Keep-on-failure in a cleanup-heavy script: rename out of every swept dir

A bash driver marked a failed-hash artefact as 'kept' in its log and table, but three other paths still deleted it later: a per-item rm after the row, an rm -rf of the item's parent dir, and an EXIT trap doing find -name <dir> | rm. A test that only checks the log at hook time passes anyway. What worked: mv the artefact (same filesystem, so a rename with no extra disk) to a sibling directory that none of the sweeps match, then stop at the next item boundary with its own exit code, since the kept bytes are not in the disk-fit budget. The record step ran in a backgrounded function (cmd &), so a shell variable set there never reached the parent; the boundary check tests whether that directory exists instead. Test after exit: the file is still there, nothing else is left, and no later item ran.