kobako 0.29.0 → 0.30.0

data/crates/kobako-wasmtime/src/preview1/mount_view.rs

@@ -2,86 +2,83 @@
 //! path, the files a Filesystem holds, and the refusals the runtime
 //! answers before the Filesystem is asked.
 
+mod wrap;
+
 use std::sync::atomic::{AtomicUsize, Ordering};
-use std::sync::Arc;
+use std::sync::{Arc, Mutex, Weak};
+use std::time::{SystemTime, UNIX_EPOCH};
 
-use kobako_runtime::filesystem::Access;
+use kobako_runtime::filesystem::Bind;
+use kobako_runtime::filesystem::Filesystem;
 use kobako_runtime::filesystem::{
-    DirEntry, Directory, File, Filesystem, FilesystemError, Hold, Memory, Metadata, OpenOptions,
-    Overlay, Rename, Temporary,
+    FileOperations, FileSystemType, FileType, FilesystemError, InodeOperations, Kiocb, Kstat,
+    Lookup, OpenHow, Overlay, RenameFlag, Tmpfs,
 };
 use kobako_runtime::grant::Grant;
-use kobako_runtime::mount::{Mount, Policy};
+use kobako_runtime::mount::{Access, Mount, Policy};
 use kobako_runtime::profile::Profile;
+use kobako_runtime::security::prepare_creds_within;
+use kobako_runtime::vfs::{self, Dentry, Inode, Path, SecurityOperations, SecurityPath, PATH_MAX};
 use wasmtime::{Instance, Module, Store};
 
-use crate::cache::shared_engine;
+use crate::cache::load_engine;
 use crate::config::Config;
 use crate::imports;
 use crate::invocation::Invocation;
 use crate::trap::NO_TIMEOUT_EPOCH_DELTA;
 use crate::wasi::Wasi;
-
-/// The answer of a test Filesystem holding no links.
-macro_rules! holds_no_links {
-    () => {
-        fn symlink_metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-            self.metadata(path)
-        }
-
-        fn canonicalize_beneath(&self, _base: &str, path: &str) -> Result<String, FilesystemError> {
-            Ok(path.to_string())
-        }
-
-        fn for_policy(&self) -> Option<Arc<dyn Filesystem>> {
-            None
-        }
-    };
-}
-
-/// The answer of a test Filesystem matching names byte for byte.
-macro_rules! matches_names_exactly {
-    () => {
-        fn stored_path(&self, path: &str) -> Result<String, FilesystemError> {
-            Ok(path.to_string())
-        }
-    };
-}
-
-/// The answer of a test Filesystem whose identities never repeat.
-macro_rules! never_repeats_identities {
-    () => {
-        fn hold_directory(&self, _path: &str) -> Result<Option<Hold>, FilesystemError> {
-            Ok(None)
-        }
-    };
+use wrap::{Hook, Wrap};
+
+/// The root of `filesystem` as the host reaches it through the VFS, a
+/// writer of its own beside the guest.
+fn host<F: FileSystemType>(filesystem: &Arc<F>) -> Path {
+    let mount = Mount::new(
+        "/data",
+        Filesystem::new(filesystem.clone()).expect("the instance must stand"),
+        Access::ReadWrite,
+    )
+    .expect("/data is a guest path");
+    Path::root(mount.mnt())
 }
 
-/// The answer of a test Filesystem every Invocation shares.
-macro_rules! is_shared {
-    () => {
-        fn for_invocation(&self) -> Option<Arc<dyn Filesystem>> {
-            None
-        }
-    };
+/// The names `filesystem`'s root holds, as the host lists them.
+fn host_entries<F: FileSystemType>(filesystem: &Arc<F>) -> Result<Vec<String>, FilesystemError> {
+    let mount = Mount::new(
+        "/data",
+        Filesystem::new(filesystem.clone()).expect("the instance must stand"),
+        Access::ReadWrite,
+    )
+    .expect("/data is a guest path");
+    let mut root = vfs::File::root(mount.mnt(), &prepare_creds_within(&[], None))?;
+    let mut names = Vec::new();
+    root.llseek(2, vfs::Whence::Set)?;
+    root.iterate_dir(&mut vfs::DirContext::new(0, &mut |emit| {
+        names.push(emit.name.to_string());
+        true
+    }))?;
+    Ok(names)
 }
 
 const ERRNO_ACCES: i32 = 2;
 const ERRNO_BADF: i32 = 8;
 const ERRNO_BUSY: i32 = 10;
-const ERRNO_FBIG: i32 = 22;
+const ERRNO_MFILE: i32 = 33;
 const ERRNO_INVAL: i32 = 28;
 const ERRNO_IO: i32 = 29;
 const ERRNO_ISDIR: i32 = 31;
+#[cfg(unix)]
 const ERRNO_LOOP: i32 = 32;
 const ERRNO_NOENT: i32 = 44;
+const ERRNO_NOMEM: i32 = 48;
 const ERRNO_NOTDIR: i32 = 54;
+const ERRNO_NOTEMPTY: i32 = 55;
+const ERRNO_NOSPC: i32 = 51;
 const ERRNO_NOTSUP: i32 = 58;
 const ERRNO_ROFS: i32 = 69;
 const ERRNO_XDEV: i32 = 75;
 const ERRNO_NOTCAPABLE: i32 = 76;
 
-/// Memory holds an `iovec` at 64 over 512..576, a `ciovec` at 80 over
+/// Tmpfs holds an `iovec` at 64 over 512..576, a `ciovec` at 80 over
 /// "hello" at 600, the paths `file.txt` at 700 and `../file.txt` at 720,
 /// and from 740 the paths the resolution rules turn on. An opened
 /// descriptor lands at 128, a count at 132, a listing's count at 136, a
@@ -92,6 +89,7 @@ const PROBE_WAT: &str = r#"
   (import "wasi_snapshot_preview1" "fd_prestat_dir_name" (func $prestat_name (param i32 i32 i32) (result i32)))
   (import "wasi_snapshot_preview1" "path_open" (func $open (param i32 i32 i32 i32 i32 i64 i64 i32 i32) (result i32)))
   (import "wasi_snapshot_preview1" "path_filestat_get" (func $stat (param i32 i32 i32 i32 i32) (result i32)))
+  (import "wasi_snapshot_preview1" "fd_filestat_get" (func $fstat (param i32 i32) (result i32)))
   (import "wasi_snapshot_preview1" "fd_read" (func $read (param i32 i32 i32 i32) (result i32)))
   (import "wasi_snapshot_preview1" "fd_write" (func $write (param i32 i32 i32 i32) (result i32)))
   (import "wasi_snapshot_preview1" "path_remove_directory" (func $rmdir (param i32 i32 i32) (result i32)))
@@ -108,6 +106,9 @@ const PROBE_WAT: &str = r#"
   (import "wasi_snapshot_preview1" "fd_fdstat_get" (func $fdstat (param i32 i32) (result i32)))
   (import "wasi_snapshot_preview1" "fd_fdstat_set_flags" (func $set_flags (param i32 i32) (result i32)))
   (import "wasi_snapshot_preview1" "poll_oneoff" (func $poll (param i32 i32 i32 i32) (result i32)))
+  (import "wasi_snapshot_preview1" "fd_sync" (func $sync (param i32) (result i32)))
+  (import "wasi_snapshot_preview1" "fd_filestat_set_times" (func $set_times (param i32 i64 i64 i32) (result i32)))
+  (import "wasi_snapshot_preview1" "sock_shutdown" (func $shutdown (param i32 i32) (result i32)))
   (memory (export "memory") 1)
   (data (i32.const 740) ".")
   (data (i32.const 760) "missing/../file.txt")
@@ -137,6 +138,12 @@ const PROBE_WAT: &str = r#"
   (data (i32.const 1120) "dir/up")
   (data (i32.const 1130) "nowhere")
   (data (i32.const 1150) "pub/x")
+  (data (i32.const 1160) "in/inner/../../sub/y")
+  (data (i32.const 1184) "loop")
+  (data (i32.const 1190) "dir/sub")
+  (data (i32.const 1400) "dir/in/y")
+  (data (i32.const 1420) "dir/sub/y")
+  (data (i32.const 1440) "\ff")
   ;; An iovec naming 16 bytes past the one page of memory.
   (data (i32.const 1140) "\00\00\02\00\10\00\00\00")
   (data (i32.const 64) "\00\02\00\00\40\00\00\00")
@@ -159,6 +166,14 @@ const PROBE_WAT: &str = r#"
     (if (local.get $errno) (then (return (local.get $errno))))
     (call $read (i32.load (i32.const 128)) (i32.const 64) (i32.const 1) (i32.const 132)))
 
+  ;; Open the path asking no right, with the given oflags, and read from it.
+  (func (export "read_unasked") (param $path i32) (param $len i32) (param $oflags i32) (result i32)
+    (local $errno i32)
+    (local.set $errno (call $open (i32.const 3) (i32.const 0) (local.get $path) (local.get $len)
+      (local.get $oflags) (i64.const 0) (i64.const 0) (i32.const 0) (i32.const 128)))
+    (if (local.get $errno) (then (return (local.get $errno))))
+    (call $read (i32.load (i32.const 128)) (i32.const 64) (i32.const 1) (i32.const 132)))
+
   ;; Open the path with read rights only, asking to truncate it.
   (func (export "truncate_file") (param $path i32) (param $len i32) (result i32)
     (call $open (i32.const 3) (i32.const 0) (local.get $path) (local.get $len)
@@ -181,6 +196,14 @@ const PROBE_WAT: &str = r#"
   (func (export "stat_flagged") (param $path i32) (param $len i32) (param $flags i32) (result i32)
     (call $stat (i32.const 3) (local.get $flags) (local.get $path) (local.get $len) (i32.const 384)))
 
+  ;; Open the path read-only and stat what is open into 384.
+  (func (export "stat_opened") (param $path i32) (param $len i32) (result i32)
+    (local $errno i32)
+    (local.set $errno (call $open (i32.const 3) (i32.const 0) (local.get $path) (local.get $len)
+      (i32.const 0) (i64.const 2097154) (i64.const 0) (i32.const 0) (i32.const 128)))
+    (if (local.get $errno) (then (return (local.get $errno))))
+    (call $fstat (i32.load (i32.const 128)) (i32.const 384)))
+
   ;; Change the root `.` at 740.
   (func (export "remove_root") (result i32)
     (call $rmdir (i32.const 3) (i32.const 740) (i32.const 1)))
@@ -204,9 +227,6 @@ const PROBE_WAT: &str = r#"
     (if (local.get $errno) (then (return (local.get $errno))))
     (call $allocate (i32.load (i32.const 128)) (i64.const 0) (i64.const 100)))
 
-  ;; Rename `file.txt` to `new.txt`.
-  (func (export "rename_to_new") (result i32)
-    (call $rename (i32.const 3) (i32.const 700) (i32.const 8) (i32.const 3) (i32.const 840) (i32.const 7)))
   ;; Rename `file.txt` onto `file.txt/`, its own path as a directory.
   (func (export "rename_onto_itself_as_directory") (result i32)
     (call $rename (i32.const 3) (i32.const 700) (i32.const 8) (i32.const 3) (i32.const 800) (i32.const 9)))
@@ -293,9 +313,39 @@ const PROBE_WAT: &str = r#"
   (func (export "dir_fdstat") (result i32)
     (local $errno i32)
     (local.set $errno (call $open (i32.const 3) (i32.const 0) (i32.const 930) (i32.const 3)
-      (i32.const 2) (i64.const 0) (i64.const 2) (i32.const 0) (i32.const 128)))
+      (i32.const 2) (i64.const 0x4002) (i64.const 2) (i32.const 0) (i32.const 128)))
     (if (local.get $errno) (then (return (local.get $errno))))
     (call $fdstat (i32.load (i32.const 128)) (i32.const 384)))
+  ;; Open `dir` as a directory with `rights`, then make call `$call` of it:
+  ;; list, sync, advise, set its flags, size, or times, wait on it with its
+  ;; event at 1264, stat it, stat `inner` from it, or read its fdstat into
+  ;; 384.
+  (func (export "dir_with") (param $rights i64) (param $call i32) (result i32)
+    (local $errno i32)
+    (local $fd i32)
+    (local.set $errno (call $open (i32.const 3) (i32.const 0) (i32.const 930) (i32.const 3)
+      (i32.const 2) (local.get $rights) (i64.const 0) (i32.const 0) (i32.const 128)))
+    (if (local.get $errno) (then (return (local.get $errno))))
+    (local.set $fd (i32.load (i32.const 128)))
+    (if (i32.eq (local.get $call) (i32.const 0)) (then (return
+      (call $readdir (local.get $fd) (i32.const 2048) (i32.const 64) (i64.const 0) (i32.const 136)))))
+    (if (i32.eq (local.get $call) (i32.const 1)) (then (return (call $sync (local.get $fd)))))
+    (if (i32.eq (local.get $call) (i32.const 2)) (then (return
+      (call $advise (local.get $fd) (i64.const 0) (i64.const 0) (i32.const 0)))))
+    (if (i32.eq (local.get $call) (i32.const 3)) (then (return (call $set_flags (local.get $fd) (i32.const 0)))))
+    (if (i32.eq (local.get $call) (i32.const 4)) (then (return (call $set_size (local.get $fd) (i64.const 0)))))
+    (if (i32.eq (local.get $call) (i32.const 5)) (then (return
+      (call $set_times (local.get $fd) (i64.const 0) (i64.const 0) (i32.const 2)))))
+    (if (i32.eq (local.get $call) (i32.const 7)) (then (return (call $fstat (local.get $fd) (i32.const 384)))))
+    (if (i32.eq (local.get $call) (i32.const 8)) (then (return
+      (call $stat (local.get $fd) (i32.const 0) (i32.const 960) (i32.const 5) (i32.const 384)))))
+    (if (i32.eq (local.get $call) (i32.const 9)) (then (return (call $fdstat (local.get $fd) (i32.const 384)))))
+    (if (i32.eq (local.get $call) (i32.const 10)) (then (return (call $shutdown (local.get $fd) (i32.const 3)))))
+    (i32.store8 (i32.const 1208) (i32.const 1))
+    (i32.store (i32.const 1216) (local.get $fd))
+    (local.set $errno (call $poll (i32.const 1200) (i32.const 1264) (i32.const 1) (i32.const 1296)))
+    (if (local.get $errno) (then (return (local.get $errno))))
+    (i32.load16_u (i32.const 1272)))
   ;; Size `file.txt` to `offset` bytes.
   (func (export "size_at") (param $offset i64) (result i32)
     (local $errno i32)
@@ -345,7 +395,7 @@ const PROBE_WAT: &str = r#"
   (func (export "open_beneath_dir") (param $path i32) (param $len i32) (result i32)
     (local $errno i32)
     (local.set $errno (call $open (i32.const 3) (i32.const 0) (i32.const 930) (i32.const 3)
-      (i32.const 2) (i64.const 0) (i64.const 2) (i32.const 0) (i32.const 128)))
+      (i32.const 2) (i64.const 0x4002) (i64.const 2) (i32.const 0) (i32.const 128)))
     (if (local.get $errno) (then (return (local.get $errno))))
     (call $open (i32.load (i32.const 128)) (i32.const 0) (local.get $path) (local.get $len)
       (i32.const 0) (i64.const 2) (i64.const 0) (i32.const 0) (i32.const 132)))
@@ -372,10 +422,20 @@ const PROBE_WAT: &str = r#"
   ;; Open `dir` as a directory into 128.
   (func $open_dir (export "open_dir") (result i32)
     (call $open (i32.const 3) (i32.const 0) (i32.const 930) (i32.const 3)
-      (i32.const 2) (i64.const 0) (i64.const 2) (i32.const 0) (i32.const 128)))
+      (i32.const 2) (i64.const 0x4002) (i64.const 2) (i32.const 0) (i32.const 128)))
+  ;; Stat the directory opened into 128 itself.
+  (func (export "fstat_dir") (result i32)
+    (call $fstat (i32.load (i32.const 128)) (i32.const 384)))
+  ;; List the directory opened into 128 from its start.
+  (func (export "list_dir") (result i32)
+    (call $readdir (i32.load (i32.const 128)) (i32.const 2048) (i32.const 256) (i64.const 0) (i32.const 136)))
   ;; Stat `inner` beneath the directory opened into 128.
   (func (export "stat_inner") (result i32)
-    (call $stat (i32.load (i32.const 128)) (i32.const 0) (i32.const 960) (i32.const 5) (i32.const 384))))
+    (call $stat (i32.load (i32.const 128)) (i32.const 0) (i32.const 960) (i32.const 5) (i32.const 384)))
+  ;; Open `inner` for reading beneath the directory opened into 128.
+  (func (export "open_inner") (result i32)
+    (call $open (i32.load (i32.const 128)) (i32.const 0) (i32.const 960) (i32.const 5)
+      (i32.const 0) (i64.const 2) (i64.const 0) (i32.const 0) (i32.const 132))))
 "#;
 
 const FILE: (i32, i32) = (700, 8);
@@ -385,6 +445,7 @@ const THROUGH_MISSING: (i32, i32) = (760, 19);
 const OUT_OF_FILE: (i32, i32) = (780, 11);
 const FILE_AS_DIRECTORY: (i32, i32) = (800, 9);
 const NEW_AS_DIRECTORY: (i32, i32) = (820, 8);
+#[cfg(unix)]
 const THROUGH_FILE: (i32, i32) = (860, 12);
 const DIR_DOT: (i32, i32) = (880, 5);
 const DIR_DOT_DOT: (i32, i32) = (890, 6);
@@ -392,29 +453,38 @@ const BENEATH_FILE: (i32, i32) = (900, 10);
 const MOVED: (i32, i32) = (920, 5);
 const DIR: (i32, i32) = (930, 3);
 const MISSING_DOT: (i32, i32) = (940, 9);
+#[cfg(unix)]
 const LINK_DOT: (i32, i32) = (970, 10);
+#[cfg(unix)]
 const OUT_OF_LINK: (i32, i32) = (990, 20);
 const HOLDING_NUL: (i32, i32) = (1010, 9);
+const NOT_UTF8: (i32, i32) = (1440, 1);
 const DIR_FILE: (i32, i32) = (1030, 12);
+#[cfg(unix)]
 const DIR_AS_DIRECTORY: (i32, i32) = (1050, 4);
+#[cfg(unix)]
 const GONE_AS_DIRECTORY: (i32, i32) = (1060, 5);
-const ERRNO_OVERFLOW: i32 = 61;
 const ERRNO_EXIST: i32 = 20;
 const OFLAGS_EXCL: i32 = 1 << 2;
 
