“Reversible” means different things for different verbs
Archive is a label change: remove Inbox, then add it back. Later is two label changes: remove Inbox and add DeclutrMail/Later, then invert both. Delete moves mail to Gmail Trash, where Gmail supplies a temporary recovery period. Keep and Protected are sender settings that can be changed again.
Unsubscribe is categorically different. Once a standards request or a user-sent mailto message reaches another organization, DeclutrMail cannot pull it back. A user may subscribe again later, but that is a new request rather than an inverse operation.
Putting all five under one “Everything is undoable” message makes the easiest promise win over the actual system. A trustworthy interface names the recovery mechanism beside the action.
A preview answers questions that undo cannot
Undo can reverse a supported operation after it runs. It cannot tell the user beforehand whether the selected sender was correct, whether the count includes years of mail, whether future messages are affected, or whether an external request will be delivered.
A useful preview states what changes, what does not change, the affected scope, and the recovery path. For Unsubscribe it should say that existing mail stays put and the delivered request is one-way. For manual Archive it should say that future messages may still arrive.
The preview is therefore not decorative friction. It is the place where the product makes its model inspectable before consequences begin.
A good undo journal records exact prior state
A generic “move back” command is not sufficient. A message may already have labels, may already be outside Inbox, or may be changed again after the cleanup action. The journal should record the exact forward and inverse label deltas, bind them to one mailbox, and execute idempotently so retries do not compound.
DeclutrMail stores message identifiers and label operations rather than a duplicate message body. Activity exposes active tokens for journaled actions. Triage also shows a recent-action tray, but Activity remains the durable place to audit outcomes and initiate recovery.
The expiry should be visible. Free and Plus use seven-day journal windows, while Pro uses thirty days. Gmail Trash can end recovery earlier if the user empties it or permanently deletes a message.
Batch size changes the cost of a mistake
The same correct action can carry different risk at one sender and one thousand senders. Bulk tools should preview aggregate counts, isolate per-sender failures, preserve one auditable batch identity, and avoid optimistic success before workers finish.
A small first batch is still the best operational control. It tests sender identity, Gmail behavior, recovery, and the user’s interpretation of the preview before the largest selection runs.
Speed should come from eliminating repeated confirmation once the model is understood, not from hiding the scope on the first irreversible decision.
Automation needs observation in addition to undo
A manual mistake affects one reviewed set. An active rule can repeat the mistake every time the condition matches. Undoing yesterday’s messages does not correct tomorrow’s rule unless the automation state is also paused or changed.
DeclutrMail’s presets begin in Observe for seven days. Would-be matches accumulate without moving mail. Activation has its own dry run and explicit state. The safety model is not “the rule is fine because actions can be undone”; it is “the user saw representative matches before the rule began, and can still audit each result.”
Unsubscribe automation deserves extra caution because delivered requests have no inverse. Protected senders are excluded before recommendations so known exceptions do not enter the automation path.
Trust comes from bounded claims
“Recoverable for seven days from Activity,” “restorable from Gmail Trash for up to thirty days,” and “cannot be undone after delivery” are less elegant than one universal promise. They are also useful when something goes wrong.
The standard for a cleanup product should be that every action has an explicit scope and an honest recovery statement, including when that statement is no. Reversibility then becomes a real system property instead of a marketing adjective.