Add audit and reports page, and a change journal

ProxMenux modifies the host: it rewrites configuration files, installs packages, enables services. Until now nobody could say afterwards what had changed, and showing the script does not answer that question — a four-hundred-line function may alter two values, and the reader has no way to know which two. This adds the two halves of an answer.

The change journal records what ProxMenux does as it does it. Eleven bash primitives capture the previous state, apply the change and record it in the same step, writing to a spool that the Monitor reads back. One hundred and thirteen functions across twenty-five scripts are instrumented, covering post-install, shared storage, security tooling, container conversions, disk operations and the PVE 8 to 9 upgrade path. The page shows the difference — rotate 7 becoming rotate 14 — and never the script. Restore and backup scripts are deliberately left out: a restore puts the host back to a state some other script already recorded.

The Audit and reports page answers the other half: what state is this host in, regardless of who put it there. Forty-three checks across seven areas read the host and classify each result as critical, warning, observation, conformant, unverified or not applicable, with the evidence they read attached to each one. A declared policy lets the reader say what this particular host is expected to do — which guests must have a backup, which storages are essential — so the report judges the host against its own intent rather than a generic template. An inventory records the hardware, network and guest topology behind those readings, a comparison shows what moved between two runs, and six report profiles produce a printable document scoped to what the reader needs. Everything is available in the eight supported languages.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/post_install/auto_post_install.sh

@@ -48,6 +48,11 @@ fi
 if [[ -f "$LOCAL_SCRIPTS/global/utils-install-functions.sh" ]]; then
     source "$LOCAL_SCRIPTS/global/utils-install-functions.sh"
 fi
+# Recording is part of writing: sourced before any function runs so a
+# change made without it is a mistake we can find, not one we can make.
+if [[ -f "$LOCAL_SCRIPTS/global/pmx_journal.sh" ]]; then
+    source "$LOCAL_SCRIPTS/global/pmx_journal.sh"
+fi
 
 load_language
 initialize_cache
@@ -92,6 +97,16 @@ register_tool() {
     local state="$2"
     local version="${3:-1.0}"
     local source="${4:-${SCRIPT_SOURCE:-unknown}}"
+    # Same as in the customizable script: the one call every function
+    # already makes, so an applied tool reaches the journal even where
+    # the function itself still writes directly.
+    if declare -F pmx_record_applied >/dev/null 2>&1; then
+        PMX_JOURNAL_FUNCTION="${FUNCNAME[1]:-$tool}" \
+        PMX_JOURNAL_VERSION="$version" \
+        PMX_JOURNAL_SOURCE="$source" \
+            pmx_record_applied "$tool" "$version" \
+              "$([[ "$state" == "true" ]] && echo applied || echo removed)"
+    fi
     ensure_tools_json
     if [[ "$state" == "true" ]]; then
         jq --arg t "$tool" --arg ver "$version" --arg src "$source" \
@@ -290,9 +305,10 @@ configure_time_sync() {
 
 skip_apt_languages() {
   local FUNC_VERSION="1.0"
+  pmx_journal_context "skip_apt_languages" "$FUNC_VERSION"
   # description: Stop APT from downloading translation files to speed up updates.
   msg_info "$(translate "Configuring APT to skip downloading additional languages...")"
-  cat > /etc/apt/apt.conf.d/99-disable-translations <<'EOF'
+  pmx_write_file /etc/apt/apt.conf.d/99-disable-translations <<'EOF'
 Acquire::Languages "none";
 EOF
   msg_ok "$(translate "APT configured to skip additional languages")"
@@ -302,6 +318,7 @@ EOF
 # ==========================================================
 optimize_journald() {
     local FUNC_VERSION="1.0"
+    pmx_journal_context "optimize_journald" "$FUNC_VERSION"
     # description: Cap journald size, raise rate limit and force info-level logging so the log viewer and Fail2Ban work.
     if [ -f /etc/log2ram.conf ] || [ -d /var/log.hdd ]; then
     return 0
@@ -314,7 +331,7 @@ optimize_journald() {
         cp -a "$jf" "${jf}.bak" 2>/dev/null || true
     fi
     
-    cat <<EOF > /etc/systemd/journald.conf
+    pmx_write_file /etc/systemd/journald.conf <<EOF
 [Journal]
 Storage=persistent
 SplitMode=none
@@ -337,8 +354,11 @@ MaxLevelConsole=notice
 MaxLevelWall=crit
 EOF
     
+    pmx_record_execution "Restart systemd-journald" "systemctl restart systemd-journald.service"
     systemctl restart systemd-journald.service > /dev/null 2>&1
+    pmx_record_execution "Vacuum system journal" "journalctl --vacuum-size=64M --vacuum-time=1d"
     journalctl --vacuum-size=64M --vacuum-time=1d > /dev/null 2>&1
+    pmx_record_execution "Rotate system journal" "journalctl --rotate"
     journalctl --rotate > /dev/null 2>&1
     
     msg_ok "$(translate "Journald optimized - Max size: 64M")"
@@ -348,6 +368,7 @@ EOF
 # ==========================================================
 optimize_logrotate() {
     local FUNC_VERSION="1.1"
+    pmx_journal_context "optimize_logrotate" "$FUNC_VERSION"
     # description: Replace logrotate.conf with a Log2RAM-friendly profile (daily rotation, copytruncate).
     msg_info "$(translate "Optimizing logrotate configuration...")"
     local logrotate_conf="/etc/logrotate.conf"
@@ -355,7 +376,7 @@ optimize_logrotate() {
 
     cp -n "$logrotate_conf" "$backup_conf" 2>/dev/null || true
 
-    cat <<EOF > "$logrotate_conf"
+    pmx_write_file "$logrotate_conf" <<EOF
 # ProxMenux optimized configuration (Log2RAM-friendly)
 daily
 su root adm
@@ -369,6 +390,7 @@ create 0640 root adm
 copytruncate
 include /etc/logrotate.d
 EOF
+    pmx_record_execution "Restart logrotate" "systemctl restart logrotate"
     systemctl restart logrotate > /dev/null 2>&1
 
     msg_ok "$(translate "Logrotate optimization completed")"
@@ -378,12 +400,13 @@ EOF
 # ==========================================================
 increase_system_limits() {
     local FUNC_VERSION="1.1"
+    pmx_journal_context "increase_system_limits" "$FUNC_VERSION"
     # description: Raise inotify watches, file descriptors, process keys and PID limits to enterprise levels.
     msg_info "$(translate "Increasing various system limits...")"
     NECESSARY_REBOOT=1
     
 
-    cat > /etc/sysctl.d/99-maxwatches.conf << EOF
+    pmx_write_file /etc/sysctl.d/99-maxwatches.conf << EOF
 # ProxMenux configuration
 fs.inotify.max_user_watches = 1048576
 fs.inotify.max_user_instances = 1048576
@@ -391,7 +414,7 @@ fs.inotify.max_queued_events = 1048576
 EOF
     
