@effect-vfs/core 0.7.0 → 0.8.0

package/dist/internal/virtualFileSystem.js

@@ -1,26 +1,28 @@
 import * as Arr from "effect/Array";
 import * as ByteSize from "effect/ByteSize";
+import * as Cause from "effect/Cause";
 import * as Clock from "effect/Clock";
+import * as Context from "effect/Context";
 import * as Crypto from "effect/Crypto";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
-import * as Encoding from "effect/Encoding";
+import * as Hex from "effect/encoding/Hex";
 import * as Exit from "effect/Exit";
 import * as Match from "effect/Match";
+import * as MutableRef from "effect/MutableRef";
 import * as Option from "effect/Option";
 import * as Predicate from "effect/Predicate";
 import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
-import * as Scope from "effect/Scope";
 import * as Semaphore from "effect/Semaphore";
 import * as Stream from "effect/Stream";
 import { BytePath } from "../BytePath.js";
-import { CallerId, MkdirOptions, ObjectReferenceId, OpenEntryOptions, OpenOptions, RemoveOptions, RootCallerOptions, SetattrOptions, SymlinkOptions, WalkOptions, WriteFileOptions } from "../Caller.js";
+import { CallerId, MkdirOptions, OpenEntryOptions, OpenOptions, RemoveOptions, RootCallerOptions, SetattrOptions, SymlinkOptions, WalkOptions, WriteFileOptions } from "../Caller.js";
 import { DirectoryHandleId, FileHandleId, SeekMode } from "../FileHandle.js";
 import { Mode, OwnerUpdate, Times } from "../Metadata.js";
-import { isEntry, isTarget, Target } from "../Target.js";
+import { isEntry, Target } from "../Target.js";
 import { make as makeError } from "../VfsError.js";
-import { OverlayChange, OverlayChangesOptions, ReferenceKey, VolumeId, VolumeIdentity, VolumeIncarnation, VolumeOptions } from "../Volume.js";
+import { OverlayChange, OverlayChangesOptions, ReferenceKey, VolumeId, VolumeIdentity, VolumeIncarnation } from "../Volume.js";
 import { WatchOptions } from "../Watch.js";
 import { sameBytes } from "./bytes.js";
 import { argumentFailure, decodeConfiguration, errorPath, fsFailure, imageFailure, OpContext, retargetFailure, VfsError } from "./errors.js";
@@ -31,10 +33,13 @@ import * as InodeTable from "./inodeTable.js";
 import * as LiveImage from "./liveImage.js";
 import * as MetadataDomain from "./metadata.js";
 import { compareOverlay } from "./overlayDiff.js";
-import { DOT_DOT_HEX, DOT_HEX, inputBytes, isAttachedBytes, isDotComponent, isWellFormed, joinPath, MAX_NAME_BYTES, MAX_SYMLINK_TRAVERSALS, nameBytes, ownedPath, preparePath, ROOT_PATH, SLASH_BYTE, SLASH_HEX } from "./path.js";
+import { inputBytes, isAttachedBytes, isDotComponent, joinPath, nameBytes, ownedPath, ROOT_PATH, SLASH_BYTE, SLASH_HEX } from "./path.js";
+import * as Resolution from "./resolution.js";
 import { VolumeTestSeams } from "./testSeams.js";
+import * as TokenRegistry from "./tokenRegistry.js";
 import { makeTurnstile } from "./turnstile.js";
-import { byEntryName, directoryMetadata, emptyRoot, getNode, Ino, MAX_FILE_BYTES, reachableValue, ROOT_INO, storedMetadata, WALK_YIELD_INTERVAL } from "./volumeState.js";
+import * as Limits from "./volumeLimits.js";
+import { byEntryName, directoryMetadata, emptyState, getNode, Ino, reachableValue, ROOT_INO, storedMetadata, WALK_YIELD_INTERVAL } from "./volumeState.js";
 import * as WatchHub from "./watchHub.js";
 const EXECUTE = 0o1;
 const WRITE = 0o2;
@@ -43,11 +48,23 @@ const ANY_EXECUTE = 0o111;
 const SET_ID_BITS = 0o6000;
 const STICKY_BIT = 0o1000;
 const RELATIME_INTERVAL_NS = 86400000000000n; // relatime, as Linux mounts by default: a read refreshes an access time at least this old, 24 hours.
+/** @internal */
+export const memoryCommitProvider = Object.freeze({
+    mode: "memory",
+    commit: () => Effect.succeed("committed"),
+    shutdown: Effect.void
+});
 // An unknown commit outcome stops the volume; definite rejection stops it only during cleanup.
 const offerCommit = (provider, operation, candidate, cleanup) => Effect.map(Effect.exit(Effect.suspend(() => provider.commit(candidate))), (committed) => {
     // TODO(#186): Preserve the cause of a provider defect or interruption.
     if (Exit.isFailure(committed)) {
-        return { available: false, failure: fsFailure("OutcomeUnknown", operation) };
+        if (Cause.hasDies(committed.cause) || Cause.hasInterrupts(committed.cause)) {
+            return { available: false, failure: fsFailure("OutcomeUnknown", operation) };
+        }
+        const failure = Cause.findErrorOption(committed.cause);
+        return Option.isSome(failure)
+            ? { available: !cleanup, failure: failure.value }
+            : { available: false, failure: fsFailure("OutcomeUnknown", operation) };
     }
     if (committed.value === "rejected") {
         return { available: !cleanup, failure: fsFailure("StorageRejected", operation) };
@@ -62,7 +79,7 @@ const MAX_FILE_OFFSET = 0x7fffffffffffffffn;
 const isMode = Schema.is(Mode);
 const isNatural = Schema.is(Schema.Natural);
 const isLength = Schema.is(SetattrOptions.fields.size.schema);
-const inGroup = (identity, gid) => identity.gid === gid || identity.groups.includes(gid);
+const inGroup = Resolution.inGroup;
 const isTimestamp = Schema.is(MetadataDomain.Timestamp);
 const isSeekMode = Schema.is(SeekMode);
 const decodeOwnerUpdate = Schema.decodeEffect(OwnerUpdate, { onExcessProperty: "error" });
@@ -77,112 +94,122 @@ const decodeSymlinkOptions = Schema.decodeEffect(SymlinkOptions, { onExcessPrope
 const decodeWalkOptions = Schema.decodeEffect(WalkOptions, { onExcessProperty: "error" });
 const decodeRemoveOptions = Schema.decodeEffect(RemoveOptions, { onExcessProperty: "error" });
 const decodeOpenEntryOptions = Schema.decodeEffect(OpenEntryOptions, { onExcessProperty: "error" });
-const encoder = new TextEncoder();
 // Whether a read at `now` refreshes a node's access time: when it is not newer than the last modification or
 // status change, or when it is at least a day old. A time already equal to `now` is never refreshed, as Linux
 // skips it, so reads at one instant (a frozen or coarse clock) store nothing.
 const accessDue = (metadata, now) => now !== metadata.atimeNs && (metadata.atimeNs <= metadata.mtimeNs || metadata.atimeNs <= metadata.ctimeNs ||
     now - metadata.atimeNs >= RELATIME_INTERVAL_NS);
 const refreshDue = (read) => read.access !== undefined && accessDue(read.access.node.metadata, read.access.now);
-// Builds the next volume value for one transition. Reads see pending writes; a discarded draft leaves the
-// base untouched, so an interrupted or failed transition needs no rollback.
-class Draft {
-    base;
-    owner = Symbol();
-    pending = new Map();
-    opens;
-    nextInode;
-    changed = false;
-    finished;
-    revision;
-    entries;
-    usedBytes;
-    events = [];
-    after = [];
-    removed = [];
-    constructor(base) {
-        this.base = base;
-        this.nextInode = base.nextInode;
-        this.revision = base.revision + 1n;
-        this.entries = base.entries;
-        this.usedBytes = base.usedBytes;
-    }
-    get(ino) {
-        const pending = this.pending.get(ino);
-        return pending !== undefined || this.pending.has(ino) ? pending : InodeTable.get(this.base.inodes, ino);
-    }
-    put(node) {
-        this.changed = true;
-        // SAFETY: callers construct the value they pass, so stamping it in place replaces a spread on every write.
-        const stamped = node;
-        stamped.revision = this.revision;
-        this.pending.set(node.ino, node);
-    }
-    putQuiet(node) {
-        this.pending.set(node.ino, node);
-    }
-    get unchanged() {
-        return this.pending.size === 0 && this.opens === undefined && this.nextInode === this.base.nextInode &&
-            this.entries === this.base.entries && this.usedBytes === this.base.usedBytes;
-    }
-    remove(ino) {
-        this.removed.push(ino);
-        this.pending.set(ino, undefined);
-    }
-    allocate() {
-        const ino = this.nextInode;
-        this.nextInode = Ino(ino + 1);
-        return ino;
-    }
-    // Whether another inode can be allocated. The allocator itself must stay exactly representable, since a live
-    // image refuses one past the largest safe integer, so the last inode it hands out is one below that.
-    get canAllocate() {
-        return this.nextInode < Number.MAX_SAFE_INTEGER;
-    }
-    openCount(ino) {
-        return this.opens?.get(ino) ?? this.base.open.get(ino) ?? 0;
-    }
-    retain(ino) {
-        this.opens = (this.opens ?? new Map()).set(ino, this.openCount(ino) + 1);
-    }
-    release(ino) {
-        const count = this.openCount(ino) - 1;
-        this.opens = (this.opens ?? new Map()).set(ino, count < 0 ? 0 : count);
-        return count;
-    }
-    finish() {
-        if (this.finished !== undefined)
-            return this.finished;
-        const base = this.base;
-        let inodes = base.inodes;
-        for (const [ino, node] of this.pending)
-            inodes = InodeTable.set(inodes, ino, node, this.owner);
-        let open = base.open;
-        if (this.opens !== undefined) {
-            const next = new Map(base.open);
-            for (const [ino, count] of this.opens) {
-                if (count > 0)
-                    next.set(ino, count);
-                else
-                    next.delete(ino);
-            }
-            open = next;
-        }
-        this.finished = {
-            inodes,
-            open,
-            nextInode: this.nextInode,
-            revision: this.changed ? this.revision : base.revision,
-            entries: this.entries,
-            usedBytes: this.usedBytes
+class Draft extends Context.Service()("@effect-vfs/core/internal/virtualFileSystem/Draft", {
+    make: Effect.fnUntraced(function* (base) {
+        const revision = base.revision + 1n;
+        const cell = MutableRef.make({
+            owner: Symbol(),
+            pending: new Map(),
+            opens: undefined,
+            nextInode: base.nextInode,
+            changed: false,
+            finished: undefined,
+            entries: base.entries,
+            usedBytes: base.usedBytes,
+            events: [],
+            after: [],
+            removed: []
+        });
+        const get = (ino) => Effect.sync(() => {
+            const draft = MutableRef.get(cell);
+            return draft.pending.has(ino) ? draft.pending.get(ino) : InodeTable.get(base.inodes, ino);
+        });
+        const openCount = (ino) => Effect.sync(() => MutableRef.get(cell).opens?.get(ino) ?? base.open.get(ino) ?? 0);
+        const put = (node, changed) => Effect.sync(() => {
+            MutableRef.update(cell, (draft) => {
+                // This map belongs only to this transition. Copying it on every inode write makes recursive changes quadratic.
+                draft.pending.set(node.ino, changed ? { ...node, revision } : node);
+                return { ...draft, changed: draft.changed || changed };
+            });
+        });
+        return {
+            revision,
+            get,
+            put: (node) => put(node, true),
+            putQuiet: (node) => put(node, false),
+            unchanged: Effect.sync(() => {
+                const draft = MutableRef.get(cell);
+                return draft.pending.size === 0 && draft.opens === undefined && draft.nextInode === base.nextInode &&
+                    draft.entries === base.entries && draft.usedBytes === base.usedBytes;
+            }),
+            remove: (ino) => Effect.sync(() => {
+                const draft = MutableRef.get(cell);
+                draft.pending.set(ino, undefined);
+                draft.removed.push(ino);
+            }),
+            allocate: Effect.sync(() => {
+                const next = MutableRef.get(cell).nextInode;
+                MutableRef.update(cell, (draft) => ({ ...draft, nextInode: Ino(next + 1) }));
+                return next;
+            }),
+            canAllocate: Effect.sync(() => MutableRef.get(cell).nextInode < Number.MAX_SAFE_INTEGER),
+            openCount,
+            retain: (ino) => Effect.sync(() => {
+                const count = MutableRef.get(cell).opens?.get(ino) ?? base.open.get(ino) ?? 0;
+                MutableRef.update(cell, (draft) => ({ ...draft, opens: new Map(draft.opens).set(ino, count + 1) }));
+            }),
+            release: (ino) => Effect.sync(() => {
+                const count = (MutableRef.get(cell).opens?.get(ino) ?? base.open.get(ino) ?? 0) - 1;
+                MutableRef.update(cell, (draft) => ({ ...draft, opens: new Map(draft.opens).set(ino, Math.max(0, count)) }));
+                return count;
+            }),
+            entries: Effect.sync(() => MutableRef.get(cell).entries),
+            addEntries: (amount) => Effect.sync(() => {
+                MutableRef.update(cell, (draft) => ({ ...draft, entries: draft.entries + amount }));
+            }),
+            usedBytes: Effect.sync(() => MutableRef.get(cell).usedBytes),
+            addUsedBytes: (amount) => Effect.sync(() => {
+                MutableRef.update(cell, (draft) => ({ ...draft, usedBytes: draft.usedBytes + amount }));
+            }),
+            publish: (event) => Effect.sync(() => {
+                MutableRef.get(cell).events.push(event);
+            }),
+            afterInstall: (action) => Effect.sync(() => {
+                MutableRef.get(cell).after.push(action);
+            }),
+            finish: Effect.sync(() => {
+                const draft = MutableRef.get(cell);
+                if (draft.finished !== undefined)
+                    return draft.finished;
+                let inodes = base.inodes;
+                for (const [ino, node] of draft.pending)
+                    inodes = InodeTable.set(inodes, ino, node, draft.owner);
+                let open = base.open;
+                if (draft.opens !== undefined) {
+                    const next = new Map(base.open);
+                    for (const [ino, count] of draft.opens) {
+                        if (count > 0)
+                            next.set(ino, count);
+                        else
+                            next.delete(ino);
+                    }
+                    open = next;
+                }
+                const finished = {
+                    inodes,
+                    open,
+                    nextInode: draft.nextInode,
+                    revision: draft.changed ? revision : base.revision,
+                    entries: draft.entries,
+                    usedBytes: draft.usedBytes
+                };
+                MutableRef.update(cell, (current) => ({ ...current, finished }));
+                return finished;
+            }),
+            actions: Effect.sync(() => {
+                const { events, after, removed } = MutableRef.get(cell);
+                return { events, after, removed };
+            })
         };
-        return this.finished;
-    }
+    })
+}) {
 }
-const objectReferences = new WeakMap();
-const isFileHandle = (value) => Predicate.hasProperty(FileHandleId)(value);
-const files = new WeakMap();
-const handles = new WeakMap();
 const withMetadata = (node) => ({ ...node.metadata, revision: node.revision });
 const withEntries = (directory, edit) => {
     const entries = new Map(directory.entries);
@@ -227,38 +254,26 @@ const observeChanges = Effect.fnUntraced(function* (captured) {
 });
 const randomHex128 = Effect.gen(function* () {
     const crypto = yield* Crypto.Crypto;
-    return Encoding.encodeHex(yield* crypto.randomBytes(16));
+    return Hex.encode(yield* crypto.randomBytes(16));
 }).pipe(Effect.orDie);
 /** @internal */
-export const makeVolume = Effect.fnUntraced(function* (source, options, commitProvider, captureInitial, durability = "memory-only") {
+export const makeVolume = Effect.fnUntraced(function* (source, commitProvider, options, durability = "memory-only") {
     const services = yield* Effect.context();
     // These accessors run inside synchronous transition callbacks. The runner is reached only when an invariant fails.
