@nimbus-sh/worker 0.10.0 → 0.11.0

package/dist/runtime/node-shims.js

@@ -41,17 +41,23 @@
 import { generateStreamsCode } from '@nimbus-sh/core/runtime/streams.js';
 import { generateSqliteShimCode } from './sqlite-shim.js';
 import { generateUndiciShimCode } from '@nimbus-sh/core/runtime/undici-shim.js';
+import { MK_COMPILED_FN_SOURCE } from '@nimbus-sh/core/_shared/compiled-fn.js';
 import { getExportsResolverJS } from '@nimbus-sh/core/_shared/exports-resolver.js';
+import { ESM_RESOLVER_PREAMBLE } from '../loaders/generated-workers.js';
 import { getTypescriptSpecifiersJS } from '@nimbus-sh/core/_shared/typescript-specifiers.js';
 import { NIMBUS_AI_CREDENTIAL_HEADERS, NIMBUS_AI_TOKEN_ENV } from '@nimbus-sh/core/_shared/ai-egress.js';
 import { MAX_RPC_SAFE_PAYLOAD_BYTES } from '@nimbus-sh/platform/limits.js';
 import { FACET_PROVIDED_PACKAGES, FS_READ_BATCH_PATH_LIMIT, FS_READ_BATCH_REQUEST_BYTES, NIMBUS_AI_GATEWAY_PORT, NODE_VERSION, NODE_VERSIONS, VFS_CAPACITY, } from '@nimbus-sh/core/constants.js';
+import { PACKAGE_ABI_POLICY } from '../facets/wasm-swap-registry.js';
 const STREAMS_CODE = generateStreamsCode();
 const SQLITE_SHIM_CODE = generateSqliteShimCode();
 const UNDICI_SHIM_CODE = generateUndiciShimCode();
 const FACET_PROVIDED_PACKAGES_LITERAL = JSON.stringify(FACET_PROVIDED_PACKAGES);
 const EXPORTS_RESOLVER_JS = getExportsResolverJS();
 const TYPESCRIPT_SPECIFIERS_JS = getTypescriptSpecifiersJS();
+// One module-cell compile for every facet (core/_shared/compiled-fn.ts).
+// Interpolated into the emitted shim below as ${COMPILED_FN_JS}.
+const COMPILED_FN_JS = MK_COMPILED_FN_SOURCE;
 // Node version fingerprint. Single source of truth in constants.ts.
 // Interpolated as JS literals into the emitted process shim. See
 // constants.ts for the rationale (create-astro preflight, etc.).
@@ -62,15 +68,43 @@ const NODE_VERSIONS_LITERAL = JSON.stringify(NODE_VERSIONS);
 // from _shared/ai-egress.ts at build time rather than being written twice.
 const AI_TOKEN_ENV_LITERAL = JSON.stringify(NIMBUS_AI_TOKEN_ENV);
 const AI_CREDENTIAL_HEADERS_LITERAL = JSON.stringify(NIMBUS_AI_CREDENTIAL_HEADERS);
+const ABI_ADVISORIES_LITERAL = JSON.stringify(PACKAGE_ABI_POLICY.rejects.map((r) => [r.from, r.suggest ? `${r.reason} … try: ${r.suggest}` : r.reason]));
 export function generateShimsCode() {
     return `
 // ═══════════════════════════════════════════════════════════════════════
 // ──  Format helper ──────────────────────────────────────────────────
 // ═══════════════════════════════════════════════════════════════════════
+function __isErrorValue(v) {
+  return v instanceof Error || Object.prototype.toString.call(v) === "[object Error]";
+}
+// Node's util.inspect(err); JSON.stringify drops non-enumerable name/message/stack.
+function __fmtError(e, seen) {
+  if (seen.has(e)) return "[Circular *]";
+  seen.add(e);
+  let text;
+  try { text = typeof e.stack === "string" && e.stack ? e.stack : Error.prototype.toString.call(e); }
+  catch { text = String(e); }
+  const fields = [];
+  for (const key of Object.keys(e)) {
+    if (key === "cause") continue;
+    let value;
+    try { value = e[key]; } catch { continue; }
+    fields.push(key + ": " + __fmtField(value, seen));
+  }
+  if (Object.prototype.hasOwnProperty.call(e, "cause")) fields.push("[cause]: " + __fmtField(e.cause, seen));
+  if (fields.length === 0) return text;
+  return text + " {\\n" + fields.map((f) => "  " + f.split("\\n").join("\\n  ")).join(",\\n") + "\\n}";
+}
+function __fmtField(v, seen) {
+  if (typeof v === "string") return JSON.stringify(v);
+  if (v !== null && typeof v === "object" && __isErrorValue(v)) return __fmtError(v, seen);
+  return __fmt(v);
+}
 function __fmt(v) {
   if (v === null) return "null";
   if (v === undefined) return "undefined";
   if (typeof v === "object") {
+    if (__isErrorValue(v)) return __fmtError(v, new Set());
     try { return JSON.stringify(v); } catch { return String(v); }
   }
   return String(v);
@@ -123,6 +157,41 @@ async function __nimbusUseRpcResultUnref(promise, use) {
   finally { __nimbusDisposeRpcResult(value); }
 }
 
+/**
+ * The ACQUIRE barrier, taken before the program sees anything that arrived
+ * from outside it: a response or body from the network, a relayed socket
+ * frame, a request routed to one of its ports, a stdin packet or signal, a
+ * child's output or exit. Each of those can be the second half of a causal
+ * chain that began with a write somewhere else — \`echo v2 > f; curl :3000\`,
+ * a child that writes a file and then exits — and the handler's synchronous
+ * reads must see that write. Nothing but this barrier carries it.
+ *
+ * What the supervisor delivers — a request, a stdin packet, a child's output
+ * or exit — carries the answer to this barrier with it (\`delivered\`,
+ * session/rpc.ts _acquireOnDelivery), computed after the thing delivered was
+ * queued, so the barrier applies that answer instead of asking, and the
+ * program resumes with no round trip of its own. It asks when there is none
+ * or it cannot use the one delivered. A resumption the supervisor does not
+ * deliver — a timer, the network — always asks.
+ *
+ * The barrier is installed by the fs module, which is evaluated after this
+ * point; a facet with no supervisor has none and nothing to be coherent with.
+ */
+async function __nimbusInboundBarrier(delivered) {
+  const acquire = globalThis.__nimbusVfsAcquireBarrier;
+  if (typeof acquire === "function") await acquire(delivered);
+}
+
+/**
+ * The arguments this process asks its ACQUIRE with (the fs module's
+ * _acquireArgs), for a delivery to be answered from: a long poll sends them,
+ * and what it delivers comes back carrying fsAcquire's answer to them.
+ */
+function __nimbusVfsAcquireArgs() {
+  const args = globalThis.__nimbusVfsAcquireArgs;
+  return typeof args === "function" ? args() : undefined;
+}
+
 // ═══════════════════════════════════════════════════════════════════════
 // ──  Precompiled wasm ───────────────────────────────────────────────
 // A wasm image can only become a WebAssembly.Module through the Worker
@@ -352,13 +421,11 @@ function __nimbusWasmDigest(bytes) {
   // supervisor round trip per outbound request, not a hidden one. It is the
   // price of the guarantee.
   //
-  // The barriers live on globalThis because the fs module installs them and
-  // is evaluated after this one; a facet with no supervisor bound has none,
-  // and there is nothing to be coherent with.
+  // The RELEASE barrier lives on globalThis because the fs module installs it
+  // and is evaluated after this one; the ACQUIRE is __nimbusInboundBarrier.
   const __resumeCoherent = async (pending) => {
     const value = await pending;
-    const acquire = globalThis.__nimbusVfsAcquireBarrier;
-    if (typeof acquire === "function") await acquire();
+    await __nimbusInboundBarrier();
     return value;
   };
   const __barriered = async (input, init) => {
@@ -388,6 +455,15 @@ function __nimbusWasmDigest(bytes) {
 
 let __nimbusLiveStdinPump = null;
 let __nimbusProcessExitReported = false;
+// Set when the program has exited: its timers are cleared and its writes refused.
+let __nimbusProgramStopped = false;
+let __nimbusExitEmitted = false;
+// 'exit' listeners run once, synchronously, before the program is stopped.
+function __nimbusEmitExit(code) {
+  if (__nimbusExitEmitted) return;
+  __nimbusExitEmitted = true;
+  try { __processEvents.emit("exit", code); } catch {}
+}
 let __nimbusProcessExitResolve = null;
 let __nimbusProcessExitCode = null;
 const __nimbusProcessExitPromise = new Promise((resolve) => {
@@ -738,29 +814,205 @@ const __fsMod = (() => {
   // ── VFS bundle lookup (fast path — in-memory) ──
   function _bundleLookup(absPath) {
     const k = _strip(absPath);
-    if (__vfsBundle && k in __vfsBundle) return __vfsBundle[k];
-    // Also check writes
+    if (globalThis.__nimbusProfileStaged) globalThis.__nimbusProfileStaged.delete(k);
+    // The parked write first, as _writtenCell reads: it is this process's own,
+    // newer than anything the store holds, and it is the live cell (a store
+    // read reassembles a copy, which a write loop would pay for per write).
     if (__vfsWrites && k in __vfsWrites) return __vfsWrites[k];
+    if (__vfsBundle && k in __vfsBundle) return __vfsBundle[k];
+    // The same bytes under the name they are held by: through a symlink, or
+    // under the old name of a rename this process has not seen land yet.
+    if (__vfsBundle && _nsActive()) {
+      const real = _nsRealKey(k);
+      if (real !== null && real !== k && real in __vfsBundle) return __vfsBundle[real];
+    }
     return undefined;
   }
 
-  // __vfsMetadata is not declared in every embedding of these shims, so the
-  // one guarded reference lives here and every other reader goes through it.
-  function _metadataTable() {
-    return (typeof __vfsMetadata !== "undefined" && __vfsMetadata) ? __vfsMetadata : null;
-  }
-
-  // Same guard, same reason: the SQLite resident store is spliced into the
-  // resident-process body only. The one-shot exec path runs in a stateless
-  // loaded worker with no facet storage at all, so these shims must still work
-  // with the resident set on the heap and this is the single place that asks.
+  // Whether the store is bound: every embedding of these shims boots one (a
+  // facet's SQLite, or a one-shot's heap), and this is the single place that asks.
   function _residentStorePresent() {
     return typeof __residentAdmit === "function" && typeof __residentReady !== "undefined" && __residentReady;
   }
 
+  // ── The namespace (resident facets) ──
+  //
+  // A resident facet's store holds every name the credential can see, with
+  // its stat, exact at the cursor (vfs/facet-resident-store.ts). While it
+  // does, it answers every synchronous metadata question — stat, exists,
+  // readdir, realpath, access — and an absent name is known absent, so none
+  // of them records a miss or refuses. While it does not (a relist failed,
+  // until the next barrier repairs it), each of them is refused by name
+  // (_nsRequire).
+  //
+  // What the table cannot know is this process's own structural effects that
+  // the authority has not reported back yet, so those sit in an overlay, one
+  // entry per path: "absent" / "absentTree" (unlink, rmdir, rm), "dir"
+  // (mkdir; \`hide\` when nothing was there, so no stale child shows through)
+  // and "alias" (a rename: the new name denotes what the old one did). An
+  // entry retires once its mutation has settled AND a barrier begun after
+  // that has applied, because such a barrier's delta is answered after the
+  // mutation committed, so the table then shows it or anything later.
+  function _nsActive() {
+    return typeof __nsReady === "function" && __nsReady();
+  }
+  // The namespace answers every synchronous metadata question, or none. While
+  // it is not ready (a relist failed, until the next barrier repairs it) a
+  // synchronous call is refused, naming why and the asynchronous form that
+  // answers now. A launch never runs user code before it is ready.
+  function _nsRequire(syscall, displayPath, asyncForm) {
+    if (_nsActive()) return;
+    _stats.namespaceRefusals++;
+    const why = typeof __nsNotReadyCause === "function" ? __nsNotReadyCause() : "the process was started without one";
+    const err = _fsErr("EAGAIN", syscall, displayPath);
+    err.message = "EAGAIN: " + syscall + " '" + String(displayPath) + "': the namespace is being rebuilt after " + why
+      + (_supervisor() ? "; use " + asyncForm : "");
+    throw err;
+  }
+  const _nsOwn = new Map();
+  let _nsFresh = [];
+  let _barrierBegins = 0;
+  function _nsOwnSet(k, state, extra) {
+    const before = _nsOwn.get(k);
+    const entry = { state, from: extra?.from, hide: !!extra?.hide, settled: null };
+    try { __residentNamespaceOverlayDelta(_nsOwnCost(k, entry) - (before ? _nsOwnCost(k, before) : 0)); }
+    catch (error) {
+      // The view is sealed by the store. Let the already-projected structural
+      // operation reach its authority/ack; aborting midway would strand
+      // earlier overlays with no owning mutation to retire them.
+      if (__residentInHeap && error?.code === "ENOSPC") return;
+      throw error;
+    }
+    _nsOwn.set(k, entry);
+    _nsFresh.push(entry);
+  }
+  function _nsOwnCost(k, entry) { return __namespaceRowBytes("", k, entry.from); }
+  /** Hand the overlay entries made since the last mutation to the one being queued. */
+  function _nsTakeFresh() {
+    const mine = _nsFresh;
+    _nsFresh = [];
+    return () => { for (const entry of mine) if (entry.settled === null) entry.settled = _barrierBegins; };
+  }
+  function _nsRetire(begin) {
+    for (const [k, entry] of _nsOwn) if (entry.settled !== null && entry.settled < begin) {
+      _nsOwn.delete(k);
+      __residentNamespaceOverlayDelta(-_nsOwnCost(k, entry));
+    }
+  }
+
+  /**
+   * The overlay's word on \`k\`: "absent", { alias } (look the table up at
+   * this key instead), { dir } (own directory), { hide } (the table knows
+   * nothing under an own fresh directory), or null (ask the table).
+   */
+  function _nsOwnView(k) {
+    if (_nsOwn.size === 0) return null;
+    const own = _nsOwn.get(k);
+    if (own) {
+      if (own.state === "absent" || own.state === "absentTree") return "absent";
+      if (own.state === "alias") return { alias: own.from };
+      return { dir: true };
+    }
+    for (let i = k.lastIndexOf("/"); i > 0; i = k.lastIndexOf("/", i - 1)) {
+      const above = _nsOwn.get(k.slice(0, i));
+      if (!above) continue;
+      if (above.state === "absent" || above.state === "absentTree") return "absent";
+      if (above.state === "alias") return { alias: above.from + k.slice(i) };
+      if (above.hide) return { hide: true };
+    }
+    return null;
+  }
+
+  /** The table key \`k\` denotes (overlay and symlinks applied), or null. */
+  function _nsRealKey(k) {
+    const own = _nsOwnView(k);
+    if (own === "absent" || (own && (own.dir || own.hide))) return null;
+    const found = __nsResolve(own && own.alias !== undefined ? own.alias : k, true);
+    return found && found !== "ELOOP" ? found.path : null;
+  }
+
+  function _nsRowMeta(row) {
+    const kind = Number(row.kind);
+    return {
+      type: kind === 1 ? "directory" : kind === 2 ? "symlink" : "file",
+      size: Number(row.size), mode: Number(row.mode), uid: Number(row.uid), gid: Number(row.gid),
+      atime: Number(row.atime), mtime: Number(row.mtime), ctime: Number(row.ctime),
+    };
+  }
+
+  /**
+   * Everything the namespace says about \`k\`: a stat record, "absent", or
+   * "ELOOP". Own pending writes and directories first, then the overlay,
+   * then the table, then content this process wrote that the table has not
+   * caught up with.
+   */
+  function _nsMeta(k, follow) {
+    if (k === "") return _nsRowMeta(__nsResolve("", true).row);
+    if (__vfsWrites && k in __vfsWrites && _denialCode(__vfsWrites[k]) === null) {
+      const size = _byteLen(__vfsWrites[k]);
+      if (_createdHere.has(k)) {
+        return { type: "file", size, mode: 0o100666 & ~__processUmask, uid: cred.uid, gid: cred.gid, own: true };
+      }
+      // A rewrite of a file that was there: its owner and mode stay what the
+      // authority says they are.
+      const found = __nsResolve(k, follow);
+      if (found && found !== "ELOOP" && Number(found.row.kind) === 0) return { ..._nsRowMeta(found.row), size };
+    }
+    const own = _nsOwnView(k);
+    if (own === "absent") return "absent";
+    if (own && own.dir) return { type: "directory", size: 0, mode: 0o40777 & ~__processUmask, uid: cred.uid, gid: cred.gid, own: true };
+    // A directory this process made hides what the namespace held under its
+    // name before, but not what this process has put there since: those rows
+    // are its own writes, recorded when the authority accepted them.
+    if (!own || own.alias !== undefined || (own.hide && _createdHere.has(k))) {
+      const found = __nsResolve(own && own.alias !== undefined ? own.alias : k, follow);
+      if (found === "ELOOP") return "ELOOP";
+      if (found) return _nsRowMeta(found.row);
+    }
+    // The namespace is exact, so a name it lacks is not there, whatever bytes
+    // the module map carries under it (a file removed since the map was
+    // built). Content never stands in for metadata.
+    return "absent";
+  }
+
+  /** Names directly under directory \`k\`: Map name → type. */
+  function _nsList(k) {
+    const names = new Map();
+    const own = _nsOwnView(k);
+    if (own !== "absent" && !(own && own.hide) && !(own && own.dir && _nsOwn.get(k)?.hide)) {
+      const real = __nsResolve(own && own.alias !== undefined ? own.alias : k, true);
+      if (real && real !== "ELOOP") {
+        for (const child of __nsChildren(real.path)) {
+          names.set(child.name, child.kind === 1 ? "directory" : child.kind === 2 ? "symlink" : "file");
+        }
+      }
+    }
+    const prefix = k ? k + "/" : "";
+    if (__vfsWrites) {
+      for (const wk in __vfsWrites) {
+        if (!wk.startsWith(prefix)) continue;
+        const rest = wk.slice(prefix.length);
+        const slash = rest.indexOf("/");
+        if (rest) names.set(slash < 0 ? rest : rest.slice(0, slash), slash < 0 ? "file" : "directory");
+      }
+    }
+    for (const [ok, entry] of _nsOwn) {
+      if (!ok.startsWith(prefix) || ok.slice(prefix.length).includes("/")) continue;
+      const name = ok.slice(prefix.length);
+      if (entry.state === "absent" || entry.state === "absentTree") { if (!(__vfsWrites && ok in __vfsWrites)) names.delete(name); }
+      else if (entry.state === "dir") names.set(name, "directory");
+      else {
+        const meta = _nsMeta(ok, false);
+        if (meta !== "absent" && meta !== "ELOOP") names.set(name, meta.type);
+      }
+    }
+    return names;
+  }
+
   function _metadata(absPath) {
-    const table = _metadataTable();
-    return table ? table[_strip(absPath)] : undefined;
+    _nsRequire("stat", absPath, "fs.promises.stat");
+    const meta = _nsMeta(_strip(absPath), true);
+    return meta === "absent" || meta === "ELOOP" ? undefined : meta;
   }
 
   function _denialCode(cell) {
@@ -768,52 +1020,13 @@ const __fsMod = (() => {
       typeof cell.error === "string" ? cell.error : null;
   }
 
