kobako 0.29.0 → 0.30.0

data/crates/kobako-runtime/src/filesystem/overlay.rs

@@ -1,146 +1,425 @@
-//! `Overlay`: Layers stacked into one Filesystem, each read-only or
-//! writable on its own.
+//! `Overlay`: read-only lower Layers under an upper Tmpfs, stacked into
+//! one Filesystem, as Linux overlayfs stacks a mount's layers.
 //!
-//! The rules follow the union filesystems that allow writable Layers
-//! below the top, aufs among them. A removal hides what a read-only Layer
-//! still shows with a whiteout, and a directory made again where one was
-//! removed is marked opaque. Both markers take the OCI image layer
-//! format's names and live in the topmost writable Layer, so they last as
-//! long as it does. Every call holds the Overlay's lock, so a change
-//! across several Layers is never seen half made.
-
-mod exclusive;
+//! The upper must be a Tmpfs, as gVisor takes only an upper that holds
+//! its marks. A removal hides what a lower Layer still shows with a
+//! whiteout, and a directory made again where one was removed is marked
+//! opaque, each as Linux marks it, in the upper, so they last as long as
+//! it does. The VFS holds each directory a call changes, as Linux's
+//! `i_rwsem` does above overlayfs, and a copy up holds the lock of what
+//! it copies, so a change across several Layers is never seen half made.
+
+mod file;
+mod inode;
+mod path;
 mod stack;
 
+use std::any::Any;
 use std::sync::Arc;
 
-pub use exclusive::Blocking;
-
+use super::rdir::Rdir;
 use super::{
-    Access, DirEntry, File, Filesystem, FilesystemError, Hold, Metadata, OpenOptions, Rename,
+    DentryOperations, FileOperations, FileSystemType, FileType, Filesystem, FilesystemError, Iattr,
+    InodeOperations, Kstat, Lookup, OpenHow, RenameFlag, Tmpfs,
 };
-use exclusive::{Exclusive, Inline};
-use stack::Stack;
-
-/// Layers stacked into one Filesystem, the first one added on top. Its
-/// clones share its lock; two Overlays sharing a writable Layer are not
-/// serialized against each other, as overlayfs leaves two mounts sharing
-/// an upper directory undefined.
+use crate::vfs::{
+    generic_file_llseek, generic_read_dir, notify_change, Dentry, DirContext, Inode, Whence,
+    NAME_MAX,
+};
+use inode::{OverlayDirInode, OverlayFileInode};
+use path::OverlayPath;
+use stack::OverlayFs;
+
+/// Read-only lower Layers under an upper Tmpfs, stacked into one
+/// Filesystem. Two Overlays sharing an upper are not serialized against
+/// each other, as overlayfs leaves two mounts sharing an upper directory
+/// undefined.
+///
+/// Each directory of the view keeps each Layer's directory it stands for
+/// on its dentry, so it is reached wherever those directories move, as a
+/// descriptor reaches its directory, and a directory opened beneath it is
+/// this Overlay asked about that dentry. overlayfs leaves a change made to
+/// a Layer outside it undefined; here such a change is the host's, and a
+/// directory reached before it keeps the Layers' directories it holds.
 #[derive(Clone)]
 pub struct Overlay {
-    stack: Stack,
-    lock: Arc<Exclusive>,
+    fs: OverlayFs,
+    /// How many Overlays stack here, itself among them, as Linux counts
+    /// a super block's `s_stack_depth`.
+    stack_depth: usize,
+}
+
+/// The deepest Overlays may stack, as Linux's `FILESYSTEM_MAX_STACK_DEPTH`
+/// bounds it, so a call through them cannot run out of stack.
+const MAX_STACK_DEPTH: usize = 2;
+
+/// The most lower Layers an Overlay takes, as overlayfs's `OVL_MAX_STACK`.
+const MAX_LOWER_LAYERS: usize = 500;
+
+impl Overlay {
+    /// An Overlay of `lower`, topmost first, under `upper`. Each Layer is
+    /// asked through that Filesystem's dentries, as overlayfs asks each
+    /// layer by its own lookup. As overlayfs's mount does, it refuses no
+    /// lower Layer, a read-only view of fewer than two, too many lower
+    /// Layers, a stack too deep, and one instance as two Layers, as
+    /// overlayfs answers overlapping layers; as gVisor's does, it refuses an
+    /// upper that is no Tmpfs.
+    pub fn new(
+        lower: Vec<Arc<Filesystem>>,
+        upper: Option<Arc<Filesystem>>,
+    ) -> Result<Self, FilesystemError> {
+        let layers: Vec<_> = lower.iter().chain(&upper).collect();
+        let overlapping = layers
+            .iter()
+            .enumerate()
+            .any(|(at, layer)| layers[..at].iter().any(|seen| Arc::ptr_eq(seen, layer)));
+        if overlapping {
+            return Err(FilesystemError::InvalidInput);
+        }
+        let too_few = if upper.is_some() { 1 } else { 2 };
+        let upper_tmpfs = upper.as_ref().is_none_or(|upper| {
+            upper
+                .root()
+                .and_then(|root| root.inode())
+                .is_some_and(|root| (root.ops().as_ref() as &dyn Any).is::<Tmpfs>())
+        });
+        let stack_depth = 1 + lower
+            .iter()
+            .filter_map(|layer| layer.root()?.inode())
+            .filter_map(|root| {
+                let overlay = (root.ops().as_ref() as &dyn Any).downcast_ref::<Self>()?;
+                Some(overlay.stack_depth)
+            })
+            .max()
+            .unwrap_or(0);
+        if !(too_few..=MAX_LOWER_LAYERS).contains(&lower.len())
+            || !upper_tmpfs
+            || stack_depth > MAX_STACK_DEPTH
+        {
+            return Err(FilesystemError::InvalidInput);
+        }
+        Ok(Self {
+            fs: OverlayFs::new(lower, upper)?,
+            stack_depth,
+        })
+    }
 }
 
-impl Default for Overlay {
-    fn default() -> Self {
-        Self::new()
+/// The Layer's dentry the entry `dentry` answers through, and the inode the view
+/// recorded, as `ovl_getattr` asks the real path.
+fn real_of(dentry: &Dentry) -> Option<(Arc<Dentry>, Arc<Inode>)> {
+    let inode = dentry.inode()?;
+    let real = OverlayFileInode::of(&inode)?.real();
+    Some((real, inode))
+}
+
+/// Whether `real`, a Layer's dentry, still names what it recorded, as
+/// `ovl_revalidate_real` asks it.
+fn ovl_revalidate_real(real: &Dentry) -> Result<bool, FilesystemError> {
+    match real.ops() {
+        Some(ops) => ops.revalidate(real.parent().inode_ops()?.as_ref(), real),
+        None => Ok(true),
     }
 }
 
-impl Overlay {
-    /// An Overlay with no Layer yet.
-    pub fn new() -> Self {
-        Self {
-            stack: Stack::default(),
-            lock: Arc::new(Exclusive::new(Arc::new(Inline))),
+/// A name stays valid while each Layer's dentry its entry keeps does, as
+/// `ovl_dentry_revalidate` asks each real dentry, and while a directory still
+/// stands for what each Layer holds there, as `ovl_clear_empty` drops a dentry
+/// whose upper no longer matches.
+impl DentryOperations for Overlay {
+    fn revalidate(
+        &self,
+        _dir: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<bool, FilesystemError> {
+        let Some(inode) = dentry.inode() else {
+            return Ok(matches!(self.lookup(dentry)?, Lookup::Absent));
+        };
+        if let Some(kept) = OverlayFileInode::of(&inode) {
+            return ovl_revalidate_real(&kept.real());
         }
+        let Some(kept) = OverlayDirInode::of(&inode) else {
+            return Ok(true);
+        };
+        let shown = kept.level();
+        for layer in shown.iter().flatten() {
+            if !ovl_revalidate_real(layer.dentry())? {
+                return Ok(false);
+            }
+        }
+        let name = dentry.name();
+        let above = self.fs.parent(dentry)?.level();
+        Ok(above.iter().zip(&shown).all(|pair| match pair {
+            (Some(layer), Some(shown)) => layer.matches_real(&name, shown.dentry()),
+            _ => true,
+        }))
     }
 
-    /// This Overlay with `filesystem` as a new Layer beneath the ones
-    /// already added, allowing `access` there. It takes a lock of its own,
-    /// so an Overlay holding the one it was built from as a Layer does not
-    /// wait on itself.
-    pub fn layer(mut self, filesystem: Arc<dyn Filesystem>, access: Access) -> Self {
-        self.stack.push(filesystem, access);
-        self.lock = Arc::new(Exclusive::new(self.lock.blocking()));
-        self
+    /// A name goes once nothing holds it where any Layer behind it would let
+    /// its own go, since its `revalidate` answers only as those Layers do.
+    fn delete(&self, dentry: &Dentry) -> bool {
+        let Some(inode) = dentry.inode() else {
+            return false;
+        };
+        if let Some(kept) = OverlayFileInode::of(&inode) {
+            return kept.real().goes_when_unused();
+        }
+        OverlayDirInode::of(&inode).is_some_and(|kept| {
+            kept.level()
+                .iter()
+                .flatten()
+                .any(|layer| layer.dentry().goes_when_unused())
+        })
     }
+}
 
-    /// This Overlay waiting for its lock through `blocking`.
-    pub fn with_blocking(self, blocking: Arc<dyn Blocking>) -> Self {
-        Self {
-            lock: Arc::new(Exclusive::new(blocking)),
-            ..self
-        }
+/// A file of the view, or an entry a Layer holds that is none of the others, as
+/// `ovl_file_inode_operations` answers for one.
+struct OverlayRegular(Overlay);
+
+/// A link of the view, as `ovl_symlink_inode_operations` answers for one.
+struct OverlayLink(Overlay);
+
+impl Overlay {
+    /// The operations an entry of `kind` answers through.
+    fn ops_of(&self, kind: FileType) -> Arc<dyn InodeOperations> {
+        match kind {
+            FileType::Dir => Arc::new(self.clone()),
+            FileType::Symlink => Arc::new(OverlayLink(self.clone())),
+            _ => Arc::new(OverlayRegular(self.clone())),
+        }
+    }
+
+    /// What the Layer the entry's name is found in reports, under the identity
+    /// the view recorded.
+    fn real_getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        let (real, inode) = real_of(dentry).ok_or(FilesystemError::NotFound)?;
+        let found = real.getattr()?;
+        Ok(match inode.identity() {
+            Some(identity) => identity.onto(found),
+            None => found,
+        })
+    }
+}
+
+impl InodeOperations for OverlayRegular {
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.0.real_getattr(dentry)
+    }
+
+    /// Copied up first, as `ovl_setattr` does, so a lower Layer stays as it
+    /// was whatever its Filesystem would keep.
+    fn setattr(&self, dentry: &Dentry, attr: &Iattr) -> Result<(), FilesystemError> {
+        let overlay = &self.0;
+        overlay
+            .fs
+            .copy_up_file(&overlay.fs.parent(dentry)?, dentry, false)?;
+        let (real, _) = real_of(dentry).ok_or(FilesystemError::NotFound)?;
+        // The open's truncate never reached the upper's open, so the upper must
+        // empty the file itself, and the view's open file is none of the upper's,
+        // as `ovl_setattr` clears `ATTR_OPEN` and `ATTR_FILE`.
+        let held = real.inode_lock()?;
+        notify_change(
+            &real,
+            &held,
+            &Iattr {
+                open: false,
+                file: None,
+                ..*attr
+            },
+        )
+    }
+
+    fn open(
+        &self,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        let fs = &self.0.fs;
+        fs.open(&fs.parent(dentry)?, dentry, how)
     }
 }
 
-impl Filesystem for Overlay {
-    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.open(path, options)
+impl InodeOperations for OverlayLink {
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.0.real_getattr(dentry)
     }
 
-    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.metadata(path)
+    /// Where the link points, as `ovl_get_link` asks the real dentry.
+    fn get_link(&self, dentry: &Dentry) -> Result<String, FilesystemError> {
+        let (real, _) = real_of(dentry).ok_or(FilesystemError::NotFound)?;
+        real.get_link()
     }
+}
 
-    fn symlink_metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.symlink_metadata(path)
+impl FileSystemType for Overlay {
+    /// With no upper nothing can change, as `ovl_fill_super` sets `SB_RDONLY`.
+    /// Its root takes the identity its topmost Layer's root recorded, as
+    /// `ovl_get_root` reads a real root's `i_ino`, so making the view asks no
+    /// Layer anything.
+    fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+        sb.set_default_d_op(self.clone());
+        if !self.fs.has_upper() {
+            sb.set_rdonly();
+        }
+        let root = Kstat::new(FileType::Dir, 0);
+        let root = match self.fs.root_identity() {
+            Some(identity) => identity.onto(root),
+            None => root,
+        };
+        let root_dir = self.fs.root_dir();
+        let root = Inode::new(&root, self);
+        inode::ovl_inode_init(&root, root_dir);
+        sb.d_make_root(root);
+        Ok(())
     }
+}
 
-    fn stored_path(&self, path: &str) -> Result<String, FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.stored_path(path)
+/// A directory of the view, finding what a call is about through the dentry it
+/// is handed, as `ovl_dir_inode_operations` answers for one.
+impl InodeOperations for Overlay {
+    /// It reports its merged Layers.
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.fs.dir_getattr(&self.fs.dir(dentry)?.level())
+    }
+
+    /// Copied up first, as `ovl_setattr` does for any entry, so a lower Layer
+    /// stays as it was.
+    fn setattr(&self, dentry: &Dentry, attr: &Iattr) -> Result<(), FilesystemError> {
+        let upper = self.fs.upper_dir(&self.fs.dir(dentry)?)?;
+        let held = upper.dentry().inode_lock()?;
+        notify_change(upper.dentry(), &held, attr)
+    }
+
+    /// The entry as a Layer spells it, as `ovl_lookup` hands
+    /// `d_splice_alias` the inode it made, a name no Layer could hold refused
+    /// before any is asked, as it compares `namelen`.
+    fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+        let level = self.fs.parent(dentry)?.level();
+        let name = dentry.name();
+        if name.len() > NAME_MAX {
+            return Err(FilesystemError::InvalidFilename);
+        }
+        let Some(found) = self.fs.lookup_layer(&level, &name)? else {
+            return Ok(Lookup::Absent);
+        };
+        let stored_name = found.1.stored_name().to_string();
+        let inode = self
+            .fs
+            .lookup(&level, &stored_name, found, |kind| self.ops_of(kind))?;
+        match stored_name == name {
+            true => Ok(Lookup::Found(inode)),
+            false => Ok(Lookup::Spelled {
+                name: stored_name,
+                inode,
+            }),
+        }
+    }
+
+    fn open(
+        &self,
+        dentry: &Dentry,
+        _how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        let _real = self
+            .fs
+            .dir(dentry)?
+            .level()
+            .iter()
+            .flatten()
+            .map(OverlayPath::open_real)
+            .collect::<Result<_, _>>()?;
+        let fs = self.fs.clone();
+        Ok(Box::new(OverlayDir {
+            fs,
+            _real,
+            cache: Rdir::default(),
+        }))
     }
 
-    fn canonicalize_beneath(&self, base: &str, path: &str) -> Result<String, FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.canonicalize_beneath(base, path)
+    /// What was made is found through the view's own lookup, as `ovl_instantiate`
+    /// records the inode for the real dentry.
+    fn create(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.fs.create(&self.fs.parent(dentry)?, &dentry.name())?;
+        match self.lookup(dentry)? {
+            Lookup::Found(inode) => dentry.add(Some(inode)),
+            _ => return Err(FilesystemError::NotFound),
+        }
+        Ok(())
     }
 
-    fn hold_directory(&self, path: &str) -> Result<Option<Hold>, FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.hold_directory(path)
+    fn mkdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.fs.mkdir(&self.fs.parent(dentry)?, &dentry.name())
     }
 
-    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.read_dir(path)
+    fn rmdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.fs.rmdir(&self.fs.parent(dentry)?, dentry)
     }
 
-    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.create_dir(path)
+    fn unlink(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.fs.unlink(&self.fs.parent(dentry)?, dentry)
     }
 
-    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.remove_dir(path)
+    /// Both directories lie in one Overlay, however many directories of
+    /// it are open. Only its upper takes a flag, which it asks itself.
+    fn rename(
+        &self,
+        from: &Dentry,
+        _to_dir: &dyn InodeOperations,
+        to: &Dentry,
+        flag: Option<RenameFlag>,
+    ) -> Result<(), FilesystemError> {
+        if flag.is_some() {
+            return Err(FilesystemError::InvalidInput);
+        }
+        self.fs
+            .rename(&self.fs.parent(from)?, from, &self.fs.parent(to)?, to)
     }
+}
+
+/// A directory of the view, open: it merges its Layers each time it is
+/// listed, finding them through the dentry it is handed, and holds each Layer's
+/// directory open while it is, as `struct ovl_dir_file` holds its `realfile`.
+struct OverlayDir {
+    fs: OverlayFs,
+    _real: Vec<Box<dyn FileOperations>>,
+    /// What a listing merged, held until it ends, as `ovl_dir_cache` holds it.
+    cache: Rdir,
+}
 
-    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.remove_file(path)
+impl FileOperations for OverlayDir {
+    fn llseek(
+        &mut self,
+        dentry: &Dentry,
+        pos: u64,
+        offset: i64,
+        whence: Whence,
+    ) -> Result<u64, FilesystemError> {
+        generic_file_llseek(dentry, pos, offset, whence)
     }
 
-    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-        let _held = self.lock.hold()?;
-        self.stack.rename(from, to, rename)
+    fn read_iter(
+        &mut self,
+        _iocb: &mut super::Kiocb,
+        _buf: &mut [u8],
+    ) -> Result<usize, FilesystemError> {
+        generic_read_dir()
     }
 
-    /// A fresh Overlay when any Layer starts each Invocation fresh, over
-    /// each Layer's own next Filesystem. It keeps this Overlay's lock,
-    /// since the Layers it shares are the same.
-    fn for_invocation(&self) -> Option<Arc<dyn Filesystem>> {
-        let stack = self.stack.for_invocation()?;
-        Some(Arc::new(Self {
-            stack,
-            lock: self.lock.clone(),
-        }))
+    fn iterate_shared(
+        &mut self,
+        dentry: &Dentry,
+        ctx: &mut DirContext<'_>,
+    ) -> Result<(), FilesystemError> {
+        let (fs, cache) = (&self.fs, &mut self.cache);
+        cache.iterate(dentry, ctx, || fs.dir_read_merged(&fs.dir(dentry)?.level()))
     }
 
-    /// An Overlay over each Layer's own Filesystem for a Policy, keeping
-    /// this Overlay's lock, since the Layers it shares are the same.
-    fn for_policy(&self) -> Option<Arc<dyn Filesystem>> {
-        let stack = self.stack.for_policy()?;
-        Some(Arc::new(Self {
-            stack,
-            lock: self.lock.clone(),
-        }))
+    /// Its Layers answer for what they hold, and its upper is a Tmpfs, so
+    /// nothing is left to make durable, as `ovl_dir_fsync` finds with no upper
+    /// of its own to sync.
+    fn fsync(&mut self, _datasync: bool) -> Result<(), FilesystemError> {
+        Ok(())
     }
 }
 
@@ -151,96 +430,173 @@ mod tests {
     use std::thread;
     use std::time::{Duration, Instant};
 
-    use super::super::memory::Memory;
-    use super::super::temporary::Temporary;
-    use super::super::{FileType, Hold};
+    use super::super::tmpfs::Tmpfs;
+    use super::super::wrap::{Hook, Wrap};
+    use super::super::{FileType, Finish, Kiocb};
     use super::*;
+    use crate::vfs::kern_path::{kern_path, KernPath};
+    use crate::vfs::Mask;
 
-    /// The answer of a test Filesystem holding no links.
-    macro_rules! holds_no_links {
-        () => {
-            fn symlink_metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-                self.metadata(path)
-            }
+    /// `filesystem` reached through the VFS.
+    fn at(filesystem: impl FileSystemType) -> KernPath {
+        kern_path(Arc::new(filesystem))
+    }
 
-            fn canonicalize_beneath(
-                &self,
-                _base: &str,
-                path: &str,
-            ) -> Result<String, FilesystemError> {
-                Ok(path.to_string())
-            }
+    /// The Filesystem `filesystem` holds, reached through the VFS.
+    fn on<F: FileSystemType>(filesystem: &Arc<F>) -> KernPath {
+        kern_path(filesystem.clone())
+    }
 
-            fn for_policy(&self) -> Option<Arc<dyn Filesystem>> {
-                None
-            }
-        };
+    #[derive(Default)]
+    struct CountsLookups(AtomicUsize);
+
+    impl Hook for CountsLookups {
+        fn lookup(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+        ) -> Result<Lookup, FilesystemError> {
+            self.0.fetch_add(1, Ordering::SeqCst);
+            inner.lookup(dentry)
+        }
     }
 
