Status: OUT
All destructive module operations are recoverable via automatic backups: backups are enabled by default, the two-phase protocol ensures correct backup creation before any modification, and fail-safe semantics abort the operation if backup creation fails.