code wiki / _hdl_build / nx_retire_path.nx
`nx_retire_path.nx` source

↩ module page · 524 lines · 32666 B
1// nx_retire_path.nx -- the missing sovereign primitive: take a file or directory OUT of a served tree
2// without ever deleting it. The estate had governance/atlas/debt sweeps but nothing that could retire a
3// path, so scratch artifacts accumulated on PUBLIC surfaces and the only "fix" anyone had was ssh rm.
4//
5// SAFE BY CONSTRUCTION (mirrors the established md_promote_deny substring-deny pattern rather than
6// inventing a new safety model):
7//   * NEVER deletes -- sys_renameat only, so the bytes survive and the move is reversible (rule 13).
8//   * moves INTO knowledge/retired/ (outside every docroot) so a retired path stops being served.
9//   * REFUSES: any path containing ".." (traversal), a shallow path -- the rule COUNTS SLASHES and needs
10//     at least 2, i.e. dir/subdir/file, so `knowledge/x.tsv` is REFUSED while `knowledge/status/x.tsv` is
11//     allowed. (The message used to say "must be >=2 segments deep", which names the wrong unit and reads
12//     as satisfied by the very path it rejects; corrected 2026-08-14 after it sent a caller hunting.)
13//     so it can never retire a whole docroot or a hub-root file), and any path whose name carries a
14//     dangerous substring (elf, key, cap, secret, opaque, .reg, .conf, daemon, serve, vault, mint).
15//   * REFUSES a target that does not exist -- a no-op must never look like a success.
16//   verbs: retire <path> | selftest
17// expect_exit: 0  license_tier: ORIGINAL
18import "nx_syscalls.nx"
19import "nx_emit_guard.nx"
20
21const RP_NAMEBUF: i64 = 1024
22
23func rt_say(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
24func rt_num(v: i64) -> i64 { if v == 0 { sys_write(1, "0" as *u8, 1); return 0 } var m: i64 = v; if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m } let t: *u8 = sys_mmap(28); var k: i64 = 0; while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } while k > 0 { k = k - 1; sys_write(1, (((t as i64) + k) as *u8), 1) } return 0 }
25
26func rt_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
27// case-sensitive substring test (the deny list is lowercase and so are our paths)
28func rt_has(s: *u8, lit: *u8) -> i64 {
  let sl: i64 = rt_len(s)
  let ll: i64 = rt_len(lit)
  if ll == 0 { return 0 }
  var i: i64 = 0
  while i + ll <= sl {
      var j: i64 = 0
      var ok: i64 = 1
      while j < ll { if s[i + j] != lit[j] { ok = 0; j = ll } else { j = j + 1 } }
      if ok == 1 { return 1 }
      i = i + 1
  }
  return 0
41}
42// does s end with lit? (suffix test -- the staged-artifact exception below is a SUFFIX rule, never a
43// substring rule: a substring test would also match a LIVE path that merely mentions '.elf.new')
44func rt_ends(s: *u8, lit: *u8) -> i64 {
  let sl: i64 = rt_len(s)
  let ll: i64 = rt_len(lit)
  if ll == 0 { return 0 }
  if ll > sl { return 0 }
  var i: i64 = 0
  while i < ll { if s[sl - ll + i] != lit[i] { return 0 } i = i + 1 }
  return 1
52}
53// SECRET-MATERIAL guards, applied to EVERY path including the staged-artifact exception. These are the
54// checks that protect CREDENTIALS; they are deliberately separate from the artifact-TYPE checks (.elf/
55// .conf/.reg) and the depth rule, because those two protect LIVE-SERVING paths -- a distinction the
56// staged exception depends on.
57// ONE TABLE, EVERY READER. The deny tokens were written out THREE times: in rt_refuse_secret, in
58// rt_refuse, and as PROSE inside rt_reason's code-4 message. The prose copy drifted -- it listed 9 tokens
59// while the predicate checked 11, and the two it omitted (`daemon`, `serve`) are precisely the ones that
60// fired on a real caller. That caller read "protected name (.elf .key .cap .conf .reg secret opaque vault
61// mint)", found NONE of them in `buildroot/runtime/nx_servedrift.nx`, and reasonably wrote the guard up as
62// broken. It was not: `nx_servedrift` contains `serve`, and refusing it is CORRECT.
63// ★★★★★★A CORRECT REFUSAL WEARING AN INCOMPLETE REASON IS THE MOST EXPENSIVE FAILURE SHAPE THERE IS --
64// IT SPENDS THE READER'S TRUST ON A DECISION THAT WAS RIGHT, AND TEACHES THEM TO ROUTE AROUND THE GUARD.
