@effect-vfs/core 0.7.1 → 0.8.0

package/dist/internal/virtualFileSystem.js

@@ -1,5 +1,6 @@
 import * as Arr from "effect/Array";
 import * as ByteSize from "effect/ByteSize";
+import * as Cause from "effect/Cause";
 import * as Clock from "effect/Clock";
 import * as Context from "effect/Context";
 import * as Crypto from "effect/Crypto";
@@ -13,16 +14,15 @@ import * as Option from "effect/Option";
 import * as Predicate from "effect/Predicate";
 import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
-import * as Scope from "effect/Scope";
 import * as Semaphore from "effect/Semaphore";
 import * as Stream from "effect/Stream";
 import { BytePath } from "../BytePath.js";
-import { CallerId, MkdirOptions, ObjectReferenceId, OpenEntryOptions, OpenOptions, RemoveOptions, RootCallerOptions, SetattrOptions, SymlinkOptions, WalkOptions, WriteFileOptions } from "../Caller.js";
+import { CallerId, MkdirOptions, OpenEntryOptions, OpenOptions, RemoveOptions, RootCallerOptions, SetattrOptions, SymlinkOptions, WalkOptions, WriteFileOptions } from "../Caller.js";
 import { DirectoryHandleId, FileHandleId, SeekMode } from "../FileHandle.js";
 import { Mode, OwnerUpdate, Times } from "../Metadata.js";
-import { isEntry, isTarget, Target } from "../Target.js";
+import { isEntry, Target } from "../Target.js";
 import { make as makeError } from "../VfsError.js";
-import { OverlayChange, OverlayChangesOptions, ReferenceKey, VolumeId, VolumeIdentity, VolumeIncarnation, VolumeOptions } from "../Volume.js";
+import { OverlayChange, OverlayChangesOptions, ReferenceKey, VolumeId, VolumeIdentity, VolumeIncarnation } from "../Volume.js";
 import { WatchOptions } from "../Watch.js";
 import { sameBytes } from "./bytes.js";
 import { argumentFailure, decodeConfiguration, errorPath, fsFailure, imageFailure, OpContext, retargetFailure, VfsError } from "./errors.js";
@@ -33,10 +33,13 @@ import * as InodeTable from "./inodeTable.js";
 import * as LiveImage from "./liveImage.js";
 import * as MetadataDomain from "./metadata.js";
 import { compareOverlay } from "./overlayDiff.js";
-import { DOT_DOT_HEX, DOT_HEX, inputBytes, isAttachedBytes, isDotComponent, isWellFormed, joinPath, MAX_NAME_BYTES, MAX_SYMLINK_TRAVERSALS, nameBytes, ownedPath, preparePath, ROOT_PATH, SLASH_BYTE, SLASH_HEX } from "./path.js";
+import { inputBytes, isAttachedBytes, isDotComponent, joinPath, nameBytes, ownedPath, ROOT_PATH, SLASH_BYTE, SLASH_HEX } from "./path.js";
+import * as Resolution from "./resolution.js";
 import { VolumeTestSeams } from "./testSeams.js";
+import * as TokenRegistry from "./tokenRegistry.js";
 import { makeTurnstile } from "./turnstile.js";
-import { byEntryName, directoryMetadata, emptyRoot, getNode, Ino, MAX_FILE_BYTES, reachableValue, ROOT_INO, storedMetadata, WALK_YIELD_INTERVAL } from "./volumeState.js";
+import * as Limits from "./volumeLimits.js";
+import { byEntryName, directoryMetadata, emptyState, getNode, Ino, reachableValue, ROOT_INO, storedMetadata, WALK_YIELD_INTERVAL } from "./volumeState.js";
 import * as WatchHub from "./watchHub.js";
 const EXECUTE = 0o1;
 const WRITE = 0o2;
@@ -45,11 +48,23 @@ const ANY_EXECUTE = 0o111;
 const SET_ID_BITS = 0o6000;
 const STICKY_BIT = 0o1000;
 const RELATIME_INTERVAL_NS = 86400000000000n; // relatime, as Linux mounts by default: a read refreshes an access time at least this old, 24 hours.
+/** @internal */
+export const memoryCommitProvider = Object.freeze({
+    mode: "memory",
+    commit: () => Effect.succeed("committed"),
+    shutdown: Effect.void
+});
 // An unknown commit outcome stops the volume; definite rejection stops it only during cleanup.
 const offerCommit = (provider, operation, candidate, cleanup) => Effect.map(Effect.exit(Effect.suspend(() => provider.commit(candidate))), (committed) => {
     // TODO(#186): Preserve the cause of a provider defect or interruption.
     if (Exit.isFailure(committed)) {
-        return { available: false, failure: fsFailure("OutcomeUnknown", operation) };
+        if (Cause.hasDies(committed.cause) || Cause.hasInterrupts(committed.cause)) {
+            return { available: false, failure: fsFailure("OutcomeUnknown", operation) };
+        }
+        const failure = Cause.findErrorOption(committed.cause);
+        return Option.isSome(failure)
+            ? { available: !cleanup, failure: failure.value }
+            : { available: false, failure: fsFailure("OutcomeUnknown", operation) };
     }
     if (committed.value === "rejected") {
         return { available: !cleanup, failure: fsFailure("StorageRejected", operation) };
@@ -64,7 +79,7 @@ const MAX_FILE_OFFSET = 0x7fffffffffffffffn;
 const isMode = Schema.is(Mode);
 const isNatural = Schema.is(Schema.Natural);
 const isLength = Schema.is(SetattrOptions.fields.size.schema);
-const inGroup = (identity, gid) => identity.gid === gid || identity.groups.includes(gid);
+const inGroup = Resolution.inGroup;
 const isTimestamp = Schema.is(MetadataDomain.Timestamp);
 const isSeekMode = Schema.is(SeekMode);
 const decodeOwnerUpdate = Schema.decodeEffect(OwnerUpdate, { onExcessProperty: "error" });
@@ -79,7 +94,6 @@ const decodeSymlinkOptions = Schema.decodeEffect(SymlinkOptions, { onExcessPrope
 const decodeWalkOptions = Schema.decodeEffect(WalkOptions, { onExcessProperty: "error" });
 const decodeRemoveOptions = Schema.decodeEffect(RemoveOptions, { onExcessProperty: "error" });
 const decodeOpenEntryOptions = Schema.decodeEffect(OpenEntryOptions, { onExcessProperty: "error" });
-const encoder = new TextEncoder();
 // Whether a read at `now` refreshes a node's access time: when it is not newer than the last modification or
 // status change, or when it is at least a day old. A time already equal to `now` is never refreshed, as Linux
 // skips it, so reads at one instant (a frozen or coarse clock) store nothing.
@@ -196,10 +210,6 @@ class Draft extends Context.Service()("@effect-vfs/core/internal/virtualFileSyst
     })
 }) {
 }
-const objectReferences = new WeakMap();
-const isFileHandle = (value) => Predicate.hasProperty(FileHandleId)(value);
-const files = new WeakMap();
-const handles = new WeakMap();
 const withMetadata = (node) => ({ ...node.metadata, revision: node.revision });
 const withEntries = (directory, edit) => {
     const entries = new Map(directory.entries);
@@ -247,29 +257,17 @@ const randomHex128 = Effect.gen(function* () {
     return Hex.encode(yield* crypto.randomBytes(16));
 }).pipe(Effect.orDie);
 /** @internal */
-export const makeVolume = Effect.fnUntraced(function* (source, options, commitProvider, captureInitial, durability = "memory-only") {
+export const makeVolume = Effect.fnUntraced(function* (source, commitProvider, options, durability = "memory-only") {
     const services = yield* Effect.context();
     // These accessors run inside synchronous transition callbacks. The runner is reached only when an invariant fails.
