(2026-10-02 release-readiness audit, agent-filed)
An agent identity lives and dies with the zone it was minted under (crates/didbot-identity/src/lib.rs:9-12), and each account's DID document is served only by this PDS itself — so permanent shutdown bricks every agent DID for every consuming app, the exact risk CLAUDE.md names. Repo bytes can leave today (getRepo CAR + listBlobs/getBlob) but identities cannot.
did:web is settled; what is missing is the wind-down path: a documented zone-handoff/restore runbook plus per-account signing-key + CAR export, so an operator shutdown degrades to a host move rather than mass stranding.
Partly done by f08fa75ec ("docs: design the evacuation path for did:web accounts"): docs/zone-handoff.md is the whole-deployment zone handoff runbook. Remains: per-account signing-key and CAR export, which is only a design in plan/evacuation.md and waits on the owner.