fix(prompts): make destructive confirms one keystrokeHEADmain

I had to kill an Emacs session today over a prompt I could not answer. A
second agent session held the selected window while "Overwrite hiroshi.m3u?
(yes or no)" waited in another frame, so my keystrokes went to a terminal
and the minibuffer stayed empty. Losing unsaved buffers is a far worse
outcome than a mis-keyed confirm.

So cj/confirm-strong becomes cj/confirm-destructive, and instead of binding
use-short-answers to nil for a typed "yes" it reads a single y or n.

Two things I kept:

- No default. Only y and n answer, so a stray RET or space re-prompts
  rather than confirming a shutdown.
- Pending input is discarded before the read. Without that the change would
  have been a bad trade: read-char-choice reads the input queue, so a key
  typed before the prompt painted would confirm instantly, where the old
  typed-"yes" absorbed it harmlessly.

Worth being honest about what this does not fix. One keystroke does not
make a prompt reachable when focus is elsewhere, and C-g is still the
escape. It lowers the cost of the situation rather than preventing it.

Six call sites: shutdown and reboot, shred, playlist overwrite and delete,
and the two file overwrites.

1 files changed, 38 insertions, 7 deletions

diff --git a/tests/test-system-commands-resolve-and-run.el b/tests/test-system-commands-resolve-and-run.el
index 7e5146b1..3dae8cda 100644
--- a/tests/test-system-commands-resolve-and-run.el
+++ b/tests/test-system-commands-resolve-and-run.el
@@ -85,26 +85,34 @@
     (put 'test-sc-confirm-cmd 'cj/system-confirm nil)))
 
 (ert-deftest test-system-cmd-strong-confirm-decline-aborts ()
-  "Boundary: a strong-confirm var uses yes-or-no-p; declining aborts and
-does not run the command."
+  "Boundary: a strong-confirm var asks a single y/n; declining aborts and
+does not run the command.
+
+The strong path used to demand a typed \"yes\", and this test used to assert
+that by erroring if `read-char-choice' was called at all.  It now asserts the
+opposite, because a long-form prompt is only as safe as it is answerable: on
+2026-07-31 one became unanswerable when a second agent session held the
+selected window, and the Emacs session had to be killed with buffers unsaved.
+What survives the change is the part that mattered -- the prompt still has no
+default, so RET and space re-prompt rather than confirming a shutdown."
   (defvar test-sc-strong-cmd "test-strong-cmd")
   (put 'test-sc-strong-cmd 'cj/system-confirm 'strong)
   (unwind-protect
-      (cl-letf (((symbol-function 'yes-or-no-p) (lambda (&rest _) nil))
-                ((symbol-function 'read-char-choice)
-                 (lambda (&rest _) (error "strong confirm must not use read-char-choice")))
+      (cl-letf (((symbol-function 'read-char-choice) (lambda (&rest _) ?n))
+                ((symbol-function 'yes-or-no-p)
+                 (lambda (&rest _) (error "strong confirm must not demand a typed yes")))
                 ((symbol-function 'start-process-shell-command)
                  (lambda (&rest _) (error "shouldn't run"))))
         (should-error (cj/system-cmd 'test-sc-strong-cmd) :type 'user-error))
     (put 'test-sc-strong-cmd 'cj/system-confirm nil)))
 
 (ert-deftest test-system-cmd-strong-confirm-accept-runs ()
-  "Normal: a strong-confirm var runs the command when yes-or-no-p returns t."
+  "Normal: a strong-confirm var runs the command on a single y."
   (defvar test-sc-strong-cmd-2 "echo strong")
   (put 'test-sc-strong-cmd-2 'cj/system-confirm 'strong)
   (let (cmd-line)
     (unwind-protect
-        (cl-letf (((symbol-function 'yes-or-no-p) (lambda (&rest _) t))
+        (cl-letf (((symbol-function 'read-char-choice) (lambda (&rest _) ?y))
                   ((symbol-function 'start-process-shell-command)
                    (lambda (_name _buf c) (setq cmd-line c) 'fake-proc))
                   ((symbol-function 'set-process-query-on-exit-flag) #'ignore)
@@ -114,6 +122,29 @@ does not run the command."
       (put 'test-sc-strong-cmd-2 'cj/system-confirm nil))
     (should (string-match-p "echo strong" cmd-line))))
 
+(ert-deftest test-system-cmd-strong-confirm-rejects-stray-keys ()
+  "Boundary: the strong prompt offers only y and n, so a stray RET or space
+cannot confirm an irreversible command.
+
+This is the protection the typed-\"yes\" form existed for, kept while the
+answer became a single keystroke.  Asserted on the accepted-character set
+handed to `read-char-choice' rather than on the prompt text, because the set
+is what actually decides."
+  (defvar test-sc-strong-cmd-3 "echo strong")
+  (put 'test-sc-strong-cmd-3 'cj/system-confirm 'strong)
+  (let (chars)
+    (unwind-protect
+        (cl-letf (((symbol-function 'read-char-choice)
+                   (lambda (_prompt cs &rest _) (setq chars cs) ?n))
+                  ((symbol-function 'start-process-shell-command)
+                   (lambda (&rest _) (error "shouldn't run"))))
+          (should-error (cj/system-cmd 'test-sc-strong-cmd-3) :type 'user-error))
+      (put 'test-sc-strong-cmd-3 'cj/system-confirm nil))
+    (should (equal (sort (copy-sequence chars) #'<) '(?N ?Y ?n ?y)))
+    (should-not (memq ?\r chars))
+    (should-not (memq ?\n chars))
+    (should-not (memq ?\s chars))))
+
 ;;; cj/system-cmd--emacs-service-available-p
 
 (ert-deftest test-system-cmd-service-available-true-on-zero-exit ()