What Is Undo

Control-Z is the most trusted key on the board. You reach for it without deciding to, dozens of times a day, and it works — the paragraph comes back, the deleted row returns, the colour you did not mean to apply goes away. Because it works, almost nobody looks at it. Underneath sits a picture, and the picture is a claim: the key performs a reversal, the last thing you did is removed, and you are returned to before it. That picture is comfortable enough that we have extended it a long way outward. An unsend button. A return window. A cooling-off period. A probationary month. Let us pretend I never said that. Each of those borrows its credibility from the key that works. Three ordinary situations show that the key does not do what the picture says it does, and the third one is the case where it works perfectly.

One neighbour first, so the two are not merged. I wrote a piece on forgiveness whose argument was that most accounts of it quietly define it as an edit to what happened, and that no such edit is on offer to anyone. That piece is about a wish with no mechanism under it. This one is about a mechanism that genuinely works — undo is not a false promise, it is a real operation used successfully several billion times a day — and the whole job here is saying where its boundary runs, and why it runs there rather than somewhere else.

What the ordinary picture commits you to

State it strongly, because the weak form is not what anybody believes.

Three commitments. First, that an undo removes: after the operation there is less in the world than there was before it. Second, that it restores the situation and not merely the object — put the state back and you are where you were. Third, that a complete undo leaves nothing behind, so that where the mechanism fully succeeds, the episode is closed as though it had not occurred.

Three ordinary situations do not fit inside those commitments.

So the operation adds where the picture says it removes, leaves the situation standing where the picture says it restores it, and leaves a residue where the picture says it closes the episode. Something real is being restored — a great deal is, routinely and usefully, and I am not building toward the claim that undo is a lie. It restores one thing and not another, and the part it misses is not a shortfall in anybody’s engineering.

What the foundation says instead

I work from a short list of numbered primitives and results derived from them. The result doing the work today is one the series has leaned on a dozen times as scenery and has never once written about for its own sake.

R2, write-protection: records are add-only, and the update a record makes to expectation runs forward and does not re-open. Two clauses, and the second is the one that gets skimmed. It is not only that marks accumulate. It is that the thing the marks change — the expectation a person is carrying — has no reverse gear either.

R3, the Arrow Theorem: given an immutable numerator and a forward-only denominator, time has a direction. I want to be careful here, because this is a derived result and nearly everyone treats its content as a starting assumption instead. The direction is not a container that events are sitting inside. It is not a background against which things happen to happen. It is what the asymmetry between two terms amounts to, and both terms are required to get it — a record that only grows, and an expectation that only moves one way.

Here is what direction-as-derived buys that the one-way update does not buy on its own. If the arrow were only a rule about the second term, you would expect operations that never touch expectation to be arrow-free, and you would expect the arrow to show up in mental life and nowhere else. R3 locates the direction in the relation between the two terms. That makes a prediction the one-way rule alone does not make: any operation that reaches one term and not the other will look partly successful, and what it leaves behind will be exactly the other term. Not a vague shortfall. A specific one, with an address.

Which is a description of undo.

P4 gives the Reality Equation, R = A / E — the Actual over an Expectation made of subconscious prediction and ideas — and R8 says the human experiences only the quotient. Not the Actual, not the Expectation. The ratio. The framework’s locked distinction between an act and an artifact supplies the last piece: an act is a process, an artifact is a mark, and pressing Control-Z is an act performed now that produces a mark now. The mark it produces resembles an earlier one. Under write-protection it does not replace that earlier one; it joins it.

The operation adds where the picture says it removes, and leaves a residue where the picture says it closes the episode. The part it misses is not a shortfall in anybody’s engineering.

Why it works as well as it does

That could be read as a debunking, and it is the opposite of one. Most of what anybody wants back is configuration. The paragraph, the file, the layer, the row, the transaction, the paint on the wall, the shape of a sentence before you ruined it. That is a real class and a very large one, and inside it the word means precisely what it says.

It is also why software is the native home of the word. A machine’s state is configuration the whole way down, so inside the machine an undo can be total — there is nothing else in there for the operation to miss.

Which raises the obvious question, and I am going to state it and stop, because the foundation records it as open and closing it in passing is exactly the move it forbids. The equation defines the quotient only where a host stands, and a host is defined as a living system. On that definition a machine has the whole of the configuration and none of the reading — which is precisely why undo inside it is complete. That is now the fifth piece in a fortnight to arrive at the same seam from a different direction, always in the same shape: the entire present-side arithmetic on one side of the line, and none of the host-side reading on the other. It is a sharper statement of the open problem than the open problem contains. It is not a resolution of it, and I am not going to pretend it is one.

Where the boundary actually runs

If the first construction holds, then the boundary of an undo is not set by how much time has gone past, and not by how hard the mechanism works. It is set by whether anybody has read the mark.

It predicts several things you can go and check.

Undo windows are timed to exposure rather than to elapsed time as such. Thirty seconds is not a physical constant. It is somebody’s estimate of how long a message sits unopened, and the number moves when that estimate moves.

A draft is trivially undoable and a published post is not, and the difference between them is not technical. The bytes are equally deletable in both cases. What differs is who has already looked.

