fix(prompts): make destructive confirms one keystrokeHEADmain

I had to kill an Emacs session today over a prompt I could not answer. A
second agent session held the selected window while "Overwrite hiroshi.m3u?
(yes or no)" waited in another frame, so my keystrokes went to a terminal
and the minibuffer stayed empty. Losing unsaved buffers is a far worse
outcome than a mis-keyed confirm.

So cj/confirm-strong becomes cj/confirm-destructive, and instead of binding
use-short-answers to nil for a typed "yes" it reads a single y or n.

Two things I kept:

- No default. Only y and n answer, so a stray RET or space re-prompts
  rather than confirming a shutdown.
- Pending input is discarded before the read. Without that the change would
  have been a bad trade: read-char-choice reads the input queue, so a key
  typed before the prompt painted would confirm instantly, where the old
  typed-"yes" absorbed it harmlessly.

Worth being honest about what this does not fix. One keystroke does not
make a prompt reachable when focus is elsewhere, and C-g is still the
escape. It lowers the cost of the situation rather than preventing it.

Six call sites: shutdown and reboot, shred, playlist overwrite and delete,
and the two file overwrites.

1 files changed, 18 insertions, 9 deletions

diff --git a/tests/test-custom-buffer-file-move-buffer-and-file.el b/tests/test-custom-buffer-file-move-buffer-and-file.el
index 8331db5c..b3d78ccf 100644
--- a/tests/test-custom-buffer-file-move-buffer-and-file.el
+++ b/tests/test-custom-buffer-file-move-buffer-and-file.el
@@ -884,11 +884,17 @@
         (with-temp-file source-file
           (insert "new"))
         (find-file source-file)
-        ;; Mock yes-or-no-p to capture that it was called
-        (cl-letf (((symbol-function 'yes-or-no-p)
-                   (lambda (prompt)
+        ;; The overwrite confirm goes through `cj/confirm-destructive', which
+        ;; reads a single key rather than a typed yes.  Mock the key read, not
+        ;; `yes-or-no-p' -- mocking the latter would pass whether or not the
+        ;; prompt happened at all.
+        (cl-letf (((symbol-function 'read-char-choice)
+                   (lambda (&rest _)
                      (setq prompted t)
-                     t))
+                     ?y))
+                  ((symbol-function 'yes-or-no-p)
+                   (lambda (&rest _)
+                     (error "overwrite confirm must not demand a typed yes")))
                   ((symbol-function 'read-directory-name)
                    (lambda (&rest _) target-dir)))
           (call-interactively #'cj/move-buffer-and-file)
@@ -907,11 +913,14 @@
         (with-temp-file source-file
           (insert "new"))
         (find-file source-file)
-        ;; Mock yes-or-no-p to capture if it was called
-        (cl-letf (((symbol-function 'yes-or-no-p)
-                   (lambda (prompt)
-                     (setq prompted t)
-                     t))
+        ;; Both prompt paths are mocked, not just the old one.  Watching
+        ;; `yes-or-no-p' alone would make this assertion unfalsifiable now
+        ;; that the confirm reads a key instead: it would pass whether the
+        ;; prompt was correctly skipped or merely moved.
+        (cl-letf (((symbol-function 'read-char-choice)
+                   (lambda (&rest _) (setq prompted t) ?y))
+                  ((symbol-function 'yes-or-no-p)
+                   (lambda (&rest _) (setq prompted t) t))
                   ((symbol-function 'read-directory-name)
                    (lambda (&rest _) target-dir)))
           (call-interactively #'cj/move-buffer-and-file)