     const dieInvariant = (message) => Effect.runSyncWith(services)(Effect.die(message));
     const live = Predicate.isTagged("Live")(source) ? source.restored : undefined;
-    let restoredOptions = options;
-    if (live !== undefined) {
-        const recovered = { identity: live.identity };
-        if (live.limits.maxEntries !== undefined)
-            recovered.maxEntries = live.limits.maxEntries;
-        if (live.limits.maxBytes !== undefined)
-            recovered.maxBytes = ByteSize.bytes(live.limits.maxBytes);
-        if (live.limits.maxFileBytes !== undefined)
-            recovered.maxFileBytes = ByteSize.bytes(live.limits.maxFileBytes);
-        if (live.limits.maxPathBytes !== undefined)
-            recovered.maxPathBytes = ByteSize.bytes(live.limits.maxPathBytes);
-        restoredOptions = recovered;
-    }
-    const decoded = yield* Effect.fromResult(decodeConfiguration(VolumeOptions, restoredOptions === undefined ? {} : restoredOptions, "make"));
-    const settings = { ...decoded };
-    const identity = settings.identity === undefined
+    const decoded = yield* Effect.fromResult(Limits.configuration(options));
+    const requested = decoded.limits;
+    const limits = live === undefined ? requested : yield* Effect.fromResult(Limits.fromStored(live.limits, requested));
+    const identity = live?.identity ?? (decoded.identity === undefined
         ? VolumeIdentity.make(yield* randomHex128)
-        : VolumeIdentity.make(settings.identity);
+        : decoded.identity);
     const incarnation = VolumeIncarnation.make(yield* randomHex128);
     const epoch = live === undefined ? VolumeEpoch.make(yield* randomHex128) : live.epoch;
     const keySecret = live === undefined ? KeySecret.make(yield* randomHex128) : live.keySecret;
@@ -288,24 +286,8 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             : Effect.fail(op.fail("InvalidArgument"));
     });
     const volumeIdentity = Symbol();
-    const tokens = new Map();
     const directoryHolds = new Map();
-    const makeFileReference = (access, append) => ({
-        volume: volumeIdentity,
-        scope: undefined,
-        closed: false,
-        ino: undefined,
-        offset: 0n,
-        access,
-        append
-    });
-    const makeDirectoryReference = (ino) => ({
-        volume: volumeIdentity,
-        scope: undefined,
-        closed: false,
-        ino
-    });
-    const maxPendingOperations = settings.maxPendingOperations ?? 64;
+    const maxPendingOperations = limits.maxPendingOperations;
     const permits = maxPendingOperations + 1;
     const gate = Semaphore.makeUnsafe(permits);
     // The gate hands permits to whichever waiter it can satisfy, so a change waiting for every permit would be
@@ -322,51 +304,36 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         onNone: () => op.fail("VolumeBusy"),
         onSome: Effect.succeed
     })));
-    const root = emptyRoot(initialTime);
-    let state = {
-        inodes: InodeTable.set(InodeTable.empty(), ROOT_INO, root),
-        open: new Map(),
-        nextInode: Ino(2),
-        revision: 1n,
-        entries: 0,
-        usedBytes: 0n
-    };
-    const maxFileBytes = Number(ByteSize.toBigInt(settings.maxFileBytes ?? ByteSize.bytes(MAX_FILE_BYTES)));
-    const limits = Object.freeze({
-        maxBytes: settings.maxBytes,
-        maxFileBytes: ByteSize.bytes(maxFileBytes),
-        maxEntries: settings.maxEntries,
-        maxPathBytes: settings.maxPathBytes,
-        maxPendingOperations: settings.maxPendingOperations ?? 64,
-        maxWatchEvents: settings.maxWatchEvents ?? 256
-    });
+    let state = emptyState(initialTime);
+    const maxFileBytes = Number(ByteSize.toBigInt(limits.maxFileBytes));
     if (Predicate.isTagged("Restored")(source)) {
         const restored = yield* reachableValue(source.value);
         if (restored.largestFile > maxFileBytes) {
             return yield* imageFailure("snapshot", "LimitExceeded", { field: "maxFileBytes" });
         }
-        if ((settings.maxEntries !== undefined && restored.state.entries > settings.maxEntries) ||
-            (settings.maxBytes !== undefined && restored.state.usedBytes > ByteSize.toBigInt(settings.maxBytes))) {
+        if ((limits.maxEntries !== undefined && restored.state.entries > limits.maxEntries) ||
+            (limits.maxBytes !== undefined && restored.state.usedBytes > ByteSize.toBigInt(limits.maxBytes))) {
             return yield* imageFailure("snapshot", "LimitExceeded", { field: "volume" });
         }
         state = restored.state;
     }
     if (live !== undefined)
         state = live.value;
-    const initialImage = captureInitial === undefined
-        ? undefined
-        : yield* captureInitial(state, { identity, epoch, keySecret }, limits);
     const view = (ino) => Effect.flatMap(Effect.serviceOption(Draft), (draft) => Option.isSome(draft) ? draft.value.get(ino) : Effect.sync(() => getNode(state, ino)));
+    const registry = TokenRegistry.make(volumeIdentity, view);
+    const referenceFor = registry.referenceFor;
+    const makeFileReference = registry.file;
+    const makeDirectoryReference = registry.directory;
     let available = true;
     const checkAvailable = (operation) => Effect.suspend(() => available ? Effect.void : Effect.fail(fsFailure("VolumeUnavailable", operation)));
     const watchCoordinate = (effect) => changing(effect);
-    const watchHub = yield* WatchHub.make(watchCoordinate, settings.maxWatchEvents ?? 256);
+    const watchHub = yield* WatchHub.make(watchCoordinate, limits.maxWatchEvents);
     const install = Effect.fnUntraced(function* (finished) {
         const before = state;
         state = yield* finished.finish;
         const actions = yield* finished.actions;
         for (const ino of actions.removed)
-            tokens.delete(ino);
+            registry.forget(ino);
         for (const apply of actions.after)
             apply();
         const after = state;
@@ -377,36 +344,33 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         const value = yield* Effect.provideService(change, Draft, current);
         return [value, current];
     });
-    const applyDirect = Effect.fnUntraced(function* (change) {
-        const current = yield* Draft.make(state);
-        yield* Effect.provideService(change(current), Draft, current);
-        yield* install(current);
-    });
-    // Offers the finished draft's value to the store before installing it. A rejected candidate is discarded and
-    // the volume stays available; an uncertain answer stops the volume. A change that is a cleanup runs its
-    // release even when the store refuses, since the handle must not stay open.
-    const committed = Effect.fnUntraced(function* (op, provider, finished, onStorageFailure) {
-        if (yield* finished.unchanged)
+    // Cleanup releases local ownership even when storage refuses; that divergence disables the volume.
+    const committed = Effect.fnUntraced(function* (op, finished, cleanup) {
+        if ((yield* finished.unchanged) || (cleanup && !available))
             return yield* install(finished);
         const next = yield* finished.finish;
-        if (provider.prepare !== undefined)
-            yield* provider.prepare(next);
-        const answer = yield* offerCommit(provider, op.operation, next, onStorageFailure !== undefined);
+        const answer = yield* offerCommit(commitProvider, op.operation, next, cleanup);
         if (!answer.available)
             available = false;
         if (answer.failure !== undefined) {
-            if (!answer.available && onStorageFailure !== undefined)
-                yield* onStorageFailure();
+            if (cleanup)
+                yield* install(finished);
             return yield* answer.failure;
         }
         yield* install(finished);
     });
+    const applyCleanup = Effect.fnUntraced(function* (change) {
+        const current = yield* Draft.make(state);
+        yield* Effect.provideService(change(current), Draft, current);
+        yield* committed(OpContext.make("close"), current, true);
+    });
     const annotateFailure = (error) => Effect.annotateCurrentSpan({ operation: error.operation, code: error.code });
-    // Permit waits stay interruptible. A change and its publication run under every permit; with a store, the
-    // change itself stays interruptible and only the commit and installation are not.
-    const coordinated = (op, effect, onStorageFailure) => admit(op, changing(commitProvider === undefined
-        ? Effect.uninterruptible(Effect.flatMap(transition(Effect.andThen(checkAvailable(op.operation), effect)), ([value, finished]) => Effect.as(install(finished), value)))
-        : Effect.uninterruptibleMask((restore) => Effect.flatMap(restore(transition(Effect.andThen(checkAvailable(op.operation), effect))), ([value, finished]) => Effect.as(committed(op, commitProvider, finished, onStorageFailure), value))))).pipe(Effect.tapError((error) => Schema.is(VfsError)(error) ? annotateFailure(error) : Effect.void));
+    // Permit waits stay interruptible. Memory transitions are masked; durable transitions remain
+    // interruptible until the candidate is ready. Every provider commit and installation is masked.