     const dieInvariant = (message) => Effect.runSyncWith(services)(Effect.die(message));
     const live = Predicate.isTagged("Live")(source) ? source.restored : undefined;
-    let restoredOptions = options;
-    if (live !== undefined) {
-        const recovered = { identity: live.identity };
-        if (live.limits.maxEntries !== undefined)
-            recovered.maxEntries = live.limits.maxEntries;
-        if (live.limits.maxBytes !== undefined)
-            recovered.maxBytes = ByteSize.bytes(live.limits.maxBytes);
-        if (live.limits.maxFileBytes !== undefined)
-            recovered.maxFileBytes = ByteSize.bytes(live.limits.maxFileBytes);
-        if (live.limits.maxPathBytes !== undefined)
-            recovered.maxPathBytes = ByteSize.bytes(live.limits.maxPathBytes);
-        restoredOptions = recovered;
-    }
-    const decoded = yield* Effect.fromResult(decodeConfiguration(VolumeOptions, restoredOptions === undefined ? {} : restoredOptions, "make"));
-    const settings = { ...decoded };
-    const identity = settings.identity === undefined
+    const decoded = yield* Effect.fromResult(Limits.configuration(options));
+    const requested = decoded.limits;
+    const limits = live === undefined ? requested : yield* Effect.fromResult(Limits.fromStored(live.limits, requested));
+    const identity = live?.identity ?? (decoded.identity === undefined
         ? VolumeIdentity.make(yield* randomHex128)
-        : VolumeIdentity.make(settings.identity);
+        : decoded.identity);
     const incarnation = VolumeIncarnation.make(yield* randomHex128);
     const epoch = live === undefined ? VolumeEpoch.make(yield* randomHex128) : live.epoch;
     const keySecret = live === undefined ? KeySecret.make(yield* randomHex128) : live.keySecret;
-    const identityBytes = Result.getOrThrow(Encoding.decodeHex(identity));
-    const epochBytes = Result.getOrThrow(Encoding.decodeHex(epoch));
-    const keySecretBytes = Result.getOrThrow(Encoding.decodeHex(keySecret));
+    const identityBytes = Result.getOrThrow(Hex.decode(identity));
+    const epochBytes = Result.getOrThrow(Hex.decode(epoch));
+    const keySecretBytes = Result.getOrThrow(Hex.decode(keySecret));
     const clock = yield* Clock.clockWith(Effect.succeed);
     const initialTime = clock.currentTimeNanosUnsafe();
     if (!isTimestamp(initialTime)) {
@@ -271,24 +286,8 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             : Effect.fail(op.fail("InvalidArgument"));
     });
     const volumeIdentity = Symbol();
-    const tokens = new Map();
     const directoryHolds = new Map();
-    const makeFileReference = (access, append) => ({
-        volume: volumeIdentity,
-        scope: undefined,
-        closed: false,
-        ino: undefined,
-        offset: 0n,
-        access,
-        append
-    });
-    const makeDirectoryReference = (ino) => ({
-        volume: volumeIdentity,
-        scope: undefined,
-        closed: false,
-        ino
-    });
-    const maxPendingOperations = settings.maxPendingOperations ?? 64;
+    const maxPendingOperations = limits.maxPendingOperations;
     const permits = maxPendingOperations + 1;
     const gate = Semaphore.makeUnsafe(permits);
     // The gate hands permits to whichever waiter it can satisfy, so a change waiting for every permit would be
@@ -305,125 +304,92 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         onNone: () => op.fail("VolumeBusy"),
         onSome: Effect.succeed
     })));
-    const root = emptyRoot(initialTime);
-    let state = {
-        inodes: InodeTable.set(InodeTable.empty(), ROOT_INO, root),
-        open: new Map(),
-        nextInode: Ino(2),
-        revision: 1n,
-        entries: 0,
-        usedBytes: 0n
-    };
-    const maxFileBytes = Number(ByteSize.toBigInt(settings.maxFileBytes ?? ByteSize.bytes(MAX_FILE_BYTES)));
-    const limits = Object.freeze({
-        maxBytes: settings.maxBytes,
-        maxFileBytes: ByteSize.bytes(maxFileBytes),
-        maxEntries: settings.maxEntries,
-        maxPathBytes: settings.maxPathBytes,
-        maxPendingOperations: settings.maxPendingOperations ?? 64,
-        maxWatchEvents: settings.maxWatchEvents ?? 256
-    });
+    let state = emptyState(initialTime);
+    const maxFileBytes = Number(ByteSize.toBigInt(limits.maxFileBytes));
     if (Predicate.isTagged("Restored")(source)) {
         const restored = yield* reachableValue(source.value);
         if (restored.largestFile > maxFileBytes) {
             return yield* imageFailure("snapshot", "LimitExceeded", { field: "maxFileBytes" });
         }
-        if ((settings.maxEntries !== undefined && restored.state.entries > settings.maxEntries) ||
-            (settings.maxBytes !== undefined && restored.state.usedBytes > ByteSize.toBigInt(settings.maxBytes))) {
+        if ((limits.maxEntries !== undefined && restored.state.entries > limits.maxEntries) ||
+            (limits.maxBytes !== undefined && restored.state.usedBytes > ByteSize.toBigInt(limits.maxBytes))) {
             return yield* imageFailure("snapshot", "LimitExceeded", { field: "volume" });
         }
         state = restored.state;
     }
     if (live !== undefined)
         state = live.value;
-    const initialImage = captureInitial === undefined
-        ? undefined
-        : yield* captureInitial(state, { identity, epoch, keySecret }, limits);
-    let draft;
-    const view = (ino) => draft === undefined ? getNode(state, ino) : draft.get(ino);
+    const view = (ino) => Effect.flatMap(Effect.serviceOption(Draft), (draft) => Option.isSome(draft) ? draft.value.get(ino) : Effect.sync(() => getNode(state, ino)));
+    const registry = TokenRegistry.make(volumeIdentity, view);
+    const referenceFor = registry.referenceFor;
+    const makeFileReference = registry.file;
+    const makeDirectoryReference = registry.directory;
     let available = true;
     const checkAvailable = (operation) => Effect.suspend(() => available ? Effect.void : Effect.fail(fsFailure("VolumeUnavailable", operation)));
     const watchCoordinate = (effect) => changing(effect);
-    const watchHub = yield* WatchHub.make(watchCoordinate, settings.maxWatchEvents ?? 256);
-    const install = (finished) => {
+    const watchHub = yield* WatchHub.make(watchCoordinate, limits.maxWatchEvents);
+    const install = Effect.fnUntraced(function* (finished) {
         const before = state;
-        state = finished.finish();
-        for (const ino of finished.removed)
-            tokens.delete(ino);
-        for (const apply of finished.after)
+        state = yield* finished.finish;
+        const actions = yield* finished.actions;
+        for (const ino of actions.removed)
+            registry.forget(ino);
+        for (const apply of actions.after)
             apply();
         const after = state;
-        watchHub.publishUnsafe(() => finished.events.flatMap((events) => Array.from(events(after))), { before, after });
-    };
-    const transition = (change) => Effect.suspend(() => {
-        const current = new Draft(state);
-        draft = current;
-        return Effect.onExit(change, () => Effect.sync(() => {
-            draft = undefined;
-        })).pipe(Effect.map((value) => [value, current]));
+        watchHub.publishUnsafe(() => actions.events.flatMap((events) => Array.from(events(after))), { before, after });
     });
-    const applyDirect = (change) => {
-        const current = new Draft(state);
-        draft = current;
-        try {
-            change(current);
-        }
-        finally {
-            draft = undefined;
-        }
-        install(current);
-    };
-    // Offers the finished draft's value to the store before installing it. A rejected candidate is discarded and
-    // the volume stays available; an uncertain answer stops the volume. A change that is a cleanup runs its
-    // release even when the store refuses, since the handle must not stay open.
-    const committed = Effect.fnUntraced(function* (op, provider, finished, onStorageFailure) {
-        if (finished.unchanged)
-            return install(finished);
-        const next = finished.finish();
-        if (provider.prepare !== undefined)
-            yield* provider.prepare(next);
-        const answer = yield* offerCommit(provider, op.operation, next, onStorageFailure !== undefined);
+    const transition = Effect.fnUntraced(function* (change) {
+        const current = yield* Draft.make(state);
+        const value = yield* Effect.provideService(change, Draft, current);
+        return [value, current];
+    });
+    // Cleanup releases local ownership even when storage refuses; that divergence disables the volume.
+    const committed = Effect.fnUntraced(function* (op, finished, cleanup) {
+        if ((yield* finished.unchanged) || (cleanup && !available))
+            return yield* install(finished);
+        const next = yield* finished.finish;
+        const answer = yield* offerCommit(commitProvider, op.operation, next, cleanup);
         if (!answer.available)
             available = false;
         if (answer.failure !== undefined) {
-            if (!answer.available)
-                onStorageFailure?.();
+            if (cleanup)
+                yield* install(finished);
             return yield* answer.failure;
         }
-        install(finished);
+        yield* install(finished);
+    });
+    const applyCleanup = Effect.fnUntraced(function* (change) {
+        const current = yield* Draft.make(state);
+        yield* Effect.provideService(change(current), Draft, current);
+        yield* committed(OpContext.make("close"), current, true);
     });
     const annotateFailure = (error) => Effect.annotateCurrentSpan({ operation: error.operation, code: error.code });
-    // Permit waits stay interruptible. A change and its publication run under every permit; with a store, the
-    // change itself stays interruptible and only the commit and installation are not.
-    const coordinated = (op, effect, onStorageFailure) => admit(op, changing(commitProvider === undefined
-        ? Effect.uninterruptible(Effect.map(transition(Effect.andThen(checkAvailable(op.operation), effect)), ([value, finished]) => {
-            install(finished);
-            return value;
-        }))
-        : Effect.uninterruptibleMask((restore) => Effect.flatMap(restore(transition(Effect.andThen(checkAvailable(op.operation), effect))), ([value, finished]) => Effect.as(committed(op, commitProvider, finished, onStorageFailure), value))))).pipe(Effect.tapError((error) => Schema.is(VfsError)(error) ? annotateFailure(error) : Effect.void));
+    // Permit waits stay interruptible. Memory transitions are masked; durable transitions remain
+    // interruptible until the candidate is ready. Every provider commit and installation is masked.
+    const coordinated = (op, effect, cleanup = false) => admit(op, changing(Effect.uninterruptibleMask((restore) => {
+        const staged = transition(Effect.andThen(checkAvailable(op.operation), effect));
+        return Effect.flatMap(commitProvider.mode === "memory" ? staged : restore(staged), ([value, finished]) => Effect.as(committed(op, finished, cleanup), value));
+    }))).pipe(Effect.tapError((error) => Schema.is(VfsError)(error) ? annotateFailure(error) : Effect.void));
     const coordinatedRead = (op, effect) => admit(op, observing(Effect.andThen(checkAvailable(op.operation), effect))).pipe(Effect.tapError((error) => Schema.is(VfsError)(error) ? annotateFailure(error) : Effect.void));
-    const refreshAccess = (read) => {
+    const refreshAccess = Effect.fnUntraced(function* (read) {
         if (refreshDue(read)) {
             const { node, now } = read.access;
-            current().putQuiet({ ...node, metadata: { ...node.metadata, atimeNs: now } });
+            const draft = yield* Draft;
+            yield* draft.putQuiet({ ...node, metadata: { ...node.metadata, atimeNs: now } });
         }
         return read.value;
-    };
+    });
     // A read that may refresh an access time. It observes under one permit, so reads run beside each other, and
     // only when the access time is due does it run again as a change. The change repeats every check and the rule,
     // since another read may have refreshed the time meanwhile, and its result is the one returned.
