The recovery cost belongs in the approval

The review card said the action was reversible. The provider said deletion was best effort.

If delivery succeeded and the response disappeared, N17Q might not know which resource to remove. If deletion succeeded, recipients could still retain notifications and audit history. If the account changed, the recovery capability might no longer be available.

The card's green Undo available label described an interface control, not a guarantee.

I had designed approval around what the agent wanted to do and hidden what the system could do if the action went wrong.

The happy path was an incomplete consequence

The first approval summary named verb, destination, artifact, and expected result. That was enough for a deliberate action under ideal transport.

Consequential tools did not live in ideal transport. Requests timed out after acceptance, providers returned incomplete receipts, identities expired, partial batches succeeded, and compensation introduced another effect.

N17Q expanded the review object to include failure boundary, outcome observability, retry semantics, postcondition, and available recovery. These details came from the versioned tool contract and current connection state.

Consent covered the behavior the product might actually exhibit, not only the result it hoped to reach.

Reversible was not a boolean

Actions occupied a spectrum.

A local uncommitted patch could be discarded completely. A stored draft might be deletable while provider logs remained. A published document could be unpublished but already copied. A sent message could not be recalled reliably. A database update might have a tested inverse only while no dependent state changed.

N17Q replaced the boolean with recovery dimensions: technical operation, required authority, time window, coverage, residual visibility, third-party propagation, cost, and confidence.

The interface summarized these dimensions in plain language and let reviewers inspect the contract evidence.

Calling a deletion “undo” implied that the original event had never happened. That was false for most external systems.

N17Q used compensate when a later action could reduce or correct impact. Compensation received its own intent, policy decision, approval where required, attempts, receipts, budgets, and uncertain outcomes. It never reused the creation identity.

The original effect remained in the trace. Current world state could become repaired while historical visibility stayed explicit.

This language made the recovery promise smaller and therefore more dependable.

Recovery depended on the failure boundary

Before an adapter sent a request, cancellation could prevent the effect. After a confirmed response, the system could often act on a known resource. Between those points, the outcome could be unknown.

The approval view showed the adapter's meaningful boundaries: prepared locally, request may have left, provider acknowledged, resource observed, and postcondition verified. It explained what the system would do after interruption at each one.

For the message fixture, a lost response after send meant stop and reconcile by stable key. It did not mean retry automatically or promise deletion.

Recovery became a state-dependent plan rather than one generic button.

Some providers supported querying by client key. Others returned a resource reference only in the response. Some exposed event history; others offered no authoritative way to distinguish absent from delayed.

N17Q recorded query capability, consistency window, identifier retention, receipt authority, and known blind spots. The review projection converted that into a sentence such as: “If confirmation is lost, the system can check by request identity for 24 hours; after that, manual inspection may be required.”

Unknown properties stayed unknown. A parameter named idempotency_key did not justify a stronger claim without documented and tested behavior.

Recovery authority could differ from execution authority

The connection allowed creating a review request but not deleting one. The old card assumed that if N17Q could perform the action, it could reverse it.

Before approval, the product evaluated current capabilities for recovery separately. It also considered whether the user, another role, or only the provider administrator could act. The view named who would be needed.

An action could remain approvable with limited recovery, but the limitation was prominent. High-impact policy could deny it or require another channel.

Capability asymmetry stopped hiding behind an optimistic verb.

Recovery windows needed exact time semantics

“Can be recalled briefly” was unusable. Briefly could mean seconds, a business day, or until another person read the item.

N17Q displayed absolute expiry and relevant condition using the user's zone, while receipts stored the underlying instant and clock basis. A countdown was supplementary. If the window depended on provider state rather than time alone, the interface said so.

Approval expiry and recovery expiry were separate. The action might need to start within ten minutes while compensation remained possible for an hour.

The view made both deadlines visible before execution.

A successful delete response did not always prove the resource was no longer visible. A corrective update might leave caches or derived artifacts unchanged.

Tool contracts specified the strongest observable postcondition and how to verify it. N17Q distinguished request accepted, recovery effect acknowledged, target state observed, and residual effects unknown.

The approval view summarized the promised endpoint. After recovery, the final account reported which level had been reached.

This prevented a green transport response from becoming a stronger product claim than the evidence allowed.

Partial batches made recovery item-specific

A batch of ten invitations could deliver six, reject two, and leave two unknown. One “Undo batch” promise was meaningless.

