Reversible actions can replace a pre-confirm with undo

What it is

If an action can be rolled back fully while the user can still hear the result, do it, say what you did, listen for undo can replace the pre-execution yes/no. “Playing jazz in the kitchen — say cancel to stop” costs a turn only when it is actually wrong, unlike “shall I play jazz in the kitchen?” every time. The undo has to be real, and the error has to be hearable. If reversibility is thin, or the user cannot notice the miss, the pre-confirm cannot come off.

Why it happens

A pre-confirm taxes every attempt, including the 99% that were right. Post-hoc undo taxes the misses, plus the requirement that the person notice. GUIs hang a visual change as an attention hook; speech vanishes, so the hook is the result utterance itself. If that utterance is too short, masked by noise, or boilerplate, nobody notices and the undo window expires unused — reversible on paper, irreversible in operation.

The window has to cover hearing the result, deciding to cancel, and saying it, and the cancel token has to stay in the recognizer the whole time. Too short, and there is no substitute; too long, and a third party may already have seen the world (the message was read). “Reversible” is not a boolean; it is window, noticeability, and live grammar together.

Studying it

On the same reversible action, compare confirm-before-every-run with do-then-speak-then-undo. Dependents: total task time, uncorrected errors, and the rate at which undo is actually spoken. Then vary the window (two seconds vs ten) and whether a screen is present. Hands-and-eyes occupancy hurts noticeability more than a lab: drivers miss the result line.

In logs, check whether undo words arrive after the window has closed. A late “wrong” becomes a new command, which looks like a recognition failure and is actually a timing failure of the substitute.

Where it stops holding

Once money has cleared or mail has reached someone else's inbox, undo holds for the speaker and not for the world — no substitute. A near-name recipient, with “sent to Mom” spoken while the number has changed, fails noticeability. On a multi-user device the person who acted may leave the room; undo rights land on someone else. An undo that itself asks for a confirm puts the friction back and the substitute is gone. Irreversible or high-cost cells were never in scope.

Applying it

• Enable only for actions the table marks reversible with bearable cost: execute → speak a specific result (device, object) → name a sayable undo word → keep that word live for the window.
• Make the undo word guessable (“cancel,” “stop”). Do not hide it in “you can also undo the last step.”
• The result line must expose the error: “sent to Manager Zhang,” not “sent.” If the miss cannot be heard, the confirm cannot come off.
• How to check: force one wrong execution. Saying undo inside the window should restore the pre-action world. Mute the result line and try again — if errors start leaking, the substitute depended on that line, and the line is not a deletable courtesy.

Related

• Same group: M2.09.1 Consequence is reversibility and cost together, not one severity knob · M2.09.3 Frequent low-risk confirms train a blind yes · M2.09.4 Actions that affect other people escalate on their own
• Nearby: M2.03 Confirmation strategies · M3.04 Barge-in · M1.06 Repair strategies
• Search terms: undo window · post-hoc undo · speak-back then undo