Trash Is Not a Universal Undo

"An honest 'it's in the Trash' beats a dishonest 'don't worry, I can undo anything.'"

The Seductive Feature You Should Refuse

It's tempting to promise universal undo: every move, replace, and delete reversible with one command, forever. Users would love it. But think about what it requires — to undo a replace, you'd have to secretly keep a copy of every file you overwrote; to undo a delete, a copy of everything deleted. That's a shadow store of duplicated data with its own disk cost, its own drift, and its own broken promises the day it can't actually restore. Universal undo is a lie that gets more expensive the longer you keep it.

What Waygate Does Instead

Waygate uses the system Trash. When you delete, it calls the macOS Trash API and records the resulting trashed URL in the journal as evidence. Restoration is a macOS Trash workflow — Put Back in Finder — not a fabricated undo Waygate pretends to own. This is honest: the file is exactly where the OS says it is, recoverable by the same mechanism every Mac user already knows, with no secret duplicate store to maintain or lie about.

Replace Is Handled, Not Hidden

What about overwriting a file? Waygate doesn't pretend that's undoable either — instead, before a replace, it protects or stages the existing destination according to the accepted collision plan, so the operation is recoverable within its own transaction. That's a bounded, journaled safety net for one operation, not an open-ended promise to reverse anything ever. The difference is the whole ethic: bounded honesty over unbounded pretense.

Trash is a system-backed workflow, not a fabricated universal undo. Waygate uses the macOS Trash API and records the trashed URL as evidence; restoration stays a macOS Trash operation. It never maintains a secret shadow store of everything it touched to fake an 'undo anything' it can't truthfully guarantee.

Track cleared — moving is safe now. Same-volume rename versus cross-volume rewrite, the destructive barrier, stage-verify-publish, partial-is-never-final, and honest Trash. This is the copy/move/delete story a file manager has to get exactly right, and it's the reason Waygate can be trusted with the delete key. Next: what happens when the destination is already occupied.

Code

System Trash, recorded — not a fake undo store·swift

func trash(_ item: URL, _ plan: OperationPlan) async throws {
    var trashedURL: NSURL?
    // The SYSTEM Trash API. Restoration = Finder's Put Back, which users know.
    try FileManager.default.trashItem(at: item, resultingItemURL: &trashedURL)
    // Record WHERE it went as evidence -- no secret duplicate kept by us:
    try await journal.mark(plan.id, .committed,
                           evidence: .trashed(url: trashedURL as URL?))
}

// What Waygate deliberately does NOT build:
//   a hidden ~/.waygate-undo-store/ holding copies of everything ever
//   replaced or deleted, so a 'universal undo' can restore it. That store
//   is a shadow filesystem, and shadow stores drift and lie. Refused.

Exercise

Sketch what a true 'undo any file operation, anytime' feature would have to store to work: think about undoing a replace from last week, then a delete from last month. Estimate the disk cost and the moments it would fail to deliver. Then argue why 'use the system Trash and be honest about the rest' is the more trustworthy design.

Hint

To undo an old replace you'd need the overwritten bytes retained since then; to undo an old delete, the deleted bytes — potentially duplicating a large fraction of your disk indefinitely, and still failing when the store was pruned or the volume changed. Honest Trash plus per-operation staging gives real, bounded recoverability without a growing shadow store that will eventually break its own promise.

Trash Is Not a Universal Undo

The Seductive Feature You Should Refuse

What Waygate Does Instead

Replace Is Handled, Not Hidden

Code

External links

Exercise

Progress

Comments 0