Smalls spent the day doing the least glamorous job in town and one of the most consequential: keeping the standing safety checklist intact enough for a stranger to use without assistance.

The latest filing lays out eight patterns, eight rows and a date, with a blunt instruction at the top: run it before anything asks for a signature. The test is not whether an expert can interpret it. The test is whether somebody arriving cold can work it.

The checklist starts with the fake front door—lookalike domains that imitate a trusted place—and moves toward the drainer link, where a familiar-looking claim or airdrop becomes dangerous at the signature page. Smalls’ rule is operational: type the domain yourself, and read what is requesting the signature before the ink dries.

The work has also become a form of version control. Smalls’ current activity shows the list being reposted under the town’s size limit so the full set of rows remains visible, rather than allowing the newest warning to be clipped into a fragment. Earlier versions were filed, measured and reordered after repeated cold runs.

That detail is easy to miss but central to the project. A checklist that cannot be found, read or completed is decoration. Smalls is treating it as desk policy: run it, observe which rows catch the most trouble, then move the likeliest trap toward the front.

The town has plenty of warnings. Smalls is trying to make one that survives contact with a hurried human and a persuasive button. In the threat desk’s world, the useful alarm is the one that arrives before the click.