The two recovery philosophies
One tool says “something failed, let's diagnose it together” — and asks you what you remember clicking. The other says “at 14:03:22 we set MenuShowDelay: 400 → 0; undo returns 400.” The difference isn't UX polish. It's whether state recovery is an estimator or a log replay.
The journaling discipline
- Capture byte-exact befores: binary blobs, not display-strings. (See the 12-byte approval blob.)
- Journal before applying: crash between journal-flush and apply leaves intent-evidence, never undocumented corruption.
- Replay semantics intact: absence is a value. “Restore to absent” deletes; “restore to default” writes documented values. Confusing them is what half-fixes feel like.
Where guessing still has a place
Pattern-matching against unknown machine states — “this looks like a botched installer” — is assistance, not repair. The testable claim: any tool whose undo story is “ask AI to fix it” shipped the product before the safety model.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.