The two-line safety pattern for every registry write

Why writes need a recipe

Every classic “undelete” guide exists because something was changed without recording first. With the recipe below there's nothing to undelete — you hold the before-image explicitly. It's two lines before any Set-ItemProperty.

$key  = 'HKCU:\Control Panel\Desktop'
$name = 'MenuShowDelay'
$before = (Get-ItemProperty $key -Name $name -ErrorAction SilentlyContinue).$name
# journal: name, before, after, utc-now
[pscustomobject]@{ Key = $key; Value = $name; Before = $before; Utc = [DateTime]::UtcNow } |
  Export-Csv "$env:LOCALAPPDATA\MyTweaks-journal.csv" -Append -NoTypeInformation
Set-ItemProperty $key -Name $name -Value 0

Three details that make it a contract

• Capture $null for absent. A value that didn't exist must restore to absent (delete), not to a guessed default. The journal column records the difference.
• Journal before writing. The write happens after the journal append flushes; a crash between “logged” and “applied” leaves a fair record of intent, never a mystery half-state.
• Character-newline shape. A literal text log with UTC timestamps beats a log file format nobody can read six months later.

One recipe, huge blast radius — the auditing approach jumps straight from sample scripts into full janitor-grade logging without dragging in PowerShell classes.

ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.