The Location Was Never the Diagnosis
A half mile of track outside Welwyn Garden City killed people twice in the twentieth century, twenty-two years apart. The first time, in 1935, a signalman lost track of which block section held a train and let a second one into it. The Newcastle express sat stopped in the dark, slowed for no reason anyone could later justify, and the Leeds express hit it at 65 miles an hour. Fourteen died.
The fix was real engineering, not a memo. Welwyn Control tied the block instrument to the track circuit itself, so a signalman physically cannot clear a section unless the circuit confirms the previous train has actually cleared it. You stop trusting a tired man's memory and make the machine refuse to lie to him. It worked. No signalman at that junction ever again cleared a section that wasn't clear, because the interlock wouldn't let him.
Then in 1957, at the same spot, a driver in freezing mist ran three signals at danger, didn't hear the detonators going off under his wheels, and plowed into a stopped local train at over 60 miles an hour. One dead, forty-four hurt. Welwyn Control was sitting right there, fully operational, and did nothing for him, because his failure wasn't a signalman misjudging occupancy. It was a driver who never saw or heard the warnings meant for him. Different machine, different human, different way of being wrong.
The reflex, looking at two wrecks at one location, is to treat the location as the diagnosis. Same milepost, must be the same disease. But a place on a map is a coordinate, not a cause. It tells you where the energy got released, not what built up to release it. The signal box that failed in 1935 and the cab that failed in 1957 shared nothing except geography. A fix built to close the first gap had no way of closing the second, because it was never designed against the second. It wasn't a weaker version of the same interlock. It was a correct, total solution to a problem that had already been solved, sitting uselessly next to an entirely different one.
This is the trap every postmortem process is built to fall into, because postmortems are written by people who just got scared, and fear wants a story with one villain. "This is the third outage in that subsystem" reads like a pattern. Sometimes it is one. Often it's three subsystems that happen to share a name, a service, or a line on an org chart, each failing for reasons that have nothing to do with the others, united only by the coincidence of where the alert fired. You patch the thing that actually broke, declare the location handled, and wait for the next incident to prove you were addressing an address, not a mechanism.
The tell is right there in the remediation if you look for it: does the fix name a mechanism, or does it name a place? "We added monitoring to the payments service" is a place. "We made it structurally impossible to double-charge a card on retry" is a mechanism. The first kind of fix accumulates at trouble spots like Welwyn Control accumulated at that milepost, correct and inert, waiting for the next failure that happens to wander past the same signpost and ignore it entirely. The second kind travels wherever the mechanism recurs, whether or not it shares an address with the last time.
None of this is an argument against the interlock. Welwyn Control was the right call for what caused Welwyn 1935, and it presumably stopped other, uncelebrated near-misses of the same shape for decades. The error isn't in building a precise fix. It's in letting the precision of the fix stand in for an audit of what else lives at that coordinate. A location just accumulates history. It doesn't accumulate a single cause, no matter how many times you walk past it expecting one.