Guard destructive settings and radio actions

- Route reset campaign and tutorial replay through one reusable confirmation dialog; repeated presses cannot stack or emit twice.
- Keep emergency hold-to-send single-shot and cover the post-submit release.
- Add destructive-action regression checks, strings and documentation.

MEMORY.md

@@ -61,6 +61,11 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   gallery is 13 good / 0 bad, the screen-design judge is 13/13 and a clean
   portrait measured a 0.732 vision gap against the photoreal concept. No
   release build, version bump or tag was created at this gate.
+- **Destructive actions (2026-11-02):** `SettingsPanel._open_destructive_dialog()`
+  owns one confirmation instance for reset/replay; repeated presses focus the
+  existing dialog, OK emits once, Cancel is inert. Emergency send remains the
+  RadioPanel hold path; `_holding` clears before submit so button-up cannot
+  double-send. Tests cover both.
 - **Font/layout limits (2026-11-02):** HUD scale is clamped to 0.75–1.75 and only
   applies to HUD labels. `Hud.set_target_label()` measures the scaled font, widens
   the chip to 180–420 px and re-measures after a scale change; top labels clip.
@@ -723,7 +728,7 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 - Venue `door_staff_lines` are logged through `GameManager` (inspect / wand / refuse). They are not a separate dialogue UI.
 - Access loadout is implemented; do not re-fix `override_access` as if it were still unread.
 - `Save.SETTINGS_FILE` is declared and unused; settings persistence goes through `Save.load_settings()` / `save_settings()`.
-- Headless suite is **260/260**; the windowed smokes, screenshot compare and judge pass. Remaining visual follow-ups are in `TODO.md`.
+- Headless suite is **261/261**; the windowed smokes, screenshot compare and judge pass. Remaining visual follow-ups are in `TODO.md`.
 - Typed spawn signal extra args: handlers must accept the 4th `event: Dictionary` or Godot will not call them (`test_shift_coordinator_runs_a_shift` failed until `_on_spawn` took four args).
 - GDScript inference trap that broke the main scene: a `var` typed as a base class
   (`radial: CanvasLayer`) exposes script members as `Variant`, so `var x := radial.is_open` is a