Ask before anything is taken away

A one-tap archive wiped a sale from a gym's till. A real sale, a real amount, on a real afternoon. Nobody meant to. The button sat next to the things people tap all day, and it did exactly what it said.

The app already had a confirm dialog. It had been in the codebase for months. It just wasn't wired to that button, because wiring it was a judgement made one screen at a time, and that screen got missed. The sale came back. The lesson stayed.

Now every app we ship follows one rule, and the rule has parts.

The dialog names the thing and the amount. Not "Are you sure?" — "Archive this sale, 340.00?" If a person can't tell from the dialog what is about to go, the dialog is decoration.

Cancel is plain and comes first. The destructive choice is red and comes second. A thumb moving fast lands on the safe one.

Two tiers. If it can be undone — archived, hidden, logged out — one deliberate tap. If it can't — a deleted person, cleared data — you type a word. We never move an irreversible action down to the light tier because the confirm felt like friction. Friction is the point.

We never confirm a restore. Undo is safe. A guardrail that fires on safe actions teaches people to tap through guardrails, and then it fires on the one that matters and they tap through that too. Every confirm you add to a harmless action is a withdrawal from the one you need.

It is one line at the call site. This is the part for the builder. If adding the confirm takes more than one line, it won't get added everywhere, and everywhere is the whole rule. The gym app had the component. It had the judgement. What it was missing was a rule cheap enough to follow without thinking.

There is a test, and the test is that cancelling writes nothing. Not "cancelling shows the right screen." Cancelling leaves the database exactly as it was. That is the test that would have caught the gym.

Why this holds past a gym: a till, a client list, a booking, a staff member's record — each one is somebody's week. When a sale goes missing, the owner is the one explaining it on Monday, not the software. So the software asks, every time, in words that say what is about to go.

Ask before anything is taken away.