Make recovery cheap

Teams obsess over accuracy percentages when the number that governs adoption is recovery cost. People are remarkably tolerant of a fallible tool when being wrong is cheap to fix — every developer tolerates Copilot’s bad completions because rejecting one costs a keystroke. The same person abandons an AI email tool after a single wrong send, because that error can’t be recovered at all. Design the miss, not just the hit.

The floor is reversibility. Any AI action that mutates real state — files, records, messages, calendars — needs an undo that actually restores the prior state, not a fresh conversation about the damage. Cursor keeps AI edits in checkpoints you can roll back wholesale; Notion AI writes into a document whose full version history sits one menu away. Where true undo is impossible (a sent email, an executed payment), the pattern inverts: that action needed an approval gate before it ran, because recovery after the fact was never available. Reversibility and approval are two ends of the same rope.

Above the floor is cheap iteration. The worst recovery loop in AI products is the blank-slate retry: the output missed, so the person rewrites the entire prompt from scratch and gambles again. Refinement patterns fix this — ChatGPT and Claude let you edit a previous message and branch from it, keeping everything that was right; image tools like Midjourney build the loop into the product with per-result vary and rerun controls. The unit of recovery should be the delta (“shorter, and keep the second paragraph”), never the whole request.

Mid-flight recovery is cheaper still. The ability to stop a generation or interrupt an agent the moment it veers wrong means errors are caught at the sketch stage instead of the delivered stage. Claude Code letting you halt a run and redirect it saves not just the wasted work but the entire review-diagnose-re-prompt cycle that a completed wrong result forces.

And persistence is a recovery feature that gets misfiled as a convenience feature. When work lives in a versioned artifact — Claude’s Artifacts, ChatGPT’s Canvas — a bad revision is a version pointer, and “go back to the one from before lunch” is a click. When work lives only in chat scrollback, recovering the good version means archaeology. Judge every AI feature by one question: when it’s wrong, what does the next fifteen seconds look like? If the answer is “start over,” the feature isn’t done.

The serious objection is that recovery machinery is expensive and can license carelessness. Checkpoints, version trees, branching conversations, and true undo across mutated state are hard engineering — Cursor’s rollback system is a real subsystem, not a feature flag — and every hour spent there is an hour not spent making the model miss less. There’s a moral-hazard argument too: make errors free and you invite slot-machine behavior, users rerunning generations endlessly instead of writing better prompts, burning compute on retries that a sharper first attempt would have avoided. Some teams conclude the money is better spent on accuracy. But this gets the economics backwards. Accuracy improvements are asymptotic and expensive at the margin; recovery-cost improvements are step functions you ship once. A ten-point accuracy gain on a system with expensive misses still leaves adoption gated by the miss; a five-second recovery loop makes the current accuracy tolerable today and every future accuracy gain compound. And the “carelessness” is called iteration — it’s how people actually work with probabilistic tools.

Measure the miss, in seconds and in survivals. The primary metric is time-to-recovery: instrument the interval between a rejection signal (regenerate, undo, edit-and-resubmit, interrupt) and the next accepted output, and drive the median toward seconds, not minutes. Watch the shape of retries — edited-prompt refinements and branches are healthy; verbatim blank-slate re-asks mean your refinement affordances are failing. Undo and checkpoint-rollback usage should be present and unremarkable: near-zero usage on a mutating agent means people don’t trust or can’t find it, and rollbacks followed by abandonment mean the restore didn’t actually restore. The number to put on the wall is retention-after-first-error: Copilot-style products survive on it, because everyone hits a bad completion in week one. Good looks like users who experienced an error in their first session retaining within a few points of those who didn’t — proof that being wrong has been priced at seconds. If the error cohort craters, your accuracy is fine and your recovery is the product’s real defect.