Crate vsh_commit 

Capability-rooted revalidation and trusted commit engine for VSH.

The committer is the only core component that can mutate a host workspace. It consumes a non-cloneable reservation, revalidates only recorded dependencies, persists an intent journal, moves replaced nodes into quarantine, installs content with create-new semantics, and verifies the final state before marking a commit.

Structs

CommitConfig

Hard bounds applied before durable commit work begins.

CommitPlan

Borrowed exact transaction artifact accepted by the trusted committer.

CommitReceipt

Compact proof that an exact transaction reached verified durable state.

Committer

Capability-rooted workspace snapshot, revalidation, commit, and recovery engine.

NoFaults

Production fault injector that never interrupts work.

RecoveryConflict

Fail-closed recovery result requiring operator resolution.

RecoveryReport

Aggregate result of scanning durable commit journals.

SnapshotLimits

Bounds for eager host metadata traversal; file and link bytes remain lazy.

VerificationFailure

Expected and observed state for a failed operation or final-state check.

Enums

CommitError

Trusted-commit, revalidation, or recovery failure.

CommitPlanError

Invalid or unbounded immutable commit artifact.

FaultPoint

Deterministic crash boundary exposed to fault-injection tests.

HostError

Capability-scoped host filesystem observation failure.

JournalError

Durable operation-journal or commit-marker validation failure.

PlanDecodeError

Durable commit-plan decoding failure.

RevalidationConflict

One exact dependency mismatch detected before the first host mutation.

Traits

FaultInjector

Test seam for simulating process loss at durable boundaries.