Transactional rollback

A tool that modifies machines is only safe to adopt if any run can be reversed, including after a failure, a crash or a restart.

I made a journal the core of execution. Each step is recorded as pending before it runs and then marked done or failed, so an interruption leaves a precise record of what was about to happen. A failed run reverses itself newest-first, ripeat rollback reverses any earlier run, and pre-existing tools are recorded so they are never removed. Steps that need a restart pause the run for ripeat resume. Vendor installers are reversed through the package receipt on macOS or the registry entry on Windows, and only with an uninstaller signed by the same vendor. A lock prevents concurrent writers.

Architected a journal-first execution model so any run, even an interrupted one, can be reversed in order, with a pause-and-resume path for restarts and pre-existing tools never touched.

• Rollback covers what ripeat installed, not data a tool writes itself, which the plan states up front.

Failed, interrupted and restarted runs all leave a recoverable state, verified with real installs on Linux, Windows and macOS.