Optimistic updates do not belong on irreversible actions
Aliases: irreversible write · optimistic payment · send without recall
What it is
Once a real-world effect cannot be taken back — money moved, mail left the outbox, an account wiped, a legal filing submitted — the screen must not pretend it has already happened. Optimistic updates do not belong on irreversible actions: the interface waits for the authority to confirm, then paints completion. Optimism’s insurance is “we can take it back if we were wrong”. Irreversibility voids that policy.
Irreversible means the consequence that matters to the user cannot be rewound, not whether the database can undo. A letter already in someone else’s inbox is too late for a local rollback.
Why it happens
The safety pad under optimism is a symmetric rollback: the server says no, the screen rewinds pixels, the real world was never changed, the debt clears. Irreversible acts break the symmetry. Once the other side accepts the request, the effect lands in another system, another person, or an unrewritable record. If the screen has already painted success, people inside the divergence window walk on: dismiss the dialog, tell the other party “I sent it”, leave the payment page. When failure returns (or worse: success that is not the success they thought), pixels can be taken back; the external effect cannot.
A second layer is when confirmation counts. Irreversible acts usually want one last check of intent (amount, recipient, deletion scope). Painting completion early swaps that check from “authoritative result” to “local guess”. The ritual is still there; the constraint is hollow. Payments add duplicate-submit risk: optimistic success lets people leave, a timeout then retries, and the other side may already have charged once.
Where it stops holding
If the product promises recall before the other party reads, “sent” may be shown optimistically inside the recall window — marked as still recallable, never painted as read. Soft-delete into a trash is reversible; optimism can apply. Hard wipe after the retention window cannot. Local encryption or local recording that never left the device fails on disk, not on a counterpart; that is not this leaf’s irreversibility. A post others will see at once has irreversible social cost for the publisher, even if a delete exists technically; it often should wait for confirm. Flows that lawfully require a second person or a signature cannot be skipped by painting done.
Applying it
- List every irreversible write: payment, outbound send, permanent delete, granting permission outside the org, legal submit. Those paths must not paint the primary state as complete before confirmation.
- On press, give local “accepted, submitting now” at once — that is instantaneous causation, not optimistic success. Completion appears only after the authority replies.
- A timeout must not be redrawn as success. Stay on “still submitting / unknown” and offer a lookup or a contact, until the authority has a conclusion.
- How to check: on pay, send, and permanent delete, inject a 5 s delay then success, and inject a failure. If “paid / sent / deleted” appears during the delay, this fails. If a completion state flashed before the failure, it also fails. Contrast with a reversible like: it may light first, to confirm optimism was not banned from the whole product.