  
-    cat > /etc/security/limits.d/99-limits.conf << EOF
+    pmx_write_file /etc/security/limits.d/99-limits.conf << EOF
 # ProxMenux configuration
 * soft     nproc          1048576
 * hard     nproc          1048576
@@ -404,7 +427,7 @@ root hard     nofile         unlimited
 EOF
     
  
-    cat > /etc/sysctl.d/99-maxkeys.conf << EOF
+    pmx_write_file /etc/sysctl.d/99-maxkeys.conf << EOF
 # ProxMenux configuration
 kernel.keys.root_maxkeys=1000000
 kernel.keys.maxkeys=1000000
@@ -413,32 +436,32 @@ EOF
    
     for file in /etc/systemd/system.conf /etc/systemd/user.conf; do
         if ! grep -q "^DefaultLimitNOFILE=" "$file"; then
-            echo "DefaultLimitNOFILE=1048576" >> "$file"
+            echo "DefaultLimitNOFILE=1048576" | pmx_append_file "$file"
         fi
     done
     
 
     for file in /etc/pam.d/common-session /etc/pam.d/runuser-l; do
         if ! grep -q "^session required pam_limits.so" "$file"; then
-            echo 'session required pam_limits.so' >> "$file"
+            echo 'session required pam_limits.so' | pmx_append_file "$file"
         fi
     done
     
 
     if ! grep -q "ulimit -n 1048576" /root/.profile; then
-        sed -i '/ulimit -n 256000/d' /root/.profile 2>/dev/null
-        echo "ulimit -n 1048576" >> /root/.profile
+        pmx_edit_file /root/.profile '/ulimit -n 256000/d' 2>/dev/null || true
+        echo "ulimit -n 1048576" | pmx_append_file /root/.profile
     fi
     
 
-    cat > /etc/sysctl.d/99-swap.conf << EOF
+    pmx_write_file /etc/sysctl.d/99-swap.conf << EOF
 # ProxMenux configuration
 vm.swappiness = 10
 vm.vfs_cache_pressure = 100
 EOF
     
  
-    cat > /etc/sysctl.d/99-fs.conf << EOF
+    pmx_write_file /etc/sysctl.d/99-fs.conf << EOF
 # ProxMenux configuration
 fs.nr_open = 2097152
 fs.file-max = 2097152
@@ -452,21 +475,25 @@ EOF
 # ==========================================================
 optimize_memory_settings() {
     local FUNC_VERSION="1.2"
+    pmx_journal_context "optimize_memory_settings" "$FUNC_VERSION"
     # description: Tune swappiness, dirty page ratios and compaction proactiveness for VM hosts without overriding the kernel's memory-overcommit policy.
     msg_info "$(translate "Optimizing memory settings...")"
     NECESSARY_REBOOT=1
     
-    cat <<EOF > /etc/sysctl.d/99-memory.conf
+    local memory_settings
+    memory_settings="$(cat <<EOF
 # Balanced Memory Optimization
 vm.swappiness = 10
 vm.dirty_ratio = 15
 vm.dirty_background_ratio = 5
 vm.max_map_count = 262144
 EOF
-    
+)"
+
     if [ -f /proc/sys/vm/compaction_proactiveness ]; then
-        echo "vm.compaction_proactiveness = 20" >> /etc/sysctl.d/99-memory.conf
+        memory_settings+=$'\n''vm.compaction_proactiveness = 20'
     fi
+    printf '%s\n' "$memory_settings" | pmx_write_file /etc/sysctl.d/99-memory.conf
     
     msg_ok "$(translate "Memory optimization completed.")"
     register_tool "memory_settings" true "$FUNC_VERSION"
@@ -475,11 +502,12 @@ EOF
 # ==========================================================
 configure_kernel_panic() {
     local FUNC_VERSION="1.0"
+    pmx_journal_context "configure_kernel_panic" "$FUNC_VERSION"
     # description: Auto-reboot on kernel panic / oops / hardlockup; write crash dumps to /var/crash.
     msg_info "$(translate "Configuring kernel panic behavior")"
     NECESSARY_REBOOT=1
     
-    cat <<EOF > /etc/sysctl.d/99-kernelpanic.conf
+    pmx_write_file /etc/sysctl.d/99-kernelpanic.conf <<EOF
 # Enable restart on kernel panic, kernel oops and hardlockup
 kernel.core_pattern = /var/crash/core.%t.%p
 kernel.panic = 10
@@ -507,11 +535,12 @@ force_apt_ipv4() {
 
 apply_network_optimizations() {
   local FUNC_VERSION="1.1"
+  pmx_journal_context "apply_network_optimizations" "$FUNC_VERSION"
   # description: Tune TCP buffers, somaxconn, IPv4 hardening and disable rp_filter on fw bridges (PVE 9 compatible).
   msg_info "$(translate "Optimizing network settings...")"
   NECESSARY_REBOOT=1
 
-  cat <<'EOF' > /etc/sysctl.d/99-network.conf
+  pmx_write_file /etc/sysctl.d/99-network.conf <<'EOF'
 # ==========================================================
 # ProxMenux - Network tuning (PVE 9 compatible)
 # ==========================================================
@@ -555,9 +584,10 @@ net.ipv4.tcp_wmem = 8192 65536 16777216
 net.unix.max_dgram_qlen = 4096
 EOF
 
+  pmx_record_execution "Apply network sysctl configuration" "sysctl --system"
   sysctl --system > /dev/null 2>&1
 
-  cat > /usr/local/sbin/proxmenux-fwbr-tune <<'EOF'
+  pmx_write_file /usr/local/sbin/proxmenux-fwbr-tune <<'EOF'
 #!/usr/bin/env bash
 # Set rp_filter=0 and log_martians=0 on Proxmox fw bridge interfaces.
 # No arg → sweep every interface currently under /proc/sys/net/ipv4/conf/.
@@ -588,7 +618,7 @@ EOF
   chmod 0755 /usr/local/sbin/proxmenux-fwbr-tune
   chown root:root /usr/local/sbin/proxmenux-fwbr-tune
 
-  cat > /etc/systemd/system/proxmenux-fwbr-tune.service <<'EOF'
+  pmx_write_file /etc/systemd/system/proxmenux-fwbr-tune.service <<'EOF'
 [Unit]
 Description=ProxMenux - Tune rp_filter/log_martians on virtual fw bridges
 After=network-online.target
@@ -603,7 +633,7 @@ RemainAfterExit=yes
 WantedBy=multi-user.target
 EOF
 
-  cat > /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules <<'EOF'
+  pmx_write_file /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules <<'EOF'
 ACTION=="add", SUBSYSTEM=="net", KERNEL=="fwbr*", RUN+="/usr/local/sbin/proxmenux-fwbr-tune %k"
 ACTION=="add", SUBSYSTEM=="net", KERNEL=="fwln*", RUN+="/usr/local/sbin/proxmenux-fwbr-tune %k"
 ACTION=="add", SUBSYSTEM=="net", KERNEL=="fwpr*", RUN+="/usr/local/sbin/proxmenux-fwbr-tune %k"
@@ -612,15 +642,18 @@ EOF
   chmod 0644 /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules
   chown root:root /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules
 
