POST /retire?site=<id> with {"confirm": "<id>"}: wipes one site's object, then forgets it.
The audit entry is written to CONFIG_KV first, because the object's own audit ring is in the
storage the wipe removes. Authority is the target's own owner token, checked here and again in
the object. The one exception is an object the deployment never claimed, under force=1: it has
no token to present, so the deployment primary's owner token authorizes it, and the object
accepts that only while it holds no owner token of its own. The deployment primary is refused
whatever the caller holds.
POST /retire?site=<id>with{"confirm": "<id>"}: wipes one site's object, then forgets it.The audit entry is written to
CONFIG_KVfirst, because the object's own audit ring is in the storage the wipe removes. Authority is the target's own owner token, checked here and again in the object. The one exception is an object the deployment never claimed, underforce=1: it has no token to present, so the deployment primary's owner token authorizes it, and the object accepts that only while it holds no owner token of its own. The deployment primary is refused whatever the caller holds.