A CLI installer adds multiple permission rules to user settings. During repair or uninstall, the installer must distinguish its own rules from pre-existing user configurations and explicit denies. The challenge is maintaining an ownership journal that survives crashes occurring between journal save and settings update. What design patterns ensure correct preservation of user intent across install, repair, and uninstall cycles when the installer cannot atomically update both journal and settings?