kobako 0.28.0 → 0.30.0

data/crates/kobako-runtime/src/filesystem/overlay.rs

@@ -0,0 +1,3469 @@
+//! `Overlay`: read-only lower Layers under an upper Tmpfs, stacked into
+//! one Filesystem, as Linux overlayfs stacks a mount's layers.
+//!
+//! The upper must be a Tmpfs, as gVisor takes only an upper that holds
+//! its marks. A removal hides what a lower Layer still shows with a
+//! whiteout, and a directory made again where one was removed is marked
+//! opaque, each as Linux marks it, in the upper, so they last as long as
+//! it does. The VFS holds each directory a call changes, as Linux's
+//! `i_rwsem` does above overlayfs, and a copy up holds the lock of what
+//! it copies, so a change across several Layers is never seen half made.
+
+mod file;
+mod inode;
+mod path;
+mod stack;
+
+use std::any::Any;
+use std::sync::Arc;
+
+use super::rdir::Rdir;
+use super::{
+    DentryOperations, FileOperations, FileSystemType, FileType, Filesystem, FilesystemError, Iattr,
+    InodeOperations, Kstat, Lookup, OpenHow, RenameFlag, Tmpfs,
+};
+use crate::vfs::{
+    generic_file_llseek, generic_read_dir, notify_change, Dentry, DirContext, Inode, Whence,
+    NAME_MAX,
+};
+use inode::{OverlayDirInode, OverlayFileInode};
+use path::OverlayPath;
+use stack::OverlayFs;
+
+/// Read-only lower Layers under an upper Tmpfs, stacked into one
+/// Filesystem. Two Overlays sharing an upper are not serialized against
+/// each other, as overlayfs leaves two mounts sharing an upper directory
+/// undefined.
+///
+/// Each directory of the view keeps each Layer's directory it stands for
+/// on its dentry, so it is reached wherever those directories move, as a
+/// descriptor reaches its directory, and a directory opened beneath it is
+/// this Overlay asked about that dentry. overlayfs leaves a change made to
+/// a Layer outside it undefined; here such a change is the host's, and a
+/// directory reached before it keeps the Layers' directories it holds.
+#[derive(Clone)]
+pub struct Overlay {
+    fs: OverlayFs,
+    /// How many Overlays stack here, itself among them, as Linux counts
+    /// a super block's `s_stack_depth`.
+    stack_depth: usize,
+}
+
+/// The deepest Overlays may stack, as Linux's `FILESYSTEM_MAX_STACK_DEPTH`
+/// bounds it, so a call through them cannot run out of stack.
+const MAX_STACK_DEPTH: usize = 2;
+
+/// The most lower Layers an Overlay takes, as overlayfs's `OVL_MAX_STACK`.
+const MAX_LOWER_LAYERS: usize = 500;
+
+impl Overlay {
+    /// An Overlay of `lower`, topmost first, under `upper`. Each Layer is
+    /// asked through that Filesystem's dentries, as overlayfs asks each
+    /// layer by its own lookup. As overlayfs's mount does, it refuses no
+    /// lower Layer, a read-only view of fewer than two, too many lower
+    /// Layers, a stack too deep, and one instance as two Layers, as
+    /// overlayfs answers overlapping layers; as gVisor's does, it refuses an
+    /// upper that is no Tmpfs.
+    pub fn new(
+        lower: Vec<Arc<Filesystem>>,
+        upper: Option<Arc<Filesystem>>,
+    ) -> Result<Self, FilesystemError> {
+        let layers: Vec<_> = lower.iter().chain(&upper).collect();
+        let overlapping = layers
+            .iter()
+            .enumerate()
+            .any(|(at, layer)| layers[..at].iter().any(|seen| Arc::ptr_eq(seen, layer)));
+        if overlapping {
+            return Err(FilesystemError::InvalidInput);
+        }
+        let too_few = if upper.is_some() { 1 } else { 2 };
+        let upper_tmpfs = upper.as_ref().is_none_or(|upper| {
+            upper
+                .root()
+                .and_then(|root| root.inode())
+                .is_some_and(|root| (root.ops().as_ref() as &dyn Any).is::<Tmpfs>())
+        });
+        let stack_depth = 1 + lower
+            .iter()
+            .filter_map(|layer| layer.root()?.inode())
+            .filter_map(|root| {
+                let overlay = (root.ops().as_ref() as &dyn Any).downcast_ref::<Self>()?;
+                Some(overlay.stack_depth)
+            })
+            .max()
+            .unwrap_or(0);
+        if !(too_few..=MAX_LOWER_LAYERS).contains(&lower.len())
+            || !upper_tmpfs
+            || stack_depth > MAX_STACK_DEPTH
+        {
+            return Err(FilesystemError::InvalidInput);
+        }
+        Ok(Self {
+            fs: OverlayFs::new(lower, upper)?,
+            stack_depth,
+        })
+    }
+}
+
+/// The Layer's dentry the entry `dentry` answers through, and the inode the view
+/// recorded, as `ovl_getattr` asks the real path.
+fn real_of(dentry: &Dentry) -> Option<(Arc<Dentry>, Arc<Inode>)> {
+    let inode = dentry.inode()?;
+    let real = OverlayFileInode::of(&inode)?.real();
+    Some((real, inode))
+}
+
+/// Whether `real`, a Layer's dentry, still names what it recorded, as
+/// `ovl_revalidate_real` asks it.
+fn ovl_revalidate_real(real: &Dentry) -> Result<bool, FilesystemError> {
+    match real.ops() {
+        Some(ops) => ops.revalidate(real.parent().inode_ops()?.as_ref(), real),
+        None => Ok(true),
+    }
+}
+
+/// A name stays valid while each Layer's dentry its entry keeps does, as
+/// `ovl_dentry_revalidate` asks each real dentry, and while a directory still
+/// stands for what each Layer holds there, as `ovl_clear_empty` drops a dentry
+/// whose upper no longer matches.
+impl DentryOperations for Overlay {
+    fn revalidate(
+        &self,
+        _dir: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<bool, FilesystemError> {
+        let Some(inode) = dentry.inode() else {
+            return Ok(matches!(self.lookup(dentry)?, Lookup::Absent));
+        };
+        if let Some(kept) = OverlayFileInode::of(&inode) {
+            return ovl_revalidate_real(&kept.real());
+        }
+        let Some(kept) = OverlayDirInode::of(&inode) else {
+            return Ok(true);
+        };
+        let shown = kept.level();
+        for layer in shown.iter().flatten() {
+            if !ovl_revalidate_real(layer.dentry())? {
+                return Ok(false);
+            }
+        }
+        let name = dentry.name();
+        let above = self.fs.parent(dentry)?.level();
+        Ok(above.iter().zip(&shown).all(|pair| match pair {
+            (Some(layer), Some(shown)) => layer.matches_real(&name, shown.dentry()),
+            _ => true,
+        }))
+    }
+
+    /// A name goes once nothing holds it where any Layer behind it would let
+    /// its own go, since its `revalidate` answers only as those Layers do.
+    fn delete(&self, dentry: &Dentry) -> bool {
+        let Some(inode) = dentry.inode() else {
+            return false;
+        };
+        if let Some(kept) = OverlayFileInode::of(&inode) {
+            return kept.real().goes_when_unused();
+        }
+        OverlayDirInode::of(&inode).is_some_and(|kept| {
+            kept.level()
+                .iter()
+                .flatten()
+                .any(|layer| layer.dentry().goes_when_unused())
+        })
+    }
+}
+
+/// A file of the view, or an entry a Layer holds that is none of the others, as
+/// `ovl_file_inode_operations` answers for one.
+struct OverlayRegular(Overlay);
+
+/// A link of the view, as `ovl_symlink_inode_operations` answers for one.
+struct OverlayLink(Overlay);
+
+impl Overlay {
+    /// The operations an entry of `kind` answers through.
+    fn ops_of(&self, kind: FileType) -> Arc<dyn InodeOperations> {
+        match kind {
+            FileType::Dir => Arc::new(self.clone()),
+            FileType::Symlink => Arc::new(OverlayLink(self.clone())),
+            _ => Arc::new(OverlayRegular(self.clone())),
+        }
+    }
+
+    /// What the Layer the entry's name is found in reports, under the identity
+    /// the view recorded.
+    fn real_getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        let (real, inode) = real_of(dentry).ok_or(FilesystemError::NotFound)?;
+        let found = real.getattr()?;
+        Ok(match inode.identity() {
+            Some(identity) => identity.onto(found),
+            None => found,
+        })
+    }
+}
+
+impl InodeOperations for OverlayRegular {
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.0.real_getattr(dentry)
+    }
+
+    /// Copied up first, as `ovl_setattr` does, so a lower Layer stays as it
+    /// was whatever its Filesystem would keep.
+    fn setattr(&self, dentry: &Dentry, attr: &Iattr) -> Result<(), FilesystemError> {
+        let overlay = &self.0;
+        overlay
+            .fs
+            .copy_up_file(&overlay.fs.parent(dentry)?, dentry, false)?;
+        let (real, _) = real_of(dentry).ok_or(FilesystemError::NotFound)?;
+        // The open's truncate never reached the upper's open, so the upper must
+        // empty the file itself, and the view's open file is none of the upper's,
+        // as `ovl_setattr` clears `ATTR_OPEN` and `ATTR_FILE`.
+        let held = real.inode_lock()?;
+        notify_change(
+            &real,
+            &held,
+            &Iattr {
+                open: false,
+                file: None,
+                ..*attr
+            },
+        )
+    }
+
+    fn open(
+        &self,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        let fs = &self.0.fs;
+        fs.open(&fs.parent(dentry)?, dentry, how)
+    }
+}
+
+impl InodeOperations for OverlayLink {
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.0.real_getattr(dentry)
+    }
+
+    /// Where the link points, as `ovl_get_link` asks the real dentry.
+    fn get_link(&self, dentry: &Dentry) -> Result<String, FilesystemError> {
+        let (real, _) = real_of(dentry).ok_or(FilesystemError::NotFound)?;
+        real.get_link()
+    }
+}
+
+impl FileSystemType for Overlay {
+    /// With no upper nothing can change, as `ovl_fill_super` sets `SB_RDONLY`.
+    /// Its root takes the identity its topmost Layer's root recorded, as
+    /// `ovl_get_root` reads a real root's `i_ino`, so making the view asks no
+    /// Layer anything.
+    fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+        sb.set_default_d_op(self.clone());
+        if !self.fs.has_upper() {
+            sb.set_rdonly();
+        }
+        let root = Kstat::new(FileType::Dir, 0);
+        let root = match self.fs.root_identity() {
+            Some(identity) => identity.onto(root),
+            None => root,
+        };
+        let root_dir = self.fs.root_dir();
+        let root = Inode::new(&root, self);
+        inode::ovl_inode_init(&root, root_dir);
+        sb.d_make_root(root);
+        Ok(())
+    }
+}
+
+/// A directory of the view, finding what a call is about through the dentry it
+/// is handed, as `ovl_dir_inode_operations` answers for one.
+impl InodeOperations for Overlay {
+    /// It reports its merged Layers.
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.fs.dir_getattr(&self.fs.dir(dentry)?.level())
+    }
+
+    /// Copied up first, as `ovl_setattr` does for any entry, so a lower Layer
+    /// stays as it was.
+    fn setattr(&self, dentry: &Dentry, attr: &Iattr) -> Result<(), FilesystemError> {
+        let upper = self.fs.upper_dir(&self.fs.dir(dentry)?)?;
+        let held = upper.dentry().inode_lock()?;
+        notify_change(upper.dentry(), &held, attr)
+    }
+
+    /// The entry as a Layer spells it, as `ovl_lookup` hands
+    /// `d_splice_alias` the inode it made, a name no Layer could hold refused
+    /// before any is asked, as it compares `namelen`.
+    fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+        let level = self.fs.parent(dentry)?.level();
+        let name = dentry.name();
+        if name.len() > NAME_MAX {
+            return Err(FilesystemError::InvalidFilename);
+        }
+        let Some(found) = self.fs.lookup_layer(&level, &name)? else {
+            return Ok(Lookup::Absent);
+        };
+        let stored_name = found.1.stored_name().to_string();
+        let inode = self
+            .fs
+            .lookup(&level, &stored_name, found, |kind| self.ops_of(kind))?;
+        match stored_name == name {
+            true => Ok(Lookup::Found(inode)),
+            false => Ok(Lookup::Spelled {
+                name: stored_name,
+                inode,
+            }),
+        }
+    }
+
+    fn open(
+        &self,
+        dentry: &Dentry,
+        _how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        let _real = self
+            .fs
+            .dir(dentry)?
+            .level()
+            .iter()
+            .flatten()
+            .map(OverlayPath::open_real)
+            .collect::<Result<_, _>>()?;
+        let fs = self.fs.clone();
+        Ok(Box::new(OverlayDir {
+            fs,
+            _real,
+            cache: Rdir::default(),
+        }))
+    }
+
+    /// What was made is found through the view's own lookup, as `ovl_instantiate`
+    /// records the inode for the real dentry.
+    fn create(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.fs.create(&self.fs.parent(dentry)?, &dentry.name())?;
+        match self.lookup(dentry)? {
+            Lookup::Found(inode) => dentry.add(Some(inode)),
+            _ => return Err(FilesystemError::NotFound),
+        }
+        Ok(())
+    }
+
+    fn mkdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.fs.mkdir(&self.fs.parent(dentry)?, &dentry.name())
+    }
+
+    fn rmdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.fs.rmdir(&self.fs.parent(dentry)?, dentry)
+    }
+
+    fn unlink(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.fs.unlink(&self.fs.parent(dentry)?, dentry)
+    }
+
+    /// Both directories lie in one Overlay, however many directories of
+    /// it are open. Only its upper takes a flag, which it asks itself.
+    fn rename(
+        &self,
+        from: &Dentry,
+        _to_dir: &dyn InodeOperations,
+        to: &Dentry,
+        flag: Option<RenameFlag>,
+    ) -> Result<(), FilesystemError> {
+        if flag.is_some() {
+            return Err(FilesystemError::InvalidInput);
+        }
+        self.fs
+            .rename(&self.fs.parent(from)?, from, &self.fs.parent(to)?, to)
+    }
+}
+
+/// A directory of the view, open: it merges its Layers each time it is
+/// listed, finding them through the dentry it is handed, and holds each Layer's
+/// directory open while it is, as `struct ovl_dir_file` holds its `realfile`.
+struct OverlayDir {
+    fs: OverlayFs,
+    _real: Vec<Box<dyn FileOperations>>,
+    /// What a listing merged, held until it ends, as `ovl_dir_cache` holds it.
+    cache: Rdir,
+}
+
+impl FileOperations for OverlayDir {
+    fn llseek(
+        &mut self,
+        dentry: &Dentry,
+        pos: u64,
+        offset: i64,
+        whence: Whence,
+    ) -> Result<u64, FilesystemError> {
+        generic_file_llseek(dentry, pos, offset, whence)
+    }
+
+    fn read_iter(
+        &mut self,
+        _iocb: &mut super::Kiocb,
+        _buf: &mut [u8],
+    ) -> Result<usize, FilesystemError> {
+        generic_read_dir()
+    }
+
+    fn iterate_shared(
+        &mut self,
+        dentry: &Dentry,
+        ctx: &mut DirContext<'_>,
+    ) -> Result<(), FilesystemError> {
+        let (fs, cache) = (&self.fs, &mut self.cache);
+        cache.iterate(dentry, ctx, || fs.dir_read_merged(&fs.dir(dentry)?.level()))
+    }
+
+    /// Its Layers answer for what they hold, and its upper is a Tmpfs, so
+    /// nothing is left to make durable, as `ovl_dir_fsync` finds with no upper
+    /// of its own to sync.
