Would it make sense to also test either here, or in the failure tests, or both, that undo is only called if it succeeds?