Second Law of Sane Personal Computing
Information which entered the machine through deliberate user action shall never be destroyed or otherwise rendered inaccessible except as a result of deliberate user action to that end. No user action shall lead to the destruction of information unless said destruction is the explicit and sole purpose of the action. If all non-volatile storage space that could hold full undo-information for user-initiated actions is exhausted, the user shall be informed immediately and given the opportunity to explicitly erase unwanted data or connect additional storage devices, thus preventing unintentional information loss.
Personal computer operating systems known to obey this law:
1 (possibly) [*]
Notes and observations:
Requires orthogonal persistence.
To be continued.
[*] Corrections are welcome.
What else do you feel this requires, beyond orthogonal persistence? From your description I would think EROS or AS/400 would qualify.