whole-tree
A deny rule: it refuses a whole-tree VCS reset, checkout, restore or clean, which cannot be undone, and names what to run instead.
What it catches
A whole-tree VCS reset, checkout, restore or clean, which cannot be undone.
Why
These destroy uncommitted and untracked work across the WHOLE tree, including a concurrent session's, and nothing recorded anywhere can give it back. It is the one category where an over-eager refusal is the safe direction, which is why an unparsable line falls back to the pattern rather than passing. Verify in place instead: no magus run needs a clean tree.
Seeing it
A verdict names its rule in brackets, which is how you got here:
deny [whole-tree]: ...
magus describe rule whole-tree prints the same entry at a terminal, and
magus describe rules lists every rule this workspace enforces.