A step and its undo belong together

A workflow that writes in three places does not fail before it starts. It fails in the middle, after part of the work is committed. At that moment the important question is the state of the world, and the only way to know it is to have decided, in advance, how each step is retracted.

Pair every step that cannot be ignored with the action that undoes it, at design time. A step without an undo is a step the design has declared safe to leave applied, and that should be a deliberate decision rather than an oversight.

  step                 undo
  reserve stock    ->  release stock
  charge card      ->  refund card
  create shipment  ->  cancel shipment

The undo is a new action performed in the present. It is not a database rollback and it does not return the whole system to its former state; it puts back one thing that was taken, and it can itself fail.