+    fn fsync(&mut self, _datasync: bool) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+    use std::sync::Mutex;
+    use std::thread;
+    use std::time::{Duration, Instant};
+
+    use super::super::tmpfs::Tmpfs;
+    use super::super::wrap::{Hook, Wrap};
+    use super::super::{FileType, Finish, Kiocb};
+    use super::*;
+    use crate::vfs::kern_path::{kern_path, KernPath};
+    use crate::vfs::Mask;
+
+    /// `filesystem` reached through the VFS.
+    fn at(filesystem: impl FileSystemType) -> KernPath {
+        kern_path(Arc::new(filesystem))
+    }
+
+    /// The Filesystem `filesystem` holds, reached through the VFS.
+    fn on<F: FileSystemType>(filesystem: &Arc<F>) -> KernPath {
+        kern_path(filesystem.clone())
+    }
+
+    #[derive(Default)]
+    struct CountsLookups(AtomicUsize);
+
+    impl Hook for CountsLookups {
+        fn lookup(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+        ) -> Result<Lookup, FilesystemError> {
+            self.0.fetch_add(1, Ordering::SeqCst);
+            inner.lookup(dentry)
+        }
+    }
+
+    // A Filesystem written in Ruby pays for each ask and keeps no dentry, so a
+    // name found absent, which no Filesystem keeps, shows how often a Layer is
+    // asked by itself.
+    // @behavior FS-184
+    #[test]
+    fn a_lookup_asks_each_layer_once_for_a_name() {
+        let lower: Tmpfs = [("file", "x")].into_iter().collect();
+        let counts = Arc::new(CountsLookups::default());
+        let view = at(Overlay::new(
+            vec![
+                Filesystem::new(Arc::new(Wrap::new(Arc::new(lower), counts.clone())))
+                    .expect("the instance must stand"),
+            ],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack"));
+        let asks = |path: &str| {
+            counts.0.store(0, Ordering::SeqCst);
+            let _ = view.vfs_lstat(path);
+            counts.0.load(Ordering::SeqCst)
+        };
+        assert_eq!(
+            (asks("missing"), asks("file")),
+            (1, 1),
+            "a stat through an Overlay of a name its lower Layer lacks, and of one it holds, \
+             must ask that Layer once"
+        );
+    }
+
+    // Only the upper could refuse the name once the directory was copied up, so
+    // the directory standing nowhere in the upper is what shows no change began.
+    // @behavior FS-183
+    #[test]
+    fn a_name_past_name_max_answers_too_long_and_copies_nothing_up() {
+        let upper = Arc::new(Tmpfs::new());
+        let (view, _lower) = overlay_on(upper.clone());
+        let long = format!("dir/{}", "n".repeat(NAME_MAX + 1));
+        assert_eq!(
+            (
+                view.vfs_lstat(&long).err(),
+                view.vfs_mkdir(&long).err(),
+                on(&upper).vfs_lstat("upper/dir").err(),
+            ),
+            (
+                Some(FilesystemError::InvalidFilename),
+                Some(FilesystemError::InvalidFilename),
+                Some(FilesystemError::NotFound),
+            ),
+            "a stat and a make of a name past NAME_MAX in a lower directory, through an Overlay, \
+             must answer ENAMETOOLONG and leave that directory uncopied"
+        );
+    }
+
+    // @behavior FS-140
+    #[test]
+    fn a_file_with_nothing_to_flush_syncs() {
+        let lower: Tmpfs = [("file", "x")].into_iter().collect();
+        let upper = Tmpfs::new();
+        let overlay = at(Overlay::new(
+            vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(upper)).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack"));
+        assert_eq!(
+            open_to_read(&overlay, "file").fsync(false),
+            Ok(()),
+            "FileOperations::fsync on an Overlay's file open to read from a Tmpfs Layer must \
+             succeed"
+        );
+        let tmpfs = at([("file", "x")].into_iter().collect::<Tmpfs>());
+        assert_eq!(
+            open_to_read(&tmpfs, "file").fsync(false),
+            Ok(()),
+            "FileOperations::fsync on a Tmpfs file must succeed"
+        );
+    }
+
+    fn open_to_read(fs: &KernPath, path: &str) -> Box<dyn FileOperations> {
+        fs.open(
+            path,
+            &OpenHow {
+                read: true,
+                ..OpenHow::default()
+            },
+        )
+        .expect("the file must open to read")
+    }
+
+    fn read_from(file: &mut dyn FileOperations) -> Vec<u8> {
+        let mut buf = vec![0; 64];
+        let read = file
+            .read_iter(&mut Kiocb::at(0), &mut buf)
+            .expect("the file must read");
+        buf.truncate(read);
+        buf
+    }
+
+    fn read(fs: &KernPath, path: &str) -> Vec<u8> {
+        read_from(open_to_read(fs, path).as_mut())
+    }
+
+    fn write(fs: &KernPath, path: &str, contents: &[u8]) -> Result<(), FilesystemError> {
+        fs.open_or_create(
+            path,
+            &OpenHow {
+                write: true,
+                truncate: true,
+                ..OpenHow::default()
+            },
+        )?
+        .write_iter(&mut Kiocb::at(0), contents)
+        .map(drop)
+    }
+
+    /// Write at the start of what stands at `path`, so a copy up brings its
+    /// bytes along.
+    fn write_over(fs: &KernPath, path: &str, contents: &[u8]) -> Result<(), FilesystemError> {
+        let how = OpenHow {
+            write: true,
+            ..OpenHow::default()
+        };
+        fs.open(path, &how)?
+            .write_iter(&mut Kiocb::at(0), contents)
+            .map(drop)
+    }
+
+    fn overwrite(fs: &KernPath, path: &str, contents: &[u8]) {
+        write(fs, path, contents).expect("the write must land");
+    }
+
+    fn names(fs: &KernPath, path: &str) -> Vec<String> {
+        let listed = match path {
+            "" => fs.iterate_dir(),
+            path => fs.open_dir(path).and_then(|dir| dir.iterate_dir()),
+        };
+        let mut names: Vec<String> = listed
+            .expect("the directory must list")
+            .into_iter()
+            .map(|entry| entry.name)
+            .collect();
+        names.sort();
+        names
+    }
+
+    fn tmpfs_with(path: &str, contents: &str) -> Arc<Tmpfs> {
+        Arc::new([(path, contents)].into_iter().collect())
+    }
+
+    // A helper beneath the VFS skips the super block's read-only answer, so only
+    // the view's own upper standing empty keeps the change off its lower Layers.
+    // @behavior FS-197
+    #[test]
+    fn a_change_reaching_an_overlay_with_no_upper_leaves_its_lower_layers_as_they_are() {
+        let top = tmpfs_with("dir/file", "top");
+        let overlay = at(lowers(top.clone(), Arc::new(Tmpfs::new())));
+        assert_eq!(
+            (
+                overlay.vfs_mkdir("made").err(),
+                on(&top).vfs_lstat("made").err()
+            ),
+            (
+                Some(FilesystemError::ReadOnlyFilesystem),
+                Some(FilesystemError::NotFound)
+            ),
+            "OverlayFs::mkdir with no upper, reached beneath the VFS's read-only answer, must \
+             answer EROFS and make nothing in its topmost lower Layer"
+        );
+    }
+
+    /// A security module recording the name of each directory it is asked to
+    /// let change.
+    struct RecordsChanges(Arc<Mutex<Vec<String>>>);
+
+    impl crate::vfs::SecurityOperations for RecordsChanges {
+        fn inode_permission(
+            &self,
+            dentry: &Dentry,
+            mask: crate::vfs::Mask,
+        ) -> Result<(), FilesystemError> {
+            if mask.contains(crate::vfs::Mask::WRITE) {
+                self.0.lock().expect("never poisoned").push(dentry.name());
+            }
+            Ok(())
+        }
+    }
+
+    // A Layer's directories carry names of their own, so a module asked about
+    // one would record more than the view's root.
+    // @behavior FS-198
+    #[test]
+    fn a_call_through_an_overlay_asks_a_module_of_the_view_alone() {
+        let overlay = over(tmpfs_with("f", "x"), Arc::new(Tmpfs::new()));
+        let mount = crate::mount::Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            crate::mount::Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let asked = Arc::new(Mutex::new(Vec::new()));
+        let cred = crate::vfs::Cred::new(vec![Arc::new(RecordsChanges(asked.clone()))]);
+        let root = crate::vfs::Path::root(mount.mnt());
+        let made = crate::vfs::filename_mkdirat(&cred, &root, "d");
+        assert_eq!(
+            (made, asked.lock().expect("never poisoned").clone()),
+            (Ok(()), vec![String::new()]),
+            "vfs::filename_mkdirat through an Overlay must ask a security module of the view's \
+             directory alone, as overlayfs makes its Layers' calls with its creator_cred"
+        );
+    }
+
+    /// `upper` over the one lower Layer `lower`.
+    fn over(lower: Arc<dyn FileSystemType>, upper: Arc<Tmpfs>) -> Overlay {
+        let instance = |fs| Filesystem::new(fs).expect("the instance must stand");
+        Overlay::new(vec![instance(lower)], Some(instance(upper)))
+            .expect("an upper over a lower Layer must make a view")
+    }
+
+    /// The lower Layers `top` over `bottom`, with no upper.
+    fn lowers(top: Arc<dyn FileSystemType>, bottom: Arc<dyn FileSystemType>) -> Overlay {
+        let instance = |fs| Filesystem::new(fs).expect("the instance must stand");
+        Overlay::new(vec![instance(top), instance(bottom)], None)
+            .expect("two lower Layers must make a view")
+    }
+
+    /// `upper` over a lower Tmpfs holding `dir/file` = "lower".
+    fn overlay_on(upper: Arc<Tmpfs>) -> (KernPath, Arc<Tmpfs>) {
+        let lower = tmpfs_with("dir/file", "lower");
+        (at(over(lower.clone(), upper)), lower)
+    }
+
+    /// A host directory holding `target`, `dir/inner`, and the links `link`
+    /// to `target`, `dirlink` to `dir`, and `dangling` to nothing, removed
+    /// when it drops.
+    #[cfg(unix)]
+    struct LinkTree(std::path::PathBuf);
+
+    #[cfg(unix)]
+    impl LinkTree {
+        fn new(name: &str) -> Self {
+            let path =
+                std::env::temp_dir().join(format!("kobako-overlay-{name}-{}", std::process::id()));
+            let _ = std::fs::remove_dir_all(&path);
+            std::fs::create_dir_all(path.join("dir")).expect("the host directory must be created");
+            std::fs::write(path.join("target"), "lower").expect("the host file must be written");
+            std::fs::write(path.join("dir/inner"), "lower").expect("the host file must be written");
+            for (target, link) in [
+                ("target", "link"),
+                ("dir", "dirlink"),
+                ("missing", "dangling"),
+            ] {
+                std::os::unix::fs::symlink(target, path.join(link)).expect("the link must be made");
+            }
+            Self(path)
+        }
+
+        /// An empty upper over the host directory as the lower Layer.
+        fn overlay(&self) -> KernPath {
+            self.under(Arc::new(Tmpfs::new()))
+        }
+
+        /// The host directory as the lower Layer beneath `upper`.
+        fn under(&self, upper: Arc<Tmpfs>) -> KernPath {
+            at(over(Arc::new(self.bind()), upper))
+        }
+
+        fn bind(&self) -> super::super::Bind {
+            super::super::Bind::new(&self.0).expect("the host directory must open")
+        }
+    }
+
+    // The upper Layer's `dirlink` is a directory and the lower one's a link,
+    // so only merging directory over directory keeps the lower link's
+    // target out of the view.
+    // @behavior FS-113
+    #[cfg(unix)]
+    #[test]
+    fn a_lower_layers_link_beneath_an_upper_directory_is_not_merged() {
+        let tree = LinkTree::new("not-merged");
+        let overlay = tree.under(tmpfs_with("upper/dirlink/.keep", ""));
+        overlay
+            .vfs_unlink("dirlink/.keep")
+            .expect("the seed must go");
+        assert_eq!(
+            (
+                kind(&overlay, "dirlink/inner"),
+                names(&overlay, "dirlink").len()
+            ),
+            (Err(FilesystemError::NotFound), 0),
+            "a name beneath a directory an upper Layer holds, where a lower Layer holds a link, \
+             through vfs_lstat and its listing must show nothing the link leads to"
+        );
+    }
+
+    #[cfg(unix)]
+    impl Drop for LinkTree {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    // The link stands in the Bind Layer beneath a Tmpfs one, so only
+    // the Overlay asking that Layer without following refuses it.
+    // @behavior FS-100
+    #[cfg(unix)]
+    #[test]
+    fn an_overlay_opens_no_link_as_a_directory_where_asked_not_to_follow() {
+        let host = LinkTree::new("nofollow");
+        let overlay = host.overlay();
+        assert_eq!(
+            (
+                overlay.open_dir("dirlink").map(drop),
+                overlay.vfs_readlink("dirlink")
+            ),
+            (Err(FilesystemError::FilesystemLoop), Ok("dir".to_string())),
+            "a link a Bind Layer holds, opened through Overlay::open_dir, must be a \
+             link loop, and through vfs_readlink must answer where it points"
+        );
+    }
+
+    // @behavior FS-049
+    #[cfg(unix)]
+    #[test]
+    fn an_overlay_reports_a_link_its_layer_holds_as_a_link() {
+        let host = LinkTree::new("lstat");
+        let overlay = host.overlay();
+        let file_type = |path| kind(&overlay, path);
+        assert_eq!(
+            (file_type("link"), file_type("dangling")),
+            (Ok(FileType::Symlink), Ok(FileType::Symlink)),
+            "a link a Bind Layer holds, pointing at a file or at nothing, looked up through \
+             vfs_lstat must be reported as a link"
+        );
+    }
+
+    // A link to a directory follows to one, and a dangling link follows to
+    // nothing, so only judging each link itself lets both go.
+    // @behavior FS-050
+    #[cfg(unix)]
+    #[test]
+    fn an_overlay_removes_a_link_its_read_only_layer_holds_as_itself() {
+        let host = LinkTree::new("unlink");
+        let overlay = host.overlay();
+        let removed = (
+            overlay.vfs_rmdir("dirlink"),
+            overlay.vfs_unlink("dirlink"),
+            overlay.vfs_unlink("dangling"),
+        );
+        let gone = |path| overlay.vfs_lstat(path).err();
+        assert_eq!(
+            (
+                removed,
+                gone("dirlink"),
+                gone("dangling"),
+                host.0.join("dirlink").is_symlink()
+            ),
+            (
+                (Err(FilesystemError::NotADirectory), Ok(()), Ok(())),
+                Some(FilesystemError::NotFound),
+                Some(FilesystemError::NotFound),
+                true
+            ),
+            "a link a read-only Bind Layer holds, removed through vfs_rmdir and \
+             vfs_unlink, must be refused as no directory and then removed as itself, \
+             leaving the Layer as it was"
+        );
+    }
+
+    // A write would copy the FIFO up, which opens it, and a rename would
+    // move what no Layer above can hold, so only refusals keep either
+    // from waiting on a peer or landing nothing.
