(defun change (description change-func prepare-backout-func)
  (with-indent
   (log-change description)
   (cond ((null prepare-backout-func)
          (log-info "no backout for this change")))
   (handle
       (lambda (st)
         (log-error "change failed. this is where we would do some smart backing-outing."))
     (change-func))))
(defun bucket-file (file-path)
  (let ((bucket-dir (or *file-bucket-dir*
                        (*rooted* (getenv "TMPDIR"))
                        (*rooted* "/tmp")))
        (original-file (*rooted* file-path)))
    (cond
     ((-f original-file)
      (let* ((uuid (get-new-uuid))
             (t (output-of "date" "-u" "+%s"))
             (digest (crypto-digest original-file))
             (size (get-size-of-file file-path))
             (meta (path-join bucket-dir (sprintf "meta-%s-%s" t uuid)))
             (data (path-join bucket-dir (sprintf "data-%s-%s" digest size))))
        (with-output-to ">" meta
          ;; PORTABILITY CAUTION: GNU and FreeBSD stat are quite different
          (printf "stat: %s\n" (output-of "stat" original-file))
          (printf "contents: %s\n" data))
        (close meta)
        (cond
         ((-e data)
          (log-info "%s already bucketed; not copying again" data))
         (true
          (log-bucket file-path meta data)
          (system-or-error "cp" "-a" original-file data)))))
     (true
      (error "could not bucket non-existent file %s" original-file)))))
(defun change-file (file-path description change-func prepare-backout-func)
  (let ((des (sprintf "%s: %s" file-path description)))
    (change des change-func (or prepare-backout-func
                                (lambda () (bucket-file file-path))))))
(defun change-dir (dir-path description change-func)
  (let ((des (sprintf "dir %s: %s" dir-path description)))
    (change des change-func nil)))

          (sed script file-path)
        (log-info "no change necessary")))))

          (change-file file-path "replace-line-in-file"
                       (lambda () (sed script file-path))
                       nil)))))

      (if (null output)
          (sed script file-path)
        (log-info "no change necessary")))))

      (when (null output)
        (change-file file-path "add line"
                     (lambda () (sed script file-path))
                     nil)))))

          (with-replacing-temp-file-io (fp tp)
            (dolines-until (lambda (l) (>= NR (- before-line 1)))
                           (lambda (l) (printf "%s\n" l)))
            (printf "%s\n" line)
            (dolines (lambda (l) (printf "%s\n" l))))))
       (true (log-info "no change necessary"))))))

          (change-file file-path "insert line before"
            (lambda ()
              (with-replacing-temp-file-io (fp tp)
                (dolines-until (lambda (l) (>= NR (- before-line 1)))
                               (lambda (l) (printf "%s\n" l)))
                (printf "%s\n" line)
                (dolines (lambda (l) (printf "%s\n" l))))))))))))

      (if (probe-sed-would-change script file-path)
          (sed script file-path)
        (log-info "no change necessary")))))

      (when (probe-sed-would-change script file-path)
        (change-file file-path "delete lines matching"
          (lambda () (sed script file-path))
          nil)))))

        (if (equal (get-mog file-path) (list mode owner group))
              (log-info "no change necessary")
            (set-mog file-path mode owner group)))

        (cond
         ((equal (get-mog file-path) (list mode owner group)))
         (true
          (change-file file-path "perms"
            (lambda () (set-mog file-path mode owner group))
            nil))))

       (true 
        (system-or-error "touch" fp)
        (set-mog file-path mode owner group))))))

       (true
        (change-file file-path "create file"
          (lambda ()
            (system-or-error "touch" fp)
            (set-mog file-path mode owner group))
          (lambda ())))))))

        (system-or-error "rm" fp))
       (true
        (log-info "no change necessary"))))))

        (change-file file-path "remove"
          (lambda ()
            (system-or-error "rm" fp))
          nil))))))

        (if (equal (get-mog dp) (list mode owner group))
            (log-info "no change necessary")
          (set-mog dp mode owner group)))

        (cond
         ((equal (get-mog dp) (list mode owner group)))
         (true
          (change-dir dir-path "perms"
                      (lambda () (set-mog dp mode owner group))))))

        (system-or-error "mkdir" dp)
        (set-mog dp owner n-group mode))))))

        (change-dir dir-path "mkdir"
                    (lambda ()
                      (system-or-error "mkdir" dp)
                      (set-mog dp owner n-group mode))))))))

      (if (-f fp)
          (progn
            (with-output-to ">" new-fp (printf "%s" contents))
            (close new-fp)
            (if (equal (crypto-digest fp)
                       (crypto-digest new-fp))
                (progn
                  (log-info "no change necessary")
                  (system "rm" "-f" new-fp))
              (copy-mog file-path new)
              (system-or-error "mv" new-fp fp)))
        (editing-nonexistent-file-error file-path)))))