N17Q assigned intent and receipt per independently duplicable item, even when transport used a batch container. The review view showed count, grouping, partial-failure behavior, and whether compensation operated per item.

After interruption, known completed items stayed complete, rejected items stayed absent, and unknown items entered reconciliation. Recovery could target exact observed resources.

Transport efficiency never collapsed the consequences a person might need to repair.

Human recovery had to be actionable

“Manual intervention may be required” moved risk into a phrase and offered no plan.

N17Q required a handoff recipe for consequential tools with incomplete automated recovery. It named the system to inspect, stable safe identifiers, evidence to compare, authority likely needed, deadline, and actions that should not be repeated.

The approval screen summarized the existence and burden of that path. The full recipe became available if the run stopped.

Manual recovery was still costly and uncertain, but it was no longer an unspecified person solving the product's omission under pressure.

One document publication and one message to a distribution list both appeared as a single tool call. Their reach differed dramatically.

N17Q calculated bounded consequence facts from normalized arguments and current destination metadata: recipient count where known, visibility, propagation features, dependent automations, and data classification. It avoided speculative audience estimates when the provider could not supply them.

The interface elevated unusually broad or changed scope. A destination alias resolving to more recipients than at preparation invalidated the artifact and required review again.

Recovery limits meant more when shown beside the size of the thing that might need recovery.

Deleting a shared file could remove future access and could not make readers forget its contents. Revoking a token could stop later use and could not erase earlier logs.

N17Q described disclosure residuals explicitly: copies, notifications, indexing, model ingestion policy, caches, and audit retention where known. Data policy could prohibit the initial action when residual exposure exceeded the task's scope.

The review view did not use “reversible” for disclosure merely because a delete endpoint existed.

This was less reassuring and more respectful of what consent was meant to cover.

Cost recovery was not state recovery

A provider could refund a failed job while the created artifact remained, or delete the artifact while compute charges remained. The original UI combined these under impact.

N17Q separated world state, audience exposure, financial cost, quota consumption, and operational burden. Recovery contracts described each dimension independently.

A retry might be consequence-safe under idempotency and still consume another billable attempt. A compensation might correct state and add cost.

Reviewers saw the meaningful residuals for the capability rather than a generic low, medium, or high risk badge.

When recovery was weak, the most important guarantee was often a stop condition.

N17Q declared that after an unknown consequential outcome it would not create another semantic intent automatically, switch providers, broaden tools, or claim failure as absence. It would use the bounded query reserve, then pause with evidence.

The approval view stated this behavior. A person could consent knowing uncertainty would produce containment rather than increasingly creative retries.

The ability to stop was a recovery property even when no inverse action existed.

Provider behavior, permissions, and APIs changed. A contract tested six months earlier could overstate current capability.

The registry stored source revision, last fixture verification, connection probe status, and known incidents. High-impact policy required fresh evidence. If deletion permission disappeared or query behavior changed, affected approvals could not rely on the old recovery projection.

Review surfaces displayed material degradation and forced rematerialization when it changed the consequence.

Recovery claims were versioned operational knowledge, not permanent copywriting.

Simulated failures tested the interface copy

It was easy to write “the system will reconcile” without verifying that the query contract could handle delayed visibility or ambiguous duplicates.

N17Q generated review text from contract fields exercised by fixtures. Scenarios lost responses before and after commit, delayed queries, expired identities, denied compensation, and returned conflicting receipts. The resulting trace had to follow the behavior the interface promised.

Copy tests checked that high-impact limits remained visible at realistic viewport sizes and did not collapse behind optional help text.

The words on the approval card became a testable projection of system behavior.

Progressive disclosure preserved the main decision

Showing every failure branch at once made the review surface unreadable. Hiding them behind a generic “Learn more” made them easy to miss.

N17Q led with consequence, scope, data, and one recovery summary. Material limitations appeared inline: Cannot reliably recall after send or Unknown outcome may require manual inspection. A structured detail view exposed boundaries, receipts, windows, residuals, and handoff.

The amount of detail adapted to effect class and novelty. Repeated low-risk local changes stayed compact; first-time external disclosures received more context.

Hierarchy reduced burden without reducing the decision to a button.

If the provider contract, recovery permission, audience, or postcondition changed after rendering, the old approval no longer described the executable action.

The receipt included normalized consequence digest, tool mapping, policy revision, connection identity, and recovery contract revision. The final gate checked all of them. A mismatch returned to review with a focused diff of what changed.