+    // @behavior FS-092
+    #[cfg(unix)]
+    #[test]
+    fn an_overlay_neither_copies_up_nor_moves_a_fifo_below_it() {
+        let host = LinkTree::new("fifo");
+        let made = std::process::Command::new("mkfifo")
+            .arg(host.0.join("pipe"))
+            .status()
+            .expect("mkfifo must run");
+        assert!(made.success(), "the FIFO must be made");
+        let overlay = host.overlay();
+        assert_eq!(
+            (
+                write(&overlay, "pipe", b"upper"),
+                overlay.rename("pipe", &overlay, "moved")
+            ),
+            (
+                Err(FilesystemError::PermissionDenied),
+                Err(FilesystemError::CrossesDevices)
+            ),
+            "a FIFO a read-only Bind Layer holds, written or renamed through an Overlay, must \
+             be refused as permission denied and as crossing devices"
+        );
+    }
+
+    // A FIFO is no directory, so each rename meets a kind it cannot
+    // replace; were it taken for neither, the directory made above would
+    // hide the FIFO, and the FIFO's rename would answer for its Layer.
+    // @behavior FS-095
+    #[cfg(unix)]
+    #[test]
+    fn an_overlay_replaces_neither_a_fifo_nor_a_directory_with_the_other() {
+        let host = LinkTree::new("fifo-kinds");
+        let made = std::process::Command::new("mkfifo")
+            .arg(host.0.join("pipe"))
+            .status()
+            .expect("mkfifo must run");
+        assert!(made.success(), "the FIFO must be made");
+        let overlay = host.overlay();
+        overlay
+            .vfs_mkdir("made")
+            .expect("a directory must be made in the upper");
+        let file_type = |path| kind(&overlay, path);
+        assert_eq!(
+            (
+                overlay.rename("pipe", &overlay, "dir"),
+                overlay.rename("made", &overlay, "pipe"),
+                file_type("pipe"),
+                file_type("made"),
+            ),
+            (
+                Err(FilesystemError::IsADirectory),
+                Err(FilesystemError::NotADirectory),
+                Ok(FileType::Fifo),
+                Ok(FileType::Dir)
+            ),
+            "a FIFO renamed onto a directory through an Overlay must be refused as a directory, \
+             and a directory renamed onto a FIFO as no directory, leaving both in place"
+        );
+    }
+
+    /// A lower Layer whose one file, `file`, would keep any time it is asked
+    /// to, recording that it was.
+    struct KeepsTimes(Arc<AtomicUsize>);
+
+    impl FileSystemType for KeepsTimes {
+        fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+            sb.d_make_root(Inode::new(&Kstat::new(FileType::Dir, 0), self));
+            Ok(())
+        }
+    }
+
+    impl InodeOperations for KeepsTimes {
+        fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+            Ok(match dentry.name().as_str() {
+                "file" => Kstat::new(FileType::RegFile, 0).with_identity(1, 2),
+                _ => Kstat::new(FileType::Dir, 0).with_identity(1, 1),
+            })
+        }
+
+        fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+            Ok(match dentry.name().as_str() {
+                "file" => Lookup::Found(Inode::new(
+                    &Kstat::new(FileType::RegFile, 0).with_identity(1, 2),
+                    Arc::new(Self(self.0.clone())),
+                )),
+                _ => Lookup::Absent,
+            })
+        }
+
+        fn setattr(&self, _dentry: &Dentry, _attr: &Iattr) -> Result<(), FilesystemError> {
+            self.0.fetch_add(1, Ordering::SeqCst);
+            Ok(())
+        }
+
+        fn open(
+            &self,
+            _dentry: &Dentry,
+            _how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            struct Empty;
+            impl FileOperations for Empty {
+                fn read_iter(
+                    &mut self,
+                    _iocb: &mut Kiocb,
+                    _buf: &mut [u8],
+                ) -> Result<usize, FilesystemError> {
+                    Ok(0)
+                }
+            }
+            Ok(Box::new(Empty))
+        }
+    }
+
+    // A lower Layer that would keep the time shows the call stopped at the upper.
+    // @behavior FS-147
+    #[test]
+    fn a_time_set_through_an_overlay_leaves_its_lower_layer_as_it_was() {
+        let asked = Arc::new(AtomicUsize::new(0));
+        let upper = Arc::new(Tmpfs::new());
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(KeepsTimes(asked.clone())))
+                .expect("the instance must stand")],
+            Some(Filesystem::new(upper.clone()).expect("the instance must stand")),
+        )
+        .unwrap_or_else(|_| panic!("the Overlay must make"));
+        let mount = crate::mount::Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            crate::mount::Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let answer = crate::vfs::do_utimes_path(
+            &Arc::default(),
+            &crate::vfs::Path::root(mount.mnt()),
+            "file",
+            false,
+            &Iattr::times(None, Some(crate::filesystem::SetTime::Now)),
+        );
+        assert_eq!(
+            (
+                answer,
+                asked.load(Ordering::SeqCst),
+                kern_path(upper).vfs_lstat("upper/file").is_ok()
+            ),
+            (Ok(()), 0, true),
+            "vfs::do_utimes_paththrough an Overlay on a file of its lower Layer must copy the file \
+             up, set the time there, and never ask the lower Layer"
+        );
+    }
+
+    // A recursive climb needs more than this stack at this depth, in a build
+    // of any optimization, so only a loop passes.
+    // @behavior FS-146
+    #[test]
+    fn a_change_copies_up_however_deep_it_lands() {
+        let deep = vec!["a"; 1500].join("/");
+        let lower: Tmpfs = [(format!("{deep}/file"), "x")].into_iter().collect();
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .unwrap_or_else(|_| panic!("the Overlay must make"));
+        let made = std::thread::Builder::new()
+            .stack_size(256 * 1024)
+            .spawn(move || {
+                let view = kern_path(Arc::new(overlay));
+                view.vfs_mkdir(&format!("{deep}/made"))?;
+                view.vfs_lstat(&format!("{deep}/made"))
+                    .map(|found| found.file_type)
+            })
+            .expect("the thread must start")
+            .join()
+            .expect("the thread must not panic");
+        assert_eq!(
+            made,
+            Ok(FileType::Dir),
+            "a directory made 1500 directories deep in a lower Layer, through an Overlay on a \
+             256 KiB stack, must copy every directory above it up and stand"
+        );
+    }
+
+    // The upper is a Tmpfs, which holds no link, so a link cannot land there.
+    // @behavior FS-051
+    #[cfg(unix)]
+    #[test]
+    fn an_overlay_refuses_to_move_a_link_its_read_only_layer_holds() {
+        let host = LinkTree::new("through");
+        let overlay = host.overlay();
+        assert_eq!(
+            (
+                overlay.rename("link", &overlay, "moved"),
+                read(&overlay, "target")
+            ),
+            (Err(FilesystemError::CrossesDevices), b"lower".to_vec()),
+            "a rename of a link a read-only Bind Layer holds, through an Overlay, must be refused \
+             as crossing devices and leave the target as it was"
+        );
+    }
+
+    // The lower Tmpfs holds a readable `dangling`, so only the upper
+    // link standing at that path can keep the read from reaching it.
+    // @behavior FS-053
+    #[cfg(unix)]
+    #[test]
+    fn a_link_a_layer_holds_hides_what_the_layers_below_hold_there() {
+        let host = LinkTree::new("shadow");
+        let overlay = at(lowers(
+            Arc::new(host.bind()),
+            tmpfs_with("dangling", "lower"),
+        ));
+        assert_eq!(
+            overlay
+                .open(
+                    "dangling",
+                    &OpenHow {
+                        read: true,
+                        ..OpenHow::default()
+                    }
+                )
+                .map(drop),
+            Err(FilesystemError::FilesystemLoop),
+            "a lower file beneath a dangling link a higher Bind Layer holds at its path, \
+             opened through Overlay::open, must be refused as the link, the file unreached"
+        );
+    }
+
+    // The lower Tmpfs holds `dirlink/x` beside where the upper link points,
+    // so only the link hiding everything beneath it keeps `x` out.
+    // @behavior FS-057
+    #[cfg(unix)]
+    #[test]
+    fn a_link_a_layer_holds_hides_what_the_layers_below_hold_beneath_it() {
+        let host = LinkTree::new("shadow-beneath");
+        let overlay = at(lowers(
+            Arc::new(host.bind()),
+            tmpfs_with("dirlink/x", "lower"),
+        ));
+        assert_eq!(
+            (
+                overlay
+                    .vfs_lstat("dirlink")
+                    .map(|metadata| metadata.file_type),
+                overlay.open_dir("dirlink").map(drop)
+            ),
+            (Ok(FileType::Symlink), Err(FilesystemError::FilesystemLoop)),
+            "a directory a higher Bind Layer holds as a link, looked up and opened through an \
+             Overlay, must stand as the link, so none of a lower Layer's entries beneath it show"
+        );
+    }
+
+    // The lower directory stays in its Layer, so only the whiteout keeps
+    // it from showing once the upper file goes.
+    // @behavior FS-058
+    #[test]
+    fn removing_a_file_over_a_lower_directory_leaves_it_hidden() {
+        let lower = tmpfs_with("f/g", "lower");
+        let overlay = at(over(lower.clone(), tmpfs_with("upper/f", "upper")));
+        let removed = overlay.vfs_unlink("f");
+        assert_eq!(
+            (
+                removed,
+                overlay.vfs_lstat("f").err(),
+                on(&lower).vfs_lstat("f/g").is_ok()
+            ),
+            (Ok(()), Some(FilesystemError::NotFound), true),
+            "a file a higher Layer holds over a lower Layer's directory, removed through \
+             vfs_unlink, must leave the path gone from the view and the lower \
+             directory as it was"
+        );
+    }
+
+    // The upper's `dir` holds only the whiteout hiding `file`, so
+    // only judging the view, not that copy, lets the move go.
+    // @behavior FS-059
+    #[test]
+    fn a_directory_moves_onto_one_holding_only_markers() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        overlay
+            .vfs_mkdir("new")
+            .expect("the directory must be made");
+        overwrite(&overlay, "new/made", b"made");
+        let moved = overlay.rename("new", &overlay, "dir");
+        assert_eq!(
+            (moved, names(&overlay, "dir")),
+            (Ok(()), vec!["made".to_string()]),
+            "a directory renamed through Overlay::rename onto one the view shows empty, whose \
+             upper copy holds only a whiteout, must take its place and show only its own entries"
+        );
+    }
+
+    // The directory made again is marked opaque in the upper, so only that
+    // mark tells it apart from one the lower Layer still holds.
+    // @behavior FS-060
+    #[test]
+    fn a_directory_made_again_moves_as_the_uppers_own() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        overlay
+            .vfs_rmdir("dir")
+            .expect("the directory must be removed");
+        overlay
+            .vfs_mkdir("dir")
+            .expect("the directory must be made again");
+        let moved = overlay.rename("dir", &overlay, "moved");
+        assert_eq!(
+            (
+                moved,
+                overlay.vfs_lstat("dir").err(),
+                overlay
+                    .open_dir("moved")
+                    .and_then(|dir| dir.iterate_dir())
+                    .map(|entries| entries.len())
+            ),
+            (Ok(()), Some(FilesystemError::NotFound), Ok(0)),
+            "a directory made again through an Overlay where a lower Layer's one was removed, \
+             renamed through Overlay::rename, must move and leave nothing of the lower one behind"
+        );
+    }
+
+    // @behavior FS-061
+    #[test]
+    fn an_overlay_refuses_a_file_moved_beneath_itself_as_no_directory() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        assert_eq!(
+            overlay.rename("dir/file", &overlay, "dir/file/x"),
+            Err(FilesystemError::NotADirectory),
+            "a file renamed through Overlay::rename to a path beneath itself must be refused as \
+             no directory, as rename(2) refuses it"
+        );
+    }
+
+    // The link points at nothing, so only the link itself can be what an
+    // exclusive create or a new directory finds there.
+    // @behavior FS-052
+    #[cfg(unix)]
+    #[test]
+    fn an_overlay_finds_a_dangling_link_where_a_new_entry_would_go() {
+        let host = LinkTree::new("dangling");
+        let overlay = host.overlay();
+        let exclusive = OpenHow {
+            write: true,
+            ..OpenHow::default()
+        };
+        assert_eq!(
+            (
+                overlay.create("dangling", &exclusive).map(drop),
+                overlay.vfs_mkdir("dangling")
+            ),
+            (
+                Err(FilesystemError::AlreadyExists),
+                Err(FilesystemError::AlreadyExists)
+            ),
+            "an exclusive create and a create_dir at a dangling link a lower Bind Layer \
+             holds, through an Overlay, must find it already there"
+        );
+    }
+
+    // @behavior FS-008
+    #[test]
+    fn an_overlay_reads_through_to_a_lower_layer() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        assert_eq!(
+            read(&overlay, "dir/file"),
+            b"lower",
+            "a lower file read through Overlay::open must read back the lower content"
+        );
+    }
+
+    // @behavior FS-009
+    #[test]
+    fn a_write_to_a_lower_layers_file_lands_in_the_upper() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, _) = overlay_on(upper.clone());
+        overwrite(&overlay, "dir/file", b"upper");
+        assert_eq!(
+            read(&on(&upper), "upper/dir/file"),
+            b"upper",
+            "a lower Layer's file written through Overlay::open must land in the upper"
+        );
+    }
+
+    // @behavior FS-010
+    #[test]
+    fn an_overlay_leaves_a_lower_layer_as_it_was() {
+        let (overlay, lower) = overlay_on(Arc::new(Tmpfs::new()));
+        overwrite(&overlay, "dir/file", b"upper");
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        assert_eq!(
+            read(&on(&lower), "dir/file"),
+            b"lower",
+            "a lower Layer's file written and removed through an Overlay must stay as it was"
+        );
+    }
+
+    // @behavior FS-011
+    #[test]
+    fn a_file_removed_through_an_overlay_is_gone_from_its_view() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        assert_eq!(
+            overlay.vfs_lstat("dir/file"),
+            Err(FilesystemError::NotFound),
+            "a lower file removed through vfs_unlink must no longer be found there"
+        );
+    }
+
+    // @behavior FS-013
+    #[test]
+    fn an_upper_layer_hides_the_same_path_in_a_lower_one() {
+        let overlay = at(lowers(
+            tmpfs_with("note", "upper"),
+            tmpfs_with("note", "lower"),
+        ));
+        assert_eq!(
+            read(&overlay, "note"),
+            b"upper",
+            "a path both Layers hold read through Overlay::open must read the upper Layer's content"
+        );
+    }
+
+    // @behavior FS-014
+    #[test]
+    fn a_write_to_the_uppers_file_changes_it_in_place() {
+        let upper = tmpfs_with("upper/note", "upper");
+        let overlay = at(over(tmpfs_with("note", "lower"), upper.clone()));
+        overwrite(&overlay, "note", b"changed");
+        assert_eq!(
+            read(&on(&upper), "upper/note"),
+            b"changed",
+            "the upper's file written through Overlay::open must change in place"
+        );
+    }
+
+    // @behavior FS-015
+    #[test]
+    fn a_new_file_lands_in_the_upper() {
+        let upper = Arc::new(Tmpfs::new());
+        let lower = Arc::new(Tmpfs::new());
+        let overlay = at(over(lower.clone(), upper.clone()));
+        overwrite(&overlay, "new", b"made");
+        assert_eq!(
+            (read(&on(&upper), "upper/new"), on(&lower).vfs_lstat("new")),
+            (b"made".to_vec(), Err(FilesystemError::NotFound)),
+            "a file created through Overlay::open must land in the upper alone"
+        );
+    }
+
+    // @behavior FS-016
+    #[test]
+    fn a_removal_leaves_a_whiteout_in_the_upper() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, _) = overlay_on(upper.clone());
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        assert_eq!(
+            on(&upper)
+                .vfs_lstat("upper/dir/file")
+                .map(|metadata| metadata.file_type),
+            Ok(FileType::Chrdev),
+            "a lower Layer's file removed through vfs_unlink must leave a whiteout, a \
+             device of no kind the guest opens, at its name in the upper"
+        );
+    }
+
+    // The Layer changes behind the view between the lookup and the listing, so
+    // only Layers bound as the name is found keep the directory it found, as
+    // they cannot be taken for another one by a move in that window.