-    /// The answer of a test Filesystem matching names byte for byte.
-    macro_rules! matches_names_exactly {
-        () => {
-            fn stored_path(&self, path: &str) -> Result<String, FilesystemError> {
-                Ok(path.to_string())
-            }
+    // A Filesystem written in Ruby pays for each ask and keeps no dentry, so a
+    // name found absent, which no Filesystem keeps, shows how often a Layer is
+    // asked by itself.
+    // @behavior FS-184
+    #[test]
+    fn a_lookup_asks_each_layer_once_for_a_name() {
+        let lower: Tmpfs = [("file", "x")].into_iter().collect();
+        let counts = Arc::new(CountsLookups::default());
+        let view = at(Overlay::new(
+            vec![
+                Filesystem::new(Arc::new(Wrap::new(Arc::new(lower), counts.clone())))
+                    .expect("the instance must stand"),
+            ],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack"));
+        let asks = |path: &str| {
+            counts.0.store(0, Ordering::SeqCst);
+            let _ = view.vfs_lstat(path);
+            counts.0.load(Ordering::SeqCst)
         };
+        assert_eq!(
+            (asks("missing"), asks("file")),
+            (1, 1),
+            "a stat through an Overlay of a name its lower Layer lacks, and of one it holds, \
+             must ask that Layer once"
+        );
     }
 
-    /// The answer of a test Filesystem whose identities never repeat.
-    macro_rules! never_repeats_identities {
-        () => {
-            fn hold_directory(&self, _path: &str) -> Result<Option<Hold>, FilesystemError> {
-                Ok(None)
-            }
-        };
+    // Only the upper could refuse the name once the directory was copied up, so
+    // the directory standing nowhere in the upper is what shows no change began.
+    // @behavior FS-183
+    #[test]
+    fn a_name_past_name_max_answers_too_long_and_copies_nothing_up() {
+        let upper = Arc::new(Tmpfs::new());
+        let (view, _lower) = overlay_on(upper.clone());
+        let long = format!("dir/{}", "n".repeat(NAME_MAX + 1));
+        assert_eq!(
+            (
+                view.vfs_lstat(&long).err(),
+                view.vfs_mkdir(&long).err(),
+                on(&upper).vfs_lstat("upper/dir").err(),
+            ),
+            (
+                Some(FilesystemError::InvalidFilename),
+                Some(FilesystemError::InvalidFilename),
+                Some(FilesystemError::NotFound),
+            ),
+            "a stat and a make of a name past NAME_MAX in a lower directory, through an Overlay, \
+             must answer ENAMETOOLONG and leave that directory uncopied"
+        );
     }
 
-    /// The answer of a test Filesystem every Invocation shares.
-    macro_rules! is_shared {
-        () => {
-            fn for_invocation(&self) -> Option<Arc<dyn Filesystem>> {
-                None
-            }
-        };
+    // @behavior FS-140
+    #[test]
+    fn a_file_with_nothing_to_flush_syncs() {
+        let lower: Tmpfs = [("file", "x")].into_iter().collect();
+        let upper = Tmpfs::new();
+        let overlay = at(Overlay::new(
+            vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(upper)).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack"));
+        assert_eq!(
+            open_to_read(&overlay, "file").fsync(false),
+            Ok(()),
+            "FileOperations::fsync on an Overlay's file open to read from a Tmpfs Layer must \
+             succeed"
+        );
+        let tmpfs = at([("file", "x")].into_iter().collect::<Tmpfs>());
+        assert_eq!(
+            open_to_read(&tmpfs, "file").fsync(false),
+            Ok(()),
+            "FileOperations::fsync on a Tmpfs file must succeed"
+        );
     }
 
-    fn read(fs: &dyn Filesystem, path: &str) -> Vec<u8> {
-        let mut file = fs
-            .open(
-                path,
-                &OpenOptions {
-                    read: true,
-                    ..OpenOptions::default()
-                },
-            )
-            .expect("the file must open");
+    fn open_to_read(fs: &KernPath, path: &str) -> Box<dyn FileOperations> {
+        fs.open(
+            path,
+            &OpenHow {
+                read: true,
+                ..OpenHow::default()
+            },
+        )
+        .expect("the file must open to read")
+    }
+
+    fn read_from(file: &mut dyn FileOperations) -> Vec<u8> {
         let mut buf = vec![0; 64];
-        let read = file.read_at(&mut buf, 0).expect("the file must read");
+        let read = file
+            .read_iter(&mut Kiocb::at(0), &mut buf)
+            .expect("the file must read");
         buf.truncate(read);
         buf
     }
 
-    fn write(fs: &dyn Filesystem, path: &str, contents: &[u8]) -> Result<(), FilesystemError> {
-        fs.open(
+    fn read(fs: &KernPath, path: &str) -> Vec<u8> {
+        read_from(open_to_read(fs, path).as_mut())
+    }
+
+    fn write(fs: &KernPath, path: &str, contents: &[u8]) -> Result<(), FilesystemError> {
+        fs.open_or_create(
             path,
-            &OpenOptions {
+            &OpenHow {
                 write: true,
-                create: true,
                 truncate: true,
-                ..OpenOptions::default()
+                ..OpenHow::default()
             },
         )?
-        .write_at(contents, 0)
+        .write_iter(&mut Kiocb::at(0), contents)
         .map(drop)
     }
 
-    fn overwrite(fs: &dyn Filesystem, path: &str, contents: &[u8]) {
+    /// Write at the start of what stands at `path`, so a copy up brings its
+    /// bytes along.
+    fn write_over(fs: &KernPath, path: &str, contents: &[u8]) -> Result<(), FilesystemError> {
+        let how = OpenHow {
+            write: true,
+            ..OpenHow::default()
+        };
+        fs.open(path, &how)?
+            .write_iter(&mut Kiocb::at(0), contents)
+            .map(drop)
+    }
+
+    fn overwrite(fs: &KernPath, path: &str, contents: &[u8]) {
         write(fs, path, contents).expect("the write must land");
     }
 
-    fn names(fs: &dyn Filesystem, path: &str) -> Vec<String> {
-        let mut names: Vec<String> = fs
-            .read_dir(path)
+    fn names(fs: &KernPath, path: &str) -> Vec<String> {
+        let listed = match path {
+            "" => fs.iterate_dir(),
+            path => fs.open_dir(path).and_then(|dir| dir.iterate_dir()),
+        };
+        let mut names: Vec<String> = listed
             .expect("the directory must list")
             .into_iter()
             .map(|entry| entry.name)
@@ -249,18 +605,90 @@ mod tests {
         names
     }
 
-    fn memory_with(path: &str, contents: &str) -> Arc<Memory> {
+    fn tmpfs_with(path: &str, contents: &str) -> Arc<Tmpfs> {
         Arc::new([(path, contents)].into_iter().collect())
     }
 
-    /// A writable `upper` over a read-only Memory holding `dir/file` =
-    /// "lower".
-    fn overlay_on(upper: Arc<dyn Filesystem>) -> (Overlay, Arc<Memory>) {
-        let lower = memory_with("dir/file", "lower");
-        let overlay = Overlay::new()
-            .layer(upper, Access::ReadWrite)
-            .layer(lower.clone(), Access::Read);
-        (overlay, lower)
+    // A helper beneath the VFS skips the super block's read-only answer, so only
+    // the view's own upper standing empty keeps the change off its lower Layers.
+    // @behavior FS-197
+    #[test]
+    fn a_change_reaching_an_overlay_with_no_upper_leaves_its_lower_layers_as_they_are() {
+        let top = tmpfs_with("dir/file", "top");
+        let overlay = at(lowers(top.clone(), Arc::new(Tmpfs::new())));
+        assert_eq!(
+            (
+                overlay.vfs_mkdir("made").err(),
+                on(&top).vfs_lstat("made").err()
+            ),
+            (
+                Some(FilesystemError::ReadOnlyFilesystem),
+                Some(FilesystemError::NotFound)
+            ),
+            "OverlayFs::mkdir with no upper, reached beneath the VFS's read-only answer, must \
+             answer EROFS and make nothing in its topmost lower Layer"
+        );
+    }
+
+    /// A security module recording the name of each directory it is asked to
+    /// let change.
+    struct RecordsChanges(Arc<Mutex<Vec<String>>>);
+
+    impl crate::vfs::SecurityOperations for RecordsChanges {
+        fn inode_permission(
+            &self,
+            dentry: &Dentry,
+            mask: crate::vfs::Mask,
+        ) -> Result<(), FilesystemError> {
+            if mask.contains(crate::vfs::Mask::WRITE) {
+                self.0.lock().expect("never poisoned").push(dentry.name());
+            }
+            Ok(())
+        }
+    }
+
+    // A Layer's directories carry names of their own, so a module asked about
+    // one would record more than the view's root.
+    // @behavior FS-198
+    #[test]
+    fn a_call_through_an_overlay_asks_a_module_of_the_view_alone() {
+        let overlay = over(tmpfs_with("f", "x"), Arc::new(Tmpfs::new()));
+        let mount = crate::mount::Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            crate::mount::Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let asked = Arc::new(Mutex::new(Vec::new()));
+        let cred = crate::vfs::Cred::new(vec![Arc::new(RecordsChanges(asked.clone()))]);
+        let root = crate::vfs::Path::root(mount.mnt());
+        let made = crate::vfs::filename_mkdirat(&cred, &root, "d");
+        assert_eq!(
+            (made, asked.lock().expect("never poisoned").clone()),
+            (Ok(()), vec![String::new()]),
+            "vfs::filename_mkdirat through an Overlay must ask a security module of the view's \
+             directory alone, as overlayfs makes its Layers' calls with its creator_cred"
+        );
+    }
+
+    /// `upper` over the one lower Layer `lower`.
+    fn over(lower: Arc<dyn FileSystemType>, upper: Arc<Tmpfs>) -> Overlay {
+        let instance = |fs| Filesystem::new(fs).expect("the instance must stand");
+        Overlay::new(vec![instance(lower)], Some(instance(upper)))
+            .expect("an upper over a lower Layer must make a view")
+    }
+
+    /// The lower Layers `top` over `bottom`, with no upper.
+    fn lowers(top: Arc<dyn FileSystemType>, bottom: Arc<dyn FileSystemType>) -> Overlay {
+        let instance = |fs| Filesystem::new(fs).expect("the instance must stand");
+        Overlay::new(vec![instance(top), instance(bottom)], None)
+            .expect("two lower Layers must make a view")
+    }
+
+    /// `upper` over a lower Tmpfs holding `dir/file` = "lower".
+    fn overlay_on(upper: Arc<Tmpfs>) -> (KernPath, Arc<Tmpfs>) {
+        let lower = tmpfs_with("dir/file", "lower");
+        (at(over(lower.clone(), upper)), lower)
     }
 
     /// A host directory holding `target`, `dir/inner`, and the links `link`
@@ -288,74 +716,67 @@ mod tests {
             Self(path)
         }
 
-        /// A writable Memory over the host directory as a read-only Layer.
-        fn overlay(&self) -> Overlay {
-            let lower =
-                super::super::Directory::new(&self.0).expect("the host directory must open");
-            Overlay::new()
-                .layer(Arc::new(Memory::new()), Access::ReadWrite)
-                .layer(Arc::new(lower), Access::Read)
+        /// An empty upper over the host directory as the lower Layer.
+        fn overlay(&self) -> KernPath {
+            self.under(Arc::new(Tmpfs::new()))
         }
-    }
 
-    #[cfg(unix)]
-    impl Drop for LinkTree {
-        fn drop(&mut self) {
-            let _ = std::fs::remove_dir_all(&self.0);
+        /// The host directory as the lower Layer beneath `upper`.
+        fn under(&self, upper: Arc<Tmpfs>) -> KernPath {
+            at(over(Arc::new(self.bind()), upper))
+        }
+
+        fn bind(&self) -> super::super::Bind {
+            super::super::Bind::new(&self.0).expect("the host directory must open")
         }
     }
 
-    // The link points at a file in the same Layer, so only a lookup that
-    // reaches the Layer's own `symlink_metadata` can answer a link.
-    // The links stand in the Directory Layer beneath a Memory one, so only
-    // the merged view handing them to the Layer holding them resolves them.
-    // @behavior FS-098
+    // The upper Layer's `dirlink` is a directory and the lower one's a link,
+    // so only merging directory over directory keeps the lower link's
+    // target out of the view.
+    // @behavior FS-113
     #[cfg(unix)]
     #[test]
-    fn an_overlay_follows_a_link_beneath_a_directory_within_the_layer_holding_it() {
-        let host = LinkTree::new("beneath");
-        std::fs::create_dir_all(host.0.join("dir/sub"))
-            .expect("the host directory must be created");
-        std::fs::write(host.0.join("dir/sub/y"), "inner").expect("the inner file must be written");
-        std::os::unix::fs::symlink("sub", host.0.join("dir/in")).expect("the link must be made");
-        std::os::unix::fs::symlink("../target", host.0.join("dir/up"))
-            .expect("the link must be made");
-        let overlay = host.overlay();
+    fn a_lower_layers_link_beneath_an_upper_directory_is_not_merged() {
+        let tree = LinkTree::new("not-merged");
+        let overlay = tree.under(tmpfs_with("upper/dirlink/.keep", ""));
+        overlay
+            .vfs_unlink("dirlink/.keep")
+            .expect("the seed must go");
         assert_eq!(
             (
-                overlay.canonicalize_beneath("dir", "in/y"),
-                overlay.canonicalize_beneath("dir", "up"),
+                kind(&overlay, "dirlink/inner"),
+                names(&overlay, "dirlink").len()
             ),
-            (Ok("sub/y".to_string()), Err(FilesystemError::NotPermitted)),
-            "a link a Directory Layer holds within `dir`, resolved through \
-             Overlay::canonicalize_beneath, must resolve to where it leads, and one leading out \
-             of `dir` must not be permitted"
+            (Err(FilesystemError::NotFound), 0),
+            "a name beneath a directory an upper Layer holds, where a lower Layer holds a link, \
+             through vfs_lstat and its listing must show nothing the link leads to"
         );
     }
 
-    // The link stands in the Directory Layer beneath a Memory one, so only
-    // the Overlay handing each Layer's own Filesystem for a Policy refuses it.
+    #[cfg(unix)]
+    impl Drop for LinkTree {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    // The link stands in the Bind Layer beneath a Tmpfs one, so only
+    // the Overlay asking that Layer without following refuses it.
     // @behavior FS-100
     #[cfg(unix)]
     #[test]
-    fn an_overlay_for_a_policy_follows_no_link_in_any_layer() {
-        let host = LinkTree::new("for-policy");
+    fn an_overlay_opens_no_link_as_a_directory_where_asked_not_to_follow() {
+        let host = LinkTree::new("nofollow");
         let overlay = host.overlay();
-        let reading = OpenOptions {
-            read: true,
-            ..OpenOptions::default()
-        };
-        let for_policy = overlay
-            .for_policy()
-            .expect("an Overlay over a Directory has a Filesystem for a Policy");
         assert_eq!(
             (
-                overlay.open("dirlink/inner", &reading).map(drop),
-                for_policy.open("dirlink/inner", &reading).map(drop),
+                overlay.open_dir("dirlink").map(drop),
+                overlay.vfs_readlink("dirlink")
             ),
-            (Ok(()), Err(FilesystemError::FilesystemLoop)),
-            "a path through a link a Directory Layer holds, opened through an Overlay's \
-             for_policy, must be a link loop, where the Overlay itself reaches it"
+            (Err(FilesystemError::FilesystemLoop), Ok("dir".to_string())),
+            "a link a Bind Layer holds, opened through Overlay::open_dir, must be a \
+             link loop, and through vfs_readlink must answer where it points"
         );
     }
 
@@ -365,16 +786,12 @@ mod tests {
     fn an_overlay_reports_a_link_its_layer_holds_as_a_link() {
         let host = LinkTree::new("lstat");
         let overlay = host.overlay();
-        let file_type = |path| {
-            overlay
-                .symlink_metadata(path)
-                .map(|metadata| metadata.file_type)
-        };
+        let file_type = |path| kind(&overlay, path);
         assert_eq!(
             (file_type("link"), file_type("dangling")),
             (Ok(FileType::Symlink), Ok(FileType::Symlink)),
-            "a link a Directory Layer holds, pointing at a file or at nothing, looked up through \
-             Overlay::symlink_metadata must be reported as a link"
+            "a link a Bind Layer holds, pointing at a file or at nothing, looked up through \
+             vfs_lstat must be reported as a link"
         );
     }
 
@@ -387,11 +804,11 @@ mod tests {
         let host = LinkTree::new("unlink");
         let overlay = host.overlay();
         let removed = (
-            overlay.remove_dir("dirlink"),
-            overlay.remove_file("dirlink"),
-            overlay.remove_file("dangling"),
+            overlay.vfs_rmdir("dirlink"),
+            overlay.vfs_unlink("dirlink"),
+            overlay.vfs_unlink("dangling"),
         );
-        let gone = |path| overlay.symlink_metadata(path).err();
+        let gone = |path| overlay.vfs_lstat(path).err();
         assert_eq!(
             (
                 removed,
@@ -405,8 +822,8 @@ mod tests {
                 Some(FilesystemError::NotFound),
                 true
             ),
-            "a link a read-only Directory Layer holds, removed through Overlay::remove_dir and \
-             Overlay::remove_file, must be refused as no directory and then removed as itself, \
+            "a link a read-only Bind Layer holds, removed through vfs_rmdir and \
+             vfs_unlink, must be refused as no directory and then removed as itself, \
              leaving the Layer as it was"
         );
     }
@@ -428,13 +845,13 @@ mod tests {
         assert_eq!(
             (
                 write(&overlay, "pipe", b"upper"),
-                overlay.rename("pipe", "moved", Rename::File)
+                overlay.rename("pipe", &overlay, "moved")
             ),
             (
                 Err(FilesystemError::PermissionDenied),
                 Err(FilesystemError::CrossesDevices)
             ),
-            "a FIFO a read-only Directory Layer holds, written or renamed through an Overlay, must \
+            "a FIFO a read-only Bind Layer holds, written or renamed through an Overlay, must \
              be refused as permission denied and as crossing devices"
         );
     }
@@ -454,181 +871,287 @@ mod tests {
         assert!(made.success(), "the FIFO must be made");
         let overlay = host.overlay();
         overlay
-            .create_dir("made")
-            .expect("a directory must be made in the writable Layer");
-        let file_type = |path| overlay.metadata(path).map(|metadata| metadata.file_type);
+            .vfs_mkdir("made")
+            .expect("a directory must be made in the upper");
+        let file_type = |path| kind(&overlay, path);
         assert_eq!(
             (
-                overlay.rename("pipe", "dir", Rename::Any),
-                overlay.rename("made", "pipe", Rename::Any),
+                overlay.rename("pipe", &overlay, "dir"),
+                overlay.rename("made", &overlay, "pipe"),
                 file_type("pipe"),
                 file_type("made"),
             ),
             (
                 Err(FilesystemError::IsADirectory),
                 Err(FilesystemError::NotADirectory),
-                Ok(FileType::Unknown),
-                Ok(FileType::Directory)
+                Ok(FileType::Fifo),
+                Ok(FileType::Dir)
             ),
             "a FIFO renamed onto a directory through an Overlay must be refused as a directory, \
              and a directory renamed onto a FIFO as no directory, leaving both in place"
         );
     }
 