65// ★★★★★THE EARLIER DRY FIX WENT ONE LEVEL TOO SHALLOW: it derived the code->message MAP from the code and
66// left the MESSAGE reciting a hand-maintained copy of the predicate's own terms. Deriving the map buys
67// nothing while the leaf is still duplicated -- and this organ's header ALREADY required a refusal to name
68// WHICH rule fired rather than recite every rule it might have applied. Code 4 recited nine and named none.
69static rt_hit: *u8
70
71func rt_deny_n() -> i64 { return 11 }
72func rt_deny_tok(i: i64) -> *u8 {
  if i == 0 { return ".elf" as *u8 }
  if i == 1 { return ".key" as *u8 }
  if i == 2 { return ".cap" as *u8 }
  if i == 3 { return ".conf" as *u8 }
  if i == 4 { return ".reg" as *u8 }
  if i == 5 { return "secret" as *u8 }
  if i == 6 { return "opaque" as *u8 }
  if i == 7 { return "vault" as *u8 }
  if i == 8 { return "mint" as *u8 }
  if i == 9 { return "daemon" as *u8 }
  if i == 10 { return "serve" as *u8 }
  return "" as *u8
85}
86// The SECRET subset protects CREDENTIALS and applies to EVERY path INCLUDING the staged-artifact
87// exception; the rest protect LIVE-SERVING paths, which the staged exception deliberately bypasses.
88// Keeping that split as a COLUMN of one table, rather than as a second hand-written list, is what stops
89// the two from drifting apart again.
90func rt_deny_is_secret(i: i64) -> i64 {
  if i == 1 { return 1 }
  if i == 2 { return 1 }
  if i == 5 { return 1 }
  if i == 6 { return 1 }
  if i == 7 { return 1 }
  if i == 8 { return 1 }
  return 0
98}
99func rt_refuse_secret(path: *u8) -> i64 {
  var i: i64 = 0
  while i < rt_deny_n() {
      if rt_deny_is_secret(i) == 1 {
          if rt_has(path, rt_deny_tok(i)) == 1 { rt_hit = rt_deny_tok(i); return 4 }
      }
      i = i + 1
  }
  return 0
108}
109// prefix test -- needed by the DIRECTORY lane below, which refuses served roots by prefix rather than by
110// depth, because for a directory the blast radius of a wrong call is a whole site rather than one file.
111func rt_starts(s: *u8, lit: *u8) -> i64 {
  var i: i64 = 0
  while lit[i] != (0 as u8) {
      if s[i] != lit[i] { return 0 }
      i = i + 1
  }
  return 1
118}
119func rt_slashes(s: *u8) -> i64 {
  var c: i64 = 0
  var i: i64 = 0
  while s[i] != (0 as u8) { if s[i] == (47 as u8) { c = c + 1 } i = i + 1 }
  return c
124}
125const RT_COMPARE_ROOT: *u8 = "sites/nishifamily/compare/"
126const RT_COMPARE_MIN_SLASHES: i64 = 4
127const RT_SLASH: i64 = 47
128// 0 = allowed, otherwise a refusal code naming the reason
129func rt_refuse(path: *u8) -> i64 {
  if rt_len(path) < 3 { return 1 }
  if rt_has(path, ".." as *u8) == 1 { return 2 }
  // ---- STAGED-ARTIFACT EXCEPTION (2026-08-03, debt 1785771205) ----------------------------------
  // WHY IT IS SAFE, not a loosened guard: `<name>.elf.new` is a STAGED artifact. The LIVE binary is
  // `<name>.elf` (or the extensionless `<name>`), so a `.elf.new` is BY CONSTRUCTION not serving any
  // request -- retiring one can never stop a running service, which is exactly what the depth rule and
  // the `.elf` name rule exist to prevent. Those two guards protect LIVE-SERVING paths; they were
  // ALSO, as a side effect, making the estate's 512 stray staged artifacts unretirable -- including a
  // 202,843 B `nx_hostctl.elf.new` sitting in the SUPERVISOR's deploy slot matching neither the live
  // binary nor any source build. A guard that blocks the cleanup of the very hazard class it cannot
  // see is protecting the wrong noun.
  // SUFFIX, never substring: a live path that merely CONTAINS '.elf.new' is not exempted.
