Function verify_containment 

pub fn verify_containment(
    root: &LocalAbsolutePath,
    child: &LocalAbsolutePath,
) -> Result<(), RunnerRootError>

Proves that child is below root, lexically and after resolution.

04-security-recovery.md requires cleanup to “verify canonical containment without following a link outside the root” before it removes anything, and allocation to “build <persistent-root>/sN and validate containment” before it journals. Both are this function.

Errors

RunnerRootError::ForeignPlatform when either value is written in the other operating system’s path syntax, which the rest of this function would otherwise judge against this host’s filesystem; RunnerRootError::Escapes when child is not strictly inside root either lexically or once every existing component is resolved; RunnerRootError::Inspect when the filesystem cannot answer.