-/// The default `OpenOptions` with `set` applied.
-fn build_options(set: impl FnOnce(&mut OpenOptions)) -> OpenOptions {
-    let mut options = OpenOptions::default();
-    set(&mut options);
-    options
+/// The default `OpenHow` with `set` applied.
+fn build_how(set: impl FnOnce(&mut OpenHow)) -> OpenHow {
+    let mut how = OpenHow::default();
+    set(&mut how);
+    how
 }
 
 fn grant(
-    filesystem: Arc<dyn Filesystem>,
+    filesystem: Arc<dyn FileSystemType>,
     access: Access,
     policy: Option<Arc<dyn Policy>>,
 ) -> Grant {
-    let mount = Mount::new("/data", filesystem, access).expect("/data is a guest path");
+    let mount = Mount::new(
+        "/data",
+        Filesystem::new(filesystem).expect("the instance must stand"),
+        access,
+    )
+    .expect("/data is a guest path");
     Grant::Mount(match policy {
         Some(policy) => mount.with_policy(policy),
         None => mount,
@@ -429,17 +499,55 @@ struct Guest {
 
 impl Guest {
     fn new(grants: &[Grant]) -> Self {
-        let engine = shared_engine().expect("shared engine must be constructible");
+        Self::with_open_file_limit(None, grants)
+    }
+
+    /// A guest holding at most `open_file_limit` descriptors at once.
+    fn with_open_file_limit(open_file_limit: Option<usize>, grants: &[Grant]) -> Self {
+        Self::build(open_file_limit, None, Profile::Hermetic, Vec::new(), grants)
+    }
+
+    /// A guest allotted `memory_limit` bytes.
+    fn with_memory_limit(memory_limit: usize, grants: &[Grant]) -> Self {
+        Self::build(
+            None,
+            Some(memory_limit),
+            Profile::Hermetic,
+            Vec::new(),
+            grants,
+        )
+    }
+
+    /// A guest on `profile`.
+    fn for_posture(profile: Profile, grants: &[Grant]) -> Self {
+        Self::build(None, None, profile, Vec::new(), grants)
+    }
+
+    /// A guest whose Driver was built with `security`.
+    fn with_security(security: Vec<Arc<dyn SecurityOperations>>, grants: &[Grant]) -> Self {
+        Self::build(None, None, Profile::Hermetic, security, grants)
+    }
+
+    fn build(
+        open_file_limit: Option<usize>,
+        memory_limit: Option<usize>,
+        profile: Profile,
+        security: Vec<Arc<dyn SecurityOperations>>,
+        grants: &[Grant],
+    ) -> Self {
+        let engine = load_engine().expect("shared engine must be constructible");
         let config = Config {
             timeout: None,
             setup_timeout: None,
-            memory_limit: None,
+            memory_limit,
             stdout_limit: None,
             stderr_limit: None,
-            open_file_limit: None,
-            profile: Profile::Hermetic,
+            open_file_limit,
+            profile,
+            security,
         };
-        let wasi = Wasi::for_invocation(&config, &[], grants).expect("WASI context must build");
+        let wasi =
+            Wasi::for_invocation(&config, Vec::new(), grants).expect("WASI context must build");
         let mut store = Store::new(engine, Invocation::new(None, wasi));
         store.set_epoch_deadline(NO_TIMEOUT_EPOCH_DELTA);
         let module = Module::new(engine, PROBE_WAT).expect("probe module must compile");
@@ -494,6 +602,15 @@ impl Guest {
             .expect("probe call must not trap")
     }
 
+    /// Open `dir` with `rights` and make call `call` of it.
+    fn call_dir_with(&mut self, rights: i64, call: i32) -> i32 {
+        self.instance
+            .get_typed_func::<(i64, i32), i32>(&mut self.store, "dir_with")
+            .expect("probe export must resolve")
+            .call(&mut self.store, (rights, call))
+            .expect("probe call must not trap")
+    }
+
     /// Call an export that takes no path.
     fn call_bare(&mut self, name: &str) -> i32 {
         self.instance
@@ -503,14 +620,26 @@ impl Guest {
             .expect("probe call must not trap")
     }
 
+    /// Stat `file.txt`, without following a link, into 384.
+    fn call_flagged_stat(&mut self) -> i32 {
+        self.instance
+            .get_typed_func::<(i32, i32, i32), i32>(&mut self.store, "stat_flagged")
+            .expect("probe export must resolve")
+            .call(&mut self.store, (FILE.0, FILE.1, 0))
+            .expect("probe call must not trap")
+    }
+
     /// The names a listing from `cookie` into `len` bytes holds whole.
-    fn list(&mut self, cookie: u64, len: i32) -> Vec<String> {
-        let errno = self
-            .instance
+    fn call_list(&mut self, cookie: u64, len: i32) -> i32 {
+        self.instance
             .get_typed_func::<(i64, i32), i32>(&mut self.store, "list")
             .expect("probe export must resolve")
             .call(&mut self.store, (cookie as i64, len))
-            .expect("probe call must not trap");
+            .expect("probe call must not trap")
+    }
+
+    fn list(&mut self, cookie: u64, len: i32) -> Vec<String> {
+        let errno = self.call_list(cookie, len);
         assert_eq!(errno, 0, "the listing must succeed");
         let memory = self
             .instance
@@ -532,6 +661,36 @@ impl Guest {
         names
     }
 
+    /// What `path_filestat_get` answers for `path` with `flags`.
+    fn stat_flagged(&mut self, path: (i32, i32), flags: i32) -> i32 {
+        self.instance
+            .get_typed_func::<(i32, i32, i32), i32>(&mut self.store, "stat_flagged")
+            .expect("probe export must resolve")
+            .call(&mut self.store, (path.0, path.1, flags))
+            .expect("probe call must not trap")
+    }
+
+    /// The `u64` the last stat placed at `field` of its `filestat`.
+    fn stat_field(&mut self, field: usize) -> u64 {
+        let memory = self
+            .instance
+            .get_memory(&mut self.store, "memory")
+            .expect("probe exports its memory");
+        let at = 384 + field;
+        u64::from_le_bytes(memory.data(&self.store)[at..at + 8].try_into().unwrap())
+    }
+
+    /// The `atim`, `mtim`, and `ctim` the last stat placed at 384.
+    fn stat_times(&mut self) -> [u64; 3] {
+        [40, 48, 56].map(|field| self.stat_field(field))
+    }
+
+    /// The times `stat_flagged` answers for `path`.
+    fn times_of_path(&mut self, path: (i32, i32)) -> [u64; 3] {
+        assert_eq!(self.stat_flagged(path, 0), 0, "the stat must succeed");
+        self.stat_times()
+    }
+
     /// The bytes the last read placed at 512.
     fn read_back(&mut self) -> Vec<u8> {
         let memory = self
@@ -544,24 +703,42 @@ impl Guest {
     }
 }
 
-fn contents(filesystem: &dyn Filesystem, path: &str) -> Option<Vec<u8>> {
-    let mut file = filesystem
-        .open(path, &build_options(|options| options.read = true))
-        .ok()?;
+/// What `do_file_open` takes for an open `how` asks.
+fn flags_of(how: &OpenHow) -> vfs::OpenFlags {
+    vfs::build_open_flags(how).expect("the flags must mean an open")
+}
+
+fn contents(root: &Path, path: &str) -> Option<Vec<u8>> {
+    let mut how = OpenHow::default();
+    how.read = true;
+    let Ok(mut file) = vfs::do_file_open(
+        &prepare_creds_within(&[], None),
+        root,
+        path,
+        &flags_of(&how),
+    ) else {
+        return None;
+    };
     let mut buf = vec![0; 64];
-    let read = file.read_at(&mut buf, 0).ok()?;
+    let read = file.pread(&mut buf, 0).ok()?;
     buf.truncate(read);
     Some(buf)
 }
 
 /// Make an empty file at `path`.
-fn overwrite(filesystem: &dyn Filesystem, path: &str) {
-    filesystem
-        .open(
+fn overwrite(root: &Path, path: &str) {
+    let mut how = OpenHow::default();
+    (how.write, how.create) = (true, true);
+    assert!(
+        vfs::do_file_open(
+            &prepare_creds_within(&[], None),
+            root,
             path,
-            &build_options(|options| (options.write, options.create) = (true, true)),
+            &flags_of(&how)
         )
-        .expect("the file must be made");
+        .is_ok(),
+        "the file must be made"
+    );
 }
 
 struct Refuses(&'static str);
@@ -580,45 +757,58 @@ impl Policy for AllowsAll {
     }
 }
 
-/// A Memory storing every name in upper case while it reaches each by
-/// any case, as a host that folds case does.
-struct StoresUpperCase(Memory);
-
-impl Filesystem for StoresUpperCase {
-    holds_no_links!();
-    never_repeats_identities!();
-    is_shared!();
-
-    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
-        self.0.open(path, options)
-    }
-
-    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        self.0.metadata(path)
-    }
-
-    fn stored_path(&self, path: &str) -> Result<String, FilesystemError> {
-        Ok(path.to_uppercase())
-    }
-
-    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-        self.0.read_dir(path)
-    }
-
-    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.create_dir(path)
-    }
-
-    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.remove_dir(path)
+/// A Filesystem holding the files `files`, each path stored in upper case and
+/// reached by any case, as a host storing every name in upper case and
+/// folding case does; a lookup hands back the entry it found under its stored
+/// spelling.
+#[derive(Clone)]
+struct StoresUpperCase(&'static [&'static str]);
+
+impl StoresUpperCase {
+    /// What stands at `path` once folded: a file it holds, a directory above
+    /// one, or nothing, each with an identity of its stored path, so a Policy
+    /// can tell it from another.
+    fn stat(&self, path: &str) -> Option<Kstat> {
+        let path = path.to_uppercase();
+        let beneath = format!("{path}/");
+        let kind = self.0.iter().find_map(|file| match *file {
+            file if file == path => Some(FileType::RegFile),
+            file if path.is_empty() || file.starts_with(&beneath) => Some(FileType::Dir),
+            _ => None,
+        })?;
+        let ino = path.bytes().fold(1, |ino: u64, byte| {
+            ino.wrapping_mul(31).wrapping_add(u64::from(byte))
+        });
+        Some(Kstat::new(kind, 0).with_identity(1, ino))
+    }
+}
+
+impl FileSystemType for StoresUpperCase {
+    fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+        sb.d_make_root(vfs::Inode::new(
+            &vfs::Kstat::new(vfs::FileType::Dir, 0),
+            self,
+        ));
+        Ok(())
     }
+}
 
-    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.remove_file(path)
+impl InodeOperations for StoresUpperCase {
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.stat(&dentry.path_raw()[1..])
+            .ok_or(FilesystemError::NotFound)
     }
 
-    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-        self.0.rename(from, to, rename)
+    fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+        let Some(found) = self.stat(&dentry.path_raw()[1..]) else {
+            return Ok(Lookup::Absent);
+        };
+        let inode = Inode::new(&found, Arc::new(self.clone()));
+        let name = dentry.name().to_uppercase();
+        Ok(match name == dentry.name() {
+            true => Lookup::Found(inode),
+            false => Lookup::Spelled { name, inode },
+        })
     }
 }
 
@@ -627,10 +817,9 @@ impl Filesystem for StoresUpperCase {
 // @behavior RT-120
 #[test]
 fn a_policy_judges_a_path_as_its_filesystem_stores_it() {
-    let memory: Memory = [("file.txt", "granted")].into_iter().collect();
     let policy: Arc<dyn Policy> = Arc::new(Refuses("/data/FILE.TXT"));
     let mut guest = Guest::new(&[grant(
-        Arc::new(StoresUpperCase(memory)),
+        Arc::new(StoresUpperCase(&["FILE.TXT"])),
         Access::Read,
         Some(policy),
     )]);
@@ -642,10 +831,31 @@ fn a_policy_judges_a_path_as_its_filesystem_stores_it() {
     );
 }
 
+// A Policy handed the descriptor's path as the guest spelled it would see
+// `/data/dir/inner` and let the read through.
+// @behavior RT-120
+#[test]
+fn a_policy_judges_a_path_beneath_an_opened_directory_as_its_filesystem_stores_it() {
+    const INNER: (i32, i32) = (960, 5);
+    let policy: Arc<dyn Policy> = Arc::new(Refuses("/data/DIR/INNER"));
+    let mut guest = Guest::new(&[grant(
+        Arc::new(StoresUpperCase(&["DIR/INNER"])),
+        Access::Read,
+        Some(policy),
+    )]);
+    assert_eq!(
+        guest.call("open_beneath_dir", INNER),
+        ERRNO_ACCES,
+        "path_open of `inner` through `dir` opened beneath a Mount whose Policy refuses \
+         `/data/DIR/INNER`, over a Filesystem storing both names in upper case, through \
+         preview1 must answer EACCES"
+    );
+}
+
 // @behavior RT-075
 #[test]
 fn a_mount_appears_as_a_directory_at_its_path() {
-    let mut guest = Guest::new(&[grant(Arc::new(Memory::new()), Access::Read, None)]);
+    let mut guest = Guest::new(&[grant(Arc::new(Tmpfs::new()), Access::Read, None)]);
     assert_eq!(
         guest.call_bare("preopen_name"),
         0,
@@ -662,66 +872,248 @@ fn a_mount_appears_as_a_directory_at_its_path() {
     );
 }
 
+/// The inode number the guest reads for `file.txt` from a stat and from a
+/// listing, and for the Mount's root from `.`.
+fn inodes_seen(profile: Profile) -> (u64, u64, u64) {
+    let mut guest = Guest::for_posture(
+        profile,
+        &[grant(file_and_directory(), Access::ReadWrite, None)],
+    );
+    assert_eq!(guest.call_flagged_stat(), 0, "the stat must succeed");
+    assert!(
+        guest.list(0, 1024).contains(&"file.txt".to_string()),
+        "the listing must hold file.txt"
+    );
+    let memory = guest
+        .instance
+        .get_memory(&mut guest.store, "memory")
+        .expect("probe exports its memory");
+    let data = memory.data(&guest.store);
+    let u64_at = |at: usize| u64::from_le_bytes(data[at..at + 8].try_into().unwrap());
+    let used = u32::from_le_bytes(data[136..140].try_into().unwrap()) as usize;
+    let mut at = 2048;
+    let (mut dot, mut listed) = (None, None);
+    while at + 24 <= 2048 + used {
+        let len = u32::from_le_bytes(data[at + 16..at + 20].try_into().unwrap()) as usize;
+        match &data[at + 24..at + 24 + len] {
+            b"." => dot = Some(u64_at(at + 8)),
+            b"file.txt" => listed = Some(u64_at(at + 8)),
+            _ => {}
+        }
+        at += 24 + len;
+    }
+    (
+        u64_at(384 + 8),
+        listed.expect("the listing names file.txt"),
+        dot.expect("the listing names `.`"),
+    )
+}
+
+// The hash is a host detail, so only what a guest can rely on is asserted: a
+// listing and a stat agree, an entry is told from another, and it is no raw
+// inode number, which a fresh Tmpfs numbers from 1.
+// @behavior RT-183
+#[test]
+fn a_permissive_guest_tells_entries_apart_by_their_inode_numbers() {
+    let (stat, listed, dot) = inodes_seen(Profile::Permissive);
+    assert_eq!(
+        stat, listed,
+        "fd_readdir and path_filestat_get of a file beneath a Mount through a permissive \
+         guest's preview1 must answer the same inode number"
+    );
+    assert!(
+        stat > u64::from(u16::MAX) && dot > u64::from(u16::MAX) && dot != stat,
+        "a permissive guest's inode numbers for a file and its directory must differ and be \
+         hashes rather than a Filesystem's own small numbers, not {stat} and {dot}"
+    );
+}
+
+// A Tmpfs's device number depends on how many came before it, so any number
+// drawn from it would differ between otherwise identical runs.
+// @behavior RT-183
+#[test]
+fn a_hermetic_guest_sees_no_inode_numbers() {
+    assert_eq!(
+        inodes_seen(Profile::Hermetic),
+        (0, 0, 0),
+        "a stat and a listing of a file and its directory beneath a Mount through a hermetic \
+         guest's preview1 must answer inode number 0"
+    );
+}
+
+/// A host directory holding only `a.txt`, which a Bind reads whole to list.
+fn host_dir_with_a_file(name: &str) -> std::path::PathBuf {
+    let dir = std::env::temp_dir().join(format!("kobako-listing-{name}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).expect("the host directory must be created");
+    std::fs::write(dir.join("a.txt"), "").expect("the host file must be written");
+    dir
+}
+
+// The VFS hands a Bind every name no walk looked up, so a Bind making what
+// any open asks for would leave a file on the host for a guest that only
+// tried to write one standing.
+// @behavior RT-311
+#[test]
+fn a_bind_opens_a_name_no_walk_looked_up_and_makes_nothing() {
+    let dir = host_dir_with_a_file("opens-unlooked");
+    std::fs::write(dir.join("file.txt"), "granted").expect("the host file must be written");
+    let bind = Arc::new(Bind::new(&dir).expect("the host directory must open"));
+    let mut guest = Guest::new(&[grant(bind, Access::ReadWrite, None)]);
+    let read = guest.call("read_file", FILE);
+    let content = guest.read_back();
+    let appended = guest.call("append_file", NEW);
+    assert_eq!(
+        (read, content, appended, dir.join("new.txt").exists()),
+        (0, b"granted".to_vec(), ERRNO_NOENT, false),
+        "path_open of a file no walk looked up beneath a Bind through preview1 must read it, \
+         and of a missing path without O_CREAT must answer ENOENT and make nothing on the host"
+    );
+}
+
 // The first listing fills its buffer with `.` and `..` exactly, so it has
 // not reached its end when the file is made.
 // @behavior RT-107
 #[test]
 fn a_listing_goes_on_over_the_entries_it_began_with() {
-    let memory: Arc<Memory> = Arc::new([("a.txt", "")].into_iter().collect());
-    let mut guest = Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)]);
+    let dir = host_dir_with_a_file("goes-on");
+    let bind = Arc::new(Bind::new(&dir).expect("the host directory must open"));
+    let mut guest = Guest::new(&[grant(bind.clone(), Access::ReadWrite, None)]);
     assert_eq!(
         guest.list(0, 51),
         [".", ".."],
         "the first listing must hold the dots"
     );
-    memory
-        .open(
-            "b.txt",
-            &build_options(|options| (options.write, options.create) = (true, true)),
-        )
-        .expect("the file must be made");
+    overwrite(&host(&bind), "b.txt");
     assert_eq!(
         guest.list(2, 4096),
         ["a.txt"],
         "a listing going on through fd_readdir must read the entries it began with"
     );
+    let mut from_the_start = guest.list(0, 4096);
+    from_the_start.sort();
     assert_eq!(
-        guest.list(0, 4096),
+        from_the_start,
         [".", "..", "a.txt", "b.txt"],
         "a listing from the start through fd_readdir must read the directory as it stands"
     );
 }
 
+// A buffer of 51 takes only the dots, one of 4096 the whole listing; the limit
+// the listing is held against is the memory the guest was allotted, counted
+// from the moment the listing is read.
+// @behavior RT-237
+#[test]
+fn a_listing_it_cannot_hold_within_a_guests_memory_answers_enomem() {
+    let dir = host_dir_with_a_file("holds");
+    let answer = |memory_limit, len| {
+        let bind = Arc::new(Bind::new(&dir).expect("the host directory must open"));
+        let mut guest =
+            Guest::with_memory_limit(memory_limit, &[grant(bind, Access::ReadWrite, None)]);
+        let errno = guest.call_list(0, len);
+        let memory = guest
+            .instance
+            .get_memory(&mut guest.store, "memory")
+            .expect("probe exports its memory");
+        let used = u32::from_le_bytes(memory.data(&guest.store)[136..140].try_into().unwrap());
+        (errno, used)
+    };
+    assert_eq!(
+        [answer(1, 51), answer(1, 4096), answer(1 << 20, 51)],
+        [(ERRNO_NOMEM, 0), (ERRNO_NOMEM, 0), (0, 51)],
+        "fd_readdir through preview1, with more to hold than the guest's memory_limit, must \
+         answer ENOMEM before it hands any entry, read part way or whole, and within it succeed"
+    );
+}
+
+/// A root whose listing hands `.` and `..`, then fails as a host read would.
+struct FailsPastTheDots;
+
+struct FailsPastTheDotsDir;
+
+impl FileOperations for FailsPastTheDotsDir {
+    fn iterate_shared(
+        &mut self,
+        dentry: &Dentry,
+        ctx: &mut vfs::DirContext<'_>,
+    ) -> Result<(), FilesystemError> {
+        if !vfs::dir_emit_dots(dentry, ctx) {
+            return Ok(());
+        }
+        Err(FilesystemError::Other("the host read failed".into()))
+    }
+}
+
+impl InodeOperations for FailsPastTheDots {
+    fn getattr(&self, _dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        Ok(Kstat::new(FileType::Dir, 0))
+    }
+
+    fn open(
+        &self,
+        _dentry: &Dentry,
+        _how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        Ok(Box::new(FailsPastTheDotsDir))
+    }
+}
+
+impl FileSystemType for FailsPastTheDots {
+    fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+        sb.d_make_root(vfs::Inode::new(
+            &vfs::Kstat::new(vfs::FileType::Dir, 0),
+            self,
+        ));
+        Ok(())
+    }
+}
+
+// The dots are written before the Filesystem fails, so only the call going on
+// from them meets the failure with nothing written.
+// @behavior RT-301
+#[test]
+fn a_listing_failing_once_it_has_handed_entries_answers_those_entries() {
+    let mut guest = Guest::new(&[grant(Arc::new(FailsPastTheDots), Access::Read, None)]);
+    let first = guest.list(0, 4096);
+    assert_eq!(
+        (first, guest.call_list(2, 4096)),
+        (vec![".".to_string(), "..".to_string()], ERRNO_IO),
+        "fd_readdir through preview1 of a Filesystem failing after it hands the dots must \
+         answer the dots, and the next call from them the error, as getdents64 answers the \
+         bytes it wrote over iterate_dir's error"
+    );
+}
+
 // @behavior RT-076
 #[test]
 fn a_guest_reads_a_file_beneath_a_mount() {
-    let memory: Memory = [("file.txt", "granted")].into_iter().collect();
-    let mut guest = Guest::new(&[grant(Arc::new(memory), Access::Read, None)]);
+    let tmpfs: Tmpfs = [("file.txt", "granted")].into_iter().collect();
+    let mut guest = Guest::new(&[grant(Arc::new(tmpfs), Access::Read, None)]);
     assert_eq!(guest.call("read_file", FILE), 0, "the read must succeed");
     assert_eq!(
         guest.read_back(),
         b"granted",
-        "a file read beneath a Mount through preview1 must read the Memory's content"
+        "a file read beneath a Mount through preview1 must read the Tmpfs's content"
     );
 }
 
