esh-pfi-infrastructure/persistent-memory.d/2026-09-22-safe-rm-installed-on-nh3-dev-and-delegated-fleet-wide-to.md

[2026-09-22] safe-rm installed on nh3-dev and delegated fleet-wide to infra-hermes.

⭐ safe-rm installed on nh3-dev and delegated fleet-wide to infra-hermes. ⚠ The package installs INERT and looks fine — Debian's /etc/zsh/zprofile has 0 non-comment lines so the shipped profile.d hook never fires under zsh; verify with command -v rm, never dpkg -l. ⚠ And it does NOT cover the habit that prompted it: measured, it refuses rm -rf /home and deletes an unset-variable path without complaint. Blacklist, not heuristic; set -u is the actual cover. Wiring ruled: /etc/bash.bashrc above the case $- guard, not /etc/environment (an rc self-guards, smaller blast radius, covers bash-over-ssh).