  // Secret-material checks STILL APPLY (a `*.key.new` stays refused), and rename-not-delete means the
  // bytes survive in knowledge/retired/ -- so a staged artifact retired in error is restorable.
  if rt_ends(path, ".elf.new" as *u8) == 1 { return rt_refuse_secret(path) }
  // ...and the BANKED twin. /api/build now renames an existing staged artifact to `<t>.sov.elf.new.prev`
  // before recompiling (debt 1785772241) -- a remedy that CREATES artifacts must also create the means to
  // sweep them, or the fix becomes the next litter source. Same reasoning as above: a banked staged copy
  // is even further from live than the staged one, so it can never be serving anything.
  if rt_ends(path, ".elf.new.prev" as *u8) == 1 { return rt_refuse_secret(path) }
  // ---- SERVING-ROOT SOURCE-STRAY EXCEPTION (2026-08-17) ------------------------------------------
  // WHY IT IS SAFE, not a loosened guard: `runtime/<name>.nx` at exactly ONE slash is NishiLang SOURCE
  // in the SERVING root. Source is never served and never executed from this tree -- the build lane is
  // buildroot-anchored (nx_sov_build_run chdirs to buildroot/), so the only resolver that can ever see
  // such a file is a CWD-rooted one: the shadow-resolution defect class adjudicated 2026-08-17
  // (ep_src_path was made buildroot-anchored-by-construction for exactly this reason). Retiring one can
  // never stop a running service; LEAVING one arms the trap where a nishihost-CWD caller silently
  // compiles a different file than the build lane. Measured population when written: 8 stray sources,
  // each byte-identical to its buildroot twin or an adjudicated probe stub.
  // STATED IMPRECISION: unlike the staged lane this walk applies the FULL deny-token table (source can
  // be named anything), so a stray whose NAME carries a protected token (e.g. nx_servedrift.nx) stays
  // unretirable here -- over-refusal is the direction that costs a stray, never a service.
  if rt_slashes(path) == 1 { if rt_starts(path, "runtime/" as *u8) == 1 { if rt_ends(path, ".nx" as *u8) == 1 {
      var sd: i64 = 0
      while sd < rt_deny_n() {
          if rt_has(path, rt_deny_tok(sd)) == 1 { rt_hit = rt_deny_tok(sd); return 4 }
          sd = sd + 1
      }
      return 0
  } } }
  // ---- COMPARE-BOARD PAGE EXCEPTION (2026-09-16) --------------------------------------------------
  // WHY IT IS SAFE, not a loosened guard: a file under sites/nishifamily/compare/<board>/ is a PAGE the /compare
  // gateway reads from disk; no daemon runs from that tree, so retiring one can never stop a service. The <board>
  // segment is a DOMAIN NAME from regen.list -- a data word -- and the token table read it as a material type:
  // `cleanserve` carries `serve`, so a 60-day-old copy of an earlier radar page, sitting as a regular FILE exactly
  // where the generator must create cleanserve/frontier/, could never be retired, and every full regen published
  // RED on it (RECEIPT-TRANSACTION-FAIL syscall=-20, ENOTDIR). The FULL token table still applies to everything
  // BELOW the board segment (compare/<board>/x.elf, compare/<board>/nx_media_serve stay refused), the SECRET subset
  // still applies to the WHOLE path (a board segment carrying vault or mint stays refused), traversal was refused
  // above, and only a file below a board enters: the board directory and the compare root carry too few slashes.
  // STATED IMPRECISION: the prefix is the nishifamily compare docroot by name; a second compare docroot would need
  // its own row, and until then it stays in the stricter general lane (over-refusal, never a service).
  if rt_starts(path, RT_COMPARE_ROOT) == 1 { if rt_slashes(path) >= RT_COMPARE_MIN_SLASHES {
      let csec: i64 = rt_refuse_secret(path)
      if csec != 0 { return csec }
      var bend: i64 = rt_len(RT_COMPARE_ROOT)
      while path[bend] != (0 as u8) { if path[bend] == (RT_SLASH as u8) { break } bend = bend + 1 }
      let below: *u8 = (path as i64 + bend + 1) as *u8
      var cd: i64 = 0
      while cd < rt_deny_n() {
          if rt_has(below, rt_deny_tok(cd)) == 1 { rt_hit = rt_deny_tok(cd); return 4 }
          cd = cd + 1
      }
      return 0
  } }
  if rt_slashes(path) < 2 { return 3 }
  var d: i64 = 0
  while d < rt_deny_n() {
      if rt_has(path, rt_deny_tok(d)) == 1 { rt_hit = rt_deny_tok(d); return 4 }
      d = d + 1
  }
  return 0
202}
203// ---- THE DIRECTORY LANE (2026-08-15) ---------------------------------------------------------------
204// WHY IT EXISTS: the file rule COUNTS SLASHES and needs >=2 (dir/subdir/file), which is right for files
205// and leaves a whole class unreachable -- an accidental orphan DIRECTORY is created at exactly
206// `knowledge/<name>`, one slash, so the organ that exists to clean up stray artifacts could not touch the
207// commonest stray shape. Measured this session: a 235-file 9.7 MB duplicate mirror sat at
208// knowledge/gfxmirror with no lane to retire it, and an unreferenced tree is not merely wasted disk --
209// every reachability question asked over the tree silently consumes it as if it were a registry.
