Prevent the foreseeable failure

The claim underneath this idea is about where blame is allowed to settle. Individual error is very often invited by structure — by a fragile transition, an unhelpful default, information omitted at exactly the moment it was needed, or a design that quietly depends on somebody's perfect memory. Once a failure has recurred, describing it as a user's private defect is a decision about accounting rather than a finding, and it has the convenient property of requiring nothing to change. Treating the same breakdown as a fresh surprise each time performs the same service.

Prevention nevertheless has no natural stopping point, which is why proportionality rather than caution is the governing question. A sufficiently determined effort to eliminate remote scenarios burdens everyone with safeguards against events that will not happen, and the burden is real even when the risk is not. So the question is never whether harm is conceivable but whether it is serious and likely enough that craft should change the conditions under which people act. That is a judgment, made with incident data, and it is revisable when the data moves.

Each of the three failure modes is a way protection becomes its own hazard. Guardrails with enough friction get routed around, leaving people less safe than no guardrail would have — the safeguard has not failed to work, it has taught everyone to work without it. A control can signal responsibility while failing under the exact condition it claims to prevent, which is the worst case, because its presence removes the vigilance that would otherwise have covered the gap. And a check that cannot detect its own blindness reports clean whether or not anything was inspected. A guard is not proven by its existence, or by a quiet record; it is proven by having fired on something real.

The third failure runs in the other direction and deserves its own weight: hindsight makes an unusual event look obvious, and the language of foreseeability then turns into blame. Foreseeable is judged after the fact by people who now know what happened, and that knowledge reorganises the past into a sequence that appears to have been signposted. Holding design responsible for what ordinary attention could anticipate is meaningful only while ordinary attention means what was available beforehand. Otherwise the concept becomes a device for assigning fault after every accident, which is the opposite of the structural view it began from.