## Context In the current [`Organizations::Stateful`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/models/concerns/organizations/stateful.rb) state machine, `cancel_deletion` allows transitioning to `active` from both `deletion_scheduled` **and** `deletion_in_progress`: ```ruby event :cancel_deletion do transition %i[deletion_scheduled deletion_in_progress] => :active end ``` Allowing `deletion_in_progress → active` is unsafe: once the deletion worker has started, partial data removal (groups, projects, org-level entities) may have already occurred. Returning the Organization to `active` from that state would leave it in an inconsistent — and silently broken — state. ## Proposal Restrict `cancel_deletion` to `deletion_scheduled → active` only: ```ruby event :cancel_deletion do transition deletion_scheduled: :active end ``` ## Scope - Update `Organizations::Stateful` to drop `deletion_in_progress` from `cancel_deletion`'s source states. - Update specs to assert that `cancel_deletion!` raises an invalid transition from `deletion_in_progress`. ## Out of scope - Changes to `Namespaces::Stateful`, which has different semantics around `ancestor_inherited`/`archived` restore states. - New services or API endpoints — this is a state-machine-only change.