This feels like a kludge to me. If we were to have this, we'd want to make sure it was basically never used interactively; we don't want to introduce visible downtime just for the sake of atomicity.

Maybe have a flag on hardware resources for 'staging' or the like, and an operation to simultaniously publish all staged changes? Not sure I think that's the right solution either, but this makes me a little uncomfortable.