210//
211// WHY IT IS NOT A LOOSENED GUARD. It is strictly NARROWER than the file lane in the direction that
212// matters, and it borrows the estate's own established idiom for a removal that cannot be undone by
213// guessing: TWO NAMES. nx_toolreg's removal verb takes `<name> <by>` precisely so one name is never
214// enough, and the same reasoning applies with more force here, because a directory carries everything
215// beneath it. Every existing protection still applies unchanged -- traversal, the full 11-token protected
216// table, secret material, must-exist, and rename-never-delete.
217//   * REFUSES a bare top-level name (zero slashes): `knowledge` can never be retired.
218//   * REFUSES anything under a SERVED root by prefix. A directory under sites/ is a site or part of one,
219//     and the cost of being wrong there is a whole surface going dark, so the directory lane simply does
220//     not go there. That is a STATED limitation, not an oversight: retiring inside a docroot stays a
221//     file-at-a-time operation where the existing >=2 rule already applies.
222//   * REFUSES unless the confirmation name is byte-identical to the path.
223const RT_SERVED_ROOT: *u8 = "sites/"
224
225func rt_same(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) {
      if a[i] != b[i] { return 0 }
      i = i + 1
  }
  if b[i] != (0 as u8) { return 0 }
  return 1
233}
234
235func rt_refuse_dir(path: *u8, confirm: *u8) -> i64 {
  if rt_len(path) < 3 { return 1 }
  if rt_has(path, ".." as *u8) == 1 { return 2 }
  if rt_slashes(path) < 1 { return 6 }
  if rt_starts(path, RT_SERVED_ROOT) == 1 { return 5 }
  var d: i64 = 0
  while d < rt_deny_n() {
      if rt_has(path, rt_deny_tok(d)) == 1 { rt_hit = rt_deny_tok(d); return 4 }
      d = d + 1
  }
  // the two-name check runs LAST so a caller who mistyped a PROTECTED path still learns which rule
  // protects it, rather than being told only that their confirmation did not match.
  if rt_same(path, confirm) == 0 { return 7 }
  return 0
249}
250
251// flatten "a/b/c" -> "a_b_c" into dst
252func rt_flatten(dst: *u8, src: *u8) -> i64 {
  var o: i64 = 0
  var i: i64 = 0
  while src[i] != (0 as u8) {
      if src[i] == (47 as u8) { dst[o] = 95 as u8 } else { dst[o] = src[i] }
      o = o + 1
      i = i + 1
  }
  return o
261}
262func rt_cat(dst: *u8, off: i64, s: *u8) -> i64 {
  var o: i64 = off
  var i: i64 = 0
  while s[i] != (0 as u8) { dst[o] = s[i]; o = o + 1; i = i + 1 }
  return o
267}
268
269// ONE PLACE NAMES EACH REFUSAL, AND THE MESSAGE READS IT.
270// The refusal used to print a hand-maintained "1=... 2=... 3=... 4=..." list beside rt_refuse's codes:
271// two parallel lists, so adding a code left the message silently lying, and correcting the WORDING (as was
272// done earlier today, after code 3 named the wrong unit and sent a caller hunting) does nothing to stop the
273// next drift. ★★★A MESSAGE MAINTAINED BESIDE THE PREDICATE IT DESCRIBES IS A DUPLICATE RULER; DERIVE IT
274// FROM THE CODE AND THERE IS ONE PLACE TO GET IT RIGHT.
275// It also prints ONLY the rule that actually fired -- the estate's own law that a refusal must say WHICH
276// rule refused, not recite every rule it might have applied.
277// ★UNKNOWN IS ITS OWN BUCKET and it accuses THIS ORGAN, not the caller's path: if rt_refuse ever returns a
278// code rt_reason does not name, the drift ANNOUNCES itself instead of mislabelling the refusal as one of
279// the codes it happens to sit near.