     const accessing = (op, read) => Effect.flatMap(coordinatedRead(op, read), (observed) => refreshDue(observed)
-        ? coordinated(op, Effect.map(read, refreshAccess))
+        ? coordinated(op, Effect.flatMap(read, refreshAccess))
         : Effect.succeed(observed.value));
     const coordinatedCleanup = (effect) => changing(Effect.uninterruptible(effect));
-    const shutdown = commitProvider === undefined ? undefined : changing(Effect.sync(() => {
+    const shutdown = commitProvider.mode === "memory" ? commitProvider.shutdown : changing(Effect.uninterruptible(Effect.andThen(Effect.sync(() => {
         available = false;
-    }));
-    const current = () => {
-        if (draft === undefined)
-            return dieInvariant("Volume mutation outside a transition");
-        return draft;
-    };
+    }), commitProvider.shutdown)));
     const pathOf = (get, ino) => {
         const names = [];
         let node = get(ino);
@@ -438,19 +404,33 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         }
         return SLASH_HEX + names.reverse().join(SLASH_HEX);
     };
+    const pathOfCurrent = Effect.fnUntraced(function* (ino) {
+        const names = [];
+        const first = yield* view(ino);
+        if (first?.kind !== "directory" || first.metadata.nlink === 0)
+            return undefined;
+        let node = first;
+        while (node.ino !== ROOT_INO) {
+            names.push(node.name);
+            const parent = yield* view(node.parent);
+            if (parent?.kind !== "directory" || parent.metadata.nlink === 0)
+                return undefined;
+            node = parent;
+        }
+        return SLASH_HEX + names.reverse().join(SLASH_HEX);
+    });
     const entryPath = (prefix, name) => ownedPath(nameBytes(prefix + (prefix === SLASH_HEX ? "" : SLASH_HEX) + name));
-    const publishEntry = (_tag, parent, name, ino) => {
-        current().events.push((installed) => {
-            const prefix = pathOf((at) => getNode(installed, at), parent);
-            return prefix === undefined ? [] : [{ change: { _tag, path: entryPath(prefix, name) }, parent, ino }];
-        });
-    };
-    const publishNode = (ino) => {
-        const target = current().get(ino);
+    const publishEntry = (_tag, parent, name, ino) => Effect.flatMap(Draft, (draft) => draft.publish((installed) => {
+        const prefix = pathOf((at) => getNode(installed, at), parent);
+        return prefix === undefined ? [] : [{ change: { _tag, path: entryPath(prefix, name) }, parent, ino }];
+    }));
+    const publishNode = Effect.fnUntraced(function* (ino) {
+        const draft = yield* Draft;
+        const target = yield* draft.get(ino);
         if (target === undefined)
             return;
         if (target.kind === "directory") {
-            current().events.push((installed) => {
+            yield* draft.publish((installed) => {
                 const directory = getNode(installed, ino);
                 const path = pathOf((at) => getNode(installed, at), ino);
                 return path === undefined || directory?.kind !== "directory"
@@ -460,7 +440,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             return;
         }
         const links = target.links;
-        current().events.push((installed) => {
+        yield* draft.publish((installed) => {
             const events = [];
             for (const link of links) {
                 const prefix = pathOf((at) => getNode(installed, at), link.parent);
@@ -474,7 +454,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             }
             return events;
         });
-    };
+    });
     const pathsOf = (installed, ino) => {
         const node = getNode(installed, ino);
         if (node === undefined)
@@ -508,16 +488,9 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         includes: () => true,
         rescan: () => ({ change: RescanChange.make({ path: rootPath() }), parent: ROOT_INO, ino: ROOT_INO })
     };
-    const scopeRoot = (scope, op) => Effect.suspend(() => {
-        const known = objectReferences.get(scope);
-        if (known === undefined)
-            return Effect.fail(op.fail("InvalidReference"));
-        if (known.volume !== volumeIdentity)
-            return Effect.fail(op.fail("ForeignReference"));
-        const node = getNode(state, known.ino);
-        return node === undefined || node.metadata.nlink === 0
-            ? Effect.fail(op.fail("StaleReference"))
-            : Effect.succeed(known.ino);
+    const scopeRoot = Effect.fnUntraced(function* (scope, op) {
+        const node = yield* TokenRegistry.nodeOrFail(yield* registry.resolve(scope, "reference"), "reference", op);
+        return node.metadata.nlink === 0 ? yield* op.fail("StaleReference") : node.ino;
     });
     // A watch of one object, and of its subtree when recursive. Membership is read from the installed tree when
     // each event is offered, so it follows renames of the scope and its ancestors. When the object's last name is
@@ -550,10 +523,6 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         yield* (yield* VolumeTestSeams).betweenSnapshotAndSummary;
         return { snapshot, observation: yield* observeChanges(captured) };
     });
-    const addressable = (ino) => {
-        const node = getNode(state, ino);
-        return node !== undefined && !(node.kind === "directory" && node.metadata.nlink === 0);
-    };
     const keyTag = (ino) => {
         const message = new Uint8Array(40);
         message.set(identityBytes);
@@ -561,19 +530,10 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         new DataView(message.buffer).setBigUint64(32, ino);
         return hmacSha256(keySecretBytes, message).subarray(0, 16);
     };
-    const referenceFor = (ino) => {
-        const existing = tokens.get(ino);
-        if (existing !== undefined)
-            return existing;
-        const reference = Object.freeze({ [ObjectReferenceId]: true });
-        objectReferences.set(reference, { volume: volumeIdentity, ino });
-        tokens.set(ino, reference);
-        return reference;
-    };
     const holdDirectory = (ino) => {
         directoryHolds.set(ino, (directoryHolds.get(ino) ?? 0) + 1);
     };
-    const unholdDirectory = (ino) => {
+    const unholdDirectory = Effect.fnUntraced(function* (ino) {
         const count = (directoryHolds.get(ino) ?? 1) - 1;
         if (count > 0) {
             directoryHolds.set(ino, count);
@@ -581,59 +541,57 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         }
         directoryHolds.delete(ino);
         const node = getNode(state, ino);
-        if (node?.kind === "directory" && node.metadata.nlink === 0)
-            applyDirect((d) => d.remove(ino));
-    };
-    const releaseDirectory = (reference) => {
-        const ino = reference.ino;
-        reference.ino = undefined;
-        reference.closed = true;
-        if (ino !== undefined)
-            unholdDirectory(ino);
-    };
-    const finalizeDirectory = (reference) => Effect.uninterruptible(Effect.suspend(() => reference.closed
-        ? Effect.void
-        : coordinatedCleanup(Effect.sync(() => releaseDirectory(reference)))));
-    const closeReleasedScope = (reference) => Effect.suspend(() => !reference.closed || reference.scope === undefined ? Effect.void : Scope.close(reference.scope, Exit.void));
-    const permitted = (node, identity) => {
-        const metadata = node.metadata;
-        const shift = metadata.uid === identity.uid ?
-            6
-            : inGroup(identity, metadata.gid)
-                ? 3
-                : 0;
-        return (metadata.mode >> shift) & (READ | WRITE | EXECUTE);
+        if (node?.kind === "directory" && node.metadata.nlink === 0) {
+            yield* applyCleanup((d) => d.remove(ino));
+        }
+    });
+    const releaseDirectory = (reference) => TokenRegistry.release(reference, unholdDirectory, (action) => Effect.sync(action));
+    const finalizeDirectory = (reference) => {
+        const close = coordinatedCleanup(releaseDirectory(reference));
+        return TokenRegistry.finalize(reference, close, Effect.ignore(close));
     };
-    const authorize = (node, identity, bits, op) => identity.privileged || (permitted(node, identity) & bits) === bits
-        ? Effect.void
-        : Effect.fail(op.fail("AccessDenied"));
-    const reclaim = (d, ino) => {
-        const node = d.get(ino);
+    const closeReleasedScope = TokenRegistry.closeReleasedScope;
+    const permitted = Resolution.permitted;
+    const authorize = Resolution.authorize;
+    const reclaim = Effect.fnUntraced(function* (d, ino) {
+        const node = yield* d.get(ino);
         if (node === undefined)
             return;
         if (node.kind === "file") {
-            if (node.links.length > 0 || d.openCount(ino) > 0)
+            if (node.links.length > 0 || (yield* d.openCount(ino)) > 0)
                 return;
-            d.usedBytes -= BigInt(node.data.length);
+            yield* d.addUsedBytes(-BigInt(node.data.length));
         }
         else if (node.kind === "symlink") {
             if (node.links.length > 0)
                 return;
-            d.usedBytes -= BigInt(node.target.length);
+            yield* d.addUsedBytes(-BigInt(node.target.length));
         }
         else if (node.metadata.nlink > 0 || directoryHolds.has(ino))
             return;
-        d.remove(ino);
-    };
-    const atEntryLimit = () => settings.maxEntries !== undefined && current().entries >= settings.maxEntries;
-    const reserveEntry = (op) => atEntryLimit() || !current().canAllocate ? Effect.fail(op.fail("NoSpace")) : Effect.void;
-    const reserveInode = (op) => current().canAllocate ? Effect.void : Effect.fail(op.fail("NoSpace"));
-    const reserveBytes = (op, bytes) => settings.maxBytes !== undefined && bytes > ByteSize.toBigInt(settings.maxBytes) - current().usedBytes
-        ? Effect.fail(op.fail("NoSpace"))
-        : Effect.void;
-    const attach = (parent, name, child, now) => {
-        const d = current();
-        d.put(withEntries({
+        yield* d.remove(ino);
+    });
+    const atEntryLimit = Effect.gen(function* () {
+        const draft = yield* Draft;
+        return limits.maxEntries !== undefined && (yield* draft.entries) >= limits.maxEntries;
+    });
+    const reserveEntry = Effect.fnUntraced(function* (op) {
+        const draft = yield* Draft;
+        if ((yield* atEntryLimit) || !(yield* draft.canAllocate))
+            return yield* op.fail("NoSpace");
+    });
+    const reserveInode = (op) => Effect.flatMap(Draft, (draft) => Effect.flatMap(draft.canAllocate, (available) => available ? Effect.void : Effect.fail(op.fail("NoSpace"))));
+    const reserveBytes = Effect.fnUntraced(function* (op, bytes) {
+        if (limits.maxBytes === undefined)
+            return;
+        const draft = yield* Draft;
+        if (bytes > ByteSize.toBigInt(limits.maxBytes) - (yield* draft.usedBytes)) {
+            return yield* op.fail("NoSpace");
+        }
+    });
+    const attach = Effect.fnUntraced(function* (parent, name, child, now) {
+        const d = yield* Draft;
+        yield* d.put(withEntries({
             ...parent,
             metadata: {
                 ...parent.metadata,
@@ -643,89 +601,43 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             }
         }, (entries) => entries.set(name, child.ino)));
         if (child.kind === "directory")
-            d.put({ ...child, parent: parent.ino, name });
+            yield* d.put({ ...child, parent: parent.ino, name });
         else {
-            d.put({
+            yield* d.put({
                 ...child,
                 links: [...child.links, { parent: parent.ino, name }],
                 metadata: { ...child.metadata, nlink: child.links.length + 1, ctimeNs: now }
             });
         }
-    };
-    const detach = (child, parent, name, now) => {
-        const d = current();
+    });
+    const detach = Effect.fnUntraced(function* (child, parent, name, now) {
+        const d = yield* Draft;
         if (child.kind === "directory") {
-            d.put({ ...child, metadata: { ...child.metadata, nlink: 0, ctimeNs: now } });
+            yield* d.put({ ...child, metadata: { ...child.metadata, nlink: 0, ctimeNs: now } });
         }
         else {
             const links = withoutLink(child.links, parent, name);
-            d.put({ ...child, links, metadata: { ...child.metadata, nlink: links.length, ctimeNs: now } });
-        }
-        reclaim(d, child.ino);
-    };
-    const releaseFile = (ref) => {
-        const ino = ref.ino;
-        if (ino !== undefined) {
-            const d = current();
-            d.release(ino);
-            reclaim(d, ino);
+            yield* d.put({ ...child, links, metadata: { ...child.metadata, nlink: links.length, ctimeNs: now } });
         }
-        ref.ino = undefined;
-        ref.closed = true;
-    };
-    const releaseOpenFile = (ref) => coordinatedCleanup(Effect.sync(() => {
-        if (!ref.closed)
-            applyDirect(() => releaseFile(ref));
-    }));
-    // Explicit close and scope cleanup share one release. A release whose commit fails still completes as
-    // cleanup, so the handle never stays open; only an explicit close reports the failure. A close refused
-    // admission never entered the volume, so it leaves the handle open for a retry.
-    const closeFile = (ref, op, check) => coordinated(op, Effect.andThen(check, Effect.sync(() => {
-        const ino = ref.ino;
-        if (ino !== undefined) {
-            const d = current();
-            d.release(ino);
-            reclaim(d, ino);
-        }
-        current().after.push(() => {
-            ref.ino = undefined;
-            ref.closed = true;
-        });
-    })), () => applyDirect(() => releaseFile(ref))).pipe(Effect.tapError((error) => error.code === "VolumeBusy" ? Effect.void : releaseOpenFile(ref)));
-    // Keyed on the file rather than the closed flag, so a rerun releases an open that published after a first run.
-    // Cleanup is uninterruptible and does not need admission, so an interrupted or busy scope close still releases.
-    const finalizeFile = (ref) => Effect.uninterruptible(Effect.suspend(() => ref.ino === undefined
-        ? Effect.sync(() => {
-            ref.closed = true;
-        })
-        : Effect.ignore(closeFile(ref, OpContext.make("close"), Effect.void)).pipe(Effect.andThen(Effect.suspend(() => ref.closed ? Effect.void : releaseOpenFile(ref))))));
-    // Acquires a handle into its own scope, forked from the caller's. The finalizer is registered before waiting,
-    // since a closed scope runs a new finalizer at once and the permit is not reentrant. A scope that closes
-    // before or during acquisition interrupts it, and releasing here, under the permit, keeps the acquisition
-    // from outliving a finalizer that already ran. A scope that closes while the acquisition commits interrupts it
-    // too. Every exit without a handle reruns the finalizer, which may have run before the commit published and
-    // which closing an already closed scope would not run again.
-    const acquireHandle = Effect.fnUntraced(function* (reference, coordinate, acquire, releaseAcquired, finalize) {
-        const scope = yield* Scope.fork(yield* Effect.scope);
-        reference.scope = scope;
-        yield* Scope.addFinalizer(scope, finalize);
-        const closed = () => Predicate.isTagged(scope.state, "Closed");
-        return yield* coordinate(Effect.suspend(() => closed() ? Effect.interrupt : acquire).pipe(Effect.tap(() => Effect.suspend(() => {
-            if (!closed())
-                return Effect.void;
-            releaseAcquired();
-            return Effect.interrupt;
-        })))).pipe(Effect.tap(() => Effect.suspend(() => closed() ? Effect.interrupt : Effect.void)), Effect.onError(() => Effect.andThen(finalize, Scope.close(scope, Exit.void))));
+        yield* reclaim(d, child.ino);
     });
-    const bindFile = (ref, ino) => {
-        current().after.push(() => {
-            ref.ino = ino;
-        });
-    };
-    const replaceContent = (file, data, now, publish = true) => {
-        const d = current();
-        d.usedBytes += BigInt(data.length - file.data.length);
-        d.put({
+    const releaseFileInode = Effect.fnUntraced(function* (ino) {
+        const d = yield* Draft;
+        yield* d.release(ino);
+        yield* reclaim(d, ino);
+    });
+    const releaseFile = (ref) => TokenRegistry.release(ref, releaseFileInode, (action) => Effect.sync(action));
+    const releaseOpenFile = (ref) => Effect.ignore(coordinatedCleanup(Effect.suspend(() => TokenRegistry.inode(ref) === undefined ? Effect.void : applyCleanup(() => releaseFile(ref)))));
+    // Admission refusal leaves the handle open. Every admitted close shares the registry release,
+    // and a storage failure still completes cleanup while only explicit close reports the failure.
