Function plan_undo_from 

pub fn plan_undo_from(
    current: Option<&SetupContext>,
    recorded: &[SetupContext],
) -> Plan

The undo plan, reversing what setup recorded and what the settings imply.

The record is authoritative: it names the resources actually installed. The current context is included as well, so a setup performed before records existed, or changed by hand since, is still cleaned up. Steps are deduplicated by their description, which names the path or rule each one acts on. plan_undo_all, with the current settings optional.

They are left out when proxy.tld no longer validates: paths built from it are exactly what validate_tld refuses to let near a privileged write, and the records were validated when they were written, so undo still works from those alone.