-  // Removal retracts the path from the sync existence view — __vfsMetadata
-  // (spawn-time stat records) and __vfsManifest (directory shape). Without
-  // it, existsSync keeps reporting a file this process already deleted and
-  // the sync read path reports that file as merely non-resident.
+  // Removal retracts the path from the sync existence view: the namespace's
+  // overlay of this process's own effects says it is gone until a barrier's
+  // delta does.
   function _forgetSyncPath(k) {
+    _createdHere.delete(k);
     _announcedDirs.delete(k);
-    const metadata = _metadataTable();
-    if (metadata) delete metadata[k];
-    if (!__vfsManifest) return;
-    delete __vfsManifest[k];
-    const slash = k.lastIndexOf("/");
-    const parent = slash >= 0 ? k.slice(0, slash) : "";
-    const name = slash >= 0 ? k.slice(slash + 1) : k;
-    const siblings = __vfsManifest[parent];
-    if (!siblings) return;
-    const at = siblings.indexOf(name);
-    if (at !== -1) siblings.splice(at, 1);
-  }
-
-  /**
-   * Put a path into the sync EXISTENCE view — the inverse of _forgetSyncPath.
-   *
-   * A content cell is not existence. An invalidation drops content and is
-   * documented to leave the name behind so existsSync cannot fabricate an
-   * ENOENT for a file that was merely rewritten — but a file this process just
-   * created has no manifest entry and no spawn-time stat record, so its cell
-   * WAS the name, and evicting it retracted a file the program had written
-   * itself. Recording the name where every other name lives is what makes that
-   * documented asymmetry true.
-   *
-   * The parent's listing is the right home for it. Where the parent has no
-   * listing the entry is created only for a directory this process made, since
-   * that is the only case in which it knows the whole contents and calling the
-   * directory enumerated is honest.
-   */
-  function _announceSyncPath(k) {
-    if (!__vfsManifest || k === "") return;
-    const slash = k.lastIndexOf("/");
-    const parent = slash >= 0 ? k.slice(0, slash) : "";
-    const name = slash >= 0 ? k.slice(slash + 1) : k;
-    let siblings = __vfsManifest[parent];
-    if (!Array.isArray(siblings)) {
-      if (!__vfsDirs || !(parent in __vfsDirs)) return;
-      siblings = __vfsManifest[parent] = [];
-    }
-    if (siblings.indexOf(name) === -1) siblings.push(name);
+    _nsOwnSet(k, "absent");
   }
 
   /**
@@ -822,41 +1035,67 @@ const __fsMod = (() => {
    * content carried. One place, because every sync mutation owes all three.
    */
   function _parkWrite(k, cell) {
+    _noteCreation(k);
     __vfsWrites[k] = cell;
     if (__vfsBundle) __vfsBundle[k] = cell;
     delete __vfsBundleRevisions[k];
-    _announceSyncPath(k);
+  }
+
+  /**
+   * The paths this process itself created, whose owner and mode are its own:
+   * its uid and gid, and what its umask leaves. Every other stat answer comes
+   * from the authority's metadata, and a path the authority never described
+   * is not given one. A stat invented from the reader's own credential made a
+   * root-owned file read as the reader's own and writable.
+   *
+   * A path counts as created when nothing was there before the write and the
+   * view KNOWS nothing was there. Unknown is not created: a file the process
+   * never staged may exist at the authority, owned by someone else.
+   */
+  const _createdHere = new Set();
+  function _noteCreation(k) {
+    if (_createdHere.has(k)) return;
+    const absPath = "/" + k;
+    // Known absent: the namespace names everything this credential can see.
+    if (_statLadder(absPath) !== undefined) return;
+    _createdHere.add(k);
+  }
+  function _forgetCreation(k) {
+    const prefix = k + "/";
+    for (const key of [..._createdHere]) if (key === k || key.startsWith(prefix)) _createdHere.delete(key);
   }
 
   function _forgetSyncTree(k) {
     const prefix = k + "/";
+    _forgetCreation(k);
+    _nsOwnSet(k, "absentTree");
     for (const dir of _announcedDirs) if (dir.startsWith(prefix)) _announcedDirs.delete(dir);
-    const metadata = _metadataTable();
-    if (metadata) {
-      for (const mk of Object.keys(metadata)) if (mk.startsWith(prefix)) delete metadata[mk];
-    }
-    if (__vfsManifest) {
-      for (const dk of Object.keys(__vfsManifest)) if (dk.startsWith(prefix)) delete __vfsManifest[dk];
-    }
     _forgetSyncPath(k);
   }
 
   /**
    * The honest error for a sync read the resident view cannot serve. A facet
    * has no synchronous I/O primitive, so a sync read is limited to content
-   * staged into this process — but the sync existence view (__vfsMetadata +
-   * __vfsManifest) knows far more paths than the content bundle carries.
-   * ENOENT is only correct when the path is unknown there too; for a path
-   * that demonstrably exists it sends the caller hunting for a missing file
-   * instead of awaiting the read that would return it.
+   * staged into this process, but the namespace names every path the
+   * credential can see. ENOENT is correct only when it names none; for a path
+   * that exists it would send the caller hunting for a missing file instead
+   * of awaiting the read that would return it.
    */
   function _notResidentError(absPath, displayPath, syscall, asyncForm) {
     const st = _statLadder(absPath);
-    if (st === undefined) {
-      if (!_absenceIsKnown(absPath)) _recordUnmapped(absPath, syscall);
-      return _fsErr("ENOENT", syscall, displayPath);
-    }
+    if (st === undefined) return _fsErr("ENOENT", syscall, displayPath);
     if (st.isDirectory()) return _fsErr("EISDIR", syscall, displayPath);
+    // Unreadable to this credential: the namespace's mode says so, and no
+    // bytes could have been staged for it.
+    if (!_modeAllows(st, 4)) return _fsErr("EACCES", syscall, displayPath);
+    if (typeof __residentStorageMiss === "function" && __residentStorageMiss(_strip(absPath))) {
+      // The process's own write, which neither its store nor its heap budget
+      // could hold: the workspace's storage is full.
+      const full = _fsErr("ENOSPC", syscall, displayPath);
+      full.message = "ENOSPC: workspace storage is full; '" + String(displayPath) + "' is readable asynchronously"
+        + (_supervisor() ? " (" + asyncForm + ")" : "");
+      return full;
+    }
     _recordResidencyMiss(absPath);
     const err = _fsErr("EAGAIN", syscall, displayPath);
     err.message += " — '" + String(displayPath) + "' exists but its content is not " +
@@ -990,7 +1229,9 @@ const __fsMod = (() => {
       let meta;
       // A thrown stat is the authority failing to answer, not an answer:
       // nothing is learned, and the miss stands.
-      try { meta = await __nimbusUseRpcResult(supervisor.stat(absPath), (r) => r); }
+      // Queued on the path: the program's own later mutations of it must not overtake the stat.
+      const observe = () => __nimbusUseRpcResult(supervisor.stat(absPath), (r) => r);
+      try { meta = await (_hasVfsMutationQueue() ? __nimbusQueueVfsMutation(absPath, observe, false) : observe()); }
       catch { return; }
       if (meta === null || meta === undefined) { _observedAbsent.add(k); return; }
       if (meta.type === "directory") return;
@@ -1028,193 +1269,46 @@ const __fsMod = (() => {
     }
   };
 
-  /**
-   * Has this directory's content been enumerated, or merely mentioned?
-   *
-   * __vfsManifest is a walk of SELECTED roots — the cwd subtree, its
-   * node_modules, the entry script's own package — not of the filesystem. A
-   * directory with an entry there was listed by that walk, so its child list
-   * is complete and a name that is not in it is genuinely not there. A
-   * directory with no entry was never opened, and knows nothing. __vfsDirs
-   * holds the directories this process created itself, which it therefore
-   * knows the contents of by construction.
-   *
-   * Conflating the two is what let a synchronous readdir of a real directory
-   * outside the walk answer with an empty array — not an error, not a refusal,
-   * a positive assertion that a populated directory is empty. Every caller
-   * that used to end in "not found, so absent" goes through here first.
-   */
-  function _dirEnumerated(k) {
-    return (!!__vfsManifest && k in __vfsManifest) || (!!__vfsDirs && k in __vfsDirs);
-  }
 
-  /** Does the content bundle itself describe children under this directory? */
-  function _bundleHasChildren(k) {
-    if (!__vfsBundle) return false;
-    return __residentAnyUnder(k ? k + "/" : "");
-  }
 
-  /**
-   * Can the view say this path is ABSENT, as opposed to say nothing at all?
-   *
-   * With no supervisor bound there is no authority to be ignorant of: the
-   * staged tables ARE the filesystem, the async form reads out of those same
-   * tables, and a name that is not in them is not anywhere. Ignorance is a
-   * property of the gap between a process and an authority it cannot reach
-   * synchronously, so where there is no authority there is no gap.
-   */
-  function _absenceIsKnown(absPath) {
-    if (!_supervisor()) return true;
-    const k = _strip(absPath);
-    if (k === "") return true;
-    const segments = k.split("/");
-    // Deepest enumerated ancestor, because that is the only one that can
-    // testify. Walking up rather than looking only at the immediate parent is
-    // what makes a whole missing subtree answerable from one listing: if
-    // $HOME was enumerated and holds no .config, then nothing under .config
-    // is there either, and a program probing three levels down deserves that
-    // answer rather than three refusals.
-    for (let i = segments.length - 1; i >= 0; i--) {
-      const dir = segments.slice(0, i).join("/");
-      if (!_dirEnumerated(dir)) continue;
-      const child = segments.slice(0, i + 1).join("/");
-      const children = (__vfsManifest && __vfsManifest[dir]) || [];
-      const present = children.indexOf(segments[i]) !== -1
-        || (!!__vfsDirs && child in __vfsDirs)
-        || (!!__vfsBundle && child in __vfsBundle);
-      // The component is not in a directory that was listed: absent, and so is
-      // everything below it. If it IS there, only its own enumeration settles
-      // what it contains, so nothing short of the immediate parent will do.
-      if (!present) return true;
-      return i === segments.length - 1;
-    }
-    return false;
-  }
 
-  /**
-   * A path the sync view never mapped: record the ignorance, and repair it.
-   *
-   * Sibling of _notResidentError and the same bargain — the file may well be
-   * there, the process simply cannot look without blocking. The callers answer
-   * ENOENT, which is provisional rather than fabricated: this records the miss
-   * and pulls in the listing that settles the question, and the exit report
-   * reads the ledger. If the path was genuinely absent the repair proves it
-   * and the entry retires — the program's not-found branch was the right
-   * branch and it reached it through the right errno. If the path WAS there,
-   * the entry survives and the run is failed by name.
-   *
-   * EAGAIN was tried here and is the wrong answer to hand a program even
-   * though it is the honest description of the situation. It cannot arise from
-   * a real POSIX filesystem, so nothing branches on it, and the catch block
-   * that receives it was written for a missing file and rethrows instead:
-   * measured, create-next-app reads $HOME/.config/<tool>/config.json through
-   * the conf package, is handed EAGAIN for a file that was never there, and
-   * dies before writing one template file. Read a config, treat ENOENT as "no
-   * config yet", rethrow anything else is the near-universal shape. Refusing
-   * bought nothing the ledger was not already delivering, and cost every
-   * program that idiom.
-   *
-   * A LISTING is the exception and still refuses — see readdirSync. An array is
-   * a complete enumeration by definition, so there is no provisional form of
-   * it: an empty one asserts that a directory nothing ever opened is empty,
-   * which is how a scaffolder was told its template directory held nothing,
-   * wrote nothing, and exited 0.
-   */
-  function _recordUnmapped(absPath, syscall) {
-    const k = _strip(absPath);
-    _recordMiss(k);
-    // A listing wants the path's own contents; a read wants its bytes. Both
-    // also want the boundary listing, which is the only thing that can prove
-    // the path was not there — and fetching one repair and then the other
-    // would refuse the same access twice, once for being unmapped and once for
-    // having no resident content. _faultOnce collapses them where they meet.
-    _faultInBoundary(k);
-    if (syscall === "scandir") { _faultInDirectory(k); return; }
-    _faultIn(k);
-  }
 
-  /**
-   * The shallowest directory on this path whose contents the view does not
-   * know: the child of the deepest ancestor that WAS enumerated.
-   *
-   * That, not the immediate parent, is the listing a refusal has to pull in.
-   * For a path that is not there the parent is usually not there either, so
-   * its readdir fails, the view learns nothing, and the ledger keeps an entry
-   * no repair can ever retire — the run is failed over a file that was simply
-   * absent. The boundary directory is different: the enumerated ancestor's own
-   * listing already proved it is present, so it can be read, and reading it
-   * either names the next component or proves the whole subtree absent.
-   *
-   * With nothing enumerated at all the boundary is the root, which is one
-   * listing away from making the next level answerable.
-   */
-  function _unknownBoundary(k) {
-    const segments = k.split("/");
-    for (let i = segments.length - 1; i >= 0; i--) {
-      if (_dirEnumerated(segments.slice(0, i).join("/"))) {
-        return segments.slice(0, i + 1).join("/");
-      }
-    }
-    return "";
-  }
 
-  function _faultInBoundary(k) {
-    _faultInDirectory(_unknownBoundary(k));
-  }
 
-  /**
-   * The refusal, for the two callers that have no provisional answer to give.
-   *
-   * A listing cannot say "not found" usefully, and neither can a write that
-   * needs the prior content it is splicing onto. Everywhere else the sync view
-   * answers ENOENT and lets the exit report settle whether that was true; here
-   * there is no branch the program could take that would be right, so the
-   * honest EAGAIN is also the useful one.
-   */
-  function _refuseUnmapped(absPath, displayPath, syscall, asyncForm) {
-    _recordUnmapped(absPath, syscall);
-    const err = _fsErr("EAGAIN", syscall, displayPath);
-    err.message += " — '" + String(displayPath) + "' lies outside the filesystem view "
-      + "staged into the process, so a synchronous call cannot tell what is there, "
-      + "and synchronous I/O cannot block to find out"
-      + (_supervisor() ? "; " + asyncForm + " answers from the live filesystem" : "");
-    return err;
-  }
 
-  /**
-   * Pull a directory listing in. _readdirAsync already records what it learns
-   * into __vfsManifest, so one call both answers the fault and converges the
-   * sync view on the async one — there is no second merge path to keep honest.
-   */
-  function _faultInDirectory(k) {
-    if (!_supervisor() || _dirEnumerated(k) || !_faultOnce("listing", k)) return;
-    try { _repairs.push(_readdirAsync("/" + k, undefined).catch(() => {})); }
-    catch { /* speculative */ }
+
+
+  // What the authority says of a path after this process's own async request
+  // (a stat, read or accepted write) is what the sync view answers for it
+  // from then on, as it would after the delta that reports it
+  // (facet-resident-store's __nsNoteLiveStat).
+  //
+  // The lstat rides the read batch (_queueBatchRequest) rather than a call
+  // of its own: a resumption refetches every path it owes at once
+  // (_acquireAndRefetch), and a learn per path made that one lstat call per
+  // path — 1,601 in flight from one facet after a program wrote 1,600 files,
+  // some of which stayed pending and never reached the session
+  // (preview/new/lucide-barrel-cache-widens, measured 2026-09-28). Batched,
+  // the learns cost a round trip per batch, as the reads before them do.
+  async function _learnLive(absPath, supervisor) {
+    if (!supervisor || typeof supervisor.fsReadBatch !== "function") return;
+    let stat;
+    try { stat = await _queueBatchRequest(supervisor, { path: absPath, lstat: true }, 0); } catch { return; }
+    __nsNoteLiveStat(_strip(absPath), stat ?? null);
   }
 
   /**
-   * Retire the refusals a repair turned into honest absence.
-   *
-   * A refusal is only a wrong answer when the path was THERE and the process
-   * was denied it. Where the listing comes back and shows the name is simply
-   * not present, the program's not-found branch was the right branch all
-   * along — it merely reached it through the wrong errno — and failing the run
-   * over that would fail every module resolver, which probes dozens of paths
-   * that do not exist by design. So what stays in the ledger is exactly the
-   * harmful set: content that exists and was not served.
+   * Retire the misses a repair turned into honest absence. A miss is a wrong
+   * answer only when the path was THERE and the process was denied it: one on
+   * a name the namespace does not have (or the authority did not have when it
+   * was asked) was the program's not-found branch, taken for the right
+   * reason. Failing the run over those would fail every module resolver,
+   * which probes dozens of paths that do not exist by design.
    */
   function _settleProvenAbsences() {
     if (_residencyMisses.size === 0) return;
     for (const k of [..._residencyMisses]) {
-      const absPath = "/" + k;
-      // The authority did not have it when we asked, so nothing was withheld —
-      // whatever is at the path now, this process put there.
-      if (_observedAbsent.has(k)) { _residencyMisses.delete(k); continue; }
-      if (_statLadder(absPath) !== undefined) continue;
-      if (_absenceIsKnown(absPath)) { _residencyMisses.delete(k); continue; }
-      // Still unprovable, because the listing that would settle it lies below
-      // the one already fetched. Ask for the next one; the settle loop waits.
-      _faultInBoundary(k);
+      if (_observedAbsent.has(k) || (_nsActive() && _statLadder("/" + k) === undefined)) _residencyMisses.delete(k);
     }
   }
 
@@ -1283,6 +1377,10 @@ const __fsMod = (() => {
 
   const _localTimes = globalThis.__nimbusVfsTimes || (globalThis.__nimbusVfsTimes = Object.create(null));
   const _localModes = globalThis.__nimbusVfsModes || (globalThis.__nimbusVfsModes = Object.create(null));
+  // Modes set locally that the authority has not received yet. Delivered once:
+  // re-sending on every flush made each read of the path a chmod, which bumped
+  // its revision and evicted the process's own cell (create-astro EAGAIN).
+  const _pendingModes = globalThis.__nimbusVfsPendingModes || (globalThis.__nimbusVfsPendingModes = new Set());
 
   function _coerceMode(value, syscall, p) {
     const n = typeof value === "string" ? parseInt(value, 8) : Number(value);
@@ -1307,11 +1405,9 @@ const __fsMod = (() => {
       atimeMs: _coerceTimeMs(atime, syscall, p),
       mtimeMs: _coerceTimeMs(mtime, syscall, p),
     };
+    // The sync view answers these times ahead of the namespace's (_statObject)
+    // until the utimes is reported back, as a write's own bytes are.
     _localTimes[k] = time;
-    // A spawn-time stat record answers statSync ahead of _localTimes, so it
-    // must carry the new times too or the sync view keeps the old mtime.
-    const meta = _metadata(absPath);
-    if (meta) { meta.atime = time.atimeMs; meta.mtime = time.mtimeMs; }
     return time;
   }
 