+    const closeFile = (ref, op, check) => coordinated(op, Effect.andThen(check, TokenRegistry.release(ref, releaseFileInode, (action) => Effect.flatMap(Draft, (draft) => draft.afterInstall(action)))), true).pipe(Effect.tapError((error) => error.code === "VolumeBusy" ? Effect.void : releaseOpenFile(ref)));
+    const finalizeFile = (ref) => TokenRegistry.finalize(ref, closeFile(ref, OpContext.make("close"), Effect.void), releaseOpenFile(ref));
+    const acquireHandle = TokenRegistry.acquire;
+    const bindFile = (ref, ino) => Effect.flatMap(Draft, (draft) => draft.afterInstall(() => TokenRegistry.publish(ref, ino)));
+    const replaceContent = Effect.fnUntraced(function* (file, data, now, publish = true) {
+        const d = yield* Draft;
+        yield* d.addUsedBytes(BigInt(data.length - file.data.length));
+        yield* d.put({
             ...file,
             data,
             metadata: {
@@ -737,8 +649,8 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             }
         });
         if (publish)
-            publishNode(file.ino);
-    };
+            yield* publishNode(file.ino);
+    });
     const resizeAt = Effect.fnUntraced(function* (file, length, now, op) {
         if (length > BigInt(maxFileBytes))
             return yield* op.fail("FileTooLarge");
@@ -746,22 +658,23 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         yield* reserveBytes(op, BigInt(size - file.data.length));
         const data = new Uint8Array(size);
         data.set(file.data.subarray(0, size));
-        replaceContent(file, data, now, false);
+        yield* replaceContent(file, data, now, false);
     });
     const resize = Effect.fnUntraced(function* (file, length, op) {
         if (!isLength(length))
             return yield* op.fail("InvalidArgument");
         yield* resizeAt(file, length, yield* timestamp(op), op);
-        publishNode(file.ino);
+        yield* publishNode(file.ino);
     });
     const fileHandle = (ref) => {
-        const get = (op, access) => {
-            const node = ref.ino === undefined ? undefined : view(ref.ino);
-            return node?.kind !== "file" || (access === "read" && ref.access === "write") ||
-                (access === "write" && ref.access === "read")
-                ? Effect.fail(op.fail("InvalidHandle"))
-                : Effect.succeed(node);
-        };
+        const get = Effect.fnUntraced(function* (op, access) {
+            const ino = TokenRegistry.inode(ref);
+            const node = ino === undefined ? undefined : yield* view(ino);
+            if (node?.kind !== "file" || (access === "read" && ref.access === "write") ||
+                (access === "write" && ref.access === "read"))
+                return yield* op.fail("InvalidHandle");
+            return node;
+        });
         const read = (maximum, position) => {
             const op = OpContext.make(position === undefined ? "read" : "pread");
             const readOp = OpContext.make("read");
@@ -783,9 +696,10 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             // other would start at the same offset.
             if (position !== undefined)
                 return Effect.map(accessing(op, body), ({ bytes, eof }) => ({ bytes, eof }));
-            return coordinated(op, Effect.map(body, (read) => {
-                const { bytes, eof, next } = refreshAccess(read);
-                current().after.push(() => {
+            return coordinated(op, Effect.gen(function* () {
+                const { bytes, eof, next } = yield* refreshAccess(yield* body);
+                const draft = yield* Draft;
+                yield* draft.afterInstall(() => {
                     ref.offset = next;
                 });
                 return { bytes, eof };
@@ -809,9 +723,10 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 if (offset >= BigInt(maxFileBytes))
                     return yield* writeOp.fail("FileTooLarge");
                 const start = Number(offset);
-                const free = settings.maxBytes === undefined
+                const draft = yield* Draft;
+                const free = limits.maxBytes === undefined
                     ? BigInt(maxFileBytes)
-                    : ByteSize.toBigInt(settings.maxBytes) - current().usedBytes;
+                    : ByteSize.toBigInt(limits.maxBytes) - (yield* draft.usedBytes);
                 const maximumEnd = BigInt(file.data.length) + free;
                 const end = Number(BigInt(maxFileBytes) < maximumEnd ? BigInt(maxFileBytes) : maximumEnd);
                 const count = Math.min(bytes.length, Math.max(0, end - start));
@@ -824,10 +739,10 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 data.set(file.data);
                 const now = yield* timestamp(writeOp);
                 data.set(bytes.subarray(0, count), start);
-                replaceContent(file, data, now);
+                yield* replaceContent(file, data, now);
                 if (position === undefined) {
                     const next = offset + BigInt(count);
-                    current().after.push(() => {
+                    yield* draft.afterInstall(() => {
                         ref.offset = next;
                     });
                 }
@@ -886,50 +801,44 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             sync: coordinatedRead(syncOp, Effect.suspend(() => Effect.asVoid(get(syncOp)))).pipe(Effect.withSpan("FileHandle.sync")),
             close: closeFile(ref, closeOp, Effect.suspend(() => get(closeOp))).pipe(Effect.ensuring(closeReleasedScope(ref)), Effect.withSpan("FileHandle.close"))
         });
-        files.set(handle, ref);
+        registry.registerFile(handle, ref);
         return handle;
     };
     const createCaller = (reference, identity, umask) => {
-        const referencedNode = Effect.fnUntraced(function* (target, op) {
-            if (reference.ino === undefined)
-                return yield* op.fail("ClosedCaller");
-            if (!Predicate.isObject(target))
-                return yield* op.fail("InvalidReference");
-            const known = objectReferences.get(target);
-            if (known === undefined)
-                return yield* op.fail("InvalidReference");
-            if (known.volume !== volumeIdentity) {
-                return yield* op.fail("ForeignReference");
-            }
-            const node = view(known.ino);
-            if (node === undefined || (node.kind === "directory" && node.metadata.nlink === 0)) {
-                return yield* op.fail("StaleReference");
-            }
-            return node;
+        const resolver = Resolution.make({
+            caller: reference,
+            get: view,
+            identity,
+            maxPathBytes: limits.maxPathBytes,
+            registry
         });
-        const callerDirectory = (op) => {
-            const node = reference.ino === undefined ? undefined : view(reference.ino);
-            return node?.kind === "directory" ? Effect.succeed(node) : Effect.fail(op.fail("ClosedCaller"));
-        };
-        const directoryNow = (ino) => {
-            const node = view(ino);
+        const prepare = resolver.prepare;
+        const prepareEntry = resolver.prepareEntry;
+        const entryName = Resolution.entryName;
+        const resolveTarget = (target, op, options) => resolver.resolve(target, { kind: "Node", ...options }, op);
+        const resolveDirectory = resolver.directory;
+        const resolveEntry = (prepared, op) => resolver.resolve(prepared, { kind: "Parent" }, op);
+        const referencedNode = (target, op) => Effect.map(resolveTarget(Target.Reference({ reference: target }), op), (resolved) => resolved.node);
+        const directoryNow = Effect.fnUntraced(function* (ino) {
+            const node = yield* view(ino);
             if (node?.kind !== "directory") {
                 return dieInvariant("Directory left the inode table during a transition");
             }
             return node;
-        };
-        const nodeNow = (ino) => {
-            const node = view(ino);
+        });
+        const nodeNow = Effect.fnUntraced(function* (ino) {
+            const node = yield* view(ino);
             if (node === undefined)
                 return dieInvariant("Inode left the table during a transition");
             return node;
-        };
+        });
         const creationTimes = (times, now) => ({
             atimeNs: times?.access.kind === "value" ? times.access.nanoseconds : now,
             mtimeNs: times?.modification.kind === "value" ? times.modification.nanoseconds : now
         });
-        const newDirectory = (parent, mode, now, times) => {
-            const ino = current().allocate();
+        const newDirectory = Effect.fnUntraced(function* (parent, mode, now, times) {
+            const draft = yield* Draft;
+            const ino = yield* draft.allocate;
             return {
                 kind: "directory",
                 ino,
@@ -942,9 +851,10 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 },
                 revision: 0n
             };
-        };
-        const newFile = (parent, data, mode, now, owner, times) => {
-            const ino = current().allocate();
+        });
+        const newFile = Effect.fnUntraced(function* (parent, data, mode, now, owner, times) {
+            const draft = yield* Draft;
+            const ino = yield* draft.allocate;
             return {
                 kind: "file",
                 ino,
@@ -959,9 +869,10 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 },
                 revision: 0n
             };
-        };
-        const newSymlink = (parent, target, now, times) => {
-            const ino = current().allocate();
+        });
+        const newSymlink = Effect.fnUntraced(function* (parent, target, now, times) {
+            const draft = yield* Draft;
+            const ino = yield* draft.allocate;
             return {
                 kind: "symlink",
                 ino,
@@ -976,142 +887,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 },
                 revision: 0n
             };
-        };
-        const lookup = Effect.fnUntraced(function* (path, base, op, options = {}, referencedBase) {
-            const pathOp = op.at(path.input);
-            const { allowMissing = false, createMissing, followFinalSymlink = true, parentOnly = false } = options;
-            if (reference.ino === undefined) {
-                return yield* pathOp.fail("ClosedCaller");
-            }
-            let current = path.absolute ? nodeNow(ROOT_INO) : yield* callerDirectory(pathOp);
-            if (!path.absolute && referencedBase !== undefined) {
-                current = referencedBase;
-                yield* authorize(current, identity, EXECUTE, op);
-            }
-            else if (!path.absolute && base !== undefined) {
-                const target = handles.get(base);
-                if (target === undefined) {
-                    return yield* pathOp.fail("InvalidHandle");
-                }
-                if (target.volume !== volumeIdentity) {
-                    return yield* pathOp.fail("ForeignHandle");
-                }
-                const directory = target.ino === undefined ? undefined : view(target.ino);
-                if (directory?.kind !== "directory") {
-                    return yield* pathOp.fail("InvalidHandle");
-                }
-                current = directory;
-                yield* authorize(current, identity, EXECUTE, pathOp);
-            }
-            if (current.metadata.nlink === 0) {
-                return yield* pathOp.fail("NotFound");
-            }
-            let work = path;
-            let parent;
-            let name;
-            let traversals = 0;
-            // Leading components that came from a symbolic link's target. Only the components the caller wrote are
-            // created, so a dangling link stays missing, as it does for mkdir -p.
-            let linked = 0;
-            for (let index = 0; index < work.components.length - (parentOnly ? 1 : 0); index++) {
-                if (current.kind !== "directory") {
-                    return yield* pathOp.fail("NotDirectory");
-                }
-                yield* authorize(current, identity, EXECUTE, pathOp);
-                const component = work.components[index];
-                if (component === undefined)
-                    break;
-                if (component === DOT_HEX)
-                    continue;
-                if (component === DOT_DOT_HEX) {
-                    current = directoryNow(current.parent);
-                    parent = undefined;
-                    name = undefined;
-                    continue;
-                }
-                parent = current;
-                name = component;
-                const childIno = current.entries.get(component);
-                const child = childIno === undefined ? undefined : view(childIno);
-                if (child === undefined) {
-                    if (allowMissing && index === work.components.length - 1) {
-                        return { node: undefined, parent, name };
-                    }
-                    if (createMissing !== undefined && index >= linked) {
-                        current = yield* createMissing(current, component, index === work.components.length - 1);
-                        continue;
-                    }
-                    return yield* pathOp.fail("NotFound");
-                }
-                if (child.kind === "symlink" && (followFinalSymlink || index < work.components.length - 1 || work.trailingSlash)) {
-                    if (child.target.length === 0) {
-                        return yield* pathOp.fail("NotFound");
-                    }
-                    if (++traversals > MAX_SYMLINK_TRAVERSALS) {
-                        return yield* pathOp.fail("SymlinkLoop");
-                    }
-                    const suffix = work.suffixes[index] ?? new Uint8Array(0);
-                    const remaining = work.components.length - index - 1;
-                    if (settings.maxPathBytes !== undefined &&
-                        ByteSize.isGreaterThan(ByteSize.bytes(child.target.length + suffix.length), settings.maxPathBytes)) {
-                        return yield* pathOp.fail("PathTooLong");
-                    }
-                    const expansion = new Uint8Array(child.target.length + suffix.length);
-                    expansion.set(child.target);
-                    expansion.set(suffix, child.target.length);
-                    const expanded = preparePath(ownedPath(expansion), op.operation, settings.maxPathBytes);
-                    // The expansion is synthetic: its per-component limits are the caller's to hear about,
-                    // but the path in the error has to be the one the caller passed in, so the
-                    // expansion's own failure is not kept as the cause.
