blast-radiuslisted

# blast radius Most engineering advice is about correctness. This is about the other thing: what happens when the code is wrong, which it will be, and how much of the world it touches before anybody finds out. The question is not "how much can this touch". It is: > **With the worst plausible input, how much does this touch before someone > notices?** Those are different numbers, and the gap between them is the detection window. Most incidents are not caused by especially bad code. They are caused by ordinary code running unattended for longer than anyone expected. ## When this applies Anything with a side effect outside the process: sending email or SMS, writing to a CRM or a production database, charging or refunding, posting publicly, deleting, deploying, or any scheduled job that calls a third party. It does not apply to pure computation. Do not slow down a report script with this. ## The six questions Answer these before it runs the first time. If any answer is "I don't know", that is the finding. ### 1. Can it run without doing anything? **If you cannot run it in report-only mode, you do not yet understand what it does.** That is the real value of the mode, more than the safety: building it forces you to separate deciding from acting, and the code is better afterwards regardless. Report-only should be the **default**, with acting behind an explicit flag. The opposite arrangement means that every future mistake, every bad config, every half-finished branch, se