Module seams 

The engine’s only two OS-effect seams (ADR-0018 — this is the hard cap, do not add a third): snapshot persistence and the USN journal session. They exist so the volume worker’s failure paths (corrupt snapshot, journal-gone, failed saves, stat-fetch storms) replay in unprivileged, deterministic tests (worker_tests.rs). The Windows implementations are thin wrappers over the exact calls the worker made before the seam was introduced — behavior-identical by construction.

Granularity guard: every method here runs at establish/batch/save frequency. Nothing per-entry goes through these traits (the per-record StatFetcher handed out below was already a dyn call before the seam existed — see usn::apply_batch).

Structs

JournalView

What checkpoint validation needs from FSCTL_QUERY_USN_JOURNAL.

WinJournalSource

Production journal: thin wrapper over usn::session::UsnJournal / VolumeStatFetcher for one drive label.

WinSnapshotStore

Production store: thin wrapper over VolumeIndex::{load_from, save_to} plus fs::{metadata, remove_file} on the volume’s snapshot path.

Traits

JournalSource

One volume’s USN journal session, reopenable across journal-gone rescans. open must succeed before any other method is called (the worker guarantees this; implementations may panic otherwise — the worker’s panic firewall turns that into a visible VolumeFailed).

SnapshotStore

Snapshot persistence for one volume ({index_dir}\{letter}.fmfidx).