Ship an Undo button for the whole computer

Your product runs an agent inside each customer's container. Sometimes the agent gets it wrong: restructures a project the customer liked, migrates data the customer wasn't ready to migrate.

So the product ships an Undo button. Before every agent run, your backend snapshots that customer's container. The button is a PUT: restore the snapshot, and the customer's entire machine: files, database, installed packages: returns to the moment before the agent acted.

You didn't build versioning into your data model. You didn't write compensating transactions per feature. Undo isn't application logic at all; it's a property of the substrate, surfaced as a button.

Editors have had undo for fifty years. Your customers get it for a whole computer.