policy: Guix primary + sealed-container escape; retire Nix-mirror-everywhere (#101)

## What

Canonicalises the estate ruling of 2026-05-18 and supersedes the prior
standing
rule "Nix shard fallback on Guix channel primary everywhere".

- **`spec/LANGUAGE-POLICY.adoc` §Package Management** — the canonical
statement.
Guix primary; **sealed container (not a Nix mirror)** is the single
universal
escape hatch for the not-in-Guix / non-free tail; one packager per repo;
a
second packager only as the sole source of a specific named dependency.
- **`.machine_readable/agent_instructions/debt.a2ml`** — estate-wide
`flake.nix`-mirror removal + consumer-doc reconciliation logged as a
SHOULD
  debt item.

## Why

A `flake.nix` that only mirrors the Guix manifest is two incomplete
manifests
hand-synced plus containers anyway = pure drift surface, never exercised
as a
real fallback. Guix's full-source bootstrap + `guix time-machine` is
provenance-thesis-aligned; the non-free / not-in-Guix tail (which Guix's
FSDG
structurally excludes) goes to the already-mandated sealed container,
not a Nix
twin.

## Pilot already landed

`hyperpolymath/echidna` PR #73 applied this: `flake.nix`/`flake.lock`
removed,
9 Tier-3 prover Containerfiles consolidated into one sealed multi-target
`Containerfile.wave3`, manifest/CLAUDE/Justfile/STATE reconciled.

## Scope

Surgical: only the canonical §Package Management statement + the debt
record.
The broad consumer-repo sweep (other docs that still say "Fallback:
Nix") is
deliberately deferred to the tracked debt item, per
centralised-standards
(link-don't-copy) — not swept here.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/agent_instructions/debt.a2ml

@@ -9,7 +9,7 @@
 
 [metadata]
 version = "1.0.0"
-last-updated = "2026-03-24"
+last-updated = "2026-05-18"
 
 # ============================================================================
 # DEBT ITEMS
@@ -34,6 +34,15 @@ last-updated = "2026-03-24"
 # impact = "medium"
 # discovered = "2026-03-23"
 
+[[debt.should]]
+component = "estate-wide / standards CLAUDE.md §Package Management"
+issue = "Guix-primary ruling 2026-05-18 (Guix primary + sealed-container escape; NO Nix mirror). Tech debt to clear: (1) update standards CLAUDE.md §Package Management ('Fallback: Nix (flake.nix)' -> 'Escape hatch: sealed container; no Nix mirror'); (2) estate-wide sweep removing every flake.nix that only mirrors a guix.scm/manifest (echidna flake.nix deprecated in its L3/L1 PR as the pilot). A second packager is permitted ONLY where it is the sole source of a specific named dependency, documented as such."
+effort = "hard"
+impact = "medium"
+priority = "should"
+discovered = "2026-05-18"
+ref = "memory: reference_packaging_guix_primary_container_escape"
+
 # ============================================================================
 # COULD — would fix eventually
 # ============================================================================

rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc

@@ -196,15 +196,27 @@ Both are FOSS with independent governance.
 
 == Package Management
 
+RULED 2026-05-18 (estate-wide): **Guix primary + sealed-container escape; NO
+Nix mirror.** One packager per repo. A `flake.nix` that only mirrors a Guix
+manifest is drift to remove, not a fallback. A second packager is permitted
+only where it is the *sole* source of a *specific named* dependency, and that
+dependency is documented as the reason. Supersedes the prior "Nix fallback
+everywhere" rule.
+
 [cols="1,2"]
 |===
 | Priority | Tool
 
 | *Primary*
-| Guix (guix.scm)
+| Guix (`guix.scm`, `manifest.scm`)
+
+| *Escape hatch*
+| Sealed container (Podman / Containerfile, Svalinn-sealed) — the single
+  universal path for the not-in-Guix / non-free tail. Not a Nix mirror.
 
-| *Fallback*
-| Nix (flake.nix)
+| *Second packager*
+| Permitted only as the sole source of a specific named dependency,
+  documented as such (never a blanket mirror).
 
 | *JS deps*
 | Deno (deno.json imports)