deletion-tripwirelisted

# Deletion Tripwire ## Overview A **mechanical** guard, not a persona: a PreToolUse hook that intercepts destructive shell commands and refuses to run them until the enumerate → confirm → ledger → approve protocol has been followed. It exists because the catastrophic-deletion class strikes during casual, un-reviewed operations, when no review panel is in session — so the guard must fire EVERY time, without anyone remembering to ask. The two lessons it enforces, burned in by a public field disaster (an agent cleaned up `Windows.old` after answering "safe" when asked directly; leftover junctions inside it pointed at the user's LIVE Documents/Pictures; the deletion followed the links and emptied the real folders): 1. **The blast radius of a deletion is everything REACHABLE from the target** — links and junctions included — not the folder that was named. 2. **"Is it safe?" answered by prediction is the weapon.** Safety requires enumeration (a dry run that lists what will actually be touched), never reasoning about what should be there. This is the deletion-direction sibling of the push/publish/send boundary: two irreversible directions, leaving the machine (can't recall) and leaving existence (can't recover). ## The protocol (what the block message demands) 1. **ENUMERATE, don't predict.** Dry-run the reachable set: count, total size, sample paths. Hunt links/junctions resolving OUTSIDE the target (PowerShell: `Get-ChildItem <target> -Recurse -Force -Attributes