-    // Each change would land in the writable Memory, which holds no link,
-    // so only refusing it keeps the write from parting with its target.
+    /// A lower Layer whose one file, `file`, would keep any time it is asked
+    /// to, recording that it was.
+    struct KeepsTimes(Arc<AtomicUsize>);
+
+    impl FileSystemType for KeepsTimes {
+        fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+            sb.d_make_root(Inode::new(&Kstat::new(FileType::Dir, 0), self));
+            Ok(())
+        }
+    }
+
+    impl InodeOperations for KeepsTimes {
+        fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+            Ok(match dentry.name().as_str() {
+                "file" => Kstat::new(FileType::RegFile, 0).with_identity(1, 2),
+                _ => Kstat::new(FileType::Dir, 0).with_identity(1, 1),
+            })
+        }
+
+        fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+            Ok(match dentry.name().as_str() {
+                "file" => Lookup::Found(Inode::new(
+                    &Kstat::new(FileType::RegFile, 0).with_identity(1, 2),
+                    Arc::new(Self(self.0.clone())),
+                )),
+                _ => Lookup::Absent,
+            })
+        }
+
+        fn setattr(&self, _dentry: &Dentry, _attr: &Iattr) -> Result<(), FilesystemError> {
+            self.0.fetch_add(1, Ordering::SeqCst);
+            Ok(())
+        }
+
+        fn open(
+            &self,
+            _dentry: &Dentry,
+            _how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            struct Empty;
+            impl FileOperations for Empty {
+                fn read_iter(
+                    &mut self,
+                    _iocb: &mut Kiocb,
+                    _buf: &mut [u8],
+                ) -> Result<usize, FilesystemError> {
+                    Ok(0)
+                }
+            }
+            Ok(Box::new(Empty))
+        }
+    }
+
+    // A lower Layer that would keep the time shows the call stopped at the upper.
+    // @behavior FS-147
+    #[test]
+    fn a_time_set_through_an_overlay_leaves_its_lower_layer_as_it_was() {
+        let asked = Arc::new(AtomicUsize::new(0));
+        let upper = Arc::new(Tmpfs::new());
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(KeepsTimes(asked.clone())))
+                .expect("the instance must stand")],
+            Some(Filesystem::new(upper.clone()).expect("the instance must stand")),
+        )
+        .unwrap_or_else(|_| panic!("the Overlay must make"));
+        let mount = crate::mount::Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            crate::mount::Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let answer = crate::vfs::do_utimes_path(
+            &Arc::default(),
+            &crate::vfs::Path::root(mount.mnt()),
+            "file",
+            false,
+            &Iattr::times(None, Some(crate::filesystem::SetTime::Now)),
+        );
+        assert_eq!(
+            (
+                answer,
+                asked.load(Ordering::SeqCst),
+                kern_path(upper).vfs_lstat("upper/file").is_ok()
+            ),
+            (Ok(()), 0, true),
+            "vfs::do_utimes_paththrough an Overlay on a file of its lower Layer must copy the file \
+             up, set the time there, and never ask the lower Layer"
+        );
+    }
+
+    // A recursive climb needs more than this stack at this depth, in a build
+    // of any optimization, so only a loop passes.
+    // @behavior FS-146
+    #[test]
+    fn a_change_copies_up_however_deep_it_lands() {
+        let deep = vec!["a"; 1500].join("/");
+        let lower: Tmpfs = [(format!("{deep}/file"), "x")].into_iter().collect();
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .unwrap_or_else(|_| panic!("the Overlay must make"));
+        let made = std::thread::Builder::new()
+            .stack_size(256 * 1024)
+            .spawn(move || {
+                let view = kern_path(Arc::new(overlay));
+                view.vfs_mkdir(&format!("{deep}/made"))?;
+                view.vfs_lstat(&format!("{deep}/made"))
+                    .map(|found| found.file_type)
+            })
+            .expect("the thread must start")
+            .join()
+            .expect("the thread must not panic");
+        assert_eq!(
+            made,
+            Ok(FileType::Dir),
+            "a directory made 1500 directories deep in a lower Layer, through an Overlay on a \
+             256 KiB stack, must copy every directory above it up and stand"
+        );
+    }
+
+    // The upper is a Tmpfs, which holds no link, so a link cannot land there.
     // @behavior FS-051
     #[cfg(unix)]
     #[test]
-    fn an_overlay_refuses_a_change_through_a_link_its_read_only_layer_holds() {
+    fn an_overlay_refuses_to_move_a_link_its_read_only_layer_holds() {
         let host = LinkTree::new("through");
         let overlay = host.overlay();
-        let creates = OpenOptions {
-            write: true,
-            create: true,
-            ..OpenOptions::default()
-        };
-        let refused = [
-            write(&overlay, "link", b"upper"),
-            overlay.open("dirlink/new", &creates).map(drop),
-            overlay.open("dangling", &creates).map(drop),
-            overlay.rename("link", "moved", Rename::Any),
-        ];
         assert_eq!(
-            (refused, read(&overlay, "target")),
             (
-                [
-                    Err(FilesystemError::CrossesDevices),
-                    Err(FilesystemError::CrossesDevices),
-                    Err(FilesystemError::CrossesDevices),
-                    Err(FilesystemError::CrossesDevices)
-                ],
-                b"lower".to_vec()
+                overlay.rename("link", &overlay, "moved"),
+                read(&overlay, "target")
             ),
-            "a write, a create, and a rename reaching through a link a read-only Directory Layer \
-             holds, through an Overlay, must be refused as crossing devices and leave the target \
-             as it was"
+            (Err(FilesystemError::CrossesDevices), b"lower".to_vec()),
+            "a rename of a link a read-only Bind Layer holds, through an Overlay, must be refused \
+             as crossing devices and leave the target as it was"
         );
     }
 
-    // The lower Memory holds a readable `dangling`, so only the upper
+    // The lower Tmpfs holds a readable `dangling`, so only the upper
     // link standing at that path can keep the read from reaching it.
     // @behavior FS-053
     #[cfg(unix)]
     #[test]
     fn a_link_a_layer_holds_hides_what_the_layers_below_hold_there() {
         let host = LinkTree::new("shadow");
-        let upper = super::super::Directory::new(&host.0).expect("the host directory must open");
-        let overlay = Overlay::new()
-            .layer(Arc::new(upper), Access::ReadWrite)
-            .layer(memory_with("dangling", "lower"), Access::Read);
+        let overlay = at(lowers(
+            Arc::new(host.bind()),
+            tmpfs_with("dangling", "lower"),
+        ));
         assert_eq!(
             overlay
                 .open(
                     "dangling",
-                    &OpenOptions {
+                    &OpenHow {
                         read: true,
-                        ..OpenOptions::default()
+                        ..OpenHow::default()
                     }
                 )
                 .map(drop),
-            Err(FilesystemError::NotFound),
-            "a lower file beneath a dangling link a higher Directory Layer holds at its path, \
-             opened through Overlay::open, must not be found"
+            Err(FilesystemError::FilesystemLoop),
+            "a lower file beneath a dangling link a higher Bind Layer holds at its path, \
+             opened through Overlay::open, must be refused as the link, the file unreached"
         );
     }
 
-    // The lower Memory holds `dirlink/x` beside where the upper link points,
+    // The lower Tmpfs holds `dirlink/x` beside where the upper link points,
     // so only the link hiding everything beneath it keeps `x` out.
     // @behavior FS-057
     #[cfg(unix)]
     #[test]
     fn a_link_a_layer_holds_hides_what_the_layers_below_hold_beneath_it() {
         let host = LinkTree::new("shadow-beneath");
-        let upper = super::super::Directory::new(&host.0).expect("the host directory must open");
-        let overlay = Overlay::new()
-            .layer(Arc::new(upper), Access::ReadWrite)
-            .layer(memory_with("dirlink/x", "lower"), Access::Read);
-        let found = overlay
-            .metadata("dirlink/x")
-            .map(|metadata| metadata.file_type);
+        let overlay = at(lowers(
+            Arc::new(host.bind()),
+            tmpfs_with("dirlink/x", "lower"),
+        ));
         assert_eq!(
-            (names(&overlay, "dirlink"), found),
-            (vec!["inner".to_string()], Err(FilesystemError::NotFound)),
-            "a directory a higher Directory Layer holds as a link, listed and looked into through \
-             an Overlay, must show only where the link points and none of a lower Layer's entries"
+            (
+                overlay
+                    .vfs_lstat("dirlink")
+                    .map(|metadata| metadata.file_type),
+                overlay.open_dir("dirlink").map(drop)
+            ),
+            (Ok(FileType::Symlink), Err(FilesystemError::FilesystemLoop)),
+            "a directory a higher Bind Layer holds as a link, looked up and opened through an \
+             Overlay, must stand as the link, so none of a lower Layer's entries beneath it show"
         );
     }
 
-    // The lower directory sits in a writable Layer, so only the whiteout,
-    // not a removal that cannot take a directory, keeps the view whole.
+    // The lower directory stays in its Layer, so only the whiteout keeps
+    // it from showing once the upper file goes.
     // @behavior FS-058
     #[test]
     fn removing_a_file_over_a_lower_directory_leaves_it_hidden() {
-        let lower = memory_with("f/g", "lower");
-        let overlay = Overlay::new()
-            .layer(memory_with("f", "upper"), Access::ReadWrite)
-            .layer(lower.clone(), Access::ReadWrite);
-        let removed = overlay.remove_file("f");
+        let lower = tmpfs_with("f/g", "lower");
+        let overlay = at(over(lower.clone(), tmpfs_with("upper/f", "upper")));
+        let removed = overlay.vfs_unlink("f");
         assert_eq!(
             (
                 removed,
-                overlay.symlink_metadata("f").err(),
-                lower.metadata("f/g").is_ok()
+                overlay.vfs_lstat("f").err(),
+                on(&lower).vfs_lstat("f/g").is_ok()
             ),
             (Ok(()), Some(FilesystemError::NotFound), true),
             "a file a higher Layer holds over a lower Layer's directory, removed through \
-             Overlay::remove_file, must leave the path gone from the view and the lower \
+             vfs_unlink, must leave the path gone from the view and the lower \
              directory as it was"
         );
     }
 
-    // The writable Layer's `dir` holds only the whiteout hiding `file`, so
+    // The upper's `dir` holds only the whiteout hiding `file`, so
     // only judging the view, not that copy, lets the move go.
     // @behavior FS-059
     #[test]
     fn a_directory_moves_onto_one_holding_only_markers() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
         overlay
-            .remove_file("dir/file")
+            .vfs_unlink("dir/file")
             .expect("the file must be removed");
         overlay
-            .create_dir("new")
+            .vfs_mkdir("new")
             .expect("the directory must be made");
         overwrite(&overlay, "new/made", b"made");
-        let moved = overlay.rename("new", "dir", Rename::Directory);
+        let moved = overlay.rename("new", &overlay, "dir");
         assert_eq!(
             (moved, names(&overlay, "dir")),
             (Ok(()), vec!["made".to_string()]),
             "a directory renamed through Overlay::rename onto one the view shows empty, whose \
-             writable copy holds only a whiteout, must take its place and show only its own entries"
+             upper copy holds only a whiteout, must take its place and show only its own entries"
         );
     }
 
-    // The directory made again is marked opaque in the writable Layer, so
-    // only that mark tells it apart from one the read-only Layer still holds.
+    // The directory made again is marked opaque in the upper, so only that
+    // mark tells it apart from one the lower Layer still holds.
     // @behavior FS-060
     #[test]
-    fn a_directory_made_again_moves_as_the_writable_layers_own() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
+    fn a_directory_made_again_moves_as_the_uppers_own() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
         overlay
-            .remove_file("dir/file")
+            .vfs_unlink("dir/file")
             .expect("the file must be removed");
         overlay
-            .remove_dir("dir")
+            .vfs_rmdir("dir")
             .expect("the directory must be removed");
         overlay
-            .create_dir("dir")
+            .vfs_mkdir("dir")
             .expect("the directory must be made again");
-        let moved = overlay.rename("dir", "moved", Rename::Directory);
+        let moved = overlay.rename("dir", &overlay, "moved");
         assert_eq!(
             (
                 moved,
-                overlay.metadata("dir").err(),
-                overlay.read_dir("moved").map(|entries| entries.len())
+                overlay.vfs_lstat("dir").err(),
+                overlay
+                    .open_dir("moved")
+                    .and_then(|dir| dir.iterate_dir())
+                    .map(|entries| entries.len())
             ),
             (Ok(()), Some(FilesystemError::NotFound), Ok(0)),
-            "a directory made again through an Overlay where a read-only Layer's one was removed, \
+            "a directory made again through an Overlay where a lower Layer's one was removed, \
              renamed through Overlay::rename, must move and leave nothing of the lower one behind"
         );
     }
@@ -636,9 +1159,9 @@ mod tests {
     // @behavior FS-061
     #[test]
     fn an_overlay_refuses_a_file_moved_beneath_itself_as_no_directory() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
         assert_eq!(
-            overlay.rename("dir/file", "dir/file/x", Rename::Any),
+            overlay.rename("dir/file", &overlay, "dir/file/x"),
             Err(FilesystemError::NotADirectory),
             "a file renamed through Overlay::rename to a path beneath itself must be refused as \
              no directory, as rename(2) refuses it"
@@ -653,21 +1176,20 @@ mod tests {
     fn an_overlay_finds_a_dangling_link_where_a_new_entry_would_go() {
         let host = LinkTree::new("dangling");
         let overlay = host.overlay();
-        let exclusive = OpenOptions {
+        let exclusive = OpenHow {
             write: true,
-            create_new: true,
-            ..OpenOptions::default()
+            ..OpenHow::default()
         };
         assert_eq!(
             (
-                overlay.open("dangling", &exclusive).map(drop),
-                overlay.create_dir("dangling")
+                overlay.create("dangling", &exclusive).map(drop),
+                overlay.vfs_mkdir("dangling")
             ),
             (
                 Err(FilesystemError::AlreadyExists),
                 Err(FilesystemError::AlreadyExists)
             ),
-            "an exclusive create and a create_dir at a dangling link a read-only Directory Layer \
+            "an exclusive create and a create_dir at a dangling link a lower Bind Layer \
              holds, through an Overlay, must find it already there"
         );
     }
@@ -675,7 +1197,7 @@ mod tests {
     // @behavior FS-008
     #[test]
     fn an_overlay_reads_through_to_a_lower_layer() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
         assert_eq!(
             read(&overlay, "dir/file"),
             b"lower",
@@ -685,67 +1207,53 @@ mod tests {
 
     // @behavior FS-009
     #[test]
-    fn a_write_to_a_read_only_layers_file_lands_in_the_nearest_writable_layer_above_it() {
-        let upper = Arc::new(Memory::new());
+    fn a_write_to_a_lower_layers_file_lands_in_the_upper() {
+        let upper = Arc::new(Tmpfs::new());
         let (overlay, _) = overlay_on(upper.clone());
         overwrite(&overlay, "dir/file", b"upper");
         assert_eq!(
-            read(upper.as_ref(), "dir/file"),
+            read(&on(&upper), "upper/dir/file"),
             b"upper",
-            "a read-only Layer's file written through Overlay::open must land in the writable Layer above it"
+            "a lower Layer's file written through Overlay::open must land in the upper"
         );
     }
 
     // @behavior FS-010
     #[test]
-    fn an_overlay_leaves_a_read_only_layer_as_it_was() {
-        let (overlay, lower) = overlay_on(Arc::new(Memory::new()));
+    fn an_overlay_leaves_a_lower_layer_as_it_was() {
+        let (overlay, lower) = overlay_on(Arc::new(Tmpfs::new()));
         overwrite(&overlay, "dir/file", b"upper");
         overlay
-            .remove_file("dir/file")
+            .vfs_unlink("dir/file")
             .expect("the file must be removed");
         assert_eq!(
-            read(lower.as_ref(), "dir/file"),
+            read(&on(&lower), "dir/file"),
             b"lower",
-            "a read-only Layer's file written and removed through an Overlay must stay as it was"
+            "a lower Layer's file written and removed through an Overlay must stay as it was"
         );
     }
 
     // @behavior FS-011
     #[test]
     fn a_file_removed_through_an_overlay_is_gone_from_its_view() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
         overlay
-            .remove_file("dir/file")
+            .vfs_unlink("dir/file")
             .expect("the file must be removed");
         assert_eq!(
-            overlay.metadata("dir/file"),
+            overlay.vfs_lstat("dir/file"),
             Err(FilesystemError::NotFound),
-            "a lower file removed through Overlay::remove_file must no longer be found there"
-        );
-    }
-
-    // @behavior FS-012
-    #[test]
-    fn an_overlay_over_a_temporary_starts_every_invocation_from_its_lower_layers() {
-        let (overlay, _) = overlay_on(Arc::new(Temporary::new()));
-        overwrite(&overlay, "dir/file", b"upper");
-        let next = overlay
-            .for_invocation()
-            .expect("an Overlay over a Temporary must start each Invocation afresh");
-        assert_eq!(
-            read(next.as_ref(), "dir/file"),
-            b"lower",
-            "Overlay::for_invocation over a Temporary must hand the next Invocation the lower content"
+            "a lower file removed through vfs_unlink must no longer be found there"
         );
     }
 
     // @behavior FS-013
     #[test]
     fn an_upper_layer_hides_the_same_path_in_a_lower_one() {
-        let overlay = Overlay::new()
-            .layer(memory_with("note", "upper"), Access::Read)
-            .layer(memory_with("note", "lower"), Access::Read);
+        let overlay = at(lowers(
+            tmpfs_with("note", "upper"),
+            tmpfs_with("note", "lower"),
+        ));
         assert_eq!(
             read(&overlay, "note"),
             b"upper",
@@ -755,267 +1263,586 @@ mod tests {
 
     // @behavior FS-014
     #[test]
-    fn a_write_to_a_writable_layers_file_changes_it_in_place() {
-        let upper = Arc::new(Memory::new());
-        let lower = memory_with("note", "lower");
-        let overlay = Overlay::new()
-            .layer(upper.clone(), Access::ReadWrite)
-            .layer(lower.clone(), Access::ReadWrite);
+    fn a_write_to_the_uppers_file_changes_it_in_place() {
+        let upper = tmpfs_with("upper/note", "upper");
+        let overlay = at(over(tmpfs_with("note", "lower"), upper.clone()));
         overwrite(&overlay, "note", b"changed");
         assert_eq!(
-            (read(lower.as_ref(), "note"), upper.metadata("note")),
-            (b"changed".to_vec(), Err(FilesystemError::NotFound)),
-            "a writable lower Layer's file written through Overlay::open must change in that Layer alone"
+            read(&on(&upper), "upper/note"),
+            b"changed",
+            "the upper's file written through Overlay::open must change in place"
         );
     }
 
-    // The lower Layer is writable, so only the refusal itself keeps the
-    // move from landing in two Layers.
-    // @behavior FS-088
+    // @behavior FS-015
     #[test]
-    fn an_overlay_refuses_to_move_a_file_a_lower_writable_layer_holds() {
-        let upper = Arc::new(Memory::new());
-        let lower = memory_with("note", "lower");
-        let overlay = Overlay::new()
-            .layer(upper.clone(), Access::ReadWrite)
-            .layer(lower.clone(), Access::ReadWrite);
+    fn a_new_file_lands_in_the_upper() {
+        let upper = Arc::new(Tmpfs::new());
+        let lower = Arc::new(Tmpfs::new());
+        let overlay = at(over(lower.clone(), upper.clone()));
+        overwrite(&overlay, "new", b"made");
         assert_eq!(
-            (
-                overlay.rename("note", "moved", Rename::File),
-                read(lower.as_ref(), "note"),
-                upper.read_dir("").map(|entries| entries.len())
-            ),
-            (Err(FilesystemError::CrossesDevices), b"lower".to_vec(), Ok(0)),
-            "a file a lower writable Layer holds, renamed through Overlay::rename, must be refused \
-             as crossing devices with nothing moved or copied"
+            (read(&on(&upper), "upper/new"), on(&lower).vfs_lstat("new")),
+            (b"made".to_vec(), Err(FilesystemError::NotFound)),
+            "a file created through Overlay::open must land in the upper alone"
         );
     }
 
-    // The writable Layer keeps the whiteout the removal left, so only a
-    // call that answers by what landed rather than by the clean-up after
-    // it succeeds.
-    // @behavior FS-089
+    // @behavior FS-016
     #[test]
-    fn an_overlay_change_that_lands_succeeds_though_its_whiteout_stays() {
-        let (overlay, _) = overlay_on(Arc::new(KeepsWhiteouts(Memory::new())));
+    fn a_removal_leaves_a_whiteout_in_the_upper() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, _) = overlay_on(upper.clone());
         overlay
-            .remove_file("dir/file")
+            .vfs_unlink("dir/file")
             .expect("the file must be removed");
         assert_eq!(
-            write(&overlay, "dir/file", b"again").map(|()| read(&overlay, "dir/file")),
-            Ok(b"again".to_vec()),
-            "a file made again through Overlay::open where it was removed, while the writable \
-             Layer refuses to remove the whiteout, must succeed and show the new file"
+            on(&upper)
+                .vfs_lstat("upper/dir/file")
+                .map(|metadata| metadata.file_type),
+            Ok(FileType::Chrdev),
+            "a lower Layer's file removed through vfs_unlink must leave a whiteout, a \
+             device of no kind the guest opens, at its name in the upper"
         );
     }
 
-    // @behavior FS-015
+    // The Layer changes behind the view between the lookup and the listing, so
+    // only Layers bound as the name is found keep the directory it found, as
+    // they cannot be taken for another one by a move in that window.
+    // @behavior FS-165
     #[test]
-    fn a_new_file_lands_in_the_topmost_writable_layer() {
-        let first = Arc::new(Memory::new());
-        let second = Arc::new(Memory::new());
-        let overlay = Overlay::new()
-            .layer(Arc::new(Memory::new()), Access::Read)
-            .layer(first.clone(), Access::ReadWrite)
-            .layer(second.clone(), Access::ReadWrite);
-        overwrite(&overlay, "new", b"made");
+    fn a_directory_found_stands_for_the_layers_it_was_found_in() {
+        use crate::vfs::lookup_one_unlocked;
+        let lower = Arc::new([("dir/old", "x")].into_iter().collect::<Tmpfs>());
+        let overlay = Arc::new(over(lower.clone(), Arc::new(Tmpfs::new())));
+        let filesystem = Filesystem::new(overlay.clone()).expect("the instance must stand");
+        let root = filesystem.s_root();
+        let dir = lookup_one_unlocked(&Default::default(), &filesystem, &root, "dir")
+            .expect("the directory must be found");
+        let layer = on(&lower);
+        layer
+            .rename("dir", &layer, "moved")
+            .expect("the Layer's directory must move");
+        layer.vfs_mkdir("dir").expect("another must be made");
+        overwrite(&layer, "dir/new", b"y");
+        let names: Vec<String> = overlay
+            .fs
+            .dir_read_merged(
+                &overlay
+                    .fs
+                    .dir(&dir)
+                    .expect("the directory must stand")
+                    .level(),
+            )
+            .expect("the directory must list")
+            .into_iter()
+            .map(|entry| entry.name)
+            .collect();
         assert_eq!(
-            (read(first.as_ref(), "new"), second.metadata("new")),
-            (b"made".to_vec(), Err(FilesystemError::NotFound)),
-            "a file created through Overlay::open must land in the topmost writable Layer"
+            names,
+            ["old"],
+            "OverlayFs::dir_read_merged of a directory OverlayFs found before its Layer changed must list \
+             the Layer's directory found with it"
         );
     }
 