+    const coordinated = (op, effect, cleanup = false) => admit(op, changing(Effect.uninterruptibleMask((restore) => {
+        const staged = transition(Effect.andThen(checkAvailable(op.operation), effect));
+        return Effect.flatMap(commitProvider.mode === "memory" ? staged : restore(staged), ([value, finished]) => Effect.as(committed(op, finished, cleanup), value));
+    }))).pipe(Effect.tapError((error) => Schema.is(VfsError)(error) ? annotateFailure(error) : Effect.void));
     const coordinatedRead = (op, effect) => admit(op, observing(Effect.andThen(checkAvailable(op.operation), effect))).pipe(Effect.tapError((error) => Schema.is(VfsError)(error) ? annotateFailure(error) : Effect.void));
     const refreshAccess = Effect.fnUntraced(function* (read) {
         if (refreshDue(read)) {
@@ -423,9 +387,9 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         ? coordinated(op, Effect.flatMap(read, refreshAccess))
         : Effect.succeed(observed.value));
     const coordinatedCleanup = (effect) => changing(Effect.uninterruptible(effect));
-    const shutdown = commitProvider === undefined ? undefined : changing(Effect.sync(() => {
+    const shutdown = commitProvider.mode === "memory" ? commitProvider.shutdown : changing(Effect.uninterruptible(Effect.andThen(Effect.sync(() => {
         available = false;
-    }));
+    }), commitProvider.shutdown)));
     const pathOf = (get, ino) => {
         const names = [];
         let node = get(ino);
@@ -524,16 +488,9 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         includes: () => true,
         rescan: () => ({ change: RescanChange.make({ path: rootPath() }), parent: ROOT_INO, ino: ROOT_INO })
     };
-    const scopeRoot = (scope, op) => Effect.suspend(() => {
-        const known = objectReferences.get(scope);
-        if (known === undefined)
-            return Effect.fail(op.fail("InvalidReference"));
-        if (known.volume !== volumeIdentity)
-            return Effect.fail(op.fail("ForeignReference"));
-        const node = getNode(state, known.ino);
-        return node === undefined || node.metadata.nlink === 0
-            ? Effect.fail(op.fail("StaleReference"))
-            : Effect.succeed(known.ino);
+    const scopeRoot = Effect.fnUntraced(function* (scope, op) {
+        const node = yield* TokenRegistry.nodeOrFail(yield* registry.resolve(scope, "reference"), "reference", op);
+        return node.metadata.nlink === 0 ? yield* op.fail("StaleReference") : node.ino;
     });
     // A watch of one object, and of its subtree when recursive. Membership is read from the installed tree when
     // each event is offered, so it follows renames of the scope and its ancestors. When the object's last name is
@@ -566,10 +523,6 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         yield* (yield* VolumeTestSeams).betweenSnapshotAndSummary;
         return { snapshot, observation: yield* observeChanges(captured) };
     });
-    const addressable = (ino) => {
-        const node = getNode(state, ino);
-        return node !== undefined && !(node.kind === "directory" && node.metadata.nlink === 0);
-    };
     const keyTag = (ino) => {
         const message = new Uint8Array(40);
         message.set(identityBytes);
@@ -577,15 +530,6 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         new DataView(message.buffer).setBigUint64(32, ino);
         return hmacSha256(keySecretBytes, message).subarray(0, 16);
     };
-    const referenceFor = (ino) => {
-        const existing = tokens.get(ino);
-        if (existing !== undefined)
-            return existing;
-        const reference = Object.freeze({ [ObjectReferenceId]: true });
-        objectReferences.set(reference, { volume: volumeIdentity, ino });
-        tokens.set(ino, reference);
-        return reference;
-    };
     const holdDirectory = (ino) => {
         directoryHolds.set(ino, (directoryHolds.get(ino) ?? 0) + 1);
     };
@@ -598,32 +542,17 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         directoryHolds.delete(ino);
         const node = getNode(state, ino);
         if (node?.kind === "directory" && node.metadata.nlink === 0) {
-            yield* applyDirect((d) => d.remove(ino));
+            yield* applyCleanup((d) => d.remove(ino));
         }
     });
-    const releaseDirectory = Effect.fnUntraced(function* (reference) {
-        const ino = reference.ino;
-        reference.ino = undefined;
-        reference.closed = true;
-        if (ino !== undefined)
-            yield* unholdDirectory(ino);
-    });
-    const finalizeDirectory = (reference) => Effect.uninterruptible(Effect.suspend(() => reference.closed
-        ? Effect.void
-        : coordinatedCleanup(releaseDirectory(reference))));
-    const closeReleasedScope = (reference) => Effect.suspend(() => !reference.closed || reference.scope === undefined ? Effect.void : Scope.close(reference.scope, Exit.void));
-    const permitted = (node, identity) => {
-        const metadata = node.metadata;
-        const shift = metadata.uid === identity.uid ?
-            6
-            : inGroup(identity, metadata.gid)
-                ? 3
-                : 0;
-        return (metadata.mode >> shift) & (READ | WRITE | EXECUTE);
+    const releaseDirectory = (reference) => TokenRegistry.release(reference, unholdDirectory, (action) => Effect.sync(action));
+    const finalizeDirectory = (reference) => {
+        const close = coordinatedCleanup(releaseDirectory(reference));
+        return TokenRegistry.finalize(reference, close, Effect.ignore(close));
     };
-    const authorize = (node, identity, bits, op) => identity.privileged || (permitted(node, identity) & bits) === bits
-        ? Effect.void
-        : Effect.fail(op.fail("AccessDenied"));
+    const closeReleasedScope = TokenRegistry.closeReleasedScope;
+    const permitted = Resolution.permitted;
+    const authorize = Resolution.authorize;
     const reclaim = Effect.fnUntraced(function* (d, ino) {
         const node = yield* d.get(ino);
         if (node === undefined)
@@ -644,7 +573,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
     });
     const atEntryLimit = Effect.gen(function* () {
         const draft = yield* Draft;
-        return settings.maxEntries !== undefined && (yield* draft.entries) >= settings.maxEntries;
+        return limits.maxEntries !== undefined && (yield* draft.entries) >= limits.maxEntries;
     });
     const reserveEntry = Effect.fnUntraced(function* (op) {
         const draft = yield* Draft;
@@ -653,10 +582,10 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
     });
     const reserveInode = (op) => Effect.flatMap(Draft, (draft) => Effect.flatMap(draft.canAllocate, (available) => available ? Effect.void : Effect.fail(op.fail("NoSpace"))));
     const reserveBytes = Effect.fnUntraced(function* (op, bytes) {
-        if (settings.maxBytes === undefined)
+        if (limits.maxBytes === undefined)
             return;
         const draft = yield* Draft;
-        if (bytes > ByteSize.toBigInt(settings.maxBytes) - (yield* draft.usedBytes)) {
+        if (bytes > ByteSize.toBigInt(limits.maxBytes) - (yield* draft.usedBytes)) {
             return yield* op.fail("NoSpace");
         }
     });
@@ -692,60 +621,19 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         }
         yield* reclaim(d, child.ino);
     });
-    const releaseFile = Effect.fnUntraced(function* (ref) {
-        const ino = ref.ino;
-        if (ino !== undefined) {
-            const d = yield* Draft;
-            yield* d.release(ino);
-            yield* reclaim(d, ino);
-        }
-        ref.ino = undefined;
-        ref.closed = true;
-    });
-    const releaseOpenFile = (ref) => coordinatedCleanup(Effect.suspend(() => ref.closed ? Effect.void : applyDirect(() => releaseFile(ref))));
-    // Explicit close and scope cleanup share one release. A release whose commit fails still completes as
-    // cleanup, so the handle never stays open; only an explicit close reports the failure. A close refused
-    // admission never entered the volume, so it leaves the handle open for a retry.
-    const closeFile = (ref, op, check) => coordinated(op, Effect.andThen(check, Effect.gen(function* () {
-        const ino = ref.ino;
-        if (ino !== undefined) {
-            const d = yield* Draft;
-            yield* d.release(ino);
-            yield* reclaim(d, ino);
-        }
+    const releaseFileInode = Effect.fnUntraced(function* (ino) {
         const d = yield* Draft;
-        yield* d.afterInstall(() => {
-            ref.ino = undefined;
-            ref.closed = true;
-        });
-    })), () => applyDirect(() => releaseFile(ref))).pipe(Effect.tapError((error) => error.code === "VolumeBusy" ? Effect.void : releaseOpenFile(ref)));
-    // Keyed on the file rather than the closed flag, so a rerun releases an open that published after a first run.
-    // Cleanup is uninterruptible and does not need admission, so an interrupted or busy scope close still releases.
-    const finalizeFile = (ref) => Effect.uninterruptible(Effect.suspend(() => ref.ino === undefined
-        ? Effect.sync(() => {
-            ref.closed = true;
-        })
-        : Effect.ignore(closeFile(ref, OpContext.make("close"), Effect.void)).pipe(Effect.andThen(Effect.suspend(() => ref.closed ? Effect.void : releaseOpenFile(ref))))));
-    // Acquires a handle into its own scope, forked from the caller's. The finalizer is registered before waiting,
-    // since a closed scope runs a new finalizer at once and the permit is not reentrant. A scope that closes
-    // before or during acquisition interrupts it, and releasing here, under the permit, keeps the acquisition
-    // from outliving a finalizer that already ran. A scope that closes while the acquisition commits interrupts it
-    // too. Every exit without a handle reruns the finalizer, which may have run before the commit published and
-    // which closing an already closed scope would not run again.
-    const acquireHandle = Effect.fnUntraced(function* (reference, coordinate, acquire, releaseAcquired, finalize) {
-        const scope = yield* Scope.fork(yield* Effect.scope);
-        reference.scope = scope;
-        yield* Scope.addFinalizer(scope, finalize);
-        const closed = () => Predicate.isTagged(scope.state, "Closed");
-        return yield* coordinate(Effect.suspend(() => closed() ? Effect.interrupt : acquire).pipe(Effect.tap(() => Effect.suspend(() => {
-            if (!closed())
-                return Effect.void;
-            return Effect.andThen(releaseAcquired(), Effect.interrupt);
-        })))).pipe(Effect.tap(() => Effect.suspend(() => closed() ? Effect.interrupt : Effect.void)), Effect.onError(() => Effect.andThen(finalize, Scope.close(scope, Exit.void))));
+        yield* d.release(ino);
+        yield* reclaim(d, ino);
     });
-    const bindFile = (ref, ino) => Effect.flatMap(Draft, (draft) => draft.afterInstall(() => {
-        ref.ino = ino;
-    }));
+    const releaseFile = (ref) => TokenRegistry.release(ref, releaseFileInode, (action) => Effect.sync(action));
+    const releaseOpenFile = (ref) => Effect.ignore(coordinatedCleanup(Effect.suspend(() => TokenRegistry.inode(ref) === undefined ? Effect.void : applyCleanup(() => releaseFile(ref)))));
+    // Admission refusal leaves the handle open. Every admitted close shares the registry release,
+    // and a storage failure still completes cleanup while only explicit close reports the failure.
