@kevin @thomasfuchs
Raskin’s arguments were also the reason that we built an undo system on top of a versioned document model in CoreObject. Our idea was that every editing operation would be persisted, immediately (and could also be sent across a network for collaborative editing). Undo was non-destructive and took you to an earlier state and introduced a new branch in the history, which you could visually navigate and pull edits from another branch and marge them if you wanted to.
This meant that you didn’t lose undo history when you rebooted and you had no UI abstraction for ‘save’. Instead, you would have had a checkpoint operation, where you have a name to a specific document state so that you could easily return to it (and meant templates were just old checkpoints: want two documents starting from the same template? Just instantiate that checkpoint and start editing). You’d also have an export operation for serialising a snapshot of the document in some format for external consumption. Export would not include the history unless explicitly instructed to, so you wouldn’t accidentally leak the history.