Where a typed confirmation does exist, several pages use a generic verb as the token — the same word already printed on the button. Retyping purge to confirm a "Purge" button doesn't establish intent, it just adds a keystroke.
Affected:
packages/ui/pages/serverless.stx:125,126,247—rollback,redeploypackages/ui/pages/serverless/deployments.stx:51,52packages/ui/pages/serverless/queues.stx:121—purge(irreversible DLQ purge)packages/ui/pages/serverless/scheduler.stx:55—disablepackages/ui/pages/serverless/assets.stx:53—invalidatepackages/ui/pages/serverless/data.stx:88—scalepackages/ui/pages/server/backups.stx:59,60
The correct pattern is already used elsewhere and should be applied uniformly — the token is the resource name: server/sites.stx:40, server/services.stx:67, server/workers.stx:63, server/deployments.stx:104.
Related: server/services.stx:64-69 shares one token (s.name) across all six operations, so the typed text can't distinguish "restart nginx" from "stop nginx" — only the prose verb differs. The verb should be part of the token or made prominent in the confirm bar.
Also unconfirmed, high blast radius
serverless/secrets.stx:126—setSecret()overwrites a production secret with no confirmation and no read-back (while delete, the less destructive op, is guarded at :104).server/sites.stx:179—saveEdit()withssl='false'disables TLS on a live domain in one click.server/database.stx:112— per-database backup has no in-flight lock, so N clicks start N concurrent dumps.