+    const closeFile = (ref, op, check) => coordinated(op, Effect.andThen(check, TokenRegistry.release(ref, releaseFileInode, (action) => Effect.flatMap(Draft, (draft) => draft.afterInstall(action)))), true).pipe(Effect.tapError((error) => error.code === "VolumeBusy" ? Effect.void : releaseOpenFile(ref)));
+    const finalizeFile = (ref) => TokenRegistry.finalize(ref, closeFile(ref, OpContext.make("close"), Effect.void), releaseOpenFile(ref));
+    const acquireHandle = TokenRegistry.acquire;
+    const bindFile = (ref, ino) => Effect.flatMap(Draft, (draft) => draft.afterInstall(() => TokenRegistry.publish(ref, ino)));
     const replaceContent = Effect.fnUntraced(function* (file, data, now, publish = true) {
         const d = yield* Draft;
         yield* d.addUsedBytes(BigInt(data.length - file.data.length));
@@ -780,7 +668,8 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
     });
     const fileHandle = (ref) => {
         const get = Effect.fnUntraced(function* (op, access) {
-            const node = ref.ino === undefined ? undefined : yield* view(ref.ino);
+            const ino = TokenRegistry.inode(ref);
+            const node = ino === undefined ? undefined : yield* view(ino);
             if (node?.kind !== "file" || (access === "read" && ref.access === "write") ||
                 (access === "write" && ref.access === "read"))
                 return yield* op.fail("InvalidHandle");
@@ -835,9 +724,9 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                     return yield* writeOp.fail("FileTooLarge");
                 const start = Number(offset);
                 const draft = yield* Draft;
-                const free = settings.maxBytes === undefined
+                const free = limits.maxBytes === undefined
                     ? BigInt(maxFileBytes)
-                    : ByteSize.toBigInt(settings.maxBytes) - (yield* draft.usedBytes);
+                    : ByteSize.toBigInt(limits.maxBytes) - (yield* draft.usedBytes);
                 const maximumEnd = BigInt(file.data.length) + free;
                 const end = Number(BigInt(maxFileBytes) < maximumEnd ? BigInt(maxFileBytes) : maximumEnd);
                 const count = Math.min(bytes.length, Math.max(0, end - start));
@@ -912,33 +801,24 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             sync: coordinatedRead(syncOp, Effect.suspend(() => Effect.asVoid(get(syncOp)))).pipe(Effect.withSpan("FileHandle.sync")),
             close: closeFile(ref, closeOp, Effect.suspend(() => get(closeOp))).pipe(Effect.ensuring(closeReleasedScope(ref)), Effect.withSpan("FileHandle.close"))
         });
-        files.set(handle, ref);
+        registry.registerFile(handle, ref);
         return handle;
     };
     const createCaller = (reference, identity, umask) => {
-        const referencedNode = Effect.fnUntraced(function* (target, op) {
-            if (reference.ino === undefined)
-                return yield* op.fail("ClosedCaller");
-            if (!Predicate.isObject(target))
-                return yield* op.fail("InvalidReference");
-            const known = objectReferences.get(target);
-            if (known === undefined)
-                return yield* op.fail("InvalidReference");
-            if (known.volume !== volumeIdentity) {
-                return yield* op.fail("ForeignReference");
-            }
-            const node = yield* view(known.ino);
-            if (node === undefined || (node.kind === "directory" && node.metadata.nlink === 0)) {
-                return yield* op.fail("StaleReference");
-            }
-            return node;
-        });
-        const callerDirectory = Effect.fnUntraced(function* (op) {
-            const node = reference.ino === undefined ? undefined : yield* view(reference.ino);
-            if (node?.kind !== "directory")
-                return yield* op.fail("ClosedCaller");
-            return node;
+        const resolver = Resolution.make({
+            caller: reference,
+            get: view,
+            identity,
+            maxPathBytes: limits.maxPathBytes,
+            registry
         });
+        const prepare = resolver.prepare;
+        const prepareEntry = resolver.prepareEntry;
+        const entryName = Resolution.entryName;
+        const resolveTarget = (target, op, options) => resolver.resolve(target, { kind: "Node", ...options }, op);
+        const resolveDirectory = resolver.directory;
+        const resolveEntry = (prepared, op) => resolver.resolve(prepared, { kind: "Parent" }, op);
+        const referencedNode = (target, op) => Effect.map(resolveTarget(Target.Reference({ reference: target }), op), (resolved) => resolved.node);
         const directoryNow = Effect.fnUntraced(function* (ino) {
             const node = yield* view(ino);
             if (node?.kind !== "directory") {
@@ -1008,141 +888,6 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 revision: 0n
             };
         });
-        const lookup = Effect.fnUntraced(function* (path, base, op, options = {}, referencedBase) {
-            const pathOp = op.at(path.input);
-            const { allowMissing = false, createMissing, followFinalSymlink = true, parentOnly = false } = options;
-            if (reference.ino === undefined) {
-                return yield* pathOp.fail("ClosedCaller");
-            }
-            let current = path.absolute ? (yield* nodeNow(ROOT_INO)) : yield* callerDirectory(pathOp);
-            if (!path.absolute && referencedBase !== undefined) {
-                current = referencedBase;
-                yield* authorize(current, identity, EXECUTE, op);
-            }
-            else if (!path.absolute && base !== undefined) {
-                const target = handles.get(base);
-                if (target === undefined) {
-                    return yield* pathOp.fail("InvalidHandle");
-                }
-                if (target.volume !== volumeIdentity) {
-                    return yield* pathOp.fail("ForeignHandle");
-                }
-                const directory = target.ino === undefined ? undefined : (yield* view(target.ino));
-                if (directory?.kind !== "directory") {
-                    return yield* pathOp.fail("InvalidHandle");
-                }
-                current = directory;
-                yield* authorize(current, identity, EXECUTE, pathOp);
-            }
-            if (current.metadata.nlink === 0) {
-                return yield* pathOp.fail("NotFound");
-            }
-            let work = path;
-            let parent;
-            let name;
-            let traversals = 0;
-            // Leading components that came from a symbolic link's target. Only the components the caller wrote are
-            // created, so a dangling link stays missing, as it does for mkdir -p.
-            let linked = 0;
-            for (let index = 0; index < work.components.length - (parentOnly ? 1 : 0); index++) {
-                if (current.kind !== "directory") {
-                    return yield* pathOp.fail("NotDirectory");
-                }
-                yield* authorize(current, identity, EXECUTE, pathOp);
-                const component = work.components[index];
-                if (component === undefined)
-                    break;
-                if (component === DOT_HEX)
-                    continue;
-                if (component === DOT_DOT_HEX) {
-                    current = yield* directoryNow(current.parent);
-                    parent = undefined;
-                    name = undefined;
-                    continue;
-                }
-                parent = current;
-                name = component;
-                const childIno = current.entries.get(component);
-                const child = childIno === undefined ? undefined : (yield* view(childIno));
-                if (child === undefined) {
-                    if (allowMissing && index === work.components.length - 1) {
-                        return { node: undefined, parent, name };
-                    }
-                    if (createMissing !== undefined && index >= linked) {
-                        current = yield* createMissing(current, component, index === work.components.length - 1);
-                        continue;
-                    }
-                    return yield* pathOp.fail("NotFound");
-                }
-                if (child.kind === "symlink" && (followFinalSymlink || index < work.components.length - 1 || work.trailingSlash)) {
-                    if (child.target.length === 0) {
-                        return yield* pathOp.fail("NotFound");
-                    }
-                    if (++traversals > MAX_SYMLINK_TRAVERSALS) {
-                        return yield* pathOp.fail("SymlinkLoop");
-                    }
-                    const suffix = work.suffixes[index] ?? new Uint8Array(0);
-                    const remaining = work.components.length - index - 1;
-                    if (settings.maxPathBytes !== undefined &&
-                        ByteSize.isGreaterThan(ByteSize.bytes(child.target.length + suffix.length), settings.maxPathBytes)) {
-                        return yield* pathOp.fail("PathTooLong");
-                    }
-                    const expansion = new Uint8Array(child.target.length + suffix.length);
-                    expansion.set(child.target);
-                    expansion.set(suffix, child.target.length);
-                    const expanded = preparePath(ownedPath(expansion), op.operation, settings.maxPathBytes);
-                    // The expansion is synthetic: its per-component limits are the caller's to hear about,
-                    // but the path in the error has to be the one the caller passed in, so the
-                    // expansion's own failure is not kept as the cause.
