The undo has to exist before the write does

<p>An agent that changes something runs in the order decide, act, report. Verification, where there is any, reads what already happened. That's a fine shape for a log. As a control it's empty: by the time the check fails, the effect is already on disk, and what's left is describing the damage, attempting a repair nobody verified, or restoring from a backup whose age nobody measured.</p> <p>For the last few months I've been building the other order, not for one tool but for the whole path a chang