+  pmx_record_execution "Reload systemd configuration" "systemctl daemon-reload"
   systemctl daemon-reload >/dev/null 2>&1 || true
+  pmx_record_execution "Reload udev rules" "udevadm control --reload-rules"
   udevadm control --reload-rules >/dev/null 2>&1 || true
-  systemctl enable --now proxmenux-fwbr-tune.service >/dev/null 2>&1 || true
+  pmx_enable_service proxmenux-fwbr-tune.service || true
+  pmx_record_execution "Tune existing Proxmox firewall bridge interfaces" "/usr/local/sbin/proxmenux-fwbr-tune"
   /usr/local/sbin/proxmenux-fwbr-tune >/dev/null 2>&1 || true
 
 
   local interfaces_file="/etc/network/interfaces"
   if ! grep -q 'source /etc/network/interfaces.d/*' "$interfaces_file"; then
-      echo "source /etc/network/interfaces.d/*" >> "$interfaces_file"
+      echo "source /etc/network/interfaces.d/*" | pmx_append_file "$interfaces_file"
   fi
 
   msg_ok "$(translate "Network optimization completed")"
@@ -759,6 +792,7 @@ PY
 
 customize_bashrc() {
     local FUNC_VERSION="1.2"
+    pmx_journal_context "customize_bashrc" "$FUNC_VERSION"
     # description: Install and safely migrate the managed ProxMenux Bash prompt and aliases while preserving or selecting the short/full working-directory style.
     msg_info "$(translate "Customizing bashrc for root user...")"
     local bashrc="/root/.bashrc"
@@ -768,7 +802,7 @@ customize_bashrc() {
     local prompt_path_escape='\W'
     local detected_path_style="short"
 
-    [[ -f "$bashrc" ]] || touch "$bashrc"
+    [[ -f "$bashrc" ]] || pmx_write_file "$bashrc" < /dev/null
     if ! detected_path_style="$(_migrate_proxmenux_bashrc "$bashrc" inspect)"; then
         msg_error "$(translate "Failed to inspect the existing ProxMenux Bash configuration.")"
         return 1
@@ -791,13 +825,19 @@ customize_bashrc() {
     esac
 
     [ -f "${bashrc}.bak" ] || cp "$bashrc" "${bashrc}.bak" > /dev/null 2>&1
-    if ! _migrate_proxmenux_bashrc "$bashrc" migrate >/dev/null; then
+    local migrated_bashrc
+    migrated_bashrc="$(mktemp)"
+    cp -p "$bashrc" "$migrated_bashrc"
+    if ! _migrate_proxmenux_bashrc "$migrated_bashrc" migrate >/dev/null; then
+        rm -f "$migrated_bashrc"
         msg_error "$(translate "Failed to migrate the existing ProxMenux Bash configuration.")"
         return 1
     fi
+    pmx_write_file "$bashrc" < "$migrated_bashrc"
+    rm -f "$migrated_bashrc"
     
  
-    cat >> "$bashrc" << EOF
+    pmx_append_file "$bashrc" << EOF
 ${marker_begin}
 # ProxMenux core customizations
 export HISTTIMEFORMAT="%d/%m/%y %T "
@@ -815,7 +855,7 @@ EOF
     
 
     if ! grep -q "source /root/.bashrc" "$bash_profile" 2>/dev/null; then
-        echo "source /root/.bashrc" >> "$bash_profile" 2>/dev/null
+        echo "source /root/.bashrc" | pmx_append_file "$bash_profile" 2>/dev/null
     fi
     
     msg_ok "$(translate "Bashrc customization completed")"
@@ -839,6 +879,7 @@ _update_existing_log2ram_auto() {
     local func_version="$1"
     local log2ram_bin=""
     local candidate resolved tmp_file
+    pmx_journal_context "_update_existing_log2ram_auto" "$func_version"
 
     msg_ok "$(translate "Log2RAM already registered — updating to latest configuration")"
 
@@ -862,10 +903,7 @@ _update_existing_log2ram_auto() {
 
     if grep -q 'rsync -aAXv ' "$log2ram_bin" 2>/dev/null; then
         [[ -e "${log2ram_bin}.proxmenux.bak" ]] || cp -a "$log2ram_bin" "${log2ram_bin}.proxmenux.bak"
-        tmp_file="$(mktemp "${log2ram_bin}.proxmenux.XXXXXX")" || return 1
-        cp -a "$log2ram_bin" "$tmp_file"
-        sed -i 's/rsync -aAXv /rsync -aXv --no-acls /g' "$tmp_file"
-        mv -f "$tmp_file" "$log2ram_bin"
+        sed 's/rsync -aAXv /rsync -aXv --no-acls /g' "$log2ram_bin" | pmx_write_file "$log2ram_bin"
     fi
 
     if dpkg-query -W -f='${Status}' proxmox-backup-server 2>/dev/null \
@@ -884,7 +922,8 @@ _update_existing_log2ram_auto() {
 EOF
         chmod 0644 "$tmp_file"
         chown root:root "$tmp_file"
-        mv -f "$tmp_file" /etc/logrotate.d/proxmox-backup-api
+        pmx_write_file /etc/logrotate.d/proxmox-backup-api < "$tmp_file"
+        rm -f "$tmp_file"
 
         tmp_file="$(mktemp /etc/cron.hourly/.proxmox-backup-logrotate.XXXXXX)" || return 1
         cat > "$tmp_file" <<'EOF'
@@ -893,7 +932,10 @@ EOF
 EOF
         chmod 0755 "$tmp_file"
         chown root:root "$tmp_file"
-        mv -f "$tmp_file" /etc/cron.hourly/proxmox-backup-logrotate
+        pmx_write_file /etc/cron.hourly/proxmox-backup-logrotate < "$tmp_file"
+        chmod 0755 /etc/cron.hourly/proxmox-backup-logrotate
+        chown root:root /etc/cron.hourly/proxmox-backup-logrotate
+        rm -f "$tmp_file"
         msg_ok "$(translate "PBS API log rotation configured (hourly, size-based)")"
     fi
 
@@ -945,7 +987,10 @@ EOF
     chmod 0755 "$tmp_file"
     chown root:root "$tmp_file"
     bash -n "$tmp_file" || return 1
-    mv -f "$tmp_file" /usr/local/bin/log2ram-check.sh
+    pmx_write_file /usr/local/bin/log2ram-check.sh < "$tmp_file"
+    chmod 0755 /usr/local/bin/log2ram-check.sh
+    chown root:root /usr/local/bin/log2ram-check.sh
+    rm -f "$tmp_file"
 
     tmp_file="$(mktemp /etc/cron.d/.log2ram-auto-sync.XXXXXX)" || return 1
     cat > "$tmp_file" <<'EOF'
@@ -958,7 +1003,10 @@ MAILTO=""
 EOF
     chmod 0644 "$tmp_file"
     chown root:root "$tmp_file"
-    mv -f "$tmp_file" /etc/cron.d/log2ram-auto-sync
+    pmx_write_file /etc/cron.d/log2ram-auto-sync < "$tmp_file"
+    chmod 0644 /etc/cron.d/log2ram-auto-sync
+    chown root:root /etc/cron.d/log2ram-auto-sync
+    rm -f "$tmp_file"
 
     register_tool "log2ram" true "$func_version"
     msg_success "$(translate "Log2RAM installation and configuration completed successfully.")"
@@ -968,6 +1016,7 @@ EOF
 install_log2ram_auto() {
     local FUNC_VERSION="1.5"
     local existing_log2ram_bin=""
+    pmx_journal_context "install_log2ram_auto" "$FUNC_VERSION"
 
     # description: Install Log2RAM with size auto-tuned to host RAM (128M/256M/512M); SSD/M.2 detection skips on rotational disks.
 