-                    if (Result.isFailure(expanded)) {
-                        return yield* pathOp.fail(expanded.failure.code);
-                    }
-                    work = expanded.success;
-                    linked = work.components.length - remaining + Math.max(0, linked - index - 1);
-                    if (work.absolute)
-                        current = yield* nodeNow(ROOT_INO);
-                    index = -1;
-                }
-                else
-                    current = child;
-            }
-            if (!parentOnly && work.trailingSlash && current.kind !== "directory") {
-                return yield* pathOp.fail("NotDirectory");
-            }
-            return { node: current, parent, name };
-        });
-        const resolveNode = Effect.fnUntraced(function* (path, base, op, options) {
-            const pathOp = op.at(path.input);
-            const result = yield* lookup(path, base, op, options);
-            if (result.node === undefined) {
-                return yield* pathOp.fail("NotFound");
-            }
-            return result.node;
-        });
-        const locate = Effect.fnUntraced(function* (path, base, op, options) {
-            const pathOp = op.at(path.input);
-            const result = yield* lookup(path, base, op, options);
-            const node = result.node;
-            if (node === undefined) {
-                return yield* pathOp.fail("NotFound");
-            }
-            if (node.kind !== "directory") {
-                return yield* pathOp.fail("NotDirectory");
-            }
-            return node;
-        });
-        const ResolvedEntry = {
-            fromPath: Effect.fnUntraced(function* (path, base, op) {
-                const parent = yield* locate(path, base, op, { parentOnly: true });
-                return {
-                    parent: parent.ino,
-                    name: path.components.at(-1),
-                    trailingSlash: path.trailingSlash,
-                    addressing: "path",
-                    op: op.at(path.input)
-                };
-            })
-        };
         const grantedMode = (metadata, mode) => !identity.privileged && metadata.kind === "file" && !inGroup(identity, metadata.gid) ? mode & ~0o2000 : mode;
         const permittedMode = (metadata, mode, op) => !identity.privileged && identity.uid !== metadata.uid
             ? Effect.fail(op.fail("NotPermitted"))
@@ -1270,13 +1015,16 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             }
             else {
                 entryOp = op.at(prepared.path.input);
-                const resolved = yield* lookup(prepared.path, prepared.base, op, {
+                const resolved = yield* resolver.resolve(Target.Path(prepared.base === undefined
+                    ? { path: prepared.path.input }
+                    : { path: prepared.path.input, relativeTo: prepared.base }), {
+                    kind: "Node",
                     createMissing: (parent, name, final) => Effect.flatMap(makeDirectory({ parent: parent.ino, name, trailingSlash: false, addressing: "path", op: entryOp }, final ? request : { mode: request.mode, exactMode: request.exactMode }, op), (made) => {
                         if (!revisionsBefore.has(parent.ino))
                             revisionsBefore.set(parent.ino, made.directory.before);
                         return directoryNow(made.child);
                     })
-                });
+                }, op);
                 node = resolved.node;
             }
             if (node?.kind !== "directory")
@@ -1545,9 +1293,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             const ino = opened();
             if (ino === undefined)
                 return;
-            const draft = yield* Draft;
-            yield* draft.release(ino);
-            yield* reclaim(draft, ino);
+            yield* releaseFileInode(ino);
         });
         const acquireOpenedFile = (ref, op, acquire) => {
             let opened;
@@ -1555,75 +1301,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 opened = ino;
             }), releasePending(() => opened), finalizeFile(ref));
         };
-        const prepare = (input, op) => preparePath(input, op.operation, settings.maxPathBytes);
-        const handleNode = Effect.fnUntraced(function* (handle, op) {
-            if (reference.ino === undefined)
-                return yield* op.fail("ClosedCaller");
-            const ref = isFileHandle(handle) ? files.get(handle) : handles.get(handle);
-            if (ref === undefined)
-                return yield* op.fail("InvalidHandle");
-            if (ref.volume !== volumeIdentity)
-                return yield* op.fail("ForeignHandle");
-            const node = ref.ino === undefined ? undefined : (yield* view(ref.ino));
-            if (node === undefined)
-                return yield* op.fail("InvalidHandle");
-            return node;
-        });
-        // A path prepares before the walk, so a malformed input fails before any lookup, and names the path on
-        // every failure. A reference or handle names none. The verb's `followFinalSymlink` is the default a
-        // path's own setting overrides; `final` makes the verb's setting win, for a verb such as `readLink` whose
-        // meaning fixes it.
-        const resolveTarget = (target, op, options) => Target.$match(target, {
-            Path: ({ followFinalSymlink, path, relativeTo }) => Effect.flatMap(Effect.fromResult(prepare(path, op)), (prepared) => Effect.map(resolveNode(prepared, relativeTo, op, {
-                followFinalSymlink: options?.final === true
-                    ? options.followFinalSymlink ?? true
-                    : followFinalSymlink ?? options?.followFinalSymlink ?? true
-            }), (node) => ({ node, op: op.at(path) }))),
-            Reference: ({ reference }) => Effect.map(referencedNode(reference, op), (node) => ({ node, op })),
-            Handle: ({ handle }) => Effect.map(handleNode(handle, op), (node) => ({ node, op }))
-        });
-        const resolveDirectory = Effect.fnUntraced(function* (target, op) {
-            const resolved = yield* resolveTarget(target, op);
-            if (resolved.node.kind !== "directory")
-                return yield* resolved.op.fail("NotDirectory");
-            return { node: resolved.node, op: resolved.op };
-        });
-        // The directory an entry names a child of. A removed directory that a handle still holds takes no new
-        // children, as on Linux, where creating through a descriptor of a removed directory fails with ENOENT.
-        const entryDirectory = Effect.fnUntraced(function* (target, op) {
-            const directory = yield* resolveDirectory(target, op);
-            if (directory.node.metadata.nlink === 0)
-                return yield* directory.op.fail("NotFound");
-            return directory;
-        });
         const asResolvedNode = (target, op, options) => Effect.map(resolveTarget(target, op, options), (resolved) => ({ ino: resolved.node.ino, op: resolved.op }));
-        const entryName = (input, op) => {
-            if (Predicate.isString(input) && !isWellFormed(input))
-                return Result.fail(op.fail("InvalidPathEncoding"));
-            const bytes = Predicate.isString(input) ? encoder.encode(input) : input;
-            if (!isAttachedBytes(bytes) || bytes.length === 0 || bytes.length > MAX_NAME_BYTES || bytes.includes(0) ||
-                bytes.includes(SLASH_BYTE))
-                return Result.fail(op.fail("InvalidArgument"));
-            return Result.succeed(Hex.encode(new Uint8Array(bytes)));
-        };
-        const prepareEntry = (input, op) => isEntry(input)
-            ? Result.map(entryName(input.name, op), (name) => ({ kind: "entry", directory: input.directory, name }))
-            : isTarget(input)
-                ? Result.map(prepare(input.path, op), (path) => ({ kind: "path", path, base: input.relativeTo }))
-                : Result.map(prepare(input, op), (path) => ({ kind: "path", path, base: undefined }));
-        const resolveEntry = Effect.fnUntraced(function* (prepared, op) {
-            if (prepared.kind === "path") {
-                return yield* ResolvedEntry.fromPath(prepared.path, prepared.base, op);
-            }
-            const directory = yield* entryDirectory(prepared.directory, op);
-            return {
-                parent: directory.node.ino,
-                name: prepared.name,
-                trailingSlash: false,
-                addressing: "entry",
-                op
-            };
-        });
         const asTarget = (input) => Target.of(input);
         const acquireDirectory = Effect.fnUntraced(function* (input, op) {
             const target = asTarget(input);
@@ -1632,7 +1310,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 const directory = yield* resolveDirectory(target, op);
                 yield* authorize(directory.node, identity, EXECUTE, directory.op);
                 holdDirectory(directory.node.ino);
-                acquired.ino = directory.node.ino;
+                TokenRegistry.publish(acquired, directory.node.ino);
                 return acquired;
             }), 
             // Nothing to undo here: the finalizer that follows an interrupted acquisition releases the hold under
@@ -1655,29 +1333,16 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             const follow = target.followFinalSymlink ?? true;
             return yield* acquireOpenedFile(acquired, op, (opened) => Effect.gen(function* () {
                 const path = yield* Effect.fromResult(prepared);
-                if (chosen.create === "exclusive") {
-                    const existing = yield* Effect.result(lookup(path, target.relativeTo, op, { followFinalSymlink: false }));
-                    if (Result.isSuccess(existing))
-                        return yield* pathOp.fail("AlreadyExists");
-                    if (existing.failure.code !== "NotFound")
-                        return yield* existing.failure;
-                }
-                const resolved = yield* lookup(path, target.relativeTo, op, {
-                    followFinalSymlink: follow,
-                    allowMissing: chosen.create === "ifMissing" || chosen.create === "exclusive"
-                });
-                const parent = resolved.parent;
-                if (parent === undefined)
-                    return yield* pathOp.fail("IsDirectory");
-                const name = resolved.name;
-                if (isDotComponent(name))
-                    return yield* pathOp.fail("IsDirectory");
-                if (resolved.node === undefined && path.trailingSlash)
+                const resolved = yield* resolver.resolve({ kind: "path", path, base: target.relativeTo }, {
+                    kind: "OrCreate",
+                    create: chosen.create ?? "never",
+                    finalSymlink: follow ? "follow" : "preserve"
+                }, op);
+                const { parent, name } = resolved;
+                if (resolved.kind === "missing" && path.trailingSlash)
                     return yield* pathOp.fail("IsDirectory");
                 yield* authorize(parent, identity, EXECUTE, pathOp);
-                const file = resolved.node;
-                if (file !== undefined && chosen.create === "exclusive")
-                    return yield* pathOp.fail("AlreadyExists");
