docs(policy): state the hardened Nix ruling — flakes are removed, not tolerated

.github/workflows/governance-reusable.yml

@@ -559,7 +559,7 @@ jobs:
           echo "WASM, Rust, OCaml, Haskell, Guile/Scheme."
 
   package-policy:
-    name: Guix primary / Nix fallback policy
+    name: Guix packaging policy (Nix retired)
     runs-on: ${{ inputs.runs-on }}
     timeout-minutes: 10
     permissions:
@@ -591,7 +591,7 @@ jobs:
             scripts
           sparse-checkout-cone-mode: false
 
-      - name: Enforce Guix primary / Nix fallback
+      - name: Enforce Guix-only packaging policy
         run: |
           # Move the checker OUT of the scanned tree and delete the standards
           # checkout before scanning: the gate walks the whole caller tree, so

rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc

@@ -332,6 +332,24 @@ only where it is the *sole* source of a *specific named* dependency, and that
 dependency is documented as the reason. Supersedes the prior "Nix fallback
 everywhere" rule.
 
+HARDENED 2026-07-28 (owner ruling): **Nix is not deprecated-but-tolerated. It is
+removed.** Nix flakes are to be thrown out of the estate; Guix is the only
+packager. This is a standing instruction to act *opportunistically*: when you
+are working in a repo for any reason, strip Nix from it — `flake.nix`,
+`flake.lock`, and the *references* (direnv `use flake`, `nix-shell` recipes,
+Dependabot's `nix` ecosystem, package-manager detection branches, `.gitignore`
+and `.gitattributes` rules, docs). Do not wait for a dedicated sweep, and do not
+merely add the file to a root allowlist.
+
+WARNING — removal is not the whole job. A repo whose `guix.scm` is a scaffold
+stub (empty `inputs`, `TODO` markers, a `{{PROJECT_NAME}}` placeholder, or a
+name belonging to another project) has *no working packaging* once the flake is
+gone. As measured on 2026-07-27, roughly a quarter of the estate's `guix.scm`
+files are in that state, so **the presence of `guix.scm` is not evidence of
+packaging**. Retire the Nix mirror *and* make the Guix side real — or fill the
+sealed container, which is the sanctioned escape hatch and is verifiable with
+Podman where Guix is not installable.
+
 [cols="1,2"]
 |===
 | Priority | Tool

scripts/check-package-policy.sh

@@ -183,9 +183,15 @@ if [ -n "$NIX" ]; then
   echo "  guix.scm | manifest.scm | channels.scm | .guix-channel   (primary)"
   echo "  Containerfile                                            (escape hatch)"
   echo
-  echo "Do NOT simply delete the flake: a repo whose guix.scm is a scaffold stub"
+  echo "HARDENED 2026-07-28 (owner ruling): Nix is REMOVED from the estate, not"
+  echo "tolerated. Retire the flake opportunistically whenever you touch a repo."
+  echo
+  echo "But removal is not the whole job: a repo whose guix.scm is a scaffold stub"
   echo "has no working packaging once the flake is gone. Make the Guix side real"
-  echo "first, then retire the mirror (spec/scaffold-stub-debt.adoc, step 3)."
+  echo "(or fill the Containerfile, which is Podman-verifiable where Guix is not"
+  echo "installable) IN THE SAME CHANGE as retiring the mirror. Do not leave the"
+  echo "repo unpackaged, and do not allowlist the flake instead"
+  echo "(spec/scaffold-stub-debt.adoc, step 3)."
   exit 1
 fi