-    // @behavior FS-016
+    // What fails after the exchange only a second writer's use of the inodes
+    // can force, so the exchange is called alone: the next walk must find the
+    // empty directory rather than the dentry whose upper no longer matches.
+    // @behavior FS-164
     #[test]
-    fn a_removal_leaves_a_whiteout_in_the_topmost_writable_layer() {
-        let upper = Arc::new(Memory::new());
-        let (overlay, _) = overlay_on(upper.clone());
-        overlay
-            .remove_file("dir/file")
+    fn a_directory_emptied_for_its_removal_stays_empty_should_the_removal_fail() {
+        use crate::vfs::{lookup_one_unlocked, vfs_unlink};
+        let lower = Arc::new([("dir/file", "x")].into_iter().collect::<Tmpfs>());
+        let overlay = Arc::new(over(lower, Arc::new(Tmpfs::new())));
+        let filesystem = Filesystem::new(overlay.clone()).expect("the instance must stand");
+        let root = filesystem.s_root();
+        let dir = lookup_one_unlocked(&Default::default(), &filesystem, &root, "dir")
+            .expect("the directory must be found");
+        let file = lookup_one_unlocked(&Default::default(), &filesystem, &dir, "file")
+            .expect("the file must be found");
+        vfs_unlink(&Default::default(), &filesystem, &dir, &file)
             .expect("the file must be removed");
+        let upper_root = overlay.fs.dir(&root).expect("the root must stand").level()[0]
+            .clone()
+            .expect("the upper shows the root");
+        overlay
+            .fs
+            .clear_empty(&upper_root, "dir")
+            .expect("the directory must be exchanged");
+        let walked = lookup_one_unlocked(&Default::default(), &filesystem, &root, "dir")
+            .expect("the directory must be found again");
+        let names = overlay.fs.dir_read_merged(
+            &overlay
+                .fs
+                .dir(&walked)
+                .expect("the directory must stand")
+                .level(),
+        );
         assert_eq!(
-            upper.metadata("dir/.wh.file").map(|metadata| metadata.file_type),
-            Ok(FileType::File),
-            "a read-only Layer's file removed through Overlay::remove_file must leave .wh.file beside it in the writable Layer"
+            names.map(|entries| entries.len()),
+            Ok(0),
+            "OverlayFs::dir_read_merged of a directory found by a walk after OverlayFs::clear_empty \
+             replaced it must show nothing of the lower Layer below it"
         );
     }
 
     // @behavior FS-017
     #[test]
-    fn a_whiteout_lasts_as_long_as_its_writable_layer() {
-        let upper = Arc::new(Memory::new());
+    fn a_whiteout_lasts_as_long_as_the_upper() {
+        let upper = Arc::new(Tmpfs::new());
         let (overlay, lower) = overlay_on(upper.clone());
         overlay
-            .remove_file("dir/file")
+            .vfs_unlink("dir/file")
             .expect("the file must be removed");
-        let rebuilt = Overlay::new()
-            .layer(upper, Access::ReadWrite)
-            .layer(lower, Access::Read);
+        let rebuilt = at(over(lower, upper));
         assert_eq!(
-            rebuilt.metadata("dir/file"),
+            rebuilt.vfs_lstat("dir/file"),
             Err(FilesystemError::NotFound),
-            "a lower file removed through an Overlay over a Memory must stay gone from a new Overlay over the same Layers"
+            "a lower file removed through an Overlay over a Tmpfs must stay gone from a new Overlay over the same Layers"
         );
     }
 
     // @behavior FS-018
     #[test]
     fn a_directory_made_again_where_one_was_removed_shows_nothing_from_below() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
         overlay
-            .remove_file("dir/file")
+            .vfs_unlink("dir/file")
             .expect("the file must be removed");
         overlay
-            .remove_dir("dir")
+            .vfs_rmdir("dir")
             .expect("the directory must be removed");
         overlay
-            .create_dir("dir")
+            .vfs_mkdir("dir")
             .expect("the directory must be made");
         assert_eq!(
             names(&overlay, "dir"),
             Vec::<String>::new(),
-            "a directory made again through Overlay::create_dir must list nothing from the read-only Layer"
+            "a directory made again through vfs_mkdir must list nothing from the lower Layer"
         );
     }
 
     // @behavior FS-019
     #[test]
     fn an_overlay_lists_none_of_its_markers() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
         overwrite(&overlay, "dir/new", b"made");
         overlay
-            .remove_file("dir/file")
+            .vfs_unlink("dir/file")
             .expect("the file must be removed");
         assert_eq!(
             names(&overlay, "dir"),
             ["new"],
-            "a directory holding a whiteout listed through Overlay::read_dir must show no .wh. entry"
+            "a directory holding a whiteout listed through Overlay::read_dir must not list the \
+             whited-out name"
         );
     }
 
-    // @behavior FS-020
+    // Linux's `ovl_rename` answers ESTALE once the upper moved beneath it; the
+    // view is undefined here, so the promise is only that the call answers,
+    // and the bound turns a hang into a failure.
+    // @behavior FS-204
+    #[test]
+    fn an_upper_changed_beside_its_overlay_still_answers() {
+        use crate::vfs;
+        let (overlay, upper) = beside_its_upper(
+            [("upper/a/x", "x"), ("upper/a/k", "k")]
+                .into_iter()
+                .collect(),
+        );
+        let cred = Arc::default();
+        vfs::vfs_fstatat(&cred, &overlay, "a/x", false).expect("a/x must stand");
+        vfs::filename_renameat2(&cred, &upper, "upper/a", &upper, "upper/b")
+            .expect("the upper's directory must move");
+        let answered = crate::sched::testing::within_max_wait(|| {
+            vfs::filename_renameat2(&cred, &overlay, "a/x", &overlay, "a/y").err()
+        });
+        assert_ne!(
+            answered,
+            Some(FilesystemError::Interrupted),
+            "vfs::filename_renameat2 through an Overlay whose upper another Mount changed must \
+             answer within its bound"
+        );
+    }
+
+    // The lower Layer is a Tmpfs seen through a wrapper, so it reports the
+    // device a whiteout is, yet is no Tmpfs whose marks the Overlay reads.
+    // @behavior FS-203
     #[test]
-    fn an_overlay_refuses_a_name_reserved_for_its_markers() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
+    fn an_overlay_reads_a_whiteout_only_from_a_tmpfs() {
+        let tmpfs = Tmpfs::new();
+        tmpfs.whiteout("device").expect("the device must be made");
+        let lower = Wrap::new(Arc::new(tmpfs), Arc::new(CountsLookups::default()));
+        let overlay = at(over(Arc::new(lower), Arc::new(Tmpfs::new())));
         assert_eq!(
-            write(&overlay, "dir/.wh.note", b"x"),
-            Err(FilesystemError::InvalidInput),
-            "a file named .wh.note created through Overlay::open must be refused"
+            (
+                names(&overlay, ""),
+                overlay.vfs_lstat("device").map(|found| found.file_type)
+            ),
+            (vec!["device".to_string()], Ok(FileType::Chrdev)),
+            "a character device in a lower Layer that is no Tmpfs, listed and stated through an \
+             Overlay, must be listed and found rather than read as a whiteout"
         );
     }
 
-    // A Layer folding case would hold `.WH.note` as the marker hiding `note`.
-    // @behavior FS-056
+    // A whiteout is a device rather than a name, so no name is the
+    // Overlay's to reserve.
+    // @behavior FS-020
     #[test]
-    fn an_overlay_refuses_its_reserved_name_in_any_case() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
+    fn a_name_starting_with_wh_is_an_ordinary_name() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        overwrite(&overlay, "dir/.wh.file", b"made");
         assert_eq!(
-            write(&overlay, "dir/.WH.note", b"x"),
-            Err(FilesystemError::InvalidInput),
-            "a file named .WH.note created through Overlay::open must be refused"
+            (read(&overlay, "dir/.wh.file"), read(&overlay, "dir/file")),
+            (b"made".to_vec(), b"lower".to_vec()),
+            "a file named .wh.file created through Overlay::open must be made, and must hide \
+             nothing"
         );
     }
 
+    /// An Overlay of two lower Layers and no upper on a Mount allowing writes,
+    /// and the root of that Mount.
+    fn mounted_with_no_upper() -> (crate::mount::Mount, crate::vfs::Path) {
+        let overlay = lowers(tmpfs_with("dir/file", "lower"), Arc::new(Tmpfs::new()));
+        let mount = crate::mount::Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            crate::mount::Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = crate::vfs::Path::root(mount.mnt());
+        (mount, root)
+    }
+
     // @behavior FS-021
     #[test]
-    fn an_overlay_with_no_writable_layer_refuses_every_change_as_read_only() {
-        let overlay = Overlay::new().layer(memory_with("dir/file", "lower"), Access::Read);
+    fn an_overlay_with_no_upper_refuses_every_change_as_read_only() {
+        let (mount, root) = mounted_with_no_upper();
+        let how = crate::vfs::OpenHow {
+            write: true,
+            ..Default::default()
+        };
+        let written = crate::vfs::kern_path::filp_open(&Arc::default(), &root, "dir/file", &how);
         assert_eq!(
-            write(&overlay, "dir/file", b"x"),
-            Err(FilesystemError::ReadOnlyFilesystem),
-            "a file written through an Overlay of read-only Layers must be refused as read-only"
+            (written.err(), mount.mnt().is_readonly()),
+            (Some(FilesystemError::ReadOnlyFilesystem), true),
+            "a file opened to write through an Overlay with no upper on a read-write Mount must \
+             be refused as read-only"
         );
     }
 
-    #[test]
-    fn an_overlay_lists_every_layer_without_what_it_hid() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
-        overwrite(&overlay, "dir/new", b"made");
-        assert_eq!(names(&overlay, "dir"), ["file", "new"]);
+    /// A Layer holding a name past what it can hold, as a Layer on a host with
+    /// a shorter limit answers one.
+    struct RefusesLongName;
+
+    impl crate::filesystem::wrap::Hook for RefusesLongName {
+        fn lookup(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+        ) -> Result<Lookup, FilesystemError> {
+            match dentry.name().as_str() {
+                "long" => Err(FilesystemError::InvalidFilename),
+                _ => inner.lookup(dentry),
+            }
+        }
     }
 
+    // `ovl_lookup_single` moves on from ENAMETOOLONG, so a name one Layer cannot
+    // hold is only absent there, and the upper takes it.
+    // @behavior FS-174
     #[test]
-    fn a_lower_file_renamed_through_an_overlay_moves_into_the_writable_layer() {
-        let upper = Arc::new(Memory::new());
-        let (overlay, lower) = overlay_on(upper.clone());
-        overlay
-            .rename("dir/file", "dir/moved", Rename::Any)
-            .expect("the file must move");
+    fn a_name_too_long_for_a_lower_layer_lands_in_the_upper() {
+        let lower =
+            crate::filesystem::wrap::Wrap::new(Arc::new(Tmpfs::new()), Arc::new(RefusesLongName));
+        let upper = Arc::new(Tmpfs::new());
+        let overlay = at(over(Arc::new(lower), upper.clone()));
         assert_eq!(
             (
-                read(&overlay, "dir/moved"),
-                overlay.metadata("dir/file"),
-                read(lower.as_ref(), "dir/file"),
-            ),
-            (
-                b"lower".to_vec(),
-                Err(FilesystemError::NotFound),
-                b"lower".to_vec()
+                overlay.vfs_mkdir("long"),
+                on(&upper)
+                    .vfs_lstat("upper/long")
+                    .map(|found| found.file_type)
             ),
+            (Ok(()), Ok(FileType::Dir)),
+            "a directory made through an Overlay at a name a lower Layer answers ENAMETOOLONG for \
+             must land in the upper"
         );
     }
 
-    /// A Memory that, the first time it lists a directory, starts another
-    /// call through `overlay` on a thread of its own and gives it a while
-    /// to finish, recording whether it did before this call returned.
-    struct Interleaves {
-        memory: Memory,
-        overlay: Mutex<Option<Overlay>>,
-        finished_inside: Mutex<Option<bool>>,
-        other: Mutex<Option<thread::JoinHandle<()>>>,
+    // Replacing the target needs an inode only where it holds whiteouts to clear
+    // away, so with none left only a rename leaving an empty one alone lands.
+    // @behavior FS-175
+    #[test]
+    fn a_rename_onto_an_empty_upper_directory_builds_no_replacement() {
+        let upper = Arc::new(Tmpfs::new().with_nr_inodes(Some(5)));
+        let lower: Tmpfs = [("base", "x")].into_iter().collect();
+        let overlay = at(over(Arc::new(lower), upper));
+        overlay.vfs_mkdir("from").expect("the source must be made");
+        overlay.vfs_mkdir("to").expect("the target must be made");
+        assert_eq!(
+            overlay.rename("from", &overlay, "to"),
+            Ok(()),
+            "a rename through an Overlay of an upper directory onto an empty upper directory, with \
+             no inode left in the upper, must land, as ovl_rename_upper clears only what holds \
+             whiteouts"
+        );
     }
 
-    impl Filesystem for Interleaves {
-        holds_no_links!();
-        never_repeats_identities!();
-        is_shared!();
-        matches_names_exactly!();
+    // overlayfs's `ovl_path_lower` is the topmost lower layer, and its stat of a
+    // merged directory is the real one's, so a Layer's entries change the size.
+    // @behavior FS-176
+    #[test]
+    fn a_merged_directory_reports_its_topmost_layer_under_the_lowers_identity() {
+        let lower: Arc<Tmpfs> = Arc::new([("dir/a", "x"), ("dir/b", "x")].into_iter().collect());
+        let upper = Arc::new(Tmpfs::new());
+        let overlay = at(over(lower.clone(), upper));
+        overlay
+            .vfs_mkdir("dir/made")
+            .expect("the directory must be made");
+        let found = overlay.vfs_lstat("dir").expect("the directory must stand");
+        let below = on(&lower)
+            .vfs_lstat("dir")
+            .expect("the directory must stand");
+        assert_eq!(
+            (found.ino, found.dev, found.nlink, found.size),
+            (below.ino, below.dev, 1, 3 * 20),
+            "a directory two Layers show, stated through an Overlay, must report the lower \
+             Layer's identity, one name, and the size of the upper's directory holding one entry"
+        );
+    }
 
-        fn open(
-            &self,
-            path: &str,
-            options: &OpenOptions,
-        ) -> Result<Box<dyn File>, FilesystemError> {
-            self.memory.open(path, options)
-        }
+    // Bind reports the same identity for both names, so without the view keeping
+    // them apart the VFS would answer the move as having nothing to do.
+    // @behavior FS-170
+    #[cfg(unix)]
+    #[test]
+    fn a_lower_layers_hard_link_moves_onto_the_other_as_two_entries() {
+        let host = LinkTree::new("hard-link");
+        std::fs::write(host.0.join("a"), "one").expect("the host file must be written");
+        std::fs::hard_link(host.0.join("a"), host.0.join("b")).expect("the host link must be made");
+        let overlay = at(over(Arc::new(host.bind()), Arc::new(Tmpfs::new())));
+        write(&overlay, "a", b"two").expect("the file must copy up and be written");
+        overlay
+            .rename("a", &overlay, "b")
+            .expect("the move must land");
+        assert_eq!(
+            (
+                overlay.vfs_lstat("a").map(drop),
+                read(&overlay, "b"),
+                std::fs::read(host.0.join("b")).expect("the host file must be read"),
+            ),
+            (
+                Err(FilesystemError::NotFound),
+                b"two".to_vec(),
+                b"one".to_vec()
+            ),
+            "a hard link in a lower Layer written and moved onto its other name through an \
+             Overlay must leave only the new name, holding what was written, and the lower Layer \
+             as it was"
+        );
+    }
 
-        fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-            self.memory.metadata(path)
-        }
+    // overlayfs's super block is read-only with no upper, so `mnt_want_write`
+    // answers before anything looks at what stands at the name.
+    // @behavior FS-169
+    #[test]
+    fn an_overlay_with_no_upper_refuses_a_change_before_what_stands_answers() {
+        use crate::vfs::{filename_renameat2, filename_rmdir, filename_unlinkat};
+        let (_mount, root) = mounted_with_no_upper();
+        let cred = Arc::default();
+        let read_only = || Err(FilesystemError::ReadOnlyFilesystem);
+        assert_eq!(
+            (
+                filename_renameat2(&cred, &root, "dir/file", &root, "dir/file"),
+                filename_unlinkat(&cred, &root, "missing"),
+                filename_rmdir(&cred, &root, "dir"),
+            ),
+            (read_only(), read_only(), read_only()),
+            "a move onto its own name, a removal of nothing, and a removal of a directory holding \
+             an entry through an Overlay with no upper must each answer EROFS"
+        );
+    }
 
-        fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-            if let Some(overlay) = self.overlay.lock().unwrap().take() {
-                let finished = Arc::new(AtomicUsize::new(0));
-                let marker = finished.clone();
-                let handle = thread::spawn(move || {
-                    let _ = write(&overlay, "dir/new", b"made");
-                    marker.store(1, Ordering::SeqCst);
-                });
-                let deadline = Instant::now() + Duration::from_millis(200);
-                while finished.load(Ordering::SeqCst) == 0 && Instant::now() < deadline {
-                    thread::sleep(Duration::from_millis(5));
-                }
-                *self.finished_inside.lock().unwrap() = Some(finished.load(Ordering::SeqCst) == 1);
-                *self.other.lock().unwrap() = Some(handle);
-            }
-            self.memory.read_dir(path)
-        }
+    /// Why `Overlay::new` refuses `lower` under `upper`, or `None`.
+    fn refusal(
+        lower: Vec<Arc<dyn FileSystemType>>,
+        upper: Option<Arc<dyn FileSystemType>>,
+    ) -> Option<FilesystemError> {
+        let instance = |fs| Filesystem::new(fs).expect("the instance must stand");
+        Overlay::new(
+            lower.into_iter().map(instance).collect(),
+            upper.map(instance),
+        )
+        .err()
+    }
 
-        fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.memory.create_dir(path)
-        }
+    // gVisor takes only an upper that holds its markers, and only a
+    // Tmpfs does here.
+    // @behavior FS-123
+    #[test]
+    fn an_overlay_refuses_an_upper_that_is_no_tmpfs() {
+        let host = std::env::temp_dir();
+        let bind = super::super::Bind::new(&host).expect("the host directory must open");
+        assert_eq!(
+            refusal(vec![Arc::new(Tmpfs::new())], Some(Arc::new(bind))),
+            Some(FilesystemError::InvalidInput),
+            "Overlay::new with a Bind as its upper must be refused as invalid input"
+        );
+    }
 
