Design question. A command line installer adds a fixed set of six exact tool allow rules to a developer settings file that the developer also edits by hand. Repair must restore only the rules the installer introduced, and uninstall must remove only those, never touching allow entries the developer had first and never overriding or resurrecting a rule the developer has explicitly denied. The process can crash at any point, including between saving the installer's ownership journal and rewriting the settings file. Known reasoning so far: ownership should be decided once at install time by observation and recorded in a side journal rather than re-derived later from rule text, since a developer can author an identical rule. Deny should take precedence at every step and the installer should never edit the deny list. Each settings mutation should be an idempotent exact diff so replay is safe. Journal-first ordering leaves a recoverable intent record, whereas settings-first can leave orphaned allows with no ownership record. Open questions: what a journal entry should contain beyond rule identity so a crash gap can be resolved, how to detect whether the settings write landed without trusting whole-file hashing, and how repair should distinguish a crash-lost rule from a rule the developer deliberately removed. This is a standalone reasoning problem with no executed tests.

Resolution by reasoning only; no tests were executed. The design converges on four invariants and a write-ahead journal. Ownership is decided once at install time by observing each rule as absent, present or deny-covered, and recorded as owned or pre-existing; it is never re-derived from rule text because a developer can author an identical rule. Deny wins at every step and the installer never adds, edits or removes a deny entry; coverage is a pattern check rather than exact match. Every settings mutation is an idempotent exact diff so replay after a crash is safe. Unresolvable disagreement between journal and file means decline ownership and report, never guess. The journal lives in the installer's own state directory and holds, per rule, the exact serialized string, the observed pre-state, ownership, a status of intended, applied, blocked, released, removing or removed, and a per-run random commit witness. Order is journal first with fsync, then atomic replace of settings that also writes the witness under an installer-namespaced metadata key, then mark applied. On the next run an entry still marked intended is resolved by the witness: present means landed, absent means not landed. Two refinements matter. A landed verdict must never be computed over an empty set of effects, since a run where all rules were already present has nothing to witness and a vacuous landed verdict would claim developer entries. A not-landed verdict must not re-classify still-present entries as pre-existing, since that silently strips ownership; the safe outcome is to leave the entry alone and report. Repair re-adds only owned, applied, currently absent, non-deny-covered rules that lack a released marker; the released marker is written whenever any command observes an owned rule missing, so deliberate deletion is honored without a nag loop. Uninstall removes only owned applied rules, uses the same removing then removed two-phase journal, removes the smaller of recorded and current duplicate counts, and deletes the journal last. Two existing skills already document this pattern including the witness and the vacuous-landed caveat, so no new skill is proposed.

Refinement by reasoning only, no executed tests. New failure considered: after install the developer hand-edits an owned rule and also edits unrelated settings, then runs uninstall. Resolution. Uninstall must compare before removing, using one shared removal procedure that recovery also uses. For each owned effect, compare the recorded exact value, on parsed values rather than bytes, at the recorded container key path. Present at the recorded count means remove exactly that many occurrences. Present above the count means remove only the recorded number, since identical values are interchangeable. Present below the count, or only as a near match such as an altered pattern, means remove nothing, mark the entry conflicted, and report it; near matching may report but must never reach the removal path. Absent means do nothing. The developer's altered variant is thereby treated as theirs. Unrelated edits survive because uninstall patches the live document and never restores a snapshot: only the touched collections change, and a pre-rename re-parse asserts every untouched key is unchanged and each touched collection equals its prior contents minus exactly the planned occurrences. The report lists a per-entry outcome of removed, kept as conflict with the expected value named, kept as pre-existing, or already absent, and exits with a status distinct from success while conflicts remain; conflicted entries stay in the journal and are re-reported until the variant disappears or the developer names the exact value in an explicit per-entry override. Partial uninstall recovery keeps a transient per-container pending record separate from the durable journal, holding planned effects with counts, kept conflicts with reasons, base hash, base file identity and the post-rename identity. Crash before the record is durable means nothing happened. Crash after the record but before the rename resolves as not landed by identity, and the plan is discarded and re-derived from the current file, never replayed, because the developer may have edited the file in the unbounded recovery window. Crash after the rename but before commit resolves as landed, so only bookkeeping finishes, and a planned removal still present was re-created by the developer and is left alone. Identity inconclusive because the host rewrote the file falls to undecided unless at least two non no-op effects unanimously corroborate; undecided changes nothing, transcribes effects as unverified, and clears the slot. With several containers each is its own commit unit, only the verdict survives recovery, an install following an interrupted uninstall reconciles and stops rather than firing stale removals, and the journal is deleted only when every container is terminal. Because every decision is recomputed from current state, retrying converges. The existing crash-safe ownership journal skill already documents all of this in its patch-never-restore, shared removal procedure, recovery actions and multi-container steps, so no update is proposed.