fix(release): retire target labels after tagging

.agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md

@@ -11,7 +11,7 @@ user_invocable: true
 
 Use the release scripts for normal release operations. Do not run raw `git tag`, `git push`, `gh api`, or version-bump commands by hand for the normal release flow.
 
-The release is one annotated semver tag on an already-merged `origin/main` commit. The GitHub workflow moves `latest`; release admins promote `lkg` manually after validation. After the tag and `latest` are verified, automatically move remaining open issues/PRs from the released version label to the next patch label, draft release notes, then verify the maintainer-published Announcement before final handoff.
+The release is one signed annotated semver tag on an already-merged `origin/main` commit. The GitHub workflow requires that tag to be GitHub-Verified, points `latest` at the exact verified tag object, carries remaining open issues/PRs to the next patch label, and deletes the released label while holding the shared release-label coordination queue; release admins promote `lkg` manually after validation. After the workflow is verified, draft release notes, then verify the maintainer-published Announcement before final handoff.
 
 ## LKG Production Image Dispatch
 
@@ -34,6 +34,8 @@ The downstream scheduled reconciliation remains available if the event-driven di
 - Push only the semver tag (`vX.Y.Z`) from the agent-controlled step.
 - Never push `latest` or `lkg` from this skill.
 - Never move, delete, or force-push an existing remote semver tag unless the maintainer explicitly starts protected-tag remediation.
+- Delete the released version label only after open work moves forward and a final query finds no open stragglers. Never rename or reuse a released label.
+- Keep label retirement inside the `release-latest-tag` workflow so it cannot overlap the post-merge labeler. Do not run the retirement script directly.
 - Draft release notes locally. Do not create the GitHub Discussion; the maintainer does that.
 - Do not mark the announcement step complete until the maintainer provides a valid Discussion URL and the published Announcement is verified.
 - Follow the shared [Git and GitHub Access Hard Stop](../_shared/git-github-hard-stop.md) for SSH, authentication, remote access, authorization, or permission failures.
@@ -48,7 +50,7 @@ Release Progress:
 - [ ] Step 2: Show plan, E2E evidence, and confirmation phrase
 - [ ] Step 3: Cut the semver tag from the confirmed plan
 - [ ] Step 4: Wait for workflow-managed latest
-- [ ] Step 5: Bump remaining open issues/PRs
+- [ ] Step 5: Carry open work forward and retire the released label
 - [ ] Step 6: Generate release-note data and draft Markdown
 - [ ] Step 7: Wait for maintainer-published Announcement
 - [ ] Step 8: Verify Announcement and hand off sharing
@@ -96,7 +98,7 @@ Read the generated `plan.json` and show the maintainer:
 - plan hash,
 - forbidden operations,
 - confirmation phrase,
-- open issue/PR housekeeping plan for the release label.
+- open issue/PR housekeeping plan for the release label, including deletion of the released label after carry-forward succeeds.
 
 Unless Step 1 records an explicit waiver, verify that the plan's next tag matches the H2 version heading in the dated changelog entry at the candidate SHA.
 When the entry is waived, show the recorded waiver reason in the plan presentation and confirmation handoff instead.
@@ -128,7 +130,7 @@ Run the cut script with the plan and the maintainer's phrase:
 npm run release:cut -- --plan <plan.json> --confirm "CONFIRM RELEASE vX.Y.Z <full-origin-main-sha>"
 ```
 
-The script verifies a clean worktree, unchanged `origin/main`, tag availability, target reachability, and remote peeled tag state. It writes:
+The script verifies a clean worktree, unchanged `origin/main`, tag availability, target reachability, and remote peeled tag state, then creates and pushes the signed annotated tag using the configured signing key. It writes:
 
 ```text
 <release-dir>/cut-result.json
@@ -144,34 +146,48 @@ Run:
 npm run release:wait-latest -- --plan <plan.json>
 ```
 
-The script waits until `vX.Y.Z^{}` and `latest^{}` both peel to the planned commit and verifies `lkg` did not change from the plan. It writes:
+The script waits until `vX.Y.Z` and `latest` reference the same tag object, verifies both peel to the planned commit, and verifies `lkg` did not change from the plan. It writes:
 
 ```text
 <release-dir>/latest-result.json
 ```
 
 If it fails, report the failed workflow/status. Do not manually move `latest`.
 
-### Step 5: Bump Remaining Open Issues/PRs
+### Step 5: Verify Carry-Forward and Label Retirement
 
-Move every remaining open issue or PR carrying the released version to the next patch label:
+The `release-latest-tag` workflow continues after moving `latest`: it moves every remaining open issue or PR carrying the released version to the next patch label, verifies none remain, and deletes the released label. The workflow and post-merge labeler share one queued concurrency group, so assignment cannot overlap the verification-and-delete window.
+
+Find the workflow run started by Step 3 and wait for it to finish:
 