280func rt_reason(code: i64) -> *u8 {
  if code == 1 { return "path too short to be a real artifact" as *u8 }
  if code == 2 { return "traversal -- the path contains .." as *u8 }
  if code == 3 { return "too shallow -- needs >=2 slashes (dir/subdir/file), so a file sitting directly inside a top-level dir is refused" as *u8 }
  if code == 4 { return "protected name -- live/serving or secret material; the token that fired is named as token= below" as *u8 }
  if code == 5 { return "directory lane refuses a SERVED root -- a directory under sites/ is a site or part of one, and retiring it would take a whole surface dark; retire inside a docroot one file at a time" as *u8 }
  if code == 6 { return "directory lane needs >=1 slash -- a bare top-level name like knowledge can never be retired" as *u8 }
  if code == 7 { return "confirmation name does not match the path -- retiredir takes the path TWICE on purpose, so one name is never enough to move a whole tree" as *u8 }
  return "UNRECOGNISED CODE -- rt_refuse returned a code rt_reason does not name. That is a defect in THIS ORGAN, not in the path you gave it." as *u8
289}
290
291// returns 0 on success; prints the refusal and returns nonzero otherwise
292func rt_retire(path: *u8) -> i64 {
  let why: i64 = rt_refuse(path)
  if why != 0 {
      rt_say("RETIRE-REFUSED code=" as *u8); rt_num(why)
      rt_say(" path=" as *u8); rt_say(path)
      rt_say(" reason=" as *u8); rt_say(rt_reason(why))
      // NAME THE RULE THAT FIRED, NOT THE SET IT BELONGS TO. ★UNKNOWN IS ITS OWN BUCKET and it accuses
      // THIS ORGAN: a code 4 that reached here without recording a token is a defect in rt_refuse, and
      // saying so is strictly better than printing a plausible token nobody verified fired.
      if why == 4 {
          rt_say(" token=" as *u8)
          if (rt_hit as i64) == 0 { rt_say("UNRECORDED -- defect in THIS ORGAN: rt_refuse returned 4 without recording which token matched" as *u8) } else { rt_say(rt_hit) }
      }
      rt_say("\n" as *u8)
      return why
  }
  if eg_have(path) == 0 {
      // a no-op must never look like a success
      rt_say("RETIRE-ABSENT path=" as *u8); rt_say(path); rt_say("\n" as *u8)
      return 9
  }
  sys_mkdir("knowledge/retired" as *u8, 493)
  let dst: *u8 = eg_buf(RP_NAMEBUF, "retire destination" as *u8)
  var o: i64 = rt_cat(dst, 0, "knowledge/retired/" as *u8)
  o = o + rt_flatten((((dst as i64) + o) as *u8), path)
  o = rt_cat(dst, o, "-" as *u8)
  // stamp so repeated retires of the same name never collide
  var ts: i64 = sys_now_realtime_sec()
  let tb: *u8 = eg_buf(32, "retire stamp" as *u8)
  var k: i64 = 0
  while ts > 0 { tb[k] = (48 + (ts % 10)) as u8; ts = ts / 10; k = k + 1 }
  while k > 0 { k = k - 1; dst[o] = tb[k]; o = o + 1 }
  dst[o] = 0 as u8
  let rc: i64 = sys_renameat(path, dst)
  if rc != 0 {
      rt_say("RETIRE-FAIL rename rc=" as *u8); rt_num(rc)
      rt_say(" path=" as *u8); rt_say(path); rt_say("\n" as *u8)
      return 3
  }
  rt_say("{\"organ\":\"nx_retire_path\",\"v\":1,\"retired\":\"" as *u8); rt_say(path)
  rt_say("\",\"to\":\"" as *u8); rt_say(dst)
  rt_say("\",\"deleted\":0,\"reversible\":1}\n" as *u8)
  return 0
335}
336
337// The directory twin of rt_retire. Same rename-never-delete move, same stamped destination, so a tree
338// retired in error is restored by renaming it back -- the bytes are never at risk.
