Every surface is designed for the week the operator wants to switch it off.

The design centre

Assume the operator is depleted and looking for an exit.

The state that matters is specific and it is not exotic: several losing weeks, a gate that has tightened, a review that is overdue, and a setup on the screen that looks like the way back. In that state the operator is not hostile to their own system — they are tired, and every additional step is a reason to skip the whole thing. Anything that is merely inconvenient on a good day becomes the point of abandonment on a bad one. Designing for the good day and hoping the discipline holds is designing for the case that does not need the product.

Consequence one

The routine has to be short enough to survive a week nobody wants to review.

A review process that is thorough and takes an afternoon will be completed in calm periods and skipped in exactly the periods it was built for. Length is therefore not a quality dimension but a survival one, and the design pressure runs toward fewer questions asked in a fixed order rather than a comprehensive audit. This is why the weekly pass is a short sequence with a defined stopping point: the version that gets run in the fourth losing week is worth more than the better version that gets run in the first.

Consequence two

A refusal in a bad week has to carry its reasoning with it.

Machinery that says no without saying why is tolerable when the operator agrees with it and worthless when they do not. In a good week a bare refusal costs nothing; in a bad one it is read as arbitrary, and arbitrary authority gets overruled. Every restriction therefore travels with the reading that produced it — the drawdown that set the gate, the exposure that consumed the capacity — because the operator has to be able to argue with the evidence rather than with the verdict. That requirement is a direct consequence of the design centre and it shows up in the layout of every panel.

Consequence three

Overrides are made visible rather than impossible.

A workbook cannot physically prevent anything, and a design that pretended otherwise would fail at the first override and take its credibility with it. What it can do is ensure that departing from the system leaves a mark — a logged decision, a flagged trade, an adherence reading that will appear in the weekly grade whether or not it is welcome. The bet is that a visible override is rare and a silent one is routine, and that the difference between them is most of the value on a bad week.

• Blocking what cannot be blocked destroys trust at the first breach.
• A recorded override still enters the evidence base; a silent one corrupts it.
• The mark matters more than the prohibition.

What this costs the good week

The instrument is duller than it could be when conditions are easy.

Optimising for the worst case has a price paid in every other case. The routine is coarser than an attentive operator in a calm month would want, the refusals are more explicit than they need to be, and the machinery repeats context that an engaged reader already holds. That friction is real and it is the correct trade, because the good week does not need the product and the bad week is the entire reason it exists. A design tuned to the demo would be more impressive and would be absent when it counted.

The key idea

Pick the design centre that is hardest, not the one that shows best.

Most products are shaped by how they are evaluated, which is a demonstration to an interested person in good conditions. A governance instrument evaluated that way will be built for a state it will rarely be in. Choosing the depleted operator as the reference user makes the product harder to demonstrate and considerably more likely to still be running in month nine, which is the only test that matters.