the reader of the handbook has no memory

An operations document is read by an actor with no memory and full permission. That reader is not looking for orientation; it is about to change something, and the document is the only thing standing between its competence and the system.

Such a document has two jobs that pull in opposite directions. It must enable: here is the machine, here is the sequence, here is the command that works. And it must constrain: this is not yours to touch, this credential does not do what you assume. Enablement is what people write, because it is what the writer needed. Constraint is what saves the reader, and it is written by whoever remembers the incident, usually once, usually somewhere else.

The rewrite treated the constraint content as first-class. Machines are listed with an explicit never-touch flag. Prohibited actions are enumerated as prohibitions rather than as advice. Credentials are inventoried with the scope of each, because the failure mode is not forgetting a secret but using the wrong one and finding that it works. Every session begins with a fixed short ritual that establishes where you are before anything is changed.

The format was inherited from a sibling system rather than invented, so that a reader who has worked in one place recognises the shape of the other. That is cheaper than it sounds and is most of the reason handbooks get read at all.

The cost is that prohibitions age badly: a rule written to stop one mistake stays long after its reason has gone, and a handbook full of dead rules teaches people to skim the live ones. What it proves is that operational writing is treated as a control, not a courtesy.