+                const file = resolved.kind === "existing" ? resolved.node : undefined;
                 const result = yield* openFile({ parent: parent.ino, name, trailingSlash: path.trailingSlash, addressing: "path", op: pathOp }, file, chosen, acquired, op);
                 opened(result.ino);
                 return fileHandle(acquired);
@@ -1719,60 +1384,44 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             }
             if (chosen.exactMode && chosen.mode === undefined)
                 return yield* op.fail("InvalidArgument");
-            const relativePath = preparePath(ownedPath(nameBytes(name)), op.operation, undefined);
             const acquired = makeFileReference(chosen.access, chosen.append ?? false);
             const expected = chosen.expected;
             return yield* acquireOpenedFile(acquired, op, (opened) => Effect.gen(function* () {
-                const parent = (yield* entryDirectory(entry.directory, op)).node;
-                if (isDotComponent(name))
-                    return yield* op.fail("InvalidArgument");
-                yield* authorize(parent, identity, EXECUTE, op);
-                const directIno = parent.entries.get(name);
-                const direct = directIno === undefined ? undefined : (yield* view(directIno));
-                if (expected !== undefined) {
-                    let expectedIno;
-                    if (expected !== null) {
-                        const observed = yield* Effect.result(referencedNode(expected, op));
-                        if (Result.isFailure(observed)) {
-                            return yield* op.fail("VolumeBusy", { cause: observed.failure });
+                const resolved = yield* resolver.resolve({ kind: "entry", directory: entry.directory, name }, {
+                    kind: "OrCreate",
+                    create: chosen.create ?? "never",
+                    finalSymlink: chosen.followFinalSymlink !== false ? "follow" : "preserve",
+                    beforeFollow: Effect.fnUntraced(function* (_, direct) {
+                        if (expected !== undefined) {
+                            let expectedIno;
+                            if (expected !== null) {
+                                const observed = yield* Effect.result(referencedNode(expected, op));
+                                if (Result.isFailure(observed)) {
+                                    return yield* op.fail("VolumeBusy", { cause: observed.failure });
+                                }
+                                expectedIno = observed.success.ino;
+                            }
+                            if (direct?.ino !== expectedIno)
+                                return yield* op.fail("VolumeBusy");
                         }
-                        expectedIno = observed.success.ino;
-                    }
-                    if (direct?.ino !== expectedIno)
-                        return yield* op.fail("VolumeBusy");
-                }
-                if (chosen.expectedChild === null) {
-                    if (direct !== undefined)
-                        return yield* op.fail("StaleReference");
-                }
-                else if (chosen.expectedChild !== undefined) {
-                    const expectedChild = chosen.expectedChild;
-                    const observed = yield* referencedNode(expectedChild.reference, op);
-                    if (direct?.ino !== observed.ino || observed.revision !== expectedChild.revision ||
-                        observed.metadata.atimeNs !== expectedChild.atimeNs ||
-                        observed.metadata.mtimeNs !== expectedChild.mtimeNs) {
-                        return yield* op.fail("StaleReference");
-                    }
-                }
-                if (direct !== undefined && chosen.create === "exclusive")
-                    return yield* op.fail("AlreadyExists");
-                let file = direct;
-                let mutationParent = parent.ino;
-                let mutationName = name;
-                if (file?.kind === "symlink" && chosen.followFinalSymlink !== false) {
-                    const resolved = yield* lookup(yield* Effect.fromResult(relativePath), undefined, op, {
-                        followFinalSymlink: true,
-                        allowMissing: chosen.create === "ifMissing" || chosen.create === "exclusive"
-                    }, parent);
-                    file = resolved.node;
-                    if (file === undefined) {
-                        if (resolved.parent === undefined || resolved.name === undefined) {
-                            return yield* op.fail("IsDirectory");
+                        if (chosen.expectedChild === null) {
+                            if (direct !== undefined)
+                                return yield* op.fail("StaleReference");
                         }
-                        mutationParent = resolved.parent.ino;
-                        mutationName = resolved.name;
-                    }
-                }
+                        else if (chosen.expectedChild !== undefined) {
+                            const expectedChild = chosen.expectedChild;
+                            const observed = yield* referencedNode(expectedChild.reference, op);
+                            if (direct?.ino !== observed.ino || observed.revision !== expectedChild.revision ||
+                                observed.metadata.atimeNs !== expectedChild.atimeNs ||
+                                observed.metadata.mtimeNs !== expectedChild.mtimeNs) {
+                                return yield* op.fail("StaleReference");
+                            }
+                        }
+                    })
+                }, op);
+                const file = resolved.kind === "existing" ? resolved.node : undefined;
+                const mutationParent = resolved.kind === "missing" ? resolved.parent.ino : resolved.origin.parent.ino;
+                const mutationName = resolved.kind === "missing" ? resolved.name : resolved.origin.name;
                 const result = yield* openFile({ parent: mutationParent, name: mutationName, trailingSlash: false, addressing: "entry", op }, file, { ...chosen, initialSize: chosen.initialSize ?? 0n }, acquired, op);
                 opened(result.ino);
                 return {
@@ -1828,7 +1477,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             const prepared = prepare(target.path, op);
             if (Result.isFailure(prepared))
                 return Effect.undefined;
-            return ResolvedEntry.fromPath(prepared.success, target.relativeTo, op).pipe(Effect.flatMap((entry) => Effect.map(view(entry.parent), (parent) => {
+            return resolveEntry({ kind: "path", path: prepared.success, base: target.relativeTo }, op).pipe(Effect.flatMap((entry) => Effect.map(view(entry.parent), (parent) => {
                 return entry.name !== undefined && parent?.kind === "directory" &&
                     parent.entries.get(entry.name) === root.ino
                     ? anchorFrame(parent, entry.name, root)
@@ -1868,27 +1517,23 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             let bytes = 0n;
             let failure;
             const list = (frame) => coordinatedRead(op, Effect.suspend(() => {
-                if (reference.ino === undefined)
+                if (TokenRegistry.inode(reference) === undefined)
                     return Effect.fail(op.fail("ClosedCaller"));
                 const at = op.at(locate(frame.path));
                 return Effect.flatMap(reachFrame(frame, at), (node) => node?.kind !== "directory" || node.metadata.nlink === 0
                     ? Effect.succeed([])
                     : Effect.andThen(listable(node, at), walkChildren(node, frame.path, frame.depth, frame)));
             }));
-            const exceeded = (frame, field) => makeError({ code: "LimitExceeded", operation: op.operation, field, path: errorPath(locate(frame.path)) });
             const admit = (frame) => {
-                if (plan.maxDepth !== undefined && frame.depth > plan.maxDepth)
-                    return exceeded(frame, "maxDepth");
-                if (plan.maxEntries !== undefined && ++entries > plan.maxEntries)
-                    return exceeded(frame, "maxEntries");
+                entries++;
                 bytes += frame.bytes;
-                if (plan.maxBytes !== undefined && bytes > plan.maxBytes)
-                    return exceeded(frame, "maxBytes");
-                return undefined;
+                return plan.limit(frame, { entries, bytes }, "entry");
             };
             const step = Effect.gen(function* () {
+                // Preserve the generic limit error E; yielding the error directly widens it to WalkFailure.
+                // oxlint-disable-next-line effecttsgo/unnecessary-fail-yieldable-error -- E must stay narrow for unbounded removal.
                 if (failure !== undefined)
-                    return yield* failure;
+                    return yield* Effect.fail(failure);
                 if (pending === undefined)
                     pending = (yield* first).reverse();
                 const out = [];
@@ -1910,9 +1555,9 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                         out.push(frame);
                     }
                     if (unlisted) {
-                        if (plan.maxDepth !== undefined && frame.depth > plan.maxDepth) {
-                            return yield* stop(exceeded(frame, "maxDepth"));
-                        }
+                        const rejected = plan.limit(frame, { entries, bytes }, "directory");
+                        if (rejected !== undefined)
+                            return yield* stop(rejected);
                         const listed = yield* Effect.result(list(frame));
                         if (Result.isFailure(listed))
                             return yield* stop(listed.failure);
@@ -1976,7 +1621,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                         }, op));
                 })));
             };
-            const plan = { order: "post", maxDepth: undefined, maxEntries: undefined, maxBytes: undefined };
+            const plan = { order: "post", limit: () => undefined };
             return yield* Stream.runForEach(walkFrames(op, first, plan, locate, listable), removeFrame);
         });
         const rootOp = OpContext.make("root");
@@ -1985,9 +1630,40 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             const prepared = yield* Effect.fromResult(prepareEntry(input, op));
             return yield* coordinated(op, Effect.flatMap(resolveEntry(prepared, op), (entry) => body(entry, op)));
         });
+        const openDispatch = Effect.fn("Caller.open")(function* (input, options) {
+            const op = OpContext.make("open");
+            if (isEntry(input))
+                return yield* openEntry(input, options, op);
+            const target = asTarget(input);
+            if (Target.$is("Path")(target))
+                return yield* openPath(target, options, op);
+            return yield* openNode(target, options, op);
+        });
+        function open(input, options) {
+            return openDispatch(input, options);
+        }
+        const removeDispatch = Effect.fn("Caller.remove")(function* (input, options) {
