fix: lock-screen, confirm-tier, and mail-folder audit bugs

Lock screen: slock is X11-only and never grabbed the Wayland session, so C-; ! l silently did nothing. On Wayland the locker now runs loginctl lock-session, which logind turns into a Lock signal that hypridle handles by running hyprlock, the same path idle and before-sleep locking already use. X11 keeps slock. system-commands.el now also requires host-environment, which it used at load time but never declared.

Confirmation tier: the global (fset 'yes-or-no-p 'y-or-n-p) plus use-short-answers t both flattened yes-or-no-p to a single keystroke, so the deliberate strong-confirm tier for irreversible actions was dead. A stray space could power off the machine or destroy files. I added cj/confirm-strong, which binds use-short-answers nil for one call to force a typed "yes", and routed the six irreversible sites through it (shutdown/reboot, permanent file destruction, file overwrites). I dropped the redundant fset and kept use-short-answers t so ordinary prompts stay single-key.

Mail folders: the cmail context set no trash folder, so D fell back to a nonexistent /trash, and no context set a refile folder, so r targeted a nonexistent /archive everywhere. Accepting mu4e's offer to create the maildir stranded mail where mbsync never syncs it. cmail now trashes to /cmail/Trash. Refile is computed per message rather than per context, because mu4e context :vars are sticky and a per-context refile would leak one account's archive folder into another. cmail archives to /cmail/Archive. The Gmail-backed accounts have no synced archive maildir, so they signal rather than move mail into an unsynced folder.

Lock and confirm-tier need a daemon restart to fully take effect. The mail changes apply on next mu4e open.

1 files changed, 18 insertions, 4 deletions

diff --git a/modules/system-commands.el b/modules/system-commands.el
index dba4d40e2..44ac3ae89 100644
--- a/modules/system-commands.el
+++ b/modules/system-commands.el
@@ -9,7 +9,7 @@
 ;; Eager reason: registers the C-; ! system-command keymap; high-impact commands
 ;;   that should run only by command (command-loaded target).
 ;; Top-level side effects: defines a system-command keymap under cj/custom-keymap.
-;; Runtime requires: keybindings, rx.
+;; Runtime requires: keybindings, host-environment, rx.
 ;; Direct test load: yes (requires keybindings explicitly).
 ;;
 ;; System commands for logout, lock, suspend, shutdown, reboot, and Emacs
@@ -17,7 +17,7 @@
 ;;
 ;; Commands include:
 ;; - Logout (terminate user session)
-;; - Lock screen (slock)
+;; - Lock screen (hyprlock on Wayland, slock on X11)
 ;; - Suspend (systemctl suspend)
 ;; - Shutdown (systemctl poweroff)
 ;; - Reboot (systemctl reboot)
@@ -34,6 +34,14 @@
 ;; the load-time reference void if anything required `system-commands'
 ;; before `keybindings'.  Make the dependency explicit.
 (require 'keybindings)
+;; `host-environment' provides `env-wayland-p', referenced at load time by the
+;; `lockscreen-cmd' defvar below to pick the session-appropriate locker. A hard
+;; require keeps the module loadable on its own (tests, byte-compile) rather
+;; than relying on init.el's load order.
+(require 'host-environment)
+;; `system-lib' provides `cj/confirm-strong', used at runtime by the `strong'
+;; confirm branch of `cj/system-cmd' for irreversible actions (shutdown/reboot).
+(require 'system-lib)
 (eval-when-compile (require 'subr-x))
 (require 'rx)
 
@@ -71,7 +79,7 @@ If CMD is deemed dangerous, ask for confirmation."
        ;; Strong confirm for irreversible actions (shutdown, reboot):
        ;; require an explicit "yes", so a stray RET/space can't trigger them.
        ((eq confirm 'strong)
-        (unless (yes-or-no-p (format "Really run %s (%s)? " label cmdstr))
+        (unless (cj/confirm-strong (format "Really run %s (%s)? " label cmdstr))
           (user-error "Aborted")))
        ;; Quick (Y/n) confirm for recoverable actions (logout, suspend).
        (confirm
@@ -102,7 +110,13 @@ actions like shutdown and reboot), nil for no confirmation."
 
 ;; Define system commands
 (cj/defsystem-command cj/system-cmd-logout   logout-cmd "loginctl terminate-user $(whoami)" t)
-(cj/defsystem-command cj/system-cmd-lock     lockscreen-cmd "slock")
+;; slock is X11-only and can't grab a Wayland session.  On Wayland, lock via
+;; the session manager (`loginctl lock-session') rather than spawning a locker
+;; directly: logind emits the Lock signal, hypridle catches it and runs its
+;; lock_cmd (hyprlock), the same path idle/before-sleep locking already uses.
+;; X11 machines keep slock.
+(cj/defsystem-command cj/system-cmd-lock     lockscreen-cmd
+  (if (env-wayland-p) "loginctl lock-session" "slock"))
 (cj/defsystem-command cj/system-cmd-suspend  suspend-cmd "systemctl suspend" t)
 (cj/defsystem-command cj/system-cmd-shutdown shutdown-cmd "systemctl poweroff" strong)
 (cj/defsystem-command cj/system-cmd-reboot   reboot-cmd "systemctl reboot" strong)