 // @behavior RT-077
 #[test]
 fn a_guest_writes_a_file_beneath_a_read_write_mount() {
-    let memory = Arc::new(Memory::new());
-    let mut guest = Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)]);
+    let tmpfs = Arc::new(Tmpfs::new());
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, None)]);
     assert_eq!(guest.call("write_file", FILE), 0, "the write must succeed");
     assert_eq!(
-        contents(memory.as_ref(), "file.txt").as_deref(),
+        contents(&host(&tmpfs), "file.txt").as_deref(),
         Some(&b"hello"[..]),
-        "a file written beneath a read-write Mount through preview1 must land in the Memory"
+        "a file written beneath a read-write Mount through preview1 must land in the Tmpfs"
     );
 }
 
 // @behavior RT-078
 #[test]
 fn a_change_beneath_a_read_only_mount_is_a_read_only_filesystem() {
-    let mut guest = Guest::new(&[grant(Arc::new(Memory::new()), Access::Read, None)]);
+    let mut guest = Guest::new(&[grant(Arc::new(Tmpfs::new()), Access::Read, None)]);
     assert_eq!(
         guest.call("write_file", FILE),
         ERRNO_ROFS,
@@ -735,12 +1127,12 @@ fn a_change_beneath_a_read_only_mount_is_a_read_only_filesystem() {
 // @behavior RT-078
 #[test]
 fn a_truncating_open_beneath_a_read_only_mount_is_refused() {
-    let memory: Arc<Memory> = Arc::new([("file.txt", "granted")].into_iter().collect());
-    let mut guest = Guest::new(&[grant(memory.clone(), Access::Read, None)]);
+    let tmpfs = tmpfs_with("file.txt", "granted");
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::Read, None)]);
     assert_eq!(
         (
             guest.call("truncate_file", FILE),
-            contents(memory.as_ref(), "file.txt")
+            contents(&host(&tmpfs), "file.txt")
         ),
         (ERRNO_ROFS, Some(b"granted".to_vec())),
         "a read-rights open with O_TRUNC beneath a read-only Mount through preview1 must answer \
@@ -751,8 +1143,8 @@ fn a_truncating_open_beneath_a_read_only_mount_is_refused() {
 // @behavior RT-079
 #[test]
 fn a_path_above_a_mounts_root_is_refused() {
-    let memory: Memory = [("file.txt", "granted")].into_iter().collect();
-    let mut guest = Guest::new(&[grant(Arc::new(memory), Access::Read, None)]);
+    let tmpfs: Tmpfs = [("file.txt", "granted")].into_iter().collect();
+    let mut guest = Guest::new(&[grant(Arc::new(tmpfs), Access::Read, None)]);
     assert_eq!(
         guest.call("read_file", ABOVE_ROOT),
         ERRNO_NOTCAPABLE,
@@ -765,10 +1157,10 @@ fn a_path_above_a_mounts_root_is_refused() {
 // @behavior RT-115
 #[test]
 fn a_path_above_the_directory_it_is_opened_beneath_is_refused() {
-    let memory: Memory = [("file.txt", "granted"), ("dir/inner.txt", "beneath")]
+    let tmpfs: Tmpfs = [("file.txt", "granted"), ("dir/inner.txt", "beneath")]
         .into_iter()
         .collect();
-    let mut guest = Guest::new(&[grant(Arc::new(memory), Access::Read, None)]);
+    let mut guest = Guest::new(&[grant(Arc::new(tmpfs), Access::Read, None)]);
     assert_eq!(
         guest.call("open_beneath_dir", ABOVE_ROOT),
         ERRNO_NOTCAPABLE,
@@ -777,136 +1169,277 @@ fn a_path_above_the_directory_it_is_opened_beneath_is_refused() {
     );
 }
 
-/// What `stat_inner` answers through `dir` opened before `change` runs on
-/// the Memory holding it.
-fn stat_after(change: impl FnOnce(&Memory)) -> i32 {
-    let memory = file_and_directory();
-    let mut guest = Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)]);
+/// What `stat_inner` answers through `dir` opened, beneath a Mount with
+/// `policy`, before `change` runs on the host's root of the Tmpfs
+/// holding it.
+fn stat_after(policy: Option<Arc<dyn Policy>>, change: impl FnOnce(&Path)) -> i32 {
+    let tmpfs = file_and_directory();
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, policy)]);
     assert_eq!(
         guest.call_bare("open_dir"),
         0,
         "dir must open as a directory"
     );
-    change(&memory);
+    change(&host(&tmpfs));
     guest.call_bare("stat_inner")
 }
 
+/// Move `dir` away, its `inner` with it, and make another `dir` holding
+/// an `inner` of its own, so only where the descriptor reaches decides
+/// whether the lookup finds one.
+fn move_and_replace(root: &Path) {
+    vfs::filename_renameat2(&prepare_creds_within(&[], None), root, "dir", root, "moved").unwrap();
+    vfs::filename_mkdirat(&prepare_creds_within(&[], None), root, "dir").unwrap();
+    overwrite(root, "dir/inner");
+}
+
 // A directory made at the path holds an `inner` of its own, so only the
-// identity check keeps the descriptor from reaching it.
+// descriptor still standing for the removed one keeps it from reaching it.
 // @behavior RT-117
 #[test]
-fn a_directory_made_in_an_opened_directorys_place_is_not_reached_through_it() {
-    let answers = (
-        stat_after(|memory| {
-            memory.rename("dir", "moved", Rename::Any).unwrap();
-            memory.create_dir("dir").unwrap();
-            overwrite(memory, "dir/inner");
-        }),
-        stat_after(|memory| {
-            memory.remove_file("dir/inner").unwrap();
-            memory.remove_dir("dir").unwrap();
-            memory.create_dir("dir").unwrap();
-            overwrite(memory, "dir/inner");
-        }),
-    );
+fn a_directory_made_in_a_removed_directorys_place_is_not_reached_through_it() {
+    let answer = stat_after(None, |root| {
+        vfs::filename_unlinkat(&prepare_creds_within(&[], None), root, "dir/inner").unwrap();
+        vfs::filename_rmdir(&prepare_creds_within(&[], None), root, "dir").unwrap();
+        vfs::filename_mkdirat(&prepare_creds_within(&[], None), root, "dir").unwrap();
+        overwrite(root, "dir/inner");
+    });
     assert_eq!(
-        answers,
-        (ERRNO_NOENT, ERRNO_NOENT),
+        answer, ERRNO_NOENT,
         "path_filestat_get through a directory descriptor beneath a Mount through preview1 must \
-         answer ENOENT once another directory stands at its path, moved in or made anew"
+         answer ENOENT once the directory was removed and another made at its path"
     );
 }
 
-/// A Memory naming `dir` by one inode number for as long as nothing holds
-/// it, as a host hands a removed directory's number to the next one made,
-/// and by a fresh number once a held `dir` was removed.
-struct ReusesInodes {
-    memory: Arc<Memory>,
-    holds: Arc<AtomicUsize>,
-    removed_while_held: AtomicUsize,
+// @behavior RT-149
+#[test]
+fn a_directory_moved_while_opened_is_reached_through_its_descriptor() {
+    assert_eq!(
+        stat_after(None, move_and_replace),
+        0,
+        "path_filestat_get through a directory descriptor beneath a Mount without a Policy \
+         through preview1 must reach the directory where it moved"
+    );
 }
 
-/// Counts as holding a directory until it drops.
-struct Holding(Arc<AtomicUsize>);
+// A Bind opens a directory a walk only steps through when a call needs
+// it, so only an open that holds the host directory at once keeps the
+// descriptor on it once another stands at its path.
+// @behavior RT-149
+#[cfg(unix)]
+#[test]
+fn a_host_directory_moved_while_opened_is_reached_through_its_descriptor() {
+    let host = LinkedHost::new("moved-open");
+    std::fs::create_dir_all(host.0.join("real2/inner")).expect("the host tree must be made");
+    std::fs::remove_file(host.0.join("dir")).expect("the link must go");
+    std::fs::rename(host.0.join("real2"), host.0.join("dir")).expect("the directory must move");
+    let mut guest = host.guest();
+    assert_eq!(guest.call_bare("open_dir"), 0, "dir must open");
+    std::fs::rename(host.0.join("dir"), host.0.join("moved")).expect("the directory must move");
+    std::fs::create_dir(host.0.join("dir")).expect("another directory must be made");
+    assert_eq!(
+        guest.call_bare("stat_inner"),
+        0,
+        "path_filestat_get of inner through a descriptor of a host directory beneath a Bind \
+         Mount, moved away after it opened and another made at its path, through preview1 must \
+         reach the directory where it moved"
+    );
+}
 
-impl Drop for Holding {
-    fn drop(&mut self) {
-        self.0.fetch_sub(1, Ordering::SeqCst);
-    }
+// The move goes through another Filesystem instance, which the guest's
+// dentries never see, so only the Tmpfs answering the descriptor's dentry
+// stale, once another directory stands at its path, refuses the call.
+// @behavior RT-150
+#[test]
+fn a_directory_moved_while_opened_beneath_a_policy_is_not_reached() {
+    assert_eq!(
+        stat_after(Some(Arc::new(AllowsAll)), move_and_replace),
+        ERRNO_NOENT,
+        "path_filestat_get through a directory descriptor beneath a Mount with a Policy through \
+         preview1 must answer ENOENT once the directory moved away"
+    );
 }
 
-impl Filesystem for ReusesInodes {
-    holds_no_links!();
-    matches_names_exactly!();
-    is_shared!();
+/// What `call` answers through the directory a guest holds beneath a Policy,
+/// once the directory moved away outside the runtime.
+fn answer_once_moved_away(call: &str) -> i32 {
+    let tmpfs = file_and_directory();
+    let mut guest = Guest::new(&[grant(
+        tmpfs.clone(),
+        Access::ReadWrite,
+        Some(Arc::new(AllowsAll)),
+    )]);
+    assert_eq!(guest.call_bare("open_dir"), 0, "dir must open");
+    move_and_replace(&host(&tmpfs));
+    guest.call_bare(call)
+}
 
-    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
-        self.memory.open(path, options)
-    }
+// A Policy judges no stat or listing, so nothing asks whether the descriptor's
+// dentry still stands; the descriptor answers as its Filesystem holds it.
+// @behavior RT-226
+#[test]
+fn a_descriptor_moved_beneath_a_policy_still_reports_itself() {
+    assert_eq!(
+        answer_once_moved_away("fstat_dir"),
+        0,
+        "fd_filestat_get of a directory descriptor beneath a Mount with a Policy through preview1 \
+         must succeed once the directory moved away"
+    );
+}
 
-    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        let found = self.memory.metadata(path)?;
-        if path != "dir" {
-            return Ok(found);
-        }
-        let ino = 100 + self.removed_while_held.load(Ordering::SeqCst) as u64;
-        Ok(found.with_identity(1, ino))
-    }
+// @behavior RT-227
+#[test]
+fn a_descriptor_moved_beneath_a_policy_still_lists_itself() {
+    assert_eq!(
+        answer_once_moved_away("list_dir"),
+        0,
+        "fd_readdir of a directory descriptor beneath a Mount with a Policy through preview1 must \
+         succeed once the directory moved away"
+    );
+}
+
+// The second Mount shares the instance's dentries, so the move carries
+// the descriptor's along, and the Policy judges the path it moved to:
+// allowed there it reaches `inner`, refused there it answers EACCES.
+// @behavior RT-170
+#[test]
+fn a_directory_moved_beneath_another_mount_of_its_instance_is_reached_beneath_a_policy() {
+    let open_after_move = |policy: Arc<dyn Policy>| {
+        let instance = Filesystem::new(file_and_directory()).expect("the instance must stand");
+        let mount = Mount::new("/data", instance.clone(), Access::ReadWrite)
+            .expect("/data is a guest path");
+        let mut guest = Guest::new(&[Grant::Mount(mount.clone().with_policy(policy))]);
+        assert_eq!(guest.call_bare("open_dir"), 0, "dir must open");
+        let other = Path::root(mount.mnt());
+        vfs::filename_renameat2(
+            &prepare_creds_within(&[], None),
+            &other,
+            "dir",
+            &other,
+            "moved",
+        )
+        .expect("the directory must move");
+        vfs::filename_mkdirat(&prepare_creds_within(&[], None), &other, "dir")
+            .expect("another directory must be made");
+        guest.call_bare("open_inner")
+    };
+    assert_eq!(
+        (
+            open_after_move(Arc::new(AllowsAll)),
+            open_after_move(Arc::new(Refuses("/data/moved/inner")))
+        ),
+        (0, ERRNO_ACCES),
+        "path_open of inner through a directory descriptor beneath a Mount with a Policy, \
+         once the directory moved beneath another Mount of the same Filesystem instance, through \
+         preview1 must reach it where it moved, as the Policy judges that path"
+    );
+}
 
-    fn hold_directory(&self, path: &str) -> Result<Option<Hold>, FilesystemError> {
-        if path != "dir" {
-            return Ok(None);
-        }
-        self.holds.fetch_add(1, Ordering::SeqCst);
-        Ok(Some(Hold::new(Holding(self.holds.clone()))))
-    }
+/// A Tmpfs naming `dir` by one inode number for as long as no directory
+/// it opened there is open, as a host hands a removed directory's number
+/// to the next one made, and by a fresh number once an open `dir` was
+/// removed.
+#[derive(Default)]
+struct ReusesInodes {
+    found: Mutex<Vec<Weak<dyn InodeOperations>>>,
+    removed_while_open: AtomicUsize,
+}
 
-    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-        self.memory.read_dir(path)
+impl ReusesInodes {
+    fn dir_kstat(&self, found: Kstat) -> Kstat {
+        let ino = 100 + self.removed_while_open.load(Ordering::SeqCst) as u64;
+        found.with_identity(1, ino)
     }
+}
 
-    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.memory.create_dir(path)
+impl Hook for ReusesInodes {
+    fn getattr(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<Kstat, FilesystemError> {
+        let found = inner.getattr(dentry)?;
+        Ok(match dentry.name().as_str() {
+            "dir" => self.dir_kstat(found),
+            _ => found,
+        })
     }
 
-    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.memory.remove_dir(path)?;
-        if self.holds.load(Ordering::SeqCst) > 0 {
-            self.removed_while_held.fetch_add(1, Ordering::SeqCst);
-        }
-        Ok(())
+    fn lookup(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<Lookup, FilesystemError> {
+        Ok(match inner.lookup(dentry)? {
+            Lookup::Found(inode) if dentry.name() == "dir" => {
+                self.found.lock().unwrap().push(Arc::downgrade(inode.ops()));
+                let found = self.dir_kstat(inode.ops().getattr(dentry)?);
+                Lookup::Found(Inode::new(&found, inode.ops().clone()))
+            }
+            other => other,
+        })
     }
 
-    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-        self.memory.remove_file(path)
+    /// Its root answers as the Filesystem's and sets up nothing of it.
+    fn fill_super(
+        &self,
+        fs: Arc<dyn FileSystemType>,
+        sb: &mut Filesystem,
+    ) -> Result<(), FilesystemError> {
+        let beneath = Filesystem::new(fs)?;
+        let root = beneath
+            .root()
+            .and_then(|root| root.inode())
+            .ok_or(FilesystemError::NotFound)?;
+        sb.d_make_root(vfs::Inode::new(
+            &vfs::Kstat::new(vfs::FileType::Dir, 0),
+            root.ops().clone(),
+        ));
+        Ok(())
     }
 
-    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-        self.memory.rename(from, to, rename)
+    /// The call removing it holds what it looked up, so `dir` is open
+    /// beyond that only where a descriptor holds it too.
+    fn rmdir(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
+        let removed = inner.rmdir(dentry);
+        let held = self
+            .found
+            .lock()
+            .unwrap()
+            .iter()
+            .filter(|dir| dir.strong_count() > 0)
+            .count();
+        if removed.is_ok() && dentry.name() == "dir" && held > 1 {
+            self.removed_while_open.fetch_add(1, Ordering::SeqCst);
+        }
+        removed
     }
 }
 
-// The Filesystem gives the new `dir` the old one's number unless a Hold
-// on it lives, so only the descriptor keeping its Hold refuses the call.
+// The Filesystem gives the new `dir` the old one's number unless the
+// directory opened there is still open, and beneath a Policy the
+// descriptor finds its directory again by that number, so only the
+// descriptor keeping the directory open refuses the call.
 // @behavior RT-121
 #[test]
 fn a_directory_descriptor_holds_its_directory_while_open() {
-    let memory = file_and_directory();
-    let reuses = Arc::new(ReusesInodes {
-        memory: memory.clone(),
-        holds: Arc::new(AtomicUsize::new(0)),
-        removed_while_held: AtomicUsize::new(0),
-    });
-    let mut guest = Guest::new(&[grant(reuses.clone(), Access::ReadWrite, None)]);
+    let tmpfs = file_and_directory();
+    let reuses = Wrap::new(tmpfs.clone(), Arc::new(ReusesInodes::default()));
+    let mut guest = Guest::new(&[grant(
+        reuses.clone(),
+        Access::ReadWrite,
+        Some(Arc::new(AllowsAll)),
+    )]);
     assert_eq!(
         guest.call_bare("open_dir"),
         0,
         "dir must open as a directory"
     );
-    reuses.remove_file("dir/inner").unwrap();
-    reuses.remove_dir("dir").unwrap();
-    reuses.create_dir("dir").unwrap();
-    overwrite(memory.as_ref(), "dir/inner");
+    let outside = host(&reuses);
+    vfs::filename_unlinkat(&prepare_creds_within(&[], None), &outside, "dir/inner").unwrap();
+    vfs::filename_rmdir(&prepare_creds_within(&[], None), &outside, "dir").unwrap();
+    vfs::filename_mkdirat(&prepare_creds_within(&[], None), &outside, "dir").unwrap();
+    overwrite(&host(&tmpfs), "dir/inner");
     assert_eq!(
         guest.call_bare("stat_inner"),
         ERRNO_NOENT,
@@ -916,16 +1449,121 @@ fn a_directory_descriptor_holds_its_directory_while_open() {
     );
 }
 