339func rt_retiredir(path: *u8, confirm: *u8) -> i64 {
  let why: i64 = rt_refuse_dir(path, confirm)
  if why != 0 {
      rt_say("RETIREDIR-REFUSED code=" as *u8); rt_num(why)
      rt_say(" path=" as *u8); rt_say(path)
      rt_say(" reason=" as *u8); rt_say(rt_reason(why))
      if why == 4 {
          rt_say(" token=" as *u8)
          if (rt_hit as i64) == 0 { rt_say("UNRECORDED -- defect in THIS ORGAN" as *u8) } else { rt_say(rt_hit) }
      }
      rt_say("\n" as *u8)
      return why
  }
  if eg_have(path) == 0 {
      rt_say("RETIREDIR-ABSENT path=" as *u8); rt_say(path); rt_say("\n" as *u8)
      return 9
  }
  sys_mkdir("knowledge/retired" as *u8, 493)
  let dst: *u8 = eg_buf(RP_NAMEBUF, "retiredir destination" as *u8)
  var o: i64 = rt_cat(dst, 0, "knowledge/retired/" as *u8)
  o = o + rt_flatten((((dst as i64) + o) as *u8), path)
  o = rt_cat(dst, o, "-" as *u8)
  var ts: i64 = sys_now_realtime_sec()
  let tb: *u8 = eg_buf(32, "retiredir stamp" as *u8)
  var k: i64 = 0
  while ts > 0 { tb[k] = (48 + (ts % 10)) as u8; ts = ts / 10; k = k + 1 }
  while k > 0 { k = k - 1; dst[o] = tb[k]; o = o + 1 }
  dst[o] = 0 as u8
  let rc: i64 = sys_renameat(path, dst)
  if rc != 0 {
      rt_say("RETIREDIR-FAIL rename rc=" as *u8); rt_num(rc)
      rt_say(" path=" as *u8); rt_say(path); rt_say("\n" as *u8)
      return 3
  }
  rt_say("{\x22organ\x22:\x22nx_retire_path\x22,\x22v\x22:1,\x22retireddir\x22:\x22" as *u8); rt_say(path)
  rt_say("\x22,\x22to\x22:\x22" as *u8); rt_say(dst)
  rt_say("\x22,\x22deleted\x22:0,\x22reversible\x22:1}\n" as *u8)
  return 0
377}
378
379func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 {
      rt_say("usage: nx_retire_path {retire <path> | selftest}\n" as *u8)
      rt_say("  moves a path into knowledge/retired/ (never deletes; bytes preserved, reversible)\n" as *u8)
      sys_exit(2)
      return 2
  }
  let verb: *u8 = argv[1] as *u8
  if rt_has(verb, "selftest" as *u8) == 1 {
      var fails: i64 = 0
      // the refusals are the whole safety story, so they are what the selftest proves
      if rt_refuse("nx_mgmt_api.elf" as *u8) == 0 { fails = fails + 1 }
      if rt_refuse("tools_cap_secret.key" as *u8) == 0 { fails = fails + 1 }
      if rt_refuse("sites/../../etc/passwd" as *u8) == 0 { fails = fails + 1 }
      if rt_refuse("daemons.reg" as *u8) == 0 { fails = fails + 1 }
      if rt_refuse("sites" as *u8) == 0 { fails = fails + 1 }
      if rt_refuse("sites/nishifamily" as *u8) == 0 { fails = fails + 1 }
      if rt_refuse("nx_sites_daemon_v2.elf" as *u8) == 0 { fails = fails + 1 }
      // and a legitimate scratch path must be ALLOWED (a guard that refuses everything is useless)
      if rt_refuse("sites/nishifamily/factory/gen-coffee/d1" as *u8) != 0 { fails = fails + 1 }
      if rt_refuse("knowledge/status/uigen_tabprobe.txt" as *u8) != 0 { fails = fails + 1 }
      // ---- STAGED-ARTIFACT EXCEPTION: it must ADMIT the hazard class and REFUSE every neighbour ----
      // ADMIT: root-level staged elfs (both staging shapes) -- the 512-strong stray class
      if rt_refuse("nx_hostctl.elf.new" as *u8) != 0 { fails = fails + 1 }
      if rt_refuse("nx_daemon_supervisor.sov.elf.new" as *u8) != 0 { fails = fails + 1 }
      // ADMIT the BANKED twin that /api/build's new anti-clobber bank creates (debt 1785772241)
      if rt_refuse("nx_tool_argecho.sov.elf.new.prev" as *u8) != 0 { fails = fails + 1 }
      // REFUSE a LIVE .prev -- promote/deploy bank the RUNNING binary under this name, and that copy is
      // the rollback source. Only the STAGED lineage (.elf.new.prev) is exempt, never `<name>.elf.prev`.
