy', legacyDurableState, --purge-data of it, AB7332
Compatibility receipt stateRoot field	doctor, uninstall, state-root.ts	isRecordedDerivedStateRoot purge authority
'unsupported' runtime status	events/ipc.ts, doctor	AB7317; a rejected status probe is a failed probe (AB7318)

Kept: uninstall --force for current-format cases (edited owned files, host-registered plugin without a store receipt), receipts without a state block (crash window of the current writer), and every path, symlink, and foreign-data guard.

Consumer impact

A Cursor directory without a format-2 receipt naming the plugin is refused. install reports AB7005 with or without --replace. uninstall reports AB7007 with or without --force. Doctor reports AB7321. Remove the directory by hand and reinstall. An in-tree state/ directory is retained and listed, never purged.

Verification

On 88a1b646a7, rebased onto origin/main after #810 merged (18a913e9d8):

• pnpm build: pass
• pnpm typecheck: pass
• pnpm lint: pass
• pnpm test:unit: pass (309 files, 4,480 tests)
• pnpm test:integration:run: pass (whole pool, 104 files, 1,187 tests)
• pnpm test:packed on packed-install-bin, packed-readonly-state-root, packed-host-install-proof, public-api-packed: pass (4 files, 14 tests)
• pnpm docs:site:build: pass (language parity OK, diagnostics coverage OK, 0 broken links)

Review

Independent review (GPT-5.6, change-risk pass) found three items.

• High, dismissed as pre-existing. uninstall --force on a host-registered plugin with no store receipt (forced-missing), plus --purge-data, removes web-data without receipt authority. The same purge candidate already exists on the base branch (installedWebDataRoot in publicHostData). This PR only removes the legacy state/ candidate from that list, so it narrows the behavior. Whether forced-missing should purge at all is a separate product decision.
• Medium, dismissed as pre-existing. The emitted install.mjs drops a receipt state block whose owner mismatches instead of rejecting the receipt. That logic is unchanged from the base branch (surface.ts:1208). Follow-up, not legacy removal.
• Low, fixed in 88a1b64. The pending #818 changeset said uninstall --force removes pre-receipt copies. That sentence is dropped because this PR removes the behavior in the same release.

[changeset-bot]

🦋 Changeset detected

Latest commit: ad2df47

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
agent-bundle	Minor
create-agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T02:10:27.539183Z	39e9597	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@841

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@841

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@841

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@841

commit: 88a1b64