Status: IN
The codebase guards state reversal through layered mechanisms: soft delete serves dual purposes (preserving invariants locally, preventing resurrection distributedly), and permanent deletion requires preconditions (empty buckets, trashed state) — unless non-deletion reversals like hotel cancellation lack equivalent underflow guards, showing the reversal-safety pattern is incomplete.
Deletion is doubly guarded (depth-2 + depth-1), but cancel-without-underflow-guard (base, IN) shows reversal safety doesn't extend beyond delete operations
Depends on (SL): soft-delete-is-dual-purpose, deletion-is-guarded-by-preconditions
Unless: hotel-cancel-no-underflow-guard