@@ -1024,31 +1073,40 @@ install_log2ram_auto() {
 
     msg_info "$(translate "Cleaning previous Log2RAM installation...")"
 
-    systemctl stop log2ram log2ram-daily.timer >/dev/null 2>&1 || true
-    systemctl disable log2ram log2ram-daily.timer >/dev/null 2>&1 || true
+    pmx_disable_service log2ram || true
+    pmx_disable_service log2ram-daily.timer || true
 
-    rm -f /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync \
-          /etc/cron.hourly/log2ram /etc/cron.daily/log2ram \
-          /etc/cron.weekly/log2ram /etc/cron.monthly/log2ram 2>/dev/null || true
-    rm -f /usr/local/bin/log2ram-check.sh /usr/local/bin/log2ram /usr/sbin/log2ram 2>/dev/null || true
-    rm -f /etc/systemd/system/log2ram.service \
-          /etc/systemd/system/log2ram-daily.timer \
-          /etc/systemd/system/log2ram-daily.service \
-          /etc/systemd/system/sysinit.target.wants/log2ram.service 2>/dev/null || true
+    local obsolete_path
+    for obsolete_path in \
+        /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync \
+        /etc/cron.hourly/log2ram /etc/cron.daily/log2ram \
+        /etc/cron.weekly/log2ram /etc/cron.monthly/log2ram \
+        /usr/local/bin/log2ram-check.sh /usr/local/bin/log2ram /usr/sbin/log2ram \
+        /etc/systemd/system/log2ram.service \
+        /etc/systemd/system/log2ram-daily.timer \
+        /etc/systemd/system/log2ram-daily.service \
+        /etc/systemd/system/sysinit.target.wants/log2ram.service \
+        /etc/log2ram.conf /etc/log2ram.conf.* /etc/logrotate.d/log2ram
+    do
+        pmx_remove_file "$obsolete_path" 2>/dev/null || true
+    done
     rm -rf /etc/systemd/system/log2ram.service.d 2>/dev/null || true
-    rm -f /etc/log2ram.conf* 2>/dev/null || true
-    rm -rf /etc/logrotate.d/log2ram /var/log.hdd /tmp/log2ram 2>/dev/null || true
+    rm -rf /var/log.hdd /tmp/log2ram 2>/dev/null || true
 
+    pmx_record_execution "Re-execute the systemd manager" "systemctl daemon-reexec"
     systemctl daemon-reexec >/dev/null 2>&1 || true
+    pmx_record_execution "Reload systemd configuration" "systemctl daemon-reload"
     systemctl daemon-reload >/dev/null 2>&1 || true
+    pmx_record_execution "Restart cron" "systemctl restart cron"
     systemctl restart cron >/dev/null 2>&1 || true
 
     msg_ok "$(translate "Previous installation cleaned")"
     msg_info "$(translate "Installing Log2RAM from source...")"
 
     if ! command -v git >/dev/null 2>&1; then
+        pmx_record_execution "Update package lists for Log2RAM" "apt-get update -qq"
         apt-get update -qq >/dev/null 2>&1
-        apt-get install -y git >/dev/null 2>&1
+        pmx_install_pkg git
     fi
 
     rm -rf /tmp/log2ram 2>/dev/null || true
@@ -1059,6 +1117,7 @@ install_log2ram_auto() {
 
     cd /tmp/log2ram || { msg_error "$(translate "Failed to access log2ram directory")"; return 1; }
 
+    pmx_record_execution "Run the Log2RAM installer" "bash install.sh"
     if ! bash install.sh >>/tmp/log2ram_install.log 2>&1; then
         msg_error "$(translate "Failed to run log2ram installer. Check /tmp/log2ram_install.log")"
         return 1
@@ -1077,7 +1136,7 @@ install_log2ram_auto() {
         [[ -n "$_l2r_bin" && -f "$_l2r_bin" ]] || continue
         if grep -q 'rsync -aAXv ' "$_l2r_bin" 2>/dev/null; then
             cp -a "$_l2r_bin" "${_l2r_bin}.proxmenux.bak"
-            sed -i 's/rsync -aAXv /rsync -aXv --no-acls /g' "$_l2r_bin"
+            pmx_edit_file "$_l2r_bin" 's/rsync -aAXv /rsync -aXv --no-acls /g'
         fi
         break
     done
@@ -1088,7 +1147,7 @@ install_log2ram_auto() {
     if dpkg-query -W -f='${Status}' proxmox-backup-server 2>/dev/null \
         | grep -q 'install ok installed'; then
         mkdir -p /var/log/proxmox-backup/api 2>/dev/null || true
-        cat > /etc/logrotate.d/proxmox-backup-api <<'EOF'
+        pmx_write_file /etc/logrotate.d/proxmox-backup-api <<'EOF'
 /var/log/proxmox-backup/api/access.log /var/log/proxmox-backup/api/auth.log {
     size 20M
     rotate 3
@@ -1101,7 +1160,7 @@ install_log2ram_auto() {
 EOF
         chmod 0644 /etc/logrotate.d/proxmox-backup-api
         chown root:root /etc/logrotate.d/proxmox-backup-api
-        cat > /etc/cron.hourly/proxmox-backup-logrotate <<'EOF'
+        pmx_write_file /etc/cron.hourly/proxmox-backup-logrotate <<'EOF'
 #!/bin/sh
 /usr/sbin/logrotate /etc/logrotate.d/proxmox-backup-api >/dev/null 2>&1
 EOF
@@ -1110,6 +1169,7 @@ EOF
         msg_ok "$(translate "PBS API log rotation configured (hourly, size-based)")"
     fi
 
+    pmx_record_execution "Reload systemd configuration" "systemctl daemon-reload"
     systemctl daemon-reload >/dev/null 2>&1 || true
 
     if [[ -f /etc/log2ram.conf ]] && command -v log2ram >/dev/null 2>&1; then
@@ -1131,11 +1191,11 @@ EOF
     fi
 
     msg_ok "$(translate "Detected RAM:") $RAM_SIZE_GB GB — $(translate "Log2RAM size set to:") $LOG2RAM_SIZE"
-    sed -i "s/^SIZE=.*/SIZE=$LOG2RAM_SIZE/" /etc/log2ram.conf
+    pmx_edit_file /etc/log2ram.conf "s/^SIZE=.*/SIZE=$LOG2RAM_SIZE/"
 