The 1984 paper reaches the same place from the engineering side, which is the part I find most useful. Faced with effects that recovery cannot reach, the authors’ third strategy is to buffer the side effects — delay delivery so that the pending effect stays part of the object state and is therefore still reversible. That is the unsend button, thirty years early, arrived at from first principles about what a recovery facility can and cannot own. They add the honest footnote: the delivery command itself cannot be undone. They also note, in a sentence that has nothing to do with metaphysics and lands on it anyway, that no recovery facility can restore the universe to an earlier state, and that they must be content with restoring an object.

A surgeon has no undo. Not because a body is complicated — a body can be repaired, and a second operation is a real and frequently successful remedy. It is that the mark is read at the instant it is made, by the system it is made in. There is no unopened interval to race.

And the everyday one: you cannot un-know a spoiler, un-see a photograph or un-hear a sentence. The reason is not that these things are filed somewhere inaccessible. It is that the reading was the update, and the update runs one way.

Figure 01

Six operations, sorted by what they reach

Operation	Configuration restored	Already read	What is left
Control-Z, one keystroke back	Fully. The object is identical.	No — by nobody except you	Small. You know the slip is available to your hands.
Gmail undo, inside the cancellation period	Not needed. The message did not go.	No — the interval is bought for exactly this	Small, and mostly yours. The recipient has nothing.
Delete for everyone, after it was opened	Yes. The copy is gone.	Yes, and a line is added saying so	Large. The reading, plus a new mark advertising the attempt.
A returned purchase inside the window	Yes. Money back, goods back.	Partly — you know what owning it was like	Medium, and often the point. The trial was what you bought.
A retraction, correction or apology	No. Nothing is removed.	Yes, by construction — it is a response to a reading	The whole of it. This operation is an addition and is not sold as anything else.
A deleted branch in version control	Yes, and the reflog keeps it anyway.	No, if nobody pulled it	Near nothing. The clearest case of pure configuration there is.

What this costs

It costs the phrase “I can always undo it” most of its coverage. True of configurations and false of readings, and people plan under the first while living in the second. The version-controlled parts of a life are the parts with no readers in them, and those are not the parts anybody lies awake about.

It costs the standard framing of reversible decisions. Prefer reversible decisions is good advice badly stated. No decision is reversible; some have small residues. And the operative question is not whether a thing can be taken back but who will have read it before you would want to — which, unlike the first question, has an answer you can find out in advance, usually in about a minute.

It costs the hope of un-knowing. There is no operation that lowers expectation to a prior value: not a weak one, not a partial one, not a slow one. Under write-protection the update runs forward, and asking for it to run backward for a single move is asking for the direction to be absent for a single move. The direction is not a thing that could be absent, because it is not a thing at all. It is the name of the asymmetry doing all the other work. Remove it for one move and there is nothing left that the move could have been going backward through.

R14, on this idea as on any other: an idea is an orientation and a prejudice in a single act, and so is this one. It is kind to the person being far too careful with a document nobody has opened. It is unkind to the person whose real problem is a decision with a large readership, and who now has a crisp vocabulary for dread. Both readings sit inside the argument and only the first is what it says.

Where this is unfinished

Four edges, stated so that somebody can hold me to them.

The first is the scale. The foundation supplies no rate, no floor and no scale for how expectation updates. The pieces on streaks, deadlines and pace each stated that gap and I inherit it rather than filling it. Everything above ranks cases and nothing above measures one, and the third construction is weaker for it in exactly the way I have marked.

The second is what a reading is. The second construction turns on a mark having been read, and the primitives define expectation as subconscious prediction and ideas while staying silent about thresholds. A glance, a skim, a thing seen and not understood, a message opened on a lock screen and not attended to — the sorting treats these as one and they are plainly not one. That silence is the room the construction is standing in, and if the threshold turned out to matter a great deal, the boundary I have drawn would be a smear rather than a line.

The third is whether a restored configuration is a mark in the locked sense. I have been calling the thing an undo produces a new artifact resembling an old one. Whether a state of affairs that stands in the world is itself a mark in the framework’s locked sense is a question two earlier pieces raised from other directions, and none of them has settled it. I keep it outside the vocabulary here, which means the first construction is a claim about the operation and not about what the operation leaves.

The fourth is the machine, stated above and left where the foundation leaves it. The tension is recorded as open, four earlier pieces have stopped at the same definition, and the accumulation of stopped pieces is not an argument for moving it.

On a Tuesday

1. Ask who reads it and when, rather than whether it is reversible. The first question has an answer you can look up in a minute. The second does not have the answer people think it has, and asking it is how the minute gets spent badly.
2. Buy unread intervals. They are cheap and they are the whole game. A drafts folder, a staging environment, a branch, a thirty-second send delay, a night’s sleep before the reply. Every one of those purchases the same commodity: time in which a mark exists and nobody has read it. That interval is the entire operating range of undo, and unlike undo itself it can be extended.
3. When an undo is available and complete, use it without ceremony. Configuration is where the word means what it says, and there is no virtue in refusing a tool that works. Being careful about a file nobody has opened is not the same as being careful.
4. When it is not available, stop shopping for it. The move is a new mark beside the old one — a correction, a retraction, a changed practice, a better second attempt. The foundation is blunt that this is not a consolation prize: addition is the only operation anyone has ever had, and the reason it feels like a downgrade is a picture we acquired from a keyboard.

None of which is fatalism, and the foundation is careful about the difference. P5: the host can occupy a position from which its response to a readable condition is revisable. R13: agency is relocated, not abolished, and the host is the site of conscious responsibility. One term is closed. The other term is where you live, and what you do this afternoon is a term in it.