Undoable Beats Confirm
Rather than asking "are you sure" before the action, let it happen first and offer a window to undo.
- 用户对所有确认弹窗都直接点确定，从来不读
- 批量操作时要一个个确认，烦到不想用
- 真的删错了，除了找你恢复没有别的办法
The problem with confirmation dialogs is that their cost distribution is inverted: out of a hundred actions, maybe one is a mistake—but all a hundred get interrupted. And once dialogs become routine, users form muscle memory and click "confirm" on reflex—the one genuine mistake still slips through.
Undo moves the cost onto the one time something goes wrong: normal actions aren't interrupted at all, and the error case costs one second to click undo.
When you still need to confirm
| 情况 | 用哪种 | 为什么 |
|---|---|---|
| 删一条笔记、归档一封邮件 | 撤销 | 可逆，影响只在自己 |
| 批量删除、批量修改状态 | 撤销 | 逐个确认会让人放弃使用 |
| 发送消息、提交表单 | 撤销 | 给几秒钟的撤回窗口就够 |
| 付款、转账 | 确认 | 钱出去了收不回来 |
| 作废合同、公开发布 | 确认 | 影响到别人，且对外可见 |
| 物理删除、清空数据 | 确认 | 真的没了。这时候还要提高确认成本 |
When confirmation really is needed, raise its cost so it can't be clicked through on reflex: require typing the contract number, turn the primary button into a danger color, replace "confirm" with a specific verb ("void the contract" instead of "confirm").
How to implement undo
- Use soft delete at the data layer. Add a deleted flag instead of actually deleting. With it, undo is just flipping the flag back — almost zero cost.
- Put the undo action next to the result feedback. The toast after a delete should carry "Undo" right on it — the user shouldn't have to look elsewhere.
- Give a generous window. Five to ten seconds is common. Batch operations can be longer, or just turn it into a trash bin.
- After undo, the user should see the thing come back. Just toasting "Undone" isn't enough — that row in the list has to actually reappear.
- A trash bin is the long-term version of undo. When the short window isn't enough, the user still has a second way back.
This approach has a side benefit for vibecoding: soft delete plus undo essentially means data never really disappears. AI-generated code has a non-trivial chance of getting delete logic wrong; this safety net makes the cost of those errors much lower.