     LOG2RAM_BIN="$(command -v log2ram || echo /usr/sbin/log2ram)"
 
-    cat > /etc/cron.d/log2ram <<EOF
+    pmx_write_file /etc/cron.d/log2ram <<EOF
 # Log2RAM periodic sync - Created by ProxMenux
 SHELL=/bin/bash
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
@@ -1146,7 +1206,7 @@ EOF
     chown root:root /etc/cron.d/log2ram
     msg_ok "$(translate "Log2RAM write scheduled every") $CRON_HOURS $(translate "hour(s)")"
 
-    cat > /usr/local/bin/log2ram-check.sh <<'EOF'
+    pmx_write_file /usr/local/bin/log2ram-check.sh <<'EOF'
 #!/usr/bin/env bash
 # Watch /var/log usage on Log2RAM's tmpfs and act at two thresholds:
 #   > 80% → vacuum journald down to ~30% of SIZE, then log2ram write
@@ -1196,7 +1256,7 @@ fi
 EOF
     chmod +x /usr/local/bin/log2ram-check.sh
 
-    cat > /etc/cron.d/log2ram-auto-sync <<'EOF'
+    pmx_write_file /etc/cron.d/log2ram-auto-sync <<'EOF'
 # Log2RAM auto-sync based on /var/log usage - Created by ProxMenux
 SHELL=/bin/bash
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
@@ -1207,6 +1267,7 @@ EOF
     chmod 0644 /etc/cron.d/log2ram-auto-sync
     chown root:root /etc/cron.d/log2ram-auto-sync
 
+    pmx_record_execution "Restart cron" "systemctl restart cron"
     systemctl restart cron >/dev/null 2>&1 || true
     msg_ok "$(translate "Auto-sync enabled when /var/log exceeds 80% of") $LOG2RAM_SIZE"
 
@@ -1232,8 +1293,8 @@ EOF
     [ "$KEEP_MB" -lt 8 ] && KEEP_MB=8
 
 
-    sed -i '/^\[Journal\]/,$d' /etc/systemd/journald.conf 2>/dev/null || true
-    tee -a /etc/systemd/journald.conf >/dev/null <<EOF
+    pmx_edit_file /etc/systemd/journald.conf '/^\[Journal\]/,$d' 2>/dev/null || true
+    pmx_append_file /etc/systemd/journald.conf <<EOF
 [Journal]
 Storage=persistent
 SplitMode=none
@@ -1267,8 +1328,10 @@ EOF
     #msg_ok "$(translate "Backup created:") /etc/systemd/journald.conf.bak.$(date +%Y%m%d-%H%M%S)"
     msg_ok "$(translate "Journald configuration adjusted to") ${USE_MB}M (Log2RAM ${LOG2RAM_SIZE})"
 
+    pmx_record_execution "Reload systemd configuration" "systemctl daemon-reload"
     systemctl daemon-reload >/dev/null 2>&1 || true
-    if ! systemctl enable log2ram >/dev/null 2>&1; then
+    if ! pmx_apply_setting "service-enabled:log2ram" "systemctl is-enabled log2ram" \
+        systemctl enable log2ram; then
         msg_error "$(translate "Log2RAM installation verification failed. Check /tmp/log2ram_install.log")"
         return 1
     fi

scripts/post_install/uninstall-tools.sh

@@ -34,6 +34,9 @@ TOOLS_JSON="$BASE_DIR/installed_tools.json"
 if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
 fi
+if [[ -f "$LOCAL_SCRIPTS/global/pmx_journal.sh" ]]; then
+    source "$LOCAL_SCRIPTS/global/pmx_journal.sh"
+fi
 
 load_language
 initialize_cache
@@ -53,18 +56,28 @@ register_tool() {
 ################################################################
 
 uninstall_fastfetch() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_fastfetch" "$FUNC_VERSION"
     if ! command -v fastfetch &>/dev/null && [[ ! -f /usr/local/bin/fastfetch ]]; then
         msg_warn "$(translate "Fastfetch is not installed.")"
         return 0
     fi
 
     msg_info2 "$(translate "Uninstalling Fastfetch...")"
-    rm -f /usr/local/bin/fastfetch /usr/bin/fastfetch
+    pmx_remove_file /usr/local/bin/fastfetch
+    pmx_remove_file /usr/bin/fastfetch
+    pmx_record_execution "Remove Fastfetch configuration directory" "rm -rf $HOME/.config/fastfetch"
     rm -rf "$HOME/.config/fastfetch"
+    pmx_record_execution "Remove shared Fastfetch files" "rm -rf /usr/local/share/fastfetch"
     rm -rf /usr/local/share/fastfetch
-    sed -i '/fastfetch/d' "$HOME/.bashrc" "$HOME/.profile" /etc/profile 2>/dev/null
-    sed -i '/# BEGIN FASTFETCH/,/# END FASTFETCH/d' "$HOME/.bashrc"
-    rm -f /etc/profile.d/fastfetch.sh /etc/update-motd.d/99-fastfetch
+    local profile_file
+    for profile_file in "$HOME/.bashrc" "$HOME/.profile" /etc/profile; do
+        pmx_edit_file "$profile_file" '/fastfetch/d' 2>/dev/null || true
+    done
+    pmx_edit_file "$HOME/.bashrc" '/# BEGIN FASTFETCH/,/# END FASTFETCH/d'
+    pmx_remove_file /etc/profile.d/fastfetch.sh
+    pmx_remove_file /etc/update-motd.d/99-fastfetch
+    pmx_record_execution "Remove Fastfetch package" "dpkg -r fastfetch"
     dpkg -r fastfetch &>/dev/null
 
     msg_ok "$(translate "Fastfetch removed from system")"
@@ -74,18 +87,23 @@ uninstall_fastfetch() {
 ################################################################
 
 uninstall_figurine() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_figurine" "$FUNC_VERSION"
     if ! command -v figurine &>/dev/null; then
         msg_warn "$(translate "Figurine is not installed.")"
         return 0
     fi
 
     msg_info2 "$(translate "Uninstalling Figurine...")"
-    rm -f /usr/local/bin/figurine
-    rm -f /etc/profile.d/figurine.sh
+    pmx_remove_file /usr/local/bin/figurine
+    pmx_remove_file /etc/profile.d/figurine.sh
 