@@ -1365,7 +1461,7 @@ const __fsMod = (() => {
   // ══ Cache coherence: ACQUIRE + read-through fill ═════════════════════
   //
   // The supervisor's SQLite VFS is the only authority. Everything in this
-  // facet — __vfsBundle, __vfsMetadata, __vfsManifest, __vfsDirs — is a
+  // facet — the resident store, __vfsBundle, __vfsDirs — is a
   // cache of it, and __vfsWrites is this process's own not-yet-flushed
   // mutations.
   //
@@ -1393,6 +1489,24 @@ const __fsMod = (() => {
   //             a frame arrives as a supervisor reply the same barrier
   //             rides on (see the relayed WebSocket below).
   //
+  // The supervisor's own deliveries are resumptions too. Each takes
+  // __nimbusInboundBarrier before the program sees it, and each carries the
+  // barrier's answer, computed by the supervisor after the thing delivered
+  // was queued (protocol §3's piggybacked inv), so the barrier applies it
+  // instead of asking and the delivery costs no round trip of its own:
+  //   - request: a request routed to one of the process's ports, in the
+  //             dispatch every resident's server shares (__nimbusServeHttp).
+  //             The supervisor starts it, so it holds no cursor of this
+  //             process's and answers "nothing since now", which stands in
+  //             only when no write preceded the request since this process
+  //             last caught up (protocol §9.2); otherwise the barrier asks.
+  //   - stdin:  a stdin packet — input, its end, a signal, a resize — for an
+  //             attached process (__makeProcessStdin's pump).
+  //   - child:  a spawned child's output and its exit (_runReadLoop,
+  //             _runWaitLoop).
+  // Stdin and child output are long polls, so they send this process's
+  // ACQUIRE arguments (_acquireArgs) and are answered from exactly those.
+  //
   // Keep this list empty. An entry here is a documented hole in the owner's
   // invariant, not a TODO: it means some process can be woken by something
   // this system does not mediate, and its next synchronous read can serve
@@ -1414,8 +1528,18 @@ const __fsMod = (() => {
   // envelope — there is no reason to invent a second surface for it.
   const _stats = globalThis.__nimbusVfsCoherence
     || (globalThis.__nimbusVfsCoherence = {
-      fills: 0, filledBytes: 0, invalidations: 0, poisons: 0,
+      fills: 0, filledBytes: 0, invalidations: 0, poisons: 0, pushes: 0,
       reconciles: 0, selfWrites: 0, misses: 0,
+      // ACQUIREs that got no answer (see _acquireBarrier), and the last reason.
+      barrierFailures: 0, lastBarrierFailure: "",
+      // Barriers that held their resumption on an own write's acknowledgement
+      // (_awaitReportedOwnWrites).
+      ownWriteWaits: 0,
+      // The namespace's failure state (a relist failed): synchronous calls
+      // refused with its cause (_nsRequire), and barriers that repaired it.
+      namespaceRefusals: 0, namespaceRepairs: 0,
+      // Repairs a delta from the store's durable floor answered, with no listing.
+      floorRepairs: 0,
     });
 
   /**
@@ -1448,8 +1572,6 @@ const __fsMod = (() => {
     let evicted = false;
     delete __vfsBundleRevisions[k];
     if (__vfsBundle && k in __vfsBundle) { delete __vfsBundle[k]; evicted = true; }
-    const metadata = _metadataTable();
-    if (metadata && k in metadata) { delete metadata[k]; evicted = true; }
     return evicted;
   }
 
@@ -1464,15 +1586,107 @@ const __fsMod = (() => {
   const _owedRefetch = new Set();
 
   // An own-mutation lease can end in an eviction (a peer wrote inside the
-  // window). The ledger owning that decision is spliced AHEAD of this
-  // closure, so it is handed the one eviction path rather than keeping a
-  // second copy of it: content view, stat view, the invalidation count and
-  // the refetch debt move together here or not at all.
-  globalThis.__nimbusEvictResidentCell = (k) => {
+  // window), and so can a flush whose revision a barrier's report outran.
+  // The ledger owning those decisions is spliced AHEAD of this closure, so it
+  // is handed the one eviction path rather than keeping a second copy of it:
+  // content view, stat view, the invalidation count and the refetch debt
+  // move together here or not at all.
+  function _evictOwed(k) {
     if (!_evictResident(k)) return;
     _stats.invalidations++;
     _owedRefetch.add(k);
-  };
+  }
+  globalThis.__nimbusEvictResidentCell = _evictOwed;
+
+  /**
+   * Live reads in flight, per path: each one's fill ticket, which carries
+   * the highest revision a barrier reported for the path while that read was
+   * outstanding.
+   *
+   * A barrier that reports a path nobody holds has nothing to evict and
+   * CONSUMES the report: the cursor moves past it and no later delta names it
+   * again. A read of that path already in flight may have been served before
+   * the mutation the report describes, and its bytes would then be installed
+   * behind the only message that could have evicted them. So the report is
+   * kept on the read until it lands, and the read installs only if nothing
+   * newer than its cursor was reported under it (_installResident).
+   *
+   * One ticket per read, not one per path: a read that begins after a report
+   * or a poison is judged only by what is reported after it began. Sharing the
+   * earlier read's record condemned the read issued to replace it.
+   */
+  const _fillReports = new Map();
+
+  /**
+   * Begin a live read of \`k\`: the cursor it is issued under — every mutation
+   * at or below it is already in the bytes it returns — and what has been
+   * reported against it since, nothing yet. Called after the read's barrier
+   * and before its RPC.
+   */
+  function _beginFill(k) {
+    const fill = { k, rev: _cursor.rev, reported: -1 };
+    let live = _fillReports.get(k);
+    if (!live) {
+      live = new Set();
+      _fillReports.set(k, live);
+    }
+    live.add(fill);
+    return fill;
+  }
+
+  function _endFill(fill) {
+    const live = _fillReports.get(fill.k);
+    if (!live) return;
+    live.delete(fill);
+    if (live.size === 0) _fillReports.delete(fill.k);
+  }
+
+  /** A barrier reported \`k\` at \`rev\`: remember it on every read of it in flight. */
+  function _noteFillReport(k, rev) {
+    const live = _fillReports.get(k);
+    if (live) for (const fill of live) if (rev > fill.reported) fill.reported = rev;
+  }
+
+  /**
+   * Note one delta entry on everything in flight that it covers: its path,
+   * or, for a subtree-scoped or structural entry, every path at or under it.
+   * The ledger does the same for this facet's own writes and mutations.
+   */
+  function _noteReport(entry) {
+    if (!entry.subtree && !entry.structural) {
+      __nimbusNoteVfsReport(entry.path, entry.rev);
+      _noteFillReport(entry.path, entry.rev);
+      return;
+    }
+    __nimbusNoteVfsReportUnder(entry.path, entry.rev);
+    const under = entry.path + "/";
+    for (const k of [..._fillReports.keys()]) {
+      if (k === entry.path || k.startsWith(under)) _noteFillReport(k, entry.rev);
+    }
+  }
+
+  /**
+   * The resident cells a delta entry covers: its path, or, for a
+   * subtree-scoped or structural entry, every cell at or under it. Such an
+   * entry stands for changes it does not name (a directory that went, one
+   * whose mode, owner or group changed, or something beneath it this facet
+   * may not see), so each cell there is judged as a named one would be.
+   */
+  function _coveredCells(entry) {
+    if (!entry.subtree && !entry.structural) return [entry.path];
+    const under = entry.path + "/";
+    const cells = new Set();
+    for (const table of [__vfsBundle, __vfsBundleRevisions]) {
+      if (!table) continue;
+      for (const k of Object.keys(table)) if (k === entry.path || k.startsWith(under)) cells.add(k);
+    }
+    return [...cells];
+  }
+
+  /** The cursor moved without a delta (a poison), so no read in flight can be dated. */
+  function _spoilFills() {
+    for (const live of _fillReports.values()) for (const fill of live) fill.reported = Infinity;
+  }
 
   /**
    * Install bytes the supervisor just served as the resident cell for a
@@ -1486,42 +1700,30 @@ const __fsMod = (() => {
    * returned, so it has nothing to invalidate. The bytes are already paid
    * for; caching them costs one map insert.
    *
+   * \`fill\` (_beginFill) dates them, and it is also the reason an install can
+   * be declined: a barrier that reported the path above the read's cursor
+   * while the read was in flight may describe a mutation the bytes predate,
+   * and that report is gone once consumed. Declining costs the next sync
+   * read a miss; installing would cost a stale byte nothing ever evicts.
+   *
    * The parent's manifest entry gains the name too, so the existence view
    * cannot go on denying a file whose bytes this process is holding.
    */
-  function _installResident(absPath, bytes) {
+  function _installResident(absPath, bytes, fill) {
     if (!__vfsBundle) return;
     const k = _strip(absPath);
     if (k === "") return;
+    if (fill.reported > fill.rev) return;
     // Never over a cell this facet owns.
     //
     // A pending write is strictly newer than anything the authority can
     // report, and __vfsBundle is what sync reads consult first, so installing
     // over it would serve the program bytes older than its own write.
-    //
-    // A STAMPED cell is this facet's own flushed write, and the barrier this
-    // read passed on the way in reported nobody else has touched the path
-    // since — so the bytes are already what is being installed, and the only
-    // thing the install would change is to drop the stamp. It did: a
-    // speculative repair issued by an earlier refused read landed after the
-    // flush, unstamped the cell, and the next ACQUIRE evicted the facet's own
-    // output. Measured at selfWrites 0 / invalidations 1 / fills 2 for one
-    // written file, against 1 / 0 / 0 with the repair absent.
     if (__vfsWrites && k in __vfsWrites) return;
-    if (__vfsBundleRevisions[k] !== undefined) return;
-    __vfsBundle[k] = bytes;
-    // Keep the stat view consistent with the bytes now held. Without this
-    // the content view is fresh while statSync still reports the
-    // spawn-time length, so a program can read N bytes and be told the
-    // file is M — an inconsistency introduced BY the fill. Only the size
-    // is corrected: type, mode, ownership and timestamps stay as the
-    // authority last reported them, so mtime-based change detection
-    // (make, tsc --build, watchers) does not see every read as a change.
-    const metadata = _metadataTable();
-    if (metadata && k in metadata) {
-      metadata[k] = { ...metadata[k], size: _byteLen(bytes) };
-    }
-    _announceSyncPath(k);
+    // The store dates the row at the read's cursor, so the next delta that
+    // names the path above it evicts it. It declines, itself, to replace own
+    // bytes or a row dated later than this read can vouch for.
+    if (!__residentFill(k, bytes, fill.rev)) return;
     _stats.fills++;
     _stats.filledBytes += _byteLen(bytes);
   }
@@ -1557,25 +1759,86 @@ const __fsMod = (() => {
     return _residentRepair;
   }
 
+  /**
+   * Set while the store holds only what a repair could NOT vouch for: rows it
+   * had to drop rather than prove current. Nothing but another repair brings
+   * those back — a delta names what changed, not what this facet lost — so
+   * every barrier repairs until one vouches, however the ACQUIRE is answered.
+   */
+  let _storeRepairOwed = false;
+
+  /**
+   * The repair's first try: the delta from the store's durable floor
+   * (__residentCursor), asked as every barrier asks it. True when it applied
+   * (the repair is done); false when a listing is needed after all.
+   */
+  async function _repairFromFloor(supervisor, result) {
+    if (!supervisor || typeof supervisor.fsAcquire !== "function" || !_nsActive()) return false;
+    if (result !== null && result.poison === true) return false;
+    const floor = __residentCursor();
+    if (floor === null || (result !== null && result.epoch !== floor.epoch)) return false;
+    let delta;
+    try {
+      delta = await __nimbusUseRpcResult(supervisor.fsAcquire(floor.epoch, floor.rev, { namespace: true }), (r) => r);
+    } catch { return false; }
+    if (!delta || delta.poison === true || typeof delta.rev !== "number" || delta.epoch !== floor.epoch) return false;
+    if (Array.isArray(delta.paths)) for (const entry of delta.paths) _noteReport(entry);
+    await __residentRoomForPushed(delta);
+    const applied = __residentAdmit(delta);
+    for (const dir of applied.relist) await __nsRelist(supervisor, dir);
+    if (!_nsActive()) return false;
+    _cursor.epoch = applied.cursor.epoch;
+    _cursor.rev = applied.cursor.rev;
+    _stats.invalidations += applied.dropped.length;
+    // What it should hold and lost (dropped by this delta, or by the barrier
+    // that could not vouch for its rows), refetched by the namespace's stats.
+    const refilled = await __residentRefillFromNamespace(supervisor, applied.dropped);
+    _stats.fills += refilled.filled;
+    _stats.filledBytes += refilled.bytes;
+    _stats.floorRepairs++;
+    _storeRepairOwed = false;
+    return true;
+  }
+
+  /**
+   * \`result\` is the ACQUIRE answer that asked for the repair: a poison, a
+   * delta arriving while a repair is owed, or null for a barrier that got no
+   * answer at all.
+   */
   async function _runResidentRepair(supervisor, result) {
+    // Within one epoch, with the change log intact and the namespace
+    // answering, the store's rows are dated through its own durable cursor, so
+    // the delta from there names everything that moved since. Only an epoch
+    // change, a poison (the log truncated past the cursor), or a namespace
+    // that stopped answering needs the listing.
+    if (await _repairFromFloor(supervisor, result)) return;
+    const ownAtStart = __residentOwnPaths();
     let repaired;
     try { repaired = await __residentSynchronizeFromSupervisor(supervisor); }
     catch { repaired = null; }
     if (!repaired || !repaired.cursor) {
       // The pass could not vouch for a single row — a supervisor replaced
-      // mid-enumeration, an enumeration that came back short. A row that
-      // cannot be dated must not be served, so the cold cache the poison asked
-      // for is taken after all, and the pass runs once more to repopulate what
-      // it just dropped.
-      __residentAdmit(result);
-      _cursor.epoch = result.epoch;
-      _cursor.rev = result.rev;
+      // mid-enumeration, an enumeration that came back short, an authority it
+      // could not reach. A row that cannot be dated must not be served, so the
+      // cold cache is taken after all, and the pass runs once more to
+      // repopulate what it just dropped. An answer with a cursor is admitted as
+      // it would have been; a barrier with no answer drops every dated row and
+      // keeps the cursor it had, which the next delta is still owed from.
+      if (result) {
+        __residentAdmit(result);
+        _cursor.epoch = result.epoch;
+        _cursor.rev = result.rev;
+      } else {
+        __residentDropDated();
+      }
       try { repaired = await __residentSynchronizeFromSupervisor(supervisor); }
       catch { repaired = null; }
     } else if (repaired.reconciled) {
       _stats.reconciles++;
     }
-    if (!repaired || !repaired.cursor) return;
+    _settleSkippedReports(ownAtStart, repaired);
+    _storeRepairOwed = !(repaired && repaired.cursor);
+    if (_storeRepairOwed) return;
     _cursor.epoch = repaired.cursor.epoch;
     _cursor.rev = repaired.cursor.rev;
     _stats.invalidations += repaired.dropped;
@@ -1583,6 +1846,41 @@ const __fsMod = (() => {
     _stats.filledBytes += repaired.bytes;
   }
 