 ```bash
-node --experimental-strip-types --no-warnings .agents/skills/nemoclaw-maintainer-day/scripts/bump-stragglers.ts <released-version> <next-version>
+RELEASE_SHA="<full-origin-main-sha>"
+mapfile -t RELEASE_RUN_IDS < <(
+  gh run list --repo NVIDIA/NemoClaw --workflow release-latest-tag.yaml --limit 20 \
+    --event push --commit "$RELEASE_SHA" --json databaseId --jq '.[].databaseId'
+)
+if (( ${#RELEASE_RUN_IDS[@]} != 1 )); then
+  echo "Expected exactly one release-latest-tag push run for $RELEASE_SHA" >&2
+  exit 1
+fi
+gh run watch "${RELEASE_RUN_IDS[0]}" --repo NVIDIA/NemoClaw --exit-status
 ```
 
-This is automatic post-tag housekeeping covered by the release plan and confirmation in Step 2. The script creates the next patch label when needed, removes the released-version label, and adds the next-version label to every open straggler. Do not run it before Step 4 verifies both the semver tag and workflow-managed `latest`.
+This automatic post-tag housekeeping is covered by the release plan and confirmation in Step 2. Do not run `scripts/retire-release-label.mts` directly; doing so would bypass the coordination boundary.
 
-Then verify the released version has no open stragglers:
+Then verify the released version label no longer exists:
 
 ```bash
-gh issue list --repo NVIDIA/NemoClaw --state open --label <released-version> --limit 100
-gh pr list --repo NVIDIA/NemoClaw --state open --label <released-version> --limit 100
+gh label list --repo NVIDIA/NemoClaw --search <released-version> --json name \
+  --jq '.[] | select(.name == "<released-version>")'
 ```
 
+The command must return no output. Never rename the released label into a future version; a future target must be a separately created label with its own GitHub identity.
+
 Summarize:
 
-- open issues/PRs bumped to `<next-version>`;
+- open issues/PRs moved to `<next-version>`;
+- released label deleted;
 - any items that need manual maintainer attention.
 
 ### Step 6: Generate Release-Note Data and Draft Markdown
@@ -235,7 +251,7 @@ If the Announcement is valid, return its URL with the release artifacts and mark
 - `latest` workflow fails or times out: report the workflow/status; do not move `latest` manually.
 - `latest` workflow rejects a rollback: keep `latest` unchanged, inspect the plan target commit, and regenerate the plan for the current `origin/main` tip if appropriate.
 - `lkg` changed: stop and escalate to a release admin.
-- Post-tag housekeeping fails: report the error and list items still carrying the released label. After the failure is fixed, rerun the same bump command; already-moved items no longer match the source label.
+- Post-tag housekeeping fails: report the workflow error and list items still carrying the released label. After the failure is fixed, rerun `release-latest-tag.yaml` with `<released-version>` through `workflow_dispatch`; the promotion and retirement steps are idempotent, already-moved items no longer match the source label, and an already-deleted released label is treated as success. Do not run the retirement script outside the workflow.
 - Announcement is not published yet: keep Step 7 in progress and return the draft path and suggested title; the tag and housekeeping remain complete.
 - Announcement title, category, body, or links are wrong: ask the maintainer to edit the existing Discussion, then verify the same URL again. Do not create a replacement. After three failed verification attempts for the same Discussion, stop and escalate to a release admin.
 - Announcement cannot be inspected: report the read failure and ask the maintainer to confirm access or provide a public URL; do not mark Step 8 complete.

.agents/skills/nemoclaw-maintainer-day/PR-REVIEW-PRIORITIES.md

@@ -38,10 +38,10 @@ The team follows a daily ship cycle. All maintainer skills operate within this r
 
 1. **Morning** (`/nemoclaw-maintainer-morning`) — triage the backlog, pick items for the day, label them with the target version (e.g., `v0.0.8`).
 2. **During the day** (`/nemoclaw-maintainer-day`) — land PRs using the maintainer loop. Version labels make progress visible on dashboards.
-3. **Evening** (`/nemoclaw-maintainer-evening`) — check what shipped, merge or explicitly waive the pre-tag release-note docs PR containing `docs/changelog/YYYY-MM-DD.mdx` for the target version, identify open stragglers, generate a QA-focused summary, freeze the candidate SHA, collect the E2E evidence or itemized maintainer exceptions required before confirmation, cut the tag, automatically bump stragglers to the next patch, and prepare the Announcement for posting.
+3. **Evening** (`/nemoclaw-maintainer-evening`) — check what shipped, merge or explicitly waive the pre-tag release-note docs PR containing `docs/changelog/YYYY-MM-DD.mdx` for the target version, identify open stragglers, generate a QA-focused summary, freeze the candidate SHA, collect the E2E evidence or itemized maintainer exceptions required before confirmation, cut the tag, automatically carry stragglers to the next patch, delete the released label, and prepare the Announcement for posting.
 4. **Overnight** — QA team (different timezone) performs additional validation of the tag. Any issues they file enter the next morning's triage like any other issue.
 
-Version labels activate release work; they are not readiness claims. If an open item misses the tag, its label moves to the next patch during post-tag housekeeping.
+Version labels activate release work; they are not readiness claims. If an open item misses the tag, its label moves to the next patch during post-tag housekeeping. After no open item remains, housekeeping deletes the released label; it never renames or reuses it.
 
 ## Explicitly not priorities
 

.agents/skills/nemoclaw-maintainer-evening/SKILL.md

@@ -6,7 +6,7 @@ user_invocable: true
 
 # NemoClaw Maintainer Evening
 
-Wrap up the day: check progress, identify stragglers, summarize for QA, cut the tag, automatically bump stragglers to the next patch, and prepare release notes for posting.
+Wrap up the day: check progress, identify stragglers, summarize for QA, cut the tag, automatically carry stragglers to the next patch, retire the released label, and prepare release notes for posting.
 
 See [PR-REVIEW-PRIORITIES.md](../nemoclaw-maintainer-day/PR-REVIEW-PRIORITIES.md) for the daily cadence.
 
@@ -28,7 +28,7 @@ gh issue list --repo NVIDIA/NemoClaw --state open --label <version> --limit 100
   --json number,title,url,labels
 ```
 
