A guard you can switch off
A microwave will not run with its door open.
Not should not. Cannot. There is no menu for it, no override for the person in a hurry, no sequence of presses that lets you stand close and watch the plate turn under power. The latch carries a small switch, wired so that an open door breaks the circuit the magnetron needs. Pull the door mid-cycle and the power is gone before the door is halfway open. The people who built it did not print please keep the door closed on a card and hope. They made the open door and the running state physically unable to exist at the same moment.
Picture the other way they could have done it. A label on the door: keep closed while operating. A line in the manual. A note about safe use. All true, all sensible, all depending on a person reading them, believing them, and remembering them at the exact moment they are tired and rushing and holding a hot bowl. The label is a guard that asks. The latch is a guard that holds. Same goal, and only one of them survives a bad day.
We spent a long time building guards that ask.
They looked like good rules, and they were — written down, agreed to, the distilled caution of people who had been burned. Check this before that. Confirm before you send. Read the whole thing before you reply. People followed them most of the time, which is the exact shape of the trouble. The failures never came on the calm afternoons. They came on the day someone was three steps behind and moving fast, when the rule was the one thing between them and done, and the rule lost — because a rule is a thought, and the hurry was a force.
So we began moving the guards into the latch. Not a note that says check this first, but a tool that will not do the second step until the first has happened. Not a reminder to read before replying, but a box that does not open until the thing to be read has been opened. The rule stops being something you remember and becomes part of the shape of the machine. You do not comply with it. You cannot route around it without taking the machine apart, and almost nobody takes the machine apart, because the guard is not standing in the doorway. It is built into the wall.
One class of mistake we had been making about a hundred times a day fell to roughly a dozen. We did not get more careful. We did not train harder or post a better sign. We changed the wiring, so that the careless path no longer led anywhere.
It costs something, and the cost lands in a place worth naming. A guard wired to the latch is stupid on purpose. It does not know about the honest exception — the time you genuinely need the door open and the power on — and it refuses you anyway. It annoys your most careful people the most, because they are the ones who could have been trusted with the label and now get treated like everyone else. That is the trade. You give up the graceful exception to buy the guarantee, and the guarantee is the thing that holds on the day your careful people are having their worst day too.
The label on the door still earns its place. It tells a newcomer what the machine believes about itself. But belief is not what cuts the power when the door swings open. The switch does that — for the careful operator and the careless one alike, on the calm afternoon and the worst day, on the same terms every time, whether anyone is grateful for it or not.