+  /**
+   * Deliver the reports a repair moved the cursor over.
+   *
+   * A repair moves the cursor without a delta, so what a delta would have
+   * reported reaches nothing on its own. A dated row the pass kept is proven
+   * current by its listed revision and needs nothing more. A row of this
+   * facet's own bytes is kept whatever the listing says — and its report is
+   * exactly what the write or mutation that owns it needs, to judge its own
+   * acknowledgement against. The pass hands those back (\`own\`), and they are
+   * noted here as a delta's would have been; one acknowledged since the pass
+   * looked was dated by a receipt that could not see the report, so it is
+   * judged here directly.
+   *
+   * With nothing datable — across incarnations, against a short listing, or
+   * a pass that failed outright — every own row, and every row that was own
+   * when the repair began, is judged as though a peer wrote it last: an
+   * eviction and a refetch, never a stale byte.
+   */
+  function _settleSkippedReports(ownAtStart, repaired) {
+    const reports = new Map();
+    if (repaired && repaired.cursor && repaired.reconciled && Array.isArray(repaired.own)) {
+      for (const entry of repaired.own) reports.set(entry.path, entry.rev);
+    } else {
+      for (const k of ownAtStart) reports.set(k, Infinity);
+      if (repaired && Array.isArray(repaired.own)) for (const entry of repaired.own) reports.set(entry.path, Infinity);
+      for (const k of Object.keys(__vfsOwnLeases)) reports.set(k, Infinity);
+      for (const k of Object.keys(__vfsWrites)) reports.set(k, Infinity);
+    }
+    for (const [k, rev] of reports) {
+      __nimbusNoteVfsReport(k, rev);
+      const provenance = __residentProvenance(k);
+      if (provenance !== undefined && provenance !== -1 && provenance < rev) _evictOwed(k);
+    }
+  }
+
   /**
    * ACQUIRE. Apply every invalidation the supervisor has for this facet,
    * then re-stamp the cursor.
@@ -1608,65 +1906,247 @@ const __fsMod = (() => {
    * left. Comparing revisions rather than names keeps the peer case intact:
    * a peer writing the same path afterwards reports a HIGHER revision than
    * our stamp, so that invalidation still lands.
+   *
+   * An ACQUIRE that gets no answer is a poison too, never an empty delta. It
+   * has learned nothing about what changed, and the resumption behind it is
+   * about to serve every row it holds. The call is a pure read, so a dropped
+   * one is already retried where the supervisor makes it (SupervisorRPC,
+   * fabric's idempotent), and what arrives here failed those retries, came
+   * from a host that could not serve it, or answered without a cursor. The
+   * rows are repaired against the listing exactly as for a poison; with no
+   * cursor to adopt, the one held is kept and still owed every change since.
+   * The barrier itself never throws: the operation or callback behind it
+   * runs either way, against rows that were vouched for or a colder cache.
+   *
+   * A repair is single-flight, and while one runs no delta may be admitted
+   * at all: the repair has already dropped the rows it could not vouch for,
+   * so a report of one of them finds nothing to evict and is consumed, and
+   * the repair then installs it at its listing's revision and publishes the
+   * listing's cursor over the one the delta advanced. So any barrier answered
+   * while a repair runs joins it, whether its own answer needed a repair or
+   * was an ordinary delta, and the listing may predate that answer — the rows
+   * it vouches for are another barrier's answer, not this one's — so a joiner
+   * waits for it and then asks again: a delta from the repaired cursor names
+   * everything since. Only the barrier that started a repair resumes on it
+   * alone.
+   *
+   * \`delivered\` is an answer the supervisor delivered with the resumption
+   * this barrier is taken for; it stands in for the first ACQUIRE when it can
+   * (_deliveredAnswer). Everything after is the same for an answer delivered
+   * and one asked for, so a repair, a join or a poison follows exactly the
+   * path it always has.
+   *
+   * Last, the barrier waits out every own write or mutation that a report —
+   * this answer's or an earlier one's — is outstanding against, until its
+   * acknowledgement says which came first (__nimbusReportedOwnAcknowledgements).
+   * Until then the resumption could run on own bytes the authority applied
+   * before a peer overwrote them. Nothing is waited on unless such a report
+   * exists.
    */
-  async function _acquireBarrier(supervisor) {
+  async function _acquireBarrier(supervisor, delivered) {
     if (!supervisor || typeof supervisor.fsAcquire !== "function") return [];
-    let result;
-    // Through the RPC helper like every other supervisor call, because it IS
-    // one: the barrier is the first thing an async read issues, and while it
-    // was uncounted __nimbusPendingOps read zero for a whole round trip. A
-    // one-shot facet's event loop, which exits when no handle is live, then
-    // ended the program mid-read — measured as an fs.promises.readFile whose
-    // .then never ran, no error, no output, intermittently, and never when a
-    // pending timer happened to hold the program open.
-    try { result = await __nimbusUseRpcResult(supervisor.fsAcquire(_cursor.epoch, _cursor.rev), (r) => r); }
-    catch { return []; }
-    if (!result || typeof result.rev !== "number") return [];
-    // Paths that held content before this eviction are the ones worth
-    // refetching at a resumption boundary — a later sync read of any of them
-    // would otherwise miss. Collected before the delete so the membership
-    // test is against the pre-eviction bundle.
-    const wereResident = [];
+    const fromDelivery = _deliveredAnswer(delivered);
+    // The overlay of this facet's own structural effects retires what settled
+    // before the answer was asked for: a delivered answer was asked for when
+    // its arguments were built, a fetched one now.
+    const begin = fromDelivery ? _argsBegin(delivered.args) : ++_barrierBegins;
+    let result = fromDelivery || await _acquire(supervisor);
     // When the resident set lives in the facet's own SQLite, the STORE applies
     // the delta. That is not an optimisation, it is where provenance has to
     // live: a facet's SQLite outlives its module scope, so a new incarnation
     // opens onto rows a previous one wrote while every heap-side stamp that
     // described them is gone. Rows carry their own revision, __vfsBundleRevisions
     // cannot follow them there, and two provenance stores would be one too many.
-    if (_residentStorePresent()) {
-      if (result.poison) {
-        _stats.poisons++;
-        await _repairPoisonedStore(supervisor, result);
-        // Nothing is returned because a dropped cell is either refetched by
-        // the repair or gone from the authority too.
-        return [];
+    {
+      // A namespace that stopped answering (a relist failed) is a failure
+      // state, not a mode: every barrier the process reaches repairs it, once,
+      // until a listing restores it.
+      let namespaceAsked = false;
+      for (let joins = 0; ; joins++) {
+        const joining = _residentRepair !== null;
+        const namespaceOwed = !namespaceAsked && !_nsActive();
+        // A sealed heap view can release acknowledged overlays before its
+        // listing; otherwise the old overlay and replacement rows would
+        // consume the same scarce allowance while preventing each other's
+        // repair. Nothing synchronous may consult the sealed view here.
+        if (namespaceOwed && __residentInHeap) _nsRetire(begin);
+        const needsRepair = result === null || result.poison === true || _storeRepairOwed || namespaceOwed;
+        if (!joining && !needsRepair) break;
+        if (namespaceOwed) { namespaceAsked = true; _stats.namespaceRepairs++; }
+        if (needsRepair) {
+          if (result !== null && result.poison === true) _stats.poisons++;
+          _spoilFills();
+        }
+        await (joining ? _residentRepair : _repairPoisonedStore(supervisor, result));
+        // A repair's listing is walked page by page at successive revisions,
+        // so even the barrier that started it asks once more: the delta from
+        // the listing's cursor leaves the namespace exact. Unanswered, it
+        // resumes on the repair's rows as they are, which the listing vouched
+        // for; the namespace then waits for the next barrier.
+        if (!joining) {
+          if (_storeRepairOwed) return [];
+          result = await _acquire(supervisor);
+          if (result === null || result.poison === true) { _nsRetire(begin); return []; }
+          continue;
+        }
+        if (joins + 1 >= _REPAIR_JOINS_MAX) {
+          // Every repair this barrier waited on was someone else's. Rather
+          // than resume on rows none of them vouched for as of its own
+          // answer, it drops them and leaves the repair owed: a colder cache,
+          // never a stale byte. Any repair still to finish lists after this.
+          __residentDropDated();
+          _storeRepairOwed = true;
+          __nimbusNoteUnnamedReports();
+          await _awaitReportedOwnWrites();
+          return [];
+        }
+        result = await _acquire(supervisor);
       }
+      // The store keeps a row of this facet's own bytes over any report, so
+      // the report is noted first: the write or mutation that owns the row
+      // judges it against its own revision when that arrives, as it does for
+      // a heap cell. A read in flight gets the same note.
+      if (Array.isArray(result.paths)) {
+        for (const entry of result.paths) _noteReport(entry);
+      }
+      // N18: room for what it pushes, before it is held.
+      await __residentRoomForPushed(result);
       const applied = __residentAdmit(result);
-      _cursor.epoch = result.epoch;
-      _cursor.rev = result.rev;
+      _cursor.epoch = applied.cursor.epoch;
+      _cursor.rev = applied.cursor.rev;
+      // A directory that became searchable has descendants no delta names.
+      for (const dir of applied.relist) await __nsRelist(supervisor, dir);
+      _nsRetire(begin);
       _stats.invalidations += applied.dropped.length;
+      _stats.selfWrites += applied.kept;
+      _stats.pushes += applied.pushed || 0;
+      await _awaitReportedOwnWrites();
       return applied.dropped;
     }
-    if (result.poison) {
-      if (__vfsBundle) for (const k of Object.keys(__vfsBundle)) { wereResident.push(k); _evictResident(k); }
-      _stats.poisons++;
-    } else if (Array.isArray(result.paths)) {
-      for (const entry of result.paths) {
-        const k = entry.path;
-        // This cursor is about to advance past the report, so a path with
-        // one of this facet's own writes in flight keeps the number: only
-        // that write's own revision, when it arrives, can say whether the
-        // report was itself or a peer. Everything else ignores it.
-        __nimbusNoteVfsReport(k, entry.rev);
-        if (__vfsBundleRevisions[k] >= entry.rev) { _stats.selfWrites++; continue; }
-        const held = !!(__vfsBundle && k in __vfsBundle);
-        if (_evictResident(k)) _stats.invalidations++;
-        if (held) wereResident.push(k);
+  }
+
+  /**
+   * Hold the resumption behind a barrier on every own write or mutation a
+   * report is outstanding against, until its acknowledgement says which came
+   * first (__nimbusReportedOwnAcknowledgements). Counted, because the wait is
+   * also paid when the report was the write itself coming back, which the
+   * facet cannot tell apart until the acknowledgement lands.
+   */
+  async function _awaitReportedOwnWrites() {
+    const acks = __nimbusReportedOwnAcknowledgements();
+    if (acks === null) return;
+    _stats.ownWriteWaits++;
+    await acks;
+  }
+
+  /**
+   * Repairs someone else started that one barrier waits on, in a row, before
+   * it stops asking again and drops what it cannot vouch for. A bound on the
+   * barrier's own liveness, not a tuning knob: each join waits a whole repair,
+   * so the fourth means repairs keep being started under it.
+   */
+  const _REPAIR_JOINS_MAX = 4;
+
+  /**
+   * What this facet asks its ACQUIRE with: its cursor. Built in one place, so
+   * what a delivery is answered from (a long poll sends these,
+   * \`__nimbusVfsAcquireArgs\`) is exactly what fsAcquire would be asked.
+   */
+  function _acquireArgs() {
+    // Every build is the start of an answer the overlay may retire against.
+    const begin = ++_barrierBegins;
+    const key = _cursor.epoch + "@" + _cursor.rev;
+    if (!_argsBegins.has(key)) _argsBegins.set(key, begin);
+    const options = _residentStorePresent() && typeof __residentAcquireOptions === "function"
+      ? __residentAcquireOptions() : undefined;
+    return options
+      ? { epoch: _cursor.epoch, cursor: _cursor.rev, options }
+      : { epoch: _cursor.epoch, cursor: _cursor.rev };
+  }
+  /**
+   * The earliest begin of any arguments built at a cursor: a delivered answer
+   * may answer any of them, and retiring against the earliest is the one
+   * that is never too late. Cursors left behind are forgotten.
+   */
+  const _argsBegins = new Map();
+  function _argsBegin(args) {
+    const key = args.epoch + "@" + args.cursor;
+    const begin = _argsBegins.get(key) ?? 0;
+    for (const k of [..._argsBegins.keys()]) {
+      const [epoch, rev] = [k.slice(0, k.lastIndexOf("@")), Number(k.slice(k.lastIndexOf("@") + 1))];
+      if (epoch !== _cursor.epoch || rev < _cursor.rev) _argsBegins.delete(k);
+    }
+    return begin;
+  }
+
+  /**
+   * One ACQUIRE: the authority's answer, or null when there is none — the
+   * call failed past the supervisor's own retries, the host could not serve
+   * it, or the answer carried no cursor. A null is counted where the
+   * coherence stats are read, and is never an empty delta (_acquireBarrier).
+   */
+  async function _acquire(supervisor) {
+    // Through the RPC helper like every other supervisor call, because it IS
+    // one: the barrier is the first thing an async read issues, and while it
+    // was uncounted __nimbusPendingOps read zero for a whole round trip. A
+    // one-shot facet's event loop, which exits when no handle is live, then
+    // ended the program mid-read — measured as an fs.promises.readFile whose
+    // .then never ran, no error, no output, intermittently, and never when a
+    // pending timer happened to hold the program open.
+    try {
+      const args = _acquireArgs();
+      const result = await __nimbusUseRpcResult(
+        args.options ? supervisor.fsAcquire(args.epoch, args.cursor, args.options) : supervisor.fsAcquire(args.epoch, args.cursor),
+        (r) => r,
+      );
+      if (!result || typeof result.rev !== "number" || typeof result.epoch !== "string") {
+        throw new Error("fsAcquire answered without a cursor");
       }
+      return _currentAnswer(result);
+    } catch (error) {
+      _stats.barrierFailures++;
+      _stats.lastBarrierFailure = (error && error.message) || String(error);
+      return null;
     }
-    _cursor.epoch = result.epoch;
-    _cursor.rev = result.rev;
-    return wereResident;
+  }
+
+  /**
+   * An answer as it stands against this facet's cursor now.
+   *
+   * Answers can be admitted in another order than they were given: an
+   * answer a long poll delivers was asked for before the barrier that
+   * overtook it. Everything at or below the cursor is admitted already, by
+   * whichever answer took the cursor past it — an answer is complete from
+   * the cursor it was asked from, which is never ahead of the cursor now, and
+   * names each path at its newest revision in its range. So only the entries
+   * above the cursor are news, and the cursor never moves back. An answer in
+   * another epoch, or a poison, is left as it is.
+   */
+  function _currentAnswer(result) {
+    if (result.poison === true || result.epoch !== _cursor.epoch) return result;
+    if (result.rev <= _cursor.rev) return { ...result, rev: _cursor.rev, paths: [] };
+    const paths = result.paths.filter((entry) => entry.rev > _cursor.rev);
+    return paths.length === result.paths.length ? result : { ...result, paths };
+  }
+
+  /**
+   * The answer a delivery carried (session/rpc.ts _acquireOnDelivery), as it
+   * stands against the cursor now, or null when it cannot stand in for
+   * asking. It can when it answers from a cursor this facet has reached, in
+   * this epoch: everything at or below that cursor is admitted, and the
+   * answer names everything after it up to the moment of delivery. The
+   * barrier asks, as it always has, when there is no answer or it is a
+   * poison, in another epoch, or from a cursor this facet has not reached — a
+   * routed request is answered from the supervisor's own cursor, "nothing
+   * since now", which stands in only for a facet that is already there.
+   */
+  function _deliveredAnswer(delivered) {
+    if (!delivered || typeof delivered !== "object") return null;
+    const { args, answer } = delivered;
+    if (!args || !answer || answer.poison === true || !Array.isArray(answer.paths)) return null;
+    if (typeof answer.rev !== "number" || answer.epoch !== _cursor.epoch || args.epoch !== _cursor.epoch) return null;
+    if (!(args.cursor <= _cursor.rev)) return null;
+    return _currentAnswer(answer);
   }
 
   /**
@@ -1688,9 +2168,22 @@ const __fsMod = (() => {
    * This closes staleness of RESIDENT cells across an untrusted resumption.
    * A first synchronous touch of a NON-resident path is the separate
    * residency floor and is unaffected — it still raises EAGAIN, correctly.
+   *
+   * Two resumptions can barrier at once — a child's output and its exit
+   * arrive together — and both deltas name the same changed path. The first
+   * to land evicts it and starts the refetch; the second finds no row and
+   * would release its callback while that refetch is still in flight, onto
+   * a miss. So a barrier also waits for every refetch still in flight.
+   * It does not read those paths again. A refetch in flight installs its
+   * bytes unless a barrier has since reported the path above the cursor it
+   * was issued under, or a poison spoiled it (_installResident). Only then
+   * does a later barrier read the path itself, and only if nothing holds it
+   * by now. Re-reading every in-flight path at every resumption cost a dev
+   * server 50 reads per request while a peer's refetch of 50 files ran: 500
+   * reads over ten resumptions, and under steady load the set never drained.
    */
-  async function _acquireAndRefetch(supervisor) {
-    const stale = await _acquireBarrier(supervisor);
+  async function _acquireAndRefetch(supervisor, delivered) {
+    const stale = await _acquireBarrier(supervisor, delivered);
     // Plus what an own-mutation lease dropped since the last resumption:
     // the same debt this function exists to settle, owed by an eviction
     // that had no barrier to report it (see _owedRefetch).
@@ -1698,8 +2191,58 @@ const __fsMod = (() => {
       for (const k of _owedRefetch) if (stale.indexOf(k) === -1) stale.push(k);
       _owedRefetch.clear();
     }
-    if (stale.length === 0) return;
-    await Promise.all(stale.map((k) => _liveReadFile("/" + k, undefined, true).catch(() => {})));
+    // Taken before this barrier's own refetches join the map.
+    const inFlight = [..._refetching];
+    const reads = stale.map(_refetch);
+    for (const [k, refetch] of inFlight) {
+      if (stale.indexOf(k) !== -1) continue;
+      if (!(refetch.fill.reported > refetch.fill.rev)) reads.push(refetch.done);
+      else if (!(__vfsBundle && k in __vfsBundle)) reads.push(_refetch(k));
+    }
+    if (reads.length > 0) await Promise.all(reads);
+  }
+
+  /**
+   * Refetches in flight, per path: the newest read of it, and the fill
+   * ticket that read installs under — the cursor it was issued at, and the
+   * reports noted against it since.
+   */
+  const _refetching = new Map();
+
+  /**
+   * Read \`k\` live and install it, behind the barrier just taken. Settles
+   * either way: a refetch that fails leaves the path missing, which the next
+   * read of it answers.
+   *
+   * \`read\` settles once this read has landed and its install was made or
+   * declined. \`done\`, which the resumptions wait on, may wait once more. An
+   * install is declined when a barrier reported the path above this read's
+   * cursor, or a poison spoiled it, and settling there would release every
+   * waiter onto the miss it left while something else is already filling
+   * the path: the newer refetch a barrier issued to replace this one, or the
+   * repair that poison started. So \`done\` waits on what is in flight at the
+   * moment this read settles, that refetch's own read and install and that
+   * repair, and then settles whether or not the path is held. It never
+   * follows a refetch issued after that. A peer that rewrites the path
+   * faster than one read round trip outdates every refetch with the next
+   * resumption's report, and following them held every resumption, including
+   * those that never read the path, until the writer stopped (1528 ms against
+   * 33 ms). A path left unheld is read live by its next read.
+   */
+  function _refetch(k) {
+    const fill = _beginFill(k);
+    const refetch = { fill, read: null, done: null };
+    refetch.read = _liveReadFile("/" + k, undefined, fill).then(() => {}, () => {}).then(() => {
+      _endFill(fill);
+      if (_refetching.get(k) === refetch) _refetching.delete(k);
+    });
+    refetch.done = refetch.read.then(() => {
+      if (__vfsBundle && k in __vfsBundle) return undefined;
+      const newer = _refetching.get(k);
+      return Promise.all([newer && newer.read, _residentRepair]);
+    });
+    _refetching.set(k, refetch);
+    return refetch.done;
   }
 
   /**
@@ -1711,14 +2254,15 @@ const __fsMod = (() => {
    * its fetch handler; binding the supervisor when the wrappers are
    * installed would silently leave every resident-TUI timer unbarriered.
    *
-   * Published on globalThis because the two other untrusted resumptions —
-   * an outbound fetch response and a relayed socket frame — are delivered
-   * by code outside this closure. One barrier, three boundaries.
+   * Published on globalThis because the other resumptions — an outbound
+   * fetch response, a relayed socket frame, and everything the supervisor
+   * delivers (\`__nimbusInboundBarrier\`, with the answer it delivered) — are
+   * handed to the program by code outside this closure.
    */
-  async function _resumptionAcquire() {
+  async function _resumptionAcquire(delivered) {
     const supervisor = _supervisor();
     if (!supervisor || typeof supervisor.fsAcquire !== "function") return;
-    await _acquireAndRefetch(supervisor);
+    await _acquireAndRefetch(supervisor, delivered);
   }
 
   /**
@@ -1752,6 +2296,7 @@ const __fsMod = (() => {
     if (globalThis.__nimbusResumptionBarriersInstalled) return;
     globalThis.__nimbusResumptionBarriersInstalled = true;
     globalThis.__nimbusVfsAcquireBarrier = _resumptionAcquire;
+    globalThis.__nimbusVfsAcquireArgs = _acquireArgs;
     globalThis.__nimbusVfsReleaseBarrier = _resumptionRelease;
     const _setTimeout = globalThis.setTimeout;
     const _setInterval = globalThis.setInterval;
@@ -1859,8 +2404,9 @@ const __fsMod = (() => {
   // \`method\` names the supervisor RPC when it differs from the syscall the
   // caller reports (lchown rides \`chown\`, rm rides \`fsRemove\`).
   function _queueStructuralMutation(absPath, syscall, displayPath, rpc, after, method) {
+    const settle = _nsTakeFresh();
     const supervisor = _supervisor();
-    if (!supervisor || typeof supervisor[method || syscall] !== "function") return null;
+    if (!supervisor || typeof supervisor[method || syscall] !== "function") { settle(); return null; }
     const queued = _hasVfsMutationQueue();
     const before = queued && after ? after() : null;
     const run = async () => {
@@ -1876,7 +2422,11 @@ const __fsMod = (() => {
       );
       _markVfsStale();
     };
-    return queued ? __nimbusQueueVfsMutation(absPath, run) : run();
+    const out = queued ? __nimbusQueueVfsMutation(absPath, run) : run();
+    // Settled either way: a failed mutation leaves the authority as it was,
+    // which the next barrier's table shows.
+    Promise.resolve(out).then(settle, settle);
+    return out;
   }
 
   /**
@@ -1889,25 +2439,33 @@ const __fsMod = (() => {
    * effect while the lease still holds the cell, so the stamp the end
    * settles describes a cell that already carries the mutation.
    *
-   * Heap-side stamps do not describe rows in the resident store, so store
-   * mode has no lease to take and is left to the store's own provenance.
+   * The ledger takes the lease on whichever holds the stamp: a heap stamp,
+   * or the resident store's row. Without it a store row the mutation
+   * overlaid would be left as own bytes nobody ever dates, which the barrier
+   * keeps against every later write by anyone.
+   *
+   * From lease to receipt it is an acknowledgement in flight
+   * (__nimbusOwnAcknowledgement): a barrier that reports the path waits for
+   * it, rather than resume on bytes the receipt may yet show a peer outran.
    */
-  async function _ownMutation(absPath, rpc, apply) {
+  function _ownMutation(absPath, rpc, apply) {
     const key = _strip(absPath);
-    const held = !_residentStorePresent() && __nimbusBeginOwnMutation(key);
-    let receipt;
-    let landed = false;
-    try { receipt = await rpc(); landed = true; }
-    finally {
-      // The local effect follows the mutation landing, not the receipt: the
-      // receipt only settles the stamp, and a supervisor that answers
-      // without one still applied the bytes. The end runs even if applying
-      // throws: a lease left open pins its cell at Infinity, which is the one
-      // state in this protocol that can serve a stale byte forever.
-      try { if (landed && apply) apply(receipt); }
-      finally { __nimbusEndOwnMutation(key, held, receipt); }
-    }
-    return receipt;
+    return __nimbusOwnAcknowledgement(key, async () => {
+      const held = __nimbusBeginOwnMutation(key);
+      let receipt;
+      let landed = false;
+      try { receipt = await rpc(); landed = true; }
+      finally {
+        // The local effect follows the mutation landing, not the receipt: the
+        // receipt only settles the stamp, and a supervisor that answers
+        // without one still applied the bytes. The end runs even if applying
+        // throws: a lease left open pins its cell at Infinity, which is the one
+        // state in this protocol that can serve a stale byte forever.
+        try { if (landed && apply) apply(receipt); }
+        finally { __nimbusEndOwnMutation(key, held, receipt); }
+      }
+      return receipt;
+    });
   }
 