-        fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.memory.remove_dir(path)
-        }
+    // Nothing else tells these apart: every other rule holds of each list, and
+    // a view over them would show the upper's own workdir.
+    // @behavior FS-148
+    #[test]
+    fn an_overlay_refuses_one_instance_as_two_layers() {
+        let instance = || Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand");
+        let (shared, doubled) = (instance(), instance());
+        assert_eq!(
+            (
+                Overlay::new(vec![shared.clone()], Some(shared)).err(),
+                Overlay::new(vec![doubled.clone(), doubled, instance()], None).err(),
+            ),
+            (
+                Some(FilesystemError::InvalidInput),
+                Some(FilesystemError::InvalidInput),
+            ),
+            "Overlay::new with one instance as its upper and a lower Layer, or as two lower \
+             Layers, must be refused as invalid input"
+        );
+    }
+
+    // @behavior FS-124
+    #[test]
+    fn an_overlay_without_an_upper_needs_two_lower_layers() {
+        assert_eq!(
+            refusal(vec![Arc::new(Tmpfs::new())], None),
+            Some(FilesystemError::InvalidInput),
+            "Overlay::new with one lower Layer and no upper must be refused as invalid input"
+        );
+    }
+
+    // Two Overlays deep is what Linux allows, so only a third is refused.
+    // @behavior FS-126
+    #[test]
+    fn an_overlay_stacks_at_most_two_deep() {
+        let first: Arc<dyn FileSystemType> =
+            Arc::new(lowers(Arc::new(Tmpfs::new()), Arc::new(Tmpfs::new())));
+        let second: Arc<dyn FileSystemType> = Arc::new(over(first.clone(), Arc::new(Tmpfs::new())));
+        assert_eq!(
+            (
+                refusal(vec![first], Some(Arc::new(Tmpfs::new()))),
+                refusal(vec![second], Some(Arc::new(Tmpfs::new())))
+            ),
+            (None, Some(FilesystemError::InvalidInput)),
+            "Overlay::new over an Overlay must make a view, and over an Overlay over an Overlay \
+             must be refused as invalid input"
+        );
+    }
+
+    // @behavior FS-127
+    #[test]
+    fn an_overlay_takes_at_most_five_hundred_lower_layers() {
+        let layers = |count: usize| -> Vec<Arc<dyn FileSystemType>> {
+            (0..count)
+                .map(|_| Arc::new(Tmpfs::new()) as Arc<dyn FileSystemType>)
+                .collect()
+        };
+        assert_eq!(
+            (refusal(layers(500), None), refusal(layers(501), None)),
+            (None, Some(FilesystemError::InvalidInput)),
+            "Overlay::new must take 500 lower Layers and refuse 501 as invalid input"
+        );
+    }
+
+    // @behavior FS-125
+    #[test]
+    fn an_overlay_needs_a_lower_layer() {
+        assert_eq!(
+            refusal(Vec::new(), Some(Arc::new(Tmpfs::new()))),
+            Some(FilesystemError::InvalidInput),
+            "Overlay::new with an upper and no lower Layer must be refused as invalid input"
+        );
+    }
+
+    #[test]
+    fn an_overlay_lists_every_layer_without_what_it_hid() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
+        overwrite(&overlay, "dir/new", b"made");
+        assert_eq!(names(&overlay, "dir"), ["file", "new"]);
+    }
+
+    #[test]
+    fn a_lower_file_renamed_through_an_overlay_moves_into_the_upper() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, lower) = overlay_on(upper.clone());
+        overlay
+            .rename("dir/file", &overlay, "dir/moved")
+            .expect("the file must move");
+        assert_eq!(
+            (
+                read(&overlay, "dir/moved"),
+                overlay.vfs_lstat("dir/file"),
+                read(&on(&lower), "dir/file"),
+            ),
+            (
+                b"lower".to_vec(),
+                Err(FilesystemError::NotFound),
+                b"lower".to_vec()
+            ),
+        );
+    }
+
+    /// Another call through the VFS at `overlay`, started once on a thread
+    /// of its own and given a while to finish, recording whether it did
+    /// before the call starting it went on.
+    #[derive(Default)]
+    struct Interleave {
+        overlay: Mutex<Option<crate::vfs::Path>>,
+        finished_inside: Mutex<Option<bool>>,
+        other: Mutex<Option<thread::JoinHandle<()>>>,
+    }
 
-        fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-            self.memory.remove_file(path)
+    impl Interleave {
+        fn start(&self) {
+            let Some(overlay) = self.overlay.lock().unwrap().take() else {
+                return;
+            };
+            let finished = Arc::new(AtomicUsize::new(0));
+            let marker = finished.clone();
+            let handle = thread::spawn(move || {
+                let how = crate::vfs::OpenHow {
+                    write: true,
+                    create: true,
+                    ..crate::vfs::OpenHow::default()
+                };
+                let _ =
+                    crate::vfs::kern_path::filp_open(&Arc::default(), &overlay, "dir/new", &how);
+                marker.store(1, Ordering::SeqCst);
+            });
+            let deadline = Instant::now() + Duration::from_millis(200);
+            while finished.load(Ordering::SeqCst) == 0 && Instant::now() < deadline {
+                thread::sleep(Duration::from_millis(5));
+            }
+            *self.finished_inside.lock().unwrap() = Some(finished.load(Ordering::SeqCst) == 1);
+            *self.other.lock().unwrap() = Some(handle);
         }
+    }
 
-        fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-            self.memory.rename(from, to, rename)
+    /// A Tmpfs whose directory beneath its root starts `Interleave` the first
+    /// time one is listed, as a removal's emptiness check lists it.
+    impl Hook for Interleave {
+        fn open(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+            how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            if dentry.kind() == Ok(FileType::Dir) && !dentry.is_root() {
+                self.start();
+            }
+            inner.open(dentry, how)
         }
     }
 
@@ -1025,113 +1852,112 @@ mod tests {
     // @behavior FS-037
     #[test]
     fn a_change_through_an_overlay_waits_for_the_one_in_progress() {
-        let upper = Arc::new(Interleaves {
-            memory: [("dir/.keep", "")].into_iter().collect(),
-            overlay: Mutex::new(None),
-            finished_inside: Mutex::new(None),
-            other: Mutex::new(None),
-        });
-        upper
-            .memory
-            .remove_file("dir/.keep")
+        let tmpfs = tmpfs_with("dir/.keep", "");
+        let interleave = Arc::new(Interleave::default());
+        on(&tmpfs)
+            .vfs_unlink("dir/.keep")
             .expect("the seed must go");
-        let overlay = Overlay::new().layer(upper.clone(), Access::ReadWrite);
-        *upper.overlay.lock().unwrap() = Some(overlay.clone());
-        let removed = overlay.remove_dir("dir");
-        upper
+        let mount = crate::mount::Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(over(
+                Arc::new(Wrap::new(tmpfs, interleave.clone())),
+                Arc::new(Tmpfs::new()),
+            )))
+            .expect("the instance must stand"),
+            crate::mount::Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = crate::vfs::Path::root(mount.mnt());
+        *interleave.overlay.lock().unwrap() = Some(root.clone());
+        let removed = crate::vfs::filename_rmdir(&Arc::default(), &root, "dir").is_ok();
+        let other = interleave
             .other
             .lock()
             .unwrap()
             .take()
-            .expect("the other call must have started")
-            .join()
-            .expect("the other call must not panic");
+            .expect("the other call must have started");
+        crate::sched::testing::join("the other call", other);
         assert_eq!(
-            (removed, *upper.finished_inside.lock().unwrap(), overlay.metadata("dir/new").is_ok()),
-            (Ok(()), Some(false), false),
-            "a change through Overlay::open started while Overlay::remove_dir runs must wait for it, \
-             failing rather than landing in the directory being removed"
+            (
+                removed,
+                *interleave.finished_inside.lock().unwrap(),
+                crate::vfs::vfs_fstatat(&Arc::default(), &root, "dir/new", false).is_ok()
+            ),
+            (true, Some(false), false),
+            "a create through vfs::do_file_open into an Overlay directory vfs::filename_rmdir is removing must \
+             wait for it, failing rather than landing in the directory being removed"
         );
     }
 
     // @behavior FS-038
     #[test]
-    fn a_call_through_an_overlay_from_inside_one_answers_a_deadlock() {
+    fn a_change_through_an_overlay_from_inside_one_answers_a_deadlock() {
+        type Answers = (bool, Result<(), FilesystemError>);
+
         struct Reenters {
-            memory: Memory,
-            overlay: Mutex<Option<Overlay>>,
-            answer: Mutex<Option<Result<Metadata, FilesystemError>>>,
+            overlay: Mutex<Option<crate::vfs::Path>>,
+            answer: Mutex<Option<Answers>>,
         }
 
-        impl Filesystem for Reenters {
-            holds_no_links!();
-            never_repeats_identities!();
-            is_shared!();
-            matches_names_exactly!();
-
-            fn open(
+        impl Hook for Reenters {
+            fn getattr(
                 &self,
-                path: &str,
-                options: &OpenOptions,
-            ) -> Result<Box<dyn File>, FilesystemError> {
-                self.memory.open(path, options)
-            }
-
-            fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-                if let Some(overlay) = self.overlay.lock().unwrap().take() {
-                    *self.answer.lock().unwrap() = Some(overlay.metadata(path));
+                inner: &dyn InodeOperations,
+                dentry: &Dentry,
+            ) -> Result<Kstat, FilesystemError> {
+                let reentering = self.overlay.lock().unwrap().take();
+                if let Some(overlay) = reentering {
+                    *self.answer.lock().unwrap() = Some((
+                        crate::vfs::vfs_fstatat(&Arc::default(), &overlay, &dentry.name(), false)
+                            .is_ok(),
+                        crate::vfs::filename_mkdirat(&Arc::default(), &overlay, "made"),
+                    ));
                 }
-                self.memory.metadata(path)
-            }
-
-            fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-                self.memory.read_dir(path)
-            }
-
-            fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-                self.memory.create_dir(path)
-            }
-
-            fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-                self.memory.remove_dir(path)
-            }
-
-            fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-                self.memory.remove_file(path)
-            }
-
-            fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-                self.memory.rename(from, to, rename)
+                inner.getattr(dentry)
             }
         }
 
         let layer = Arc::new(Reenters {
-            memory: [("note", "x")].into_iter().collect(),
             overlay: Mutex::new(None),
             answer: Mutex::new(None),
         });
-        let overlay = Overlay::new().layer(layer.clone(), Access::Read);
-        *layer.overlay.lock().unwrap() = Some(overlay.clone());
-        overlay
-            .metadata("note")
+        let tmpfs: Tmpfs = [("note", "x")].into_iter().collect();
+        let mount = crate::mount::Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(over(
+                Arc::new(Wrap::new(Arc::new(tmpfs), layer.clone())),
+                Arc::new(Tmpfs::new()),
+            )))
+            .expect("the instance must stand"),
+            crate::mount::Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = crate::vfs::Path::root(mount.mnt());
+        *layer.overlay.lock().unwrap() = Some(root.clone());
+        crate::vfs::vfs_fstatat(&Arc::default(), &root, "note", false)
             .expect("the outer call must answer");
+        let answers = layer.answer.lock().unwrap().take();
         assert_eq!(
-            layer.answer.lock().unwrap().take(),
-            Some(Err(FilesystemError::Deadlock)),
-            "a call through an Overlay made from inside one of its own calls on the same thread \
-             must answer Deadlock rather than wait forever"
+            answers,
+            Some((true, Err(FilesystemError::Deadlock))),
+            "a read through an Overlay made from inside one of its own reads on the same thread \
+             must answer, and a change must answer Deadlock rather than wait forever"
         );
     }
 
-    /// A writable Memory seeded with `files` and room for `inodes`, over a
-    /// read-only one holding `dir/file` = "lower".
-    fn full_over_lower(files: &[(&str, &str)], inodes: usize) -> (Overlay, Arc<Memory>) {
-        let upper = Memory::from_iter(files.iter().copied()).with_inodes(Some(inodes));
+    /// An upper whose `upper` is seeded with `files`, with room for
+    /// `inodes` more than its root, `upper`, and `work` take, over a lower
+    /// Tmpfs holding `dir/file` = "lower".
+    fn full_over_lower(files: &[(&str, &str)], inodes: usize) -> (KernPath, Arc<Tmpfs>) {
+        let seeded = files
+            .iter()
+            .map(|(path, contents)| (format!("upper/{path}"), *contents));
+        let upper = Tmpfs::from_iter(seeded).with_nr_inodes(Some(inodes + 3));
         let upper = Arc::new(upper);
-        let overlay = Overlay::new()
-            .layer(upper.clone(), Access::ReadWrite)
-            .layer(memory_with("dir/file", "lower"), Access::Read);
-        (overlay, upper)
+        (
+            at(over(tmpfs_with("dir/file", "lower"), upper.clone())),
+            upper,
+        )
     }
 
     // The upper copy is all the room there is, so the whiteout cannot be
@@ -1139,32 +1965,37 @@ mod tests {
     // @behavior FS-040
     #[test]
     fn a_removal_that_cannot_leave_its_whiteout_removes_nothing() {
-        let (overlay, _) = full_over_lower(&[("dir/file", "upper")], 3);
+        let (overlay, _) = full_over_lower(&[("dir/file", "upper")], 2);
         assert_eq!(
-            (overlay.remove_file("dir/file"), read(&overlay, "dir/file")),
+            (overlay.vfs_unlink("dir/file"), read(&overlay, "dir/file")),
             (Err(FilesystemError::StorageFull), b"upper".to_vec()),
-            "a file removed through Overlay::remove_file whose whiteout finds no room must stay as \
+            "a file removed through vfs_unlink whose whiteout finds no room must stay as \
              it was"
         );
     }
 
+    // The directory is built in the workdir before it replaces the
+    // whiteout, so a workdir with no room leaves the whiteout standing.
     // @behavior FS-041
     #[test]
-    fn a_directory_that_cannot_be_marked_opaque_is_not_made() {
-        let (overlay, upper) = full_over_lower(&[(".wh.dir", "")], 3);
+    fn a_directory_made_over_a_whiteout_without_room_is_not_made() {
+        let lower = Arc::new(Tmpfs::new());
+        on(&lower)
+            .vfs_mkdir("gone")
+            .expect("the directory must be made");
+        let upper = Arc::new(Tmpfs::new().with_nr_inodes(Some(4)));
+        let overlay = at(over(lower, upper));
+        overlay
+            .vfs_rmdir("gone")
+            .expect("the directory must be removed");
         assert_eq!(
-            (
-                overlay.create_dir("dir"),
-                overlay.metadata("dir"),
-                upper.metadata("dir")
-            ),
+            (overlay.vfs_mkdir("gone"), overlay.vfs_lstat("gone")),
             (
                 Err(FilesystemError::StorageFull),
-                Err(FilesystemError::NotFound),
                 Err(FilesystemError::NotFound)
             ),
-            "a directory made through Overlay::create_dir where one was removed, with no room for \
-             its opaque marker, must not be made, nor its whiteout lifted"
+            "a directory made through vfs_mkdir over a whiteout, with no room left, \
+             must be refused as out of space and leave the name hidden"
         );
     }
 
@@ -1173,11 +2004,11 @@ mod tests {
     // @behavior FS-042
     #[test]
     fn a_rename_that_cannot_leave_its_whiteout_moves_nothing() {
-        let (overlay, _) = full_over_lower(&[], 3);
+        let (overlay, _) = full_over_lower(&[], 2);
         assert_eq!(
             (
-                overlay.rename("dir/file", "dir/moved", Rename::Any),
-                overlay.metadata("dir/moved"),
+                overlay.rename("dir/file", &overlay, "dir/moved"),
+                overlay.vfs_lstat("dir/moved"),
                 read(&overlay, "dir/file")
             ),
             (
@@ -1190,149 +2021,39 @@ mod tests {
         );
     }
 
-    // The lower writable copy still holds the file the upper whiteout
-    // hides, so it cannot be removed; removing the upper copy first would
-    // show the file again.
-    // @behavior FS-074
-    #[test]
-    fn a_directory_a_lower_writable_layer_still_fills_is_removed_behind_a_whiteout() {
-        let lower = memory_with("dir/file", "lower");
-        let overlay = Overlay::new()
-            .layer(memory_with("dir/.wh.file", ""), Access::ReadWrite)
-            .layer(lower.clone(), Access::ReadWrite);
-        assert_eq!(
-            (
-                overlay.remove_dir("dir"),
-                overlay.metadata("dir").err(),
-                read(lower.as_ref(), "dir/file")
-            ),
-            (Ok(()), Some(FilesystemError::NotFound), b"lower".to_vec()),
-            "a directory the view shows empty, removed through Overlay::remove_dir while a lower \
-             writable Layer still holds a whited-out file in it, must leave the view and stay \
-             below unseen"
-        );
-    }
-
-    // The marker is the one entry past the room the upper Layer has, so
-    // marking after the move would leave the directory moved.
-    // @behavior FS-075
-    #[test]
-    fn a_rename_that_cannot_mark_its_directory_opaque_moves_nothing() {
-        let upper = Arc::new(Memory::new().with_inodes(Some(2)));
-        upper
-            .create_dir("moving")
-            .expect("the directory must be made");
-        let lower = Arc::new(Memory::new());
-        lower.create_dir("dir").expect("the directory must be made");
-        let overlay = Overlay::new()
-            .layer(upper.clone(), Access::ReadWrite)
-            .layer(lower, Access::Read);
-        assert_eq!(
-            (
-                overlay.rename("moving", "dir", Rename::Directory),
-                upper.metadata("moving").map(|metadata| metadata.file_type),
-                upper.metadata("dir").err()
-            ),
-            (
-                Err(FilesystemError::StorageFull),
-                Ok(FileType::Directory),
-                Some(FilesystemError::NotFound)
-            ),
-            "a directory renamed through Overlay::rename over one a lower Layer holds, with no \
-             room for its opaque marker, must stay where it was"
-        );
-    }
-
-    // The writable Layer sits between two read-only ones, so a rename
-    // landing in it beneath the top Layer's `to` would vanish from view.
-    // @behavior FS-076
-    #[test]
-    fn a_rename_a_read_only_layer_above_would_cover_is_refused() {
-        let overlay = Overlay::new()
-            .layer(memory_with("to", "top"), Access::Read)
-            .layer(Arc::new(Memory::new()), Access::ReadWrite)
-            .layer(memory_with("from", "moved"), Access::Read);
-        assert_eq!(
-            (
-                overlay.rename("from", "to", Rename::Any),
-                read(&overlay, "from"),
-                read(&overlay, "to")
-            ),
-            (
-                Err(FilesystemError::ReadOnlyFilesystem),
-                b"moved".to_vec(),
-                b"top".to_vec()
-            ),
-            "a file renamed through Overlay::rename onto a name a read-only Layer above the \
-             writable one holds must be refused as read-only and move nothing"
-        );
-    }
-
-    // @behavior FS-077
-    #[test]
-    fn a_name_a_read_only_layer_above_hides_is_not_made() {
-        let upper = Arc::new(Memory::new());
-        let overlay = Overlay::new()
-            .layer(
-                Arc::new(
-                    [(".wh.file", ""), (".wh.dir", "")]
-                        .into_iter()
-                        .collect::<Memory>(),
-                ),
-                Access::Read,
-            )
-            .layer(upper.clone(), Access::ReadWrite);
-        assert_eq!(
-            (
-                write(&overlay, "file", b"new"),
-                overlay.create_dir("dir"),
-                upper.metadata("file").err(),
-                upper.metadata("dir").err()
-            ),
-            (
-                Err(FilesystemError::ReadOnlyFilesystem),
-                Err(FilesystemError::ReadOnlyFilesystem),
-                Some(FilesystemError::NotFound),
-                Some(FilesystemError::NotFound)
-            ),
-            "a file and a directory made through an Overlay where a read-only Layer above the \
-             writable one holds their whiteouts must be refused as read-only and not made"
-        );
-    }
-
     // @behavior FS-043
     #[test]
     fn a_directory_a_lower_layer_holds_does_not_move_through_an_overlay() {
-        let (overlay, _) = overlay_on(Arc::new(Memory::new()));
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::new()));
         assert_eq!(
             (
-                overlay.rename("dir", "moved", Rename::Any),
-                overlay.metadata("moved")
+                overlay.rename("dir", &overlay, "moved"),
+                overlay.vfs_lstat("moved")
             ),
             (
                 Err(FilesystemError::CrossesDevices),
                 Err(FilesystemError::NotFound)
             ),
-            "a directory a read-only Layer holds renamed through Overlay::rename must be refused \
+            "a directory a lower Layer holds renamed through Overlay::rename must be refused \
              as crossing devices, as overlayfs refuses it"
         );
     }
 