+    // @behavior FS-165
+    #[test]
+    fn a_directory_found_stands_for_the_layers_it_was_found_in() {
+        use crate::vfs::lookup_one_unlocked;
+        let lower = Arc::new([("dir/old", "x")].into_iter().collect::<Tmpfs>());
+        let overlay = Arc::new(over(lower.clone(), Arc::new(Tmpfs::new())));
+        let filesystem = Filesystem::new(overlay.clone()).expect("the instance must stand");
+        let root = filesystem.s_root();
+        let dir = lookup_one_unlocked(&Default::default(), &filesystem, &root, "dir")
+            .expect("the directory must be found");
+        let layer = on(&lower);
+        layer
+            .rename("dir", &layer, "moved")
+            .expect("the Layer's directory must move");
+        layer.vfs_mkdir("dir").expect("another must be made");
+        overwrite(&layer, "dir/new", b"y");
+        let names: Vec<String> = overlay
+            .fs
+            .dir_read_merged(
+                &overlay
+                    .fs
+                    .dir(&dir)
+                    .expect("the directory must stand")
+                    .level(),
+            )
+            .expect("the directory must list")
+            .into_iter()
+            .map(|entry| entry.name)
+            .collect();
+        assert_eq!(
+            names,
+            ["old"],
+            "OverlayFs::dir_read_merged of a directory OverlayFs found before its Layer changed must list \
+             the Layer's directory found with it"
+        );
+    }
+
+    // What fails after the exchange only a second writer's use of the inodes
+    // can force, so the exchange is called alone: the next walk must find the
+    // empty directory rather than the dentry whose upper no longer matches.
+    // @behavior FS-164
+    #[test]
+    fn a_directory_emptied_for_its_removal_stays_empty_should_the_removal_fail() {
+        use crate::vfs::{lookup_one_unlocked, vfs_unlink};
+        let lower = Arc::new([("dir/file", "x")].into_iter().collect::<Tmpfs>());
+        let overlay = Arc::new(over(lower, Arc::new(Tmpfs::new())));
+        let filesystem = Filesystem::new(overlay.clone()).expect("the instance must stand");
+        let root = filesystem.s_root();
+        let dir = lookup_one_unlocked(&Default::default(), &filesystem, &root, "dir")
+            .expect("the directory must be found");
+        let file = lookup_one_unlocked(&Default::default(), &filesystem, &dir, "file")
+            .expect("the file must be found");
+        vfs_unlink(&Default::default(), &filesystem, &dir, &file)
+            .expect("the file must be removed");
+        let upper_root = overlay.fs.dir(&root).expect("the root must stand").level()[0]
+            .clone()
+            .expect("the upper shows the root");
+        overlay
+            .fs
+            .clear_empty(&upper_root, "dir")
+            .expect("the directory must be exchanged");
+        let walked = lookup_one_unlocked(&Default::default(), &filesystem, &root, "dir")
+            .expect("the directory must be found again");
+        let names = overlay.fs.dir_read_merged(
+            &overlay
+                .fs
+                .dir(&walked)
+                .expect("the directory must stand")
+                .level(),
+        );
+        assert_eq!(
+            names.map(|entries| entries.len()),
+            Ok(0),
+            "OverlayFs::dir_read_merged of a directory found by a walk after OverlayFs::clear_empty \
+             replaced it must show nothing of the lower Layer below it"
+        );
+    }
+
+    // @behavior FS-017
+    #[test]
+    fn a_whiteout_lasts_as_long_as_the_upper() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, lower) = overlay_on(upper.clone());
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        let rebuilt = at(over(lower, upper));
+        assert_eq!(
+            rebuilt.vfs_lstat("dir/file"),
+            Err(FilesystemError::NotFound),
+            "a lower file removed through an Overlay over a Tmpfs must stay gone from a new Overlay over the same Layers"
+        );
+    }
+
+    // @behavior FS-018
+    #[test]
+    fn a_directory_made_again_where_one_was_removed_shows_nothing_from_below() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        overlay
+            .vfs_rmdir("dir")
+            .expect("the directory must be removed");
+        overlay
+            .vfs_mkdir("dir")
+            .expect("the directory must be made");
+        assert_eq!(
+            names(&overlay, "dir"),
+            Vec::<String>::new(),
+            "a directory made again through vfs_mkdir must list nothing from the lower Layer"
+        );
+    }
+
+    // @behavior FS-019
+    #[test]
+    fn an_overlay_lists_none_of_its_markers() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        overwrite(&overlay, "dir/new", b"made");
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        assert_eq!(
+            names(&overlay, "dir"),
+            ["new"],
+            "a directory holding a whiteout listed through Overlay::read_dir must not list the \
+             whited-out name"
+        );
+    }
+
+    // Linux's `ovl_rename` answers ESTALE once the upper moved beneath it; the
+    // view is undefined here, so the promise is only that the call answers,
+    // and the bound turns a hang into a failure.
+    // @behavior FS-204
+    #[test]
+    fn an_upper_changed_beside_its_overlay_still_answers() {
+        use crate::vfs;
+        let (overlay, upper) = beside_its_upper(
+            [("upper/a/x", "x"), ("upper/a/k", "k")]
+                .into_iter()
+                .collect(),
+        );
+        let cred = Arc::default();
+        vfs::vfs_fstatat(&cred, &overlay, "a/x", false).expect("a/x must stand");
+        vfs::filename_renameat2(&cred, &upper, "upper/a", &upper, "upper/b")
+            .expect("the upper's directory must move");
+        let answered = crate::sched::testing::within_max_wait(|| {
+            vfs::filename_renameat2(&cred, &overlay, "a/x", &overlay, "a/y").err()
+        });
+        assert_ne!(
+            answered,
+            Some(FilesystemError::Interrupted),
+            "vfs::filename_renameat2 through an Overlay whose upper another Mount changed must \
+             answer within its bound"
+        );
+    }
+
+    // The lower Layer is a Tmpfs seen through a wrapper, so it reports the
+    // device a whiteout is, yet is no Tmpfs whose marks the Overlay reads.
+    // @behavior FS-203
+    #[test]
+    fn an_overlay_reads_a_whiteout_only_from_a_tmpfs() {
+        let tmpfs = Tmpfs::new();
+        tmpfs.whiteout("device").expect("the device must be made");
+        let lower = Wrap::new(Arc::new(tmpfs), Arc::new(CountsLookups::default()));
+        let overlay = at(over(Arc::new(lower), Arc::new(Tmpfs::new())));
+        assert_eq!(
+            (
+                names(&overlay, ""),
+                overlay.vfs_lstat("device").map(|found| found.file_type)
+            ),
+            (vec!["device".to_string()], Ok(FileType::Chrdev)),
+            "a character device in a lower Layer that is no Tmpfs, listed and stated through an \
+             Overlay, must be listed and found rather than read as a whiteout"
+        );
+    }
+
+    // A whiteout is a device rather than a name, so no name is the
+    // Overlay's to reserve.
+    // @behavior FS-020
+    #[test]
+    fn a_name_starting_with_wh_is_an_ordinary_name() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        overwrite(&overlay, "dir/.wh.file", b"made");
+        assert_eq!(
+            (read(&overlay, "dir/.wh.file"), read(&overlay, "dir/file")),
+            (b"made".to_vec(), b"lower".to_vec()),
+            "a file named .wh.file created through Overlay::open must be made, and must hide \
+             nothing"
+        );
+    }
+
+    /// An Overlay of two lower Layers and no upper on a Mount allowing writes,
+    /// and the root of that Mount.
+    fn mounted_with_no_upper() -> (crate::mount::Mount, crate::vfs::Path) {
+        let overlay = lowers(tmpfs_with("dir/file", "lower"), Arc::new(Tmpfs::new()));
+        let mount = crate::mount::Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            crate::mount::Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = crate::vfs::Path::root(mount.mnt());
+        (mount, root)
+    }
+
+    // @behavior FS-021
+    #[test]
+    fn an_overlay_with_no_upper_refuses_every_change_as_read_only() {
+        let (mount, root) = mounted_with_no_upper();
+        let how = crate::vfs::OpenHow {
+            write: true,
+            ..Default::default()
+        };
+        let written = crate::vfs::kern_path::filp_open(&Arc::default(), &root, "dir/file", &how);
+        assert_eq!(
+            (written.err(), mount.mnt().is_readonly()),
+            (Some(FilesystemError::ReadOnlyFilesystem), true),
+            "a file opened to write through an Overlay with no upper on a read-write Mount must \
+             be refused as read-only"
+        );
+    }
+
+    /// A Layer holding a name past what it can hold, as a Layer on a host with
+    /// a shorter limit answers one.
+    struct RefusesLongName;
+
+    impl crate::filesystem::wrap::Hook for RefusesLongName {
+        fn lookup(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+        ) -> Result<Lookup, FilesystemError> {
+            match dentry.name().as_str() {
+                "long" => Err(FilesystemError::InvalidFilename),
+                _ => inner.lookup(dentry),
+            }
+        }
+    }
+
+    // `ovl_lookup_single` moves on from ENAMETOOLONG, so a name one Layer cannot
+    // hold is only absent there, and the upper takes it.
+    // @behavior FS-174
+    #[test]
+    fn a_name_too_long_for_a_lower_layer_lands_in_the_upper() {
+        let lower =
+            crate::filesystem::wrap::Wrap::new(Arc::new(Tmpfs::new()), Arc::new(RefusesLongName));
+        let upper = Arc::new(Tmpfs::new());
+        let overlay = at(over(Arc::new(lower), upper.clone()));
+        assert_eq!(
+            (
+                overlay.vfs_mkdir("long"),
+                on(&upper)
+                    .vfs_lstat("upper/long")
+                    .map(|found| found.file_type)
+            ),
+            (Ok(()), Ok(FileType::Dir)),
+            "a directory made through an Overlay at a name a lower Layer answers ENAMETOOLONG for \
+             must land in the upper"
+        );
+    }
+
+    // Replacing the target needs an inode only where it holds whiteouts to clear
+    // away, so with none left only a rename leaving an empty one alone lands.
+    // @behavior FS-175
+    #[test]
+    fn a_rename_onto_an_empty_upper_directory_builds_no_replacement() {
+        let upper = Arc::new(Tmpfs::new().with_nr_inodes(Some(5)));
+        let lower: Tmpfs = [("base", "x")].into_iter().collect();
+        let overlay = at(over(Arc::new(lower), upper));
+        overlay.vfs_mkdir("from").expect("the source must be made");
+        overlay.vfs_mkdir("to").expect("the target must be made");
+        assert_eq!(
+            overlay.rename("from", &overlay, "to"),
+            Ok(()),
+            "a rename through an Overlay of an upper directory onto an empty upper directory, with \
+             no inode left in the upper, must land, as ovl_rename_upper clears only what holds \
+             whiteouts"
+        );
+    }
+
+    // overlayfs's `ovl_path_lower` is the topmost lower layer, and its stat of a
+    // merged directory is the real one's, so a Layer's entries change the size.
+    // @behavior FS-176
+    #[test]
+    fn a_merged_directory_reports_its_topmost_layer_under_the_lowers_identity() {
+        let lower: Arc<Tmpfs> = Arc::new([("dir/a", "x"), ("dir/b", "x")].into_iter().collect());
+        let upper = Arc::new(Tmpfs::new());
+        let overlay = at(over(lower.clone(), upper));
+        overlay
+            .vfs_mkdir("dir/made")
+            .expect("the directory must be made");
+        let found = overlay.vfs_lstat("dir").expect("the directory must stand");
+        let below = on(&lower)
+            .vfs_lstat("dir")
+            .expect("the directory must stand");
+        assert_eq!(
+            (found.ino, found.dev, found.nlink, found.size),
+            (below.ino, below.dev, 1, 3 * 20),
+            "a directory two Layers show, stated through an Overlay, must report the lower \
+             Layer's identity, one name, and the size of the upper's directory holding one entry"
+        );
+    }
+
+    // Bind reports the same identity for both names, so without the view keeping
+    // them apart the VFS would answer the move as having nothing to do.
+    // @behavior FS-170
+    #[cfg(unix)]
+    #[test]
+    fn a_lower_layers_hard_link_moves_onto_the_other_as_two_entries() {
+        let host = LinkTree::new("hard-link");
+        std::fs::write(host.0.join("a"), "one").expect("the host file must be written");
+        std::fs::hard_link(host.0.join("a"), host.0.join("b")).expect("the host link must be made");
+        let overlay = at(over(Arc::new(host.bind()), Arc::new(Tmpfs::new())));
+        write(&overlay, "a", b"two").expect("the file must copy up and be written");
+        overlay
+            .rename("a", &overlay, "b")
+            .expect("the move must land");
+        assert_eq!(
+            (
+                overlay.vfs_lstat("a").map(drop),
+                read(&overlay, "b"),
+                std::fs::read(host.0.join("b")).expect("the host file must be read"),
+            ),
+            (
+                Err(FilesystemError::NotFound),
+                b"two".to_vec(),
+                b"one".to_vec()
+            ),
+            "a hard link in a lower Layer written and moved onto its other name through an \
+             Overlay must leave only the new name, holding what was written, and the lower Layer \
+             as it was"
+        );
+    }
+
+    // overlayfs's super block is read-only with no upper, so `mnt_want_write`
+    // answers before anything looks at what stands at the name.
+    // @behavior FS-169
+    #[test]
+    fn an_overlay_with_no_upper_refuses_a_change_before_what_stands_answers() {
+        use crate::vfs::{filename_renameat2, filename_rmdir, filename_unlinkat};
+        let (_mount, root) = mounted_with_no_upper();
+        let cred = Arc::default();
+        let read_only = || Err(FilesystemError::ReadOnlyFilesystem);
+        assert_eq!(
+            (
+                filename_renameat2(&cred, &root, "dir/file", &root, "dir/file"),
+                filename_unlinkat(&cred, &root, "missing"),
+                filename_rmdir(&cred, &root, "dir"),
+            ),
+            (read_only(), read_only(), read_only()),
+            "a move onto its own name, a removal of nothing, and a removal of a directory holding \
+             an entry through an Overlay with no upper must each answer EROFS"
+        );
+    }
+
+    /// Why `Overlay::new` refuses `lower` under `upper`, or `None`.
+    fn refusal(
+        lower: Vec<Arc<dyn FileSystemType>>,
+        upper: Option<Arc<dyn FileSystemType>>,
+    ) -> Option<FilesystemError> {
+        let instance = |fs| Filesystem::new(fs).expect("the instance must stand");
+        Overlay::new(
+            lower.into_iter().map(instance).collect(),
+            upper.map(instance),
+        )
+        .err()
+    }
+
+    // gVisor takes only an upper that holds its markers, and only a
+    // Tmpfs does here.
+    // @behavior FS-123
+    #[test]
+    fn an_overlay_refuses_an_upper_that_is_no_tmpfs() {
+        let host = std::env::temp_dir();
+        let bind = super::super::Bind::new(&host).expect("the host directory must open");
+        assert_eq!(
+            refusal(vec![Arc::new(Tmpfs::new())], Some(Arc::new(bind))),
+            Some(FilesystemError::InvalidInput),
+            "Overlay::new with a Bind as its upper must be refused as invalid input"
+        );
+    }
+
+    // Nothing else tells these apart: every other rule holds of each list, and
+    // a view over them would show the upper's own workdir.