   // A sync caller has no frame to receive the outcome. The ledger already
@@ -1942,6 +2500,8 @@ const __fsMod = (() => {
         "write", absPath,
         (result) => result,
       ),
+      true,
+      true,
     );
   }
 
@@ -1952,13 +2512,18 @@ const __fsMod = (() => {
       await _flushParkedWrite(absPath, supervisor);
       _markVfsStale();
     }
-    // Pending sync chmod rides along with any flush of the same path
-    // (idempotent — the entry stays so local statSync remains coherent).
-    if (k in _localModes && typeof supervisor.chmod === "function") {
-      await _ownMutation(
-        absPath,
-        () => _fsRpc(supervisor.chmod(absPath, _localModes[k]), "chmod", absPath, (result) => result),
-      );
+    // A pending sync chmod rides along with the next flush of the same path.
+    if (_pendingModes.has(k) && typeof supervisor.chmod === "function") {
+      _pendingModes.delete(k);
+      try {
+        await _ownMutation(
+          absPath,
+          () => _fsRpc(supervisor.chmod(absPath, _localModes[k]), "chmod", absPath, (result) => result),
+        );
+      } catch (error) {
+        _pendingModes.add(k);
+        throw error;
+      }
       _markVfsStale();
     }
   }
@@ -2046,8 +2611,11 @@ const __fsMod = (() => {
     const atime = new Date(Number(meta?.atime || meta?.mtime || Date.now()));
     const mode = Number(meta?.mode ?? (isDir ? 0o755 : 0o644));
     const stat = _localStatObject(key, isDir, isSymlink, size, mode, meta?.uid, meta?.gid);
-    stat.atime = atime;
-    stat.mtime = mtime;
+    // This process's own utimes, until it is reported back, ahead of the
+    // namespace's (_recordLocalTimes).
+    const own = key === undefined ? undefined : _localTimes[key];
+    stat.atime = own && Number.isFinite(own.atimeMs) ? new Date(own.atimeMs) : atime;
+    stat.mtime = own && Number.isFinite(own.mtimeMs) ? new Date(own.mtimeMs) : mtime;
     stat.ctime = new Date(Number(meta?.ctime ?? meta?.mtime ?? Date.now()));
     stat.birthtime = stat.ctime;
     return stat;
@@ -2080,24 +2648,32 @@ const __fsMod = (() => {
   // multi-MB file for one RPC frame.
   const READ_STREAM_CHUNK_BYTES = 65536;
 
-  // Ranged reads issued in the same microtask turn travel as ONE batch.
+  // Ranged reads issued in the same microtask turn travel as ONE batch, and
+  // so do lstats (_learnLive): one request kind each, one round trip.
   //
   // A round trip costs an order of magnitude more than the read behind it,
   // so a program awaiting reads one at a time pays for round trips and
   // nothing else. Nothing here changes what a read sees: every request is
-  // the same live ranged read, executed in order, in the caller's turn. The
-  // gather window is one microtask, so it can only capture reads the program
-  // had already issued concurrently — a sequential loop batches nothing
-  // because it has issued nothing else to batch.
+  // the same live ranged read or lstat, executed in order, in the caller's
+  // turn. The gather window is one microtask, so it can only capture
+  // requests the program had already issued concurrently — a sequential
+  // loop batches nothing because it has issued nothing else to batch.
   const READ_BATCH_PATH_LIMIT = ${FS_READ_BATCH_PATH_LIMIT};
   const READ_BATCH_REQUEST_BYTES = ${FS_READ_BATCH_REQUEST_BYTES};
   let _openReadBatch = null;
 
   function _queueRangeRead(supervisor, absPath, pos, want) {
+    return _queueBatchRequest(supervisor, { path: absPath, offset: pos, length: want }, want);
+  }
+
+  // \`request\` in the open batch, \`bytes\` of file content counted against the
+  // batch's bound. Settles with the entry's bytes for a range, its stat for
+  // an lstat.
+  function _queueBatchRequest(supervisor, request, bytes) {
     let batch = _openReadBatch;
     if (batch && (
       batch.requests.length >= READ_BATCH_PATH_LIMIT
-      || batch.bytes + want > READ_BATCH_REQUEST_BYTES
+      || batch.bytes + bytes > READ_BATCH_REQUEST_BYTES
     )) {
       _openReadBatch = null;
       _flushReadBatch(batch);
@@ -2107,17 +2683,24 @@ const __fsMod = (() => {
       batch = { supervisor, requests: [], settlers: [], bytes: 0 };
       _openReadBatch = batch;
       queueMicrotask(() => {
-        if (_openReadBatch === batch) _openReadBatch = null;
+        // A batch a bound closed was flushed then; sending it here too would
+        // read every entry of it twice.
+        if (_openReadBatch !== batch) return;
+        _openReadBatch = null;
         _flushReadBatch(batch);
       });
     }
-    batch.bytes += want;
-    batch.requests.push({ path: absPath, offset: pos, length: want });
-    return new Promise((resolve, reject) => { batch.settlers.push({ resolve, reject }); });
+    batch.bytes += bytes;
+    batch.requests.push(request);
+    const settler = Promise.withResolvers();
+    batch.settlers.push(settler);
+    return settler.promise;
   }
 
   async function _flushReadBatch(batch) {
-    globalThis.__nimbusFsRpcReads++;
+    // A read round trip is one that carries a range; a batch of learns
+    // (lstat requests) is metadata, which the read count leaves out.
+    if (batch.requests.some((request) => request.lstat !== true)) globalThis.__nimbusFsRpcReads++;
     try {
       const entries = await __nimbusUseRpcResult(
         batch.supervisor.fsReadBatch(batch.requests), (r) => r,
@@ -2128,6 +2711,8 @@ const __fsMod = (() => {
           const err = new Error(entry.error.message);
           if (entry.error.code) err.code = entry.error.code;
           batch.settlers[i].reject(err);
+        } else if (batch.requests[i].lstat === true) {
+          batch.settlers[i].resolve(entry ? entry.stat : null);
         } else {
           batch.settlers[i].resolve(entry ? entry.bytes : null);
         }
@@ -2192,59 +2777,83 @@ const __fsMod = (() => {
     return parts;
   }
 
-  async function _liveReadFile(p, opts, skipAcquire) {
+  async function _liveReadFile(p, opts, refetch) {
     const absPath = _resolve(p);
     const encoding = typeof opts === "string" ? opts : opts?.encoding;
     const supervisor = _supervisor();
     if (!supervisor) throw _fsErr("ENOENT", "open", p);
-    // The refetch step of _acquireAndRefetch has already acquired against a
-    // fresh cursor, so re-acquiring here would be a redundant round trip
-    // that always returns "still R". Every other caller acquires.
-    if (!skipAcquire) await _acquireBarrier(supervisor);
-
-    if (typeof supervisor.fsReadRange === "function") {
-      // Chunked: the caller wants the whole file, but nothing upstream has
-      // to hold it all at once to produce it.
-      //
-      // A short chunk is the only signal the file ended, so this walk could
-      // only ever have one chunk in flight — 65 sequential round trips for a
-      // 4 MiB file, each costing far more than the read behind it. The FIRST
-      // chunk still costs exactly one trip and settles it for every file
-      // that fits in one. When it comes back full there is demonstrably
-      // more, and a stat says how much, so the remainder is issued together
-      // and the read batch carries it in a single trip.
-      const parts = [];
-      let total = 0;
-      for (;;) {
-        const chunk = await _readRangeAt(absPath, p, total, READ_STREAM_CHUNK_BYTES);
-        if (chunk === null) break;
-        parts.push(chunk);
-        total += chunk.byteLength;
-        if (chunk.byteLength < READ_STREAM_CHUNK_BYTES) break;
-        if (typeof supervisor.stat !== "function") continue;
-        for (const rest of await _readChunksFrom(absPath, p, supervisor, total)) {
-          parts.push(rest);
-          total += rest.byteLength;
+    // A refetch (_refetch) has already acquired against a fresh cursor and
+    // holds the fill ticket issued under it, so re-acquiring here would be a
+    // redundant round trip that always returns "still R". Every other caller
+    // acquires, and its fill ticket is its own.
+    if (!refetch) await _acquireBarrier(supervisor);
+    const fill = refetch || _beginFill(_strip(absPath));
+    try {
+      if (typeof supervisor.fsReadRange === "function") {
+        // Chunked: the caller wants the whole file, but nothing upstream has
+        // to hold it all at once to produce it.
+        //
+        // A short chunk is the only signal the file ended, so this walk could
+        // only ever have one chunk in flight — 65 sequential round trips for a
+        // 4 MiB file, each costing far more than the read behind it. The FIRST
+        // chunk still costs exactly one trip and settles it for every file
+        // that fits in one. When it comes back full there is demonstrably
+        // more, and a stat says how much, so the remainder is issued together
+        // and the read batch carries it in a single trip.
+        const parts = [];
+        let total = 0;
+        for (;;) {
+          const chunk = await _readRangeAt(absPath, p, total, READ_STREAM_CHUNK_BYTES);
+          if (chunk === null) break;
+          parts.push(chunk);
+          total += chunk.byteLength;
+          if (chunk.byteLength < READ_STREAM_CHUNK_BYTES) break;
+          if (typeof supervisor.stat !== "function") continue;
+          for (const rest of await _readChunksFrom(absPath, p, supervisor, total)) {
+            parts.push(rest);
+            total += rest.byteLength;
+          }
+          break;
         }
-        break;
+        const bytes = parts.length === 1 ? parts[0] : _concatBytes(parts, total);
+        _installResident(absPath, bytes, fill);
+        await _learnLive(absPath, supervisor);
+        return encoding ? _asString(bytes) : __BufferMod.from(bytes);
       }
-      const bytes = parts.length === 1 ? parts[0] : _concatBytes(parts, total);
-      _installResident(absPath, bytes);
-      return encoding ? _asString(bytes) : __BufferMod.from(bytes);
-    }
 
-    if (typeof supervisor.readFile === "function") {
-      await _flushLocalPathToSupervisor(absPath, supervisor);
-      const text = await _fsReadRpc(supervisor.readFile(absPath), "open", p, (result) => result);
-      if (text !== null && text !== undefined) {
-        _installResident(absPath, text);
-        return encoding ? _asString(text) : __BufferMod.from(text);
+      if (typeof supervisor.readFile === "function") {
+        await _flushLocalPathToSupervisor(absPath, supervisor);
+        const text = await _fsReadRpc(supervisor.readFile(absPath), "open", p, (result) => result);
+        if (text !== null && text !== undefined) {
+          _installResident(absPath, text, fill);
+          await _learnLive(absPath, supervisor);
+          return encoding ? _asString(text) : __BufferMod.from(text);
+        }
       }
+    } finally {
+      if (!refetch) _endFill(fill);
     }
 
     throw _fsErr("ENOENT", "open", p);
   }
 
+
+
+  /** Paths whose write-back this process issued and the authority accepted. */
+  const _acceptedHere = new Set();
+  globalThis.__nimbusVfsWriteLanded = (key) => {
+    const k = String(key).replace(/^\\/+/, "");
+    _acceptedHere.add(k);
+  };
+
+  // The authority refused a parked write (vfs-write-ledger): the record may
+  // be that write's, so it is forgotten and the next access asks the authority.
+  globalThis.__nimbusVfsWriteRefused = (key) => {
+    const k = String(key).replace(/^\\/+/, "");
+    _createdHere.delete(k);
+    _acceptedHere.delete(k);
+  };
+
   function _concatBytes(parts, total) {
     const out = new Uint8Array(total);
     let off = 0;
@@ -2316,24 +2925,11 @@ const __fsMod = (() => {
         // its shape: the sync existence view must not go on contradicting a
         // directory this very process has enumerated. Names only — size, mode
         // and ownership are not observable here and are never invented.
-        if (__vfsManifest) __vfsManifest[key] = entries.map((entry) => entry.name);
-        // Which of the children are directories IS observable here, and it is
-        // the one fact a later synchronous listing cannot recover on its own —
-        // an unwalked subdirectory has no manifest entry, so without this it
-        // reads back as a file. A directory's size is 0 in this filesystem, so
-        // recording it invents nothing; file children are left alone, because
-        // their size is not knowable from a listing and must not be guessed.
-        const metadataTable = _metadataTable();
-        if (metadataTable) {
-          for (const entry of entries) {
-            if (entry.type !== "directory") continue;
-            const child = prefix + entry.name;
-            if (child in metadataTable) continue;
-            metadataTable[child] = {
-              type: "directory", size: 0, mode: 0o755, uid: cred.uid, gid: cred.gid,
-            };
-          }
-        }
+        // The listed directory and its child directories get the authority's
+        // own stat: a later synchronous stat or listing of them needs a record
+        // saying what they are, and a record says who owns them, which a
+        // listing does not. So it is asked for, never assumed (one lstat per
+        // child directory, concurrently).
         if (opts?.withFileTypes) {
           return entries
             .map((entry) => _direntObject(entry.name, entry.type, absPath))
@@ -2391,6 +2987,8 @@ const __fsMod = (() => {
         _fsRpc(supervisor.writeFile(absPath, content), "write", p, (result) => result)
       );
       _markVfsStale();
+      // Accepted: the authority's stat is what the sync view keeps for it.
+      await _learnLive(absPath, supervisor);
     }
   }
 
@@ -2409,6 +3007,7 @@ const __fsMod = (() => {
       ),
     );
     _markVfsStale();
+    await _learnLive(absPath, supervisor);
   }
 
   // The async structural calls ARE the sync ones, awaited: the same local
@@ -2516,11 +3115,27 @@ const __fsMod = (() => {
     if (!supervisor && !existsSync(p)) throw _fsErr("ENOENT", syscall, p);
   }
 
+  /**
+   * chmod(2): only the owner or root changes a mode (EPERM). The local
+   * overlay is what statSync reports and what the local permission checks
+   * read, so a mode set here without that check made a root-owned file
+   * writable in the process's own view.
+   */
+  function _ensureModeOwner(absPath, syscall, p) {
+    if (Number(cred.uid) === 0) return;
+    const stat = _statLadder(absPath);
+    if (stat === undefined) throw _fsErr("ENOENT", syscall, p);
+    if (Number(stat.uid) !== Number(cred.uid)) throw _fsErr("EPERM", syscall, p);
+  }
+
   function chmodSync(p, mode) {
     if (!existsSync(p)) throw _fsErr("ENOENT", "chmod", p);
+    _ensureModeOwner(_resolve(p), "chmod", p);
     // Local-visible immediately (statSync overlay); the live write-through
     // rides the next flush of the same path — same fidelity as utimesSync.
-    _localModes[_strip(_resolve(p))] = _coerceMode(mode, "chmod", p);
+    const k = _strip(_resolve(p));
+    _localModes[k] = _coerceMode(mode, "chmod", p);
+    _pendingModes.add(k);
   }
 
   async function _chmodAsync(p, mode) {
@@ -2532,7 +3147,9 @@ const __fsMod = (() => {
       throw _fsErr("ENOENT", "chmod", p);
     }
     const m = _coerceMode(mode, "chmod", p);
+    if (localExists) _ensureModeOwner(absPath, "chmod", p);
     _localModes[_strip(absPath)] = m;
+    _pendingModes.add(_strip(absPath));
     if (supervisor && typeof supervisor.chmod === "function") {
       await _flushLocalPathToSupervisor(absPath, supervisor);
       _markVfsStale();
@@ -2584,6 +3201,18 @@ const __fsMod = (() => {
     }
     const nextUid = _coerceId(uid, syscall, p);
     const nextGid = _coerceId(gid, syscall, p);
+    // chown(2): root changes anything; the owner may only set the group to
+    // one of its own groups, and never the owner. Checked before the local
+    // row changes: that row is what the local permission checks read.
+    if (Number(cred.uid) !== 0) {
+      const stat = _statLadder(absPath);
+      if (stat === undefined) throw _fsErr("ENOENT", syscall, p);
+      const groups = [Number(cred.gid), ...cred.groups.map(Number)];
+      if (Number(stat.uid) !== Number(cred.uid) || nextUid !== Number(stat.uid)
+        || (nextGid !== Number(stat.gid) && !groups.includes(nextGid))) {
+        throw _fsErr("EPERM", syscall, p);
+      }
+    }
     const meta = _metadata(absPath);
     if (meta) { meta.uid = nextUid; meta.gid = nextGid; }
     // The parked write must be registered on the tail BEFORE the chown is
@@ -2600,21 +3229,25 @@ const __fsMod = (() => {
   function lchownSync(p, uid, gid) { _detachStructuralMutation(_chownQueued(p, uid, gid, { followSymlinks: false }, "lchown")); }
   function lchmodSync(p, mode) { chmodSync(p, mode); }
 
+  /**
+   * Whether this process may WANT (r=4, w=2, x=1) a path whose stat is
+   * META, by POSIX's owner/group/other rule. Only a stat that states the
+   * owner, group and mode can be judged; one that does not is not judged in
+   * the process's favour: absent fields used to default to mode 0644 and
+   * owner 1000, which made any undescribed file the reader's own.
+   */
   function _modeAllows(meta, want) {
     if (want === 0) return true;
-    const mode = Number(meta?.mode ?? 0o644) & 0o777;
+    const mode = Number(meta?.mode);
+    const uid = Number(meta?.uid);
+    const gid = Number(meta?.gid);
+    if (!Number.isInteger(mode) || !Number.isInteger(uid) || !Number.isInteger(gid)) return false;
+    const bits = mode & 0o777;
     const currentUid = Number(cred.uid);
-    const currentGid = Number(cred.gid);
+    if (currentUid === 0) return (want & 1) === 0 || (bits & 0o111) !== 0;
     const groups = cred.groups.map(Number);
-    if (currentUid === 0) {
-      if ((want & 1) !== 0 && (mode & 0o111) === 0) return false;
-      return true;
-    }
-    const shift = currentUid === Number(meta?.uid ?? 1000)
-      ? 6
-      : (currentGid === Number(meta?.gid ?? 1000) || groups.includes(Number(meta?.gid ?? 1000))) ? 3 : 0;
-    const available = (mode >> shift) & 7;
-    return (available & want) === want;
+    const shift = currentUid === uid ? 6 : (Number(cred.gid) === gid || groups.includes(gid)) ? 3 : 0;
+    return (((bits >> shift) & 7) & want) === want;
   }
 
   function _ensureAncestorsTraversable(absPath, syscall, p) {
@@ -2628,34 +3261,31 @@ const __fsMod = (() => {
   function _ensureWritable(absPath, syscall, p) {
     _ensureAncestorsTraversable(absPath, syscall, p);
     const cell = _bundleLookup(absPath);
-    const meta = _metadata(absPath);
-    // The ladder rather than existsSync: a write to a path outside the staged
-    // view is a legitimate create, and must not be turned into a refusal by
-    // the check that guards it.
-    if (meta !== undefined || cell !== undefined || _statLadder(absPath) !== undefined) {
-      const denial = _denialCode(cell);
-      if (denial || !_modeAllows(meta, 2)) throw _fsErr(denial || "EACCES", syscall, p);
+    const denial = _denialCode(cell);
+    if (denial) throw _fsErr(denial, syscall, p);
+    // Judged on what the authority says of the path (or of a file this
+    // process made), never on the bytes held under its name.
+    const stat = _statLadder(absPath);
+    if (stat !== undefined) {
+      if (!_modeAllows(stat, 2)) throw _fsErr("EACCES", syscall, p);
       return;
     }
+    // Nothing there: a create, judged by the parent the namespace describes.
 
