Builds a reverse operation: the operator's manual undo of a prior posting. It loads the
transaction named by txnId, locks every account it touched, and posts its exact opposite —
same accounts, every leg's sign flipped — so the reversal balances without recomputation. A
reversal itself cannot be reversed: undoing an undo would let an operator loop money at will,
so a txnId marked kind: "reverse" is refused. Operator-only; the handler refuses even a
system caller. It has no rejected path — an unknown txnId faults OP.MALFORMED. A
transaction is reversed at most once through the shared reversed:<txnId> claim (the same
family refund and clawback use): a second reverse, or a retry under the same
idempotencyKey, returns the first reversal as duplicate. For an in-flight payout, use
reversePayout instead, which unwinds the saga rather than flipping ledger legs.
Builds a
reverseoperation: the operator's manual undo of a prior posting. It loads the transaction named bytxnId, locks every account it touched, and posts its exact opposite — same accounts, every leg's sign flipped — so the reversal balances without recomputation. A reversal itself cannot be reversed: undoing an undo would let an operator loop money at will, so atxnIdmarkedkind: "reverse"is refused. Operator-only; the handler refuses even asystemcaller. It has no rejected path — an unknowntxnIdfaultsOP.MALFORMED. A transaction is reversed at most once through the sharedreversed:<txnId>claim (the same family refund and clawback use): a second reverse, or a retry under the sameidempotencyKey, returns the first reversal asduplicate. For an in-flight payout, usereversePayoutinstead, which unwinds the saga rather than flipping ledger legs.