nx_toolreg_reap.nx

nx_toolreg_reap.nx -- REMOVE named scaffold rows from tool_allowlist.conf. The counterpart the registry never had: nx_toolreg_reconcile only ever ADDS (rows=830 registered=0 already=815), /api has a tools/register route and NO unregister, and nx_fs_write refuses the allowlist by construction -- correctly, since a tool that can EDIT the capability allowlist can GRANT ITSELF ANYTHING. So scaffold registrations accumulated forever with no sanctioned way to clear them (debt 1785976684). WHY THIS IS SAFE TO EXIST AT ALL, and why it is a separate organ rather than a verb on the registrar: this organ can ONLY REMOVE, never add and never rewrite a target. Removal is strictly DE-privileging -- the worst case is a tool stops being callable, which is a recoverable annoyance, whereas an organ that could add or repoint a row would be a privilege-granting oracle. Single responsibility is the security property here, not a style preference. FAIL-CLOSED PREDICATE: a row is reapable ONLY if its elf path ends in ".new" -- the staged-artifact shape that scaffold aliases have. A row pointing at a promoted ".elf" is REFUSED and reported, so a fat-fingered name can never unregister a live tool. Names are EXPLICIT: there is no wildcard sweep, because rows like nx_meshmerge_staged and nx_ccingest_r7 also point at .new and other seats depend on them. nx_toolreg_reap <name> [<name>...] | nx_toolreg_reap --list (show reapable rows, change nothing) license_tier: ORIGINAL expect_exit: 0