      if rt_refuse("nx_mgmt_api.elf.prev" as *u8) == 0 { fails = fails + 1 }
      // REFUSE: the LIVE binary of the same organ (the one-character difference that matters most)
      if rt_refuse("nx_hostctl.elf" as *u8) == 0 { fails = fails + 1 }
      // REFUSE: staged SECRET material -- the secret guards survive the exception
      if rt_refuse("tools_cap_secret.key.new" as *u8) == 0 { fails = fails + 1 }
      if rt_refuse("opaque_keys.bin.elf.new" as *u8) == 0 { fails = fails + 1 }
      // REFUSE: traversal is never exempted, even wearing the staged suffix
      if rt_refuse("../../etc/evil.elf.new" as *u8) == 0 { fails = fails + 1 }
      // REFUSE: SUFFIX not substring -- a live path merely CONTAINING the marker is not exempt
      if rt_refuse("nx_thing.elf.new.elf" as *u8) == 0 { fails = fails + 1 }
      // ---- SOURCE-STRAY EXCEPTION (2026-08-17): ADMIT the shadow class, REFUSE every neighbour ----
      // ADMIT: a one-slash serving-root source -- the measured shadow class this lane exists for
      if rt_refuse("runtime/nx_regdup.nx" as *u8) != 0 { fails = fails + 1 }
      // REFUSE: same depth, not source -- an artifact wearing runtime/ is not exempted
      if rt_refuse("runtime/nx_regdup.elf" as *u8) == 0 { fails = fails + 1 }
      // REFUSE + NAME: the full token table survives this exception (unlike the staged lane)
      if rt_refuse("runtime/nx_servedrift.nx" as *u8) != 4 { fails = fails + 1 }
      if rt_has(rt_hit, "serve" as *u8) != 1 { fails = fails + 1 }
      // REFUSE: the prefix is `runtime/` exactly -- a sibling dir cannot borrow the lane
      if rt_refuse("myruntime/nx_regdup.nx" as *u8) == 0 { fails = fails + 1 }
      // REFUSE: traversal is never exempted in any lane
      if rt_refuse("runtime/../nx_regdup.nx" as *u8) == 0 { fails = fails + 1 }
      // ---- COMPARE-BOARD PAGE EXCEPTION (2026-09-16): ADMIT a page below a board whose NAME carries a token ----
      // ADMIT: the exact stale page that held every full regen RED
      if rt_refuse("sites/nishifamily/compare/cleanserve/frontier" as *u8) != 0 { fails = fails + 1 }
      // REFUSE + NAME: the full table still applies below the board segment
      if rt_refuse("sites/nishifamily/compare/cleanserve/nx_media_serve" as *u8) != 4 { fails = fails + 1 }
      if rt_has(rt_hit, "serve" as *u8) != 1 { fails = fails + 1 }
      if rt_refuse("sites/nishifamily/compare/search/nx_thing.elf" as *u8) != 4 { fails = fails + 1 }
      // REFUSE: the secret subset still applies to the WHOLE path, board segment included
      if rt_refuse("sites/nishifamily/compare/vaultboard/index.html" as *u8) != 4 { fails = fails + 1 }
      if rt_has(rt_hit, "vault" as *u8) != 1 { fails = fails + 1 }
      // REFUSE: the board directory itself never enters the lane (too few slashes, general table fires)
      if rt_refuse("sites/nishifamily/compare/cleanserve" as *u8) != 4 { fails = fails + 1 }
      // REFUSE: the prefix is exact -- a sibling tree and a lookalike root cannot borrow the lane
      if rt_refuse("sites/nishifamily/cleanserve/frontier" as *u8) != 4 { fails = fails + 1 }
      if rt_refuse("sites/nishifamily/compareX/cleanserve/frontier" as *u8) != 4 { fails = fails + 1 }
      // REFUSE: traversal is never exempted in any lane
      if rt_refuse("sites/nishifamily/compare/cleanserve/../../x" as *u8) != 2 { fails = fails + 1 }
      // absent target must not report success
      if rt_retire("sites/nishifamily/factory/definitely-not-here-xyz" as *u8) != 9 { fails = fails + 1 }
      // and an absent STAGED artifact must also refuse (the exception must not fake a success)
      if rt_retire("nx_definitely_not_staged_xyz.elf.new" as *u8) != 9 { fails = fails + 1 }
      // ---- THE REFUSAL MUST NAME THE RULE THAT FIRED (regression, 2026-08-15) -------------------
      // The exact caller path that exposed the drift. It MUST refuse -- `nx_servedrift` contains `serve`.
      if rt_refuse("buildroot/runtime/nx_servedrift.nx" as *u8) != 4 { fails = fails + 1 }
      // ANTI-VACUITY: refusing is NOT enough. A guard that refuses correctly while naming the wrong rule
      // passes every refuse-only test -- which is precisely how the 9-vs-11 drift survived. Assert the
      // ORGAN NAMED THE TOKEN, not merely that it said no.
      if rt_len(rt_hit) != 5 { fails = fails + 1 }
      if rt_has(rt_hit, "serve" as *u8) != 1 { fails = fails + 1 }
      // the OTHER token the stale message omitted -- proven reachable AND correctly named
      if rt_refuse("sites/nishifamily/nx_daemon_notes.txt" as *u8) != 4 { fails = fails + 1 }
      if rt_has(rt_hit, "daemon" as *u8) != 1 { fails = fails + 1 }
      // neg-control-reason-naming: an ALLOWED path must still be allowed after all that token traffic,
      // so the naming machinery cannot have turned the guard into one that refuses everything.
