Undo vs Confirm
The mercy pattern traditionalTwo ways to protect a person from their own click. Confirm interrupts before the act: are you sure? — asked so often that the honest answer becomes a reflex, and the reflex defeats the protection. Undo permits the act and holds the door open after it: done — undo? One pattern taxes every action to protect the rare mistake; the other taxes nothing and rescues the mistake itself.
The judgment of this floor: undo beats confirm wherever undo is possible. Gmail's send-undo did more for email regret than twenty years of confirmation dialogs. Confirm survives for the genuinely irreversible — deletion that truly deletes, payments that truly move — and for nothing else. A confirm guarding a reversible action is an interruption cosplaying as safety.
Undo — use when
- The action can be held, delayed, or reversed cheaply (send, archive, move, apply)
- The action is frequent — frequency is exactly where confirm fatigue breeds
- The cost of a five-second hold is invisible to the user
Confirm — reserve for when
- Reversal is genuinely impossible (permanent deletion, sent money, published-to-world)
- The consequence lands on someone else, who can't be un-notified
- Law or safety demands an explicit second assent
Why traditional: “Undo beats confirm wherever undo is possible” is this floor’s judgement and long practice, not a measured result.