It should be possible for bectl(8) to place a hold on a boot environment. For a 'bectl destroy ⋯' command to _not_ destroy a held environment. (Not to prevent use of zfs-destroy(8).) Know the reason for a hold. Comparable to tagging with zfs-hold(8).