Every System-of-Record mutation an agent executes carries an idempotency key (so it can never be applied twice) and a pre-mapped reversal path (BAPI_..._CREATE ⇒ BAPI_..._CANCEL). This kernel decides whether a reference may be reversed and drives the compensating-transaction lifecycle — none → staged → reversing → reversed — so one click cleanly undoes a posted action. EcoCloud stages and tracks the reversal; the connector runs the actual BAPI.
Honest scope. A deterministic, signable state machine in the kernel family alongside the verifying-ledger and signing-limit kernels. The reversal/idempotency mapping is stored in the live task_object_refs table (idempotency_key is uniquely indexed per workspace, so a mutation can never post twice). EcoCloud does not call SAP or move money: it gates eligibility, stages the compensating transaction, and tracks its lifecycle — the actual reversal BAPI is run by a connector you build (EcoCloud ships none), which POSTs the outcome back to /api/sor. Executing or reversing a mutation requires a connector secret or a workspace admin — not a plain member. Source: flowdesk-reversal-kernel.js.