-                    if (Result.isFailure(expanded)) {
-                        return yield* pathOp.fail(expanded.failure.code);
-                    }
-                    work = expanded.success;
-                    linked = work.components.length - remaining + Math.max(0, linked - index - 1);
-                    if (work.absolute)
-                        current = nodeNow(ROOT_INO);
-                    index = -1;
-                }
-                else
-                    current = child;
-            }
-            if (!parentOnly && work.trailingSlash && current.kind !== "directory") {
-                return yield* pathOp.fail("NotDirectory");
-            }
-            return { node: current, parent, name };
-        });
-        const resolveNode = Effect.fnUntraced(function* (path, base, op, options) {
-            const pathOp = op.at(path.input);
-            const result = yield* lookup(path, base, op, options);
-            if (result.node === undefined) {
-                return yield* pathOp.fail("NotFound");
-            }
-            return result.node;
         });
-        const locate = Effect.fnUntraced(function* (path, base, op, options) {
-            const pathOp = op.at(path.input);
-            const result = yield* lookup(path, base, op, options);
-            const node = result.node;
-            if (node === undefined) {
-                return yield* pathOp.fail("NotFound");
-            }
-            if (node.kind !== "directory") {
-                return yield* pathOp.fail("NotDirectory");
-            }
-            return node;
-        });
-        const ResolvedEntry = {
-            fromPath: Effect.fnUntraced(function* (path, base, op) {
-                const parent = yield* locate(path, base, op, { parentOnly: true });
-                return {
-                    parent: parent.ino,
-                    name: path.components.at(-1),
-                    trailingSlash: path.trailingSlash,
-                    addressing: "path",
-                    op: op.at(path.input)
-                };
-            })
-        };
         const grantedMode = (metadata, mode) => !identity.privileged && metadata.kind === "file" && !inGroup(identity, metadata.gid) ? mode & ~0o2000 : mode;
         const permittedMode = (metadata, mode, op) => !identity.privileged && identity.uid !== metadata.uid
             ? Effect.fail(op.fail("NotPermitted"))
@@ -1137,7 +913,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             const resolving = resolve();
             return coordinated(op, Effect.gen(function* () {
                 const resolved = yield* resolving;
-                const node = nodeNow(resolved.ino);
+                const node = yield* nodeNow(resolved.ino);
                 if (expected !== undefined && node.revision !== expected) {
                     return yield* resolved.op.fail("StaleReference", { field: "expected" });
                 }
@@ -1163,11 +939,11 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 const now = yield* timestamp(op);
                 if (size !== undefined && node.kind === "file")
                     yield* resizeAt(node, size, now, op);
-                const sized = nodeNow(resolved.ino);
+                const sized = yield* nodeNow(resolved.ino);
                 const gid = owner?.gid ?? sized.metadata.gid;
                 const cleared = chowned && sized.kind === "file" ? sized.metadata.mode & ~SET_ID_BITS : sized.metadata.mode;
                 if (chowned || mode !== undefined || timed) {
-                    current().put({
+                    yield* (yield* Draft).put({
                         ...sized,
                         metadata: {
                             ...sized.metadata,
@@ -1180,7 +956,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                         }
                     });
                 }
-                publishNode(node.ino);
+                yield* publishNode(node.ino);
             }));
         };
         const authorizeRemoval = (parent, child, op) => (parent.metadata.mode & STICKY_BIT) !== 0 && !identity.privileged &&
@@ -1188,7 +964,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             ? Effect.fail(op.fail("NotPermitted"))
             : Effect.void;
         const claimName = Effect.fnUntraced(function* (entry, trailingSlash = "allowed") {
-            const parent = directoryNow(entry.parent);
+            const parent = yield* directoryNow(entry.parent);
             if (isDotComponent(entry.name)) {
                 return yield* entry.op.fail(entry.addressing === "entry" ? "InvalidArgument" : "AlreadyExists");
             }
@@ -1203,17 +979,18 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         const makeDirectory = Effect.fnUntraced(function* (entry, request, op) {
             const name = yield* claimName(entry);
             yield* reserveEntry(entry.op);
-            const parent = directoryNow(entry.parent);
+            const parent = yield* directoryNow(entry.parent);
             const before = parent.revision;
             const now = yield* timestamp(op);
             const mode = request.exactMode
                 ? yield* permittedMode({ kind: "directory", uid: identity.uid, gid: parent.metadata.gid }, request.mode, op)
                 : (request.mode & 0o777 & ~umask) | (request.mode & STICKY_BIT);
-            const child = newDirectory(parent, mode, now, request.times);
-            attach(parent, name, child, now);
-            current().entries += 1;
-            publishEntry("Create", parent.ino, name, child.ino);
-            return { child: child.ino, directory: { before, after: current().revision } };
+            const child = yield* newDirectory(parent, mode, now, request.times);
+            yield* attach(parent, name, child, now);
+            const draft = yield* Draft;
+            yield* draft.addEntries(1);
+            yield* publishEntry("Create", parent.ino, name, child.ino);
+            return { child: child.ino, directory: { before, after: draft.revision } };
         });
         // Creates every missing directory a path names in the running transition, so a failure anywhere discards
         // them all. The mode applies to each directory created and the times to the one in the final position. An
@@ -1229,57 +1006,64 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 const made = yield* Effect.result(makeDirectory(entry, request, op));
                 if (Result.isSuccess(made))
                     return made.success;
-                const existingIno = entry.name === undefined ? undefined : directoryNow(entry.parent).entries.get(entry.name);
-                node = existingIno === undefined ? undefined : view(existingIno);
+                const existingIno = entry.name === undefined
+                    ? undefined
+                    : (yield* directoryNow(entry.parent)).entries.get(entry.name);
+                node = existingIno === undefined ? undefined : (yield* view(existingIno));
                 if (made.failure.code !== "AlreadyExists" || node?.kind !== "directory")
                     return yield* made.failure;
             }
             else {
                 entryOp = op.at(prepared.path.input);
-                const resolved = yield* lookup(prepared.path, prepared.base, op, {
-                    createMissing: (parent, name, final) => Effect.map(makeDirectory({ parent: parent.ino, name, trailingSlash: false, addressing: "path", op: entryOp }, final ? request : { mode: request.mode, exactMode: request.exactMode }, op), (made) => {
+                const resolved = yield* resolver.resolve(Target.Path(prepared.base === undefined
+                    ? { path: prepared.path.input }
+                    : { path: prepared.path.input, relativeTo: prepared.base }), {
+                    kind: "Node",
+                    createMissing: (parent, name, final) => Effect.flatMap(makeDirectory({ parent: parent.ino, name, trailingSlash: false, addressing: "path", op: entryOp }, final ? request : { mode: request.mode, exactMode: request.exactMode }, op), (made) => {
                         if (!revisionsBefore.has(parent.ino))
                             revisionsBefore.set(parent.ino, made.directory.before);
                         return directoryNow(made.child);
                     })
-                });
+                }, op);
                 node = resolved.node;
             }
             if (node?.kind !== "directory")
                 return yield* entryOp.fail("AlreadyExists");
-            const after = directoryNow(node.parent).revision;
+            const after = (yield* directoryNow(node.parent)).revision;
             return { child: node.ino, directory: { before: revisionsBefore.get(node.parent) ?? after, after } };
         });
         const linkNode = Effect.fnUntraced(function* (node, entry, op) {
             const name = yield* claimName(entry, "rejected");
             yield* reserveEntry(entry.op);
-            const parent = directoryNow(entry.parent);
+            const parent = yield* directoryNow(entry.parent);
             const before = parent.revision;
             const now = yield* timestamp(op);
-            attach(parent, name, node, now);
-            current().entries += 1;
-            publishEntry("Create", parent.ino, name, node.ino);
-            return { before, after: current().revision };
+            yield* attach(parent, name, node, now);
+            const draft = yield* Draft;
+            yield* draft.addEntries(1);
+            yield* publishEntry("Create", parent.ino, name, node.ino);
+            return { before, after: draft.revision };
         });
         const makeSymlink = Effect.fnUntraced(function* (entry, target, times, op) {
             const name = yield* claimName(entry, "rejected");
             yield* reserveEntry(entry.op);
             yield* reserveBytes(entry.op, BigInt(target.length));
-            const parent = directoryNow(entry.parent);
+            const parent = yield* directoryNow(entry.parent);
             const before = parent.revision;
             const now = yield* timestamp(op);
-            const child = newSymlink(parent, target, now, times);
-            attach(parent, name, child, now);
-            current().entries += 1;
-            current().usedBytes += BigInt(target.length);
-            publishEntry("Create", parent.ino, name, child.ino);
-            return { child: child.ino, directory: { before, after: current().revision } };
+            const child = yield* newSymlink(parent, target, now, times);
+            yield* attach(parent, name, child, now);
+            const draft = yield* Draft;
+            yield* draft.addEntries(1);
+            yield* draft.addUsedBytes(BigInt(target.length));
+            yield* publishEntry("Create", parent.ino, name, child.ino);
+            return { child: child.ino, directory: { before, after: draft.revision } };
         });
         const removeChild = Effect.fnUntraced(function* (parent, name, child, op) {
             const before = parent.revision;
             const now = yield* timestamp(op);
-            const d = current();
-            d.put(withEntries({
+            const d = yield* Draft;
+            yield* d.put(withEntries({
                 ...parent,
                 metadata: {
                     ...parent.metadata,
@@ -1288,22 +1072,22 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                     ctimeNs: now
                 }
             }, (entries) => entries.delete(name)));
-            publishEntry("Remove", parent.ino, name, child.ino);
-            detach(child, parent.ino, name, now);
-            d.entries -= 1;
+            yield* publishEntry("Remove", parent.ino, name, child.ino);
+            yield* detach(child, parent.ino, name, now);
+            yield* d.addEntries(-1);
             return { before, after: d.revision };
         });
         // Authorizes removing from the entry's directory and returns the named child. Only a path can name a dot
         // entry, and each verb reports it with its own code. Search permission comes before the lookup and write
         // permission after it, as on Linux; `beforeWrite` holds the verb's own checks that Linux makes in between.
         const removalTarget = Effect.fnUntraced(function* (entry, dotNameCode, beforeWrite) {
-            const parent = directoryNow(entry.parent);
+            const parent = yield* directoryNow(entry.parent);
             if (isDotComponent(entry.name)) {
                 return yield* entry.op.fail(entry.addressing === "entry" ? "InvalidArgument" : dotNameCode);
             }
             yield* authorize(parent, identity, EXECUTE, entry.op);
             const childIno = parent.entries.get(entry.name);
-            const child = childIno === undefined ? undefined : view(childIno);
+            const child = childIno === undefined ? undefined : (yield* view(childIno));
             if (child === undefined)
                 return yield* entry.op.fail("NotFound");
             const rejected = beforeWrite?.(child);
@@ -1338,8 +1122,8 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             return yield* removeChild(parent, name, child, op);
         });
         const renameEntry = Effect.fnUntraced(function* (source, destination, op) {
-            const sourceDirectory = directoryNow(source.parent);
-            const destinationDirectory = directoryNow(destination.parent);
+            const sourceDirectory = yield* directoryNow(source.parent);
+            const destinationDirectory = yield* directoryNow(destination.parent);
             const sameDirectory = source.parent === destination.parent;
             const sourceName = source.name;
             const destinationName = destination.name;
@@ -1353,11 +1137,11 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             const sourceBefore = sourceDirectory.revision;
             const destinationBefore = destinationDirectory.revision;
             const childIno = sourceDirectory.entries.get(sourceName);
-            const child = childIno === undefined ? undefined : view(childIno);
+            const child = childIno === undefined ? undefined : (yield* view(childIno));
             if (child === undefined)
                 return yield* source.op.fail("NotFound");
             const replacedIno = destinationDirectory.entries.get(destinationName);
-            const replaced = replacedIno === undefined ? undefined : view(replacedIno);
+            const replaced = replacedIno === undefined ? undefined : (yield* view(replacedIno));
             // A trailing slash on either side asks for a directory; a missing slashed destination is fine when the
             // source is one, as Linux allows.
             if ((source.trailingSlash || destination.trailingSlash) && child.kind !== "directory") {
@@ -1366,24 +1150,29 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             if (destination.trailingSlash && replaced !== undefined && replaced.kind !== "directory") {
                 return yield* destination.op.fail("NotDirectory");
             }
-            const result = () => sameDirectory
-                ? {
-                    _tag: "SameDirectory",
-                    directory: { before: sourceBefore, after: directoryNow(source.parent).revision }
-                }
-                : {
-                    _tag: "DifferentDirectories",
-                    sourceDirectory: { before: sourceBefore, after: directoryNow(source.parent).revision },
-                    destinationDirectory: { before: destinationBefore, after: directoryNow(destination.parent).revision }
-                };
-            for (let ancestor = destinationDirectory;; ancestor = directoryNow(ancestor.parent)) {
+            const result = Effect.fnUntraced(function* () {
+                return sameDirectory
+                    ? {
+                        _tag: "SameDirectory",
+                        directory: { before: sourceBefore, after: (yield* directoryNow(source.parent)).revision }
+                    }
+                    : {
+                        _tag: "DifferentDirectories",
+                        sourceDirectory: { before: sourceBefore, after: (yield* directoryNow(source.parent)).revision },
+                        destinationDirectory: {
+                            before: destinationBefore,
+                            after: (yield* directoryNow(destination.parent)).revision
+                        }
+                    };
+            });
+            for (let ancestor = destinationDirectory;; ancestor = yield* directoryNow(ancestor.parent)) {
                 if (ancestor.ino === child.ino)
                     return yield* destination.op.fail("InvalidArgument");
                 if (ancestor.ino === ROOT_INO)
                     break;
             }
             if (child.ino === replaced?.ino)
-                return result();
+                return yield* result();
             yield* authorize(sourceDirectory, identity, WRITE, source.op);
             yield* authorize(destinationDirectory, identity, WRITE, destination.op);
             yield* authorizeRemoval(sourceDirectory, child, source.op);
@@ -1400,9 +1189,9 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 }
             }
             const now = yield* timestamp(op);
-            const d = current();
-            publishEntry("Remove", sourceDirectory.ino, sourceName, child.ino);
-            d.put(withEntries({
+            const d = yield* Draft;
+            yield* publishEntry("Remove", sourceDirectory.ino, sourceName, child.ino);
+            yield* d.put(withEntries({
                 ...sourceDirectory,
                 metadata: {
                     ...sourceDirectory.metadata,
@@ -1411,8 +1200,8 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                     ctimeNs: now
                 }
             }, (entries) => entries.delete(sourceName)));
-            const destinationNow = directoryNow(destination.parent);
-            d.put(withEntries({
+            const destinationNow = yield* directoryNow(destination.parent);
+            yield* d.put(withEntries({
                 ...destinationNow,
                 metadata: {
                     ...destinationNow.metadata,
@@ -1421,9 +1210,9 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                     ctimeNs: now
                 }
             }, (entries) => entries.set(destinationName, child.ino)));
-            const moved = nodeNow(child.ino);
+            const moved = yield* nodeNow(child.ino);
             if (moved.kind === "directory") {
-                d.put({
+                yield* d.put({
                     ...moved,
                     parent: destination.parent,
                     name: destinationName,
@@ -1431,7 +1220,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 });
             }
             else {
-                d.put({
+                yield* d.put({
                     ...moved,
                     links: [
                         ...withoutLink(moved.links, source.parent, sourceName),
@@ -1441,11 +1230,11 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 });
             }
             if (replaced !== undefined) {
-                detach(nodeNow(replaced.ino), destination.parent, destinationName, now);
-                d.entries -= 1;
+                yield* detach(yield* nodeNow(replaced.ino), destination.parent, destinationName, now);
+                yield* d.addEntries(-1);
             }
-            publishEntry("Create", destination.parent, destinationName, child.ino);
-            return result();
+            yield* publishEntry("Create", destination.parent, destinationName, child.ino);
+            return yield* result();
         });
         const openExisting = Effect.fnUntraced(function* (file, request, at, op) {
             yield* authorize(file, identity, request.access === "read" ? READ : request.access === "write" ? WRITE : READ | WRITE, at);
@@ -1454,7 +1243,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         });
         const openFile = Effect.fnUntraced(function* (entry, found, request, acquired, op) {
             const { name } = entry;
-            const parent = directoryNow(entry.parent);
+            const parent = yield* directoryNow(entry.parent);
             const before = parent.revision;
             let file = found;
             let created = false;
@@ -1481,12 +1270,13 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 const mode = request.exactMode
                     ? yield* permittedMode({ kind: "file", uid: owner?.uid ?? identity.uid, gid: owner?.gid ?? parent.metadata.gid }, request.mode, op)
                     : (request.mode ?? 0o666) & 0o777 & ~umask;
-                file = newFile(parent, new Uint8Array(Number(size)), mode, now, owner, request.times);
-                attach(parent, name, file, now);
-                current().entries += 1;
-                current().usedBytes += size;
+                file = yield* newFile(parent, new Uint8Array(Number(size)), mode, now, owner, request.times);
+                yield* attach(parent, name, file, now);
+                const draft = yield* Draft;
+                yield* draft.addEntries(1);
+                yield* draft.addUsedBytes(size);
                 created = true;
-                publishEntry("Create", parent.ino, name, file.ino);
+                yield* publishEntry("Create", parent.ino, name, file.ino);
             }
             else {
                 if (file.kind === "symlink")
@@ -1495,92 +1285,23 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                     return yield* entry.op.fail("IsDirectory");
                 yield* openExisting(file, request, entry.op, op);
             }
-            current().retain(file.ino);
-            bindFile(acquired, file.ino);
-            return { ino: file.ino, created, directory: { before, after: directoryNow(entry.parent).revision } };
+            yield* (yield* Draft).retain(file.ino);
+            yield* bindFile(acquired, file.ino);
+            return { ino: file.ino, created, directory: { before, after: (yield* directoryNow(entry.parent)).revision } };
         });
-        const releasePending = (opened) => () => {
+        const releasePending = (opened) => () => Effect.gen(function* () {
             const ino = opened();
             if (ino === undefined)
                 return;
-            current().release(ino);
-            reclaim(current(), ino);
-        };
+            yield* releaseFileInode(ino);
+        });
         const acquireOpenedFile = (ref, op, acquire) => {
             let opened;
             return acquireHandle(ref, (effect) => coordinated(op, effect), acquire((ino) => {
                 opened = ino;
             }), releasePending(() => opened), finalizeFile(ref));
         };
-        const prepare = (input, op) => preparePath(input, op.operation, settings.maxPathBytes);
-        const handleNode = Effect.fnUntraced(function* (handle, op) {
-            if (reference.ino === undefined)
-                return yield* op.fail("ClosedCaller");
-            const ref = isFileHandle(handle) ? files.get(handle) : handles.get(handle);
-            if (ref === undefined)
-                return yield* op.fail("InvalidHandle");
-            if (ref.volume !== volumeIdentity)
-                return yield* op.fail("ForeignHandle");
-            const node = ref.ino === undefined ? undefined : view(ref.ino);
-            if (node === undefined)
-                return yield* op.fail("InvalidHandle");
-            return node;
-        });
-        // A path prepares before the walk, so a malformed input fails before any lookup, and names the path on
-        // every failure. A reference or handle names none. The verb's `followFinalSymlink` is the default a
-        // path's own setting overrides; `final` makes the verb's setting win, for a verb such as `readLink` whose
-        // meaning fixes it.