+    // @behavior FS-148
+    #[test]
+    fn an_overlay_refuses_one_instance_as_two_layers() {
+        let instance = || Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand");
+        let (shared, doubled) = (instance(), instance());
+        assert_eq!(
+            (
+                Overlay::new(vec![shared.clone()], Some(shared)).err(),
+                Overlay::new(vec![doubled.clone(), doubled, instance()], None).err(),
+            ),
+            (
+                Some(FilesystemError::InvalidInput),
+                Some(FilesystemError::InvalidInput),
+            ),
+            "Overlay::new with one instance as its upper and a lower Layer, or as two lower \
+             Layers, must be refused as invalid input"
+        );
+    }
+
+    // @behavior FS-124
+    #[test]
+    fn an_overlay_without_an_upper_needs_two_lower_layers() {
+        assert_eq!(
+            refusal(vec![Arc::new(Tmpfs::new())], None),
+            Some(FilesystemError::InvalidInput),
+            "Overlay::new with one lower Layer and no upper must be refused as invalid input"
+        );
+    }
+
+    // Two Overlays deep is what Linux allows, so only a third is refused.
+    // @behavior FS-126
+    #[test]
+    fn an_overlay_stacks_at_most_two_deep() {
+        let first: Arc<dyn FileSystemType> =
+            Arc::new(lowers(Arc::new(Tmpfs::new()), Arc::new(Tmpfs::new())));
+        let second: Arc<dyn FileSystemType> = Arc::new(over(first.clone(), Arc::new(Tmpfs::new())));
+        assert_eq!(
+            (
+                refusal(vec![first], Some(Arc::new(Tmpfs::new()))),
+                refusal(vec![second], Some(Arc::new(Tmpfs::new())))
+            ),
+            (None, Some(FilesystemError::InvalidInput)),
+            "Overlay::new over an Overlay must make a view, and over an Overlay over an Overlay \
+             must be refused as invalid input"
+        );
+    }
+
+    // @behavior FS-127
+    #[test]
+    fn an_overlay_takes_at_most_five_hundred_lower_layers() {
+        let layers = |count: usize| -> Vec<Arc<dyn FileSystemType>> {
+            (0..count)
+                .map(|_| Arc::new(Tmpfs::new()) as Arc<dyn FileSystemType>)
+                .collect()
+        };
+        assert_eq!(
+            (refusal(layers(500), None), refusal(layers(501), None)),
+            (None, Some(FilesystemError::InvalidInput)),
+            "Overlay::new must take 500 lower Layers and refuse 501 as invalid input"
+        );
+    }
+
+    // @behavior FS-125
+    #[test]
+    fn an_overlay_needs_a_lower_layer() {
+        assert_eq!(
+            refusal(Vec::new(), Some(Arc::new(Tmpfs::new()))),
+            Some(FilesystemError::InvalidInput),
+            "Overlay::new with an upper and no lower Layer must be refused as invalid input"
+        );
+    }
+
+    #[test]
+    fn an_overlay_lists_every_layer_without_what_it_hid() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        overwrite(&overlay, "dir/new", b"made");
+        assert_eq!(names(&overlay, "dir"), ["file", "new"]);
+    }
+
+    #[test]
+    fn a_lower_file_renamed_through_an_overlay_moves_into_the_upper() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, lower) = overlay_on(upper.clone());
+        overlay
+            .rename("dir/file", &overlay, "dir/moved")
+            .expect("the file must move");
+        assert_eq!(
+            (
+                read(&overlay, "dir/moved"),
+                overlay.vfs_lstat("dir/file"),
+                read(&on(&lower), "dir/file"),
+            ),
+            (
+                b"lower".to_vec(),
+                Err(FilesystemError::NotFound),
+                b"lower".to_vec()
+            ),
+        );
+    }
+
+    /// Another call through the VFS at `overlay`, started once on a thread
+    /// of its own and given a while to finish, recording whether it did
+    /// before the call starting it went on.
+    #[derive(Default)]
+    struct Interleave {
+        overlay: Mutex<Option<crate::vfs::Path>>,
+        finished_inside: Mutex<Option<bool>>,
+        other: Mutex<Option<thread::JoinHandle<()>>>,
+    }
+
+    impl Interleave {
+        fn start(&self) {
+            let Some(overlay) = self.overlay.lock().unwrap().take() else {
+                return;
+            };
+            let finished = Arc::new(AtomicUsize::new(0));
+            let marker = finished.clone();
+            let handle = thread::spawn(move || {
+                let how = crate::vfs::OpenHow {
+                    write: true,
+                    create: true,
+                    ..crate::vfs::OpenHow::default()
+                };
+                let _ =
+                    crate::vfs::kern_path::filp_open(&Arc::default(), &overlay, "dir/new", &how);
+                marker.store(1, Ordering::SeqCst);
+            });
+            let deadline = Instant::now() + Duration::from_millis(200);
+            while finished.load(Ordering::SeqCst) == 0 && Instant::now() < deadline {
+                thread::sleep(Duration::from_millis(5));
+            }
+            *self.finished_inside.lock().unwrap() = Some(finished.load(Ordering::SeqCst) == 1);
+            *self.other.lock().unwrap() = Some(handle);
+        }
+    }
+
+    /// A Tmpfs whose directory beneath its root starts `Interleave` the first
+    /// time one is listed, as a removal's emptiness check lists it.
+    impl Hook for Interleave {
+        fn open(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+            how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            if dentry.kind() == Ok(FileType::Dir) && !dentry.is_root() {
+                self.start();
+            }
+            inner.open(dentry, how)
+        }
+    }
+
+    // The other call starts inside this one, between its emptiness check
+    // and its removal, so only the Overlay's lock keeps the file it
+    // creates from being removed with the directory.
+    // @behavior FS-037
+    #[test]
+    fn a_change_through_an_overlay_waits_for_the_one_in_progress() {
+        let tmpfs = tmpfs_with("dir/.keep", "");
+        let interleave = Arc::new(Interleave::default());
+        on(&tmpfs)
+            .vfs_unlink("dir/.keep")
+            .expect("the seed must go");
+        let mount = crate::mount::Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(over(
+                Arc::new(Wrap::new(tmpfs, interleave.clone())),
+                Arc::new(Tmpfs::new()),
+            )))
+            .expect("the instance must stand"),
+            crate::mount::Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = crate::vfs::Path::root(mount.mnt());
+        *interleave.overlay.lock().unwrap() = Some(root.clone());
+        let removed = crate::vfs::filename_rmdir(&Arc::default(), &root, "dir").is_ok();
+        let other = interleave
+            .other
+            .lock()
+            .unwrap()
+            .take()
+            .expect("the other call must have started");
+        crate::sched::testing::join("the other call", other);
+        assert_eq!(
+            (
+                removed,
+                *interleave.finished_inside.lock().unwrap(),
+                crate::vfs::vfs_fstatat(&Arc::default(), &root, "dir/new", false).is_ok()
+            ),
+            (true, Some(false), false),
+            "a create through vfs::do_file_open into an Overlay directory vfs::filename_rmdir is removing must \
+             wait for it, failing rather than landing in the directory being removed"
+        );
+    }
+
+    // @behavior FS-038
+    #[test]
+    fn a_change_through_an_overlay_from_inside_one_answers_a_deadlock() {
+        type Answers = (bool, Result<(), FilesystemError>);
+
+        struct Reenters {
+            overlay: Mutex<Option<crate::vfs::Path>>,
+            answer: Mutex<Option<Answers>>,
+        }
+
+        impl Hook for Reenters {
+            fn getattr(
+                &self,
+                inner: &dyn InodeOperations,
+                dentry: &Dentry,
+            ) -> Result<Kstat, FilesystemError> {
+                let reentering = self.overlay.lock().unwrap().take();
+                if let Some(overlay) = reentering {
+                    *self.answer.lock().unwrap() = Some((
+                        crate::vfs::vfs_fstatat(&Arc::default(), &overlay, &dentry.name(), false)
+                            .is_ok(),
+                        crate::vfs::filename_mkdirat(&Arc::default(), &overlay, "made"),
+                    ));
+                }
+                inner.getattr(dentry)
+            }
+        }
+
+        let layer = Arc::new(Reenters {
+            overlay: Mutex::new(None),
+            answer: Mutex::new(None),
+        });
+        let tmpfs: Tmpfs = [("note", "x")].into_iter().collect();
+        let mount = crate::mount::Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(over(
+                Arc::new(Wrap::new(Arc::new(tmpfs), layer.clone())),
+                Arc::new(Tmpfs::new()),
+            )))
+            .expect("the instance must stand"),
+            crate::mount::Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = crate::vfs::Path::root(mount.mnt());
+        *layer.overlay.lock().unwrap() = Some(root.clone());
+        crate::vfs::vfs_fstatat(&Arc::default(), &root, "note", false)
+            .expect("the outer call must answer");
+        let answers = layer.answer.lock().unwrap().take();
+        assert_eq!(
+            answers,
+            Some((true, Err(FilesystemError::Deadlock))),
+            "a read through an Overlay made from inside one of its own reads on the same thread \
+             must answer, and a change must answer Deadlock rather than wait forever"
+        );
+    }
+
+    /// An upper whose `upper` is seeded with `files`, with room for
+    /// `inodes` more than its root, `upper`, and `work` take, over a lower
+    /// Tmpfs holding `dir/file` = "lower".
+    fn full_over_lower(files: &[(&str, &str)], inodes: usize) -> (KernPath, Arc<Tmpfs>) {
+        let seeded = files
+            .iter()
+            .map(|(path, contents)| (format!("upper/{path}"), *contents));
+        let upper = Tmpfs::from_iter(seeded).with_nr_inodes(Some(inodes + 3));
+        let upper = Arc::new(upper);
+        (
+            at(over(tmpfs_with("dir/file", "lower"), upper.clone())),
+            upper,
+        )
+    }
+
+    // The upper copy is all the room there is, so the whiteout cannot be
+    // made; taking the copy away first would show the lower file again.
+    // @behavior FS-040
+    #[test]
+    fn a_removal_that_cannot_leave_its_whiteout_removes_nothing() {
+        let (overlay, _) = full_over_lower(&[("dir/file", "upper")], 2);
+        assert_eq!(
+            (overlay.vfs_unlink("dir/file"), read(&overlay, "dir/file")),
+            (Err(FilesystemError::StorageFull), b"upper".to_vec()),
+            "a file removed through vfs_unlink whose whiteout finds no room must stay as \
+             it was"
+        );
+    }
+
+    // The directory is built in the workdir before it replaces the
+    // whiteout, so a workdir with no room leaves the whiteout standing.
+    // @behavior FS-041
+    #[test]
+    fn a_directory_made_over_a_whiteout_without_room_is_not_made() {
+        let lower = Arc::new(Tmpfs::new());
+        on(&lower)
+            .vfs_mkdir("gone")
+            .expect("the directory must be made");
+        let upper = Arc::new(Tmpfs::new().with_nr_inodes(Some(4)));
+        let overlay = at(over(lower, upper));
+        overlay
+            .vfs_rmdir("gone")
+            .expect("the directory must be removed");
+        assert_eq!(
+            (overlay.vfs_mkdir("gone"), overlay.vfs_lstat("gone")),
+            (
+                Err(FilesystemError::StorageFull),
+                Err(FilesystemError::NotFound)
+            ),
+            "a directory made through vfs_mkdir over a whiteout, with no room left, \
+             must be refused as out of space and leave the name hidden"
+        );
+    }
+
+    // The copy up takes the last room, so the whiteout over the source
+    // cannot be made; moving first would leave the file in two places.
+    // @behavior FS-042
+    #[test]
+    fn a_rename_that_cannot_leave_its_whiteout_moves_nothing() {
+        let (overlay, _) = full_over_lower(&[], 2);
+        assert_eq!(
+            (
+                overlay.rename("dir/file", &overlay, "dir/moved"),
+                overlay.vfs_lstat("dir/moved"),
+                read(&overlay, "dir/file")
+            ),
+            (
+                Err(FilesystemError::StorageFull),
+                Err(FilesystemError::NotFound),
+                b"lower".to_vec()
+            ),
+            "a file renamed through Overlay::rename whose whiteout finds no room must stay where \
+             it was"
+        );
+    }
+
+    // @behavior FS-043
+    #[test]
+    fn a_directory_a_lower_layer_holds_does_not_move_through_an_overlay() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        assert_eq!(
+            (
+                overlay.rename("dir", &overlay, "moved"),
+                overlay.vfs_lstat("moved")
+            ),
+            (
+                Err(FilesystemError::CrossesDevices),
+                Err(FilesystemError::NotFound)
+            ),
+            "a directory a lower Layer holds renamed through Overlay::rename must be refused \
+             as crossing devices, as overlayfs refuses it"
+        );
+    }
+
+    // The directory shows only from the lower Layer, so only a check of
+    // the whole view finds it in the way.
+    // @behavior FS-044
+    #[test]
+    fn a_rename_onto_what_an_overlay_shows_is_checked_against_the_view() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, _) = overlay_on(upper.clone());
+        overwrite(&overlay, "note", b"x");
+        overlay
+            .vfs_mkdir("empty")
+            .expect("the directory must be made");
+        assert_eq!(
+            (
+                overlay.rename("note", &overlay, "dir"),
+                overlay.rename("empty", &overlay, "dir"),
+                read(&overlay, "dir/file")
+            ),
+            (
+                Err(FilesystemError::IsADirectory),
+                Err(FilesystemError::DirectoryNotEmpty),
+                b"lower".to_vec()
+            ),
+            "a rename through Overlay::rename onto a directory only a lower Layer shows must \
+             be refused as rename(2) refuses it, leaving that directory as it was"
+        );
+    }
+
+    // A directory moved over an empty one a lower Layer holds must not take
+    // up what that Layer later shows there.
+    // @behavior FS-045
+    #[test]
+    fn a_directory_moved_over_a_lower_one_is_marked_opaque() {
+        let upper = Arc::new(Tmpfs::new());
+        let lower: Arc<Tmpfs> = Arc::new([("dir/.keep", "")].into_iter().collect());
+        on(&lower)
+            .vfs_unlink("dir/.keep")
+            .expect("the seed must go");
+        let overlay = at(over(lower.clone(), upper.clone()));
+        overlay
+            .vfs_mkdir("made")
+            .expect("the directory must be made");
+        overlay
+            .rename("made", &overlay, "dir")
+            .expect("the directory must move over the empty one");
+        overwrite(&on(&lower), "dir/later", b"lower");
+        assert_eq!(
+            names(&overlay, "dir"),
+            Vec::<String>::new(),
+            "a directory moved through Overlay::rename over one a lower Layer holds must be \
+             marked opaque, so a file the lower Layer gains there later does not show"
+        );
+    }
+
+    // A change is built in `work` before it lands, so `work` holds nothing
+    // once each change is done, and only `upper` holds what the view shows.
+    // @behavior FS-128
+    #[test]
+    fn an_overlay_keeps_its_changes_in_its_tmpfss_upper() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, _) = overlay_on(upper.clone());
+        overwrite(&overlay, "dir/file", b"changed");
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        assert_eq!(
+            (names(&on(&upper), ""), names(&on(&upper), "work")),
+            (
+                vec!["upper".to_string(), "work".to_string()],
+                Vec::<String>::new()
+            ),
+            "an Overlay's upper Tmpfs, after a copy up and a removal through it, must hold only \
+             upper and an empty work"
+        );
+    }
+
+    // The upper's `dir` holds the whiteout the file's removal left, so only
+    // clearing it before the removal lets what is exchanged out go.
+    // @behavior FS-134
+    #[test]
+    fn a_directory_removed_through_an_overlay_leaves_nothing_in_its_workdir() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, _) = overlay_on(upper.clone());
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        overlay
+            .vfs_rmdir("dir")
+            .expect("the emptied directory must be removed");
+        assert_eq!(
+            (names(&on(&upper), "work"), kind(&overlay, "dir")),
+            (Vec::<String>::new(), Err(FilesystemError::NotFound)),
+            "vfs_rmdir of a lower directory whose file vfs_unlink removed \
+             must leave the upper Tmpfs's work empty and the directory gone"
+        );
+    }
+
+    // The open writes nothing, so only the copy taking the lower file's
+    // times, rather than the time it was made, keeps them.
