Module filesystem 

Output guard: validates files returned from a generator before they hit disk.

Rules:

• Paths are relative. Absolute paths and Windows drive letters are rejected.
• No .. segments. The host normalises and confirms the result stays inside the output directory.
• No duplicate paths within a single generator output.
• Per-file and total byte caps.

Generators write into a temp dir adjacent to the output dir; on success the host renames into place. The rename is atomic on the same filesystem.

Structs

Caps

Enums

OutputError

Functions

validate_output

Validate a list of output files against the limits encoded in Caps.