-    sed -i '/lxcclean/d;/lxcupdate/d;/kernelclean/d;/cpugov/d;/updatecerts/d;/seqwrite/d;/seqread/d;/ranwrite/d;/ranread/d' "$HOME/.bashrc" "$HOME/.profile" 2>/dev/null
-    sed -i '/# ProxMenux Figurine aliases and tools/,+20d' "$HOME/.bashrc" "$HOME/.profile" 2>/dev/null
-    sed -i '/# BEGIN PROXMENUX ALIASES/,/# END PROXMENUX ALIASES/d' "$HOME/.bashrc" "$HOME/.profile" 2>/dev/null
+    local profile_file
+    for profile_file in "$HOME/.bashrc" "$HOME/.profile"; do
+        pmx_edit_file "$profile_file" '/lxcclean/d;/lxcupdate/d;/kernelclean/d;/cpugov/d;/updatecerts/d;/seqwrite/d;/seqread/d;/ranwrite/d;/ranread/d' 2>/dev/null || true
+        pmx_edit_file "$profile_file" '/# ProxMenux Figurine aliases and tools/,+20d' 2>/dev/null || true
+        pmx_edit_file "$profile_file" '/# BEGIN PROXMENUX ALIASES/,/# END PROXMENUX ALIASES/d' 2>/dev/null || true
+    done
 
     msg_ok "$(translate "Figurine removed from system")"
     register_tool "figurine" false
@@ -95,15 +113,18 @@ uninstall_figurine() {
 ################################################################
 
 uninstall_kexec() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_kexec" "$FUNC_VERSION"
     if ! dpkg -s kexec-tools >/dev/null 2>&1 && [ ! -f /etc/systemd/system/kexec-pve.service ]; then
         msg_warn "$(translate "kexec-tools is not installed or already removed.")"
         return 0
     fi
 
     msg_info2 "$(translate "Uninstalling kexec-tools and removing custom service...")"
-    systemctl disable --now kexec-pve.service &>/dev/null
-    rm -f /etc/systemd/system/kexec-pve.service
-    sed -i "/alias reboot-quick='systemctl kexec'/d" /root/.bash_profile
+    pmx_disable_service kexec-pve.service
+    pmx_remove_file /etc/systemd/system/kexec-pve.service
+    pmx_edit_file /root/.bash_profile "/alias reboot-quick='systemctl kexec'/d"
+    pmx_record_execution "Purge kexec-tools package" "apt-get purge -y kexec-tools"
     apt-get purge -y kexec-tools >/dev/null 2>&1
 
     msg_ok "$(translate "kexec-tools and related settings removed")"
@@ -269,6 +290,8 @@ uninstall_rpc() {
 ################################################################
 
 uninstall_motd() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_motd" "$FUNC_VERSION"
     local state_file="$BASE_DIR/motd.state"
     local original_file="$BASE_DIR/motd.original"
     local motd_file="${PROXMENUX_MOTD_FILE:-/etc/motd}"
@@ -287,15 +310,15 @@ uninstall_motd() {
                 msg_error "$(translate "The original MOTD backup is unavailable; no changes were made")"
                 return 1
             fi
-            cp -a "$original_file" "$motd_file"
+            pmx_write_file "$motd_file" < "$original_file"
             ;;
         absent)
-            rm -f "$motd_file"
+            pmx_remove_file "$motd_file"
             ;;
         legacy-marker)
             if [[ -f "$motd_file" ]]; then
-                sed -i "\|^${custom_message}$|d" "$motd_file"
-                sed -i '/./,$!d' "$motd_file"
+                pmx_edit_file "$motd_file" "\|^${custom_message}$|d"
+                pmx_edit_file "$motd_file" '/./,$!d'
             fi
             ;;
         *)
@@ -304,7 +327,8 @@ uninstall_motd() {
             ;;
     esac
 
-    rm -f "$state_file" "$original_file"
+    pmx_remove_file "$state_file"
+    pmx_remove_file "$original_file"
     register_tool "motd" false
     msg_ok "$(translate "The original MOTD configuration has been restored")"
 }
@@ -380,10 +404,12 @@ uninstall_apt_languages() {
 ################################################################
 
 uninstall_journald() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_journald" "$FUNC_VERSION"
     msg_info "$(translate "Restoring default journald configuration...")"
     
     # Restore default journald configuration
-    cat > /etc/systemd/journald.conf << 'EOF'
+    pmx_write_file /etc/systemd/journald.conf << 'EOF'
 #  This file is part of systemd.
 #
 #  systemd is free software; you can redistribute it and/or modify it
@@ -425,6 +451,7 @@ uninstall_journald() {
 #MaxLevelWall=emerg
 EOF
     
+    pmx_record_execution "Restart systemd-journald" "systemctl restart systemd-journald.service"
     systemctl restart systemd-journald.service >/dev/null 2>&1
     
     msg_ok "$(translate "Default journald configuration restored")"
@@ -452,37 +479,40 @@ uninstall_logrotate() {
 ################################################################
 
 uninstall_system_limits() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_system_limits" "$FUNC_VERSION"
     msg_info "$(translate "Removing system limits optimizations...")"
     
     # Remove ProxMenux sysctl configurations
-    rm -f /etc/sysctl.d/99-maxwatches.conf
-    rm -f /etc/sysctl.d/99-maxkeys.conf
-    rm -f /etc/sysctl.d/99-swap.conf
-    rm -f /etc/sysctl.d/99-fs.conf
+    pmx_remove_file /etc/sysctl.d/99-maxwatches.conf
+    pmx_remove_file /etc/sysctl.d/99-maxkeys.conf
+    pmx_remove_file /etc/sysctl.d/99-swap.conf
+    pmx_remove_file /etc/sysctl.d/99-fs.conf
     
     # Remove ProxMenux limits configuration
-    rm -f /etc/security/limits.d/99-limits.conf
+    pmx_remove_file /etc/security/limits.d/99-limits.conf
     
     # Remove systemd limits (restore defaults)
     for file in /etc/systemd/system.conf /etc/systemd/user.conf; do
         if [ -f "$file" ]; then
-            sed -i '/^DefaultLimitNOFILE=256000/d' "$file"
+            pmx_edit_file "$file" '/^DefaultLimitNOFILE=256000/d'
         fi
     done
     
     # Remove PAM limits
     for file in /etc/pam.d/common-session /etc/pam.d/runuser-l; do
         if [ -f "$file" ]; then
-            sed -i '/^session required pam_limits.so/d' "$file"
+            pmx_edit_file "$file" '/^session required pam_limits.so/d'
         fi
     done
     
     # Remove ulimit from profile
     if [ -f /root/.profile ]; then
-        sed -i '/ulimit -n 256000/d' /root/.profile
+        pmx_edit_file /root/.profile '/ulimit -n 256000/d'
     fi
     
     # Reload sysctl
+    pmx_record_execution "Apply sysctl configuration" "sysctl --system"
     sysctl --system >/dev/null 2>&1
     
     msg_ok "$(translate "System limits optimizations removed")"
@@ -553,26 +583,31 @@ uninstall_apt_ipv4() {
 ################################################################
 
 uninstall_network_optimization() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_network_optimization" "$FUNC_VERSION"
     msg_info "$(translate "Removing network optimizations...")"
     
