Undo is a design material

Every confirm dialog is a small admission that the action can't be taken back. At Harbour Mail we timed it: people answered the archive dialog in under 400ms, faster than anyone reads. The question had become a speed bump, and it still let mistakes through.

We made archive immediate and moved the decision after the action instead of before it. A pill offers the thread back for five seconds. Archive three and the pill counts them, so one undo returns all three.

Once undo is reliable, the rest of the interface gets lighter. Buttons lose their warnings, menus lose their second step, and destructive actions can sit where they are used instead of behind a settings page.

It only works if undo is honest. Five seconds has to mean five seconds of deciding, so the timer stops under the pointer. And anything that really can't be taken back, like sending, still asks.