+/// A Tmpfs reporting no identity for anything it holds, as a host whose
+/// stat names no inode.
+struct NamesNoIdentity;
+
+impl Hook for NamesNoIdentity {
+    fn lookup(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<Lookup, FilesystemError> {
+        Ok(match inner.lookup(dentry)? {
+            Lookup::Found(inode) => {
+                let found = inode.ops().getattr(dentry)?;
+                let bare = Kstat::new(found.file_type, found.size);
+                Lookup::Found(Inode::new(&bare, inode.ops().clone()))
+            }
+            other => other,
+        })
+    }
+}
+
+// Without an identity the descriptor cannot tell its directory from one
+// made in its place, so beneath a Policy it answers less rather than
+// reach another.
+// @behavior RT-151
+#[test]
+fn a_directory_without_an_identity_is_not_reached_again_beneath_a_policy() {
+    let mut guest = Guest::new(&[grant(
+        Wrap::new(file_and_directory(), Arc::new(NamesNoIdentity)),
+        Access::ReadWrite,
+        Some(Arc::new(AllowsAll)),
+    )]);
+    assert_eq!(
+        (guest.call_bare("open_dir"), guest.call_bare("stat_inner")),
+        (0, ERRNO_NOENT),
+        "path_filestat_get through a directory descriptor beneath a Mount with a Policy, over a \
+         Filesystem reporting no identity, through preview1 must answer ENOENT"
+    );
+}
+
+// @behavior RT-233
+#[test]
+fn a_directory_without_an_identity_still_reports_itself_beneath_a_policy() {
+    let mut guest = Guest::new(&[grant(
+        Wrap::new(file_and_directory(), Arc::new(NamesNoIdentity)),
+        Access::ReadWrite,
+        Some(Arc::new(AllowsAll)),
+    )]);
+    assert_eq!(
+        (guest.call_bare("open_dir"), guest.call_bare("fstat_dir")),
+        (0, 0),
+        "fd_filestat_get of a directory descriptor beneath a Mount with a Policy, over a \
+         Filesystem reporting no identity, through preview1 must succeed"
+    );
+}
+
+// The table holds the three standard descriptors and the preopen alone, so a
+// missing path, or one no call can take, could only answer EMFILE by asking
+// the table first. A path of `PATH_MAX` bytes is too long, an empty one or one
+// holding a NUL names nothing, and one that is not UTF-8 is never decoded.
+// @behavior RT-190
+#[test]
+fn a_full_table_answers_emfile_whatever_the_path_names() {
+    let mut guest = Guest::with_open_file_limit(
+        Some(4),
+        &[grant(file_and_directory(), Access::ReadWrite, None)],
+    );
+    let too_long = (0, i32::try_from(PATH_MAX).expect("PATH_MAX fits an i32"));
+    let answers = [THROUGH_MISSING, EMPTY, HOLDING_NUL, too_long, NOT_UTF8]
+        .map(|path| guest.call("read_file", path));
+    assert_eq!(
+        answers, [ERRNO_MFILE; 5],
+        "path_open of a missing, empty, NUL-holding, too long, or non-UTF-8 path through \
+         preview1 with no descriptor left must answer EMFILE, as Linux's FD_ADD takes one \
+         before do_file_open answers for the name"
+    );
+}
+
+// The three standard descriptors and the preopen leave room for one more,
+// so a directory spanning both Layers taking more than one leaves none
+// for the file.
+// @behavior RT-152
+#[test]
+fn an_overlay_directory_takes_one_descriptor_however_many_layers_it_spans() {
+    let overlay = Overlay::new(
+        vec![Filesystem::new(file_and_directory()).expect("the instance must stand")],
+        Some(Filesystem::new(tmpfs_with("dir/upper", "u")).expect("the instance must stand")),
+    )
+    .expect("an upper over a lower Layer must make a view");
+    let mut guest = Guest::with_open_file_limit(
+        Some(6),
+        &[grant(Arc::new(overlay), Access::ReadWrite, None)],
+    );
+    assert_eq!(
+        (
+            guest.call_bare("open_dir"),
+            guest.call("read_file", FILE),
+            guest.call("read_file", FILE)
+        ),
+        (0, 0, ERRNO_MFILE),
+        "path_open of a directory two Layers of an Overlay hold, then of files, beneath a Mount \
+         through preview1 with room for two descriptors must take one descriptor for each"
+    );
+}
+
 // The open looks the directory up without following a link at its end, so
 // the identity it remembers comes from the Overlay's lstat, and every later
 // call compares it with the Overlay's stat.
 #[test]
 fn a_directory_two_layers_hold_is_reached_through_its_descriptor() {
-    let upper: Arc<dyn Filesystem> = Arc::new([("dir/upper", "u")].into_iter().collect::<Memory>());
-    let lower: Arc<dyn Filesystem> = file_and_directory();
-    let overlay = Overlay::new()
-        .layer(upper, Access::ReadWrite)
-        .layer(lower, Access::Read);
+    let overlay = Overlay::new(
+        vec![Filesystem::new(file_and_directory()).expect("the instance must stand")],
+        Some(Filesystem::new(tmpfs_with("dir/upper", "u")).expect("the instance must stand")),
+    )
+    .expect("an upper over a lower Layer must make a view");
     let mut guest = Guest::new(&[grant(Arc::new(overlay), Access::ReadWrite, None)]);
     assert_eq!(
         (guest.call_bare("open_dir"), guest.call_bare("stat_inner")),
@@ -938,9 +1576,11 @@ fn a_directory_two_layers_hold_is_reached_through_its_descriptor() {
 // @behavior RT-118
 #[test]
 fn a_directory_moved_back_to_its_path_is_reached_through_its_descriptor_again() {
-    let answer = stat_after(|memory| {
-        memory.rename("dir", "moved", Rename::Any).unwrap();
-        memory.rename("moved", "dir", Rename::Any).unwrap();
+    let answer = stat_after(None, |root| {
+        vfs::filename_renameat2(&prepare_creds_within(&[], None), root, "dir", root, "moved")
+            .unwrap();
+        vfs::filename_renameat2(&prepare_creds_within(&[], None), root, "moved", root, "dir")
+            .unwrap();
     });
     assert_eq!(
         answer, 0,
@@ -952,9 +1592,9 @@ fn a_directory_moved_back_to_its_path_is_reached_through_its_descriptor_again()
 // @behavior RT-080
 #[test]
 fn a_policy_refusing_an_open_answers_access_denied() {
-    let memory: Memory = [("file.txt", "granted")].into_iter().collect();
+    let tmpfs: Tmpfs = [("file.txt", "granted")].into_iter().collect();
     let policy: Arc<dyn Policy> = Arc::new(Refuses("/data/file.txt"));
-    let mut guest = Guest::new(&[grant(Arc::new(memory), Access::Read, Some(policy))]);
+    let mut guest = Guest::new(&[grant(Arc::new(tmpfs), Access::Read, Some(policy))]);
     assert_eq!(
         guest.call("read_file", FILE),
         ERRNO_ACCES,
@@ -964,22 +1604,26 @@ fn a_policy_refusing_an_open_answers_access_denied() {
 
 // @behavior RT-081
 #[test]
-fn a_policy_decides_in_the_place_of_a_mounts_access() {
-    let memory = Arc::new(Memory::new());
+fn a_policy_cannot_widen_a_mounts_access() {
+    let tmpfs = Arc::new(Tmpfs::new());
     let policy: Arc<dyn Policy> = Arc::new(AllowsAll);
-    let mut guest = Guest::new(&[grant(memory.clone(), Access::Read, Some(policy))]);
-    assert_eq!(guest.call("write_file", FILE), 0, "the write must succeed");
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::Read, Some(policy))]);
     assert_eq!(
-        contents(memory.as_ref(), "file.txt").as_deref(),
-        Some(&b"hello"[..]),
-        "a write a Policy allows beneath a read-only Mount through preview1 must land"
+        (
+            guest.call("write_file", FILE),
+            contents(&host(&tmpfs), "file.txt")
+        ),
+        (ERRNO_ROFS, None),
+        "a write a Policy allows beneath a read-only Mount through preview1 must answer EROFS \
+         and leave nothing behind"
     );
 }
 
 // @behavior RT-082
 #[test]
-fn each_invocation_is_handed_the_filesystem_it_starts_from() {
-    let grants = [grant(Arc::new(Temporary::new()), Access::ReadWrite, None)];
+fn every_invocation_reaches_the_filesystem_its_mount_holds() {
+    let tmpfs = Arc::new(Tmpfs::new());
+    let grants = [grant(tmpfs.clone(), Access::ReadWrite, None)];
     assert_eq!(
         Guest::new(&grants).call("write_file", FILE),
         0,
@@ -987,24 +1631,30 @@ fn each_invocation_is_handed_the_filesystem_it_starts_from() {
     );
     assert_eq!(
         Guest::new(&grants).call("read_file", FILE),
-        ERRNO_NOENT,
-        "a file an earlier invocation wrote to a Temporary must not be found by the next one"
+        0,
+        "a file an earlier invocation wrote beneath a Mount over a Tmpfs must be found by the \
+         next invocation through preview1"
+    );
+    assert_eq!(
+        contents(&host(&tmpfs), "file.txt").as_deref(),
+        Some(&b"hello"[..]),
+        "the file the next invocation finds must hold what the earlier invocation wrote"
     );
 }
 
-/// A Memory holding `file.txt` that counts every change it is asked for,
+/// A Tmpfs holding `file.txt` that counts every change it is asked for,
 /// so a test can tell the runtime refused before asking it.
+#[derive(Default)]
 struct ChangeCounter {
-    memory: Memory,
     changes: AtomicUsize,
 }
 
 impl ChangeCounter {
-    fn new() -> Arc<Self> {
-        Arc::new(Self {
-            memory: [("file.txt", "granted")].into_iter().collect(),
-            changes: AtomicUsize::new(0),
-        })
+    /// A counter, and a Tmpfs holding `file.txt` it counts the changes of.
+    fn over_file() -> (Arc<Self>, Arc<Wrap<Self>>) {
+        let counter = Arc::new(Self::default());
+        let tmpfs: Tmpfs = [("file.txt", "granted")].into_iter().collect();
+        (counter.clone(), Wrap::new(Arc::new(tmpfs), counter))
     }
 
     fn change(&self) {
@@ -1012,125 +1662,68 @@ impl ChangeCounter {
     }
 }
 
-impl Filesystem for ChangeCounter {
-    holds_no_links!();
-    matches_names_exactly!();
-    never_repeats_identities!();
-    is_shared!();
-
-    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
-        self.memory.open(path, options)
-    }
-
-    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        self.memory.metadata(path)
-    }
-
-    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-        self.memory.read_dir(path)
-    }
-
-    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
+impl Hook for ChangeCounter {
+    fn mkdir(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
         self.change();
-        self.memory.create_dir(path)
+        inner.mkdir(dentry)
     }
 
-    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
+    fn rmdir(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
         self.change();
-        self.memory.remove_dir(path)
+        inner.rmdir(dentry)
     }
 
-    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
+    fn unlink(&self, inner: &dyn InodeOperations, dentry: &Dentry) -> Result<(), FilesystemError> {
         self.change();
-        self.memory.remove_file(path)
+        inner.unlink(dentry)
     }
 
-    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
+    fn rename(
+        &self,
+        inner: &dyn InodeOperations,
+        from: &Dentry,
+        to_dir: &dyn InodeOperations,
+        to: &Dentry,
+        flag: Option<RenameFlag>,
+    ) -> Result<(), FilesystemError> {
         self.change();
-        self.memory.rename(from, to, rename)
-    }
-}
-
-/// A Memory holding `file.txt` that, as a rename reaches it, replaces the
-/// file with a directory holding `secret`, as another invocation sharing
-/// the Memory could between the runtime's checks and the move.
-struct SwappedForADirectory(Memory);
-
-impl SwappedForADirectory {
-    fn new() -> Arc<Self> {
-        Arc::new(Self([("file.txt", "granted")].into_iter().collect()))
-    }
-}
-
-impl Filesystem for SwappedForADirectory {
-    holds_no_links!();
-    matches_names_exactly!();
-    never_repeats_identities!();
-    is_shared!();
-
-    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
-        self.0.open(path, options)
-    }
-
-    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        self.0.metadata(path)
-    }
-
-    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-        self.0.read_dir(path)
-    }
-
-    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.create_dir(path)
-    }
-
-    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.remove_dir(path)
-    }
-
-    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.remove_file(path)
-    }
-
-    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-        self.0.remove_file(from)?;
-        self.0.create_dir(from)?;
-        drop(self.0.open(
-            &format!("{from}/secret"),
-            &build_options(|options| (options.write, options.create) = (true, true)),
-        )?);
-        self.0.rename(from, to, rename)
+        inner.rename(from, to_dir, to, flag)
     }
 }
 
 // The Policy allows everything, so only the rename's own refusal of a
-// directory, checked as the Filesystem moves it, keeps `secret` from
-// taking a path the Policy never judged.
+// directory keeps `secret` from taking a path the Policy never judged.
 // @behavior RT-094
 #[test]
 fn a_directory_beneath_a_mount_with_a_policy_does_not_move() {
-    let swapped = SwappedForADirectory::new();
+    let tmpfs = Arc::new([("dir/secret", "x")].into_iter().collect::<Tmpfs>());
     let policy: Arc<dyn Policy> = Arc::new(AllowsAll);
-    let mut guest = Guest::new(&[grant(swapped.clone(), Access::ReadWrite, Some(policy))]);
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, Some(policy))]);
     assert_eq!(
         (
-            guest.call_bare("rename_to_new"),
-            swapped.metadata("new.txt/secret")
+            guest.call_pair("rename_paths", DIR, MOVED),
+            vfs::vfs_fstatat(
+                &prepare_creds_within(&[], None),
+                &host(&tmpfs),
+                "dir/secret",
+                false
+            )
+            .map(|m| m.file_type)
         ),
-        (ERRNO_XDEV, Err(FilesystemError::NotFound)),
-        "path_rename of what is a directory by the time it moves, beneath a Mount with a \
-         Policy, through preview1 must answer EXDEV and move nothing"
+        (ERRNO_XDEV, Ok(FileType::RegFile)),
+        "path_rename of a directory beneath a Mount with a Policy through preview1 must \
+         answer EXDEV and move nothing"
     );
 }
 
-/// A Memory whose files take another writer's `bbb` at their end as one
+/// A Tmpfs whose files take another writer's `bbb` at their end as one
 /// is written, once the length the write would land at is known and
 /// before it lands, as another invocation sharing the file could.
-struct AppendedMeanwhile(Memory);
+struct AppendedMeanwhile;
 
 struct AppendedMeanwhileFile {
-    file: Box<dyn File>,
-    other: std::sync::Mutex<Box<dyn File>>,
+    file: Box<dyn FileOperations>,
+    other: std::sync::Mutex<Box<dyn FileOperations>>,
 }
 
 impl AppendedMeanwhileFile {
@@ -1138,75 +1731,39 @@ impl AppendedMeanwhileFile {
         self.other
             .lock()
             .expect("the other writer's lock must not be poisoned")
-            .append(b"bbb")
+            .write_iter(&mut Kiocb::at(0).with_append(), b"bbb")
             .map(drop)
     }
 }
 
-impl File for AppendedMeanwhileFile {
-    fn read_at(&mut self, buf: &mut [u8], offset: u64) -> Result<usize, FilesystemError> {
-        self.file.read_at(buf, offset)
-    }
-
-    fn write_at(&mut self, buf: &[u8], offset: u64) -> Result<usize, FilesystemError> {
-        self.file.write_at(buf, offset)
-    }
-
-    /// The length is read before the other writer appends, so a write
-    /// placed by it lands over what the other wrote.
-    fn metadata(&self) -> Result<Metadata, FilesystemError> {
-        let metadata = self.file.metadata()?;
-        self.other_appends()?;
-        Ok(metadata)
+impl FileOperations for AppendedMeanwhileFile {
+    fn read_iter(&mut self, iocb: &mut Kiocb, buf: &mut [u8]) -> Result<usize, FilesystemError> {
+        self.file.read_iter(iocb, buf)
     }
 
-    fn set_len(&mut self, len: u64) -> Result<(), FilesystemError> {
-        self.file.set_len(len)
-    }
-
-    fn append(&mut self, buf: &[u8]) -> Result<(u64, usize), FilesystemError> {
-        self.other_appends()?;
-        self.file.append(buf)
+    fn write_iter(&mut self, iocb: &mut Kiocb, buf: &[u8]) -> Result<usize, FilesystemError> {
+        if iocb.append {
+            self.other_appends()?;
+        }
+        self.file.write_iter(iocb, buf)
     }
 }
 
-impl Filesystem for AppendedMeanwhile {
-    holds_no_links!();
-    matches_names_exactly!();
-    never_repeats_identities!();
-    is_shared!();
-
-    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
-        let writes = build_options(|options| options.write = true);
+impl Hook for AppendedMeanwhile {
+    fn open(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        let writes = build_how(|how| how.write = true);
+        let file = inner.open(dentry, how)?;
+        let other = inner.open(dentry, &writes)?;
         Ok(Box::new(AppendedMeanwhileFile {
-            file: self.0.open(path, options)?,
-            other: std::sync::Mutex::new(self.0.open(path, &writes)?),
+            file,
+            other: std::sync::Mutex::new(other),
         }))
     }
-
-    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        self.0.metadata(path)
-    }
-
-    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-        self.0.read_dir(path)
-    }
-
-    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.create_dir(path)
-    }
-
-    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.remove_dir(path)
-    }
-
-    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.remove_file(path)
-    }
-
-    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-        self.0.rename(from, to, rename)
-    }
 }
 
 // The other writer's `bbb` lands as the guest's append is made, so only
@@ -1214,13 +1771,13 @@ impl Filesystem for AppendedMeanwhile {
 // @behavior RT-095
 #[test]
 fn an_append_lands_after_another_writers_append() {
-    let memory: Memory = [("file.txt", "granted")].into_iter().collect();
-    let shared = Arc::new(AppendedMeanwhile(memory));
-    let mut guest = Guest::new(&[grant(shared.clone(), Access::ReadWrite, None)]);
+    let tmpfs = tmpfs_with("file.txt", "granted");
+    let shared = Wrap::new(tmpfs.clone(), Arc::new(AppendedMeanwhile));
+    let mut guest = Guest::new(&[grant(shared, Access::ReadWrite, None)]);
     assert_eq!(
         (
             guest.call("append_file", FILE),
-            contents(&shared.0, "file.txt")
+            contents(&host(&tmpfs), "file.txt")
         ),
         (0, Some(b"grantedbbbhello".to_vec())),
         "fd_write to a file opened to append beneath a Mount through preview1 must land after \
@@ -1228,22 +1785,26 @@ fn an_append_lands_after_another_writers_append() {
     );
 }
 
+#[cfg(unix)]
 const FILETYPE_UNKNOWN: u8 = 0;
+#[cfg(unix)]
 const FILETYPE_DIRECTORY: u8 = 3;
+#[cfg(unix)]
 const FILETYPE_REGULAR_FILE: u8 = 4;
+#[cfg(unix)]
 const FILETYPE_SYMBOLIC_LINK: u8 = 7;
 
 /// A host directory of its own holding `file.txt` as a link to `target`,
-/// made by `make_target`, and a guest handed it as a read-only Directory
+/// made by `make_target`, and a guest handed it as a read-only Bind
 /// Mount.
 #[cfg(unix)]
-fn linked(name: &str, make_target: fn(&std::path::Path)) -> (std::path::PathBuf, Guest) {
-    linked_under(name, make_target, Access::Read, None)
+fn mount_link(name: &str, make_target: fn(&std::path::Path)) -> (std::path::PathBuf, Guest) {
+    mount_link_under(name, make_target, Access::Read, None)
 }
 
 /// As `linked`, the Mount taking `access` and `policy`.
 #[cfg(unix)]
-fn linked_under(
+fn mount_link_under(
     name: &str,
     make_target: fn(&std::path::Path),
     access: Access,
@@ -1254,13 +1815,13 @@ fn linked_under(
     std::fs::create_dir_all(&host).expect("the host directory must be created");
     make_target(&host.join("target"));
     std::os::unix::fs::symlink("target", host.join("file.txt")).expect("the link must be made");
-    let directory = Directory::new(&host).expect("the host directory must open");
+    let directory = Bind::new(&host).expect("the host directory must open");
     let guest = Guest::new(&[grant(Arc::new(directory), access, policy)]);
     (host, guest)
 }
 
