fix(disk-hygiene): manual-handoff lane — require immediate re-enumeration before container-wide deletions (F2)

[kyle-sexton]

Parent

Source: handoff-inbox item 20260723-021058-disk-hygiene-0-6-4-consumer-audit (finding F2 — demonstrated near-miss: Clear-RecycleBin approved as "1,183 items" while four freshly-deleted repo folders landed in the bin concurrently; 30 seconds earlier and the stale approval would have destroyed them).

What to build

Cheap process fix for the manual-handoff TOCTOU gap (the ambitious handoff-verify subcommand is a separate issue): in the clean skill's manual-handoff steps, forbid container-wide deletion operations (e.g. Clear-RecycleBin, emptying Trash) unless the container is re-enumerated IMMEDIATELY before execution, and abort on any drift versus the approved count/set. Additionally document that SendToRecycleBin is conditionally reversible — bin size caps, policy-disabled bins, non-NTFS/network volumes silently make it permanent.

Reproduce the finding's framing against the current SKILL.md before editing (per the item's reproduce-before-fix instruction). Semver bump + CHANGELOG entry.

Acceptance criteria

• Manual-handoff steps require immediate pre-execution re-enumeration for container-wide ops, with an explicit abort-on-drift rule
• SendToRecycleBin conditional-reversibility caveat documented
• Changed-since-scan threat section cross-references the manual lane

Blocked by

None — can start immediately.

[kyle-sexton]

Claim (work lane, T3) — dispatching an implementation subagent this cycle. 2026-07-23T08:21:00Z

[kyle-sexton]