-    // The directory shows only from the read-only Layer, so only a check of
+    // The directory shows only from the lower Layer, so only a check of
     // the whole view finds it in the way.
     // @behavior FS-044
     #[test]
     fn a_rename_onto_what_an_overlay_shows_is_checked_against_the_view() {
-        let upper = Arc::new(Memory::new());
+        let upper = Arc::new(Tmpfs::new());
         let (overlay, _) = overlay_on(upper.clone());
         overwrite(&overlay, "note", b"x");
         overlay
-            .create_dir("empty")
+            .vfs_mkdir("empty")
             .expect("the directory must be made");
         assert_eq!(
             (
-                overlay.rename("note", "dir", Rename::Any),
-                overlay.rename("empty", "dir", Rename::Any),
+                overlay.rename("note", &overlay, "dir"),
+                overlay.rename("empty", &overlay, "dir"),
                 read(&overlay, "dir/file")
             ),
             (
@@ -1340,7 +2061,7 @@ mod tests {
                 Err(FilesystemError::DirectoryNotEmpty),
                 b"lower".to_vec()
             ),
-            "a rename through Overlay::rename onto a directory only a read-only Layer shows must \
+            "a rename through Overlay::rename onto a directory only a lower Layer shows must \
              be refused as rename(2) refuses it, leaving that directory as it was"
         );
     }
@@ -1350,39 +2071,245 @@ mod tests {
     // @behavior FS-045
     #[test]
     fn a_directory_moved_over_a_lower_one_is_marked_opaque() {
-        let upper = Arc::new(Memory::new());
-        let lower: Arc<Memory> = Arc::new([("dir/.keep", "")].into_iter().collect());
-        lower.remove_file("dir/.keep").expect("the seed must go");
-        let overlay = Overlay::new()
-            .layer(upper.clone(), Access::ReadWrite)
-            .layer(lower.clone(), Access::Read);
+        let upper = Arc::new(Tmpfs::new());
+        let lower: Arc<Tmpfs> = Arc::new([("dir/.keep", "")].into_iter().collect());
+        on(&lower)
+            .vfs_unlink("dir/.keep")
+            .expect("the seed must go");
+        let overlay = at(over(lower.clone(), upper.clone()));
         overlay
-            .create_dir("made")
+            .vfs_mkdir("made")
             .expect("the directory must be made");
         overlay
-            .rename("made", "dir", Rename::Any)
+            .rename("made", &overlay, "dir")
             .expect("the directory must move over the empty one");
+        overwrite(&on(&lower), "dir/later", b"lower");
         assert_eq!(
-            upper
-                .metadata("dir/.wh..wh..opq")
-                .map(|metadata| metadata.file_type),
-            Ok(FileType::File),
-            "a directory moved through Overlay::rename over one a read-only Layer holds must be \
-             marked opaque in the writable Layer"
+            names(&overlay, "dir"),
+            Vec::<String>::new(),
+            "a directory moved through Overlay::rename over one a lower Layer holds must be \
+             marked opaque, so a file the lower Layer gains there later does not show"
+        );
+    }
+
+    // A change is built in `work` before it lands, so `work` holds nothing
+    // once each change is done, and only `upper` holds what the view shows.
+    // @behavior FS-128
+    #[test]
+    fn an_overlay_keeps_its_changes_in_its_tmpfss_upper() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, _) = overlay_on(upper.clone());
+        overwrite(&overlay, "dir/file", b"changed");
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        assert_eq!(
+            (names(&on(&upper), ""), names(&on(&upper), "work")),
+            (
+                vec!["upper".to_string(), "work".to_string()],
+                Vec::<String>::new()
+            ),
+            "an Overlay's upper Tmpfs, after a copy up and a removal through it, must hold only \
+             upper and an empty work"
+        );
+    }
+
+    // The upper's `dir` holds the whiteout the file's removal left, so only
+    // clearing it before the removal lets what is exchanged out go.
+    // @behavior FS-134
+    #[test]
+    fn a_directory_removed_through_an_overlay_leaves_nothing_in_its_workdir() {
+        let upper = Arc::new(Tmpfs::new());
+        let (overlay, _) = overlay_on(upper.clone());
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the file must be removed");
+        overlay
+            .vfs_rmdir("dir")
+            .expect("the emptied directory must be removed");
+        assert_eq!(
+            (names(&on(&upper), "work"), kind(&overlay, "dir")),
+            (Vec::<String>::new(), Err(FilesystemError::NotFound)),
+            "vfs_rmdir of a lower directory whose file vfs_unlink removed \
+             must leave the upper Tmpfs's work empty and the directory gone"
+        );
+    }
+
+    // The open writes nothing, so only the copy taking the lower file's
+    // times, rather than the time it was made, keeps them.
+    // @behavior FS-129
+    #[test]
+    fn a_copy_up_keeps_the_lower_files_times() {
+        let lower = tmpfs_with("dir/file", "lower");
+        let before = on(&lower)
+            .vfs_lstat("dir/file")
+            .expect("the lower file must stand");
+        std::thread::sleep(Duration::from_millis(10));
+        let overlay = at(over(lower, Arc::new(Tmpfs::new())));
+        overlay
+            .open(
+                "dir/file",
+                &OpenHow {
+                    write: true,
+                    ..OpenHow::default()
+                },
+            )
+            .expect("the open must copy the file up");
+        assert_eq!(
+            overlay.vfs_lstat("dir/file").map(|stat| stat.mtime),
+            Ok(before.mtime),
+            "a lower file opened to write through Overlay::open, writing nothing, must keep the \
+             lower file's modified time once copied up"
+        );
+    }
+
+    // The second copy up lands in a directory the first made, so only
+    // restoring its times leaves what the view reports unchanged.
+    // @behavior FS-130
+    #[test]
+    fn a_copy_up_leaves_its_directorys_times_as_they_were() {
+        let lower: Arc<Tmpfs> = Arc::new([("dir/a", "a"), ("dir/b", "b")].into_iter().collect());
+        let overlay = at(over(lower, Arc::new(Tmpfs::new())));
+        overwrite(&overlay, "dir/a", b"changed");
+        let before = overlay
+            .vfs_lstat("dir")
+            .expect("the directory must stand")
+            .mtime;
+        std::thread::sleep(Duration::from_millis(10));
+        overlay
+            .open(
+                "dir/b",
+                &OpenHow {
+                    write: true,
+                    ..OpenHow::default()
+                },
+            )
+            .expect("the open must copy the file up");
+        assert_eq!(
+            overlay.vfs_lstat("dir").map(|stat| stat.mtime),
+            Ok(before),
+            "a lower file copied up through Overlay::open into a directory the upper holds must \
+             leave that directory's modified time as it was"
+        );
+    }
+
+    /// An Overlay over an empty lower Layer under the Tmpfs `upper`, and
+    /// that same Tmpfs mounted on its own, each reached through the VFS.
+    fn beside_its_upper(upper: Tmpfs) -> (crate::vfs::Path, crate::vfs::Path) {
+        let upper = Filesystem::new(Arc::new(upper)).expect("the instance must stand");
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")],
+            Some(upper.clone()),
+        )
+        .expect("an upper over a lower Layer must make a view");
+        let root = |filesystem| {
+            let mount =
+                crate::mount::Mount::new("/data", filesystem, crate::mount::Access::ReadWrite)
+                    .expect("/data is a guest path");
+            crate::vfs::Path::root(mount.mnt())
+        };
+        (
+            root(Filesystem::new(Arc::new(overlay)).expect("the instance must stand")),
+            root(upper),
+        )
+    }
+
+    // The move holds the directory it leaves and the one above it, and the
+    // removal holds the same two, so only taking the one above first in
+    // both keeps them from waiting on each other; unordered, they wait
+    // within a few moves.
+    // @behavior FS-131
+    #[test]
+    fn an_overlay_and_a_mount_of_its_upper_never_wait_on_each_other() {
+        let (overlay, upper) = beside_its_upper(
+            [("upper/a/b/c", "c"), ("upper/a/b/keep", "")]
+                .into_iter()
+                .collect(),
+        );
+        let moved = Arc::new(AtomicBool::new(false));
+        let removing = {
+            let moved = moved.clone();
+            thread::spawn(move || {
+                while !moved.load(Ordering::SeqCst) {
+                    let _ = crate::vfs::filename_rmdir(&Arc::default(), &upper, "upper/a/b");
+                }
+            })
+        };
+        let (done, finished) = std::sync::mpsc::channel();
+        thread::spawn(move || {
+            for _ in 0..500 {
+                crate::vfs::filename_renameat2(&Arc::default(), &overlay, "a/b/c", &overlay, "a/c")
+                    .expect("the file must move up");
+                crate::vfs::filename_renameat2(&Arc::default(), &overlay, "a/c", &overlay, "a/b/c")
+                    .expect("the file must move back");
+            }
+            let _ = done.send(());
+        });
+        let returned = finished
+            .recv_timeout(crate::sched::testing::MAX_WAIT)
+            .is_ok();
+        moved.store(true, Ordering::SeqCst);
+        if returned {
+            crate::sched::testing::join("the removal", removing);
+        }
+        assert!(
+            returned,
+            "vfs::filename_renameat2 of a file up one directory through an Overlay, while vfs::filename_rmdir \
+             removes that directory through a Mount of its upper Tmpfs, must return"
+        );
+    }
+
+    // The make holds only the directory it makes in, so only the removal
+    // holding that directory too, and removing it only once empty, keeps
+    // what the make made from going with it. The two land in the same
+    // instant only a few times in this many tries.
+    // @behavior FS-132
+    #[test]
+    fn a_removal_through_an_overlay_waits_for_a_change_in_that_directory() {
+        let (overlay, upper) = beside_its_upper([("upper/a/.keep", "")].into_iter().collect());
+        let stop = Arc::new(AtomicBool::new(false));
+        let churning = {
+            let stop = stop.clone();
+            thread::spawn(move || {
+                while !stop.load(Ordering::SeqCst) {
+                    let _ = crate::vfs::filename_mkdirat(&Arc::default(), &overlay, "a/b");
+                    let _ = crate::vfs::filename_rmdir(&Arc::default(), &overlay, "a/b");
+                }
+            })
+        };
+        let mut lost = 0;
+        for _ in 0..100_000 {
+            if crate::vfs::filename_mkdirat(&Arc::default(), &upper, "upper/a/b/made").is_ok() {
+                match crate::vfs::vfs_fstatat(&Arc::default(), &upper, "upper/a/b/made", false) {
+                    Ok(_) => {
+                        let _ =
+                            crate::vfs::filename_rmdir(&Arc::default(), &upper, "upper/a/b/made");
+                    }
+                    Err(_) => lost += 1,
+                }
+            }
+        }
+        stop.store(true, Ordering::SeqCst);
+        churning.join().expect("the Overlay's calls must not panic");
+        assert_eq!(
+            lost, 0,
+            "vfs::filename_mkdirat in a directory through a Mount of an Overlay's upper Tmpfs, while \
+             vfs::filename_rmdir removes that directory through the Overlay, must leave every \
+             directory it made standing"
         );
     }
 
-    // The writable Layer has room for the copy's entry but for less than
+    // The upper has room for the copy's entry but for less than
     // the lower file's bytes, so the copy fails part way.
     // @behavior FS-046
     #[test]
     fn a_copy_up_that_fails_part_way_leaves_nothing_behind() {
-        let upper = Arc::new(Memory::new().with_limit(Some(2)).with_inodes(Some(8)));
+        let upper = Arc::new(Tmpfs::new().with_size(Some(2)).with_nr_inodes(Some(8)));
         let (overlay, _) = overlay_on(upper.clone());
         assert_eq!(
             (
-                write(&overlay, "dir/file", b"x"),
-                upper.metadata("dir/file"),
+                write_over(&overlay, "dir/file", b"x"),
+                on(&upper).vfs_lstat("upper/dir/file"),
                 read(&overlay, "dir/file")
             ),
             (
@@ -1395,374 +2322,894 @@ mod tests {
         );
     }
 
-    /// A Memory whose files write at most three bytes per call and, when
-    /// `refuses_close`, refuse their close.
-    struct Trickles {
-        memory: Memory,
-        refuses_close: bool,
+    /// A Tmpfs answering a stat of `dir` at any depth with an I/O failure,
+    /// though it opens `dir` as any other directory.
+    struct StatsNoDir;
+
+    impl Hook for StatsNoDir {
+        fn getattr(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+        ) -> Result<Kstat, FilesystemError> {
+            if dentry.name() == "dir" {
+                return Err(FilesystemError::Other("dir has no stat".to_string()));
+            }
+            inner.getattr(dentry)
+        }
     }
 
-    struct TrickleFile {
-        file: Box<dyn File>,
-        refuses_close: bool,
+    /// A Tmpfs whose `file` is gone after its first lookup, as a host
+    /// directory another process changes mid-call.
+    #[derive(Default)]
+    struct Vanishes {
+        seen: AtomicBool,
     }
 
-    impl File for TrickleFile {
-        fn read_at(&mut self, buf: &mut [u8], offset: u64) -> Result<usize, FilesystemError> {
-            self.file.read_at(buf, offset)
+    impl Hook for Vanishes {
+        fn getattr(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+        ) -> Result<Kstat, FilesystemError> {
+            if dentry.name() == "file" && self.seen.swap(true, Ordering::SeqCst) {
+                return Err(FilesystemError::NotFound);
+            }
+            inner.getattr(dentry)
         }
+    }
+
+    /// A Tmpfs storing names in lower case and reaching each by any
+    /// case, as a host that folds case does, answering each call by the
+    /// folded path from its root.
+    #[derive(Clone)]
+    struct FoldsCase {
+        root: KernPath,
+    }
 
-        fn write_at(&mut self, buf: &[u8], offset: u64) -> Result<usize, FilesystemError> {
-            self.file.write_at(&buf[..buf.len().min(3)], offset)
+    impl FoldsCase {
+        fn new(tmpfs: Tmpfs) -> Self {
+            Self { root: at(tmpfs) }
         }
+    }
+
+    /// The path `dentry` stands at beneath the root, folded.
+    fn folded_path_of(dentry: &Dentry) -> String {
+        dentry.path_raw()[1..].to_lowercase()
+    }
 
-        fn append(&mut self, buf: &[u8]) -> Result<(u64, usize), FilesystemError> {
-            self.file.append(&buf[..buf.len().min(3)])
+    /// A directory of a `FoldsCase`, open.
+    struct FoldedDir(KernPath);
+
+    impl FileOperations for FoldedDir {
+        fn iterate_shared(
+            &mut self,
+            dentry: &Dentry,
+            ctx: &mut DirContext<'_>,
+        ) -> Result<(), FilesystemError> {
+            let entries = match folded_path_of(dentry).as_str() {
+                "" => self.0.iterate_dir(),
+                at => self.0.open_dir(at)?.iterate_dir(),
+            }?;
+            crate::filesystem::Rdir::default().iterate(dentry, ctx, || Ok(entries))
         }
+    }
 
-        fn metadata(&self) -> Result<Metadata, FilesystemError> {
-            self.file.metadata()
+    impl FileSystemType for FoldsCase {
+        fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+            sb.d_make_root(Inode::new(&Kstat::new(FileType::Dir, 0), self));
+            Ok(())
         }
+    }
 
-        fn set_len(&mut self, len: u64) -> Result<(), FilesystemError> {
-            self.file.set_len(len)
+    impl InodeOperations for FoldsCase {
+        fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+            self.root.vfs_lstat(&folded_path_of(dentry))
         }
 
-        fn close(self: Box<Self>) -> Result<(), FilesystemError> {
-            if self.refuses_close {
-                return Err(FilesystemError::PermissionDenied);
+        fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+            let name = dentry.name();
+            let lower = name.to_lowercase();
+            match self.root.vfs_lstat(&folded_path_of(dentry)) {
+                Ok(found) if lower != name => Ok(Lookup::Spelled {
+                    name: lower,
+                    inode: Inode::new(&found, Arc::new(self.clone())),
+                }),
+                Ok(found) => Ok(Lookup::Found(Inode::new(&found, Arc::new(self.clone())))),
+                Err(FilesystemError::NotFound) => Ok(Lookup::Absent),
+                Err(err) => Err(err),
             }
-            self.file.close()
         }
-    }
-
-    impl Filesystem for Trickles {
-        holds_no_links!();
-        never_repeats_identities!();
-        is_shared!();
-        matches_names_exactly!();
 
         fn open(
             &self,
-            path: &str,
-            options: &OpenOptions,
-        ) -> Result<Box<dyn File>, FilesystemError> {
-            Ok(Box::new(TrickleFile {
-                file: self.memory.open(path, options)?,
-                refuses_close: self.refuses_close,
-            }))
+            dentry: &Dentry,
+            how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            if dentry.kind() == Ok(FileType::Dir) {
+                return Ok(Box::new(FoldedDir(self.root.clone())));
+            }
+            self.root.open(&folded_path_of(dentry), how)
         }
 
-        fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-            self.memory.metadata(path)
-        }
-
-        fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-            self.memory.read_dir(path)
-        }
-
-        fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.memory.create_dir(path)
+        fn atomic_open(&self, dentry: &Dentry, how: &OpenHow) -> Result<Finish, FilesystemError> {
+            if dentry.in_lookup() {
+                let found = self.lookup(dentry)?;
+                if !how.create || !matches!(found, Lookup::Absent) {
+                    return Ok(Finish::Lookup(found));
+                }
+            }
+            if !how.create {
+                return Ok(Finish::NoOpen { created: false });
+            }
+            let file = self.root.create(&folded_path_of(dentry), how)?;
+            Ok(Finish::Open {
+                file,
+                created: true,
+            })
         }
 
-        fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.memory.remove_dir(path)
+        fn mkdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+            self.root.vfs_mkdir(&folded_path_of(dentry))
         }
 
-        fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-            self.memory.remove_file(path)
+        fn rmdir(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+            self.root.vfs_rmdir(&folded_path_of(dentry))
         }
 
-        fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-            self.memory.rename(from, to, rename)
+        fn unlink(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+            self.root.vfs_unlink(&folded_path_of(dentry))
         }
-    }
-
-    /// A Memory refusing to move or remove a directory.
-    struct HoldsDirectories(Memory);
-
-    impl Filesystem for HoldsDirectories {
-        holds_no_links!();
-        never_repeats_identities!();
-        is_shared!();
-        matches_names_exactly!();
 
-        fn open(
+        fn rename(
             &self,
-            path: &str,
-            options: &OpenOptions,
-        ) -> Result<Box<dyn File>, FilesystemError> {
-            self.0.open(path, options)
-        }
-
-        fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-            self.0.metadata(path)
-        }
-
-        fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-            self.0.read_dir(path)
-        }
-
-        fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.0.create_dir(path)
+            from: &Dentry,
+            _to_dir: &dyn InodeOperations,
+            to: &Dentry,
+            _flag: Option<RenameFlag>,
+        ) -> Result<(), FilesystemError> {
+            self.root
+                .rename(&folded_path_of(from), &self.root, &folded_path_of(to))
         }
+    }
 
-        fn remove_dir(&self, _path: &str) -> Result<(), FilesystemError> {
-            Err(FilesystemError::PermissionDenied)
-        }
+    /// What `path` names through `fs`, or why it names nothing.
+    fn kind(fs: &KernPath, path: &str) -> Result<FileType, FilesystemError> {
+        fs.vfs_lstat(path).map(|metadata| metadata.file_type)
+    }
 
-        fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-            self.0.remove_file(path)
-        }
+    // The inner directory is opened too, so only directories held as the
+    // Layers' directories themselves, not reached again by their path,
+    // take it along.
+    // @behavior FS-110
+    #[test]
+    fn a_directory_opened_from_an_overlay_follows_it_when_it_moves() {
+        let upper = Arc::new(Tmpfs::new());
+        let overlay = at(over(Arc::new(Tmpfs::new()), upper.clone()));
+        overlay.vfs_mkdir("dir").expect("dir must be made");
+        overlay.vfs_mkdir("dir/inner").expect("inner must be made");
+        let dir = overlay.open_dir("dir").expect("dir must open");
+        let inner = overlay.open_dir("dir/inner").expect("inner must open");
+        overlay
+            .rename("dir", &overlay, "moved")
+            .expect("the directory must move");
+        overwrite(&dir, "a", b"x");
+        overwrite(&inner, "b", b"x");
+        assert_eq!(
+            (
+                kind(&overlay, "moved/a"),
+                kind(&overlay, "moved/inner/b"),
+                kind(&overlay, "dir")
+            ),
+            (
+                Ok(FileType::RegFile),
+                Ok(FileType::RegFile),
+                Err(FilesystemError::NotFound)
+            ),
+            "files made through directories Overlay::open_dir opened before Overlay::rename moved \
+             the outer one must stand beneath its new path"
+        );
+    }
 
-        fn rename(&self, _from: &str, _to: &str, _rename: Rename) -> Result<(), FilesystemError> {
-            Err(FilesystemError::PermissionDenied)
-        }
+    // @behavior FS-111
+    #[test]
+    fn an_overlay_directory_removed_while_opened_makes_nothing_more() {
+        let overlay = at(over(Arc::new(Tmpfs::new()), Arc::new(Tmpfs::new())));
+        overlay.vfs_mkdir("dir").expect("dir must be made");
+        let dir = overlay.open_dir("dir").expect("dir must open");
+        overlay.vfs_rmdir("dir").expect("dir must remove");
+        overlay.vfs_mkdir("dir").expect("another dir must be made");
+        assert_eq!(
+            (
+                write(&dir, "made", b"x"),
+                dir.iterate_dir().map(|entries| entries.len()),
+                names(&overlay, "dir").len()
+            ),
+            (Err(FilesystemError::NotFound), Ok(0), 0),
+            "a directory Overlay::open_dir opened, once vfs_rmdir removed it and another \
+             was made in its place, must make nothing, list nothing, and leave the new one empty"
+        );
     }
 
-    /// A Memory refusing to remove a whiteout.
-    struct KeepsWhiteouts(Memory);
+    // A change made to a Layer outside its Overlay is the host's, so the
+    // opened directory keeps the Layer's directory it holds, as a
+    // descriptor keeps its directory, rather than reach the one made in
+    // its place.
+    // @behavior FS-112
+    #[test]
+    fn an_overlay_directory_keeps_its_layers_directory_through_a_change_outside_it() {
+        let upper = tmpfs_with("upper/dir/file", "x");
+        let overlay = at(over(Arc::new(Tmpfs::new()), upper.clone()));
+        let dir = overlay.open_dir("dir").expect("dir must open");
+        let outside = on(&upper);
+        outside
+            .rename("upper/dir", &outside, "upper/moved")
+            .expect("the Layer must move it");
+        outside
+            .vfs_mkdir("upper/dir")
+            .expect("the Layer must make another");
+        overwrite(&outside, "upper/dir/file", b"other");
+        assert_eq!(
+            read(&dir, "file"),
+            b"x".to_vec(),
+            "a read through a directory Overlay::open_dir opened, once its Layer moved it away \
+             and made another in its place outside the Overlay, must read the directory it \
+             opened"
+        );
+    }
 
-    impl Filesystem for KeepsWhiteouts {
-        holds_no_links!();
-        never_repeats_identities!();
-        is_shared!();
-        matches_names_exactly!();
+    /// A lower Layer running what it holds right after its first open, while a
+    /// file of it is being opened through the view.
+    #[derive(Default)]
+    struct RunsAfterOpen(Mutex<Option<Box<dyn FnOnce() + Send>>>);
 