 /// What each stat of `path` with the given lookupflags answers, and the
-/// filetype it wrote, beneath a Directory Mount whose host directory
+/// filetype it wrote, beneath a Bind Mount whose host directory
 /// holds `file.txt` as a link to `target`, made by `make_target`.
 #[cfg(unix)]
 fn stat_link(
@@ -1268,16 +1829,11 @@ fn stat_link(
     make_target: fn(&std::path::Path),
     stats: &[((i32, i32), i32)],
 ) -> Vec<(i32, u8)> {
-    let (host, mut guest) = linked(name, make_target);
+    let (host, mut guest) = mount_link(name, make_target);
     let answers = stats
         .iter()
         .map(|&(path, flags)| {
-            let errno = guest
-                .instance
-                .get_typed_func::<(i32, i32, i32), i32>(&mut guest.store, "stat_flagged")
-                .expect("probe export must resolve")
-                .call(&mut guest.store, (path.0, path.1, flags))
-                .expect("probe call must not trap");
+            let errno = guest.stat_flagged(path, flags);
             let memory = guest
                 .instance
                 .get_memory(&mut guest.store, "memory")
@@ -1303,14 +1859,9 @@ fn a_guest_sees_a_fifo_as_of_an_unknown_type_and_cannot_open_it() {
         .status()
         .expect("mkfifo must run");
     assert!(made.success(), "the FIFO must be made");
-    let directory = Directory::new(&host).expect("the host directory must open");
+    let directory = Bind::new(&host).expect("the host directory must open");
     let mut guest = Guest::new(&[grant(Arc::new(directory), Access::Read, None)]);
-    let stat = guest
-        .instance
-        .get_typed_func::<(i32, i32, i32), i32>(&mut guest.store, "stat_flagged")
-        .expect("probe export must resolve")
-        .call(&mut guest.store, (FILE.0, FILE.1, 0))
-        .expect("probe call must not trap");
+    let stat = guest.stat_flagged(FILE, 0);
     let filestat = guest
         .instance
         .get_memory(&mut guest.store, "memory")
@@ -1323,11 +1874,40 @@ fn a_guest_sees_a_fifo_as_of_an_unknown_type_and_cannot_open_it() {
     assert_eq!(
         (stat, filestat[16], nlink, opened),
         (0, FILETYPE_UNKNOWN, 1, ERRNO_ACCES),
-        "path_filestat_get of a FIFO beneath a Directory Mount through preview1 must report an \
+        "path_filestat_get of a FIFO beneath a Bind Mount through preview1 must report an \
          unknown filetype named once, and path_open of it must answer EACCES"
     );
 }
 
+// Bound and never accepted, so an open reaching it would answer ENXIO rather
+// than the refusal asserted here.
+// @behavior RT-196
+#[cfg(unix)]
+#[test]
+fn a_guest_sees_a_socket_as_one_and_cannot_open_it() {
+    let host = std::env::temp_dir().join(format!("kobako-granted-sock-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&host);
+    std::fs::create_dir_all(&host).expect("the host directory must be created");
+    let _socket = std::os::unix::net::UnixListener::bind(host.join("file.txt"))
+        .expect("the socket must be bound");
+    let directory = Bind::new(&host).expect("the host directory must open");
+    let mut guest = Guest::new(&[grant(Arc::new(directory), Access::Read, None)]);
+    let stat = guest.stat_flagged(FILE, 0);
+    let filetype = guest
+        .instance
+        .get_memory(&mut guest.store, "memory")
+        .expect("probe exports its memory")
+        .data(&guest.store)[384 + 16];
+    let opened = guest.call("read_file", FILE);
+    let _ = std::fs::remove_dir_all(&host);
+    assert_eq!(
+        (stat, filetype, opened),
+        (0, 6, ERRNO_ACCES),
+        "path_filestat_get of a socket beneath a Bind Mount through preview1 must report a \
+         stream socket, and path_open of it must answer EACCES"
+    );
+}
+
 // The link points at a regular file, so only a stat that follows none
 // can answer a link.
 // @behavior RT-097
@@ -1342,11 +1922,84 @@ fn a_stat_following_no_link_reports_the_link_itself() {
     assert_eq!(
         answers,
         [(0, FILETYPE_REGULAR_FILE), (0, FILETYPE_SYMBOLIC_LINK)],
-        "path_filestat_get of a host link beneath a Directory Mount through preview1 must report \
+        "path_filestat_get of a host link beneath a Bind Mount through preview1 must report \
          the file it points to when following links, and a symbolic link when following none"
     );
 }
 
+// A host link reports the length of where it points, so only what the runtime
+// shows a guest keeps that length from it.
+// @behavior RT-173
+#[cfg(unix)]
+#[test]
+fn a_link_reports_no_size_however_its_filesystem_sizes_it() {
+    let (host, mut guest) = mount_link("link-size", |target| {
+        std::fs::write(target, "granted").expect("the host file must be written")
+    });
+    let answered = guest.stat_flagged(FILE, 0);
+    let size = guest.stat_field(32);
+    let _ = std::fs::remove_dir_all(&host);
+    assert_eq!(
+        (answered, size),
+        (0, 0),
+        "path_filestat_get following no link of a host link beneath a Bind Mount through \
+         preview1 must report a size of zero"
+    );
+}
+
+/// One Tmpfs read-write, as an invocation on each posture is handed it.
+fn tmpfs_grant(tmpfs: &Arc<Tmpfs>) -> [Grant; 1] {
+    [grant(tmpfs.clone(), Access::ReadWrite, None)]
+}
+
+// @behavior RT-156
+#[test]
+fn the_weaker_posture_sees_the_times_a_filesystem_keeps() {
+    let mut guest = Guest::for_posture(Profile::Permissive, &tmpfs_grant(&Arc::new(Tmpfs::new())));
+    let before = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("the host clock stands past the epoch")
+        .as_nanos() as u64;
+    assert_eq!(guest.call("write_file", FILE), 0, "the write must succeed");
+    assert!(
+        guest.times_of_path(FILE)[1] >= before,
+        "path_filestat_get of a file written beneath a Mount through preview1 on the weaker \
+         posture must report a modification time no earlier than the write"
+    );
+}
+
+// A Tmpfs records the host's real time, so only the posture's view turns it
+// into the epoch.
+// @behavior RT-157
+#[test]
+fn the_strongest_posture_sees_every_time_at_the_unix_epoch() {
+    let mut guest = Guest::for_posture(Profile::Hermetic, &tmpfs_grant(&Arc::new(Tmpfs::new())));
+    assert_eq!(guest.call("write_file", FILE), 0, "the write must succeed");
+    let path = guest.times_of_path(FILE);
+    assert_eq!(guest.call("stat_opened", FILE), 0, "the stat must succeed");
+    assert_eq!(
+        (path, guest.stat_times()),
+        ([0; 3], [0; 3]),
+        "path_filestat_get and fd_filestat_get of a written file through preview1 on the \
+         strongest posture must report each time as the Unix epoch"
+    );
+}
+
+// @behavior RT-158
+#[test]
+fn a_time_another_posture_wrote_reaches_the_strongest_posture_as_the_epoch() {
+    let tmpfs = Arc::new(Tmpfs::new());
+    let mut writer = Guest::for_posture(Profile::Permissive, &tmpfs_grant(&tmpfs));
+    assert_eq!(writer.call("write_file", FILE), 0, "the write must succeed");
+    let mut reader = Guest::for_posture(Profile::Hermetic, &tmpfs_grant(&tmpfs));
+    assert_eq!(
+        reader.times_of_path(FILE),
+        [0; 3],
+        "path_filestat_get through preview1 on the strongest posture, of a file the weaker \
+         posture wrote into the same Tmpfs, must report each time as the Unix epoch"
+    );
+}
+
 // The stat follows no link, so only the trailing `/` can make it reach
 // the directory the link points at, as Linux's `lstat` does.
 // @behavior RT-098
@@ -1362,18 +2015,18 @@ fn a_stat_of_a_link_named_with_a_trailing_slash_reports_its_directory() {
         answers,
         [(0, FILETYPE_DIRECTORY), (0, FILETYPE_SYMBOLIC_LINK)],
         "path_filestat_get following no link of a host link to a directory, named with a \
-         trailing slash, beneath a Directory Mount through preview1 must report the directory, \
+         trailing slash, beneath a Bind Mount through preview1 must report the directory, \
          and without the slash a symbolic link"
     );
 }
 
 /// What `path_unlink_file` and `path_rename` answer for the link
-/// `file.txt/` to a directory beneath a read-write Directory Mount taking
+/// `file.txt/` to a directory beneath a read-write Bind Mount taking
 /// `policy`, and whether the link stays; `name` keeps its host directory
 /// its own.
 #[cfg(unix)]
 fn change_link_named_as_directory(name: &str, policy: Option<Arc<dyn Policy>>) -> ([i32; 2], bool) {
-    let (host, mut guest) = linked_under(name, directory_with_key, Access::ReadWrite, policy);
+    let (host, mut guest) = mount_link_under(name, directory_with_key, Access::ReadWrite, policy);
     let answers = [
         guest.call("unlink_path", FILE_AS_DIRECTORY),
         guest.call_pair("rename_paths", FILE_AS_DIRECTORY, MOVED),
@@ -1397,7 +2050,7 @@ fn a_link_named_with_a_trailing_slash_is_neither_removed_nor_moved() {
         ],
         [([ERRNO_NOTDIR, ERRNO_NOTDIR], true); 2],
         "path_unlink_file and path_rename of a host link to a directory named with a trailing \
-         slash, beneath a read-write Directory Mount with or without a Policy through preview1, \
+         slash, beneath a read-write Bind Mount with or without a Policy through preview1, \
          must answer ENOTDIR as Linux does and leave the link"
     );
 }
@@ -1416,7 +2069,7 @@ fn an_unlink_with_a_trailing_slash_answers_for_the_name_itself() {
     std::fs::create_dir_all(host.join("dir")).expect("the host directory must be created");
     std::fs::write(host.join("file.txt"), "granted").expect("the host file must be written");
     std::os::unix::fs::symlink("nowhere", host.join("gone")).expect("the link must be made");
-    let directory = Directory::new(&host).expect("the host directory must open");
+    let directory = Bind::new(&host).expect("the host directory must open");
     let mut guest = Guest::new(&[grant(Arc::new(directory), Access::ReadWrite, None)]);
     let answers = [
         DIR_AS_DIRECTORY,
@@ -1434,22 +2087,122 @@ fn an_unlink_with_a_trailing_slash_answers_for_the_name_itself() {
             [true; 3]
         ),
         "path_unlink_file of a directory, a file, a link to nothing, and a missing name, each \
-         named with a trailing slash beneath a read-write Directory Mount through preview1, must \
+         named with a trailing slash beneath a read-write Bind Mount through preview1, must \
          answer EISDIR, ENOTDIR, ENOTDIR, and ENOENT as Linux does and remove nothing"
     );
 }
 
+// @behavior RT-188
+#[test]
+fn a_name_no_filesystem_makes_is_answered_by_what_stands() {
+    let tmpfs = tmpfs_with("file.txt", "granted");
+    let mount = Mount::new(
+        "/data",
+        Filesystem::new(tmpfs.clone()).expect("the instance must stand"),
+        Access::ReadWrite,
+    )
+    .expect("/data is a guest path");
+    let root = vfs::Path::root(mount.mnt());
+    let cred = prepare_creds_within(&[], None);
+    let link = |old, new| vfs::filename_linkat(&cred, &root, old, &root, new, false);
+    let symlink = |new| vfs::filename_symlinkat(&cred, "target", &root, new);
+    let refused = Err;
+    assert_eq!(
+        (
+            link("missing", "new"),
+            link("file.txt", "file.txt"),
+            link("file.txt", "new"),
+            symlink("file.txt"),
+            symlink("new"),
+        ),
+        (
+            refused(FilesystemError::NotFound),
+            refused(FilesystemError::AlreadyExists),
+            refused(FilesystemError::NotPermitted),
+            refused(FilesystemError::AlreadyExists),
+            refused(FilesystemError::NotPermitted),
+        ),
+        "vfs::filename_linkat and filename_symlinkat over a Filesystem making no links must \
+         answer ENOENT for a missing source, EEXIST for a name that stands, and otherwise EPERM"
+    );
+    assert_eq!(
+        host_entries(&tmpfs).expect("the root must list"),
+        vec!["file.txt".to_string()],
+        "a refused link must make nothing"
+    );
+}
+
+// Only Linux grows a file in one step, so a Bind elsewhere refuses and leaves it.
 // @behavior RT-099
+// @behavior RT-239
+#[test]
+fn an_allocation_grows_a_file_to_where_its_room_ends_and_shortens_none() {
+    // What a file holds from where the room might start, and how long it is.
+    let read = |bytes: Vec<u8>| (bytes.len(), bytes.get(7).copied());
+    let long = "x".repeat(200);
+    let through_tmpfs = |seed: &str| {
+        let tmpfs = tmpfs_with("file.txt", seed);
+        let answer = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, None)])
+            .call("allocate_file", FILE);
+        let len = vfs::vfs_fstatat(
+            &prepare_creds_within(&[], None),
+            &host(&tmpfs),
+            "file.txt",
+            false,
+        )
+        .map(|stat| stat.size);
+        let held = contents(&host(&tmpfs), "file.txt").map(|head| head[7]);
+        (answer, len.ok().map(|len| len as usize), held)
+    };
+    let through_bind = |seed: &str| {
+        let dir = std::env::temp_dir().join(format!("kobako-allocate-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).expect("the host directory must be created");
+        std::fs::write(dir.join("file.txt"), seed).expect("the host file must be written");
+        let bind = Bind::new(&dir).expect("the host directory must open");
+        let answer = Guest::new(&[grant(Arc::new(bind), Access::ReadWrite, None)])
+            .call("allocate_file", FILE);
+        let (len, held) = read(std::fs::read(dir.join("file.txt")).expect("the file stands"));
+        let _ = std::fs::remove_dir_all(&dir);
+        (answer, Some(len), held)
+    };
+    let bind_answers = match cfg!(target_os = "linux") {
+        true => [(0, Some(100), Some(0)), (0, Some(200), Some(b'x'))],
+        false => [
+            (ERRNO_NOTSUP, Some(7), None),
+            (ERRNO_NOTSUP, Some(200), Some(b'x')),
+        ],
+    };
+    assert_eq!(
+        (
+            [through_tmpfs("granted"), through_tmpfs(&long)],
+            [through_bind("granted"), through_bind(&long)],
+        ),
+        (
+            [(0, Some(100), Some(0)), (0, Some(200), Some(b'x'))],
+            bind_answers,
+        ),
+        "fd_allocate of 100 bytes from the start through preview1, over a Tmpfs and a Bind on \
+         Linux, must grow a shorter file with zeros and leave a longer one as it was, and over a \
+         Bind elsewhere answer ENOTSUP and leave both"
+    );
+}
+
+// Linux counts room reserved in `i_blocks` against the tmpfs's size, and a
+// Tmpfs holds every byte up to a file's end, so its budget refuses the growth.
+// @behavior RT-238
 #[test]
-fn an_allocation_for_a_file_beneath_a_mount_is_unsupported() {
-    let memory: Arc<Memory> = Arc::new([("file.txt", "granted")].into_iter().collect());
-    let answer =
-        Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)]).call("allocate_file", FILE);
+fn an_allocation_past_a_tmpfs_size_answers_enospc() {
+    let tmpfs: Tmpfs = [("file.txt", "x")].into_iter().collect();
+    let answer = Guest::new(&[grant(
+        Arc::new(tmpfs.with_size(Some(50))),
+        Access::ReadWrite,
+        None,
+    )])
+    .call("allocate_file", FILE);
     assert_eq!(
-        (answer, contents(memory.as_ref(), "file.txt")),
-        (ERRNO_NOTSUP, Some(b"granted".to_vec())),
-        "fd_allocate of a file beneath a read-write Mount through preview1 must answer ENOTSUP \
-         as wasmtime-wasi does, leaving the file as it was"
+        answer, ERRNO_NOSPC,
+        "fd_allocate of 100 bytes in a Tmpfs of 50 through preview1 must answer ENOSPC"
     );
 }
 
@@ -1459,7 +2212,7 @@ fn an_allocation_for_a_file_beneath_a_mount_is_unsupported() {
 #[cfg(unix)]
 #[test]
 fn an_open_following_no_link_refuses_a_link_to_a_directory() {
-    let (host, mut guest) = linked("open-nofollow", |target| {
+    let (host, mut guest) = mount_link("open-nofollow", |target| {
         std::fs::create_dir(target).expect("the host directory must be created")
     });
     let answers = [
@@ -1470,7 +2223,7 @@ fn an_open_following_no_link_refuses_a_link_to_a_directory() {
     assert_eq!(
         answers,
         [ERRNO_LOOP, 0],
-        "path_open following no link of a host link to a directory beneath a Directory Mount \
+        "path_open following no link of a host link to a directory beneath a Bind Mount \
          through preview1 must answer ELOOP, and with a trailing slash open the directory"
     );
 }
@@ -1482,27 +2235,32 @@ fn directory_with_key(target: &std::path::Path) {
     std::fs::write(target.join("key"), "secret").expect("the host file must be written");
 }
 
-// The Policy allows everything, so only the link on the way can refuse
-// these; the same calls beneath a Mount without a Policy go through.
+// The link itself is allowed; only judging where it leads refuses the key, so
+// a walk that took the link's own path for the answer would hand it over.
 // @behavior RT-101
 #[cfg(unix)]
 #[test]
-fn a_path_through_a_link_beneath_a_mount_with_a_policy_answers_eloop() {
-    let policy: Arc<dyn Policy> = Arc::new(AllowsAll);
-    let (host, mut guest) = linked_under(
-        "policy-link",
+fn a_path_through_a_link_beneath_a_mount_with_a_policy_is_judged_where_it_leads() {
+    let refuses_key: Arc<dyn Policy> = Arc::new(Refuses("/data/target/key"));
+    let (host, mut guest) = mount_link_under(
+        "policy-link-refused",
         directory_with_key,
         Access::ReadWrite,
-        Some(policy),
+        Some(refuses_key),
     );
     let refused = [
         guest.call("read_file", THROUGH_FILE),
         guest.call("unlink_path", THROUGH_FILE),
-        guest.call("open_following", FILE),
     ];
     let kept = host.join("target/key").exists();
     let _ = std::fs::remove_dir_all(&host);
-    let (host, mut guest) = linked_under("plain-link", directory_with_key, Access::Read, None);
+    let allows: Arc<dyn Policy> = Arc::new(AllowsAll);
+    let (host, mut guest) = mount_link_under(
+        "policy-link-allowed",
+        directory_with_key,
+        Access::ReadWrite,
+        Some(allows),
+    );
     let followed = [
         guest.call("read_file", THROUGH_FILE),
         guest.call("open_following", FILE),
@@ -1510,21 +2268,20 @@ fn a_path_through_a_link_beneath_a_mount_with_a_policy_answers_eloop() {
     let _ = std::fs::remove_dir_all(&host);
     assert_eq!(
         (refused, kept, followed),
-        ([ERRNO_LOOP; 3], true, [0, 0]),
-        "path_open and path_unlink_file through a host link, or path_open following one at the \
-         end, beneath a Mount with a Policy through preview1 must answer ELOOP and change \
-         nothing, while a Mount without a Policy follows the link"
+        ([ERRNO_ACCES; 2], true, [0, 0]),
+        "path_open and path_unlink_file through a host link beneath a Mount with a Policy \
+         through preview1 must answer what the Policy says of where the link leads, EACCES \
+         for a refused path, changing nothing, and follow it to an allowed one"
     );
 }
 