-    rm -f /etc/sysctl.d/99-network.conf
+    pmx_remove_file /etc/sysctl.d/99-network.conf
 
     local interfaces_file="/etc/network/interfaces"
     if [ -f "$interfaces_file" ]; then
-        sed -i '/^source \/etc\/network\/interfaces\.d\/\*/d' "$interfaces_file"
+        pmx_edit_file "$interfaces_file" '/^source \/etc\/network\/interfaces\.d\/\*/d'
     fi
     
-    rm -f /etc/sysctl.d/97-proxmenux-fwbr.conf \
-        /etc/sysctl.d/98-proxmenux-rpf.conf
+    pmx_remove_file /etc/sysctl.d/97-proxmenux-fwbr.conf
+    pmx_remove_file /etc/sysctl.d/98-proxmenux-rpf.conf
 
-    systemctl disable --now proxmenux-fwbr-tune.service >/dev/null 2>&1 || true
-    rm -f /etc/systemd/system/proxmenux-fwbr-tune.service
-    rm -f /usr/local/sbin/proxmenux-fwbr-tune
-    rm -f /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules \
-        /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules
+    pmx_disable_service proxmenux-fwbr-tune.service || true
+    pmx_remove_file /etc/systemd/system/proxmenux-fwbr-tune.service
+    pmx_remove_file /usr/local/sbin/proxmenux-fwbr-tune
+    pmx_remove_file /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules
+    pmx_remove_file /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules
+    pmx_record_execution "Reload udev rules" "udevadm control --reload-rules"
     udevadm control --reload-rules >/dev/null 2>&1 || true
 
+    pmx_record_execution "Reload systemd configuration" "systemctl daemon-reload"
     systemctl daemon-reload >/dev/null 2>&1 || true
+    pmx_record_execution "Apply sysctl configuration" "sysctl --system"
     sysctl --system >/dev/null 2>&1 || true
 
 
@@ -585,24 +620,27 @@ uninstall_network_optimization() {
 ################################################################
 
 uninstall_bashrc_custom() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_bashrc_custom" "$FUNC_VERSION"
     msg_info "$(translate "Restoring original bashrc...")"
     
     # Restore original bashrc from backup
     if [ -f /root/.bashrc.bak ]; then
-        mv /root/.bashrc.bak /root/.bashrc
+        pmx_write_file /root/.bashrc < /root/.bashrc.bak
+        pmx_remove_file /root/.bashrc.bak
         msg_ok "$(translate "Original bashrc restored")"
     else
         # Remove ProxMenux customizations manually
         if [ -f /root/.bashrc ]; then
             # Remove the customization block using the markers written by customize_bashrc
-            sed -i '/# BEGIN PMX_CORE_BASHRC/,/# END PMX_CORE_BASHRC/d' /root/.bashrc
+            pmx_edit_file /root/.bashrc '/# BEGIN PMX_CORE_BASHRC/,/# END PMX_CORE_BASHRC/d'
         fi
         msg_ok "$(translate "ProxMenux customizations removed from bashrc")"
     fi
     
     # Remove bash_profile source line if we added it
     if [ -f /root/.bash_profile ]; then
-        sed -i '/source \/root\/\.bashrc/d' /root/.bash_profile
+        pmx_edit_file /root/.bash_profile '/source \/root\/\.bashrc/d'
     fi
     
     register_tool "bashrc_custom" false
@@ -718,21 +756,23 @@ uninstall_persistent_network() {
 
 
 uninstall_vfio_iommu() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_vfio_iommu" "$FUNC_VERSION"
     msg_info2 "$(translate "Reverting IOMMU/VFIO configuration...")"
     NECESSARY_REBOOT=1
 
     # Remove VFIO modules from /etc/modules
     local modules_file="/etc/modules"
     if [ -f "$modules_file" ]; then
-        sed -i '/^vfio$/d;/^vfio_iommu_type1$/d;/^vfio_pci$/d;/^vfio_virqfd$/d' "$modules_file"
+        pmx_edit_file "$modules_file" '/^vfio$/d;/^vfio_iommu_type1$/d;/^vfio_pci$/d;/^vfio_virqfd$/d'
         msg_ok "$(translate "VFIO modules removed from /etc/modules")"
     fi
 
     # Remove driver blacklists added by ProxMenux
     local blacklist_file="/etc/modprobe.d/blacklist.conf"
     if [ -f "$blacklist_file" ]; then
-        sed -i '/^blacklist nouveau$/d;/^blacklist lbm-nouveau$/d;/^blacklist radeon$/d;/^blacklist nvidia$/d;/^blacklist nvidiafb$/d;/^options nouveau modeset=0$/d' "$blacklist_file"
-        [ ! -s "$blacklist_file" ] && rm -f "$blacklist_file"
+        pmx_edit_file "$blacklist_file" '/^blacklist nouveau$/d;/^blacklist lbm-nouveau$/d;/^blacklist radeon$/d;/^blacklist nvidia$/d;/^blacklist nvidiafb$/d;/^options nouveau modeset=0$/d'
+        [ ! -s "$blacklist_file" ] && pmx_remove_file "$blacklist_file"
         msg_ok "$(translate "Driver blacklist entries removed")"
     fi
 
@@ -742,9 +782,12 @@ uninstall_vfio_iommu() {
         # systemd-boot / ZFS
         if grep -qE 'intel_iommu=on|amd_iommu=on|iommu=pt|pcie_acs_override=' "$cmdline_file"; then
             cp "$cmdline_file" "${cmdline_file}.bak.$(date +%Y%m%d_%H%M%S)"
-            sed -i -E 's/\b(intel_iommu=on|amd_iommu=on|iommu=pt|pcie_acs_override=[^ ]*)\b//g' "$cmdline_file"
-            sed -i -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' "$cmdline_file"
-            command -v proxmox-boot-tool >/dev/null 2>&1 && proxmox-boot-tool refresh >/dev/null 2>&1 || true
+            pmx_edit_file "$cmdline_file" -E 's/\b(intel_iommu=on|amd_iommu=on|iommu=pt|pcie_acs_override=[^ ]*)\b//g'
+            pmx_edit_file "$cmdline_file" -E 's/[[:space:]]+/ /g; s/^ //; s/ $//'
+            if command -v proxmox-boot-tool >/dev/null 2>&1; then
+                pmx_record_execution "Refresh Proxmox boot configuration" "proxmox-boot-tool refresh"
+                proxmox-boot-tool refresh >/dev/null 2>&1 || true
+            fi
             msg_ok "$(translate "IOMMU parameters removed from /etc/kernel/cmdline")"
         fi
     else
@@ -752,9 +795,10 @@ uninstall_vfio_iommu() {
         local grub_file="/etc/default/grub"
         if [[ -f "$grub_file" ]] && grep -qE 'intel_iommu=on|amd_iommu=on|iommu=pt|pcie_acs_override=' "$grub_file"; then
             cp "$grub_file" "${grub_file}.bak.$(date +%Y%m%d_%H%M%S)"
-            sed -i -E 's/\b(intel_iommu=on|amd_iommu=on|iommu=pt|pcie_acs_override=[^ "]*)\b//g' "$grub_file"
+            pmx_edit_file "$grub_file" -E 's/\b(intel_iommu=on|amd_iommu=on|iommu=pt|pcie_acs_override=[^ "]*)\b//g'
             awk -F\" 'BEGIN{OFS="\""} /GRUB_CMDLINE_LINUX_DEFAULT=/{gsub(/[[:space:]]+/," ",$2);sub(/^ /,"",$2);sub(/ $/,"",$2)}1' \
-                "$grub_file" > "${grub_file}.tmp" && mv "${grub_file}.tmp" "$grub_file"
+                "$grub_file" | pmx_write_file "$grub_file"
+            pmx_record_execution "Regenerate GRUB configuration" "update-grub"
             update-grub >/dev/null 2>&1 || true
             msg_ok "$(translate "IOMMU parameters removed from GRUB")"
         fi
@@ -762,7 +806,9 @@ uninstall_vfio_iommu() {
     
     msg_info "$(translate 'Updating initramfs (this may take a minute)...')"
 