+    impl Hook for RunsAfterOpen {
         fn open(
             &self,
-            path: &str,
-            options: &OpenOptions,
-        ) -> Result<Box<dyn File>, FilesystemError> {
-            self.0.open(path, options)
-        }
-
-        fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-            self.0.metadata(path)
-        }
-
-        fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-            self.0.read_dir(path)
-        }
-
-        fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.0.create_dir(path)
-        }
-
-        fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.0.remove_dir(path)
-        }
-
-        fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-            match path.rsplit('/').next() {
-                Some(name) if name.starts_with(".wh.") => Err(FilesystemError::PermissionDenied),
-                _ => self.0.remove_file(path),
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+            how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            let opened = inner.open(dentry, how);
+            let run = self.0.lock().expect("never poisoned").take();
+            if let Some(run) = run {
+                crate::sched::testing::join("the writer", thread::spawn(run));
             }
+            opened
         }
+    }
 
-        fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-            self.0.rename(from, to, rename)
-        }
+    // The copy up lands between the lower open and whatever the file does to
+    // learn of one, so only a file asking where the data is at each read sees
+    // it. A count taken after the open would say no reader was there to tell.
+    // @behavior FS-157
+    #[test]
+    fn a_file_opened_as_a_copy_up_lands_reads_the_copy() {
+        let hook = Arc::new(RunsAfterOpen::default());
+        let lower = Wrap::new(tmpfs_with("note", "lower"), hook.clone());
+        let overlay = at(over(Arc::new(lower), Arc::new(Tmpfs::new())));
+        *hook.0.lock().expect("never poisoned") = Some({
+            let writer = overlay.clone();
+            Box::new(move || overwrite(&writer, "note", b"upper"))
+        });
+        assert_eq!(
+            read(&overlay, "note"),
+            b"upper".to_vec(),
+            "a read through a file of a lower Layer opened while a write copied it up must read \
+             the copy"
+        );
     }
 
-    /// A Memory answering a lookup of any marker name with an I/O failure.
-    struct ReadsNoMarker(Memory);
+    // A descriptor held across the removal still names the lower file, while
+    // what stands at its name now is another entry, so only a copy up refusing
+    // a name taken keeps the lower Layer from being asked.
+    // @behavior FS-158
+    #[test]
+    fn a_time_set_on_a_file_whose_name_was_taken_leaves_its_lower_layer() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+        let asked = Arc::new(AtomicUsize::new(0));
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(KeepsTimes(asked.clone())))
+                .expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = Path::root(mount.mnt());
+        let cred = Arc::default();
+        let (read, create) = (
+            OpenHow {
+                read: true,
+                ..OpenHow::default()
+            },
+            OpenHow {
+                write: true,
+                create: true,
+                ..OpenHow::default()
+            },
+        );
+        let held = vfs::kern_path::filp_open(&cred, &root, "file", &read)
+            .unwrap_or_else(|_| panic!("the file must open"));
+        vfs::filename_unlinkat(&cred, &root, "file").expect("the file must be removed");
+        drop(vfs::kern_path::filp_open(&cred, &root, "file", &create));
+        let answer = vfs::do_utimes_fd(
+            &cred,
+            held.path(),
+            &Iattr::times(None, Some(crate::vfs::SetTime::Now)),
+        );
+        assert_eq!(
+            (answer, asked.load(Ordering::SeqCst)),
+            (Err(FilesystemError::AlreadyExists), 0),
+            "vfs::do_utimes_fd on a held lower file whose name another entry took must answer \
+             EEXIST and leave the lower Layer unasked"
+        );
+    }
 
-    impl Filesystem for ReadsNoMarker {
-        holds_no_links!();
-        never_repeats_identities!();
-        is_shared!();
-        matches_names_exactly!();
+    // The held file's directory was removed and made again, and the upper
+    // directory it knows of is the removed one, so nothing lands in the new one.
+    // @behavior FS-179
+    #[test]
+    fn a_held_file_of_a_directory_made_again_stays_out_of_it() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+        let lower: Tmpfs = [("d/f", "removed")].into_iter().collect();
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = Path::root(mount.mnt());
+        let cred = Arc::default();
+        let read = OpenHow {
+            read: true,
+            ..OpenHow::default()
+        };
+        let held = vfs::kern_path::filp_open(&cred, &root, "d/f", &read)
+            .unwrap_or_else(|_| panic!("the file must open"));
+        vfs::filename_unlinkat(&cred, &root, "d/f").expect("the file must be removed");
+        vfs::filename_rmdir(&cred, &root, "d").expect("the directory must be removed");
+        vfs::filename_mkdirat(&cred, &root, "d").expect("the directory must be made again");
+        let answer = vfs::do_utimes_fd(
+            &cred,
+            held.path(),
+            &Iattr::times(None, Some(crate::vfs::SetTime::Now)),
+        );
+        assert_eq!(
+            (
+                answer,
+                vfs::vfs_fstatat(&cred, &root, "d/f", false).map(|_| ())
+            ),
+            (
+                Err(FilesystemError::NotFound),
+                Err(FilesystemError::NotFound)
+            ),
+            "vfs::do_utimes_fd on a held lower file whose directory was removed and made again \
+             must answer ENOENT and leave the file out of the view"
+        );
+    }
 
-        fn open(
-            &self,
-            path: &str,
-            options: &OpenOptions,
-        ) -> Result<Box<dyn File>, FilesystemError> {
-            self.0.open(path, options)
-        }
+    /// Slows the first ask about the directory `e` once armed, so a second copy
+    /// up of it finds the first under way.
+    struct SlowsDirectory(AtomicBool);
 
-        fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-            if path
-                .rsplit('/')
-                .next()
-                .is_some_and(|name| name.starts_with(".wh."))
-            {
-                return Err(FilesystemError::Other(
-                    "the marker cannot be read".to_string(),
-                ));
+    impl Hook for SlowsDirectory {
+        fn getattr(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+        ) -> Result<Kstat, FilesystemError> {
+            if dentry.name() == "e" && self.0.swap(false, Ordering::SeqCst) {
+                thread::sleep(Duration::from_millis(100));
             }
-            self.0.metadata(path)
-        }
-
-        fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-            self.0.read_dir(path)
-        }
-
-        fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.0.create_dir(path)
-        }
-
-        fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.0.remove_dir(path)
-        }
-
-        fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-            self.0.remove_file(path)
-        }
-
-        fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-            self.0.rename(from, to, rename)
+            inner.getattr(dentry)
         }
     }
 
-    /// A Memory whose `file` is gone after its first lookup, as a host
-    /// directory another process changes mid-call.
-    struct Vanishes {
-        memory: Memory,
-        seen: AtomicBool,
+    // The second copy up decided the directory was not up yet, and waited for the
+    // first. Without asking again under the lock, it would find the first's copy
+    // standing at the name and refuse.
+    // @behavior FS-181
+    #[test]
+    fn a_directory_two_files_copy_up_at_once_takes_both() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+        let lower: Tmpfs = [("d/e/f", "1"), ("d/e/g", "2")].into_iter().collect();
+        let hook = Arc::new(SlowsDirectory(AtomicBool::new(false)));
+        let overlay = Overlay::new(
+            vec![
+                Filesystem::new(Arc::new(Wrap::new(Arc::new(lower), hook.clone())))
+                    .expect("the instance must stand"),
+            ],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = Path::root(mount.mnt());
+        let cred = Arc::default();
+        let write = OpenHow {
+            write: true,
+            ..OpenHow::default()
+        };
+        for name in ["d/e/f", "d/e/g"] {
+            vfs::vfs_fstatat(&cred, &root, name, false).expect("the file stands");
+        }
+        hook.0.store(true, Ordering::SeqCst);
+        let opened = thread::scope(|scope| {
+            let (first, second) = (
+                scope.spawn(|| vfs::kern_path::filp_open(&cred, &root, "d/e/f", &write).map(drop)),
+                scope.spawn(|| vfs::kern_path::filp_open(&cred, &root, "d/e/g", &write).map(drop)),
+            );
+            (
+                crate::sched::testing::join_scoped("the first open", first),
+                crate::sched::testing::join_scoped("the second open", second),
+            )
+        });
+        assert_eq!(
+            opened,
+            (Ok(()), Ok(())),
+            "vfs::do_file_open to write two files of one lower directory at once must copy the \
+             directory up once and open both"
+        );
     }
 
-    impl Filesystem for Vanishes {
-        holds_no_links!();
-        never_repeats_identities!();
-        is_shared!();
-        matches_names_exactly!();
-
-        fn open(
-            &self,
-            path: &str,
-            options: &OpenOptions,
-        ) -> Result<Box<dyn File>, FilesystemError> {
-            self.memory.open(path, options)
-        }
-
-        fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-            if path == "file" && self.seen.swap(true, Ordering::SeqCst) {
-                return Err(FilesystemError::NotFound);
+    mod stress {
+        use super::*;
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+
+        /// What a removal and an open to write answer racing over one lower file,
+        /// with what the descriptor the open made reports of itself.
+        fn race_removal_with_a_write() -> (
+            Result<(), FilesystemError>,
+            Option<Result<FileType, FilesystemError>>,
+        ) {
+            let lower: Tmpfs = [("d/f", "lower")].into_iter().collect();
+            let overlay = Overlay::new(
+                vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+                Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+            )
+            .expect("the Overlay must stack");
+            let mount = Mount::new(
+                "/data",
+                Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+                Access::ReadWrite,
+            )
+            .expect("/data is a guest path");
+            let root = Path::root(mount.mnt());
+            let cred = Arc::default();
+            let write = OpenHow {
+                write: true,
+                ..OpenHow::default()
+            };
+            let ready = std::sync::atomic::AtomicBool::new(false);
+            std::thread::scope(|scope| {
+                let opening = scope.spawn(|| {
+                    crate::sched::testing::wait_until("the removal starting", || {
+                        ready.load(Ordering::SeqCst)
+                    });
+                    vfs::kern_path::filp_open(&cred, &root, "d/f", &write)
+                        .ok()
+                        .map(|file| file.getattr().map(|metadata| metadata.file_type))
+                });
+                ready.store(true, Ordering::SeqCst);
+                let removed = crate::sched::testing::within_max_wait(|| {
+                    vfs::filename_unlinkat(&cred, &root, "d/f")
+                });
+                (
+                    removed,
+                    crate::sched::testing::join_scoped("the open", opening),
+                )
+            })
+        }
+
+        // A removal deciding how to hide the name before the copy up landed asked
+        // the rename to find nothing there.
+        // @behavior FS-182
+        #[test]
+        #[ignore = "a stress witness; run by rake crates:stress"]
+        fn a_file_removed_as_it_is_copied_up_goes() {
+            for _ in 0..50_000 {
+                let (removed, _) = race_removal_with_a_write();
+                assert_eq!(
+                    removed,
+                    Ok(()),
+                    "vfs::filename_unlinkat of a file another Thread opens to write through an \
+                     Overlay must remove it"
+                );
             }
-            self.memory.metadata(path)
         }
 
-        fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-            self.memory.read_dir(path)
+        // A copy up reading its name back after its lock went found the whiteout
+        // the removal left there.
+        // @behavior FS-180
+        #[test]
+        #[ignore = "a stress witness; run by rake crates:stress"]
+        fn a_file_copied_up_as_its_name_is_removed_stays_a_file() {
+            for _ in 0..50_000 {
+                let (_, opened) = race_removal_with_a_write();
+                if let Some(kind) = opened {
+                    assert_eq!(
+                        kind,
+                        Ok(FileType::RegFile),
+                        "File::getattr of a file opened to write through an Overlay as it is \
+                         removed must report a file"
+                    );
+                }
+            }
         }
+    }
 
-        fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.memory.create_dir(path)
-        }
+    /// A lower Layer whose one entry, `pipe`, is a FIFO, counting each open.
+    struct HoldsFifo(Arc<AtomicUsize>);
 
-        fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.memory.remove_dir(path)
+    impl FileSystemType for HoldsFifo {
+        fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+            sb.d_make_root(Inode::new(&Kstat::new(FileType::Dir, 0), self));
+            Ok(())
         }
+    }
 
-        fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-            self.memory.remove_file(path)
+    impl InodeOperations for HoldsFifo {
+        fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+            Ok(match dentry.name().as_str() {
+                "pipe" => Kstat::new(FileType::Fifo, 0).with_identity(1, 2),
+                _ => Kstat::new(FileType::Dir, 0).with_identity(1, 1),
+            })
         }
 
-        fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-            self.memory.rename(from, to, rename)
+        fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+            Ok(match dentry.name().as_str() {
+                "pipe" => Lookup::Found(Inode::new(
+                    &Kstat::new(FileType::Fifo, 0).with_identity(1, 2),
+                    Arc::new(Self(self.0.clone())),
+                )),
+                _ => Lookup::Absent,
+            })
         }
-    }
-
-    /// A Memory storing names in lower case and reaching each by any
-    /// case, as a host that folds case does.
-    struct FoldsCase(Memory);
-
-    impl Filesystem for FoldsCase {
-        holds_no_links!();
-        never_repeats_identities!();
-        is_shared!();
 
         fn open(
             &self,
-            path: &str,
-            options: &OpenOptions,
-        ) -> Result<Box<dyn File>, FilesystemError> {
-            self.0.open(&path.to_lowercase(), options)
+            _dentry: &Dentry,
+            _how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            self.0.fetch_add(1, Ordering::SeqCst);
+            Err(FilesystemError::Interrupted)
         }
+    }
 
-        fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-            self.0.metadata(&path.to_lowercase())
-        }
+    // A special file answers a time without any open having been asked, as
+    // an open of one could wait for a peer past the invocation's timeout.
+    // @behavior FS-162
+    #[test]
+    fn a_time_set_on_a_special_file_below_an_overlay_opens_nothing() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, Path};
+        let opened = Arc::new(AtomicUsize::new(0));
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(HoldsFifo(opened.clone())))
+                .expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let answer = vfs::do_utimes_path(
+            &Arc::default(),
+            &Path::root(mount.mnt()),
+            "pipe",
+            false,
+            &Iattr::times(None, Some(crate::vfs::SetTime::Now)),
+        );
+        assert_eq!(
+            (answer, opened.load(Ordering::SeqCst)),
+            (Err(FilesystemError::PermissionDenied), 0),
+            "vfs::do_utimes_pathon a FIFO a lower Layer holds through an Overlay must answer EACCES \
+             and open nothing"
+        );
+    }
 
-        fn stored_path(&self, path: &str) -> Result<String, FilesystemError> {
-            Ok(path.to_lowercase())
-        }
+    // An earlier Overlay's upper, stacked as a lower Layer of another, holds a
+    // whiteout in a directory only that Layer shows, so only a walk reading
+    // such a directory for marks finds nothing there.
+    // @behavior FS-159
+    #[test]
+    fn a_whiteout_in_a_directory_one_layer_shows_names_nothing() {
+        let lower: Tmpfs = [("file", "x")].into_iter().collect();
+        let first_upper = Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand");
+        let first = kern_path(Arc::new(
+            Overlay::new(
+                vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+                Some(first_upper.clone()),
+            )
+            .expect("the Overlay must stack"),
+        ));
+        first.vfs_unlink("file").expect("the file must be removed");
+        let second = at(Overlay::new(
+            vec![first_upper],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack"));
+        assert_eq!(
+            second.vfs_lstat("upper/file").err(),
+            Some(FilesystemError::NotFound),
+            "a stat through an Overlay of a whiteout in a directory one Layer shows must answer \
+             ENOENT, as the listing shows nothing there"
+        );
+    }
 
-        fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-            self.0.read_dir(&path.to_lowercase())
-        }
+    // A lower directory moved onto a full one answers why it cannot move, so
+    // only asking that first keeps what stands at the target from answering.
+    // @behavior FS-160
+    #[test]
+    fn a_lower_directory_answers_that_it_cannot_move_before_its_target_is_read() {
+        let lower: Tmpfs = [("dir/file", "x"), ("full/file", "x")]
+            .into_iter()
+            .collect();
+        let overlay = at(over(Arc::new(lower), Arc::new(Tmpfs::new())));
+        assert_eq!(
+            overlay.rename("dir", &overlay, "full"),
+            Err(FilesystemError::CrossesDevices),
+            "a rename through an Overlay of a lower Layer's directory onto one holding entries \
+             must answer EXDEV, as ovl_rename_start asks whether it can move first"
+        );
+    }
 
-        fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.0.create_dir(&path.to_lowercase())
-        }
+    // The lower file is far bigger than the upper holds, so only a copy up
+    // leaving its bytes behind can land.
+    // @behavior FS-155
+    #[test]
+    fn a_truncating_open_copies_up_none_of_the_bytes() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+        let lower: Tmpfs = [("file", vec![b'x'; 1 << 20])].into_iter().collect();
+        let upper = Tmpfs::new().with_size(Some(4096)).with_nr_inodes(None);
+        let overlay = Overlay::new(
+            vec![Filesystem::new(Arc::new(lower)).expect("the instance must stand")],
+            Some(Filesystem::new(Arc::new(upper)).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::ReadWrite,
+        )
+        .expect("/data is a guest path");
+        let root = Path::root(mount.mnt());
+        let cred = Arc::default();
+        let how = OpenHow {
+            read: true,
+            write: true,
+            truncate: true,
+            ..OpenHow::default()
+        };
+        let opened = vfs::kern_path::filp_open(&cred, &root, "file", &how);
+        assert!(
+            opened.is_ok_and(|mut file| file.read(&mut [0; 8]) == Ok(0)),
+            "vfs::do_file_open with O_TRUNC of a lower file past what the upper holds must land \
+             on an empty file"
+        );
+    }
 
-        fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-            self.0.remove_dir(&path.to_lowercase())
-        }
+    // Only the directory the view holds open keeps its Layer's host directory
+    // through walks past a Bind's bound, so only that reaches it once the host
+    // moved it.
+    // @behavior FS-152
+    #[cfg(unix)]
+    #[test]
+    fn an_overlay_directory_held_open_keeps_its_bind_layers_directory_past_the_bound() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow, Path};
+        let host = std::env::temp_dir().join(format!("kobako-overlay-held-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&host);
+        let deep = host.join(vec!["d"; 100].join("/"));
+        std::fs::create_dir_all(&deep).expect("the host tree must be made");
+        std::fs::create_dir_all(host.join("held")).expect("the host tree must be made");
+        std::fs::write(host.join("held/f"), "x").expect("the host file must be written");
+        let lower = Filesystem::new(Arc::new(
+            crate::filesystem::Bind::new(&host).expect("the host directory must open"),
+        ))
+        .expect("the instance must stand");
+        let overlay = Overlay::new(
+            vec![lower],
+            Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+        )
+        .expect("the Overlay must stack");
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::Read,
+        )
+        .expect("/data is a guest path");
+        let root = Path::root(mount.mnt());
+        let cred = Arc::default();
+        let directory = OpenHow {
+            read: true,
+            directory: true,
+            ..OpenHow::default()
+        };
+        let Ok(held) = vfs::kern_path::filp_open(&cred, &root, "held", &directory) else {
+            panic!("the directory must open");
+        };
+        vfs::vfs_fstatat(&cred, &root, &vec!["d"; 100].join("/"), false)
+            .unwrap_or_else(|_| panic!("the deep directory must stand"));
+        std::fs::rename(host.join("held"), host.join("moved")).expect("the host must move it");
+        let reached = vfs::vfs_fstatat(&cred, held.path(), "f", false);
+        let _ = std::fs::remove_dir_all(&host);
+        assert!(
+            reached.is_ok(),
+            "vfs::vfs_fstatat through an Overlay directory held open over a Bind Layer, once a \
+             walk passed the bound and the host moved it, must still reach the directory it opened"
+        );
+    }
 
-        fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-            self.0.remove_file(&path.to_lowercase())
-        }
+    // Only the lower Layer holds `dir` when both handles open it, so the
+    // second sees the file only if the copy up through the first reaches
+    // it too.
+    // @behavior FS-119
+    #[test]
+    fn a_copy_up_through_one_overlay_directory_is_seen_through_another() {
+        let lower: Arc<dyn FileSystemType> = tmpfs_with("dir/a.txt", "a");
+        let overlay = at(over(lower, Arc::new(Tmpfs::new())));
+        let first = overlay.open_dir("dir").expect("dir must open");
+        let second = overlay.open_dir("dir").expect("dir must open again");
+        write(&first, "b.txt", b"b").expect("the write must copy dir up");
+        assert_eq!(
+            read(&second, "b.txt"),
+            b"b".to_vec(),
+            "a read through one directory Overlay::open_dir opened, of a file written through \
+             another opened before the write copied it up, must read the file"
+        );
+    }
 