-List open labeled PRs and issues as the post-tag housekeeping plan. Tell the maintainer that, after the tag and workflow-managed `latest` are verified, `cut-release-tag` will automatically move all of them to the next patch label.
+List open labeled PRs and issues as the post-tag housekeeping plan. Tell the maintainer that, after the tag and workflow-managed `latest` are verified, `cut-release-tag` will automatically move all of them to the next patch label and delete the released label.
 
 If an item should leave the daily release flow instead of moving forward, remove it from the released-version label before asking for the release confirmation phrase.
 
@@ -50,7 +50,7 @@ If a docs PR or any other intended PR merges after `release:plan`, regenerate th
 
 ## Step 4: Cut the Tag and Publish Release Notes
 
-Load `cut-release-tag`. The version is already known — default to patch bump, but still show the commit, changelog, post-tag bump plan, and release notes draft for confirmation. After the release plan freezes the candidate SHA, review the pre-tag E2E evidence ledger derived from `.github/workflows/e2e.yaml` at that commit. Do not ask for the release confirmation phrase until every test has green evidence or an explicit itemized maintainer exception. NemoClaw releases are tag-based: tag the confirmed release commit with `vX.Y.Z`, let the workflow move `latest`, automatically bump remaining open issues/PRs to the next patch label, and prepare the release notes announcement for the maintainer to post.
+Load `cut-release-tag`. The version is already known — default to patch bump, but still show the commit, changelog, post-tag carry-forward and label-retirement plan, and release notes draft for confirmation. After the release plan freezes the candidate SHA, review the pre-tag E2E evidence ledger derived from `.github/workflows/e2e.yaml` at that commit. Do not ask for the release confirmation phrase until every test has green evidence or an explicit itemized maintainer exception. NemoClaw releases are tag-based: tag the confirmed release commit with `vX.Y.Z`, let the workflow move `latest`, automatically carry remaining open issues/PRs to the next patch label, delete the released label, and prepare the release notes announcement for the maintainer to post.
 
 ## Step 5: Confirm and Share
 
@@ -60,15 +60,16 @@ After the tag is cut and release notes are drafted or posted by the maintainer,
 - **Pre-tag E2E evidence**: 12/13 tests green for the candidate SHA; 1 itemized maintainer exception
 - **Release notes draft**: `../nemoclaw-release-v0.0.8/release-note-draft.md`
 - **Shipped**: 4 items (#1234, #1235, #1236, #1237)
-- **Bumped to v0.0.9**: 1 item (#1238 — still needs CI fix)
+- **Moved to v0.0.9**: 1 item (#1238 — still needs CI fix)
+- **Retired label**: `v0.0.8`
 - **QA focus areas**: installer changes, new onboard preset
 
 This summary can be shared in the team's handoff channel.
 
 ## Step 6: Update State
 
 ```bash
-node --experimental-strip-types --no-warnings .agents/skills/nemoclaw-maintainer-day/scripts/state.ts history "tag-cut" "<version>" "shipped N items, bumped M"
+node --experimental-strip-types --no-warnings .agents/skills/nemoclaw-maintainer-day/scripts/state.ts history "tag-cut" "<version>" "shipped N items, carried M forward"
 ```
 
 ## Notes
@@ -77,3 +78,4 @@ node --experimental-strip-types --no-warnings .agents/skills/nemoclaw-maintainer
 - If nothing was labeled or nothing shipped, ask whether to skip the tag today.
 - A PR version label activates release work; it is not a readiness claim.
 - If an open item misses the tag, post-tag housekeeping moves its target to the next patch version.
+- After carry-forward succeeds, post-tag housekeeping deletes the released label; never rename or reuse it.