One refactor. It touched five files and hard-coded timeout out of the config center. The ask was to print a request id in the log. Reviewers only read the diff. Five red lines hid the timeout change. Nobody was watching config. Rollback was slower than generate. We split it: assumptions and blast radius first, a human nod, then the patch. Wrong config edits dropped. After they dropped, I trusted the stop.