-        fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-            self.0
-                .rename(&from.to_lowercase(), &to.to_lowercase(), rename)
-        }
+    // The lower Layer holds no `dir`, so reaching it again by the path it
+    // was opened at would miss where it moved.
+    // @behavior FS-120
+    #[test]
+    fn a_write_through_a_moved_overlay_directory_lands_where_it_went() {
+        let upper = tmpfs_with("upper/dir/a.txt", "a");
+        let overlay = at(over(Arc::new(Tmpfs::new()), upper.clone()));
+        let dir = overlay.open_dir("dir").expect("dir must open");
+        overlay
+            .rename("dir", &overlay, "moved")
+            .expect("the directory must move");
+        assert_eq!(
+            (
+                write(&dir, "b.txt", b"b"),
+                read(&on(&upper), "upper/moved/b.txt")
+            ),
+            (Ok(()), b"b".to_vec()),
+            "a write through a directory Overlay::open_dir opened, once Overlay::rename moved it \
+             over a lower Layer, must land where it moved"
+        );
     }
 
     // @behavior FS-083
     #[test]
     fn an_overlay_spells_a_path_as_the_layer_showing_it_stores_it() {
-        let overlay = Overlay::new()
-            .layer(Arc::new(Memory::new()), Access::ReadWrite)
-            .layer(
-                Arc::new(FoldsCase([("private/secret", "x")].into_iter().collect())),
-                Access::Read,
-            );
+        let overlay = at(over(
+            Arc::new(FoldsCase::new(
+                [("private/secret", "x")].into_iter().collect(),
+            )),
+            Arc::new(Tmpfs::new()),
+        ));
+        let private = overlay
+            .open_dir("PRIVATE")
+            .expect("the directory must open in any case");
         assert_eq!(
             (
-                overlay.stored_path("PRIVATE/SECRET"),
-                overlay.stored_path("PRIVATE/New")
+                overlay.lookup("PRIVATE"),
+                private.lookup("SECRET"),
+                private.lookup("New")
             ),
             (
-                Ok("private/secret".to_string()),
-                Ok("private/New".to_string())
+                Ok("private".to_string()),
+                Ok("secret".to_string()),
+                Ok("New".to_string())
             ),
-            "a path asked of Overlay::stored_path in another case, shown by a Layer folding case, \
-             must come back as that Layer stores each name, a new name kept as given"
+            "a name asked of Overlay::lookup in another case, shown by a Layer folding case, \
+             must come back as that Layer stores it, a new name kept as given"
         );
     }
 
-    // A whiteout the Layer cannot read would otherwise count as absent and
-    // let the lower file show.
-    // @behavior FS-079
+    // A directory only one Layer shows has nothing to merge or hide, so the
+    // walk keeps what that Layer's lookup recorded, as overlayfs leaves it
+    // unmerged and reads `d_is_dir` rather than ask for a stat.
+    // @behavior FS-122
     #[test]
-    fn a_layer_that_cannot_read_its_markers_fails_the_lookup() {
-        let top: Memory = [(".wh.file", "")].into_iter().collect();
-        let overlay = Overlay::new()
-            .layer(Arc::new(ReadsNoMarker(top)), Access::Read)
-            .layer(memory_with("file", "hidden"), Access::Read);
-        assert!(
-            matches!(overlay.metadata("file"), Err(FilesystemError::Other(_))),
-            "a file looked up through Overlay::metadata, beneath a Layer that cannot read the \
-             whiteout over it, must fail the lookup rather than show the file"
+    fn a_directory_one_layer_shows_is_walked_without_its_stat() {
+        let only: Arc<dyn FileSystemType> = tmpfs_with("top/dir/file", "only");
+        let overlay = at(over(
+            Arc::new(Wrap::new(only, Arc::new(StatsNoDir))),
+            Arc::new(Tmpfs::new()),
+        ));
+        assert_eq!(
+            read(&overlay, "top/dir/file"),
+            b"only",
+            "a file read through Overlay::open beneath a directory only the lower Layer shows, \
+             that Layer answering no stat of the directory, must read its content"
+        );
+    }
+
+    /// Refuses every open, as a Layer whose directory cannot open does.
+    struct RefusesOpen;
+
+    impl Hook for RefusesOpen {
+        fn open(
+            &self,
+            _inner: &dyn InodeOperations,
+            _dentry: &Dentry,
+            _how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            Err(FilesystemError::PermissionDenied)
+        }
+    }
+
+    // A host removing a Bind's directory cannot witness this, as the fid the
+    // lookup took still opens it, so a Layer refuses instead.
+    // @behavior FS-166
+    #[test]
+    fn a_directory_a_layer_cannot_open_answers_why() {
+        use crate::mount::{Access, Mount};
+        use crate::vfs::{self, OpenHow};
+        let lower: Arc<dyn FileSystemType> = tmpfs_with("top/file", "lower");
+        let overlay = over(
+            Arc::new(Wrap::new(lower, Arc::new(RefusesOpen))),
+            Arc::new(Tmpfs::new()),
+        );
+        let mount = Mount::new(
+            "/data",
+            Filesystem::new(Arc::new(overlay)).expect("the instance must stand"),
+            Access::Read,
+        )
+        .expect("/data is a guest path");
+        let directory = OpenHow {
+            read: true,
+            directory: true,
+            ..OpenHow::default()
+        };
+        let answer = vfs::kern_path::filp_open(
+            &Arc::default(),
+            &vfs::Path::root(mount.mnt()),
+            "top",
+            &directory,
+        );
+        assert_eq!(
+            answer.err(),
+            Some(FilesystemError::PermissionDenied),
+            "vfs::do_file_open of an Overlay's directory whose Layer refuses its open must answer \
+             what the Layer answered"
         );
     }
 
     // @behavior FS-080
     #[test]
     fn a_file_gone_during_a_rename_answers_not_found() {
-        let lower = Vanishes {
-            memory: [("file", "lower")].into_iter().collect(),
-            seen: AtomicBool::new(false),
-        };
-        let overlay = Overlay::new()
-            .layer(Arc::new(Memory::new()), Access::ReadWrite)
-            .layer(Arc::new(lower), Access::Read);
+        let tmpfs: Tmpfs = [("file", "lower")].into_iter().collect();
+        let lower = Wrap::new(Arc::new(tmpfs), Arc::new(Vanishes::default()));
+        let overlay = at(over(Arc::new(lower), Arc::new(Tmpfs::new())));
         assert_eq!(
-            overlay.rename("file", "moved", Rename::Any),
+            overlay.rename("file", &overlay, "moved"),
             Err(FilesystemError::NotFound),
             "a file renamed through Overlay::rename that its Layer loses during the call must \
              answer not found"
@@ -1774,148 +3221,134 @@ mod tests {
     // @behavior FS-078
     #[test]
     fn a_directory_over_a_lower_file_on_its_way_reads_as_a_directory() {
-        let overlay = Overlay::new()
-            .layer(memory_with("dir/sub/file", "upper"), Access::ReadWrite)
-            .layer(memory_with("dir", "lower"), Access::Read);
+        let overlay = at(over(
+            tmpfs_with("dir", "lower"),
+            tmpfs_with("upper/dir/sub/file", "upper"),
+        ));
         assert_eq!(
             (
-                overlay.metadata("dir/sub").map(|metadata| metadata.file_type),
+                overlay
+                    .vfs_lstat("dir/sub")
+                    .map(|metadata| metadata.file_type),
                 read(&overlay, "dir/sub/file")
             ),
-            (Ok(FileType::Directory), b"upper".to_vec()),
-            "a directory looked up through Overlay::metadata above a lower Layer holding a file on \
+            (Ok(FileType::Dir), b"upper".to_vec()),
+            "a directory looked up through vfs_lstat above a lower Layer holding a file on \
              its path must read as a directory, as its files open"
         );
     }
 
-    // The writable Layer refuses each change only after the Overlay has
-    // cleared the whiteout from `dir`, so only putting it back keeps the
-    // read-only Layer's `dir/file` hidden.
-    // @behavior FS-063
+    // @behavior FS-101
     #[test]
-    fn a_refused_change_leaves_what_a_whiteout_hid_hidden() {
-        let (overlay, _) = overlay_on(Arc::new(HoldsDirectories(Memory::new())));
-        overlay
-            .remove_file("dir/file")
-            .expect("the file must be removed");
-        overlay
-            .create_dir("new")
-            .expect("the directory must be made");
-        let refused = (
-            overlay.rename("new", "dir", Rename::Directory),
-            overlay.remove_dir("dir"),
-        );
+    fn a_file_opened_to_read_before_a_copy_up_reads_the_copy() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::default()));
+        let mut reader = open_to_read(&overlay, "dir/file");
+        overwrite(&overlay, "dir/file", b"upper");
         assert_eq!(
-            (refused, overlay.metadata("dir/file").err()),
-            (
-                (
-                    Err(FilesystemError::PermissionDenied),
-                    Err(FilesystemError::PermissionDenied)
-                ),
-                Some(FilesystemError::NotFound)
-            ),
-            "a rename onto and a removal of a directory whose writable copy holds only a whiteout, \
-             refused by the Layer through an Overlay, must leave the whited-out file hidden"
+            read_from(reader.as_mut()),
+            b"upper".to_vec(),
+            "a file Overlay::open handed out to read before another open copied it up must \
+             read what the copy holds"
         );
     }
 
-    fn trickles(refuses_close: bool) -> Arc<Trickles> {
-        Arc::new(Trickles {
-            memory: Memory::new(),
-            refuses_close,
-        })
-    }
-
-    // @behavior FS-054
+    // @behavior FS-102
     #[test]
-    fn a_copy_up_through_a_layer_writing_in_parts_copies_the_whole_file() {
-        let upper = trickles(false);
-        let (overlay, _) = overlay_on(upper.clone());
+    fn a_file_opened_to_read_before_a_rename_reads_the_moved_copy() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::default()));
+        let mut reader = open_to_read(&overlay, "dir/file");
         overlay
-            .open(
-                "dir/file",
-                &OpenOptions {
-                    write: true,
-                    ..OpenOptions::default()
-                },
-            )
-            .expect("the open must copy the lower file up");
+            .rename("dir/file", &overlay, "dir/moved")
+            .expect("the rename must land");
+        overwrite(&overlay, "dir/moved", b"moved");
         assert_eq!(
-            read(&upper.memory, "dir/file"),
-            b"lower".to_vec(),
-            "a write open through Overlay::open must copy the whole lower file up into a Layer \
-             whose writes land a few bytes at a time"
+            read_from(reader.as_mut()),
+            b"moved".to_vec(),
+            "a file Overlay::open handed out to read before Overlay::rename moved it must read \
+             what the moved copy holds"
         );
     }
 
-    // @behavior FS-055
+    // @behavior FS-103
     #[test]
-    fn a_copy_up_whose_close_a_layer_refuses_leaves_nothing_behind() {
-        let upper = trickles(true);
-        let (overlay, _) = overlay_on(upper.clone());
+    fn a_file_open_to_read_keeps_what_it_held_once_removed() {
+        let (overlay, _) = overlay_on(Arc::new(Tmpfs::default()));
+        let mut reader = open_to_read(&overlay, "dir/file");
+        overwrite(&overlay, "dir/file", b"upper");
+        overlay
+            .vfs_unlink("dir/file")
+            .expect("the removal must land");
+        overwrite(&overlay, "dir/file", b"fresh");
+        overlay
+            .rename("dir/file", &overlay, "dir/moved")
+            .expect("the rename must land");
         assert_eq!(
-            (
-                write(&overlay, "dir/file", b"x"),
-                upper.metadata("dir/file"),
-                read(&overlay, "dir/file")
-            ),
-            (
-                Err(FilesystemError::PermissionDenied),
-                Err(FilesystemError::NotFound),
-                b"lower".to_vec()
-            ),
-            "a write through Overlay::open whose copy up the writable Layer refuses to close must \
-             leave no copy hiding the lower file"
+            read_from(reader.as_mut()),
+            b"upper".to_vec(),
+            "a file Overlay::open handed out to read must keep reading what it held once \
+             vfs_unlink took it away, whatever later stands at its path"
         );
     }
 
-    /// Counts each wait its Overlay's lock makes through it.
-    struct CountsWaits(AtomicUsize);
+    /// A Tmpfs whose first open sleeps a while, flagging that it began.
+    #[derive(Default)]
+    struct SleepsOnOpen {
+        opening: AtomicBool,
+    }
 
-    impl Blocking for CountsWaits {
-        fn wait(&self, wait: &mut dyn FnMut()) {
-            self.0.fetch_add(1, Ordering::SeqCst);
-            wait();
+    impl Hook for SleepsOnOpen {
+        fn open(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+            how: &OpenHow,
+        ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+            if !self.opening.swap(true, Ordering::SeqCst) {
+                thread::sleep(Duration::from_millis(100));
+            }
+            inner.open(dentry, how)
         }
     }
 
+    // The first copy up holds the file's lock while its lower open sleeps,
+    // so the second, of the same file, finds the lock held and waits.
     // @behavior FS-039
     #[test]
-    fn a_contended_overlay_waits_through_its_blocking() {
-        let counts = Arc::new(CountsWaits(AtomicUsize::new(0)));
-        let overlay = Overlay::new()
-            .layer(memory_with("note", "x"), Access::Read)
-            .with_blocking(counts.clone());
-        let held = overlay.lock.hold().expect("the lock must be free");
-        let other = overlay.clone();
-        let waiter = thread::spawn(move || other.metadata("note").map(|m| m.file_type));
-        while counts.0.load(Ordering::SeqCst) == 0 {
-            thread::sleep(Duration::from_millis(1));
-        }
-        drop(held);
+    fn a_contended_copy_up_waits_through_the_registered_blocking() {
+        let counts = crate::sched::testing::count_waits();
+        let sleeps = Arc::new(SleepsOnOpen::default());
+        let lower = Wrap::new(tmpfs_with("note", "lower"), sleeps.clone());
+        let overlay = over(Arc::new(lower), Arc::new(Tmpfs::new()));
+        let first = at(overlay);
+        let second = first.clone();
+        let copying = thread::spawn(move || write_over(&first, "note", b"first"));
+        crate::sched::testing::wait_until("the first copy up opening its lower file", || {
+            sleeps.opening.load(Ordering::SeqCst)
+        });
+        let waited =
+            crate::sched::testing::within_max_wait(|| write_over(&second, "note", b"later"));
         assert_eq!(
             (
-                waiter.join().expect("the waiter must not panic"),
-                counts.0.load(Ordering::SeqCst)
+                crate::sched::testing::join("the first copy up", copying),
+                waited,
+                counts.load(Ordering::SeqCst) > 0
             ),
-            (Ok(FileType::File), 1),
-            "a call through an Overlay whose lock another thread holds must wait through the \
-             Blocking given by Overlay::with_blocking, then answer"
+            (Ok(()), Ok(()), true),
+            "a write through an Overlay copying up a file another thread is copying up must wait \
+             through the Blocking given to sched::register_blocking, then land"
         );
     }
 
-    // Copying up makes the directory in the writable Layer, whose own
-    // identity differs, so only reporting the lower Layer's keeps it.
+    // Copying up makes the directory in the upper, whose own identity
+    // differs, so only reporting the lower Layer's keeps it.
     // @behavior FS-072
     #[test]
     fn an_overlay_keeps_a_directorys_identity_when_a_write_copies_it_up() {
-        let lower: Arc<dyn Filesystem> =
-            Arc::new([("dir/a.txt", "a")].into_iter().collect::<Memory>());
-        let overlay = Overlay::new()
-            .layer(Arc::new(Memory::new()), Access::ReadWrite)
-            .layer(lower, Access::Read);
-        let identity = |overlay: &Overlay| {
-            let metadata = overlay.metadata("dir").expect("the directory must stand");
+        let lower: Arc<dyn FileSystemType> =
+            Arc::new([("dir/a.txt", "a")].into_iter().collect::<Tmpfs>());
+        let overlay = at(over(lower, Arc::new(Tmpfs::new())));
+        let identity = |overlay: &KernPath| {
+            let metadata = overlay.vfs_lstat("dir").expect("the directory must stand");
             (metadata.dev, metadata.ino)
         };
         let before = identity(&overlay);
@@ -1923,33 +3356,114 @@ mod tests {
         assert_eq!(
             (identity(&overlay) == before, before.1 != 0),
             (true, true),
-            "a directory of a read-only Layer copied up by a write through an Overlay's open must \
-             keep the identity Overlay::metadata reported before"
+            "a directory of a lower Layer copied up by a write through an Overlay's open must \
+             keep the identity vfs_lstat reported before"
+        );
+    }
+
+    // The upper Layer's directory changes after the lower one is made, so
+    // the two report different times and only the upper's matches.
+    // @behavior FS-117
+    #[test]
+    fn an_overlay_reports_a_merged_directory_as_overlayfs_does() {
+        let lower: Arc<Tmpfs> = Arc::new([("dir/a.txt", "a")].into_iter().collect());
+        let upper: Arc<Tmpfs> = Arc::new(Tmpfs::new());
+        let overlay = at(over(lower.clone(), upper.clone()));
+        std::thread::sleep(std::time::Duration::from_millis(10));
+        write(&overlay, "dir/b.txt", b"b").expect("the upper must take a write");
+        let merged = overlay.vfs_lstat("dir").expect("the directory must stand");
+        let modified = |layer: &Arc<Tmpfs>, path: &str| {
+            on(layer).vfs_lstat(path).expect("a Layer holds it").mtime
+        };
+        assert_eq!(
+            (
+                merged.nlink,
+                merged.mtime == modified(&upper, "upper/dir"),
+                merged.mtime == modified(&lower, "dir"),
+            ),
+            (1, true, false),
+            "Overlay::getattr of a directory two Layers hold, written last in the upper, must \
+             count one name and report the upper Layer's times"
         );
     }
 
     // @behavior FS-073
     #[test]
     fn an_overlay_names_a_directory_alike_whether_a_link_at_its_end_is_followed() {
-        let layer = |name: &str| -> Arc<dyn Filesystem> {
-            Arc::new(
-                [(format!("dir/{name}"), "x")]
-                    .into_iter()
-                    .collect::<Memory>(),
-            )
-        };
-        let overlay = Overlay::new()
-            .layer(layer("upper"), Access::ReadWrite)
-            .layer(layer("lower"), Access::Read);
-        let identity = |metadata: Result<Metadata, FilesystemError>| {
+        let overlay = at(over(
+            tmpfs_with("dir/lower", "x"),
+            tmpfs_with("upper/dir/upper", "x"),
+        ));
+        let identity = |metadata: Result<Kstat, FilesystemError>| {
             let metadata = metadata.expect("the directory must stand");
             (metadata.dev, metadata.ino)
         };
         assert_eq!(
-            identity(overlay.symlink_metadata("dir")),
-            identity(overlay.metadata("dir")),
-            "a directory two Layers hold, looked up through Overlay::symlink_metadata, must \
-             report the identity Overlay::metadata does"
+            identity(overlay.vfs_lstat("dir")),
+            identity(overlay.vfs_lstat("dir")),
+            "a directory two Layers hold, looked up through vfs_lstat, must \
+             report the identity vfs_lstat does"
         );
     }
+
+    /// A Layer whose `permission` refuses `mask` of what stands at `name`.
+    struct RefusesOf {
+        name: &'static str,
+        mask: Mask,
+    }
+
+    impl Hook for RefusesOf {
+        fn permission(
+            &self,
+            inner: &dyn InodeOperations,
+            dentry: &Dentry,
+            mask: Mask,
+        ) -> Result<(), FilesystemError> {
+            if dentry.name() == self.name && mask.contains(self.mask) {
+                return Err(FilesystemError::PermissionDenied);
+            }
+            inner.permission(dentry, mask)
+        }
+    }
+
+    type LayerCall = fn(&KernPath) -> Result<(), FilesystemError>;
+
+    // Only a Layer of the Host App's own answers `permission`, so each call is
+    // made over a lower Layer refusing just the one ask that call makes of it.
+    // @behavior FS-206
+    #[test]
+    fn an_overlay_asks_a_layers_permission_where_overlayfs_does() {
+        let calls: [(&str, &str, Mask, LayerCall); 4] = [
+            ("finding a name", "dir", Mask::EXEC, |view| {
+                view.vfs_lstat("dir/file").map(drop)
+            }),
+            ("opening a file", "file", Mask::OPEN, |view| {
+                let read = OpenHow {
+                    read: true,
+                    ..OpenHow::default()
+                };
+                view.open("dir/file", &read).map(drop)
+            }),
+            ("listing a directory", "dir", Mask::OPEN, |view| {
+                view.open_dir("dir")?.iterate_dir().map(drop)
+            }),
+            ("copying a file up", "file", Mask::OPEN, |view| {
+                write_over(view, "dir/file", b"y")
+            }),
+        ];
+        for (call, name, mask, run) in calls {
+            let lower = Wrap::new(
+                tmpfs_with("dir/file", "x"),
+                Arc::new(RefusesOf { name, mask }),
+            );
+            let view = at(over(Arc::new(lower), Arc::new(Tmpfs::new())));
+            assert_eq!(
+                run(&view),
+                Err(FilesystemError::PermissionDenied),
+                "{call} through an Overlay over a Layer whose permission refuses {mask:?} of \
+                 `{name}` must answer that refusal, as overlayfs asks inode_permission of the \
+                 real inode"
+            );
+        }
+    }
 }