nx_retire_path.nx

nx_retire_path.nx -- the missing sovereign primitive: take a file or directory OUT of a served tree without ever deleting it. The estate had governance/atlas/debt sweeps but nothing that could retire a path, so scratch artifacts accumulated on PUBLIC surfaces and the only "fix" anyone had was ssh rm. SAFE BY CONSTRUCTION (mirrors the established md_promote_deny substring-deny pattern rather than inventing a new safety model): * NEVER deletes -- sys_renameat only, so the bytes survive and the move is reversible (rule 13). * moves INTO knowledge/retired/ (outside every docroot) so a retired path stops being served. * REFUSES: any path containing ".." (traversal), a shallow path -- the rule COUNTS SLASHES and needs at least 2, i.e. dir/subdir/file, so `knowledge/x.tsv` is REFUSED while `knowledge/status/x.tsv` is allowed. (The message used to say "must be >=2 segments deep", which names the wrong unit and reads as satisfied by the very path it rejects; corrected 2026-08-14 after it sent a caller hunting.) so it can never retire a whole docroot or a hub-root file), and any path whose name carries a dangerous substring (elf, key, cap, secret, opaque, .reg, .conf, daemon, serve, vault, mint). * REFUSES a target that does not exist -- a no-op must never look like a success. verbs: retire <path> | selftest expect_exit: 0 license_tier: ORIGINAL