-// cap-std refuses to follow a link out of the host directory, and the
-// host refuses a loop, so each open is refused whichever answers first;
-// only ELOOP says the link is why. An unlink acts on the link itself,
-// which no Policy-free walk past it is needed for.
+// A Policy changes nothing of where a link may lead: one out of the Bind escapes
+// it and one into itself loops, as beneath a Mount without a Policy, and an unlink
+// acts on the link itself.
 // @behavior RT-125
 #[cfg(unix)]
 #[test]
-fn a_link_out_of_a_directory_or_into_a_loop_answers_eloop_beneath_a_policy() {
+fn a_link_out_of_a_directory_or_into_a_loop_answers_as_without_a_policy() {
     let outside = std::env::temp_dir().join(format!("kobako-outside-{}", std::process::id()));
     directory_with_key(&outside);
     let targets = [
@@ -1544,7 +2301,7 @@ fn a_link_out_of_a_directory_or_into_a_loop_answers_eloop_beneath_a_policy() {
             std::fs::create_dir_all(&host).expect("the host directory must be created");
             std::os::unix::fs::symlink(target, host.join("file.txt"))
                 .expect("the link must be made");
-            let directory = Directory::new(&host).expect("the host directory must open");
+            let directory = Bind::new(&host).expect("the host directory must open");
             let policy: Arc<dyn Policy> = Arc::new(AllowsAll);
             let mut guest =
                 Guest::new(&[grant(Arc::new(directory), Access::ReadWrite, Some(policy))]);
@@ -1561,90 +2318,60 @@ fn a_link_out_of_a_directory_or_into_a_loop_answers_eloop_beneath_a_policy() {
     let _ = std::fs::remove_dir_all(&outside);
     assert_eq!(
         (answers, kept),
-        (vec![([ERRNO_LOOP, 0], true); 3], true),
-        "path_open through a host link out of a Directory, by an absolute or a relative target, \
-         or into a loop, beneath a Mount with a Policy through preview1 must answer ELOOP, and \
-         path_unlink_file of each link must remove it"
+        (
+            vec![
+                ([ERRNO_NOTCAPABLE, 0], true),
+                ([ERRNO_NOTCAPABLE, 0], true),
+                ([ERRNO_LOOP, 0], true),
+            ],
+            true
+        ),
+        "path_open through a host link out of a Bind, by an absolute or a relative target, \
+         beneath a Mount with a Policy through preview1 must answer NOTCAPABLE, into a loop \
+         ELOOP, and path_unlink_file of each link must remove it"
     );
 }
 
-// The Filesystem fails only the lookup of `dir`, which the open needs
-// no answer from but the walk for links on its way does.
+// The Filesystem fails only the lookup of `dir`, which the open needs no answer
+// from but the walk on its way does.
 // @behavior RT-126
 #[test]
-fn a_link_check_that_fails_fails_the_call_beneath_a_policy() {
-    let failing = Arc::new(FailsLookingUpDir(
-        [("dir/file.txt", "granted")].into_iter().collect(),
-    ));
-    let policy: Arc<dyn Policy> = Arc::new(AllowsAll);
-    let mut guest = Guest::new(&[grant(failing, Access::Read, Some(policy))]);
-    assert_eq!(
-        guest.call("read_file", DIR_FILE),
-        ERRNO_IO,
-        "path_open of a file beneath a directory the Filesystem fails to look up, beneath a \
-         Mount with a Policy through preview1, must answer that failure"
-    );
-}
-
-/// A Memory failing every lookup of `dir` itself, as a host directory
-/// that cannot be read could.
-struct FailsLookingUpDir(Memory);
-
-impl Filesystem for FailsLookingUpDir {
-    matches_names_exactly!();
-    never_repeats_identities!();
-    is_shared!();
-
-    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
-        self.0.open(path, options)
-    }
-
-    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        self.0.metadata(path)
-    }
-
-    fn symlink_metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        match path {
-            "dir" => Err(FilesystemError::Other("unreadable".into())),
-            path => self.0.symlink_metadata(path),
-        }
-    }
-
-    fn canonicalize_beneath(&self, base: &str, path: &str) -> Result<String, FilesystemError> {
-        self.0.canonicalize_beneath(base, path)
-    }
-
-    fn for_policy(&self) -> Option<Arc<dyn Filesystem>> {
-        None
-    }
-
-    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-        self.0.read_dir(path)
-    }
-
-    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.create_dir(path)
-    }
-
-    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.remove_dir(path)
-    }
-
-    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-        self.0.remove_file(path)
-    }
+fn a_lookup_that_fails_fails_the_call_beneath_a_policy() {
+    let tmpfs: Tmpfs = [("dir/file.txt", "granted")].into_iter().collect();
+    let failing = Wrap::new(Arc::new(tmpfs), Arc::new(FailsLookingUpDir));
+    let policy: Arc<dyn Policy> = Arc::new(AllowsAll);
+    let mut guest = Guest::new(&[grant(failing, Access::Read, Some(policy))]);
+    assert_eq!(
+        guest.call("read_file", DIR_FILE),
+        ERRNO_IO,
+        "path_open of a file beneath a directory the Filesystem fails to look up, beneath a \
+         Mount with a Policy through preview1, must answer that failure"
+    );
+}
 
-    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-        self.0.rename(from, to, rename)
+/// A Tmpfs failing every lookup of `dir` itself, as a host directory
+/// that cannot be read could.
+struct FailsLookingUpDir;
+
+impl Hook for FailsLookingUpDir {
+    fn lookup(
+        &self,
+        inner: &dyn InodeOperations,
+        dentry: &Dentry,
+    ) -> Result<Lookup, FilesystemError> {
+        match dentry.name().as_str() {
+            "dir" => Err(FilesystemError::Other("unreadable".into())),
+            _ => inner.lookup(dentry),
+        }
     }
 }
 
-// The Mount has no Policy and follows links, so only the step out of
-// the link can refuse these.
+// Each path lands on what the link's target or its parent holds, so only a
+// walk taking `.` and `..` from where the link led answers.
 // @behavior RT-119
 #[cfg(unix)]
 #[test]
-fn a_step_out_of_a_link_answers_eloop() {
+fn a_step_out_of_a_link_lands_where_it_leads() {
     assert_eq!(
         stat_link(
             "dot-link",
@@ -1654,13 +2381,18 @@ fn a_step_out_of_a_link_answers_eloop() {
         .into_iter()
         .map(|(errno, _)| errno)
         .collect::<Vec<_>>(),
-        [ERRNO_LOOP; 2],
+        [0; 2],
         "path_filestat_get of `file.txt/.` and `file.txt/../file.txt`, where `file.txt` is a \
-         host link to a directory, beneath a Directory Mount through preview1 must answer ELOOP"
+         host link to a directory, beneath a Bind Mount through preview1 must answer what they \
+         lead to, as Linux's walk does"
     );
 }
 
-fn file_and_directory() -> Arc<Memory> {
+fn tmpfs_with(path: &str, contents: &str) -> Arc<Tmpfs> {
+    Arc::new([(path, contents)].into_iter().collect())
+}
+
+fn file_and_directory() -> Arc<Tmpfs> {
     Arc::new(
         [("file.txt", "granted"), ("dir/inner", "x")]
             .into_iter()
@@ -1668,19 +2400,65 @@ fn file_and_directory() -> Arc<Memory> {
     )
 }
 
+/// A security module refusing every directory made.
+struct RefusesMkdir;
+
+impl SecurityOperations for RefusesMkdir {
+    fn path_mkdir(&self, _path: SecurityPath<'_>) -> Result<(), FilesystemError> {
+        Err(FilesystemError::PermissionDenied)
+    }
+}
+
+// The Mount allows every change and has no Policy, so only the module the
+// Driver was built with refuses the make.
+// @behavior RT-329
+#[test]
+fn a_security_module_the_driver_was_built_with_judges_the_guest() {
+    let tmpfs = file_and_directory();
+    let mut guest = Guest::with_security(
+        vec![Arc::new(RefusesMkdir)],
+        &[grant(tmpfs.clone(), Access::ReadWrite, None)],
+    );
+    assert_eq!(
+        (
+            guest.call("make_dir", NEW_AS_DIRECTORY),
+            vfs::vfs_fstatat(
+                &prepare_creds_within(&[], None),
+                &host(&tmpfs),
+                "new.txt",
+                false
+            )
+            .is_err()
+        ),
+        (ERRNO_ACCES, true),
+        "path_create_directory beneath a Mount through preview1, the Driver built with a \
+         security module refusing it, must answer EACCES and make nothing, as an LSM stacked \
+         at boot refuses security_path_mkdir"
+    );
+}
+
 // A `.` after a name resolves through it, so Linux and macOS both refuse
 // `missing/.` at the missing name rather than make it.
 // @behavior RT-109
 #[test]
 fn a_path_ending_in_a_dot_makes_nothing_where_no_directory_stands() {
-    let memory = file_and_directory();
-    let mut guest = Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)]);
+    let tmpfs = file_and_directory();
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, None)]);
     let answers = [
         guest.call("make_dir", MISSING_DOT),
         guest.call_flagged(MISSING_DOT, OFLAGS_CREAT, 0),
     ];
     assert_eq!(
-        (answers, memory.metadata("missing").is_err()),
+        (
+            answers,
+            vfs::vfs_fstatat(
+                &prepare_creds_within(&[], None),
+                &host(&tmpfs),
+                "missing",
+                false
+            )
+            .is_err()
+        ),
         ([ERRNO_NOENT, ERRNO_NOENT], true),
         "path_create_directory and path_open with O_CREAT of missing/. beneath a Mount through \
          preview1 must answer ENOENT, as Linux does, and make nothing named missing"
@@ -1692,8 +2470,8 @@ fn a_path_ending_in_a_dot_makes_nothing_where_no_directory_stands() {
 // @behavior RT-102
 #[test]
 fn a_path_ending_in_a_dot_is_neither_removed_nor_moved() {
-    let memory = file_and_directory();
-    let mut guest = Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)]);
+    let tmpfs = file_and_directory();
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, None)]);
     let answers = [
         guest.call("remove_path", DIR_DOT),
         guest.call("remove_path", DIR_DOT_DOT),
@@ -1703,11 +2481,20 @@ fn a_path_ending_in_a_dot_is_neither_removed_nor_moved() {
         guest.call_pair("rename_paths", OUT_OF_FILE, MOVED),
     ];
     assert_eq!(
-        (answers, memory.metadata("dir/inner").is_ok()),
+        (
+            answers,
+            vfs::vfs_fstatat(
+                &prepare_creds_within(&[], None),
+                &host(&tmpfs),
+                "dir/inner",
+                false
+            )
+            .is_ok()
+        ),
         (
             [
                 ERRNO_INVAL,
-                ERRNO_INVAL,
+                ERRNO_NOTEMPTY,
                 ERRNO_BUSY,
                 ERRNO_BUSY,
                 ERRNO_NOTDIR,
@@ -1716,8 +2503,9 @@ fn a_path_ending_in_a_dot_is_neither_removed_nor_moved() {
             true
         ),
         "path_remove_directory of a path ending in . or .., and path_rename of one, beneath a \
-         Mount through preview1 must answer EINVAL and EBUSY as wasmtime-wasi does, or ENOTDIR \
-         where a file stands before the dot, and leave the directory in place"
+         Mount through preview1 must answer EINVAL for . and ENOTEMPTY for .. and EBUSY, as \
+         Linux does, or ENOTDIR where a file stands before the dot, and leave the directory in \
+         place"
     );
 }
 
@@ -1755,7 +2543,7 @@ fn a_create_of_a_host_file_that_only_reads_opens_it() {
         std::fs::Permissions::from_mode(0o444),
     )
     .expect("the host file must become read-only");
-    let directory = Directory::new(&host).expect("the host directory must open");
+    let directory = Bind::new(&host).expect("the host directory must open");
     let answer = Guest::new(&[grant(Arc::new(directory), Access::ReadWrite, None)]).call_flagged(
         FILE,
         OFLAGS_CREAT,
@@ -1764,26 +2552,178 @@ fn a_create_of_a_host_file_that_only_reads_opens_it() {
     let _ = std::fs::remove_dir_all(&host);
     assert_eq!(
         answer, 0,
-        "path_open with O_CREAT and no write of a read-only host file beneath a Directory Mount \
+        "path_open with O_CREAT and no write of a read-only host file beneath a Bind Mount \
          through preview1 must open it"
     );
 }
 
+/// A host directory of the test's own beneath a read-write Bind Mount,
+/// `dir` a link to the directory `real` and `gone` a link to nothing,
+/// removed when it drops.
+#[cfg(unix)]
+struct LinkedHost(std::path::PathBuf);
+
+#[cfg(unix)]
+impl LinkedHost {
+    fn new(name: &str) -> Self {
+        let host = std::env::temp_dir().join(format!("kobako-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&host);
+        std::fs::create_dir_all(host.join("real/inner")).expect("the host tree must be made");
+        std::os::unix::fs::symlink("real", host.join("dir")).expect("the link must be made");
+        std::os::unix::fs::symlink("nowhere", host.join("gone")).expect("the link must be made");
+        Self(host)
+    }
+
+    fn guest(&self) -> Guest {
+        let directory = Bind::new(&self.0).expect("the host directory must open");
+        Guest::new(&[grant(Arc::new(directory), Access::ReadWrite, None)])
+    }
+}
+
+#[cfg(unix)]
+impl Drop for LinkedHost {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+// The link stands before the dot, so it is followed as Linux follows a
+// link that is not the last name, and the dot answers as one through a
+// directory does.
+// @behavior RT-161
+#[cfg(unix)]
+#[test]
+fn a_path_ending_in_a_dot_through_a_link_is_neither_removed_nor_moved() {
+    let host = LinkedHost::new("dot-link");
+    let mut guest = host.guest();
+    let answers = [
+        guest.call("remove_path", DIR_DOT),
+        guest.call("remove_path", DIR_DOT_DOT),
+        guest.call_pair("rename_paths", DIR_DOT, MOVED),
+        guest.call_pair("rename_paths", DIR_DOT_DOT, MOVED),
+    ];
+    assert_eq!(
+        (answers, host.0.join("real/inner").is_dir()),
+        ([ERRNO_INVAL, ERRNO_NOTEMPTY, ERRNO_BUSY, ERRNO_BUSY], true),
+        "path_remove_directory and path_rename of dir/. and dir/.., dir a host link to a \
+         directory beneath a Bind Mount, through preview1 must answer EINVAL, ENOTEMPTY, and \
+         EBUSY, as Linux does, and leave the directory"
+    );
+}
+
+// The dot is the last name, which these act on rather than land on, so
+// nothing of where the link points shows, and the answers are Linux's.
+// @behavior RT-219
+#[cfg(unix)]
+#[test]
+fn a_change_naming_a_dot_through_a_link_answers_as_linux() {
+    let host = LinkedHost::new("dot-change");
+    let mut guest = host.guest();
+    assert_eq!(
+        (
+            guest.call("make_dir", DIR_DOT),
+            guest.call("unlink_path", DIR_DOT),
+            host.0.join("real/inner").is_dir()
+        ),
+        (ERRNO_EXIST, ERRNO_ISDIR, true),
+        "path_create_directory and path_unlink_file of dir/., dir a host link to a directory \
+         beneath a Bind Mount, through preview1 must answer EEXIST and EISDIR, as Linux does, \
+         and leave the directory"
+    );
+}
+
+/// The root of `host` beneath a Bind Mount, as the VFS walks it.
+#[cfg(unix)]
+fn bind_root(host: &std::path::Path) -> Path {
+    let directory = Bind::new(host).expect("the host directory must open");
+    let mount = Mount::new(
+        "/data",
+        Filesystem::new(Arc::new(directory)).expect("the instance must stand"),
+        Access::ReadWrite,
+    )
+    .expect("/data is a guest path");
+    Path::root(mount.mnt())
+}
+
+// No security module is registered, so were the link followed the file would
+// be made where it points, and only `O_EXCL` keeps that from happening.
+// @behavior RT-220
+#[cfg(unix)]
+#[test]
+fn an_exclusive_create_follows_no_link_at_the_end() {
+    let host = LinkedHost::new("excl-link");
+    let mut how = OpenHow::default();
+    how.write = true;
+    how.create = true;
+    how.exclusive = true;
+    how.follow = true;
+    let answer = vfs::do_file_open(
+        &prepare_creds_within(&[], None),
+        &bind_root(&host.0),
+        "gone",
+        &flags_of(&how),
+    );
+    assert_eq!(
+        (answer.err(), host.0.join("nowhere").exists()),
+        (Some(FilesystemError::AlreadyExists), false),
+        "vfs::do_file_open with create and exclusive of a link to nothing, asking to follow it, \
+         must answer EEXIST, as Linux's O_EXCL does, and make nothing"
+    );
+}
+
+// The trailing `/` follows the link, so what is read stands at the directory,
+// where the walk that reports a link as itself would answer ENOTDIR.
+// @behavior RT-221
+#[cfg(unix)]
+#[test]
+fn a_trailing_slash_on_a_link_to_a_directory_reads_no_link() {
+    let host = LinkedHost::new("readlink-slash");
+    assert_eq!(
+        vfs::do_readlinkat(
+            &prepare_creds_within(&[], None),
+            &bind_root(&host.0),
+            "dir/"
+        )
+        .err(),
+        Some(FilesystemError::InvalidInput),
+        "vfs::do_readlinkat of dir/, dir a host link to a directory beneath a Bind Mount, must \
+         answer EINVAL, as Linux's does"
+    );
+}
+
+// Linux answers the trailing slash of a create before it would follow the
+// link, which points at nothing a create could make.
+// @behavior RT-162
+#[cfg(unix)]
+#[test]
+fn a_create_through_a_trailing_slash_answers_eisdir_before_following_a_link() {
+    let host = LinkedHost::new("slash-link");
+    let answer = host
+        .guest()
+        .call_flagged(GONE_AS_DIRECTORY, OFLAGS_CREAT, 0);
+    assert_eq!(
+        (answer, host.0.join("nowhere").exists()),
+        (ERRNO_ISDIR, false),
+        "path_open with O_CREAT of gone/, gone a host link to nothing beneath a Bind Mount, \
+         through preview1 must answer EISDIR, as Linux does, and make nothing"
+    );
+}
+
 // The second seek would land past what a signed offset holds, so only
 // the cap keeps the position from reaching it.
 // @behavior RT-104
 #[test]
-fn a_seek_past_the_largest_offset_overflows() {
+fn a_seek_past_the_largest_offset_is_invalid() {
     let answer = Guest::new(&[grant(file_and_directory(), Access::Read, None)])
         .call_bare("seek_past_the_largest_offset");
     assert_eq!(
-        answer, ERRNO_OVERFLOW,
+        answer, ERRNO_INVAL,
         "fd_seek past the largest signed 64-bit offset of a file beneath a Mount through \
-         preview1 must answer EOVERFLOW, as Linux does"
+         preview1 must answer EINVAL, as Linux does"
     );
 }
 
-// A Memory clamps a read past its end and tries to grow for a write or a
+// A Tmpfs clamps a read past its end and tries to grow for a write or a
 // size, so only the check before the Filesystem answers each as Linux does.
 // @behavior RT-116
 #[test]
@@ -1797,7 +2737,7 @@ fn an_offset_past_the_largest_signed_offset_is_invalid() {
         ),
         (ERRNO_INVAL, ERRNO_INVAL, ERRNO_INVAL),
         "fd_pread, fd_pwrite, and fd_filestat_set_size past the largest signed 64-bit offset of a \
-         Memory file beneath a Mount through preview1 must answer EINVAL, as Linux does"
+         Tmpfs file beneath a Mount through preview1 must answer EINVAL, as Linux does"
     );
 }
 
