R2 object storage disabled during a phishing report remediation

Lesson: Abuse tooling needs the same guardrails as production changes: scope checks and a second pair of eyes before an action can disable a whole service.

What happened

While remediating a phishing URL report, an employee disabled the R2 Gateway service instead of a single bucket. Operations against R2 failed at a 100% error rate from 08:14 to 09:13 UTC, and reconnecting clients overloaded the metadata layer until 09:36 UTC.