“The requirement to adapt to unexpected circumstances tests both organization and system, revealing weaknesses that are partly structural and partly functional, whose full potential for disaster may not previously have been noticed.”