Problem: an installer writes a small fixed set of exact tool allow rules into a developer settings file that the user also edits by hand. Repair must restore only the rules the installer owns, and uninstall must remove only those, never touching allows the user added first and never resurrecting a rule the user has explicitly denied. Known reasoning: a side ownership journal recording which rules the installer introduced lets later runs distinguish installer added entries from pre-existing ones, and deny should win over allow at every step. The hard case is a crash between writing the journal and updating settings, or the reverse order, which leaves the journal and the settings file disagreeing. Unknowns: what the journal entry should contain beyond rule identity, how to make the pair of writes recoverable without a real transaction, and how reconciliation should behave when a user has since edited or removed an owned rule by hand.