      if rt_refuse("knowledge/status/uigen_tabprobe.txt" as *u8) != 0 { fails = fails + 1 }
      // ---- THE DIRECTORY LANE (2026-08-15) -----------------------------------------------------
      // REFUSE a bare top-level name: the commonest catastrophic typo, and the one the file rule's
      // slash count was really protecting against.
      if rt_refuse_dir("knowledge" as *u8, "knowledge" as *u8) != 6 { fails = fails + 1 }
      // REFUSE a SERVED root and anything under it -- by PREFIX, so depth cannot buy a way in.
      if rt_refuse_dir("sites/nishifamily" as *u8, "sites/nishifamily" as *u8) != 5 { fails = fails + 1 }
      if rt_refuse_dir("sites/nishifamily/world" as *u8, "sites/nishifamily/world" as *u8) != 5 { fails = fails + 1 }
      // REFUSE traversal, which is never exempted in either lane
      if rt_refuse_dir("knowledge/../../etc" as *u8, "knowledge/../../etc" as *u8) != 2 { fails = fails + 1 }
      // REFUSE protected material -- the full token table still applies to directories
      if rt_refuse_dir("knowledge/opaque_store" as *u8, "knowledge/opaque_store" as *u8) != 4 { fails = fails + 1 }
      if rt_refuse_dir("knowledge/daemon_logs" as *u8, "knowledge/daemon_logs" as *u8) != 4 { fails = fails + 1 }
      // ★THE TWO-NAME CONFIRMATION IS THE POINT: the SAME path that is allowed with a matching
      // confirmation must be REFUSED when the confirmation differs by one character. Without this
      // tooth the second argument would be decoration.
      if rt_refuse_dir("knowledge/gfxmirror" as *u8, "knowledge/gfxmirro" as *u8) != 7 { fails = fails + 1 }
      if rt_refuse_dir("knowledge/gfxmirror" as *u8, "knowledge/gfxmirrorx" as *u8) != 7 { fails = fails + 1 }
      // neg-control-dir-allow: a guard that refuses everything passes every refusal tooth above, so a
      // legitimate orphan directory with a MATCHING confirmation must be ALLOWED.
      if rt_refuse_dir("knowledge/gfxmirror" as *u8, "knowledge/gfxmirror" as *u8) != 0 { fails = fails + 1 }
      // an absent directory must not report success
      if rt_retiredir("knowledge/definitely-not-here-xyz" as *u8, "knowledge/definitely-not-here-xyz" as *u8) != 9 { fails = fails + 1 }
      // NO UNREACHABLE ROWS: every table entry must be a real token, so the table can never grow a row
      // the predicate cannot fire on or the message cannot name.
      var ti: i64 = 0
      while ti < rt_deny_n() {
          if rt_len(rt_deny_tok(ti)) == 0 { fails = fails + 1 }
          ti = ti + 1
      }
      rt_say("NX-RETIRE-PATH selftest fails=" as *u8); rt_num(fails)
      // ★THE VERDICT LINE DOES NOT RECITE COUNTS. The old one hand-maintained "12 protected paths / 4
      // retirable / 2 absent" beside the teeth -- the SAME duplicate-ruler defect this session came here
      // to fix, one line below the fix. Adding a tooth silently made it lie.
      if fails == 0 { rt_say(" verdict=GREEN (all refusal, allow, staged-exception and reason-naming teeth passed)\n" as *u8); sys_exit(0); return 0 }
      rt_say(" verdict=RED\n" as *u8)
      sys_exit(1)
      return 1
  }
  // EXACT verb match, never substring: `retire` is a prefix of `retiredir`, so a substring test would
  // route every retiredir call into the file lane and refuse it for the wrong reason.
  if rt_same(verb, "retiredir" as *u8) == 1 {
      if argc < 4 {
          rt_say("usage: nx_retire_path retiredir <path> <same-path-again>\n" as *u8)
          rt_say("  the path is required TWICE on purpose -- one name is never enough to move a whole tree\n" as *u8)
          sys_exit(2)
          return 2
      }
      let drc: i64 = rt_retiredir(argv[2] as *u8, argv[3] as *u8)
      sys_exit(drc)
      return drc
  }
  if argc < 3 {
      rt_say("usage: nx_retire_path {retire <path> | retiredir <path> <path> | selftest}\n" as *u8)
      sys_exit(2)
      return 2
  }
  let rc: i64 = rt_retire(argv[2] as *u8)
  sys_exit(rc)
  return rc
524}
nx_retire_path.nx source

`nx_retire_path.nx` source