     const parent = __pathMod.dirname(absPath);
-    const parentMeta = _metadata(parent);
-    if (parentMeta) {
-      if (parentMeta.type && parentMeta.type !== "directory") throw _fsErr("ENOTDIR", syscall, p);
-      if (!_modeAllows(parentMeta, 3)) throw _fsErr("EACCES", syscall, p);
+    const parentStat = _statLadder(parent);
+    if (parentStat !== undefined) {
+      if (!parentStat.isDirectory()) throw _fsErr("ENOTDIR", syscall, p);
+      if (!_modeAllows(parentStat, 3)) throw _fsErr("EACCES", syscall, p);
       return;
     }
 
-    const parentKey = _strip(parent);
-    const parentIsLocal = parent === cwd || parent === "/" ||
-      (!!__vfsDirs && parentKey in __vfsDirs) ||
-      (!!__vfsManifest && parentKey in __vfsManifest);
-    if (parentIsLocal || _supervisor()) return;
     throw _fsErr("ENOENT", syscall, p);
   }
 
   function accessSync(p, mode) {
     const absPath = _resolve(p);
+    _nsRequire("access", p, "fs.promises.access");
     const cell = _bundleLookup(absPath);
     const meta = _metadata(absPath);
     if (cell === undefined && meta === undefined && !existsSync(p)) throw _fsErr("ENOENT", "access", p);
@@ -2666,7 +3296,10 @@ const __fsMod = (() => {
     _ensureAncestorsTraversable(absPath, "access", p);
     const denial = _denialCode(cell);
     if ((requested & 4) !== 0 && denial) throw _fsErr(denial, "access", p);
-    if (!_modeAllows(meta, requested)) throw _fsErr("EACCES", "access", p);
+    if (requested === 0) return;
+    const stat = _statLadder(absPath);
+    if (stat === undefined) throw _fsErr("ENOENT", "access", p);
+    if (!_modeAllows(stat, requested)) throw _fsErr("EACCES", "access", p);
   }
 
   async function _accessAsync(p, mode) {
@@ -2777,42 +3410,12 @@ const __fsMod = (() => {
   // ── existsSync ──
   function existsSync(p) {
     const absPath = _resolve(p);
-    const k = _strip(absPath);
-    if (_metadata(absPath) !== undefined) { _residencySatisfied(absPath); return true; }
-    if (__vfsBundle && k in __vfsBundle) { _residencySatisfied(absPath); return true; }
-    if (__vfsWrites && k in __vfsWrites) { _residencySatisfied(absPath); return true; }
-    if (__vfsDirs && k in __vfsDirs) { _residencySatisfied(absPath); return true; }
-    // W2.5b root-cause fix: consult the manifest BEFORE falling back to
-    // the O(N) bundle-prefix scan. The manifest is uncapped and always
-    // reflects the real directory shape, even when the file content for
-    // a directory's contents was excluded by the 4 MiB / 500-file content
-    if (__vfsManifest) {
-      if (k in __vfsManifest) { _residencySatisfied(absPath); return true; }
-      // Path may be a file listed by its parent's manifest entry.
-      const slash = k.lastIndexOf("/");
-      const parent = slash >= 0 ? k.slice(0, slash) : "";
-      const name = slash >= 0 ? k.slice(slash + 1) : k;
-      const sib = __vfsManifest[parent];
-      if (sib && sib.indexOf(name) !== -1) { _residencySatisfied(absPath); return true; }
-    }
-    // Last-resort: bundle dir entries
-    if (__vfsBundle && (k in __vfsBundle || __residentAnyUnder(k + "/"))) {
-      _residencySatisfied(absPath);
-      return true;
-    }
-    // Nothing found — which is only an answer if the enclosing directory was
-    // enumerated. Node's existsSync never throws, so the false below is
-    // provisional: the miss is recorded, the listing that settles it is pulled
-    // in, and the exit report fails the run if the path turns out to have been
-    // there all along.
-    if (!_absenceIsKnown(absPath)) {
-      _recordUnmapped(absPath, "access");
-      return false;
-    }
+    _nsRequire("access", p, "fs.promises.access");
     _residencySatisfied(absPath);
-    return false;
+    return _statLadder(absPath) !== undefined;
   }
 
+
   // ── statSync ──
   function statSync(p, opts) {
     const absPath = _resolve(p);
@@ -2825,16 +3428,12 @@ const __fsMod = (() => {
   // classify a miss without redoing the resolve and ancestor walk it just
   // performed — that path runs on every module-resolution probe.
   function _statResolved(absPath, p, opts) {
+    _nsRequire("stat", p, "fs.promises.stat");
     const stat = _statLadder(absPath);
-    // An answer settles the path, including the honest "not there" below —
-    // what the ledger is for is reads that went unanswered, not reads that came
-    // back with news the caller did not want. A PROVISIONAL not-there is not an
-    // answer, so the unmapped branch deliberately leaves the record standing.
-    if (stat !== undefined) { _residencySatisfied(absPath); return stat; }
-    // Nothing in the view describes the path, and there are two very different
-    // reasons for that. Only one of them means the file is not there.
-    if (_absenceIsKnown(absPath)) _residencySatisfied(absPath);
-    else _recordUnmapped(absPath, "stat");
+    // An answer settles the path, including the honest "not there": the
+    // namespace names every path this credential can see.
+    _residencySatisfied(absPath);
+    if (stat !== undefined) return stat;
     // Node's statSync honors { throwIfNoEntry: false } by returning undefined
     // for a missing path instead of throwing.
     if (opts && opts.throwIfNoEntry === false) return undefined;
@@ -2847,154 +3446,45 @@ const __fsMod = (() => {
    * MEANS — absence and ignorance are different answers and only one of them
    * is a condition a program can act on, so the callers classify.
    */
-  function _statLadder(absPath) {
+  function _statLadder(absPath, noFollow) {
     const k = _strip(absPath);
-    // Content written this exec session is newer than the spawn-time
-    // metadata snapshot, so it — not __vfsMetadata — is authoritative for
-    // size. Without this, fstatSync/statSync on a file we just wrote report
-    // the pre-write length.
-    if (__vfsWrites && k in __vfsWrites && _denialCode(__vfsWrites[k]) === null) {
-      const meta = _metadata(absPath);
-      const size = _byteLen(__vfsWrites[k]);
-      // Correct only the size — reusing the metadata record keeps the type
-      // and the recorded timestamps stable, so mtime-based change detection
-      // (make, tsc --build, watchers) does not see every call as a change.
-      if (meta) return _statObject({ ...meta, size }, k);
-      return _localStatObject(
-        k, false, false, size, 0o666 & ~__processUmask, cred.uid, cred.gid,
-      );
-    }
-    const metadata = _metadata(absPath);
-    if (metadata) return _statObject(metadata, k);
-    // Check if it's a known directory written this exec session
-    if (__vfsDirs && k in __vfsDirs) {
-      return _localStatObject(k, true, false, 0, 0o777 & ~__processUmask, cred.uid, cred.gid);
-    }
-    // W2.5b: consult uncapped manifest first for directory shape.
-    if (__vfsManifest && k in __vfsManifest) {
-      return _localStatObject(k, true, false, 0, 0o755, cred.uid, cred.gid);
-    }
-    // File with content embedded?
-    const content = _bundleLookup(absPath);
-    if (content !== undefined) {
-      // _byteLen handles both string (UTF-8 encode) and Uint8Array
-      // (byteLength) — fixes binary writes from reporting the
-      // post-corruption byte count.
-      const size = _byteLen(content);
-      return _localStatObject(k, false, false, size, 0o666 & ~__processUmask, cred.uid, cred.gid);
-    }
-    // File listed in parent's manifest but content was capped out — return
-    // a zero-size file stat so callers like fs.stat / fs.statSync see the
-    // file as present (downstream readFileSync will surface ENOENT if it
-    // actually tries to read content; many consumers only need stat).
-    if (__vfsManifest) {
-      const slash = k.lastIndexOf("/");
-      const parent = slash >= 0 ? k.slice(0, slash) : "";
-      const name = slash >= 0 ? k.slice(slash + 1) : k;
-      const sib = __vfsManifest[parent];
-      if (sib && sib.indexOf(name) !== -1) {
-        return _localStatObject(k, false, false, 0, 0o644, cred.uid, cred.gid);
-      }
-    }
-    // Last-resort: bundle prefix scan (legacy path).
-    if (__vfsBundle && __residentAnyUnder(k + "/")) {
-      return _localStatObject(k, true, false, 0, 0o755, cred.uid, cred.gid);
-    }
-    return undefined;
+    _nsRequire("stat", absPath, "fs.promises.stat");
+    const meta = _nsMeta(k, !noFollow);
+    if (meta === "absent" || meta === "ELOOP") return undefined;
+    return meta.own
+      ? _localStatObject(k, meta.type === "directory", false, meta.size, meta.mode & 0o7777, meta.uid, meta.gid)
+      : _statObject(meta, k);
   }
 
   // ── lstatSync (alias for statSync in our VFS — no symlinks) ──
-  function lstatSync(p, opts) { return statSync(p, opts); }
+  function lstatSync(p, opts) {
+    const absPath = _resolve(p);
+    _nsRequire("lstat", p, "fs.promises.lstat");
+    _ensureAncestorsTraversable(absPath, "lstat", p);
+    const stat = _statLadder(absPath, true);
+    if (stat !== undefined) return stat;
+    if (opts && opts.throwIfNoEntry === false) return undefined;
+    throw _fsErr("ENOENT", "lstat", p);
+  }
 
   // ── readdirSync ──
-  // W2.5b root-cause fix: prefer the uncapped __vfsManifest for directory
-  // listings. The legacy bundle-prefix scan is kept as a fallback for paths
-  // not in the manifest (e.g. dirs created at exec time via mkdirSync) and
-  // is unioned with __vfsWrites so newly-written files become visible.
+  // The namespace's listing of the directory, with this process's own
+  // structural effects over it (_nsList).
   function readdirSync(p, opts) {
     const absPath = _resolve(p);
+    _nsRequire("scandir", p, "fs.promises.readdir");
     _ensureAncestorsTraversable(absPath, "scandir", p);
     const metadata = _metadata(absPath);
     if (metadata && !_modeAllows(metadata, 4)) throw _fsErr("EACCES", "scandir", p);
     const k = _strip(absPath);
-    // A listing is the one answer with no way to express doubt: an array is a
-    // complete enumeration by definition, so returning what happens to be
-    // known asserts that nothing else is there. Only a directory the walk
-    // enumerated, or one this process created, can honestly be listed.
-    if (!_dirEnumerated(k) && !_bundleHasChildren(k)) {
-      // An authority exists that this call cannot reach, so an empty array
-      // would be a claim about a directory nothing ever opened. Refuse, and
-      // pull the listing in for the next one.
-      //
-      // This is the one caller that keeps refusing. Everywhere else the sync
-      // view answers a path it cannot map with the not-found the program was
-      // written to handle, provisionally, and lets the exit report settle
-      // whether that answer was true. A listing has no such answer to give:
-      // "no config yet, write one" is an idiom every program implements, and
-      // there is no counterpart for a directory — a caller handed ENOENT for a
-      // template tree has nowhere to go but the same wrong branch an empty
-      // array sent it down, and the array at least it could not detect.
-      if (_supervisor()) {
-        throw _refuseUnmapped(absPath, p, "scandir", "fs.promises.readdir");
-      }
-      // No authority: the staged tables are the whole filesystem. A path they
-      // do not describe is missing, and one they describe with no children is
-      // genuinely empty.
-      if (_statLadder(absPath) === undefined) throw _fsErr("ENOENT", "scandir", p);
-    }
-    const prefix = k ? k + "/" : "";
-    const names = new Set();
-    // 1. Manifest-supplied children (the authoritative source for installed pkgs).
-    if (__vfsManifest && k in __vfsManifest) {
-      for (const n of __vfsManifest[k]) names.add(n);
-    }
-    // 2. Bundle-prefix fallback (covers older paths or runtime-mkdir'd ones
-    //    that aren't in the manifest yet).
-    if (__vfsBundle) {
-      for (const bk of __residentUnder(prefix)) {
-        const seg = bk.substring(prefix.length).split("/")[0];
-        if (seg) names.add(seg);
-      }
-    }
-    // 3. Files written during this exec session.
-    if (__vfsWrites) {
-      for (const wk in __vfsWrites) {
-        if (wk.startsWith(prefix)) {
-          const rest = wk.substring(prefix.length);
-          const seg = rest.split("/")[0];
-          if (seg) names.add(seg);
-        }
-      }
-    }
-    // 4. Dirs created during this exec session.
-    if (__vfsDirs) {
-      for (const dk in __vfsDirs) {
-        if (dk.startsWith(prefix)) {
-          const rest = dk.substring(prefix.length);
-          const seg = rest.split("/")[0];
-          if (seg) names.add(seg);
-        }
-      }
-    }
+    const st = _statLadder(absPath);
+    if (st === undefined) throw _fsErr("ENOENT", "scandir", p);
+    if (!st.isDirectory()) throw _fsErr("ENOTDIR", "scandir", p);
     _residencySatisfied(absPath);
-    const arr = [...names].sort();
-    if (opts?.withFileTypes) {
-      return arr.map(n => {
-        const fp = prefix + n;
-        // Manifest is the definitive isDir source; fall back to bundle scan.
-        // The metadata record sits between them: a directory that was listed
-        // but never walked has no manifest entry of its own, and calling it a
-        // file is how a template tree full of subdirectories reads back as a
-        // tree full of nothing.
-        const isDir =
-          (!!__vfsManifest && fp in __vfsManifest) ||
-          (!!__vfsDirs && fp in __vfsDirs) ||
-          _metadata(fp)?.type === "directory" ||
-          (!!__vfsBundle && __residentAnyUnder(fp + "/"));
-        return _direntObject(n, isDir ? "directory" : "file", absPath);
-      });
-    }
-    return arr;
+    const listed = _nsList(k);
+    const sorted = [...listed.keys()].sort();
+    if (!opts?.withFileTypes) return sorted;
+    return sorted.map((n) => _direntObject(n, listed.get(n), absPath));
   }
 
   // ── mkdirSync ──
@@ -3008,11 +3498,16 @@ const __fsMod = (() => {
     if (opts?.recursive) {
       const parts = k.split("/").filter(Boolean);
       let cur = "";
-      for (const part of parts) { cur = cur ? cur + "/" + part : part; __vfsDirs[cur] = true; created.push(cur); }
+      for (const part of parts) { cur = cur ? cur + "/" + part : part; _noteCreation(cur); __vfsDirs[cur] = true; created.push(cur); }
     } else {
+      _noteCreation(k);
       __vfsDirs[k] = true;
       created.push(k);
     }
+    for (const dir of created) {
+      const was = _nsMeta(dir, true);
+      if (was === "absent") _nsOwnSet(dir, "dir", { hide: true });
+    }
     const queued = _queueStructuralMutation(absPath, "mkdir", p, (supervisor) => supervisor.mkdir(absPath));
     // Told, not merely known locally: _announceLocalDirs must not issue a
     // second mkdir for a directory whose own RPC is already in the queue.
@@ -3022,9 +3517,30 @@ const __fsMod = (() => {
   function mkdirSync(p, opts) { _detachStructuralMutation(_mkdirQueued(p, opts)); }
 
   // ── unlinkSync ──
+  /**
+   * unlink(2)/rmdir(2)/rename(2) of an existing name: the parent must be
+   * writable and searchable, and in a sticky directory (/tmp, 1777) only the
+   * file's owner, the directory's owner or root may remove it. Checked before
+   * the local view changes, so a refusal leaves the process's view intact. A
+   * name whose owner this view does not know is refused as a miss.
+   */
+  function _ensureRemovable(absPath, syscall, p) {
+    _ensureAncestorsTraversable(absPath, syscall, p);
+    const k = _strip(absPath);
+    const parent = _statLadder(__pathMod.dirname(absPath));
+    if (parent === undefined) return;
+    if (!_modeAllows(parent, 3)) throw _fsErr("EACCES", syscall, p);
+    if ((Number(parent.mode) & 0o1000) === 0 || Number(cred.uid) === 0 || Number(parent.uid) === Number(cred.uid)) return;
+    if (_createdHere.has(k)) return;
+    const target = _statLadder(absPath, true);
+    if (target === undefined) return;
+    if (Number(target.uid) !== Number(cred.uid)) throw _fsErr("EPERM", syscall, p);
+  }
+
   function _unlinkQueued(p) {
     const absPath = _resolve(p);
     const k = _strip(absPath);
+    _ensureRemovable(absPath, "unlink", p);
     if (__vfsBundle) delete __vfsBundle[k];
     if (__vfsWrites) delete __vfsWrites[k];
     _forgetSyncPath(k);
@@ -3036,6 +3552,7 @@ const __fsMod = (() => {
   function _rmdirQueued(p) {
     const absPath = _resolve(p);
     const k = _strip(absPath);
+    _ensureRemovable(absPath, "rmdir", p);
     if (__vfsDirs) delete __vfsDirs[k];
     _forgetSyncPath(k);
     return _queueStructuralMutation(
@@ -3050,21 +3567,29 @@ const __fsMod = (() => {
   function _renameQueued(oldP, newP) {
     const oldAbs = _resolve(oldP);
     const newAbs = _resolve(newP);
+    // The name leaves its directory and lands in another (replacing what is
+    // there): both are removals by POSIX's rule.
+    _ensureRemovable(oldAbs, "rename", oldP);
+    if (_statLadder(newAbs, true) !== undefined) _ensureRemovable(newAbs, "rename", newP);
+    else _ensureWritable(newAbs, "rename", newP);
     const oldK = _strip(oldAbs);
     const newK = _strip(newAbs);
+    // The table still holds the old name until the rename is reported, so the
+    // new name reads through to it and the old one reads as gone.
+    const nsFrom = _nsRealKey(oldK);
+    // What this process created travels with the name; what it did not stays
+    // the authority's, whatever the move does to the local tables.
+    const oldPrefix = oldK + "/";
+    const createdMoved = [..._createdHere]
+      .filter((key) => key === oldK || key.startsWith(oldPrefix))
+      .map((key) => newK + key.slice(oldK.length));
     const content = __vfsBundle?.[oldK] ?? __vfsWrites?.[oldK];
     if (content !== undefined) {
       _parkWrite(newK, content);
       if (__vfsBundle) delete __vfsBundle[oldK];
       delete __vfsBundleRevisions[oldK];
       delete __vfsWrites[oldK];
-      // The stat record travels with the content: dropping it would lose the
-      // mode/ownership, and leaving it behind would keep the source path
-      // reporting as an existing file this rename already moved away.
-      const metadata = _metadataTable();
-      const moved = metadata ? metadata[oldK] : undefined;
       _forgetSyncPath(oldK);
-      if (moved) metadata[newK] = moved;
     } else if (__vfsDirs && oldK in __vfsDirs) {
       // A directory this process made travels under its new name, so the
       // sync view stops listing the old one and _announceLocalDirs cannot
@@ -3079,6 +3604,16 @@ const __fsMod = (() => {
       }
       _forgetSyncTree(oldK);
     }
+    _forgetCreation(oldK);
+    _forgetCreation(newK);
+    for (const key of createdMoved) _createdHere.add(key);
+    for (const [ok, entry] of [..._nsOwn]) {
+      if ((ok === oldK || ok.startsWith(oldPrefix)) && entry.state === "dir") {
+        _nsOwnSet(newK + ok.slice(oldK.length), "dir", { hide: entry.hide });
+      }
+    }
+    if (nsFrom !== null && !_nsOwn.has(newK)) _nsOwnSet(newK, "alias", { from: nsFrom });
+    _nsOwnSet(oldK, "absentTree");
     const queued = _queueStructuralMutation(
       oldAbs, "rename", oldP,
       (supervisor) => supervisor.rename(oldAbs, newAbs),
@@ -3245,7 +3780,16 @@ const __fsMod = (() => {
   // Sync realpath stays local and identity-resolves. Async symlink
   // operations use the live supervisor bridge below.
   // .native static is required by TypeScript's getNodeSystem at
-  function realpathSync(p, opts) { return _resolve(String(p)); }
+  function realpathSync(p, opts) {
+    const absPath = _resolve(String(p));
+    _nsRequire("realpath", p, "fs.promises.realpath");
+    const k = _strip(absPath);
+    const meta = _nsMeta(k, true);
+    if (meta === "ELOOP") throw _fsErr("ELOOP", "realpath", p);
+    if (meta === "absent") throw _fsErr("ENOENT", "realpath", p);
+    const real = _nsRealKey(k);
+    return real === null ? absPath : "/" + real;
+  }
   realpathSync.native = realpathSync;
 
