adopt without --rewrite-agent leaves the default agent dangling at the suppressed channel, silently

[arcavenai]

What happens

When a repo's default agent is the foreign form (vsdd-factory:orchestrator) and you adopt without --rewrite-agent, adoption succeeds and suppresses the foreign identity — leaving settings.json pointing at an agent namespace that no longer resolves to anything. The --dry-run plan warns about this beforehand, but the real run prints no warning at the moment it creates the condition, and no later command reports it.

Reproduction

mkdir /tmp/rw && cd /tmp/rw && git init -q && git commit -qm i --allow-empty
mkdir -p .claude && cat > .claude/settings.json <<'JSON'
{ "enabledPlugins": { "vsdd-factory@claude-mp": true },
  "agent": "vsdd-factory:orchestrator" }
JSON

sideshow adopt vsdd-factory@1.0.0-rc.23 --allow-version-change   # no --rewrite-agent

Adoption reports success. Afterwards:

$ python3 -c "import json;print(json.load(open('.claude/settings.json'))['agent'])"
vsdd-factory:orchestrator          # points at the SUPPRESSED channel

$ sideshow coexist vsdd-factory
Repo /tmp/rw:
  effectively enabled: none
  suppressed here:     vsdd-factory@claude-mp

And a real session in that repo offers no such agent — the prefixed forms are the only ones present:

vsdd-factory: prefixed agents present?  False
orchestrator entries: ['vsdd-orchestrator', 'vsdd-orchestrator-brownfield-sequence', ...]

So the repo's declared default agent does not exist in the session.

What's missing

1. The real run is silent. --dry-run step 3 says it plainly ("it will KEEP pointing at the suppressed channel — pass --rewrite-agent to flip it, or run 'sideshow activate' after"). The actual adopt prints nothing at that step, so an operator who skips the dry-run gets no signal at the only moment it matters.
2. Nothing detects it afterwards. coexist-check layer 5 (agent-key-audit) reports "35 prefixed agent entries … (sideshow channel)" and does not notice that the active agent key is a foreign-form orphan. This looks like a natural layer-5 check: if the default agent carries the foreign <pack>: prefix while that identity is suppressed here, that's an ERROR (or at minimum WARN) with the two remedies named.

Note on what works

--rewrite-agent itself behaves well and is worth keeping as-is: it writes the flip to settings.local.json and leaves the committed settings.json untouched —

default agent rewritten: "vsdd-factory:orchestrator" -> "vsdd-orchestrator"

— so disable + deleting the override restores the original byte-exact (verified). The defect is only the silent no-flag path.

Also seen while reproducing

adopt refused with [recent-burst-log] … a burst appears in flight and the hint "pass --override-stale-lock". That flag is accepted by adopt and is in the runbook §8 flag list, but adopt's own usage line omits it:

sideshow adopt <pack> [--repo <path>] [--rewrite-agent] [--dry-run]  Convert a repo from the foreign (claude-mp) channel

Adding it there would match the enable/disable help (cf. #88's neighborhood).

Environment

sideshow 0.1.0-alpha.20260801.040642.a1962f7, macOS (darwin-arm64). Found closing the --rewrite-agent coverage gap left open in the aae-orc#128 round-2 report.

[arcaven]

Accepted. Two-part fix queued: the cheap half is the real adopt run printing the same dangling-agent warning the dry-run already prints when a foreign-form default agent exists and --rewrite-agent was not passed (silent divergence between dry-run and real run is the same defect family as the version gate). The fuller half is your suggestion, a coexist-check layer-5 check for an agent key that resolves to nothing on the active channel. Agreed --rewrite-agent itself stays as designed; the local-scope flip with byte-exact retreat is the right shape.