+    pmx_record_execution "Regenerate initramfs" "update-initramfs -u -k all"
     update-initramfs -u -k all >/dev/null 2>&1 || true
+    pmx_record_execution "Refresh Proxmox boot configuration" "proxmox-boot-tool refresh"
     proxmox-boot-tool refresh >/dev/null 2>&1 || true
 
     msg_ok "$(translate "IOMMU/VFIO configuration reverted")"
@@ -772,6 +818,8 @@ uninstall_vfio_iommu() {
 ################################################################
 
 uninstall_amd_fixes() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_amd_fixes" "$FUNC_VERSION"
     msg_info2 "$(translate "Reverting AMD (Ryzen/EPYC) fixes...")"
     NECESSARY_REBOOT=1
 
@@ -785,9 +833,10 @@ uninstall_amd_fixes() {
                 return 1
             }
 
-            sed -i 's/\bidle=nomwait\b//g; s/[[:space:]]\+/ /g; s/^ //; s/ $//' "$cmdline_file"
+            pmx_edit_file "$cmdline_file" 's/\bidle=nomwait\b//g; s/[[:space:]]\+/ /g; s/^ //; s/ $//'
 
             if command -v proxmox-boot-tool >/dev/null 2>&1; then
+                pmx_record_execution "Refresh Proxmox boot configuration" "proxmox-boot-tool refresh"
                 proxmox-boot-tool refresh >/dev/null 2>&1 || {
                     msg_error "$(translate "Failed to refresh boot configuration")"
                     return 1
@@ -805,14 +854,15 @@ uninstall_amd_fixes() {
                     return 1
                 }
 
-                sed -i -E 's/(GRUB_CMDLINE_LINUX_DEFAULT=")/\1/; s/\bidle=nomwait\b//g' "$grub_file"
+                pmx_edit_file "$grub_file" -E 's/(GRUB_CMDLINE_LINUX_DEFAULT=")/\1/; s/\bidle=nomwait\b//g'
 
                 awk -F\" '
                   $1=="GRUB_CMDLINE_LINUX_DEFAULT=" {
                     gsub(/[[:space:]]+/," ",$2); sub(/^ /,"",$2); sub(/ $/,"",$2)
                   }1
-                ' OFS="\"" "$grub_file" > "${grub_file}.tmp" && mv "${grub_file}.tmp" "$grub_file"
+                ' OFS="\"" "$grub_file" | pmx_write_file "$grub_file"
 
+                pmx_record_execution "Regenerate GRUB configuration" "update-grub"
                 update-grub >/dev/null 2>&1 || {
                     msg_error "$(translate "Failed to update GRUB configuration")"
                     return 1
@@ -830,17 +880,19 @@ uninstall_amd_fixes() {
                 msg_error "$(translate "Failed to backup $kvm_conf")"
                 return 1
             }
-            sed -i -E '/ignore_msrs|report_ignored_msrs/d' "$kvm_conf"
+            pmx_edit_file "$kvm_conf" -E '/ignore_msrs|report_ignored_msrs/d'
 
             if [[ ! -s "$kvm_conf" ]]; then
-                rm -f "$kvm_conf"
+                pmx_remove_file "$kvm_conf"
                 msg_ok "$(translate "Removed empty KVM configuration file")"
             else
                 msg_ok "$(translate "Removed KVM MSR options from configuration")"
             fi
 
+            pmx_record_execution "Regenerate initramfs" "update-initramfs -u -k all"
             update-initramfs -u -k all >/dev/null 2>&1 || true
-    proxmox-boot-tool refresh >/dev/null 2>&1 || true
+            pmx_record_execution "Refresh Proxmox boot configuration" "proxmox-boot-tool refresh"
+            proxmox-boot-tool refresh >/dev/null 2>&1 || true
         else
             msg_ok "$(translate "KVM MSR options not present, nothing to revert")"
         fi
@@ -957,8 +1009,12 @@ uninstall_ceph() {
 }
 
 uninstall_ha() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_ha" "$FUNC_VERSION"
     msg_info2 "$(translate 'Disabling High Availability services...')"
-    systemctl disable --now pve-ha-lrm pve-ha-crm corosync >/dev/null 2>&1 || true
+    pmx_disable_service pve-ha-lrm || true
+    pmx_disable_service pve-ha-crm || true
+    pmx_disable_service corosync || true
     msg_ok "$(translate 'HA services disabled (configs preserved)')"
     register_tool "ha" false
 }
@@ -1009,13 +1065,17 @@ uninstall_ovh_rtm() {
 }
 
 uninstall_pigz() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_pigz" "$FUNC_VERSION"
     msg_info2 "$(translate 'Reverting pigz wrapper...')"
     if [[ -f /bin/gzip.original ]]; then
-        mv -f /bin/gzip.original /bin/gzip
+        pmx_write_file /bin/gzip < /bin/gzip.original
+        pmx_remove_file /bin/gzip.original
         msg_ok "$(translate 'Restored original /bin/gzip')"
     fi
-    rm -f /bin/pigzwrapper
-    sed -i 's/^pigz: 1/#pigz: 1/' /etc/vzdump.conf 2>/dev/null || true
+    pmx_remove_file /bin/pigzwrapper
+    pmx_edit_file /etc/vzdump.conf 's/^pigz: 1/#pigz: 1/' 2>/dev/null || true
+    pmx_record_execution "Purge pigz package" "apt-get purge -y pigz"
     apt-get purge -y pigz >/dev/null 2>&1 || true
     msg_ok "$(translate 'pigz removed')"
     register_tool "pigz" false
@@ -1124,12 +1184,15 @@ uninstall_zfs_autotrim() {
 }
 
 uninstall_vzdump_speed() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_vzdump_speed" "$FUNC_VERSION"
     msg_info2 "$(translate 'Reverting vzdump speed tuning...')"
     if [[ -f /etc/vzdump.conf.bak ]]; then
-        mv -f /etc/vzdump.conf.bak /etc/vzdump.conf
+        pmx_write_file /etc/vzdump.conf < /etc/vzdump.conf.bak
+        pmx_remove_file /etc/vzdump.conf.bak
         msg_ok "$(translate 'Restored original /etc/vzdump.conf from .bak')"
     else
-        sed -i '/^bwlimit: 0$/d;/^ionice: 5$/d' /etc/vzdump.conf 2>/dev/null
+        pmx_edit_file /etc/vzdump.conf '/^bwlimit: 0$/d;/^ionice: 5$/d' 2>/dev/null
         msg_ok "$(translate 'Removed bwlimit/ionice tuning (no .bak found)')"
     fi
     register_tool "vzdump_speed" false