@@ -1824,17 +2764,17 @@ fn a_read_whose_end_passes_the_largest_signed_offset_is_invalid() {
 // two answers apart.
 // @behavior RT-135
 #[test]
-fn a_wait_to_write_a_file_answers_by_what_its_mount_permits() {
+fn a_wait_to_write_a_file_is_ready_whatever_its_mount_permits() {
     let wait = |access| {
         Guest::new(&[grant(file_and_directory(), access, None)])
             .call_at("poll_write_with", RIGHTS_FD_READ)
     };
     assert_eq!(
         (wait(Access::ReadWrite), wait(Access::Read)),
-        (0, ERRNO_PERM),
+        (0, 0),
         "poll_oneoff waiting to write a file opened only to read through preview1 must be ready \
-         beneath a read-write Mount and answer EPERM beneath a read-only one, as wasmtime-wasi \
-         answers by its preopen"
+         beneath a read-write and a read-only Mount alike, as Linux's vfs_poll answers a file \
+         with no poll of its own"
     );
 }
 
@@ -1852,10 +2792,10 @@ fn sizing_a_file_opened_only_to_read_answers_by_its_mount_then_as_linux_does() {
             size(Access::ReadWrite, RIGHTS_FD_READ),
             size(Access::ReadWrite, RIGHTS_FD_WRITE),
         ),
-        (ERRNO_PERM, ERRNO_INVAL, 0),
-        "fd_filestat_set_size on a file opened only to read through preview1 must answer EPERM \
-         beneath a read-only Mount, as wasmtime-wasi does, and EINVAL beneath a read-write one, \
-         as Linux's ftruncate does, while a file opened to write is sized"
+        (ERRNO_INVAL, ERRNO_INVAL, 0),
+        "fd_filestat_set_size on a file opened only to read through preview1 must answer EINVAL \
+         beneath a read-only and a read-write Mount, as Linux's ftruncate does, while a file \
+         opened to write is sized"
     );
 }
 
@@ -1871,7 +2811,7 @@ impl Policy for RecordsAsks {
 }
 
 // The Mount is made read-only, as a Ruby mount with a block is by default,
-// so only the Policy standing in its access's place lets either through.
+// so only a Mount allowing writes lets either through.
 // Each Policy is asked only by the open before the call, so a wait or a size
 // asking it as well adds an ask the literal lists below do not hold.
 // @behavior RT-139
@@ -1881,7 +2821,7 @@ fn a_mount_whose_policy_decides_may_be_written() {
         let policy = Arc::new(RecordsAsks::default());
         let errno = Guest::new(&[grant(
             file_and_directory(),
-            Access::Read,
+            Access::ReadWrite,
             Some(policy.clone() as Arc<dyn Policy>),
         )])
         .call_at(name, rights);
@@ -1897,23 +2837,24 @@ fn a_mount_whose_policy_decides_may_be_written() {
             (0, vec![("/data/file.txt".to_owned(), Access::Read)]),
             (0, vec![("/data/file.txt".to_owned(), Access::ReadWrite)]),
         ),
-        "through preview1 beneath a read-only Mount whose Policy allows every change, \
+        "through preview1 beneath a read-write Mount whose Policy allows every change, \
          poll_oneoff waiting to write a file opened only to read must be ready, and \
          fd_filestat_set_size on a file opened to write must size it, the Policy asked \
          only by each open"
     );
 }
 
-// Each open asks without the right to write, so only its CREAT, where
-// nothing stands yet, makes it a change.
+// Each open asks without the right to write, so only its CREAT makes it a
+// change; that is asked before the walk knows the file stands, as Linux's
+// `may_o_create` is, and the open of the file then asks as a read.
 // @behavior RT-146
 #[test]
-fn a_policy_is_asked_once_for_an_open_that_may_create_as_what_it_does() {
+fn an_open_that_may_create_asks_to_make_the_file_before_it_finds_what_stands() {
     let open = |path| {
         let policy = Arc::new(RecordsAsks::default());
         let errno = Guest::new(&[grant(
             file_and_directory(),
-            Access::Read,
+            Access::ReadWrite,
             Some(policy.clone() as Arc<dyn Policy>),
         )])
         .call_flagged(path, OFLAGS_CREAT, 0);
@@ -1924,11 +2865,52 @@ fn a_policy_is_asked_once_for_an_open_that_may_create_as_what_it_does() {
         (open(NEW), open(FILE)),
         (
             (0, vec![("/data/new.txt".to_owned(), Access::ReadWrite)]),
-            (0, vec![("/data/file.txt".to_owned(), Access::Read)]),
+            (
+                0,
+                vec![
+                    ("/data/file.txt".to_owned(), Access::ReadWrite),
+                    ("/data/file.txt".to_owned(), Access::Read),
+                ]
+            ),
         ),
         "path_open with O_CREAT and no write of a missing path and of an existing file beneath \
-         a Mount whose Policy allows every change through preview1 must ask the Policy once for \
-         each, as a change where it creates and as a read where the file stands"
+         a Mount whose Policy allows every change through preview1 must ask the Policy a change \
+         for each, then a read for the file, as lookup_open asks may_o_create first"
+    );
+}
+
+/// A Policy refusing the Mount's root and allowing what lies beneath it,
+/// keeping each path it is asked.
+#[derive(Default)]
+struct RefusesTheRoot(std::sync::Mutex<Vec<String>>);
+
+impl Policy for RefusesTheRoot {
+    fn allows(&self, path: &str, _access: Access) -> bool {
+        self.0.lock().unwrap().push(path.to_owned());
+        path != "/data"
+    }
+}
+
+// A Policy opening its Mount's root itself would refuse the invocation before
+// the guest runs, so only a root opened before the Policy applies lets the
+// read through.
+// @behavior RT-290
+#[test]
+fn a_mount_whose_policy_refuses_its_root_still_reads_beneath_it() {
+    let policy = Arc::new(RefusesTheRoot::default());
+    let mut guest = Guest::new(&[grant(
+        file_and_directory(),
+        Access::Read,
+        Some(policy.clone() as Arc<dyn Policy>),
+    )]);
+    let read = guest.call("read_file", FILE);
+    let asked = policy.0.lock().unwrap().clone();
+    assert_eq!(
+        (read, asked),
+        (0, vec!["/data/file.txt".to_owned()]),
+        "path_open of a file beneath a Mount whose Policy refuses its root, through preview1, \
+         must read the file and ask the Policy only about it, as a Linux task opens what it \
+         keeps before landlock_restrict_self"
     );
 }
 
@@ -1973,29 +2955,124 @@ fn what_stands_at_a_path_answers_before_a_read_only_mount_refuses() {
     );
 }
 
+// wasi-testsuite makes a file asking no right, so only an open that reads
+// lets the descriptor read what it made or emptied.
+// @behavior RT-303
+#[test]
+fn an_open_making_or_emptying_a_file_with_no_right_opens_it_to_read() {
+    let tmpfs = file_and_directory();
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, None)]);
+    let mut read_unasked = |path: (i32, i32), oflags: i32| {
+        guest
+            .instance
+            .get_typed_func::<(i32, i32, i32), i32>(&mut guest.store, "read_unasked")
+            .expect("probe export must resolve")
+            .call(&mut guest.store, (path.0, path.1, oflags))
+            .expect("probe call must not trap")
+    };
+    let answers = (
+        read_unasked(NEW, OFLAGS_CREAT),
+        read_unasked(FILE, OFLAGS_TRUNC),
+    );
+    assert_eq!(
+        (
+            answers,
+            contents(&host(&tmpfs), "new.txt"),
+            contents(&host(&tmpfs), "file.txt")
+        ),
+        ((0, 0), Some(Vec::new()), Some(Vec::new())),
+        "path_open asking no right with O_CREAT, or with O_TRUNC, of a Tmpfs beneath a read-write \
+         Mount through preview1 must make or empty the file and open it to read, as an O_RDONLY \
+         open does"
+    );
+}
+
 const NEW: (i32, i32) = (840, 7);
 const RIGHTS_FD_READ: u64 = 1 << 1;
 const ERRNO_PERM: i32 = 63;
 
-// A Memory would refuse the bytes for want of space, so only the refusal
-// before the Filesystem is asked answers EFBIG.
+/// A Tmpfs with no operation to make, remove, or move a name, as a NULL in
+/// Linux's `inode_operations`.
+struct ChangesNothing(Arc<dyn InodeOperations>);
+
+impl FileSystemType for ChangesNothing {
+    fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+        sb.d_make_root(vfs::Inode::new(
+            &vfs::Kstat::new(vfs::FileType::Dir, 0),
+            self,
+        ));
+        Ok(())
+    }
+}
+
+impl InodeOperations for ChangesNothing {
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.0.getattr(dentry)
+    }
+
+    fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+        Ok(match self.0.lookup(dentry)? {
+            Lookup::Found(inode) => {
+                Lookup::Found(inode.with_ops(Arc::new(Self(inode.ops().clone()))))
+            }
+            other => other,
+        })
+    }
+
+    fn open(
+        &self,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        self.0.open(dentry, how)
+    }
+}
+
+// The Filesystem has nothing to answer these with, so each errno is the
+// runtime's, the one Linux's VFS answers for a NULL in `inode_operations`.
+// @behavior RT-175
+#[test]
+fn the_runtime_answers_for_an_operation_a_filesystem_lacks() {
+    let filesystem = Arc::new(ChangesNothing(file_and_directory()));
+    let mut guest = Guest::new(&[grant(filesystem, Access::ReadWrite, None)]);
+    assert_eq!(
+        (
+            guest.call("make_dir", NEW),
+            guest.call_flagged(NEW, OFLAGS_CREAT, 0),
+            guest.call("remove_path", DIR),
+            guest.call("unlink_path", FILE),
+            guest.call_pair("rename_paths", FILE, MOVED),
+        ),
+        (ERRNO_PERM, ERRNO_ACCES, ERRNO_PERM, ERRNO_PERM, ERRNO_PERM),
+        "path_create_directory, path_open with O_CREAT, path_remove_directory, \
+         path_unlink_file, and path_rename through preview1, of a Filesystem lacking each \
+         operation, must answer EPERM, EACCES, EPERM, EPERM, and EPERM"
+    );
+}
+
+// A Tmpfs would refuse the bytes for want of space, so only the refusal
+// before the Filesystem is asked answers EINVAL.
 // @behavior RT-133
 #[test]
-fn a_write_at_the_largest_signed_offset_is_too_large() {
-    let memory = file_and_directory();
-    let answer = Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)])
-        .call_bare("write_at_the_largest_offset");
+fn a_write_ending_past_the_largest_signed_offset_is_invalid() {
+    let tmpfs = file_and_directory();
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, None)]);
+    let answers = (
+        guest.call_bare("write_at_the_largest_offset"),
+        guest.call_at("write_at", i64::MAX as u64 - 1),
+    );
     assert_eq!(
-        (answer, contents(memory.as_ref(), "file.txt")),
-        (ERRNO_FBIG, Some(b"granted".to_vec())),
-        "fd_write at the largest signed 64-bit offset of a Memory file beneath a Mount through \
-         preview1 must answer EFBIG, as Linux does, and leave the file as it was"
+        (answers, contents(&host(&tmpfs), "file.txt")),
+        ((ERRNO_INVAL, ERRNO_INVAL), Some(b"granted".to_vec())),
+        "fd_write at the largest signed 64-bit offset, and fd_pwrite from one before it, of a \
+         Tmpfs file beneath a Mount through preview1 must answer EINVAL, as Linux does, and \
+         leave the file as it was"
     );
 }
 
 // @behavior RT-130
 #[test]
-fn an_advice_past_the_largest_signed_offset_is_invalid() {
+fn an_advice_reaching_past_the_largest_signed_offset_is_invalid() {
     let mut guest = Guest::new(&[grant(file_and_directory(), Access::ReadWrite, None)]);
     assert_eq!(
         (
@@ -2004,16 +3081,17 @@ fn an_advice_past_the_largest_signed_offset_is_invalid() {
             guest.call_at("advise_for", 0)
         ),
         (ERRNO_INVAL, ERRNO_INVAL, 0),
-        "fd_advise from or for past the largest signed 64-bit offset of a Memory file beneath a \
-         Mount through preview1 must answer EINVAL, as an advice within it succeeds"
+        "fd_advise of a Tmpfs file beneath a Mount through preview1 must answer EINVAL from an \
+         offset or for a length past the largest signed 64-bit offset, as Linux's \
+         generic_fadvise does"
     );
 }
 
 // The open asks to read only, so nothing else the open could refuse
-// stands in for the refusal of not blocking.
+// stands in for a refusal of not blocking.
 // @behavior RT-129
 #[test]
-fn a_descriptor_that_would_not_block_is_unsupported() {
+fn a_descriptor_may_ask_not_to_block() {
     let mut guest = Guest::new(&[grant(file_and_directory(), Access::ReadWrite, None)]);
     assert_eq!(
         (
@@ -2021,9 +3099,10 @@ fn a_descriptor_that_would_not_block_is_unsupported() {
             guest.call_bare("set_nonblocking"),
             guest.call_flagged(FILE, 0, 0)
         ),
-        (ERRNO_NOTSUP, ERRNO_NOTSUP, 0),
+        (0, 0, 0),
         "path_open asking not to block and fd_fdstat_set_flags setting an open file not to \
-         block, beneath a Mount through preview1, must answer ENOTSUP"
+         block, beneath a Mount through preview1, must succeed, as Linux takes O_NONBLOCK on a \
+         file"
     );
 }
 
@@ -2049,17 +3128,106 @@ fn a_directory_a_guest_opens_carries_no_right_to_write() {
     );
 }
 
+// wasi-libc's `openat` asks only the rights its directory hands down, so a
+// write beneath a directory a guest opened needs `fd_write` among them.
+// @behavior RT-298
+#[test]
+fn a_directory_a_guest_opens_hands_down_the_right_to_write() {
+    let mut guest = Guest::new(&[grant(file_and_directory(), Access::ReadWrite, None)]);
+    let errno = guest.call_dir_with((RIGHTS_FD_READ | RIGHTS_FD_READDIR) as i64, 9);
+    let memory = guest
+        .instance
+        .get_memory(&mut guest.store, "memory")
+        .expect("probe exports its memory");
+    let inheriting = u64::from_le_bytes(
+        memory.data(&guest.store)[400..408]
+            .try_into()
+            .expect("the rights are eight bytes"),
+    );
+    assert_eq!(
+        (errno, inheriting & RIGHTS_FD_WRITE),
+        (0, RIGHTS_FD_WRITE),
+        "fd_fdstat_get of a directory opened through path_open beneath a read-write Mount \
+         through preview1 must hand down fd_write, as Linux takes an open's mode from its \
+         flags alone"
+    );
+}
+
+// wasi-libc opens `O_SEARCH`, which glibc spells `O_PATH`, without `fd_read`,
+// `fd_readdir`, or `fd_write`; the poll answers the event's error, its call
+// succeeding. wasi-testsuite lists a directory opened with `fd_readdir` alone.
+// @behavior RT-297
+// @behavior RT-299
+// @behavior RT-300
+#[test]
+fn a_directory_opened_for_neither_reading_nor_writing_stands_only_for_its_path() {
+    let mut guest = Guest::new(&[grant(file_and_directory(), Access::ReadWrite, None)]);
+    assert_eq!(
+        guest.call_dir_with(RIGHTS_FD_READDIR as i64, 0),
+        0,
+        "fd_readdir of a directory opened with fd_readdir alone through preview1 must list it"
+    );
+    let answers: Vec<i32> = (0..9).map(|call| guest.call_dir_with(0, call)).collect();
+    assert_eq!(
+        answers,
+        [
+            ERRNO_BADF, ERRNO_BADF, ERRNO_BADF, ERRNO_BADF, ERRNO_BADF, ERRNO_BADF, ERRNO_BADF, 0,
+            0
+        ],
+        "fd_readdir, fd_sync, fd_advise, fd_fdstat_set_flags, fd_filestat_set_size, \
+         fd_filestat_set_times, and poll_oneoff of a directory opened without fd_read or \
+         fd_write beneath a read-write Mount through preview1 must answer EBADF, as fdget \
+         refuses O_PATH, while fd_filestat_get and path_filestat_get from it succeed"
+    );
+    let errno = guest.call_dir_with(0, 9);
+    let memory = guest
+        .instance
+        .get_memory(&mut guest.store, "memory")
+        .expect("probe exports its memory");
+    let rights = u64::from_le_bytes(
+        memory.data(&guest.store)[392..400]
+            .try_into()
+            .expect("the rights are eight bytes"),
+    );
+    assert_eq!(
+        (errno, rights & RIGHTS_FD_READDIR),
+        (0, 0),
+        "fd_fdstat_get of a directory opened without fd_read or fd_write through preview1 \
+         must report no fd_readdir, as it lists nothing"
+    );
+}
+
+// A directory opened to list answers NOTSOCK, so only a socket call taking its
+// descriptor through fdget answers EBADF for one standing only for its path.
+// @behavior RT-306
+#[test]
+fn a_socket_call_refuses_a_descriptor_standing_only_for_its_path() {
+    let mut guest = Guest::new(&[grant(file_and_directory(), Access::ReadWrite, None)]);
+    assert_eq!(
+        (
+            guest.call_dir_with(0, 10),
+            guest.call_dir_with(RIGHTS_FD_READDIR as i64, 10)
+        ),
+        (ERRNO_BADF, ERRNO_NOTSOCK),
+        "sock_shutdown through preview1 of a directory opened without fd_read or fd_write must \
+         answer EBADF, as Linux's socket calls take theirs through fdget, and of one opened to \
+         list ENOTSOCK"
+    );
+}
+
+const ERRNO_NOTSOCK: i32 = 57;
+
 // @behavior RT-105
 #[test]
 fn a_file_moved_beneath_itself_is_no_directory() {
-    let memory = file_and_directory();
-    let answer = Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)]).call_pair(
+    let tmpfs = file_and_directory();
+    let answer = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, None)]).call_pair(
         "rename_paths",
         FILE,
         BENEATH_FILE,
     );
     assert_eq!(
-        (answer, contents(memory.as_ref(), "file.txt")),
+        (answer, contents(&host(&tmpfs), "file.txt")),
         (ERRNO_NOTDIR, Some(b"granted".to_vec())),
         "path_rename of a file to a path beneath it, beneath a Mount through preview1, must \
          answer ENOTDIR as Linux does and leave the file in place"
@@ -2072,7 +3240,7 @@ fn a_file_moved_beneath_itself_is_no_directory() {
 #[cfg(unix)]
 #[test]
 fn an_open_following_no_link_finds_a_dangling_link_as_itself() {
-    let (host, mut guest) = linked_under("dangling", |_| {}, Access::ReadWrite, None);
+    let (host, mut guest) = mount_link_under("dangling", |_| {}, Access::ReadWrite, None);
     let answers = [
         guest.call_flagged(FILE, 0, 0),
         guest.call_flagged(FILE, OFLAGS_CREAT | OFLAGS_EXCL, 0),
@@ -2082,7 +3250,7 @@ fn an_open_following_no_link_finds_a_dangling_link_as_itself() {
     assert_eq!(
         (answers, made),
         ([ERRNO_LOOP, ERRNO_EXIST], false),
-        "path_open following no link of a dangling host link beneath a Directory Mount through \
+        "path_open following no link of a dangling host link beneath a Bind Mount through \
          preview1 must answer ELOOP, and with O_CREAT and O_EXCL EEXIST, as Linux does, making \
          nothing where it points"
     );
@@ -2091,8 +3259,8 @@ fn an_open_following_no_link_finds_a_dangling_link_as_itself() {
 /// What each root-changing export answers, and how many changes the
 /// Filesystem was asked for along the way.
 fn change_root(exports: &[&str]) -> (Vec<i32>, usize) {
-    let counted = ChangeCounter::new();
-    let mut guest = Guest::new(&[grant(counted.clone(), Access::ReadWrite, None)]);
+    let (counted, filesystem) = ChangeCounter::over_file();
+    let mut guest = Guest::new(&[grant(filesystem, Access::ReadWrite, None)]);
     let answers = exports.iter().map(|name| guest.call_bare(name)).collect();
     (answers, counted.changes.load(Ordering::Relaxed))
 }
@@ -2133,8 +3301,8 @@ fn unlinking_a_mounts_root_answers_that_it_is_a_directory() {
 /// What reading `path` answers beneath a read-only Mount holding
 /// `file.txt`.
 fn read_beneath(path: (i32, i32)) -> i32 {
-    let memory: Memory = [("file.txt", "granted")].into_iter().collect();
-    Guest::new(&[grant(Arc::new(memory), Access::Read, None)]).call("read_file", path)
+    let tmpfs: Tmpfs = [("file.txt", "granted")].into_iter().collect();
+    Guest::new(&[grant(Arc::new(tmpfs), Access::Read, None)]).call("read_file", path)
 }
 