+            const op = OpContext.make("remove");
+            const prepared = yield* Effect.fromResult(prepareEntry(input, op));
+            const chosen = yield* decodeRemoveOptions(options ?? {}).pipe(Effect.mapError((cause) => fail(preparedOp(prepared, op), cause)));
+            const once = coordinated(op, Effect.flatMap(resolveEntry(prepared, op), (entry) => removeEntry(entry, op)));
+            const target = (effect) => chosen.force === true
+                ? Effect.catchIf(effect, (error) => error.code === "NotFound", () => Effect.undefined)
+                : effect;
+            const removed = yield* Effect.result(target(once));
+            if (Result.isSuccess(removed))
+                return removed.success;
+            if (chosen.recursive !== true || removed.failure.code !== "NotEmpty")
+                return yield* removed.failure;
+            yield* emptyDirectory(prepared, op, chosen.force === true);
+            return yield* target(once);
+        });
+        function remove(input, options) {
+            return removeDispatch(input, options);
+        }
         const caller = Object.freeze({
             [CallerId]: true,
-            root: coordinatedRead(rootOp, Effect.suspend(() => reference.ino === undefined
+            root: coordinatedRead(rootOp, Effect.suspend(() => TokenRegistry.inode(reference) === undefined
                 ? Effect.fail(rootOp.fail("ClosedCaller"))
                 : Effect.succeed(referenceFor(ROOT_INO)))).pipe(Effect.withSpan("Caller.root")),
             lookup: Effect.fn("Caller.lookup")(function* (input) {
@@ -2044,11 +1720,20 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                         yield* authorize(directory.node, identity, READ, directory.op);
                         return yield* walkChildren(directory.node, new Uint8Array(0), 0, yield* pathAnchor(target, directory.node, op));
                     }));
+                    const exceeded = (frame, field) => makeError({ code: "LimitExceeded", operation: op.operation, field, path: errorPath(locate(frame.path)) });
+                    const maxBytes = chosen.maxBytes === undefined ? undefined : ByteSize.toBigInt(chosen.maxBytes);
                     const plan = {
                         order: chosen.order ?? "pre",
-                        maxDepth: chosen.maxDepth,
-                        maxEntries: chosen.maxEntries,
-                        maxBytes: chosen.maxBytes === undefined ? undefined : ByteSize.toBigInt(chosen.maxBytes)
+                        limit: (frame, progress, phase) => {
+                            if (chosen.maxDepth !== undefined && frame.depth > chosen.maxDepth)
+                                return exceeded(frame, "maxDepth");
+                            if (phase === "directory")
+                                return undefined;
+                            if (chosen.maxEntries !== undefined && progress.entries > chosen.maxEntries) {
+                                return exceeded(frame, "maxEntries");
+                            }
+                            return maxBytes !== undefined && progress.bytes > maxBytes ? exceeded(frame, "maxBytes") : undefined;
+                        }
                     };
                     return Stream.map(walkFrames(op, first, plan, locate, readable), (frame) => Object.freeze({
                         path: ownedPath(frame.path),
@@ -2076,12 +1761,16 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 return yield* coordinatedRead(op, Effect.gen(function* () {
                     if (Target.$is("Path")(target)) {
                         const pathOp = op.at(target.path);
-                        const result = yield* lookup(yield* Effect.fromResult(prepare(target.path, op)), target.relativeTo, op);
-                        const directory = result.node?.kind === "directory" ? result.node : result.parent;
+                        const result = yield* resolveTarget(target, op, { final: true });
+                        const directory = result.node.kind === "directory"
+                            ? result.node
+                            : result.kind === "entry"
+                                ? result.parent
+                                : undefined;
                         const prefix = directory === undefined ? SLASH_HEX : yield* pathOfCurrent(directory.ino);
                         if (prefix === undefined)
                             return yield* pathOp.fail("NotFound");
-                        if (result.node?.kind === "directory" || result.name === undefined)
+                        if (result.node.kind === "directory" || result.kind === "node")
                             return ownedPath(nameBytes(prefix));
                         return ownedPath(nameBytes(prefix + (prefix === SLASH_HEX ? "" : SLASH_HEX) + result.name));
                     }
@@ -2136,66 +1825,19 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 const captured = new Uint8Array(bytes);
                 const chosen = yield* decodeWriteFileOptions(options).pipe(Effect.mapError((cause) => fail(optionsOp, cause)));
                 return yield* coordinated(op, Effect.gen(function* () {
-                    let entryOp = op;
-                    let parent;
-                    let name;
-                    let found;
-                    let trailingSlash = false;
-                    if (prepared.kind === "path") {
-                        const path = prepared.path;
-                        entryOp = op.at(path.input);
-                        if (chosen.create === "exclusive") {
-                            const exists = yield* Effect.result(lookup(path, prepared.base, op, { followFinalSymlink: false }));
-                            if (Result.isSuccess(exists))
-                                return yield* entryOp.fail("AlreadyExists");
-                            if (exists.failure.code !== "NotFound")
-                                return yield* exists.failure;
-                        }
-                        const resolved = yield* lookup(path, prepared.base, op, {
-                            followFinalSymlink: chosen.replaceFinalSymlink !== true && chosen.followFinalSymlink !== false,
-                            allowMissing: chosen.create === "ifMissing" || chosen.create === "exclusive"
-                        });
-                        if (resolved.parent === undefined || resolved.name === undefined || resolved.node?.kind === "directory") {
-                            return yield* entryOp.fail("IsDirectory");
-                        }
-                        parent = resolved.parent;
-                        name = resolved.name;
-                        found = resolved.node;
-                        trailingSlash = path.trailingSlash;
-                    }
-                    else {
-                        const directory = yield* entryDirectory(prepared.directory, op);
-                        if (isDotComponent(prepared.name))
-                            return yield* op.fail("InvalidArgument");
-                        yield* authorize(directory.node, identity, EXECUTE, op);
-                        parent = directory.node;
-                        name = prepared.name;
-                        const childIno = parent.entries.get(name);
-                        let child = childIno === undefined ? undefined : (yield* view(childIno));
-                        if (child?.kind === "symlink" && chosen.replaceFinalSymlink !== true &&
-                            chosen.followFinalSymlink !== false) {
-                            const resolved = yield* lookup(yield* Effect.fromResult(preparePath(ownedPath(nameBytes(name)), op.operation, undefined)), undefined, op, {
-                                followFinalSymlink: true,
-                                allowMissing: chosen.create === "ifMissing" || chosen.create === "exclusive"
-                            }, parent);
-                            if (resolved.parent === undefined || resolved.name === undefined || resolved.node?.kind === "directory") {
-                                return yield* op.fail("IsDirectory");
-                            }
-                            parent = resolved.parent;
-                            name = resolved.name;
-                            child = resolved.node;
-                        }
-                        if (child === undefined && (chosen.create === undefined || chosen.create === "never")) {
-                            return yield* op.fail("NotFound");
-                        }
-                        if (child !== undefined && chosen.create === "exclusive")
-                            return yield* op.fail("AlreadyExists");
-                        if (child?.kind === "directory")
-                            return yield* op.fail("IsDirectory");
-                        found = child;
-                    }
-                    if (found === undefined && trailingSlash)
+                    const resolved = yield* resolver.resolve(prepared, {
+                        kind: "OrCreate",
+                        create: chosen.create ?? "never",
+                        finalSymlink: chosen.replaceFinalSymlink !== true && chosen.followFinalSymlink !== false
+                            ? "follow"
+                            : "preserve",
+                        entryExclusive: "afterSymlink"
+                    }, op);
+                    const { parent, name, trailingSlash, op: entryOp } = resolved;
+                    const found = resolved.kind === "existing" ? resolved.node : undefined;
+                    if (found?.kind === "directory" || (found === undefined && trailingSlash)) {
                         return yield* entryOp.fail("IsDirectory");
+                    }
                     const replaced = found?.kind === "symlink" ? found : undefined;
                     if (replaced !== undefined && !chosen.replaceFinalSymlink)
                         return yield* entryOp.fail("SymlinkLoop");
@@ -2260,17 +1902,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                     }
                 }));
             }),
-            // SAFETY: the overloads pair an entry with entry options and a target with open options; the decoders below
-            // reject the other shape, so one implementation serves both.
-            open: Effect.fn("Caller.open")(function* (input, options) {
-                const op = OpContext.make("open");
-                if (isEntry(input))
-                    return yield* openEntry(input, options, op);
-                const target = asTarget(input);
-                if (Target.$is("Path")(target))
-                    return yield* openPath(target, options, op);
-                return yield* openNode(target, options, op);
-            }),
+            open,
             mkdir: Effect.fn("Caller.mkdir")(function* (input, options = {}) {
                 const op = OpContext.make("mkdir");
                 const prepared = yield* Effect.fromResult(prepareEntry(input, op));
@@ -2328,23 +1960,7 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
             rmdir: Effect.fn("Caller.rmdir")(function* (input) {
                 return yield* entryVerb("rmdir", input, rmdirEntry);
             }),
-            // SAFETY: the overloads differ only in whether `force` may leave nothing removed; one body serves both.
