Changing a relay re-mints every agent identity, and the abandoned ones cannot be retired

[eatmianbao]

Buzz Desktop on macOS, relay running block/buzz 0.2.1.

What happens

Agent identities appear to be bound to the relay they were minted against. The agent log files are named
<agent_pubkey>__<sha256(relay_url)>.log, and on our install three different suffixes exist, one per relay we
have used. All three hash exactly:

• sha256("wss://") matches the suffix on logs from our current relay
• sha256("wss://") matches the suffix from the relay before it
• sha256("wss://") matches the suffix from our first relay

When the relay changes, Desktop does not update the existing agents. It mints a brand new identity for every
persona, in a batch seconds apart, and leaves the previous identities alive on the previous relay. Our
managed-agents.json backups show six such batches between 5 and 21 September 2026, each matching a relay
change or a team change.

The three builtin welcome personas are hit hardest because they are reconciled on launch, so they caught every
switch. One workspace now shows 13 identities for each of them in the member picker, against 2 that have ever
been used.

Why it cannot be cleaned up

1. Deleting an agent record in Desktop prunes its private key from the Keychain. The profile stays on the relay
   and can no longer be signed for, so it can never be renamed or retired by its owner. We have identities that
   are permanently stranded this way.
2. The relay does not implement NIP-IA. Its NIP-11 descriptor lists
   supported_nips [1,2,10,11,16,17,23,25,29,33,38,42,50,56,43] with no identity archive.
3. buzz agents archive <pubkey> nonetheless returns rc 0 and {"ok":true,"event_id":...}. The events are
   accepted and silently do nothing: buzz agents archived stays {"archived":[]} indefinitely. That silent
   success is its own bug, separate from the missing feature.
4. buzz moderation ban registers in moderation restricted but does not remove the identity from the member
   picker, so it is not a workaround.

The only cleanup available to an owner today is to mint a NIP-OA attestation with the owner key and rename each
duplicate's profile to " (retired)", and that only works while the private key still exists locally.

What would fix it

1. Look agents up by persona_id rather than by (name, relay_url) during reconciliation, and update the
   relay_url field on the existing record instead of minting a new identity.
2. Do not prune an agent's key on delete, or warn clearly that deleting strands the identity permanently.
3. Either implement NIP-IA on the relay, or make buzz agents archive fail loudly against a relay that does not
   support it, rather than returning ok.
4. Warn on load when several agents share one persona_id.

Happy to supply the log filenames, the dated mint batches and the pubkeys involved if useful.