 // @behavior RT-086
@@ -2157,7 +3325,7 @@ fn a_dot_dot_after_a_missing_name_names_nothing() {
     );
 }
 
-// The Memory would hold `file.txt` and any other name, so only the NUL
+// The Tmpfs would hold `file.txt` and any other name, so only the NUL
 // refuses the open.
 // @behavior RT-122
 #[test]
@@ -2193,12 +3361,12 @@ fn a_path_ending_in_a_slash_names_only_a_directory() {
 // @behavior RT-093
 #[test]
 fn a_rename_of_a_file_onto_a_path_ending_in_a_slash_is_not_a_directory() {
-    let memory: Arc<Memory> = Arc::new([("file.txt", "granted")].into_iter().collect());
-    let mut guest = Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)]);
+    let tmpfs = tmpfs_with("file.txt", "granted");
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, None)]);
     assert_eq!(
         (
             guest.call_bare("rename_onto_itself_as_directory"),
-            contents(memory.as_ref(), "file.txt")
+            contents(&host(&tmpfs), "file.txt")
         ),
         (ERRNO_NOTDIR, Some(b"granted".to_vec())),
         "path_rename of `file.txt` onto `file.txt/` beneath a Mount through preview1 must \
@@ -2209,12 +3377,12 @@ fn a_rename_of_a_file_onto_a_path_ending_in_a_slash_is_not_a_directory() {
 // @behavior RT-090
 #[test]
 fn a_file_created_at_a_path_ending_in_a_slash_is_refused_as_a_directory() {
-    let memory = Arc::new(Memory::new());
-    let mut guest = Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)]);
+    let tmpfs = Arc::new(Tmpfs::new());
+    let mut guest = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, None)]);
     assert_eq!(
         (
             guest.call("write_file", NEW_AS_DIRECTORY),
-            memory.read_dir("").map(|entries| entries.len())
+            host_entries(&tmpfs).map(|entries| entries.len())
         ),
         (ERRNO_ISDIR, Ok(0)),
         "path_open creating `new.txt/` beneath a Mount through preview1 must answer EISDIR and \
@@ -2231,57 +3399,75 @@ const RIGHTS_FD_WRITE: u64 = 1 << 6;
 const RIGHTS_FD_READDIR: u64 = 1 << 14;
 
 /// What opening `path` with `oflags` and `fdflags` answers beneath a
-/// read-write Memory holding `file.txt`, and the paths it holds after.
+/// read-write Tmpfs holding `file.txt`, and the paths it holds after.
 fn open_flagged(path: (i32, i32), oflags: i32, fdflags: i32) -> (i32, Vec<String>) {
-    let memory: Arc<Memory> = Arc::new([("file.txt", "granted")].into_iter().collect());
-    let errno = Guest::new(&[grant(memory.clone(), Access::ReadWrite, None)])
+    let tmpfs = tmpfs_with("file.txt", "granted");
+    let errno = Guest::new(&[grant(tmpfs.clone(), Access::ReadWrite, None)])
         .call_flagged(path, oflags, fdflags);
-    let held = memory
-        .read_dir("")
-        .expect("the root must list")
-        .into_iter()
-        .map(|entry| entry.name)
-        .collect();
+    let held = host_entries(&tmpfs).expect("the root must list");
     (errno, held)
 }
 
 // @behavior RT-091
 #[test]
-fn an_open_asking_for_synchronized_writes_is_unsupported() {
+fn an_open_may_ask_for_synchronized_writes() {
     assert_eq!(
         open_flagged(FILE, 0, FDFLAGS_SYNC).0,
-        ERRNO_NOTSUP,
-        "path_open of `file.txt` with FDFLAGS_SYNC beneath a Mount through preview1 must answer \
-         ENOTSUP"
+        0,
+        "path_open of `file.txt` with FDFLAGS_SYNC beneath a Mount through preview1 must succeed, \
+         as Linux takes O_SYNC"
     );
 }
 
 // @behavior RT-092
 #[test]
-fn an_open_of_a_directory_that_creates_or_truncates_is_invalid() {
+fn an_open_of_a_directory_answers_its_other_flags_as_linux_does() {
     let held = vec!["file.txt".to_string()];
     assert_eq!(
         (
             open_flagged(NEW_AS_DIRECTORY, OFLAGS_DIRECTORY | OFLAGS_CREAT, 0),
-            open_flagged(FILE, OFLAGS_DIRECTORY | OFLAGS_TRUNC, 0)
+            open_flagged(FILE, OFLAGS_DIRECTORY | OFLAGS_TRUNC, 0),
+            open_flagged(FILE, OFLAGS_DIRECTORY, 0),
+        ),
+        (
+            (ERRNO_INVAL, held.clone()),
+            (ERRNO_NOTDIR, held.clone()),
+            (ERRNO_NOTDIR, held)
         ),
-        ((ERRNO_INVAL, held.clone()), (ERRNO_INVAL, held)),
-        "path_open with OFLAGS_DIRECTORY and CREAT or TRUNC beneath a Mount through preview1 \
-         must answer EINVAL and make nothing"
+        "path_open with OFLAGS_DIRECTORY beneath a Mount through preview1 must answer EINVAL \
+         with CREAT and ENOTDIR for a file, and make nothing, as Linux does"
     );
 }
 
+#[cfg(unix)]
 const UP: (i32, i32) = (1070, 2);
+#[cfg(unix)]
 const THROUGH_UPDIR: (i32, i32) = (1080, 7);
+#[cfg(unix)]
 const IN_LINKED: (i32, i32) = (1090, 4);
+#[cfg(unix)]
 const TWISTY: (i32, i32) = (1100, 6);
+#[cfg(unix)]
 const DANGLE: (i32, i32) = (1110, 6);
+#[cfg(unix)]
 const DIR_UP: (i32, i32) = (1120, 6);
+#[cfg(unix)]
 const NOWHERE: (i32, i32) = (1130, 7);
+#[cfg(unix)]
+const OUT_OF_IN: (i32, i32) = (1160, 20);
+#[cfg(unix)]
+const LOOP: (i32, i32) = (1184, 4);
+#[cfg(unix)]
+const DIR_SUB: (i32, i32) = (1190, 7);
+#[cfg(unix)]
+const DIR_IN_Y: (i32, i32) = (1400, 8);
+#[cfg(unix)]
+const DIR_SUB_Y: (i32, i32) = (1420, 9);
 
 /// A host directory whose `dir` holds links staying within it (`in`,
-/// `twisty`), links leading out of it (`up`, `updir`), and links pointing
-/// at nothing out of it (`dangle`) and within it (`nowhere`).
+/// `twisty`), links leading out of it (`up`, `updir`), links pointing at
+/// nothing out of it (`dangle`) and within it (`nowhere`), and a link
+/// pointing at itself (`loop`).
 #[cfg(unix)]
 struct LinkedBeneath(std::path::PathBuf);
 
@@ -2291,7 +3477,8 @@ impl LinkedBeneath {
         let host =
             std::env::temp_dir().join(format!("kobako-beneath-{name}-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&host);
-        std::fs::create_dir_all(host.join("dir/sub")).expect("the host directory must be created");
+        std::fs::create_dir_all(host.join("dir/sub/inner"))
+            .expect("the host directory must be created");
         std::fs::create_dir_all(host.join("other")).expect("the host directory must be created");
         for file in ["secret", "other/x", "dir/sub/y"] {
             std::fs::write(host.join(file), "x").expect("the host file must be written");
@@ -2303,21 +3490,24 @@ impl LinkedBeneath {
             ("sub/../sub/y", "dir/twisty"),
             ("../escaped", "dir/dangle"),
             ("missing", "dir/nowhere"),
+            ("loop", "dir/loop"),
         ] {
             std::os::unix::fs::symlink(target, host.join(link)).expect("the link must be made");
         }
         Self(host)
     }
 
-    /// A guest over this host directory as a Directory Mount, or as an
-    /// Overlay's writable Directory Layer above an empty Memory.
+    /// A guest over this host directory as a Bind Mount, or as an
+    /// Overlay's lower Bind Layer beneath an empty upper.
     fn guest(&self, overlay: bool) -> Guest {
-        let directory = Arc::new(Directory::new(&self.0).expect("the host directory must open"));
-        let filesystem: Arc<dyn Filesystem> = if overlay {
+        let directory = Arc::new(Bind::new(&self.0).expect("the host directory must open"));
+        let filesystem: Arc<dyn FileSystemType> = if overlay {
             Arc::new(
-                Overlay::new()
-                    .layer(directory, Access::ReadWrite)
-                    .layer(Arc::new(Memory::new()), Access::Read),
+                Overlay::new(
+                    vec![Filesystem::new(directory).expect("the instance must stand")],
+                    Some(Filesystem::new(Arc::new(Tmpfs::new())).expect("the instance must stand")),
+                )
+                .expect("an upper over a lower Layer must make a view"),
             )
         } else {
             directory
@@ -2338,7 +3528,7 @@ impl Drop for LinkedBeneath {
 // @behavior RT-140
 #[cfg(unix)]
 #[test]
-fn a_link_leading_out_of_an_opened_directory_is_not_permitted() {
+fn a_link_leading_out_of_an_opened_directory_escapes_it() {
     let host = LinkedBeneath::new("out");
     let answers = |overlay| {
         let mut guest = host.guest(overlay);
@@ -2356,10 +3546,85 @@ fn a_link_leading_out_of_an_opened_directory_is_not_permitted() {
             answers(true),
             host.0.join("escaped").exists()
         ),
-        ([ERRNO_PERM; 5], [ERRNO_PERM; 5], false),
+        ([ERRNO_NOTCAPABLE; 5], [ERRNO_NOTCAPABLE; 5], false),
         "an open, a stat, or a create through preview1 of a path whose link leads out of a \
-         directory opened beneath a Directory Mount, or an Overlay's Directory Layer, must answer \
-         EPERM, as wasmtime-wasi does, and create nothing"
+         directory opened beneath a Bind Mount, or an Overlay's Bind Layer, must answer \
+         ENOTCAPABLE, as a `..` leading out does, and create nothing"
+    );
+}
+
+// The second `..` leaves `sub`, where `in` led, two names after the link, so
+// only a walk standing where the link led reaches `sub/y` from `dir`.
+// @behavior RT-119
+#[cfg(unix)]
+#[test]
+fn a_step_out_of_where_a_link_led_lands_beside_it() {
+    let host = LinkedBeneath::new("led");
+    let answers = |overlay| host.guest(overlay).call("open_beneath_dir", OUT_OF_IN);
+    assert_eq!(
+        (answers(false), answers(true)),
+        (0, 0),
+        "an open through preview1 of `in/inner/../../sub/y`, where `in` is a link within a \
+         directory opened beneath a Bind Mount or an Overlay's Bind Layer, must reach the file \
+         beside where the link points, as Linux's walk does"
+    );
+}
+
+// A Policy lets no directory move, and each side of the rename is walked
+// on its own, so only a rename recognised as onto its own path, rather
+// than by the directory each walk opened, changes nothing and succeeds.
+// @behavior RT-155
+#[cfg(unix)]
+#[test]
+fn a_directory_renamed_onto_its_own_path_beneath_a_policy_stays() {
+    let host = LinkedBeneath::new("onto-itself");
+    let directory = Arc::new(Bind::new(&host.0).expect("the host directory must open"));
+    let mut guest = Guest::new(&[grant(
+        directory,
+        Access::ReadWrite,
+        Some(Arc::new(AllowsAll)),
+    )]);
+    assert_eq!(
+        (
+            guest.call_pair("rename_paths", DIR_SUB, DIR_SUB),
+            host.0.join("dir/sub/y").is_file()
+        ),
+        (0, true),
+        "path_rename of `dir/sub` onto itself beneath a Bind Mount with a Policy through \
+         preview1 must change nothing and succeed, as rename(2) does"
+    );
+}
+
+// The two paths differ, so only the walk ending on one dentry tells the
+// rename it is onto itself; otherwise it waits on that name's lock twice.
+// @behavior RT-168
+#[cfg(unix)]
+#[test]
+fn a_file_renamed_onto_itself_through_a_link_stays() {
+    let host = LinkedBeneath::new("onto-itself-linked");
+    let mut guest = host.guest(false);
+    assert_eq!(
+        (
+            guest.call_pair("rename_paths", DIR_IN_Y, DIR_SUB_Y),
+            host.0.join("dir/sub/y").is_file()
+        ),
+        (0, true),
+        "path_rename of `dir/in/y` onto `dir/sub/y`, where `in` links to `sub`, beneath a Bind \
+         Mount through preview1 must change nothing and succeed, as rename(2) does"
+    );
+}
+
+// @behavior RT-154
+#[cfg(unix)]
+#[test]
+fn a_link_loop_answers_eloop() {
+    let host = LinkedBeneath::new("loop");
+    let answers = |overlay| host.guest(overlay).call("open_following_beneath_dir", LOOP);
+    assert_eq!(
+        (answers(false), answers(true)),
+        (ERRNO_LOOP, ERRNO_LOOP),
+        "an open through preview1 following a link pointing at itself, beneath a Directory \
+         Mount or an Overlay's Bind Layer, must answer ELOOP"
     );
 }
 
@@ -2379,38 +3644,37 @@ fn a_link_staying_within_an_opened_directory_is_followed() {
         (answers(false), answers(true)),
         ([0; 2], [0; 2]),
         "an open through preview1 of a path whose links stay within a directory opened beneath \
-         a Directory Mount, or an Overlay's Directory Layer, must reach the file they lead to"
+         a Bind Mount, or an Overlay's Bind Layer, must reach the file they lead to"
     );
 }
 
-// The link's target lies within `dir`, where Linux would create it, so only
-// the refusal to create through a link it cannot resolve answers ELOOP.
+// An Overlay's change lands in its upper, so only a Bind shows it on the host.
 // @behavior RT-142
 #[cfg(unix)]
 #[test]
-fn a_create_through_a_dangling_link_beneath_an_opened_directory_is_refused() {
-    let host = LinkedBeneath::new("dangle");
-    let answers = |overlay| {
+fn a_create_through_a_dangling_link_beneath_an_opened_directory_makes_its_target() {
+    let answers = |name, overlay| {
+        let host = LinkedBeneath::new(name);
         let errno = host
             .guest(overlay)
             .call("create_following_beneath_dir", NOWHERE);
         (errno, host.0.join("dir/missing").exists())
     };
     assert_eq!(
-        (answers(false), answers(true)),
-        ((ERRNO_LOOP, false), (ERRNO_LOOP, false)),
+        (answers("dangle", false), answers("dangle-overlay", true)),
+        ((0, true), (0, false)),
         "an open through preview1 creating a file through a link pointing at nothing beneath a \
-         directory opened beneath a Directory Mount, or an Overlay's Directory Layer, must answer \
-         ELOOP and create nothing"
+         directory opened beneath a Bind Mount must make the file where the link points, as \
+         Linux's open does, and beneath an Overlay's Bind Layer must leave that Layer as it was"
     );
 }
 
-// The link names a file outside the host directory, so cap-std refuses it
-// with no OS code, which wasmtime-wasi answers as EPERM.
+// The link names a file outside the host directory by an absolute path, so
+// the walk refuses it before any host call is made.
 // @behavior RT-143
 #[cfg(unix)]
 #[test]
-fn a_link_leading_out_of_a_mount_is_not_permitted() {
+fn a_link_leading_out_of_a_mount_escapes_it() {
     let host = LinkedBeneath::new("mount");
     let outside =
         std::env::temp_dir().join(format!("kobako-beneath-outside-{}", std::process::id()));
@@ -2420,9 +3684,9 @@ fn a_link_leading_out_of_a_mount_is_not_permitted() {
     let errno = host.guest(false).call("open_following", DIR_UP);
     let _ = std::fs::remove_file(&outside);
     assert_eq!(
-        errno, ERRNO_PERM,
-        "an open through preview1 from a Directory Mount's root of a link to a file outside its \
-         host directory must answer EPERM, as wasmtime-wasi does"
+        errno, ERRNO_NOTCAPABLE,
+        "an open through preview1 from a Bind Mount's root of a link to a file outside its \
+         host directory must answer ENOTCAPABLE, as an absolute path does"
     );
 }
 
@@ -2430,7 +3694,7 @@ fn a_link_leading_out_of_a_mount_is_not_permitted() {
 // of the bound and the access check decides between a trap and EBADF.
 // @behavior RT-144
 #[test]
-fn a_buffer_outside_memory_is_bounded_before_a_files_access_is_checked() {
+fn a_files_access_is_checked_before_a_buffer_outside_memory_is_bounded() {
     let call = |name, rights| {
         Guest::new(&[grant(file_and_directory(), Access::ReadWrite, None)])
             .try_call_at(name, rights)
@@ -2442,13 +3706,14 @@ fn a_buffer_outside_memory_is_bounded_before_a_files_access_is_checked() {
             call("pwrite_far_with", RIGHTS_FD_READ),
             call("pread_far_with", RIGHTS_FD_WRITE),
         ],
-        [None, None, None, Some(ERRNO_BADF)],
+        [Some(ERRNO_BADF); 4],
         "through preview1 on a file opened without the access each call needs, with a buffer \
-         past memory, fd_read, fd_write, and fd_pwrite must trap, and fd_pread must answer \
-         EBADF, as wasmtime-wasi does"
+         past memory, fd_read, fd_write, fd_pwrite, and fd_pread must answer EBADF, as Linux \
+         asks f_mode before it touches the buffer"
     );
 }
 
+#[cfg(unix)]
 const PUB_X: (i32, i32) = (1150, 5);
 
 /// A Policy allowing `/data/pub/` alone, which swaps `pub` for a link to
@@ -2469,9 +3734,9 @@ impl Policy for SwapsWhileAsked {
     }
 }
 
-// The swap happens inside the Policy's own judgment, so only a call that
-// reaches the path without following the link swapped in meanwhile is
-// refused; a plain Directory would read `secret/x`.
+// The swap happens inside the Policy's own judgment, after the walk opened
+// `pub`, so only a call acting on the directory it walked to, rather than
+// on the path again, keeps from reading `secret/x`.
 // @behavior RT-145
 #[cfg(unix)]
 #[test]
@@ -2483,17 +3748,19 @@ fn a_link_swapped_in_after_a_policy_judges_a_path_is_not_followed() {
         std::fs::write(host.join(dir).join("x"), dir).expect("the host file must be written");
     }
     let policy = SwapsWhileAsked(host.clone(), std::sync::atomic::AtomicBool::new(true));
-    let directory = Directory::new(&host).expect("the host directory must open");
-    let errno = Guest::new(&[grant(
+    let directory = Bind::new(&host).expect("the host directory must open");
+    let mut guest = Guest::new(&[grant(
         Arc::new(directory),
         Access::Read,
         Some(Arc::new(policy)),
-    )])
-    .call("open_following", PUB_X);
+    )]);
+    let answer = (guest.call("read_file", PUB_X), guest.read_back());
     let _ = std::fs::remove_dir_all(&host);
     assert_eq!(
-        errno, ERRNO_LOOP,
-        "an open through preview1 beneath a Directory Mount with a Policy, of a path whose \
-         directory another writer swaps for a link as the Policy judges it, must answer ELOOP"
+        answer,
+        (0, b"pub".to_vec()),
+        "a read through preview1 beneath a Bind Mount with a Policy, of a path whose \
+         directory another writer swaps for a link as the Policy judges it, must read the \
+         directory the walk held and nothing where the link points"
     );
 }