Undo safely

ConfigOps performs compensating writes. It does not rewind the database or claim to reverse side effects it did not observe.

Before selecting Undo

1. Read every change in the request group.
2. Confirm the site should return to the recorded baseline.
3. Check that no one intentionally changed the same setting afterward.
4. Keep a tested backup for consequential configuration.
5. Prefer an individual field or option over whole-capture undo when that is the true intent.

Conflict check

The current option must still match the captured after state at the scope ConfigOps intends to restore. If it differs, ConfigOps refuses to write. This prevents a stale capture from silently overwriting newer work.

Two restore modes can appear:

• Full option: the complete typed before/after values are safely encoded and the entire current option matches.
• Field patch: a tested adapter can restore supported non-secret paths while preserving an existing hidden credential or unrelated field.

Field patches remain adapter- and schema-bound. ConfigOps does not synthesize a patch for an unknown nested value.

Local references

Some settings point to local media, pages, or users. ConfigOps stores bounded identity evidence—not file contents, post bodies, or account data. Before undo, it verifies that the referenced target still exists and remains usable. Missing or trashed targets block the write.

Serialization and audit

Restore operations acquire a local operation lock. Every attempt writes a value-free audit record before its first configuration write, then records success, failure, compensation, or compensation failure.

For a multi-option capture, ConfigOps applies eligible writes in sequence. If a later write fails, it attempts to compensate earlier writes back to the state seen before the restore began. Compensation can also fail; that condition is recorded and requires manual investigation.

After undo

• Reload the affected plugin or WordPress settings screen.
• Verify the visible behavior, not just the ConfigOps status.
• Check relevant health signals such as outbound mail, indexing, URLs, or cache behavior.
• Investigate any failed or compensated audit entry before another attempt.

Not a backup restore

ConfigOps cannot reverse email already sent, external API calls, cache purges, filesystem writes, custom-table changes, or plugin side effects that occurred outside the observed Options API mutation.

See Failure model for the full fail-closed matrix.