a commitment binds you to a value without revealing it (publish the hash now, open it later); a salt is the random ingredient that stops guessers from brute-forcing low-entropy values through the hash.
The mechanism itself: bind with the hash, hide with the salt.
Etymology and backstory
commitments are cryptography's sealed envelope - the formal properties are hiding (the hash reveals nothing useful) and binding (you cannot open to a different value), studied since the 1980s. Salting is older and humbler: Unix password files salted hashes in the 1970s (Morris and Thompson's 1979 paper) so identical passwords would not produce identical hashes and rainbow tables would not amortize. Salted hash commitments combine both: hash(value, random-salt) hides even guessable values.
Ecosystem
password storage everywhere, commit-reveal schemes in auctions and blockchains, SD-JWT's per-claim salts, git's inability to hide anything (unsalted content addressing famously leaks - identical content, identical hash - which is exactly why disclosure systems must salt).
In codexproof
every hidden field gets its own random salt before hashing, so two envelopes hiding the same value are unlinkable and a verifier cannot dictionary- attack "region: us-west." Losing salts costs utility (commitments can never be opened); leaking them costs privacy (hidden fields become checkable guesses); integrity survives either way.