-        const resolveTarget = (target, op, options) => Target.$match(target, {
-            Path: ({ followFinalSymlink, path, relativeTo }) => Effect.flatMap(Effect.fromResult(prepare(path, op)), (prepared) => Effect.map(resolveNode(prepared, relativeTo, op, {
-                followFinalSymlink: options?.final === true
-                    ? options.followFinalSymlink ?? true
-                    : followFinalSymlink ?? options?.followFinalSymlink ?? true
-            }), (node) => ({ node, op: op.at(path) }))),
-            Reference: ({ reference }) => Effect.map(referencedNode(reference, op), (node) => ({ node, op })),
-            Handle: ({ handle }) => Effect.map(handleNode(handle, op), (node) => ({ node, op }))
-        });
-        const resolveDirectory = Effect.fnUntraced(function* (target, op) {
-            const resolved = yield* resolveTarget(target, op);
-            if (resolved.node.kind !== "directory")
-                return yield* resolved.op.fail("NotDirectory");
-            return { node: resolved.node, op: resolved.op };
-        });
-        // The directory an entry names a child of. A removed directory that a handle still holds takes no new
-        // children, as on Linux, where creating through a descriptor of a removed directory fails with ENOENT.
-        const entryDirectory = Effect.fnUntraced(function* (target, op) {
-            const directory = yield* resolveDirectory(target, op);
-            if (directory.node.metadata.nlink === 0)
-                return yield* directory.op.fail("NotFound");
-            return directory;
-        });
         const asResolvedNode = (target, op, options) => Effect.map(resolveTarget(target, op, options), (resolved) => ({ ino: resolved.node.ino, op: resolved.op }));
-        const entryName = (input, op) => {
-            if (Predicate.isString(input) && !isWellFormed(input))
-                return Result.fail(op.fail("InvalidPathEncoding"));
-            const bytes = Predicate.isString(input) ? encoder.encode(input) : input;
-            if (!isAttachedBytes(bytes) || bytes.length === 0 || bytes.length > MAX_NAME_BYTES || bytes.includes(0) ||
-                bytes.includes(SLASH_BYTE))
-                return Result.fail(op.fail("InvalidArgument"));
-            return Result.succeed(Encoding.encodeHex(new Uint8Array(bytes)));
-        };
-        const prepareEntry = (input, op) => isEntry(input)
-            ? Result.map(entryName(input.name, op), (name) => ({ kind: "entry", directory: input.directory, name }))
-            : isTarget(input)
-                ? Result.map(prepare(input.path, op), (path) => ({ kind: "path", path, base: input.relativeTo }))
-                : Result.map(prepare(input, op), (path) => ({ kind: "path", path, base: undefined }));
-        const resolveEntry = Effect.fnUntraced(function* (prepared, op) {
-            if (prepared.kind === "path") {
-                return yield* ResolvedEntry.fromPath(prepared.path, prepared.base, op);
-            }
-            const directory = yield* entryDirectory(prepared.directory, op);
-            return {
-                parent: directory.node.ino,
-                name: prepared.name,
-                trailingSlash: false,
-                addressing: "entry",
-                op
-            };
-        });
         const asTarget = (input) => Target.of(input);
         const acquireDirectory = Effect.fnUntraced(function* (input, op) {
             const target = asTarget(input);
@@ -1589,12 +1310,12 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 const directory = yield* resolveDirectory(target, op);
                 yield* authorize(directory.node, identity, EXECUTE, directory.op);
                 holdDirectory(directory.node.ino);
-                acquired.ino = directory.node.ino;
+                TokenRegistry.publish(acquired, directory.node.ino);
                 return acquired;
             }), 
             // Nothing to undo here: the finalizer that follows an interrupted acquisition releases the hold under
             // every permit, where a detached directory may leave the table.
-            () => { }, finalizeDirectory(acquired));
+            () => Effect.void, finalizeDirectory(acquired));
         });
         const fail = (op, cause, field) => op.fail("InvalidArgument", field === undefined ? { cause } : { cause, field });
         const preparedOp = (prepared, op) => prepared.kind === "path" ? op.at(prepared.path.input) : op;
@@ -1612,29 +1333,16 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             const follow = target.followFinalSymlink ?? true;
             return yield* acquireOpenedFile(acquired, op, (opened) => Effect.gen(function* () {
                 const path = yield* Effect.fromResult(prepared);
-                if (chosen.create === "exclusive") {
-                    const existing = yield* Effect.result(lookup(path, target.relativeTo, op, { followFinalSymlink: false }));
-                    if (Result.isSuccess(existing))
-                        return yield* pathOp.fail("AlreadyExists");
-                    if (existing.failure.code !== "NotFound")
-                        return yield* existing.failure;
-                }
-                const resolved = yield* lookup(path, target.relativeTo, op, {
-                    followFinalSymlink: follow,
-                    allowMissing: chosen.create === "ifMissing" || chosen.create === "exclusive"
-                });
-                const parent = resolved.parent;
-                if (parent === undefined)
-                    return yield* pathOp.fail("IsDirectory");
-                const name = resolved.name;
-                if (isDotComponent(name))
-                    return yield* pathOp.fail("IsDirectory");
-                if (resolved.node === undefined && path.trailingSlash)
+                const resolved = yield* resolver.resolve({ kind: "path", path, base: target.relativeTo }, {
+                    kind: "OrCreate",
+                    create: chosen.create ?? "never",
+                    finalSymlink: follow ? "follow" : "preserve"
+                }, op);
+                const { parent, name } = resolved;
+                if (resolved.kind === "missing" && path.trailingSlash)
                     return yield* pathOp.fail("IsDirectory");
                 yield* authorize(parent, identity, EXECUTE, pathOp);
-                const file = resolved.node;
-                if (file !== undefined && chosen.create === "exclusive")
-                    return yield* pathOp.fail("AlreadyExists");
+                const file = resolved.kind === "existing" ? resolved.node : undefined;
                 const result = yield* openFile({ parent: parent.ino, name, trailingSlash: path.trailingSlash, addressing: "path", op: pathOp }, file, chosen, acquired, op);
                 opened(result.ino);
                 return fileHandle(acquired);
@@ -1656,8 +1364,9 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 if (node.metadata.nlink === 0)
                     return yield* resolved.op.fail("StaleReference");
                 yield* openExisting(node, chosen, resolved.op, op);
-                current().retain(node.ino);
-                bindFile(acquired, node.ino);
+                const draft = yield* Draft;
+                yield* draft.retain(node.ino);
+                yield* bindFile(acquired, node.ino);
                 opened(node.ino);
                 return fileHandle(acquired);
             }));
@@ -1675,60 +1384,44 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             }
             if (chosen.exactMode && chosen.mode === undefined)
                 return yield* op.fail("InvalidArgument");
-            const relativePath = preparePath(ownedPath(nameBytes(name)), op.operation, undefined);
             const acquired = makeFileReference(chosen.access, chosen.append ?? false);
             const expected = chosen.expected;
             return yield* acquireOpenedFile(acquired, op, (opened) => Effect.gen(function* () {
-                const parent = (yield* entryDirectory(entry.directory, op)).node;
-                if (isDotComponent(name))
-                    return yield* op.fail("InvalidArgument");
-                yield* authorize(parent, identity, EXECUTE, op);
-                const directIno = parent.entries.get(name);
-                const direct = directIno === undefined ? undefined : view(directIno);
-                if (expected !== undefined) {
-                    let expectedIno;
-                    if (expected !== null) {
-                        const observed = yield* Effect.result(referencedNode(expected, op));
-                        if (Result.isFailure(observed)) {
-                            return yield* op.fail("VolumeBusy", { cause: observed.failure });
+                const resolved = yield* resolver.resolve({ kind: "entry", directory: entry.directory, name }, {
+                    kind: "OrCreate",
+                    create: chosen.create ?? "never",
+                    finalSymlink: chosen.followFinalSymlink !== false ? "follow" : "preserve",
+                    beforeFollow: Effect.fnUntraced(function* (_, direct) {
+                        if (expected !== undefined) {
+                            let expectedIno;
+                            if (expected !== null) {
+                                const observed = yield* Effect.result(referencedNode(expected, op));
+                                if (Result.isFailure(observed)) {
+                                    return yield* op.fail("VolumeBusy", { cause: observed.failure });
+                                }
+                                expectedIno = observed.success.ino;
+                            }
+                            if (direct?.ino !== expectedIno)
+                                return yield* op.fail("VolumeBusy");
                         }
-                        expectedIno = observed.success.ino;
-                    }
-                    if (direct?.ino !== expectedIno)
-                        return yield* op.fail("VolumeBusy");
-                }
-                if (chosen.expectedChild === null) {
-                    if (direct !== undefined)
-                        return yield* op.fail("StaleReference");
-                }
-                else if (chosen.expectedChild !== undefined) {
-                    const expectedChild = chosen.expectedChild;
-                    const observed = yield* referencedNode(expectedChild.reference, op);
-                    if (direct?.ino !== observed.ino || observed.revision !== expectedChild.revision ||
-                        observed.metadata.atimeNs !== expectedChild.atimeNs ||
-                        observed.metadata.mtimeNs !== expectedChild.mtimeNs) {
-                        return yield* op.fail("StaleReference");
-                    }
-                }
-                if (direct !== undefined && chosen.create === "exclusive")
-                    return yield* op.fail("AlreadyExists");
-                let file = direct;
-                let mutationParent = parent.ino;
-                let mutationName = name;
-                if (file?.kind === "symlink" && chosen.followFinalSymlink !== false) {
-                    const resolved = yield* lookup(yield* Effect.fromResult(relativePath), undefined, op, {
-                        followFinalSymlink: true,
-                        allowMissing: chosen.create === "ifMissing" || chosen.create === "exclusive"
-                    }, parent);
-                    file = resolved.node;
-                    if (file === undefined) {
-                        if (resolved.parent === undefined || resolved.name === undefined) {
-                            return yield* op.fail("IsDirectory");
+                        if (chosen.expectedChild === null) {
+                            if (direct !== undefined)
+                                return yield* op.fail("StaleReference");
                         }
-                        mutationParent = resolved.parent.ino;
-                        mutationName = resolved.name;
-                    }
-                }
+                        else if (chosen.expectedChild !== undefined) {
+                            const expectedChild = chosen.expectedChild;
+                            const observed = yield* referencedNode(expectedChild.reference, op);
+                            if (direct?.ino !== observed.ino || observed.revision !== expectedChild.revision ||
+                                observed.metadata.atimeNs !== expectedChild.atimeNs ||
+                                observed.metadata.mtimeNs !== expectedChild.mtimeNs) {
+                                return yield* op.fail("StaleReference");
+                            }
+                        }
+                    })
+                }, op);
+                const file = resolved.kind === "existing" ? resolved.node : undefined;
+                const mutationParent = resolved.kind === "missing" ? resolved.parent.ino : resolved.origin.parent.ino;
+                const mutationName = resolved.kind === "missing" ? resolved.name : resolved.origin.name;
                 const result = yield* openFile({ parent: mutationParent, name: mutationName, trailingSlash: false, addressing: "entry", op }, file, { ...chosen, initialSize: chosen.initialSize ?? 0n }, acquired, op);
                 opened(result.ino);
                 return {
@@ -1739,29 +1432,31 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 };
             }));
         });
-        const walkChildren = (directory, path, depth, up) => {
+        const walkChildren = Effect.fnUntraced(function* (directory, path, depth, up) {
             const listed = referenceFor(directory.ino);
-            return Arr.flatMap(Arr.sort(directory.entries, byEntryName), ([name, childIno]) => {
-                const child = view(childIno);
+            const frames = [];
+            for (const [name, childIno] of Arr.sort(directory.entries, byEntryName)) {
+                const child = yield* view(childIno);
                 if (child === undefined)
-                    return [];
+                    continue;
                 const bytes = nameBytes(name);
-                return [{
-                        ino: child.ino,
-                        kind: child.kind,
-                        name: bytes,
-                        key: name,
-                        path: joinPath(path, bytes),
-                        parent: directory.ino,
-                        up,
-                        depth: depth + 1,
-                        bytes: child.kind === "directory" ? 0n : child.metadata.size,
-                        reference: referenceFor(child.ino),
-                        directory: listed,
-                        listed: false
-                    }];
-            });
-        };
+                frames.push({
+                    ino: child.ino,
+                    kind: child.kind,
+                    name: bytes,
+                    key: name,
+                    path: joinPath(path, bytes),
+                    parent: directory.ino,
+                    up,
+                    depth: depth + 1,
+                    bytes: child.kind === "directory" ? 0n : child.metadata.size,
+                    reference: referenceFor(child.ino),
+                    directory: listed,
+                    listed: false
+                });
+            }
+            return frames;
+        });
         const anchorFrame = (parent, key, root) => ({
             ino: root.ino,
             kind: root.kind,
@@ -1782,13 +1477,12 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             const prepared = prepare(target.path, op);
             if (Result.isFailure(prepared))
                 return Effect.undefined;
-            return ResolvedEntry.fromPath(prepared.success, target.relativeTo, op).pipe(Effect.map((entry) => {
-                const parent = view(entry.parent);
+            return resolveEntry({ kind: "path", path: prepared.success, base: target.relativeTo }, op).pipe(Effect.flatMap((entry) => Effect.map(view(entry.parent), (parent) => {
                 return entry.name !== undefined && parent?.kind === "directory" &&
                     parent.entries.get(entry.name) === root.ino
                     ? anchorFrame(parent, entry.name, root)
                     : undefined;
-            }), Effect.catch(() => Effect.undefined));
+            })), Effect.catch(() => Effect.undefined));
         };
         const holds = (parent, frame) => parent?.kind === "directory" && parent.metadata.nlink > 0 && parent.entries.get(frame.key) === frame.ino;
         // The node a frame names, reached by name from the walk's root as a path lookup reaches it: every directory on
@@ -1801,13 +1495,13 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             const chain = [];
             for (let link = frame; link !== undefined; link = link.up)
                 chain.push(link);
-            let node = view((chain.at(-1) ?? frame).parent);
+            let node = yield* view((chain.at(-1) ?? frame).parent);
             for (let index = chain.length - 1; index >= 0; index--) {
                 const link = chain[index];
                 if (link === undefined || node?.kind !== "directory" || node.metadata.nlink === 0)
                     return undefined;
                 yield* authorize(node, identity, EXECUTE, at);
-                node = node.entries.get(link.key) === link.ino ? view(link.ino) : undefined;
+                node = node.entries.get(link.key) === link.ino ? (yield* view(link.ino)) : undefined;
             }
             return node;
         });
@@ -1823,27 +1517,23 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             let bytes = 0n;
             let failure;
             const list = (frame) => coordinatedRead(op, Effect.suspend(() => {
-                if (reference.ino === undefined)
+                if (TokenRegistry.inode(reference) === undefined)
                     return Effect.fail(op.fail("ClosedCaller"));
                 const at = op.at(locate(frame.path));
                 return Effect.flatMap(reachFrame(frame, at), (node) => node?.kind !== "directory" || node.metadata.nlink === 0
                     ? Effect.succeed([])
-                    : Effect.as(listable(node, at), walkChildren(node, frame.path, frame.depth, frame)));
+                    : Effect.andThen(listable(node, at), walkChildren(node, frame.path, frame.depth, frame)));
             }));
-            const exceeded = (frame, field) => makeError({ code: "LimitExceeded", operation: op.operation, field, path: errorPath(locate(frame.path)) });
             const admit = (frame) => {
-                if (plan.maxDepth !== undefined && frame.depth > plan.maxDepth)
-                    return exceeded(frame, "maxDepth");
-                if (plan.maxEntries !== undefined && ++entries > plan.maxEntries)
-                    return exceeded(frame, "maxEntries");
+                entries++;
                 bytes += frame.bytes;
-                if (plan.maxBytes !== undefined && bytes > plan.maxBytes)
-                    return exceeded(frame, "maxBytes");
-                return undefined;
+                return plan.limit(frame, { entries, bytes }, "entry");
             };
             const step = Effect.gen(function* () {
+                // Preserve the generic limit error E; yielding the error directly widens it to WalkFailure.
