An installer needs to add multiple permission allow rules to a configuration file. The installer must preserve any pre-existing allow rules and respect explicit deny rules set by the user. During uninstall or repair, only the rules added by the installer should be removed, leaving user-configured rules intact. The installer can crash between writing an ownership journal and updating the configuration file. What journal design ensures correct recovery in both directions: completing an interrupted install or rolling back a partial install that never finished?