+    // @behavior FS-129
+    #[test]
+    fn a_copy_up_keeps_the_lower_files_times() {
+        let lower = tmpfs_with("dir/file", "lower");
+        let before = on(&lower)
+            .vfs_lstat("dir/file")
+            .expect("the lower file must stand");
+        std::thread::sleep(Duration::from_millis(10));
+        let overlay = at(over(lower, Arc::new(Tmpfs::new())));
+        overlay
+            .open(
+                "dir/file",
+                &OpenHow {
+                    write: true,
+                    ..OpenHow::default()
+                },
+            )
+            .expect("the open must copy the file up");
+        assert_eq!(
+            overlay.vfs_lstat("dir/file").map(|stat| stat.mtime),
+            Ok(before.mtime),
+            "a lower file opened to write through Overlay::open, writing nothing, must keep the \
+             lower file's modified time once copied up"
+        );
+    }
+
+    // The second copy up lands in a directory the first made, so only
+    // restoring its times leaves what the view reports unchanged.
+    // @behavior FS-130
+    #[test]
+    fn a_copy_up_leaves_its_directorys_times_as_they_were() {
+        let lower: Arc<Tmpfs> = Arc::new([("dir/a", "a"), ("dir/b", "b")].into_iter().collect());
+        let overlay = at(over(lower, Arc::new(Tmpfs::new())));
+        overwrite(&overlay, "dir/a", b"changed");
+        let before = overlay
+            .vfs_lstat("dir")
+            .expect("the directory must stand")
+            .mtime;
+        std::thread::sleep(Duration::from_millis(10));
+        overlay
+            .open(
+                "dir/b",
+                &OpenHow {
+                    write: true,
+                    ..OpenHow::default()
+                },
+            )
+            .expect("the open must copy the file up");
+        assert_eq!(
+            overlay.vfs_lstat("dir").map(|stat| stat.mtime),
+            Ok(before),
+            "a lower file copied up through Overlay::open into a directory the upper holds must \
+             leave that directory's modified time as it was"
+        );
+    }
+
+    /// An Overlay over an empty lower Layer under the Tmpfs `upper`, and
+    /// that same Tmpfs mounted on its own, each reached through the VFS.
+    fn beside_its_upper(upper: Tmpfs) -> (crate::vfs::Path, crate::vfs::Path) {
+        let upper = Filesystem::new(Arc::new(upper)).expect("the instance must stand");
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")],
+            Some(upper.clone()),
+        )
+        .expect("an upper over a lower Layer must make a view");
+        let root = |filesystem| {
+            let mount =
+                crate::mount::Mount::new("/data", filesystem, crate::mount::Access::ReadWrite)
+                    .expect("/data is a guest path");
+            crate::vfs::Path::root(mount.mnt())
+        };
+        (
+            root(Filesystem::new(Arc::new(overlay)).expect("the instance must stand")),
+            root(upper),
+        )
+    }
+
+    // The move holds the directory it leaves and the one above it, and the
+    // removal holds the same two, so only taking the one above first in
+    // both keeps them from waiting on each other; unordered, they wait
+    // within a few moves.
+    // @behavior FS-131
+    #[test]
+    fn an_overlay_and_a_mount_of_its_upper_never_wait_on_each_other() {
+        let (overlay, upper) = beside_its_upper(
+            [("upper/a/b/c", "c"), ("upper/a/b/keep", "")]
+                .into_iter()
+                .collect(),
+        );
+        let moved = Arc::new(AtomicBool::new(false));
+        let removing = {
+            let moved = moved.clone();
+            thread::spawn(move || {
+                while !moved.load(Ordering::SeqCst) {
+                    let _ = crate::vfs::filename_rmdir(&Arc::default(), &upper, "upper/a/b");
+                }
+            })
+        };
+        let (done, finished) = std::sync::mpsc::channel();
+        thread::spawn(move || {
+            for _ in 0..500 {
+                crate::vfs::filename_renameat2(&Arc::default(), &overlay, "a/b/c", &overlay, "a/c")
+                    .expect("the file must move up");
+                crate::vfs::filename_renameat2(&Arc::default(), &overlay, "a/c", &overlay, "a/b/c")
+                    .expect("the file must move back");
+            }
+            let _ = done.send(());
+        });
+        let returned = finished
+            .recv_timeout(crate::sched::testing::MAX_WAIT)
+            .is_ok();
+        moved.store(true, Ordering::SeqCst);
+        if returned {
+            crate::sched::testing::join("the removal", removing);
+        }
+        assert!(
+            returned,
+            "vfs::filename_renameat2 of a file up one directory through an Overlay, while vfs::filename_rmdir \
+             removes that directory through a Mount of its upper Tmpfs, must return"
+        );
+    }
+
+    // The make holds only the directory it makes in, so only the removal
+    // holding that directory too, and removing it only once empty, keeps
+    // what the make made from going with it. The two land in the same
+    // instant only a few times in this many tries.
+    // @behavior FS-132
+    #[test]
+    fn a_removal_through_an_overlay_waits_for_a_change_in_that_directory() {
+        let (overlay, upper) = beside_its_upper([("upper/a/.keep", "")].into_iter().collect());
+        let stop = Arc::new(AtomicBool::new(false));
+        let churning = {
+            let stop = stop.clone();
+            thread::spawn(move || {
+                while !stop.load(Ordering::SeqCst) {
+                    let _ = crate::vfs::filename_mkdirat(&Arc::default(), &overlay, "a/b");
+                    let _ = crate::vfs::filename_rmdir(&Arc::default(), &overlay, "a/b");
+                }
+            })
+        };
+        let mut lost = 0;
+        for _ in 0..100_000 {
+            if crate::vfs::filename_mkdirat(&Arc::default(), &upper, "upper/a/b/made").is_ok() {
+                match crate::vfs::vfs_fstatat(&Arc::default(), &upper, "upper/a/b/made", false) {
+                    Ok(_) => {
+                        let _ =
+                            crate::vfs::filename_rmdir(&Arc::default(), &upper, "upper/a/b/made");
+                    }
+                    Err(_) => lost += 1,
+                }
+            }
+        }
+        stop.store(true, Ordering::SeqCst);
+        churning.join().expect("the Overlay's calls must not panic");
+        assert_eq!(
+            lost, 0,
+            "vfs::filename_mkdirat in a directory through a Mount of an Overlay's upper Tmpfs, while \
+             vfs::filename_rmdir removes that directory through the Overlay, must leave every \
+             directory it made standing"
+        );
+    }
+
+    // The upper has room for the copy's entry but for less than
+    // the lower file's bytes, so the copy fails part way.
+    // @behavior FS-046
+    #[test]
+    fn a_copy_up_that_fails_part_way_leaves_nothing_behind() {
+        let upper = Arc::new(Tmpfs::new().with_size(Some(2)).with_nr_inodes(Some(8)));
+        let (overlay, _) = overlay_on(upper.clone());
+        assert_eq!(
+            (
+                write_over(&overlay, "dir/file", b"x"),
+                on(&upper).vfs_lstat("upper/dir/file"),
+                read(&overlay, "dir/file")
+            ),
+            (
+                Err(FilesystemError::StorageFull),
+                Err(FilesystemError::NotFound),
+                b"lower".to_vec()
+            ),
+            "a write through Overlay::open whose copy up runs out of room must leave no partial \
+             copy hiding the lower file"
+        );
+    }
+
+    /// A Tmpfs answering a stat of `dir` at any depth with an I/O failure,
+    /// though it opens `dir` as any other directory.
+    struct StatsNoDir;
+
+    impl Hook for StatsNoDir {
+        fn getattr(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+        ) -> Result<Kstat, FilesystemError> {
+            if dentry.name() == "dir" {
+                return Err(FilesystemError::Other("dir has no stat".to_string()));
+            }
+            inner.getattr(dentry)
+        }
+    }
+
+    /// A Tmpfs whose `file` is gone after its first lookup, as a host
+    /// directory another process changes mid-call.
+    #[derive(Default)]
+    struct Vanishes {
+        seen: AtomicBool,
+    }
+
+    impl Hook for Vanishes {
+        fn getattr(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+        ) -> Result<Kstat, FilesystemError> {
+            if dentry.name() == "file" && self.seen.swap(true, Ordering::SeqCst) {
+                return Err(FilesystemError::NotFound);
+            }
+            inner.getattr(dentry)
+        }
+    }
+
+    /// A Tmpfs storing names in lower case and reaching each by any
+    /// case, as a host that folds case does, answering each call by the
+    /// folded path from its root.
+    #[derive(Clone)]
+    struct FoldsCase {
+        root: KernPath,
+    }
+
+    impl FoldsCase {
+        fn new(tmpfs: Tmpfs) -> Self {
+            Self { root: at(tmpfs) }
+        }
+    }
+
+    /// The path `dentry` stands at beneath the root, folded.
+    fn folded_path_of(dentry: &Dentry) -> String {
+        dentry.path_raw()[1..].to_lowercase()
+    }
+
+    /// A directory of a `FoldsCase`, open.
+    struct FoldedDir(KernPath);
+
+    impl FileOperations for FoldedDir {
+        fn iterate_shared(
+            &mut self,
+            dentry: &Dentry,
+            ctx: &mut DirContext<'_>,
+        ) -> Result<(), FilesystemError> {
+            let entries = match folded_path_of(dentry).as_str() {
+                "" => self.0.iterate_dir(),
+                at => self.0.open_dir(at)?.iterate_dir(),
+            }?;
+            crate::filesystem::Rdir::default().iterate(dentry, ctx, || Ok(entries))
+        }
+    }
+
+    impl FileSystemType for FoldsCase {
+        fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+            sb.d_make_root(Inode::new(&Kstat::new(FileType::Dir, 0), self));
+            Ok(())
+        }
+    }
+
+    impl InodeOperations for FoldsCase {
+        fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+            self.root.vfs_lstat(&folded_path_of(dentry))
+        }
+
+        fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+            let name = dentry.name();
+            let lower = name.to_lowercase();
+            match self.root.vfs_lstat(&folded_path_of(dentry)) {
+                Ok(found) if lower != name => Ok(Lookup::Spelled {
+                    name: lower,
+                    inode: Inode::new(&found, Arc::new(self.clone())),
+                }),
+                Ok(found) => Ok(Lookup::Found(Inode::new(&found, Arc::new(self.clone())))),
+                Err(FilesystemError::NotFound) => Ok(Lookup::Absent),
+                Err(err) => Err(err),
+            }
+        }
+
+        fn open(
+            &self,
+            dentry: &Dentry,
+            how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            if dentry.kind() == Ok(FileType::Dir) {
+                return Ok(Box::new(FoldedDir(self.root.clone())));
+            }
+            self.root.open(&folded_path_of(dentry), how)
+        }
+
+        fn atomic_open(&self, dentry: &Dentry, how: &OpenHow) -> Result<Finish, FilesystemError> {
+            if dentry.in_lookup() {
+                let found = self.lookup(dentry)?;
+                if !how.create || !matches!(found, Lookup::Absent) {
+                    return Ok(Finish::Lookup(found));
+                }
+            }
+            if !how.create {
+                return Ok(Finish::NoOpen { created: false });
+            }
+            let file = self.root.create(&folded_path_of(dentry), how)?;
+            Ok(Finish::Open {
+                file,
+                created: true,
+            })
+        }
+
+        fn mkdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+            self.root.vfs_mkdir(&folded_path_of(dentry))
+        }
+
+        fn rmdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+            self.root.vfs_rmdir(&folded_path_of(dentry))
+        }
+
+        fn unlink(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+            self.root.vfs_unlink(&folded_path_of(dentry))
+        }
+
+        fn rename(
+            &self,
+            from: &Dentry,
+            _to_dir: &dyn InodeOperations,
+            to: &Dentry,
+            _flag: Option<RenameFlag>,
+        ) -> Result<(), FilesystemError> {
+            self.root
+                .rename(&folded_path_of(from), &self.root, &folded_path_of(to))
+        }
+    }
+
+    /// What `path` names through `fs`, or why it names nothing.
+    fn kind(fs: &KernPath, path: &str) -> Result<FileType, FilesystemError> {
+        fs.vfs_lstat(path).map(|metadata| metadata.file_type)
+    }
+
+    // The inner directory is opened too, so only directories held as the
+    // Layers' directories themselves, not reached again by their path,
+    // take it along.
+    // @behavior FS-110
+    #[test]
+    fn a_directory_opened_from_an_overlay_follows_it_when_it_moves() {
+        let upper = Arc::new(Tmpfs::new());
+        let overlay = at(over(Arc::new(Tmpfs::new()), upper.clone()));
+        overlay.vfs_mkdir("dir").expect("dir must be made");
+        overlay.vfs_mkdir("dir/inner").expect("inner must be made");
+        let dir = overlay.open_dir("dir").expect("dir must open");
+        let inner = overlay.open_dir("dir/inner").expect("inner must open");
+        overlay
+            .rename("dir", &overlay, "moved")
+            .expect("the directory must move");
+        overwrite(&dir, "a", b"x");
+        overwrite(&inner, "b", b"x");
+        assert_eq!(
+            (
+                kind(&overlay, "moved/a"),
+                kind(&overlay, "moved/inner/b"),
+                kind(&overlay, "dir")
+            ),
+            (
+                Ok(FileType::RegFile),
+                Ok(FileType::RegFile),
+                Err(FilesystemError::NotFound)
+            ),
+            "files made through directories Overlay::open_dir opened before Overlay::rename moved \
+             the outer one must stand beneath its new path"
+        );
+    }
+
+    // @behavior FS-111
+    #[test]
+    fn an_overlay_directory_removed_while_opened_makes_nothing_more() {
+        let overlay = at(over(Arc::new(Tmpfs::new()), Arc::new(Tmpfs::new())));
+        overlay.vfs_mkdir("dir").expect("dir must be made");
+        let dir = overlay.open_dir("dir").expect("dir must open");
+        overlay.vfs_rmdir("dir").expect("dir must remove");
+        overlay.vfs_mkdir("dir").expect("another dir must be made");
+        assert_eq!(
+            (
+                write(&dir, "made", b"x"),
+                dir.iterate_dir().map(|entries| entries.len()),
+                names(&overlay, "dir").len()
+            ),
+            (Err(FilesystemError::NotFound), Ok(0), 0),
+            "a directory Overlay::open_dir opened, once vfs_rmdir removed it and another \
+             was made in its place, must make nothing, list nothing, and leave the new one empty"
+        );
+    }
+
+    // A change made to a Layer outside its Overlay is the host's, so the
+    // opened directory keeps the Layer's directory it holds, as a
+    // descriptor keeps its directory, rather than reach the one made in
+    // its place.
+    // @behavior FS-112
+    #[test]
+    fn an_overlay_directory_keeps_its_layers_directory_through_a_change_outside_it() {
+        let upper = tmpfs_with("upper/dir/file", "x");
+        let overlay = at(over(Arc::new(Tmpfs::new()), upper.clone()));
+        let dir = overlay.open_dir("dir").expect("dir must open");
+        let outside = on(&upper);
+        outside
+            .rename("upper/dir", &outside, "upper/moved")
+            .expect("the Layer must move it");
+        outside
+            .vfs_mkdir("upper/dir")
+            .expect("the Layer must make another");
+        overwrite(&outside, "upper/dir/file", b"other");
+        assert_eq!(
+            read(&dir, "file"),
+            b"x".to_vec(),
+            "a read through a directory Overlay::open_dir opened, once its Layer moved it away \
+             and made another in its place outside the Overlay, must read the directory it \
+             opened"
+        );
+    }
+
+    /// A lower Layer running what it holds right after its first open, while a
+    /// file of it is being opened through the view.