+                // oxlint-disable-next-line effecttsgo/unnecessary-fail-yieldable-error -- E must stay narrow for unbounded removal.
                 if (failure !== undefined)
-                    return yield* failure;
+                    return yield* Effect.fail(failure);
                 if (pending === undefined)
                     pending = (yield* first).reverse();
                 const out = [];
@@ -1865,9 +1555,9 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                         out.push(frame);
                     }
                     if (unlisted) {
-                        if (plan.maxDepth !== undefined && frame.depth > plan.maxDepth) {
-                            return yield* stop(exceeded(frame, "maxDepth"));
-                        }
+                        const rejected = plan.limit(frame, { entries, bytes }, "directory");
+                        if (rejected !== undefined)
+                            return yield* stop(rejected);
                         const listed = yield* Effect.result(list(frame));
                         if (Result.isFailure(listed))
                             return yield* stop(listed.failure);
@@ -1900,10 +1590,10 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             let targetAt = preparedOp(prepared, op);
             const first = coordinatedRead(op, Effect.gen(function* () {
                 const entry = yield* resolveEntry(prepared, op);
-                const parent = directoryNow(entry.parent);
+                const parent = yield* directoryNow(entry.parent);
                 yield* authorize(parent, identity, EXECUTE, entry.op);
                 const childIno = entry.name === undefined ? undefined : parent.entries.get(entry.name);
-                const child = childIno === undefined ? undefined : view(childIno);
+                const child = childIno === undefined ? undefined : (yield* view(childIno));
                 if (entry.name === undefined || child === undefined)
                     return yield* entry.op.fail("NotFound");
                 if (child.kind !== "directory")
@@ -1911,16 +1601,16 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 yield* listable(child, entry.op);
                 anchor = anchorFrame(parent, entry.name, child);
                 targetAt = entry.op;
-                return walkChildren(child, new Uint8Array(0), 0, anchor);
+                return yield* walkChildren(child, new Uint8Array(0), 0, anchor);
             })).pipe(Effect.catchIf((error) => force && error.code === "NotFound", () => Effect.succeed([])));
             const seams = yield* VolumeTestSeams;
             const removeFrame = (frame) => {
                 const at = op.at(locate(frame.path));
-                return Effect.andThen(seams.beforeTreeRemoval, coordinated(op, Effect.suspend(() => {
-                    if (anchor !== undefined && !holds(view(anchor.parent), anchor)) {
-                        return force ? Effect.void : Effect.fail(targetAt.fail("NotFound"));
+                return Effect.andThen(seams.beforeTreeRemoval, coordinated(op, Effect.gen(function* () {
+                    if (anchor !== undefined && !holds(yield* view(anchor.parent), anchor)) {
+                        return yield* (force ? Effect.void : Effect.fail(targetAt.fail("NotFound")));
                     }
-                    return Effect.flatMap(frame.up === undefined ? Effect.succeed(view(frame.parent)) : reachFrame(frame.up, at), (parent) => !holds(parent, frame)
+                    return yield* Effect.flatMap(frame.up === undefined ? view(frame.parent) : reachFrame(frame.up, at), (parent) => !holds(parent, frame)
                         ? Effect.fail(at.fail("NotFound"))
                         : removeEntry({
                             parent: parent.ino,
@@ -1931,7 +1621,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                         }, op));
                 })));
             };
-            const plan = { order: "post", maxDepth: undefined, maxEntries: undefined, maxBytes: undefined };
+            const plan = { order: "post", limit: () => undefined };
             return yield* Stream.runForEach(walkFrames(op, first, plan, locate, listable), removeFrame);
         });
         const rootOp = OpContext.make("root");
@@ -1940,9 +1630,40 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             const prepared = yield* Effect.fromResult(prepareEntry(input, op));
             return yield* coordinated(op, Effect.flatMap(resolveEntry(prepared, op), (entry) => body(entry, op)));
         });
+        const openDispatch = Effect.fn("Caller.open")(function* (input, options) {
+            const op = OpContext.make("open");
+            if (isEntry(input))
+                return yield* openEntry(input, options, op);
+            const target = asTarget(input);
+            if (Target.$is("Path")(target))
+                return yield* openPath(target, options, op);
+            return yield* openNode(target, options, op);
+        });
+        function open(input, options) {
+            return openDispatch(input, options);
+        }
+        const removeDispatch = Effect.fn("Caller.remove")(function* (input, options) {
+            const op = OpContext.make("remove");
+            const prepared = yield* Effect.fromResult(prepareEntry(input, op));
+            const chosen = yield* decodeRemoveOptions(options ?? {}).pipe(Effect.mapError((cause) => fail(preparedOp(prepared, op), cause)));
+            const once = coordinated(op, Effect.flatMap(resolveEntry(prepared, op), (entry) => removeEntry(entry, op)));
+            const target = (effect) => chosen.force === true
+                ? Effect.catchIf(effect, (error) => error.code === "NotFound", () => Effect.undefined)
+                : effect;
+            const removed = yield* Effect.result(target(once));
+            if (Result.isSuccess(removed))
+                return removed.success;
+            if (chosen.recursive !== true || removed.failure.code !== "NotEmpty")
+                return yield* removed.failure;
+            yield* emptyDirectory(prepared, op, chosen.force === true);
+            return yield* target(once);
+        });
+        function remove(input, options) {
+            return removeDispatch(input, options);
+        }
         const caller = Object.freeze({
             [CallerId]: true,
-            root: coordinatedRead(rootOp, Effect.suspend(() => reference.ino === undefined
+            root: coordinatedRead(rootOp, Effect.suspend(() => TokenRegistry.inode(reference) === undefined
                 ? Effect.fail(rootOp.fail("ClosedCaller"))
                 : Effect.succeed(referenceFor(ROOT_INO)))).pipe(Effect.withSpan("Caller.root")),
             lookup: Effect.fn("Caller.lookup")(function* (input) {
@@ -1950,7 +1671,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 const prepared = yield* Effect.fromResult(prepareEntry(input, op));
                 return yield* coordinatedRead(op, Effect.gen(function* () {
                     const entry = yield* resolveEntry(prepared, op);
-                    const directory = directoryNow(entry.parent);
+                    const directory = yield* directoryNow(entry.parent);
                     if (isDotComponent(entry.name)) {
                         return yield* entry.op.fail(entry.addressing === "entry" ? "InvalidArgument" : "NotFound");
                     }
@@ -1997,13 +1718,22 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                     const first = coordinatedRead(op, Effect.gen(function* () {
                         const directory = yield* resolveDirectory(target, op);
                         yield* authorize(directory.node, identity, READ, directory.op);
-                        return walkChildren(directory.node, new Uint8Array(0), 0, yield* pathAnchor(target, directory.node, op));
+                        return yield* walkChildren(directory.node, new Uint8Array(0), 0, yield* pathAnchor(target, directory.node, op));
                     }));
+                    const exceeded = (frame, field) => makeError({ code: "LimitExceeded", operation: op.operation, field, path: errorPath(locate(frame.path)) });
+                    const maxBytes = chosen.maxBytes === undefined ? undefined : ByteSize.toBigInt(chosen.maxBytes);
                     const plan = {
                         order: chosen.order ?? "pre",
-                        maxDepth: chosen.maxDepth,
-                        maxEntries: chosen.maxEntries,
-                        maxBytes: chosen.maxBytes === undefined ? undefined : ByteSize.toBigInt(chosen.maxBytes)
+                        limit: (frame, progress, phase) => {
+                            if (chosen.maxDepth !== undefined && frame.depth > chosen.maxDepth)
+                                return exceeded(frame, "maxDepth");
+                            if (phase === "directory")
+                                return undefined;
+                            if (chosen.maxEntries !== undefined && progress.entries > chosen.maxEntries) {
+                                return exceeded(frame, "maxEntries");
+                            }
+                            return maxBytes !== undefined && progress.bytes > maxBytes ? exceeded(frame, "maxBytes") : undefined;
+                        }
                     };
                     return Stream.map(walkFrames(op, first, plan, locate, readable), (frame) => Object.freeze({
                         path: ownedPath(frame.path),
@@ -2031,17 +1761,21 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 return yield* coordinatedRead(op, Effect.gen(function* () {
                     if (Target.$is("Path")(target)) {
                         const pathOp = op.at(target.path);
-                        const result = yield* lookup(yield* Effect.fromResult(prepare(target.path, op)), target.relativeTo, op);
-                        const directory = result.node?.kind === "directory" ? result.node : result.parent;
-                        const prefix = directory === undefined ? SLASH_HEX : pathOf(view, directory.ino);
+                        const result = yield* resolveTarget(target, op, { final: true });
+                        const directory = result.node.kind === "directory"
+                            ? result.node
+                            : result.kind === "entry"
+                                ? result.parent
+                                : undefined;
+                        const prefix = directory === undefined ? SLASH_HEX : yield* pathOfCurrent(directory.ino);
                         if (prefix === undefined)
                             return yield* pathOp.fail("NotFound");
-                        if (result.node?.kind === "directory" || result.name === undefined)
+                        if (result.node.kind === "directory" || result.kind === "node")
                             return ownedPath(nameBytes(prefix));
                         return ownedPath(nameBytes(prefix + (prefix === SLASH_HEX ? "" : SLASH_HEX) + result.name));
                     }
                     const resolved = yield* resolveTarget(target, op);
-                    const path = pathOf(view, resolved.node.ino);
+                    const path = yield* pathOfCurrent(resolved.node.ino);
                     if (path === undefined)
                         return yield* resolved.op.fail("NotFound");
                     return ownedPath(nameBytes(path));
@@ -2091,66 +1825,19 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 const captured = new Uint8Array(bytes);
                 const chosen = yield* decodeWriteFileOptions(options).pipe(Effect.mapError((cause) => fail(optionsOp, cause)));
                 return yield* coordinated(op, Effect.gen(function* () {
-                    let entryOp = op;
-                    let parent;
-                    let name;
-                    let found;
-                    let trailingSlash = false;
-                    if (prepared.kind === "path") {
-                        const path = prepared.path;
-                        entryOp = op.at(path.input);
-                        if (chosen.create === "exclusive") {
-                            const exists = yield* Effect.result(lookup(path, prepared.base, op, { followFinalSymlink: false }));
-                            if (Result.isSuccess(exists))
-                                return yield* entryOp.fail("AlreadyExists");
-                            if (exists.failure.code !== "NotFound")
-                                return yield* exists.failure;
-                        }
-                        const resolved = yield* lookup(path, prepared.base, op, {
-                            followFinalSymlink: chosen.replaceFinalSymlink !== true && chosen.followFinalSymlink !== false,
-                            allowMissing: chosen.create === "ifMissing" || chosen.create === "exclusive"
-                        });
-                        if (resolved.parent === undefined || resolved.name === undefined || resolved.node?.kind === "directory") {
-                            return yield* entryOp.fail("IsDirectory");
-                        }
-                        parent = resolved.parent;
-                        name = resolved.name;
-                        found = resolved.node;
-                        trailingSlash = path.trailingSlash;
-                    }
-                    else {
-                        const directory = yield* entryDirectory(prepared.directory, op);
-                        if (isDotComponent(prepared.name))
-                            return yield* op.fail("InvalidArgument");
-                        yield* authorize(directory.node, identity, EXECUTE, op);
-                        parent = directory.node;
-                        name = prepared.name;
-                        const childIno = parent.entries.get(name);
-                        let child = childIno === undefined ? undefined : view(childIno);
-                        if (child?.kind === "symlink" && chosen.replaceFinalSymlink !== true &&
-                            chosen.followFinalSymlink !== false) {
-                            const resolved = yield* lookup(yield* Effect.fromResult(preparePath(ownedPath(nameBytes(name)), op.operation, undefined)), undefined, op, {
-                                followFinalSymlink: true,
-                                allowMissing: chosen.create === "ifMissing" || chosen.create === "exclusive"
-                            }, parent);
-                            if (resolved.parent === undefined || resolved.name === undefined || resolved.node?.kind === "directory") {
-                                return yield* op.fail("IsDirectory");
-                            }
-                            parent = resolved.parent;
-                            name = resolved.name;
-                            child = resolved.node;
-                        }
-                        if (child === undefined && (chosen.create === undefined || chosen.create === "never")) {
-                            return yield* op.fail("NotFound");
-                        }
-                        if (child !== undefined && chosen.create === "exclusive")
-                            return yield* op.fail("AlreadyExists");
-                        if (child?.kind === "directory")
-                            return yield* op.fail("IsDirectory");
-                        found = child;
-                    }
-                    if (found === undefined && trailingSlash)
+                    const resolved = yield* resolver.resolve(prepared, {
+                        kind: "OrCreate",
+                        create: chosen.create ?? "never",
+                        finalSymlink: chosen.replaceFinalSymlink !== true && chosen.followFinalSymlink !== false
+                            ? "follow"
+                            : "preserve",
+                        entryExclusive: "afterSymlink"
+                    }, op);
+                    const { parent, name, trailingSlash, op: entryOp } = resolved;
+                    const found = resolved.kind === "existing" ? resolved.node : undefined;
+                    if (found?.kind === "directory" || (found === undefined && trailingSlash)) {
                         return yield* entryOp.fail("IsDirectory");
+                    }
                     const replaced = found?.kind === "symlink" ? found : undefined;
                     if (replaced !== undefined && !chosen.replaceFinalSymlink)
                         return yield* entryOp.fail("SymlinkLoop");
@@ -2161,7 +1848,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                         yield* authorize(parent, identity, WRITE | EXECUTE, entryOp);
                         if (replaced !== undefined)
                             yield* authorizeRemoval(parent, replaced, entryOp);
-                        yield* replaced === undefined ? reserveEntry(entryOp) : reserveInode(entryOp);
+                        yield* (replaced === undefined ? reserveEntry(entryOp) : reserveInode(entryOp));
                     }
                     else {
                         yield* authorize(file, identity, chosen.access === "readWrite" ? READ | WRITE : WRITE, entryOp);
@@ -2186,8 +1873,9 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                         data.set(captured, position);
                     }
                     const now = yield* timestamp(op);
-                    const d = current();
-                    const node = file ?? newFile(parent, new Uint8Array(0), (chosen.mode ?? 0o666) & 0o777 & ~umask, now);
+                    const d = yield* Draft;
+                    const node = file ??