An improvement in recovery could still require rematerialization because the reviewed object was different. A degradation always did for consequential actions.

Consent stayed attached to the entire material representation, including its limitations.

Recovery controls did not bypass review

During an incident, urgency encouraged broad delete or revoke tools. Giving the agent automatic access to them could compound the original problem.

N17Q offered contract-defined recovery capabilities only for the active intent, target identity, and allowed window. Policy and approval still applied according to impact. Status queries could draw from a protected non-mutating reserve.

The interface separated inspect outcome, prepare compensation, and execute approved compensation. A red warning did not become ambient authority.

Recovery paths were narrow workflows, not emergency superpowers.

Recovery burden affected autonomy limits

Two tools could have similar immediate impact and very different failure burden. A local artifact export had a complete disposable boundary. An external publication depended on manual inspection, a short query window, and another administrator for removal.

N17Q used those facts when deciding whether an action could run automatically, required review, or was unavailable. Weak recovery did not always prohibit an effect, but it reduced the amount of autonomy policy granted around it.

The approval view explained when limited recovery was the reason for a stronger checkpoint. That made the interruption feel connected to the actual system, not an arbitrary category label.

Autonomy scaled with the product's ability to observe and contain failure.

The person approving an action might not be the person investigating it later. A prose warning visible only before execution was a poor incident artifact.

N17Q stored the reviewed recovery projection with the effect intent. Unknown outcomes generated a handoff containing current state, last safe boundary, deadlines, identifiers, permitted queries, unavailable actions, and escalation path. It used the same contract revision the reviewer had seen.

A new operator could continue without rereading the whole conversation or trusting a model summary. If the plan was stale, the handoff named what changed.

Consent and recovery remained connected across time and ownership.

Accessibility changed how risk was presented

Color and icons alone could not communicate that an action lacked reliable compensation. Dense technical tables were difficult under keyboard and screen-reader navigation.

The review component used ordered headings, concise text labels, explicit state names, and predictable disclosure controls. Critical limitations appeared in the reading order before the approval controls. Counts and deadlines were announced as text rather than encoded only in badges.

Focus moved to the changed consequence when rematerialization was required. The product tested the full approval and recovery path with keyboard and reduced motion settings.

A safety boundary was only real if the reviewer could perceive and operate it.

Repeated approvals encouraged habit. Hiding recovery details after the first successful use would make interface familiarity substitute for current evidence.

N17Q could collapse unchanged low-risk details, but always recomputed scope, connection capability, recovery window, and material contract changes. The summary highlighted differences from the last reviewed action. A previously recoverable operation could not inherit yesterday's reassuring label.

Review history helped users recognize stable patterns while the current receipt stayed bound to current facts.

The system respected learned familiarity without turning it into permanent consent.

The final account compared promise and result

After execution, N17Q rendered the approved recovery projection beside what actually happened. It named attempt boundary, receipt strength, postcondition, remaining window, and residual uncertainty.

If the provider exceeded the documented delay, the report flagged contract drift. If no recovery was needed, it still retained the plan that informed consent. If compensation occurred, the original and corrective effects stayed linked but separate.

This made approval evidence useful after the button press. It could be audited against reality rather than archived as ceremony.

The misleading Undo label disappeared

In the repaired message scenario, the approval view said that delivery could not be reliably recalled, a lost confirmation would pause for identity-based reconciliation, notifications might persist, and manual inspection could be needed after the query window.

The reviewer could inspect the exact recipients and artifact, then approve or decline. After a simulated lost response, N17Q did not send again. It found the existing delivery by key, verified the receipt, and reported that no recovery effect was necessary.

Nothing about the action had become safer because the interface used more words. The decision became better because the interface stopped promising control the system did not possess.

That honesty also improved refusal. A reviewer could decline because the residual audience was too broad, the compensation permission belonged to someone unavailable, or the reconciliation window was too short. N17Q preserved that reason as product evidence and offered safer alternatives such as a local export, narrower destination, delayed draft, or manually controlled handoff. The interface did not frame rejection as friction to overcome. It treated the reviewer's understanding of recovery as part of the system's decision quality.

Approval is not only permission for an intended success. It is consent to a bounded process that includes uncertainty, stopping, observation, and whatever correction is genuinely available.

The review should show that whole boundary before the world is asked to change.

Only then does the button represent informed control rather than optimistic acknowledgement of the agent's preferred path.

For everyone.