docs(rules): note why the hook's protected list differs from mailctl's

Two module-level constants with the same name in one repo, meaning
different things: mailctl.py's is a gate a human can override, the
hook's is a refusal because cron has no human to ask.

1 files changed, 4 insertions, 0 deletions

diff --git a/post-new b/post-new
index c10d6d7..1ee974d 100755
--- a/post-new
+++ b/post-new
@@ -61,6 +61,10 @@ SCOPE = "tag:new"
 # 90 days" rule is a reasonable thing to want and would need this list revised.
 # When that day comes, the question to answer first is what confirms the rule
 # before it runs, not whether the guard is annoying.
+# NOT the same list as mailctl.py's PROTECTED_REMOVALS, and the two must not be
+# merged. That one is `{inbox}` and is a GATE: a human can override it with
+# --confirm-destructive. This one is `{unread, inbox}` and is a REFUSAL, because
+# there is no human present to confirm anything when cron runs a sync.
 PROTECTED_REMOVALS = frozenset({"unread", "inbox"})