+    #[derive(Default)]
+    struct RunsAfterOpen(Mutex<Option<Box<dyn FnOnce() + Send>>>);
+
+    impl Hook for RunsAfterOpen {
+        fn open(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+            how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            let opened = inner.open(dentry, how);
+            let run = self.0.lock().expect("never poisoned").take();
+            if let Some(run) = run {
+                crate::sched::testing::join("the writer", thread::spawn(run));
+            }
+            opened
+        }
+    }
+
+    // The copy up lands between the lower open and whatever the file does to
+    // learn of one, so only a file asking where the data is at each read sees
+    // it. A count taken after the open would say no reader was there to tell.
+    // @behavior FS-157
+    #[test]
+    fn a_file_opened_as_a_copy_up_lands_reads_the_copy() {
+        let hook = Arc::new(RunsAfterOpen::default());
+        let lower = Wrap::new(tmpfs_with("note", "lower"), hook.clone());
+        let overlay = at(over(Arc::new(lower), Arc::new(Tmpfs::new())));
+        *hook.0.lock().expect("never poisoned") = Some({
+            let writer = overlay.clone();
+            Box::new(move || overwrite(&writer, "note", b"upper"))
+        });
+        assert_eq!(
+            read(&overlay, "note"),
+            b"upper".to_vec(),
+            "a read through a file of a lower Layer opened while a write copied it up must read \
+             the copy"
+        );
+    }
+
+    // A descriptor held across the removal still names the lower file, while
+    // what stands at its name now is another entry, so only a copy up refusing
+    // a name taken keeps the lower Layer from being asked.
+    // @behavior FS-158
+    #[test]
+    fn a_time_set_on_a_file_whose_name_was_taken_leaves_its_lower_layer() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+        let asked = Arc::new(AtomicUsize::new(0));
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(KeepsTimes(asked.clone())))
+                .expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = Path::root(mount.mnt());
+        let cred = Arc::default();
+        let (read, create) = (
+            OpenHow {
+                read: true,
+                ..OpenHow::default()
+            },
+            OpenHow {
+                write: true,
+                create: true,
+                ..OpenHow::default()
+            },
+        );
+        let held = vfs::kern_path::filp_open(&cred, &root, "file", &read)
+            .unwrap_or_else(|_| panic!("the file must open"));
+        vfs::filename_unlinkat(&cred, &root, "file").expect("the file must be removed");
+        drop(vfs::kern_path::filp_open(&cred, &root, "file", &create));
+        let answer = vfs::do_utimes_fd(
+            &cred,
+            held.path(),
+            &Iattr::times(None, Some(crate::vfs::SetTime::Now)),
+        );
+        assert_eq!(
+            (answer, asked.load(Ordering::SeqCst)),
+            (Err(FilesystemError::AlreadyExists), 0),
+            "vfs::do_utimes_fd on a held lower file whose name another entry took must answer \
+             EEXIST and leave the lower Layer unasked"
+        );
+    }
+
+    // The held file's directory was removed and made again, and the upper
+    // directory it knows of is the removed one, so nothing lands in the new one.
+    // @behavior FS-179
+    #[test]
+    fn a_held_file_of_a_directory_made_again_stays_out_of_it() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+        let lower: Tmpfs = [("d/f", "removed")].into_iter().collect();
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = Path::root(mount.mnt());
+        let cred = Arc::default();
+        let read = OpenHow {
+            read: true,
+            ..OpenHow::default()
+        };
+        let held = vfs::kern_path::filp_open(&cred, &root, "d/f", &read)
+            .unwrap_or_else(|_| panic!("the file must open"));
+        vfs::filename_unlinkat(&cred, &root, "d/f").expect("the file must be removed");
+        vfs::filename_rmdir(&cred, &root, "d").expect("the directory must be removed");
+        vfs::filename_mkdirat(&cred, &root, "d").expect("the directory must be made again");
+        let answer = vfs::do_utimes_fd(
+            &cred,
+            held.path(),
+            &Iattr::times(None, Some(crate::vfs::SetTime::Now)),
+        );
+        assert_eq!(
+            (
+                answer,
+                vfs::vfs_fstatat(&cred, &root, "d/f", false).map(|_| ())
+            ),
+            (
+                Err(FilesystemError::NotFound),
+                Err(FilesystemError::NotFound)
+            ),
+            "vfs::do_utimes_fd on a held lower file whose directory was removed and made again \
+             must answer ENOENT and leave the file out of the view"
+        );
+    }
+
+    /// Slows the first ask about the directory `e` once armed, so a second copy
+    /// up of it finds the first under way.
+    struct SlowsDirectory(AtomicBool);
+
+    impl Hook for SlowsDirectory {
+        fn getattr(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+        ) -> Result<Kstat, FilesystemError> {
+            if dentry.name() == "e" && self.0.swap(false, Ordering::SeqCst) {
+                thread::sleep(Duration::from_millis(100));
+            }
+            inner.getattr(dentry)
+        }
+    }
+
+    // The second copy up decided the directory was not up yet, and waited for the
+    // first. Without asking again under the lock, it would find the first's copy
+    // standing at the name and refuse.
+    // @behavior FS-181
+    #[test]
+    fn a_directory_two_files_copy_up_at_once_takes_both() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+        let lower: Tmpfs = [("d/e/f", "1"), ("d/e/g", "2")].into_iter().collect();
+        let hook = Arc::new(SlowsDirectory(AtomicBool::new(false)));
+        let overlay = Overlay::new(
+            vec![
+                Filesystem::new(Arc::new(Wrap::new(Arc::new(lower), hook.clone())))
+                    .expect("the instance must stand"),
+            ],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = Path::root(mount.mnt());
+        let cred = Arc::default();
+        let write = OpenHow {
+            write: true,
+            ..OpenHow::default()
+        };
+        for name in ["d/e/f", "d/e/g"] {
+            vfs::vfs_fstatat(&cred, &root, name, false).expect("the file stands");
+        }
+        hook.0.store(true, Ordering::SeqCst);
+        let opened = thread::scope(|scope| {
+            let (first, second) = (
+                scope.spawn(|| vfs::kern_path::filp_open(&cred, &root, "d/e/f", &write).map(drop)),
+                scope.spawn(|| vfs::kern_path::filp_open(&cred, &root, "d/e/g", &write).map(drop)),
+            );
+            (
+                crate::sched::testing::join_scoped("the first open", first),
+                crate::sched::testing::join_scoped("the second open", second),
+            )
+        });
+        assert_eq!(
+            opened,
+            (Ok(()), Ok(())),
+            "vfs::do_file_open to write two files of one lower directory at once must copy the \
+             directory up once and open both"
+        );
+    }
+
+    mod stress {
+        use super::*;
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+
+        /// What a removal and an open to write answer racing over one lower file,
+        /// with what the descriptor the open made reports of itself.
+        fn race_removal_with_a_write() -> (
+            Result<(), FilesystemError>,
+            Option<Result<FileType, FilesystemError>>,
+        ) {
+            let lower: Tmpfs = [("d/f", "lower")].into_iter().collect();
+            let overlay = Overlay::new(
+                vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+                Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+            )
+            .expect("the Overlay must stack");
+            let mount = Mount::new(
+                "/data",
+                Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+                Access::ReadWrite,
+            )
+            .expect("/data is a guest path");
+            let root = Path::root(mount.mnt());
+            let cred = Arc::default();
+            let write = OpenHow {
+                write: true,
+                ..OpenHow::default()
+            };
+            let ready = std::sync::atomic::AtomicBool::new(false);
+            std::thread::scope(|scope| {
+                let opening = scope.spawn(|| {
+                    crate::sched::testing::wait_until("the removal starting", || {
+                        ready.load(Ordering::SeqCst)
+                    });
+                    vfs::kern_path::filp_open(&cred, &root, "d/f", &write)
+                        .ok()
+                        .map(|file| file.getattr().map(|metadata| metadata.file_type))
+                });
+                ready.store(true, Ordering::SeqCst);
+                let removed = crate::sched::testing::within_max_wait(|| {
+                    vfs::filename_unlinkat(&cred, &root, "d/f")
+                });
+                (
+                    removed,
+                    crate::sched::testing::join_scoped("the open", opening),
+                )
+            })
+        }
+
+        // A removal deciding how to hide the name before the copy up landed asked
+        // the rename to find nothing there.
+        // @behavior FS-182
+        #[test]
+        #[ignore = "a stress witness; run by rake crates:stress"]
+        fn a_file_removed_as_it_is_copied_up_goes() {
+            for _ in 0..50_000 {
+                let (removed, _) = race_removal_with_a_write();
+                assert_eq!(
+                    removed,
+                    Ok(()),
+                    "vfs::filename_unlinkat of a file another Thread opens to write through an \
+                     Overlay must remove it"
+                );
+            }
+        }
+
+        // A copy up reading its name back after its lock went found the whiteout
+        // the removal left there.
+        // @behavior FS-180
+        #[test]
+        #[ignore = "a stress witness; run by rake crates:stress"]
+        fn a_file_copied_up_as_its_name_is_removed_stays_a_file() {
+            for _ in 0..50_000 {
+                let (_, opened) = race_removal_with_a_write();
+                if let Some(kind) = opened {
+                    assert_eq!(
+                        kind,
+                        Ok(FileType::RegFile),
+                        "File::getattr of a file opened to write through an Overlay as it is \
+                         removed must report a file"
+                    );
+                }
+            }
+        }
+    }
+
+    /// A lower Layer whose one entry, `pipe`, is a FIFO, counting each open.
+    struct HoldsFifo(Arc<AtomicUsize>);
+
+    impl FileSystemType for HoldsFifo {
+        fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+            sb.d_make_root(Inode::new(&Kstat::new(FileType::Dir, 0), self));
+            Ok(())
+        }
+    }
+
+    impl InodeOperations for HoldsFifo {
+        fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+            Ok(match dentry.name().as_str() {
+                "pipe" => Kstat::new(FileType::Fifo, 0).with_identity(1, 2),
+                _ => Kstat::new(FileType::Dir, 0).with_identity(1, 1),
+            })
+        }
+
+        fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+            Ok(match dentry.name().as_str() {
+                "pipe" => Lookup::Found(Inode::new(
+                    &Kstat::new(FileType::Fifo, 0).with_identity(1, 2),
+                    Arc::new(Self(self.0.clone())),
+                )),
+                _ => Lookup::Absent,
+            })
+        }
+
+        fn open(
+            &self,
+            _dentry: &Dentry,
+            _how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            self.0.fetch_add(1, Ordering::SeqCst);
+            Err(FilesystemError::Interrupted)
+        }
+    }
+
+    // A special file answers a time without any open having been asked, as
+    // an open of one could wait for a peer past the invocation's timeout.
+    // @behavior FS-162
+    #[test]
+    fn a_time_set_on_a_special_file_below_an_overlay_opens_nothing() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, Path};
+        let opened = Arc::new(AtomicUsize::new(0));
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(HoldsFifo(opened.clone())))
+                .expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let answer = vfs::do_utimes_path(
+            &Arc::default(),
+            &Path::root(mount.mnt()),
+            "pipe",
+            false,
+            &Iattr::times(None, Some(crate::vfs::SetTime::Now)),
+        );
+        assert_eq!(
+            (answer, opened.load(Ordering::SeqCst)),
+            (Err(FilesystemError::PermissionDenied), 0),
+            "vfs::do_utimes_pathon a FIFO a lower Layer holds through an Overlay must answer EACCES \
+             and open nothing"
+        );
+    }
+
+    // An earlier Overlay's upper, stacked as a lower Layer of another, holds a
+    // whiteout in a directory only that Layer shows, so only a walk reading
+    // such a directory for marks finds nothing there.
+    // @behavior FS-159
+    #[test]
+    fn a_whiteout_in_a_directory_one_layer_shows_names_nothing() {
+        let lower: Tmpfs = [("file", "x")].into_iter().collect();
+        let first_upper = Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand");
+        let first = kern_path(Arc::new(
+            Overlay::new(
+                vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+                Some(first_upper.clone()),
+            )
+            .expect("the Overlay must stack"),
+        ));
+        first.vfs_unlink("file").expect("the file must be removed");
+        let second = at(Overlay::new(
+            vec![first_upper],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack"));
+        assert_eq!(
+            second.vfs_lstat("upper/file").err(),
+            Some(FilesystemError::NotFound),
+            "a stat through an Overlay of a whiteout in a directory one Layer shows must answer \
+             ENOENT, as the listing shows nothing there"
+        );
+    }
+
+    // A lower directory moved onto a full one answers why it cannot move, so
+    // only asking that first keeps what stands at the target from answering.
+    // @behavior FS-160
+    #[test]
+    fn a_lower_directory_answers_that_it_cannot_move_before_its_target_is_read() {
+        let lower: Tmpfs = [("dir/file", "x"), ("full/file", "x")]
+            .into_iter()
+            .collect();
+        let overlay = at(over(Arc::new(lower), Arc::new(Tmpfs::new())));
+        assert_eq!(
+            overlay.rename("dir", &overlay, "full"),
+            Err(FilesystemError::CrossesDevices),
+            "a rename through an Overlay of a lower Layer's directory onto one holding entries \
+             must answer EXDEV, as ovl_rename_start asks whether it can move first"
+        );
+    }
+
+    // The lower file is far bigger than the upper holds, so only a copy up
+    // leaving its bytes behind can land.
+    // @behavior FS-155
+    #[test]
+    fn a_truncating_open_copies_up_none_of_the_bytes() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+        let lower: Tmpfs = [("file", vec![b'x'; 1 << 20])].into_iter().collect();
+        let upper = Tmpfs::new().with_size(Some(4096)).with_nr_inodes(None);
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(upper)).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = Path::root(mount.mnt());
+        let cred = Arc::default();
+        let how = OpenHow {
+            read: true,
+            write: true,
+            truncate: true,
+            ..OpenHow::default()
+        };
+        let opened = vfs::kern_path::filp_open(&cred, &root, "file", &how);
+        assert!(
+            opened.is_ok_and(|mut file| file.read(&mut [0; 8]) == Ok(0)),
+            "vfs::do_file_open with O_TRUNC of a lower file past what the upper holds must land \
+             on an empty file"
+        );
+    }
+
+    // Only the directory the view holds open keeps its Layer's host directory
+    // through walks past a Bind's bound, so only that reaches it once the host
+    // moved it.
+    // @behavior FS-152
+    #[cfg(unix)]
+    #[test]
+    fn an_overlay_directory_held_open_keeps_its_bind_layers_directory_past_the_bound() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+        let host = std::env::temp_dir().join(format!("kobako-overlay-held-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&host);
+        let deep = host.join(vec!["d"; 100].join("/"));
+        std::fs::create_dir_all(&deep).expect("the host tree must be made");
+        std::fs::create_dir_all(host.join("held")).expect("the host tree must be made");
+        std::fs::write(host.join("held/f"), "x").expect("the host file must be written");
+        let lower = Filesystem::new(Arc::new(
+            crate::filesystem::Bind::new(&host).expect("the host directory must open"),
+        ))
+        .expect("the instance must stand");
+        let overlay = Overlay::new(
+            vec![lower],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::Read,
+        )
+        .expect("/data is a guest path");
+        let root = Path::root(mount.mnt());
+        let cred = Arc::default();
+        let directory = OpenHow {
+            read: true,
+            directory: true,
+            ..OpenHow::default()
+        };
+        let Ok(held) = vfs::kern_path::filp_open(&cred, &root, "held", &directory) else {
+            panic!("the directory must open");
+        };
+        vfs::vfs_fstatat(&cred, &root, &vec!["d"; 100].join("/"), false)
+            .unwrap_or_else(|_| panic!("the deep directory must stand"));
+        std::fs::rename(host.join("held"), host.join("moved")).expect("the host must move it");
+        let reached = vfs::vfs_fstatat(&cred, held.path(), "f", false);
+        let _ = std::fs::remove_dir_all(&host);
+        assert!(
+            reached.is_ok(),
+            "vfs::vfs_fstatat through an Overlay directory held open over a Bind Layer, once a \
+             walk passed the bound and the host moved it, must still reach the directory it opened"
+        );
+    }
+
+    // Only the lower Layer holds `dir` when both handles open it, so the
+    // second sees the file only if the copy up through the first reaches
+    // it too.