+                        (yield* newFile(parent, new Uint8Array(0), (chosen.mode ?? 0o666) & 0o777 & ~umask, now));
                     const written = {
                         ...node,
                         data,
@@ -2199,32 +1887,22 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                             ctimeNs: now
                         }
                     };
-                    d.usedBytes += BigInt(size - previous);
+                    yield* d.addUsedBytes(BigInt(size - previous));
                     if (file === undefined) {
                         if (replaced !== undefined)
-                            detach(replaced, parent.ino, name, now);
-                        attach(directoryNow(parent.ino), name, written, now);
+                            yield* detach(replaced, parent.ino, name, now);
+                        yield* attach(yield* directoryNow(parent.ino), name, written, now);
                         if (replaced === undefined)
-                            d.entries += 1;
-                        publishEntry(replaced === undefined ? "Create" : "Update", parent.ino, name, written.ino);
+                            yield* d.addEntries(1);
+                        yield* publishEntry(replaced === undefined ? "Create" : "Update", parent.ino, name, written.ino);
                     }
                     else {
-                        d.put(written);
-                        publishNode(written.ino);
+                        yield* d.put(written);
+                        yield* publishNode(written.ino);
                     }
                 }));
             }),
-            // SAFETY: the overloads pair an entry with entry options and a target with open options; the decoders below
-            // reject the other shape, so one implementation serves both.
-            open: Effect.fn("Caller.open")(function* (input, options) {
-                const op = OpContext.make("open");
-                if (isEntry(input))
-                    return yield* openEntry(input, options, op);
-                const target = asTarget(input);
-                if (Target.$is("Path")(target))
-                    return yield* openPath(target, options, op);
-                return yield* openNode(target, options, op);
-            }),
+            open,
             mkdir: Effect.fn("Caller.mkdir")(function* (input, options = {}) {
                 const op = OpContext.make("mkdir");
                 const prepared = yield* Effect.fromResult(prepareEntry(input, op));
@@ -2282,23 +1960,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             rmdir: Effect.fn("Caller.rmdir")(function* (input) {
                 return yield* entryVerb("rmdir", input, rmdirEntry);
             }),
-            // SAFETY: the overloads differ only in whether `force` may leave nothing removed; one body serves both.
-            remove: Effect.fn("Caller.remove")(function* (input, options) {
-                const op = OpContext.make("remove");
-                const prepared = yield* Effect.fromResult(prepareEntry(input, op));
-                const chosen = yield* decodeRemoveOptions(options ?? {}).pipe(Effect.mapError((cause) => fail(preparedOp(prepared, op), cause)));
-                const once = coordinated(op, Effect.flatMap(resolveEntry(prepared, op), (entry) => removeEntry(entry, op)));
-                const target = (effect) => chosen.force === true
-                    ? Effect.catchIf(effect, (error) => error.code === "NotFound", () => Effect.undefined)
-                    : effect;
-                const removed = yield* Effect.result(target(once));
-                if (Result.isSuccess(removed))
-                    return removed.success;
-                if (chosen.recursive !== true || removed.failure.code !== "NotEmpty")
-                    return yield* removed.failure;
-                yield* emptyDirectory(prepared, op, chosen.force === true);
-                return yield* target(once);
-            }),
+            remove,
             rename: Effect.fn("Caller.rename")(function* (fromInput, toInput) {
                 const op = OpContext.make("rename");
                 const from = yield* Effect.fromResult(prepareEntry(fromInput, op));
@@ -2371,21 +2033,21 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 const statOp = OpContext.make("stat");
                 const handle = Object.freeze({
                     [DirectoryHandleId]: true,
-                    stat: coordinatedRead(statOp, Effect.suspend(() => {
-                        const node = acquired.ino === undefined ? undefined : view(acquired.ino);
-                        return node === undefined
+                    stat: coordinatedRead(statOp, Effect.gen(function* () {
+                        const ino = TokenRegistry.inode(acquired);
+                        const node = ino === undefined ? undefined : yield* view(ino);
+                        return yield* (node === undefined
                             ? Effect.fail(statOp.fail("InvalidHandle"))
-                            : Effect.succeed(withMetadata(node));
+                            : Effect.succeed(withMetadata(node)));
                     })).pipe(Effect.withSpan("DirectoryHandle.stat")),
                     close: coordinatedCleanup(Effect.suspend(() => {
-                        if (acquired.ino === undefined) {
+                        if (TokenRegistry.inode(acquired) === undefined) {
                             return Effect.fail(OpContext.make("close").fail("InvalidHandle"));
                         }
-                        releaseDirectory(acquired);
-                        return Effect.void;
+                        return releaseDirectory(acquired);
                     })).pipe(Effect.ensuring(closeReleasedScope(acquired)), Effect.withSpan("DirectoryHandle.close"))
                 });
-                handles.set(handle, acquired);
+                registry.registerDirectory(handle, acquired);
                 return handle;
             })
         });
@@ -2416,32 +2078,27 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         snapshot: coordinatedRead(OpContext.make("snapshot"), Effect.sync(() => Image.make(state))).pipe(Effect.withSpan("Volume.snapshot")),
         referenceKey: Effect.fn("Volume.referenceKey")(function* (reference) {
             const op = OpContext.make("referenceKey");
-            return yield* coordinatedRead(op, Effect.suspend(() => {
-                const known = Predicate.isObject(reference) ? objectReferences.get(reference) : undefined;
-                if (known === undefined)
-                    return Effect.fail(op.fail("InvalidReference"));
-                if (known.volume !== volumeIdentity)
-                    return Effect.fail(op.fail("ForeignReference"));
-                if (!addressable(known.ino))
-                    return Effect.fail(op.fail("StaleReference"));
-                const ino = BigInt(known.ino);
-                return Effect.succeed({ identity: identityBytes.slice(), epoch: epochBytes.slice(), ino, tag: keyTag(ino) });
+            return yield* coordinatedRead(op, Effect.gen(function* () {
+                const node = yield* TokenRegistry.nodeOrFail(yield* registry.resolve(reference, "reference"), "reference", op);
+                const ino = BigInt(node.ino);
+                return { identity: identityBytes.slice(), epoch: epochBytes.slice(), ino, tag: keyTag(ino) };
             }));
         }),
         resolveReferenceKey: Effect.fn("Volume.resolveReferenceKey")(function* (key) {
             const op = OpContext.make("resolveReferenceKey");
-            return yield* coordinatedRead(op, Effect.suspend(() => {
+            return yield* coordinatedRead(op, Effect.gen(function* () {
                 if (!Schema.is(ReferenceKey)(key))
-                    return Effect.fail(op.fail("InvalidReference"));
+                    return yield* op.fail("InvalidReference");
                 // Another epoch numbered its objects on its own, so its key is another volume's even under this identity.
                 if (!sameBytes(key.identity, identityBytes) || !sameBytes(key.epoch, epochBytes)) {
-                    return Effect.fail(op.fail("ForeignReference"));
+                    return yield* op.fail("ForeignReference");
                 }
                 // Checked before the inode is looked up, so a guessed key learns nothing about which numbers are in use.
                 if (!sameTag(key.tag, keyTag(key.ino)))
-                    return Effect.fail(op.fail("InvalidReference"));
+                    return yield* op.fail("InvalidReference");
                 const ino = Ino(Number(key.ino));
-                return addressable(ino) ? Effect.succeed(referenceFor(ino)) : Effect.fail(op.fail("StaleReference"));
+                yield* TokenRegistry.nodeOrFail(yield* registry.resolveInode(ino), "reference", op);
+                return referenceFor(ino);
             }));
         }),
         caller: Effect.fn("Volume.caller")(function* (options) {
@@ -2455,47 +2112,37 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         changes: coordinatedRead(OpContext.make("changes"), Effect.suspend(() => observeChanges(state))),
         capture: coordinatedRead(OpContext.make("capture"), captureState())
     });
-    return Object.freeze({ volume, shutdown, initialImage, observe });
+    return Object.freeze({ volume, shutdown, observe });
 });
 /** @internal */
 export const make = Effect.fn("VirtualFileSystem.make")(function* (options) {
-    return (yield* makeVolume(VolumeSource.Empty(), options).pipe(Effect.catchIf((error) => Schema.is(VfsError)(error) && error.code !== "InvalidArgument", Effect.die))).volume;
+    return (yield* makeVolume(VolumeSource.Empty(), memoryCommitProvider, options).pipe(Effect.catchIf((error) => Schema.is(VfsError)(error) && error.code !== "InvalidArgument", Effect.die))).volume;
 });
 /** @internal */
 export const prepareEmptyLiveImage = Effect.fnUntraced(function* (options) {
-    const { initialImage } = yield* Effect.mapError(makeVolume(VolumeSource.Empty(), options, undefined, LiveImage.encode), (error) => retargetFailure("prepareEmptyImage", error));
-    if (initialImage === undefined)
-        return yield* imageFailure("openImage", "InvalidStructure", { field: "liveImage" });
-    return initialImage;
+    const decoded = yield* Effect.fromResult(Limits.configuration(options, "prepareEmptyImage"));
+    const limits = decoded.limits;
+    const identity = decoded.identity ?? VolumeIdentity.make(yield* randomHex128);
+    const epoch = VolumeEpoch.make(yield* randomHex128);
+    const keySecret = KeySecret.make(yield* randomHex128);
+    const now = yield* Clock.currentTimeNanos;
+    if (!isTimestamp(now))
+        return yield* argumentFailure("prepareEmptyImage", "clock.currentTimeNanos");
+    return yield* LiveImage.encode(emptyState(now), { identity, epoch, keySecret }, limits).pipe(Effect.mapError((error) => retargetFailure("prepareEmptyImage", error)));
 });
 /** @internal */
-export const openImageVolume = Effect.fnUntraced(function* (image, maxImageBytes, commit, durability = "memory-only") {
+export const openImageVolume = Effect.fnUntraced(function* (image, maxImageBytes, commit, durability = "memory-only", options) {
     const restored = yield* LiveImage.decode(image, maxImageBytes);
-    let prepared;
-    const { limits: stored } = restored;
-    const commitOp = OpContext.make("commit");
-    const limits = {
-        maxEntries: stored.maxEntries,
-        maxBytes: stored.maxBytes === undefined ? undefined : ByteSize.bytes(stored.maxBytes),
-        maxFileBytes: ByteSize.bytes(stored.maxFileBytes ?? MAX_FILE_BYTES),
-        maxPathBytes: stored.maxPathBytes === undefined ? undefined : ByteSize.bytes(stored.maxPathBytes),
-        maxPendingOperations: 64,
-        maxWatchEvents: 256
+    const requested = yield* Effect.fromResult(Limits.fromOptions(options, "openImage"));
+    const limits = yield* Effect.fromResult(Limits.fromStored(restored.limits, requested));
+    const provider = {
+        mode: "durable",
+        shutdown: Effect.void,
+        commit: (candidate) => LiveImage.encode(candidate, restored, limits).pipe(Effect.mapError((cause) => makeError({ code: "StorageRejected", operation: "commit", cause })), Effect.flatMap((bytes) => ByteSize.isGreaterThan(ByteSize.bytes(bytes.length), maxImageBytes)
+            ? Effect.fail(makeError({ code: "StorageRejected", operation: "commit" }))
+            : commit(bytes)))
     };
-    const { volume, shutdown } = yield* makeVolume(VolumeSource.Live({ restored }), undefined, {
-        prepare: (candidate) => LiveImage.encode(candidate, restored, limits).pipe(Effect.mapError((cause) => commitOp.fail("StorageRejected", { cause })), Effect.flatMap((bytes) => ByteSize.isGreaterThan(ByteSize.bytes(bytes.length), maxImageBytes)
-            ? commitOp.fail("StorageRejected")
-            : Effect.sync(() => {
-                prepared = bytes;
-            }))),
-        commit: () => Effect.suspend(() => {
-            const bytes = prepared;
-            prepared = undefined;
-            return bytes === undefined ? Effect.succeed("unknown") : commit(bytes);
-        })
-    }, undefined, durability);
-    if (shutdown === undefined)
-        return yield* imageFailure("openImage", "InvalidStructure", { field: "liveImage" });
+    const { volume, shutdown } = yield* makeVolume(VolumeSource.Live({ restored }), provider, options, durability);
     return Object.freeze({ volume, shutdown });
 });
 /** @internal */
@@ -2508,12 +2155,12 @@ const changeOptions = (options) => {
 };
 /** @internal */
 export const fromSnapshot = Effect.fn("VirtualFileSystem.fromSnapshot")(function* (snapshot, options) {
-    return (yield* makeVolume(VolumeSource.Restored({ value: yield* Image.valueOf(snapshot) }), options)).volume;
+    return (yield* makeVolume(VolumeSource.Restored({ value: yield* Image.valueOf(snapshot) }), memoryCommitProvider, options)).volume;
 }, Effect.mapError((error) => retargetFailure("fromSnapshot", error)));
 /** @internal */
 export const makeOverlay = Effect.fn("VirtualFileSystem.makeOverlay")(function* (base, options) {
     const value = yield* Image.valueOf(base);
-    const made = yield* Effect.mapError(makeVolume(VolumeSource.Restored({ value }), options), (error) => retargetFailure("makeOverlay", error));
+    const made = yield* Effect.mapError(makeVolume(VolumeSource.Restored({ value }), memoryCommitProvider, options), (error) => retargetFailure("makeOverlay", error));
     const baseObservation = yield* observeChanges(value);
     const overlay = Object.freeze({
         ...made.volume,