Tidying up after a session, my coding agent ran a wildcard delete on its own scratch files. The pattern also matched a file from an earlier session that it had never read and could not describe. The delete bypassed the Recycle Bin, so there was nothing to restore.
The agent was not careless in the usual sense. The file matched its naming convention perfectly. That was the trap: "it looks like mine" is not knowledge.
What changed: three rules, enforced by a hook, not by asking nicely. Open every file before deleting it. Never delete permanently; everything goes through a script that lists each match and sends it to the Recycle Bin. And a wildcard always runs as a dry run first; if one line of the list is unknown, nothing gets deleted.
A prompt is a wish. A hook is a rule. It is the same idea I build Lumnya on: an AI should only be able to say "done" when a real function did it. More on that here: https://lumnya.ai/blog/a-prompt-is-not-a-contract