Is it possible to "take back" a shutdown statement? Would a before database trigger do any good?

You have both development and production SSH sessions open, Oracle 11gR2 single instance on Linux. You execute a SHUTDOWN immediate that was intended for development, but you've just introduced an unscheduled production outage. What would you do to sanity-check a shutdown on certain hosts during certain hours?

One possible workaround I've thought of is to change the practice of command-line, interactive shutdowns. Running an OS shell script, or even SQLPlus, will readily set a trap for the SHUTDOWN, and require some form of pre-confirmation during normal business hours.

Once the command leaves the client, however, do you have any technique to ask, are you sure?  Thanks in advance, all.