The deletion switch

REAPER_DESTRUCTIVE_ACTIONS_ENABLED seeds the first run only. On a fresh install with nothing stored yet, it decides whether Reaper comes up armed so a declarative deployment can ship ready to delete.

The stored value wins after that, so the variable is ignored. This means a setting you change in the UI can't be silently clobbered by a stale .env.

The live control is deliberately asymmetric

The switch lives in the web UI, under Policy, Deletion.

• Turning deletion on requires the admin password. A stray click or an open tab won't arm the tool. Your password is what stands between a browser and an armed Reaper.
• Turning deletion off requires nothing. You can make Reaper safer without any extra steps.

Note

Arming and deleting are separate. Turning the switch on removes nothing. A real run still needs a typed confirmation matching the exact plan, recomputed on the server.

One function decides if deletion is on. Every client and health check reads that same answer so they never disagree.

Before you arm it

Turning deletion on is the full checklist. Set your pace and grace, turn on the Leaving Soon shelf and "Update while read-only" so your users are warned before you arm anything, and keep your first run supervised.