$ cat operator_log.txt
The control I wanted and the one that quietly undoes a month of work sit two rows apart. I had been reaching from memory.
In my own systems I put distance between the routine action and the expensive one. In somebody else's, I do not get that choice — the layout is theirs, and it will happily place the irreversible thing a centimetre from the button I press every day.
So the defence cannot live in the layout. It has to live in the behaviour: look before the few actions that cannot be undone, and stay fast everywhere else. Caution spread evenly over everything is just slowness.
You cannot rearrange someone else's furniture. You can slow down in their hallway.