Transactional installer. install.rs ONLY writes files; reload routing is the caller’s job. Drop defaults to rollback (RAII); commit must take self and forget the txn to prevent the default rollback.