-            remove: Effect.fn("Caller.remove")(function* (input, options) {
-                const op = OpContext.make("remove");
-                const prepared = yield* Effect.fromResult(prepareEntry(input, op));
-                const chosen = yield* decodeRemoveOptions(options ?? {}).pipe(Effect.mapError((cause) => fail(preparedOp(prepared, op), cause)));
-                const once = coordinated(op, Effect.flatMap(resolveEntry(prepared, op), (entry) => removeEntry(entry, op)));
-                const target = (effect) => chosen.force === true
-                    ? Effect.catchIf(effect, (error) => error.code === "NotFound", () => Effect.undefined)
-                    : effect;
-                const removed = yield* Effect.result(target(once));
-                if (Result.isSuccess(removed))
-                    return removed.success;
-                if (chosen.recursive !== true || removed.failure.code !== "NotEmpty")
-                    return yield* removed.failure;
-                yield* emptyDirectory(prepared, op, chosen.force === true);
-                return yield* target(once);
-            }),
+            remove,
             rename: Effect.fn("Caller.rename")(function* (fromInput, toInput) {
                 const op = OpContext.make("rename");
                 const from = yield* Effect.fromResult(prepareEntry(fromInput, op));
@@ -2418,19 +2034,20 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
                 const handle = Object.freeze({
                     [DirectoryHandleId]: true,
                     stat: coordinatedRead(statOp, Effect.gen(function* () {
-                        const node = acquired.ino === undefined ? undefined : yield* view(acquired.ino);
+                        const ino = TokenRegistry.inode(acquired);
+                        const node = ino === undefined ? undefined : yield* view(ino);
                         return yield* (node === undefined
                             ? Effect.fail(statOp.fail("InvalidHandle"))
                             : Effect.succeed(withMetadata(node)));
                     })).pipe(Effect.withSpan("DirectoryHandle.stat")),
                     close: coordinatedCleanup(Effect.suspend(() => {
-                        if (acquired.ino === undefined) {
+                        if (TokenRegistry.inode(acquired) === undefined) {
                             return Effect.fail(OpContext.make("close").fail("InvalidHandle"));
                         }
                         return releaseDirectory(acquired);
                     })).pipe(Effect.ensuring(closeReleasedScope(acquired)), Effect.withSpan("DirectoryHandle.close"))
                 });
-                handles.set(handle, acquired);
+                registry.registerDirectory(handle, acquired);
                 return handle;
             })
         });
@@ -2461,32 +2078,27 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         snapshot: coordinatedRead(OpContext.make("snapshot"), Effect.sync(() => Image.make(state))).pipe(Effect.withSpan("Volume.snapshot")),
         referenceKey: Effect.fn("Volume.referenceKey")(function* (reference) {
             const op = OpContext.make("referenceKey");
-            return yield* coordinatedRead(op, Effect.suspend(() => {
-                const known = Predicate.isObject(reference) ? objectReferences.get(reference) : undefined;
-                if (known === undefined)
-                    return Effect.fail(op.fail("InvalidReference"));
-                if (known.volume !== volumeIdentity)
-                    return Effect.fail(op.fail("ForeignReference"));
-                if (!addressable(known.ino))
-                    return Effect.fail(op.fail("StaleReference"));
-                const ino = BigInt(known.ino);
-                return Effect.succeed({ identity: identityBytes.slice(), epoch: epochBytes.slice(), ino, tag: keyTag(ino) });
+            return yield* coordinatedRead(op, Effect.gen(function* () {
+                const node = yield* TokenRegistry.nodeOrFail(yield* registry.resolve(reference, "reference"), "reference", op);
+                const ino = BigInt(node.ino);
+                return { identity: identityBytes.slice(), epoch: epochBytes.slice(), ino, tag: keyTag(ino) };
             }));
         }),
         resolveReferenceKey: Effect.fn("Volume.resolveReferenceKey")(function* (key) {
             const op = OpContext.make("resolveReferenceKey");
-            return yield* coordinatedRead(op, Effect.suspend(() => {
+            return yield* coordinatedRead(op, Effect.gen(function* () {
                 if (!Schema.is(ReferenceKey)(key))
-                    return Effect.fail(op.fail("InvalidReference"));
+                    return yield* op.fail("InvalidReference");
                 // Another epoch numbered its objects on its own, so its key is another volume's even under this identity.
                 if (!sameBytes(key.identity, identityBytes) || !sameBytes(key.epoch, epochBytes)) {
-                    return Effect.fail(op.fail("ForeignReference"));
+                    return yield* op.fail("ForeignReference");
                 }
                 // Checked before the inode is looked up, so a guessed key learns nothing about which numbers are in use.
                 if (!sameTag(key.tag, keyTag(key.ino)))
-                    return Effect.fail(op.fail("InvalidReference"));
+                    return yield* op.fail("InvalidReference");
                 const ino = Ino(Number(key.ino));
-                return addressable(ino) ? Effect.succeed(referenceFor(ino)) : Effect.fail(op.fail("StaleReference"));
+                yield* TokenRegistry.nodeOrFail(yield* registry.resolveInode(ino), "reference", op);
+                return referenceFor(ino);
             }));
         }),
         caller: Effect.fn("Volume.caller")(function* (options) {
@@ -2500,47 +2112,37 @@ export const makeVolume = Effect.fnUntraced(function* (source, options, commitPr
         changes: coordinatedRead(OpContext.make("changes"), Effect.suspend(() => observeChanges(state))),
         capture: coordinatedRead(OpContext.make("capture"), captureState())
     });
-    return Object.freeze({ volume, shutdown, initialImage, observe });
+    return Object.freeze({ volume, shutdown, observe });
 });
 /** @internal */
 export const make = Effect.fn("VirtualFileSystem.make")(function* (options) {
-    return (yield* makeVolume(VolumeSource.Empty(), options).pipe(Effect.catchIf((error) => Schema.is(VfsError)(error) && error.code !== "InvalidArgument", Effect.die))).volume;
+    return (yield* makeVolume(VolumeSource.Empty(), memoryCommitProvider, options).pipe(Effect.catchIf((error) => Schema.is(VfsError)(error) && error.code !== "InvalidArgument", Effect.die))).volume;
 });
 /** @internal */
 export const prepareEmptyLiveImage = Effect.fnUntraced(function* (options) {
-    const { initialImage } = yield* Effect.mapError(makeVolume(VolumeSource.Empty(), options, undefined, LiveImage.encode), (error) => retargetFailure("prepareEmptyImage", error));
-    if (initialImage === undefined)
-        return yield* imageFailure("openImage", "InvalidStructure", { field: "liveImage" });
-    return initialImage;
+    const decoded = yield* Effect.fromResult(Limits.configuration(options, "prepareEmptyImage"));
+    const limits = decoded.limits;
+    const identity = decoded.identity ?? VolumeIdentity.make(yield* randomHex128);
+    const epoch = VolumeEpoch.make(yield* randomHex128);
+    const keySecret = KeySecret.make(yield* randomHex128);
+    const now = yield* Clock.currentTimeNanos;
+    if (!isTimestamp(now))
+        return yield* argumentFailure("prepareEmptyImage", "clock.currentTimeNanos");
+    return yield* LiveImage.encode(emptyState(now), { identity, epoch, keySecret }, limits).pipe(Effect.mapError((error) => retargetFailure("prepareEmptyImage", error)));
 });
 /** @internal */
-export const openImageVolume = Effect.fnUntraced(function* (image, maxImageBytes, commit, durability = "memory-only") {
+export const openImageVolume = Effect.fnUntraced(function* (image, maxImageBytes, commit, durability = "memory-only", options) {
     const restored = yield* LiveImage.decode(image, maxImageBytes);
-    let prepared;
-    const { limits: stored } = restored;
-    const commitOp = OpContext.make("commit");
-    const limits = {
-        maxEntries: stored.maxEntries,
-        maxBytes: stored.maxBytes === undefined ? undefined : ByteSize.bytes(stored.maxBytes),
-        maxFileBytes: ByteSize.bytes(stored.maxFileBytes ?? MAX_FILE_BYTES),
-        maxPathBytes: stored.maxPathBytes === undefined ? undefined : ByteSize.bytes(stored.maxPathBytes),
-        maxPendingOperations: 64,
-        maxWatchEvents: 256
+    const requested = yield* Effect.fromResult(Limits.fromOptions(options, "openImage"));
+    const limits = yield* Effect.fromResult(Limits.fromStored(restored.limits, requested));
+    const provider = {
+        mode: "durable",
+        shutdown: Effect.void,
+        commit: (candidate) => LiveImage.encode(candidate, restored, limits).pipe(Effect.mapError((cause) => makeError({ code: "StorageRejected", operation: "commit", cause })), Effect.flatMap((bytes) => ByteSize.isGreaterThan(ByteSize.bytes(bytes.length), maxImageBytes)
+            ? Effect.fail(makeError({ code: "StorageRejected", operation: "commit" }))
+            : commit(bytes)))
     };
-    const { volume, shutdown } = yield* makeVolume(VolumeSource.Live({ restored }), undefined, {
-        prepare: (candidate) => LiveImage.encode(candidate, restored, limits).pipe(Effect.mapError((cause) => commitOp.fail("StorageRejected", { cause })), Effect.flatMap((bytes) => ByteSize.isGreaterThan(ByteSize.bytes(bytes.length), maxImageBytes)
-            ? commitOp.fail("StorageRejected")
-            : Effect.sync(() => {
-                prepared = bytes;
-            }))),
-        commit: () => Effect.suspend(() => {
-            const bytes = prepared;
-            prepared = undefined;
-            return bytes === undefined ? Effect.succeed("unknown") : commit(bytes);
-        })
-    }, undefined, durability);
-    if (shutdown === undefined)
-        return yield* imageFailure("openImage", "InvalidStructure", { field: "liveImage" });
+    const { volume, shutdown } = yield* makeVolume(VolumeSource.Live({ restored }), provider, options, durability);
     return Object.freeze({ volume, shutdown });
 });
 /** @internal */
@@ -2553,12 +2155,12 @@ const changeOptions = (options) => {
 };
 /** @internal */
 export const fromSnapshot = Effect.fn("VirtualFileSystem.fromSnapshot")(function* (snapshot, options) {
-    return (yield* makeVolume(VolumeSource.Restored({ value: yield* Image.valueOf(snapshot) }), options)).volume;
+    return (yield* makeVolume(VolumeSource.Restored({ value: yield* Image.valueOf(snapshot) }), memoryCommitProvider, options)).volume;
 }, Effect.mapError((error) => retargetFailure("fromSnapshot", error)));
 /** @internal */
 export const makeOverlay = Effect.fn("VirtualFileSystem.makeOverlay")(function* (base, options) {
     const value = yield* Image.valueOf(base);
-    const made = yield* Effect.mapError(makeVolume(VolumeSource.Restored({ value }), options), (error) => retargetFailure("makeOverlay", error));
+    const made = yield* Effect.mapError(makeVolume(VolumeSource.Restored({ value }), memoryCommitProvider, options), (error) => retargetFailure("makeOverlay", error));
     const baseObservation = yield* observeChanges(value);
     const overlay = Object.freeze({
         ...made.volume,