Labelled snapshots of a directory, with a restore that either fully lands or does not land at all — and a verify that proves restorability by restoring.