   // ── Async variants (thin wrappers returning via callback) ──
@@ -3273,6 +3817,11 @@ const __fsMod = (() => {
     _mkdirAsync(p, opts).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); });
   }
   function unlink(p, cb) { _unlinkAsync(p).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); }); }
+  // The callback form proper-lockfile (via graceful-fs) releases its lock directory with.
+  function rmdir(p, opts, cb) {
+    if (typeof opts === "function") { cb = opts; opts = undefined; }
+    _rmdirAsync(p).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); });
+  }
   function rename(oldP, newP, cb) { _renameAsync(oldP, newP).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); }); }
   function utimes(p, atime, mtime, cb) { _utimesAsync(p, atime, mtime).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); }); }
   function lutimes(p, atime, mtime, cb) { _utimesAsync(p, atime, mtime, { followSymlinks: false }).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); }); }
@@ -3329,11 +3878,8 @@ const __fsMod = (() => {
     // Non-resident and non-empty: writing onto a zero-filled base would
     // silently destroy the bytes we cannot see. Refuse instead.
     if (st !== undefined && st.size !== 0) throw _notResidentError(absPath, p, syscall, asyncForm);
-    // Absent or empty — an empty base IS the true prior content, but only
-    // where absence is knowledge. A path the view never mapped may hold bytes
-    // this process cannot see, and an O_APPEND descriptor onto a zero-filled
-    // base would overwrite the file with the fragment it meant to add.
-    if (st === undefined && !_absenceIsKnown(absPath)) throw _refuseUnmapped(absPath, p, syscall, asyncForm);
+    // Absent or empty: an empty base is the true prior content (the namespace
+    // names every path this credential can see).
     return new Uint8Array(0);
   }
 
@@ -3596,6 +4142,10 @@ const __fsMod = (() => {
     if (!exists && !fl.create) throw _fsErr("ENOENT", "open", path);
     if (exists && fl.create && fl.exclusive) throw _fsErr("EEXIST", "open", path);
     let size = liveMeta ? (Number(liveMeta.size) || 0) : (localStat ? localStat.size : 0);
+    // The authority answered, so what it said is what the sync view keeps:
+    // its stat when something is there, and when nothing is, the file this
+    // open creates is the process's own.
+    if (!liveMeta && supervisor && !localStat) _createdHere.add(_strip(absPath));
     if (!exists) {
       await _writeFileAsync(path, new Uint8Array(0));
       if (mode !== undefined && mode !== null) {
@@ -3620,6 +4170,7 @@ const __fsMod = (() => {
     if (!exists && !fl.create) throw _fsErr("ENOENT", "open", path);
     if (exists && fl.create && fl.exclusive) throw _fsErr("EEXIST", "open", path);
     if (fl.write || !exists) _ensureWritable(absPath, "open", path);
+    if (!exists) _noteCreation(_strip(absPath));
     let size = exists ? st.size : 0;
     // O_TRUNC means "make it empty", so zeroing is the requested semantic,
     // and creating a genuinely absent file is too. O_APPEND must NEVER
@@ -3748,7 +4299,10 @@ const __fsMod = (() => {
   function fchmodSync(fd, mode) {
     if (_isStdioFd(fd)) throw _fsErr("EINVAL", "fchmod", fd);
     const handle = _fdHandle(fd, "fchmod");
-    _localModes[_strip(handle._abs)] = _coerceMode(mode, "fchmod", handle._path);
+    const k = _strip(handle._abs);
+    _ensureModeOwner(handle._abs, "fchmod", handle._path);
+    _localModes[k] = _coerceMode(mode, "fchmod", handle._path);
+    _pendingModes.add(k);
   }
   function fchownSync(fd, uid, gid) {
     if (_isStdioFd(fd)) throw _fsErr("EINVAL", "fchown", fd);
@@ -4088,15 +4642,16 @@ const __fsMod = (() => {
       // not just the local cache — is required so a subsequent async fs op
       // (e.g. fs.promises.rename of a copied file, as create-cloudflare
       // does for __dot__gitignore) sees the copy in the VFS instead of
-      // ENOENT.
-      __vfsDirs[destK] = true;
+      // ENOENT. Each directory is made as mkdir makes it, so the namespace's
+      // overlay lists it for the writes beneath it.
+      await _mkdirAsync("/" + destK, { recursive: true });
       const walk = async (relDir) => {
         const absDir = relDir ? srcAbs + "/" + relDir : srcAbs;
         const ents = await _readdirAsync(absDir, { withFileTypes: true });
         for (const ent of ents) {
           const rel = relDir ? relDir + "/" + ent.name : ent.name;
           if (ent.isDirectory && ent.isDirectory()) {
-            __vfsDirs[destK + "/" + rel] = true;
+            await _mkdirAsync("/" + destK + "/" + rel, { recursive: true });
             await walk(rel);
           } else {
             await _writeFileAsync("/" + destK + "/" + rel, await _readFileAsync(srcAbs + "/" + rel));
@@ -4269,7 +4824,7 @@ const __fsMod = (() => {
     openSync, closeSync, readSync, writeSync, fstatSync, ftruncateSync, fsyncSync, fdatasyncSync,
     futimesSync, fchmodSync, fchownSync, readvSync, writevSync,
     open, close, read, write, fstat, ftruncate, fsync, fdatasync, fchmod, futimes, readv, writev,
-    readFile, writeFile, appendFile, stat, lstat, readdir, exists, mkdir, unlink, rename, utimes, lutimes, chmod, lchmod, chown, lchown, fchown, access,
+    readFile, writeFile, appendFile, stat, lstat, readdir, exists, mkdir, unlink, rmdir, rename, utimes, lutimes, chmod, lchmod, chown, lchown, fchown, access,
     rm, cp, truncate, copyFile, mkdtemp, link, symlink, readlink, realpath, opendir, statfs,
     Dirent: __Dirent,
     Dir: __Dir,
@@ -4446,8 +5001,7 @@ const __NimbusRelayedWebSocket = (() => {
           // The barrier the whole relay exists for. Every frame is now a
           // supervisor reply, so it can carry the invalidation delta, and
           // user code runs only after the resident set has caught up.
-          const acquire = globalThis.__nimbusVfsAcquireBarrier;
-          if (typeof acquire === "function") await acquire();
+          await __nimbusInboundBarrier();
           this._deliver(event);
         }
       }
@@ -4850,9 +5404,14 @@ ${UNDICI_SHIM_CODE}
 // ──  util module ────────────────────────────────────────────────────
 // ═══════════════════════════════════════════════════════════════════════
 const __utilMod = {
-  inspect: (o, opts) => { try { return JSON.stringify(o, null, 2); } catch { return String(o); } },
-  format: (fmt, ...a) => {
-    if (typeof fmt !== "string") return [fmt, ...a].map(__fmt).join(" ");
+  inspect: (o, opts) => {
+    if (o !== null && typeof o === "object" && __isErrorValue(o)) return __fmtError(o, new Set());
+    try { return JSON.stringify(o, null, 2); } catch { return String(o); }
+  },
+  format: (...args) => {
+    if (args.length === 0) return "";
+    const [fmt, ...a] = args;
+    if (typeof fmt !== "string") return args.map(__fmt).join(" ");
     let i = 0;
     return fmt.replace(/%[sdifjoO%]/g, (m) => {
       if (m === "%%") return "%";
@@ -4861,7 +5420,7 @@ const __utilMod = {
       if (m === "%s") return String(v);
       if (m === "%d" || m === "%i" || m === "%f") return Number(v).toString();
       if (m === "%j") { try { return JSON.stringify(v); } catch { return "[Circular]"; } }
-      if (m === "%o" || m === "%O") { try { return JSON.stringify(v, null, 2); } catch { return String(v); } }
+      if (m === "%o" || m === "%O") return __utilMod.inspect(v);
       return String(v);
     }) + (i < a.length ? " " + a.slice(i).map(__fmt).join(" ") : "");
   },
@@ -5128,11 +5687,31 @@ const __utilMod = {
 // (set+restored by __loadModule per call). When set, the fallback becomes
 // "file:///" + __currentModulePath so relative URLs resolve against
 // the real on-VFS module location — restoring proper import.meta.url
+//
+// The leniency is scoped to calls that PASSED a base. \`new URL(x)\` with one
+// argument is Node's strict absolute-URL parse: it throws
+// TypeError [ERR_INVALID_URL] for anything that is not already a URL, and
+// that throw is load-bearing rather than incidental. Node's own ESM
+// resolver — and every vendored copy of it, including exsolve, which is what
+// \`nuxt dev\` resolves \`@nuxt/kit\` and \`nuxt\` with — spells the
+// bare-specifier test as
+//     try { resolved = new URL(specifier); } catch { packageResolve(…); }
+// Swallowing the throw made \`new URL("@nuxt/kit")\` answer
+// file:///@nuxt/kit, so moduleResolve never reached packageResolve and
+// finalizeResolution stat'd /@nuxt/kit — the FILESYSTEM ROOT — instead of
+// walking <from>/node_modules. Two syscalls and every bare import in the
+// project was unresolvable. The bundler breakage this wrapper exists for
+// (\`new URL(rel, import.meta.url)\` where the rolldown/esbuild polyfill
+// reduced import.meta.url to null/undefined) is always a two-argument call,
+// so requiring the base argument keeps that fix and restores Node's
+// contract for the one-argument form. URL.canParse, which is bound
+// straight off the native constructor below, already answered false for
+// these strings; the constructor now agrees with it.
 (() => {
   const _Orig = globalThis.URL;
   class _Shim extends _Orig {
     constructor(input, base) {
-      if (base == null && typeof input === "string") {
+      if (arguments.length >= 2 && base == null && typeof input === "string") {
         try { super(input); return; }
         catch {
           // X.5-M3: prefer current module path when known, so
@@ -5714,6 +6293,13 @@ const __childProcessMod = (() => {
   /**
    * Read-loop for a single fd. Long-polls cpReadOutput, pushes chunks
    * into the Readable via .push, handles closure.
+   *
+   * What the child printed, and that it closed the stream, is news from
+   * another process, which may have written files before it printed. So a
+   * reply that delivers anything takes the barrier first, and a 'data'
+   * handler that reads what the child wrote reads it current. The poll sends
+   * this process's ACQUIRE arguments and the reply carries the answer, so the
+   * barrier costs no round trip of its own.
    */
   async function _runReadLoop(child, fd, stream, sinceSeqRef) {
     // Exponential backoff for idle children: start at 100ms, double up
@@ -5726,12 +6312,14 @@ const __childProcessMod = (() => {
     while (HAS_SUPERVISOR && child.pid && !child._streamsClosed) {
       try {
         const r = await __nimbusUseRpcResult(
-          __supervisor.cpReadOutput(child.pid, fd, sinceSeqRef.value, backoff),
+          __supervisor.cpReadOutput(child.pid, fd, sinceSeqRef.value, backoff, __nimbusVfsAcquireArgs()),
           (result) => result,
         );
-        if (r && Array.isArray(r.chunks) && r.chunks.length > 0) {
+        const chunks = r && Array.isArray(r.chunks) ? r.chunks : [];
+        if (chunks.length > 0 || (r && r.closed)) await __nimbusInboundBarrier(r.acquired);
+        if (chunks.length > 0) {
           backoff = 100;  // reset — child is producing
-          for (const c of r.chunks) {
+          for (const c of chunks) {
             // The queue hands back bytes; a Readable given a string would
             // encode it again.
             stream.write(__BufferMod.from(c.data));
@@ -5759,16 +6347,19 @@ const __childProcessMod = (() => {
 
   /**
    * Wait-loop: long-poll cpWait until the child reports exit. Emits
-   * 'exit' once stamped.
+   * 'exit' once stamped, behind the barrier: a child's exit is how a parent
+   * learns the files it wrote are there. Answered on the reply, as for the
+   * child's output.
    */
   async function _runWaitLoop(child) {
     while (HAS_SUPERVISOR && child.pid && !child._exitFired) {
       try {
         const r = await __nimbusUseRpcResult(
-          __supervisor.cpWait(child.pid, 1000),
+          __supervisor.cpWait(child.pid, 1000, __nimbusVfsAcquireArgs()),
           (result) => result,
         );
         if (r && r.done) {
+          await __nimbusInboundBarrier(r.acquired);
           child.exitCode = r.exitCode;
           child.signalCode = r.signal;
           child._exitFired = true;
@@ -5949,7 +6540,7 @@ const __childProcessMod = (() => {
    *      stdout/stderr/exit events fire. Callers like cross-spawn.sync
    *      that read result.status get null until the spawn settles.
    *   3. When the parent facet's main drain settles __pendingIO before
-   *      reportExit (facet-manager.ts), the result object's fields are
+   *      reportExit (facets/manager.ts), the result object's fields are
    *      filled in by the time the supervisor sees the parent exit.
    *
    * Cross-spawn.sync's typical pattern is "const r = spawnSync(...);
@@ -6292,7 +6883,7 @@ function __makeProcessStdin() {
         // facet, so counting it as in-flight work would mean the entry drain
         // never sees the program finish.
         packet = await __nimbusUseRpcResultUnref(
-          __supervisor.cpReadStdin(liveChildPid, 1000),
+          __supervisor.cpReadStdin(liveChildPid, 1000, __nimbusVfsAcquireArgs()),
           (result) => result,
         );
         readFailures = 0;
@@ -6309,6 +6900,18 @@ function __makeProcessStdin() {
         await new Promise((resolve) => setTimeout(resolve, 500));
         continue;
       }
+      // A packet that delivers anything — input, its end, a signal, a resize
+      // — hands the program news from outside it, and whatever sent the news
+      // may have written files first (a shell's \`echo v2 > f\` before the
+      // keystroke, the editor's save before the signal). So it takes the
+      // barrier before any handler sees it. The poll sent this process's
+      // ACQUIRE arguments and the packet carries the answer, so a keystroke
+      // costs no round trip of its own. An empty poll delivers nothing and
+      // costs nothing.
+      if (packet && (packet.resize || packet.signal || packet.ended
+          || (packet.data && packet.data.byteLength > 0))) {
+        await __nimbusInboundBarrier(packet.acquired);
+      }
       if (packet && packet.resize) {
         __nimbusTtyColumns = Number(packet.resize.columns) || __nimbusTtyColumns;
         __nimbusTtyRows = Number(packet.resize.rows) || __nimbusTtyRows;
@@ -6425,6 +7028,7 @@ function __makeProcessOutputStream(streamName) {
     errored: null,
     write(d, enc, cb) {
       if (typeof enc === "function") cb = enc;
+      if (__nimbusProgramStopped) return true;
       // The reported result is text; decode the bytes at this edge only.
       const s = __nimbusOutText(streamName, __nimbusOutBytes(d, enc));
       if (streamName === "stderr") stderr += s;
@@ -6470,6 +7074,8 @@ function __makeProcessOutputStream(streamName) {
 function __nimbusReportProcessExit(code, reason) {
   if (__nimbusProcessExitReported) return;
   __nimbusProcessExitCode = Number(code ?? 0);
+  __nimbusProgramStopped = true;
+  try { if (typeof globalThis.__nimbusStopProgramTimers === "function") globalThis.__nimbusStopProgramTimers(); } catch {}
   try { if (__nimbusProcessExitResolve) __nimbusProcessExitResolve(__nimbusProcessExitCode); } catch {}
   // Generated lifecycle owners defer the terminal supervisor report until
   // their durability boundary has drained. Reporting here would retire the
@@ -6509,7 +7115,7 @@ const __processMod = {
   chdir: (d) => { cwd = __pathMod.resolve(cwd || "/home/user", d); },
   exit: (code) => {
     exitCode = code ?? 0;
-    try { __processEvents.emit("exit", exitCode); } catch {}
+    __nimbusEmitExit(exitCode);
     __nimbusReportProcessExit(exitCode, "");
     throw new __ProcessExit(exitCode);
   },
@@ -6923,14 +7529,27 @@ builtins.http = (() => {
       return new __hostResponse("Nimbus: no HTTP server is listening in this process", { status: 502 });
     }
     const url = new URL(request.url);
+    // The request carries the answer to its own barrier (below). It is
+    // Nimbus's, not the program's, so the program does not see it.
+    let delivered;
+    try { delivered = JSON.parse(request.headers.get("X-Nimbus-Vfs-Acquired") || "null"); } catch {}
     const headers = {};
-    request.headers.forEach((v, k) => { headers[k] = v; });
+    request.headers.forEach((v, k) => { if (k !== "x-nimbus-vfs-acquired") headers[k] = v; });
     // Bytes, not text: a UTF-8 decode corrupts every binary upload, and the
     // decoded string is not the TypedArray receiver Buffer methods require.
     let body = null;
     if (request.method !== "GET" && request.method !== "HEAD") {
       body = new Uint8Array(await request.arrayBuffer());
     }
+    // A request is a resumption like any other, and often the second half of
+    // a causal chain — \`echo v2 > f; curl :3000\` — so the handler runs behind
+    // the barrier, after the body has arrived. Sited here, in the dispatch
+    // every resident's server shares, not in a caller that happens to yield
+    // through a barriered timer on the way. The supervisor routed it, so it
+    // arrives with an answer, which is enough when no write preceded the
+    // request since this process last caught up (session/rpc.ts
+    // _acquireForRoutedRequest); otherwise the barrier asks.
+    await __nimbusInboundBarrier(delivered);
     const res = server._handleRequest(url.pathname + url.search, request.method, headers, body);
     // Return once headers are known. A handler that never sends headers is
     // bounded by a header timeout (NOT a body-finish cap) so a hung handler
@@ -7765,38 +8384,12 @@ builtins["node:util/types"] = builtins["util/types"];
 // skips it via the same FACET_PROVIDED_PACKAGES list.
 builtins.undici = __undiciMod;
 
-/**
- * A cell's dynamic import() call.
- *
- * A cell is compiled with new Function, so an import() left in its body
- * is the RUNTIME's: it resolves against the module map and hands back the
- * platform's own builtins, not this process's. Real Vite reaches
- * node:http that way (config.js:14968), got a server whose listen bound no
- * port here, and the facet exited with no handles the moment boot returned.
- *
- * The ESM→CJS rewriter routes those calls here with the cell's own
- * require, so resolution is the one the process already has. The result is
- * shaped as a module namespace, since import() resolves to one and callers
- * destructure named exports off it.
- */
-globalThis.__nimbusCellImport = (req, id) => Promise.resolve().then(() => {
-  const loaded = req(id);
-  if (loaded && (loaded.__esModule || loaded[Symbol.toStringTag] === "Module")) return loaded;
-  // A CJS module's exports ARE the namespace's named exports, with the whole
-  // object as the default export — what an ESM importer of a CJS module sees.
-  if (loaded && (typeof loaded === "object" || typeof loaded === "function")) {
-    const ns = Object.create(null);
-    for (const key of Object.keys(loaded)) ns[key] = loaded[key];
-    if (!("default" in ns)) ns.default = loaded;
-    Object.defineProperty(ns, Symbol.toStringTag, { value: "Module" });
-    return ns;
-  }
-  return { default: loaded };
-});
 // ═══════════════════════════════════════════════════════════════════════
 // ──  require() — full Node.js module resolution ─────────────────────
 // ═══════════════════════════════════════════════════════════════════════
 const __moduleCache = new Map();
+// package → why the package ABI policy says it cannot run here (wasm-swap-registry.ts).
+const __nimbusAbiAdvisories = new Map(${ABI_ADVISORIES_LITERAL});
 
