diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt
index 2436e1c..c06a590 100644
--- a/.machine_readable/root-allow.txt
+++ b/.machine_readable/root-allow.txt
@@ -22,6 +22,7 @@ MAINTAINERS.adoc           # maintainer roster
 CONTRIBUTING.md            # REQUIRED AT ROOT by scorecard-enforcer/openssf-compliance/quality CI (test -f, no .github fallback). The fuller copy in .github/ is GitHub's auto-discovery convention; dedupe is an owner decision (would need those CI checks updated to accept .github/).
 SECURITY.md                # REQUIRED AT ROOT by scorecard-enforcer CI + the security-policy contractile (test -f SECURITY.md). See CONTRIBUTING.md note re: the .github/ copy.
 LICENSE
+LICENSES/                  # REUSE licence texts (MPL-2.0.txt + CC-BY-SA-4.0.txt) for the dual-licence model (code MPL-2.0 / docs CC-BY-SA-4.0)
 CHANGELOG.md
 
 # ─── Build entry points (must live at root for their tooling) ────────────────
@@ -64,3 +65,12 @@ container/                 # may host Containerfile if not at build/
 .pre-commit-config.yaml    # TODO: relocate to ci/.pre-commit-config.yaml after invocation pattern decided
 affinescript/              # AffineScript source subtree consumed by this template
 tools/                     # TODO: consolidate with scripts/ or document the split (pending decision)
+
+# ─── Nix retirement (policy item, not a CI fix) ───────────────────────────────
+flake.nix                  # TOLERATED, NOT BLESSED. Nix was retired estate-wide on
+                           # 2026-06-01 (Guix primary + sealed-container escape hatch).
+                           # This entry stops the root-shape gate failing on a file whose
+                           # REMOVAL is a policy decision tracked in
+                           # dev-notes/GOVERNANCE-REMEDIATION-BACKLOG.md §A — not something
+                           # a CI-unblocking PR should decide. Do NOT mass-delete: campaign
+                           # #102 hand-diffed 277 candidates and removed exactly 1.