## Problem Description

In Omarchy Quattro, modern GNOME Files (Nautilus 50+) is configured as the default file manager. When users toggle "Show Hidden Files" (`Ctrl+H`) to manage dotfiles or inspect their home directory, critical configuration roots and shell assets become visible directly alongside ordinary files:
- `~/.config`
- `~/.local/share`
- `~/.local/state`
- Top-level shell configs (`~/.bashrc`, `~/.profile`, `~/.gitconfig`)
- Credential directories (`~/.ssh`, `~/.gnupg`)

Under current FreeDesktop/GLib behavior in Nautilus, pressing `Delete` moves items directly to Trash (`g_file_trash()`) without an upfront confirmation dialog. While an undo toast is displayed, moving `~/.config` or `~/.local/share` even momentarily causes active background processes, compositor settings, and desktop shell singletons to lose their configuration paths immediately. This can lead to session instability, broken keybindings, and desktop corruption that cannot always be reverted simply through Nautilus's transient undo notification.

In a configuration-heavy Linux desktop environment like Omarchy, accidental trashing of `~/.config` represents a severe usability and data integrity hazard for users.

## Suggested Behavior & Protection Model

We propose introducing a lightweight safety barrier around critical desktop configuration paths:
1. **Configurable Critical Paths:** Top-level configuration roots (`~/.config`, `~/.local/share`, `~/.local/state`, `~/.ssh`, `~/.gnupg`) and direct Omarchy/Hyprland configuration directories (`~/.config/omarchy`, `~/.config/hypr`) should be protected against unintentional trashing.
2. **Immediate Restoration / Intervention:** When an unprivileged file manager moves a protected path to `$XDG_DATA_HOME/Trash`, the system detects the `.trashinfo` metadata and automatically restores the path to its original location before background daemons and applications crash.
3. **Intentional Overrides:** Users who intentionally wish to delete or reset a configuration path can explicitly bypass or override the barrier (e.g. via CLI or an override action).
4. **Zero Impact on Ordinary File Operations:** Ordinary documents, downloads, project files, and disposable caches (`~/.cache`) must remain completely undisturbed. Project dotfiles (e.g. `.gitignore`, local repo dotfiles) are not blocked.

## Implementation Direction

Because modern Nautilus does not provide pre-trash extension hooks or native deletion confirmation settings, interception can be handled cleanly at the FreeDesktop Trash specification boundary:
- A headless user service (e.g. an `omarchy-shell` service plugin) monitors `~/.local/share/Trash/info` via inotify (`inotifywait` or kernel inotify).
- When a `.trashinfo` creation event fires, the service decodes the RFC 2396 URI path.
- If the path matches protected configurations and no active override token exists, it calls `gio trash --restore` immediately.
- A native Omarchy notification (`omarchy-notification-send`) alerts the user with details and an override option.
- Debouncing ensures multi-item deletions produce a single consolidated alert.
- Destination conflicts are checked defensively to prevent overwriting existing destinations.

We have implemented and tested a reference plugin for this architecture (`roonakyadav.trash-guard` at https://github.com/roonakyadav/omarchy-plugin), which demonstrates zero-CPU idle monitoring, instant auto-restoration, and safe override semantics on Omarchy Quattro. We welcome discussion on whether this or an equivalent safety barrier would be appropriate as a built-in Omarchy core service.