A settings-page danger zone — one row per irreversible action with its consequences itemised before the confirm, a type-the-resource-name gate, grace windows dated from the payload's own clock, and blocked actions that name their blocker instead of rendering a dead button.