+    // @behavior FS-119
+    #[test]
+    fn a_copy_up_through_one_overlay_directory_is_seen_through_another() {
+        let lower: Arc<dyn FileSystemType> = tmpfs_with("dir/a.txt", "a");
+        let overlay = at(over(lower, Arc::new(Tmpfs::new())));
+        let first = overlay.open_dir("dir").expect("dir must open");
+        let second = overlay.open_dir("dir").expect("dir must open again");
+        write(&first, "b.txt", b"b").expect("the write must copy dir up");
+        assert_eq!(
+            read(&second, "b.txt"),
+            b"b".to_vec(),
+            "a read through one directory Overlay::open_dir opened, of a file written through \
+             another opened before the write copied it up, must read the file"
+        );
+    }
+
+    // The lower Layer holds no `dir`, so reaching it again by the path it
+    // was opened at would miss where it moved.
+    // @behavior FS-120
+    #[test]
+    fn a_write_through_a_moved_overlay_directory_lands_where_it_went() {
+        let upper = tmpfs_with("upper/dir/a.txt", "a");
+        let overlay = at(over(Arc::new(Tmpfs::new()), upper.clone()));
+        let dir = overlay.open_dir("dir").expect("dir must open");
+        overlay
+            .rename("dir", &overlay, "moved")
+            .expect("the directory must move");
+        assert_eq!(
+            (
+                write(&dir, "b.txt", b"b"),
+                read(&on(&upper), "upper/moved/b.txt")
+            ),
+            (Ok(()), b"b".to_vec()),
+            "a write through a directory Overlay::open_dir opened, once Overlay::rename moved it \
+             over a lower Layer, must land where it moved"
+        );
+    }
+
+    // @behavior FS-083
+    #[test]
+    fn an_overlay_spells_a_path_as_the_layer_showing_it_stores_it() {
+        let overlay = at(over(
+            Arc::new(FoldsCase::new(
+                [("private/secret", "x")].into_iter().collect(),
+            )),
+            Arc::new(Tmpfs::new()),
+        ));
+        let private = overlay
+            .open_dir("PRIVATE")
+            .expect("the directory must open in any case");
+        assert_eq!(
+            (
+                overlay.lookup("PRIVATE"),
+                private.lookup("SECRET"),
+                private.lookup("New")
+            ),
+            (
+                Ok("private".to_string()),
+                Ok("secret".to_string()),
+                Ok("New".to_string())
+            ),
+            "a name asked of Overlay::lookup in another case, shown by a Layer folding case, \
+             must come back as that Layer stores it, a new name kept as given"
+        );
+    }
+
+    // A directory only one Layer shows has nothing to merge or hide, so the
+    // walk keeps what that Layer's lookup recorded, as overlayfs leaves it
+    // unmerged and reads `d_is_dir` rather than ask for a stat.
+    // @behavior FS-122
+    #[test]
+    fn a_directory_one_layer_shows_is_walked_without_its_stat() {
+        let only: Arc<dyn FileSystemType> = tmpfs_with("top/dir/file", "only");
+        let overlay = at(over(
+            Arc::new(Wrap::new(only, Arc::new(StatsNoDir))),
+            Arc::new(Tmpfs::new()),
+        ));
+        assert_eq!(
+            read(&overlay, "top/dir/file"),
+            b"only",
+            "a file read through Overlay::open beneath a directory only the lower Layer shows, \
+             that Layer answering no stat of the directory, must read its content"
+        );
+    }
+
+    /// Refuses every open, as a Layer whose directory cannot open does.
+    struct RefusesOpen;
+
+    impl Hook for RefusesOpen {
+        fn open(
+            &self,
+            _inner: &dyn InodeOperations,
+            _dentry: &Dentry,
+            _how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            Err(FilesystemError::PermissionDenied)
+        }
+    }
+
+    // A host removing a Bind's directory cannot witness this, as the fid the
+    // lookup took still opens it, so a Layer refuses instead.
+    // @behavior FS-166
+    #[test]
+    fn a_directory_a_layer_cannot_open_answers_why() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow};
+        let lower: Arc<dyn FileSystemType> = tmpfs_with("top/file", "lower");
+        let overlay = over(
+            Arc::new(Wrap::new(lower, Arc::new(RefusesOpen))),
+            Arc::new(Tmpfs::new()),
+        );
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::Read,
+        )
+        .expect("/data is a guest path");
+        let directory = OpenHow {
+            read: true,
+            directory: true,
+            ..OpenHow::default()
+        };
+        let answer = vfs::kern_path::filp_open(
+            &Arc::default(),
+            &vfs::Path::root(mount.mnt()),
+            "top",
+            &directory,
+        );
+        assert_eq!(
+            answer.err(),
+            Some(FilesystemError::PermissionDenied),
+            "vfs::do_file_open of an Overlay's directory whose Layer refuses its open must answer \
+             what the Layer answered"
+        );
+    }
+
+    // @behavior FS-080
+    #[test]
+    fn a_file_gone_during_a_rename_answers_not_found() {
+        let tmpfs: Tmpfs = [("file", "lower")].into_iter().collect();
+        let lower = Wrap::new(Arc::new(tmpfs), Arc::new(Vanishes::default()));
+        let overlay = at(over(Arc::new(lower), Arc::new(Tmpfs::new())));
+        assert_eq!(
+            overlay.rename("file", &overlay, "moved"),
+            Err(FilesystemError::NotFound),
+            "a file renamed through Overlay::rename that its Layer loses during the call must \
+             answer not found"
+        );
+    }
+
+    // The upper Layer's `dir/sub` stands where the lower Layer holds a
+    // file `dir`, so the merge below it meets a file on the way.
+    // @behavior FS-078
+    #[test]
+    fn a_directory_over_a_lower_file_on_its_way_reads_as_a_directory() {
+        let overlay = at(over(
+            tmpfs_with("dir", "lower"),
+            tmpfs_with("upper/dir/sub/file", "upper"),
+        ));
+        assert_eq!(
+            (
+                overlay
+                    .vfs_lstat("dir/sub")
+                    .map(|metadata| metadata.file_type),
+                read(&overlay, "dir/sub/file")
+            ),
+            (Ok(FileType::Dir), b"upper".to_vec()),
+            "a directory looked up through vfs_lstat above a lower Layer holding a file on \
+             its path must read as a directory, as its files open"
+        );
+    }
+
+    // @behavior FS-101
+    #[test]
+    fn a_file_opened_to_read_before_a_copy_up_reads_the_copy() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::default()));
+        let mut reader = open_to_read(&overlay, "dir/file");
+        overwrite(&overlay, "dir/file", b"upper");
+        assert_eq!(
+            read_from(reader.as_mut()),
+            b"upper".to_vec(),
+            "a file Overlay::open handed out to read before another open copied it up must \
+             read what the copy holds"
+        );
+    }
+
+    // @behavior FS-102
+    #[test]
+    fn a_file_opened_to_read_before_a_rename_reads_the_moved_copy() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::default()));
+        let mut reader = open_to_read(&overlay, "dir/file");
+        overlay
+            .rename("dir/file", &overlay, "dir/moved")
+            .expect("the rename must land");
+        overwrite(&overlay, "dir/moved", b"moved");
+        assert_eq!(
+            read_from(reader.as_mut()),
+            b"moved".to_vec(),
+            "a file Overlay::open handed out to read before Overlay::rename moved it must read \
+             what the moved copy holds"
+        );
+    }
+
+    // @behavior FS-103
+    #[test]
+    fn a_file_open_to_read_keeps_what_it_held_once_removed() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::default()));
+        let mut reader = open_to_read(&overlay, "dir/file");
+        overwrite(&overlay, "dir/file", b"upper");
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the removal must land");
+        overwrite(&overlay, "dir/file", b"fresh");
+        overlay
+            .rename("dir/file", &overlay, "dir/moved")
+            .expect("the rename must land");
+        assert_eq!(
+            read_from(reader.as_mut()),
+            b"upper".to_vec(),
+            "a file Overlay::open handed out to read must keep reading what it held once \
+             vfs_unlink took it away, whatever later stands at its path"
+        );
+    }
+
+    /// A Tmpfs whose first open sleeps a while, flagging that it began.
+    #[derive(Default)]
+    struct SleepsOnOpen {
+        opening: AtomicBool,
+    }
+
+    impl Hook for SleepsOnOpen {
+        fn open(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+            how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            if !self.opening.swap(true, Ordering::SeqCst) {
+                thread::sleep(Duration::from_millis(100));
+            }
+            inner.open(dentry, how)
+        }
+    }
+
+    // The first copy up holds the file's lock while its lower open sleeps,
+    // so the second, of the same file, finds the lock held and waits.
+    // @behavior FS-039
+    #[test]
+    fn a_contended_copy_up_waits_through_the_registered_blocking() {
+        let counts = crate::sched::testing::count_waits();
+        let sleeps = Arc::new(SleepsOnOpen::default());
+        let lower = Wrap::new(tmpfs_with("note", "lower"), sleeps.clone());
+        let overlay = over(Arc::new(lower), Arc::new(Tmpfs::new()));
+        let first = at(overlay);
+        let second = first.clone();
+        let copying = thread::spawn(move || write_over(&first, "note", b"first"));
+        crate::sched::testing::wait_until("the first copy up opening its lower file", || {
+            sleeps.opening.load(Ordering::SeqCst)
+        });
+        let waited =
+            crate::sched::testing::within_max_wait(|| write_over(&second, "note", b"later"));
+        assert_eq!(
+            (
+                crate::sched::testing::join("the first copy up", copying),
+                waited,
+                counts.load(Ordering::SeqCst) > 0
+            ),
+            (Ok(()), Ok(()), true),
+            "a write through an Overlay copying up a file another thread is copying up must wait \
+             through the Blocking given to sched::register_blocking, then land"
+        );
+    }
+
+    // Copying up makes the directory in the upper, whose own identity
+    // differs, so only reporting the lower Layer's keeps it.
+    // @behavior FS-072
+    #[test]
+    fn an_overlay_keeps_a_directorys_identity_when_a_write_copies_it_up() {
+        let lower: Arc<dyn FileSystemType> =
+            Arc::new([("dir/a.txt", "a")].into_iter().collect::<Tmpfs>());
+        let overlay = at(over(lower, Arc::new(Tmpfs::new())));
+        let identity = |overlay: &KernPath| {
+            let metadata = overlay.vfs_lstat("dir").expect("the directory must stand");
+            (metadata.dev, metadata.ino)
+        };
+        let before = identity(&overlay);
+        overwrite(&overlay, "dir/b.txt", b"b");
+        assert_eq!(
+            (identity(&overlay) == before, before.1 != 0),
+            (true, true),
+            "a directory of a lower Layer copied up by a write through an Overlay's open must \
+             keep the identity vfs_lstat reported before"
+        );
+    }
+
+    // The upper Layer's directory changes after the lower one is made, so
+    // the two report different times and only the upper's matches.
+    // @behavior FS-117
+    #[test]
+    fn an_overlay_reports_a_merged_directory_as_overlayfs_does() {
+        let lower: Arc<Tmpfs> = Arc::new([("dir/a.txt", "a")].into_iter().collect());
+        let upper: Arc<Tmpfs> = Arc::new(Tmpfs::new());
+        let overlay = at(over(lower.clone(), upper.clone()));
+        std::thread::sleep(std::time::Duration::from_millis(10));
+        write(&overlay, "dir/b.txt", b"b").expect("the upper must take a write");
+        let merged = overlay.vfs_lstat("dir").expect("the directory must stand");
+        let modified = |layer: &Arc<Tmpfs>, path: &str| {
+            on(layer).vfs_lstat(path).expect("a Layer holds it").mtime
+        };
+        assert_eq!(
+            (
+                merged.nlink,
+                merged.mtime == modified(&upper, "upper/dir"),
+                merged.mtime == modified(&lower, "dir"),
+            ),
+            (1, true, false),
+            "Overlay::getattr of a directory two Layers hold, written last in the upper, must \
+             count one name and report the upper Layer's times"
+        );
+    }
+
+    // @behavior FS-073
+    #[test]
+    fn an_overlay_names_a_directory_alike_whether_a_link_at_its_end_is_followed() {
+        let overlay = at(over(
+            tmpfs_with("dir/lower", "x"),
+            tmpfs_with("upper/dir/upper", "x"),
+        ));
+        let identity = |metadata: Result<Kstat, FilesystemError>| {
+            let metadata = metadata.expect("the directory must stand");
+            (metadata.dev, metadata.ino)
+        };
+        assert_eq!(
+            identity(overlay.vfs_lstat("dir")),
+            identity(overlay.vfs_lstat("dir")),
+            "a directory two Layers hold, looked up through vfs_lstat, must \
+             report the identity vfs_lstat does"
+        );
+    }
+
+    /// A Layer whose `permission` refuses `mask` of what stands at `name`.
+    struct RefusesOf {
+        name: &'static str,
+        mask: Mask,
+    }
+
+    impl Hook for RefusesOf {
+        fn permission(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+            mask: Mask,
+        ) -> Result<(), FilesystemError> {
+            if dentry.name() == self.name && mask.contains(self.mask) {
+                return Err(FilesystemError::PermissionDenied);
+            }
+            inner.permission(dentry, mask)
+        }
+    }
+
+    type LayerCall = fn(&KernPath) -> Result<(), FilesystemError>;
+
+    // Only a Layer of the Host App's own answers `permission`, so each call is
+    // made over a lower Layer refusing just the one ask that call makes of it.
+    // @behavior FS-206
+    #[test]
+    fn an_overlay_asks_a_layers_permission_where_overlayfs_does() {
+        let calls: [(&str, &str, Mask, LayerCall); 4] = [
+            ("finding a name", "dir", Mask::EXEC, |view| {
+                view.vfs_lstat("dir/file").map(drop)
+            }),
+            ("opening a file", "file", Mask::OPEN, |view| {
+                let read = OpenHow {
+                    read: true,
+                    ..OpenHow::default()
+                };
+                view.open("dir/file", &read).map(drop)
+            }),
+            ("listing a directory", "dir", Mask::OPEN, |view| {
+                view.open_dir("dir")?.iterate_dir().map(drop)
+            }),
+            ("copying a file up", "file", Mask::OPEN, |view| {
+                write_over(view, "dir/file", b"y")
+            }),
+        ];
+        for (call, name, mask, run) in calls {
+            let lower = Wrap::new(
+                tmpfs_with("dir/file", "x"),
+                Arc::new(RefusesOf { name, mask }),
+            );
+            let view = at(over(Arc::new(lower), Arc::new(Tmpfs::new())));
+            assert_eq!(
+                run(&view),
+                Err(FilesystemError::PermissionDenied),
+                "{call} through an Overlay over a Layer whose permission refuses {mask:?} of \
+                 `{name}` must answer that refusal, as overlayfs asks inode_permission of the \
+                 real inode"
+            );
+        }
+    }
+}