What Can the Next Person Still Do?

In the early 1900s, Norwegian conservators pulled waterlogged wood out of the Oseberg Viking ship burial and soaked it in hot alum. It worked. The wood kept its shape, the objects survived drying, the method became standard practice. A century later, researchers found the alum had been quietly destroying the wood's internal structure the whole time. The obvious repair — wash the alum back out with water — would collapse the worst pieces on contact. The treatment that saved the artifacts used up nearly every move available to the people who came after.

I keep coming back to this because it's the cleanest picture I've found of what goes wrong in recovery. We ask whether the thing we just did can be undone, and in production the answer is almost always no. Not cleanly, not without bullshitting yourself about what "undo" means. I argued in Issue #40 that forward is a function and backwards is a judgment call about the world. Follow that through and the recovery question changes shape: after we act, what can the next person still do?

Conservators have a word for the property — re-treatability. The AIC Code of Ethics codifies the substance without the word: treatments should not adversely affect future examination, investigation, or treatment. That's a lower bar than reversibility and a far more useful one. Set Oseberg next to the Getty's 2017 reconstruction of a fragmented Roman obelisk, where the team ran pins through holes that were already there, used magnets for the fills, and built the sections to come apart on purpose. When the obelisk went home to Italy they disassembled it, flew it, and rebuilt it on a seismic-isolation base. Stable enough to stand in a gallery, loose enough to take apart again.

A refund has the same shape if you look at it honestly. The original charge persists. So does the refund transaction, the changed account state, every notification that went out. Nothing was erased; recovery wrote new state on top of old. That new state will never match the world before the charge — it can't — so the thing worth checking is whether whoever touches the account next, a support rep or a reconciliation job or another agent, has enough information and enough room left to do the right thing.

The ugly version shows up in incident response. After the 2023 East Palestine derailment, Norfolk Southern returned locomotives to service before their image recorders had been fully downloaded, overwriting footage the NTSB had requested that morning. The railroad got its equipment back and the investigators lost the record. NTSB still found the cause — a failed wheel bearing — but the chair noted that the lost recording foreclosed safety improvements a longer record might have supported. Restoring service and preserving the ability to learn from the failure pulled against each other, and nobody had treated evidence preservation as a constraint on the restart.

A re-treatability lens catches that. Not because asking guarantees a different call — sometimes you restart the box anyway, because the alternative is staying down — but because it drags the trade-off into the open. Protecting the footage before turning the engines over was a design choice nobody filed as one. Once you're asking what the next operator will need, recovery procedures start carrying a preservation step next to the restore step.

For agent systems this stops being philosophical in a hurry, because actions compound at machine speed and the next operator is often another agent with no idea why the state looks the way it does. Issue #43 asked whether a human can get in before the window for intervening shuts. Re-treatability picks up after that window closes: once the crisis is over, does the state you left behind still permit a correct move? Or is your fix doing what the alum did, holding the shape beautifully while the options underneath quietly go away?