      (cond
       ((-f fp)
        (with-output-to ">" new-fp (printf "%s\n" contents))
        (close new-fp)
        (copy-mog file-path new)
        (cond
         ((equal (crypto-digest fp) (crypto-digest new-fp))
          (system "rm" "-f" new-fp))
         (true
          (change-file file-path "replace contents"
            (lambda ()
              (system-or-error "mv" new-fp fp))
            nil))))
       (true (editing-nonexistent-file-error file-path))))))

    (if (equal (crypto-digest dfp) (crypto-digest src-file-path))
        (log-info "no change necessary")
      (let ((tmp  (make-temp-filename-from dest-file-path))
            (dfp-tmp (*rooted* tmp)))
        (with-input-from "<" src-file-path
          (with-output-to ">" dfp-tmp
            (dolines (lambda (l) (printf "%s\n" l)))))
        (copy-mog dest-file-path tmp)
        (system-or-error "mv" dfp-tmp dfp)))))

    (cond
     ((equal (crypto-digest dfp) (crypto-digest src-file-path)))
     (true (let ((tmp  (make-temp-filename-from dest-file-path))
                 (dfp-tmp (*rooted* tmp)))
             (with-input-from "<" src-file-path
               (with-output-to ">" dfp-tmp
                 (dolines (lambda (l) (printf "%s\n" l)))))
             (copy-mog dest-file-path tmp)
             (change-file file-path "replace contents"
               (lambda () (system-or-error "mv" dfp-tmp dfp))
               nil))))))

         (if (equal (crypto-digest rft)
                    (crypto-digest dfp))
             (log-info "no change necessary")
           (copy-mog dest ft)
           (system-or-error "mv" rft dfp))))))

         (copy-mog dest ft)
         (cond
          (equal (crypto-digest rft) (crypto-digest dfp))
          (true (change-file dest "replace with templated contents"
                  (lambda () (system-or-error "mv" rft dfp))
                  nil)))))))

    (if (probe-success "grep" "-q" (sprintf "^%s:" user-name)
                       (*rooted* "/etc/passwd"))
        (log-info "no change necessary")
      (apply system-or-error `("pw" ,@alt-root-addendum
                               "useradd" "-n" ,user-name "-m"
                               ,@group-addendum)))))

    (cond
     ((probe-success "grep" "-q" (sprintf "^%s:" user-name)
                     (*rooted* "/etc/passwd")))
     (true
      (change (sprintf "add local user %s" user-name)
              (lambda () (apply system-or-error
                                `("pw" ,@alt-root-addendum
                                  "useradd" "-n" ,user-name "-m"
                                  ,@group-addendum)))
              nil)))))

    (if installed
        (log-info "no change necessary")
      ;; "If pkg is already installed, nothing is done."
      (apply system-or-error `("pkg" ,@pkg-opts "bootstrap"))
      (apply system-or-error `("pkg" ,@pkg-opts "install" "-y" ,name)))))

    (cond
     (installed)
     (true
      (change (sprintf "install package %s" name)
              (lambda ()
                ;; "If pkg is already installed, nothing is done."
                (apply system-or-error `("pkg" ,@pkg-opts "bootstrap"))
                (apply system-or-error
                       `("pkg" ,@pkg-opts "install" "-y" ,name))))))))

        (if (apply probe-success `("sysrc" "-c" ,@alt-root ,setting))
            (log-info "no change necessary")
          (apply system-or-error `("sysrc" ,@alt-root ,setting)))))

        (cond
         ((apply probe-success `("sysrc" "-c" ,@alt-root ,setting)))
         (true
          (change (sprintf "sysrc %s = %s" name value)
                  (lambda () (apply system-or-error
                                    `("sysrc" ,@alt-root ,setting))))))))

        (if (equal o n)
            ;; The value was unchanged by our snooping. That means the
            ;; thing we were trying to add is already in there, so our
            ;; check succeeds and our change will not be done (nor
            ;; superfluously reported).
            (log-info "no change necessary")
          ;; We changed it while trying to check. The added value will
          ;; be on the end, so if we remove it, everything will be
          ;; back how we found it, so we can then change it. :)
          ;;
          ;; -- except here in lacrum, we aren't separating checks and
          ;; changes yet, nor worrying about how to undo a change, so
          ;; we shall just be happy. we did the change!
          true)))

        (cond
         ;; The value was unchanged by our snooping. That means the
         ;; thing we were trying to add is already in there, so our
         ;; check succeeds and our change will not be done (nor
         ;; superfluously reported).
         ((equal o n))
         ;; We changed it while trying to check. The added value will
         ;; be on the end, so if we remove it, everything will be
         ;; back how we found it, so we can then change it. :)
         (true
          (apply system-or-error `("sysrc" ,@alt-root ,sub-s))
          (change (sprintf "sysrc %s += %s" name value)
                  (lambda ()
                    (apply system-or-error `("sysrc" ,@alt-root ,add-s)))
                  nil)))))

        (if (equal o n)
            (log-info "no change necessary")
          ;; while checking it we removed it. be happy
          true)))

        (when (not (equal o n))
          ;; while checking it we removed it. uhhhrrr... log a change.
          ;; get better at preparing backouts in the future.
          (change (sprintf "sysrc %s -= %s" name value)
                  (lambda ())
                  nil))))