decommission removes the record: the lifetime is ended, its receipts kept in the store for pruning, and reconcile is not-found until the next deploy #929

Epic: #451 · Feature: #762 The writ lifecycle surface · Schedule: #916, lane 12, PR E · Waits on: #971 (lane 17)

The ruling (#913; this lane ruled 2026-09-23)

Decommission removes the record. After a decommission the lifetime is over: the fold yields nothing,
reconcile is not-found (66, #756) as on a machine never deployed, and the next deploy opens a fresh lifetime.
Removed means ended, not deleted (ruled 2026-09-23): the lifetime's receipts stay in the store, marked ended,
so history is kept; deleting them is pruning's (lane 13) and nothing else's.

Today

cmd/writ/writ/decommission reads the folded inventory, plans one graph per scope, unlinks what writ linked and
removes what writ copied (a target the user replaced is refused, never deleted), and writes a receipt whose removal
inventory the next fold subtracts. The files are removed well. The record survives as rows the fold subtracts --
a record that says "gone" by subtraction rather than a lifetime that ended.

The change

1. Decommission removes the files as today, scope by scope, and then marks the current lifetime ended in the
   store: the receipts stay, and the fold (deploy replaces the record: readback.Fold is bounded to the current lifetime, one writ deploy invocation across scopes #922) does not read an ended lifetime.
2. After it, reconcile exits 66 not-found; upgrade has nothing to update and says so; deploy opens a new
   lifetime whose record has no memory of the ended one.
3. A second decommission with no current lifetime is a not-found, the same 66, not an error and not a no-op
   that pretends to have removed something.
4. The representation of "ended" is the same lifetime marker deploy replaces the record: readback.Fold is bounded to the current lifetime, one writ deploy invocation across scopes #922 designs; this lane adds the ending.

Acceptance

• deploy, decommission: every linked target unlinked, every copied target removed, a user-replaced target
  refused and reported; then reconcile exits 66
• the ended lifetime's receipts are still in the store, byte-identical, and marked ended
• deploy again: reconcile exits 0 and mentions nothing from the ended lifetime
• decommission with no current lifetime exits 66
• 10-command-line-interface.md §3.1's mechanics row for decommission says "reverse traversal; the lifetime
  ended, its receipts kept"
• both VMs: the deploy, decommission, reconcile, deploy sequence

Plan and design documents

Revised 2026-09-28 (#847)

Under kept snapshots, the ended lifetime's snapshots and refs/devlore/ refs are kept with its receipts, for pruning (#930); its links are removed. No unretained edit in a snapshot is ever discarded: decommission refuses a snapshot holding one until reconcile has retained it.