Record no hand act for a cleanup that deletes nothing

nox cleanup delete without --confirm deletes nothing; the vault refuses it
for its missing confirm alone and judges only a confirmed delete, and nox
records the warranting act only for that one (issue 1126 review 2).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

modules/mesh-vault/cmd/mesh-vault/sensitive_test.go

@@ -102,3 +102,17 @@ func TestNoxsRuntimeExportsWithItsHandActAndIsRefusedWithout(t *testing.T) {
 		t.Errorf("an export with nox's act: %v", err)
 	}
 }
+
+// Review 2 of issue 1126: a delete without its confirm deletes nothing, so it is refused for that, never judged as an
+// act wanting a hand act; nox records none for it.
+func TestADeleteWithoutConfirmIsRefusedForItsConfirmAlone(t *testing.T) {
+	del := toolNamed(t, definitions(&Env{Custody: retiredC(t).Custody}), "provisioner_delete")
+	if _, err := del.runAs("shanks.node-tools", map[string]any{"consumer": "d-app", "why": "look"}); err == nil ||
+		!strings.Contains(err.Error(), "confirm must repeat") {
+		t.Errorf("an unconfirmed delete: %v", err)
+	}
+	if _, err := del.runAs("shanks.node-tools", map[string]any{"consumer": "d-app", "confirm": "d-app", "why": "gone"}); err == nil ||
+		!strings.Contains(err.Error(), "named none") {
+		t.Errorf("a confirmed delete with no act: %v", err)
+	}
+}

modules/mesh-vault/cmd/mesh-vault/tools.go

@@ -540,13 +540,17 @@ func definitions(env *Env) []toolDef {
 			Input: actInput(false, true),
 			run: func(caller string, a map[string]any) (any, error) {
 				consumer, _ := a["consumer"].(string)
-				if err := env.judge(caller, SensitiveDelete, a, consumer); err != nil {
-					return nil, err
+				confirm, _ := a["confirm"].(string)
+				// A delete without its confirm deletes nothing and is refused for that alone (Custody.Delete); one
+				// confirmed is judged.
+				if confirm != "" {
+					if err := env.judge(caller, SensitiveDelete, a, consumer); err != nil {
+						return nil, err
+					}
 				}
 				if env.Custody == nil {
 					return nil, errors.New("the vault has no custody ledger")
 				}
-				confirm, _ := a["confirm"].(string)
 				if err := env.Custody.Delete(consumer, confirm, actOf(caller, a)); err != nil {
 					return nil, err
 				}