Comment by kuchenbecker

Yeah, it's a hard lesson. We would always safe-expire or soft-delete to avoid this so each operation is undo-able for ~2 weeks.