 /**
  * Direct VFS bundle access for module resolution.
@@ -7822,24 +8415,8 @@ function __readFileOr(path, fallback) {
 }
 function __fileExists(path) {
   const k = path.replace(/^\\/+/, "");
-  if (__vfsBundle && k in __vfsBundle) return true;
-  if (__vfsWrites && k in __vfsWrites) return true;
-  if (__vfsDirs && k in __vfsDirs) return true;
-  // Consult the uncapped manifest (directory shape) so resolution sees
-  // installed files whose content was excluded from the bounded snapshot
-  // (e.g. web-streams-polyfill's ponyfill/package.json, reached via a
-  // parent-relative main). Mirrors existsSync's manifest probe.
-  if (__vfsManifest) {
-    if (k in __vfsManifest) return true;
-    const slash = k.lastIndexOf("/");
-    const parent = slash >= 0 ? k.slice(0, slash) : "";
-    const name = slash >= 0 ? k.slice(slash + 1) : k;
-    const sib = __vfsManifest[parent];
-    if (sib && sib.indexOf(name) !== -1) return true;
-  }
-  // Check for directory by looking for any key with this prefix
-  if (__vfsBundle && __residentAnyUnder(k + "/")) return true;
-  return false;
+  // The namespace answers exactly (vfs/facet-resident-store.ts).
+  return __fsMod.existsSync("/" + k);
 }
 // W3.5 Fix A: strict-file membership probe. __fileExists also returns true for
 // directories (it has to — __resolveNodeModule and __resolveImportsField call
@@ -7851,26 +8428,8 @@ function __fileExists(path) {
 // the fastify ret/dist/types failure.
 function __pathIsFile(path) {
   const k = path.replace(/^\\/+/, "");
-  if (__vfsBundle && k in __vfsBundle) return true;
-  if (__vfsWrites && k in __vfsWrites) return true;
-  // Consult the manifest as a strict-file probe: a name listed in its
-  // parent's manifest entry is a file (directories are manifest KEYS).
-  // This lets resolution find files whose content was excluded from the
-  // bounded snapshot without re-introducing the directory short-circuit
-  // (__vfsManifest[k] being a directory key is deliberately NOT matched).
-  if (__vfsManifest) {
-    const slash = k.lastIndexOf("/");
-    const parent = slash >= 0 ? k.slice(0, slash) : "";
-    const name = slash >= 0 ? k.slice(slash + 1) : k;
-    const sib = __vfsManifest[parent];
-    if (sib && sib.indexOf(name) !== -1 && !(k in __vfsManifest)) return true;
-  }
-  // Last resort: the full fs view (live SQLite VFS) for paths outside the
-  // bounded snapshot/manifest entirely — e.g. the /tmp/.npx-cache tree,
-  // which the project snapshot never covers. stat-as-file only.
-  try { const st = __fsMod.statSync("/" + k); if (st && st.isFile && st.isFile()) return true; } catch {}
-  // Deliberately does NOT consult __vfsDirs nor do the prefix scan.
-  return false;
+  const st = __fsMod.statSync("/" + k, { throwIfNoEntry: false });
+  return !!st && st.isFile();
 }
 function __resolveFile(base) {
   // Mirrors Node's LOAD_AS_FILE + LOAD_AS_DIRECTORY (require_2 spec):
@@ -7943,15 +8502,12 @@ function __resolveFile(base) {
 }
 
 // __compiledModules is defined at MODULE TOP LEVEL in the generator code
-// (facet-manager.ts) so new Function() runs during module evaluation.
+// (facets/manager.ts) so new Function() runs during module evaluation.
 
 // ── Single-source-of-truth exports/imports resolver (W2) ───────────────
 // Emitted from src/_shared/exports-resolver.ts via getExportsResolverJS().
 // Declares: resolveExports, resolveConditionValue, resolvePackageEntry,
 //           DEFAULT_ESM_CONDITIONS, DEFAULT_CJS_CONDITIONS.
-// the prior hand-rolled __resolvePkgEntry only honoured top-level
-// require|default|import and dropped subpath maps, wildcards, nested
-// conditions, the imports field, and null-target enforcement.
 ${EXPORTS_RESOLVER_JS}
 
 // ── TypeScript specifier fallbacks ────────────────────────────────────────
@@ -7989,8 +8545,8 @@ function __resolvePkgSubpath(pkgDir, pkg, subpath) {
   }
   let entry = resolvePackageEntry(pkg, subpath, __NIMBUS_CJS_CONDITIONS);
   // X.5-F R3: ESM-condition fallback for pure-ESM packages whose
-  // dist/.mjs files were transformed to CJS by transformEsmInBundle
-  // at install time (facet-manager.ts:842, W3.5 Fix B). Without this,
+  // dist/.mjs files were transformed to CJS
+  // by transformEsmInBundle (facets/manager.ts). Without this,
   // packages like nuxt — whose exports map only contains
   // {types, import} for the root subpath — return null from the CJS
   // walk and dead-end with "Cannot find module 'nuxt'" even though
@@ -8033,10 +8589,6 @@ function __resolvePkgSubpath(pkgDir, pkg, subpath) {
   return __resolveFile(pkgDir + "/" + rel);
 }
 
-/** Back-compat name used elsewhere in this file. */
-function __resolvePkgEntry(pkgDir) {
-  return __resolvePkgSubpath(pkgDir, null, ".");
-}
 
 /**
  * Resolve a bare specifier (e.g. "react", "@scope/pkg", "pkg/sub/path")
@@ -8085,32 +8637,23 @@ function __resolveNodeModule(name, fromDir) {
 }
 
 /**
- * Resolve a #name imports-field specifier from the nearest enclosing
- * package.json. Returns the resolved file or null.
+ * Node's "package scope" of a directory (readPackageScope): the nearest
+ * enclosing package.json, walking up from fromDir. The FIRST package.json
+ * found is the scope, even when it lacks the field the caller wants — the
+ * imports field and the self-reference rule both belong to the importing
+ * module's own package, never to an ancestor past it. The walk never
+ * crosses a node_modules directory: a file that sits directly under one
+ * belongs to no package, not to the project above it. Returns { dir, pkg }
+ * (pkg null when the file is unparseable) or null when no package.json
+ * encloses fromDir.
  */
-function __resolveImportsField(name, fromDir) {
-  // Walk up looking for the nearest package.json. Stop at the first one
-  // (Node spec: imports field of the importing module's package).
+function __nearestPackageScope(fromDir) {
   let dir = (fromDir || "").replace(/^\\/+/, "");
   while (true) {
+    if (dir === "node_modules" || dir.endsWith("/node_modules")) return null;
     const pkgJsonPath = (dir ? dir + "/" : "") + "package.json";
     if (__fileExists(pkgJsonPath)) {
-      const pkg = __readPkgJson(dir);
-      if (pkg && pkg.imports) {
-        const target = resolveExports(pkg.imports, name, __NIMBUS_CJS_CONDITIONS);
-        if (target) {
-          // Imports targets are relative to the package root (dir)
-          if (target.startsWith("./")) {
-            return __resolveFile((dir ? dir + "/" : "") + target.slice(2));
-          }
-          if (target.startsWith("/")) {
-            return __resolveFile(target.slice(1));
-          }
-          // Bare specifier — re-resolve as a node_module from this dir
-          return __resolveNodeModule(target, dir);
-        }
-      }
-      return null; // first package.json wins, even if no imports field
+      return { dir, pkg: __readPkgJson(dir) };
     }
     if (!dir) return null;
     const lastSlash = dir.lastIndexOf("/");
@@ -8118,37 +8661,68 @@ function __resolveImportsField(name, fromDir) {
   }
 }
 
+/**
+ * Resolve a #name imports-field specifier from the nearest enclosing
+ * package.json. Returns the resolved file or null.
+ */
+function __resolveImportsField(name, fromDir) {
+  // First package.json wins, even if no imports field (Node spec: imports
+  // field of the importing module's package).
+  const scope = __nearestPackageScope(fromDir);
+  if (!scope || !scope.pkg || !scope.pkg.imports) return null;
+  const dir = scope.dir;
+  const target = resolveExports(scope.pkg.imports, name, __NIMBUS_CJS_CONDITIONS);
+  if (!target) return null;
+  // Imports targets are relative to the package root (dir)
+  if (target.startsWith("./")) {
+    return __resolveFile((dir ? dir + "/" : "") + target.slice(2));
+  }
+  if (target.startsWith("/")) {
+    return __resolveFile(target.slice(1));
+  }
+  // Bare specifier — re-resolve as a node_module from this dir
+  return __resolveNodeModule(target, dir);
+}
+
+/**
+ * Node's LOAD_PACKAGE_SELF: a bare specifier naming the enclosing package
+ * itself (\`require('<its-name>')\`, \`require('<its-name>/sub')\`) resolves
+ * through that package's own \`exports\` map — only when the nearest
+ * package.json has \`exports\` AND its \`name\` matches, and only through
+ * \`exports\` (no main/index probing: a subpath the map does not expose is
+ * not exported). Sits between the imports-field branch and the
+ * node_modules walk, where Node puts it. Returns the resolved file or null.
+ *
+ * Conditions are the ones the node_modules walk uses for the same
+ * require: the runtime's CJS set first, the ESM set when the map exposes
+ * the subpath only under \`import\` (dynamic import() is lowered onto this
+ * require chain, see __resolvePkgSubpath).
+ *
+ * Tri-state, as in Node: null when the rule does not apply (the caller
+ * walks node_modules); { resolved: null } when the enclosing package claims
+ * the name but its map does not expose the subpath or the target is
+ * missing — Node throws ERR_PACKAGE_PATH_NOT_EXPORTED / MODULE_NOT_FOUND
+ * there and never consults node_modules, so neither does the caller.
+ */
+function __resolvePackageSelf(name, fromDir) {
+  const scope = __nearestPackageScope(fromDir);
+  if (!scope || !scope.pkg) return null;
+  const subpath = packageSelfReferenceSubpath(scope.pkg, name);
+  if (subpath === null) return null;
+  let entry = resolveExports(scope.pkg.exports, subpath, __NIMBUS_CJS_CONDITIONS);
+  if (entry == null) entry = resolveExports(scope.pkg.exports, subpath, DEFAULT_ESM_CONDITIONS);
+  if (entry == null) return { resolved: null };
+  return { resolved: __resolveFile((scope.dir ? scope.dir + "/" : "") + entry.replace(/^\\.\\/+/, "")) };
+}
+
 // ═══════════════════════════════════════════════════════════════════════
-// ──  X.5-S: __mkCompiledFn — conditional-param-rename wrap for new Function
+// ──  __mkCompiledFn — the request-time fallback compile ──────────────
 // ═══════════════════════════════════════════════════════════════════════
-//
-// vite's chunks/node.js (transitive bundle of open@10.2.0) contains the
-// ESM idiom \`const __dirname = path.dirname(fileURLToPath(import.meta.url))\`.
-// W3.5 Fix B's esbuild ESM→CJS transform preserves that line verbatim
-// while substituting \`import.meta\` with \`const import_meta = {}\`. Wrapping
-// the body in \`new Function("exports","require","module","__filename","__dirname", code)\`
-// then collides at parse time:
-//
-//     SyntaxError: Identifier '__dirname' has already been declared
-//
-// (VERIFY-23417C5 §4 #1 / X5M3-retro §"Next bucket".) The helper RENAMES
-// the conflicting param to a placeholder name so the body's own
-// \`const __dirname\` becomes the single declarer. We rename rather than
-// drop because callers pass 5 positional arguments and dropping a slot
-// would mis-align downstream slots (e.g. the USER_CODE wrap appends
-// \`console\` / \`process\` / etc. after \`__dirname\`). Renaming preserves
-// slot alignment while letting the body's binding win.
-//
-// Symmetric for \`__filename\` because open@10's idiom often emits both.
-function __mkCompiledFn(code) {
-  const reFn = /(?:^|\\n|;)\\s*(?:const|let|var)\\s+__filename\\s*=/m;
-  const reDn = /(?:^|\\n|;)\\s*(?:const|let|var)\\s+__dirname\\s*=/m;
-  const reRequire = /(?:^|\\n|;)\\s*(?:const|let|var)\\s+require\\s*=/m;
-  const fnName = reFn.test(code) ? "__filename__nimbus_unused" : "__filename";
-  const dnName = reDn.test(code) ? "__dirname__nimbus_unused"  : "__dirname";
-  const requireName = reRequire.test(code) ? "require__nimbus_unused" : "require";
-  return new Function("exports", requireName, "module", fnName, dnName, code);
-}
+// One definition, from core/_shared/compiled-fn.ts (interpolated above as
+// MK_COMPILED_FN_SOURCE); here it serves a cell the startup precompile set
+// did not include, where the runtime permits it. See that file for why the
+// collision is detected by compiling rather than by scanning the source.
+${COMPILED_FN_JS}
 
 function __exportsTarget(mod) {
   const value = mod.exports;
@@ -8200,11 +8774,12 @@ function __makeLoadingExports(mod) {
  * Load and execute a JS/JSON module from VFS.
  * Returns the module.exports value.
  */
-function __loadModule(resolvedPath) {
-  if (__moduleCache.has(resolvedPath)) return __moduleCache.get(resolvedPath);
+function __loadModule(resolvedPath, evaluationKey = resolvedPath) {
+  if (globalThis.__nimbusProfileStaged) globalThis.__nimbusProfileStaged.delete(String(resolvedPath).replace(/^\\/+/, ""));
+  if (__moduleCache.has(evaluationKey)) return __moduleCache.get(evaluationKey);
 
   const mod = { exports: {} };
-  __moduleCache.set(resolvedPath, __makeLoadingExports(mod));
+  __moduleCache.set(evaluationKey, __makeLoadingExports(mod));
 
   const code = __readFileOr(resolvedPath, null);
   if (code === null) throw new Error("Cannot read module: " + resolvedPath);
@@ -8212,7 +8787,7 @@ function __loadModule(resolvedPath) {
   // JSON
   if (resolvedPath.endsWith(".json")) {
     mod.exports = JSON.parse(code);
-    __moduleCache.set(resolvedPath, mod.exports);
+    __moduleCache.set(evaluationKey, mod.exports);
     return mod.exports;
   }
 
@@ -8235,6 +8810,16 @@ function __loadModule(resolvedPath) {
   // const import_meta = {}. Save+restore for recursive __loadModule.
   const __prevModulePath = globalThis.__currentModulePath;
   globalThis.__currentModulePath = resolvedPath;
+  const moduleUrl = evaluationKey.startsWith("file:")
+    ? evaluationKey : builtins.url.pathToFileURL("/" + resolvedPath).href;
+  // Evaluation metadata lives on the module, not in source text. Keeping
+  // it here preserves the five CommonJS arguments and captures the parent
+  // even when import.meta.resolve is extracted and called later.
+  const importMeta = Object.assign(Object.create(null), {
+    url: moduleUrl,
+    resolve: (specifier) => globalThis.__nimbusImportMetaResolve(specifier, moduleUrl),
+  });
+  Object.defineProperty(mod, "__nimbusImportMeta", { value: importMeta });
   try {
     // Use pre-compiled function from startup (new Function allowed at module eval time)
     // Normalize path to match VFS bundle key format (no leading /)
@@ -8259,7 +8844,7 @@ function __loadModule(resolvedPath) {
       } catch (evalErr) {
         // W3.5 Fix C: if the file was in the bundle but its pre-compile
         // failed at facet startup, surface the original SyntaxError
-        // instead of the misleading "file was not pre-bundled" text.
+        // instead of the misleading "not in this launch's module map" text.
         const normalizedPath2 = resolvedPath.replace(/^\\/+/, "");
         const compileErr =
           (typeof __compileFailures !== "undefined" && __compileFailures &&
@@ -8271,22 +8856,27 @@ function __loadModule(resolvedPath) {
           );
         }
         if (evalErr.message && evalErr.message.includes("Code generation from strings disallowed")) {
-          throw new Error("Cannot load module '" + resolvedPath + "': file was not pre-bundled. Add it to the VFS bundle.");
+          // Not a read miss (the text is here) and nothing in the process can
+          // answer it, so it is kept apart from the read ledger that settles those.
+          (globalThis.__nimbusModuleMisses ??= new Set()).add(normalizedPath2);
+          throw new Error("Cannot load module '" + resolvedPath + "': it was not in this launch's module map; the next launch of the same command stages it.");
         }
         throw evalErr;
       }
     }
   } catch (e) {
-    __moduleCache.delete(resolvedPath);
+    __moduleCache.delete(evaluationKey);
     if (e && typeof e === "object" && !e.__nimbusModulePath) {
       try {
-        e.__nimbusModulePath = resolvedPath;
-        if (typeof e.message === "string") {
-          e.message += "\\nNimbus module: " + resolvedPath;
-        }
-        if (typeof e.stack === "string" && !e.stack.includes("Nimbus module:")) {
-          e.stack += "\\nNimbus module: " + resolvedPath;
-        }
+        Object.defineProperty(e, "__nimbusModulePath", { value: resolvedPath, configurable: true, writable: true });
+        const at = resolvedPath.lastIndexOf("node_modules/");
+        const parts = at < 0 ? [] : resolvedPath.slice(at + 13).split("/");
+        const pkg = parts[0] && parts[0].startsWith("@") ? parts[0] + "/" + parts[1] : parts[0];
+        const advisory = pkg ? __nimbusAbiAdvisories.get(pkg) : undefined;
+        const note = "\\nNimbus module: " + resolvedPath
+          + (advisory ? "\\nNimbus: " + pkg + " has no Workers-compatible build: " + advisory : "");
+        if (typeof e.message === "string") e.message += note;
+        if (typeof e.stack === "string" && !e.stack.includes("Nimbus module:")) e.stack += note;
       } catch {}
     }
     throw e;
@@ -8295,7 +8885,7 @@ function __loadModule(resolvedPath) {
   }
 
   // Update cache with final exports (module.exports may have been reassigned)
-  __moduleCache.set(resolvedPath, mod.exports);
+  __moduleCache.set(evaluationKey, mod.exports);
   return mod.exports;
 }
 
@@ -8304,6 +8894,25 @@ function __loadModule(resolvedPath) {
  * Returns the resolved VFS path, or null.
  */
 function __resolveFrom(id, fromDir) {
+  // An absolute file: URL is a specifier Node accepts: \`import(href)\` is the
+  // portable way to load a path a resolver just handed back, and it is what
+  // every package that resolves before it imports emits — @nuxt/cli's
+  // loadKit does \`import(pathToFileURL(resolveModulePath('@nuxt/kit', …)).href)\`.
+  // The ESM→CJS transform funnels those imports through this one resolver, so
+  // the scheme has to come off before the specifier is classified: with it on,
+  // the file: URL misses the absolute-path branch below and gets looked up as
+  // if it were the name of a package.
+  if (typeof id === "string" && id.startsWith("file:")) {
+    let filePath;
+    try {
+      const u = new URL(id);
+      // .pathname drops the query a cache-busting importer appends
+      // (\`import(href + "?t=" + Date.now())\` is the standard HMR spelling),
+      // and the decode is what node:url's fileURLToPath does with it.
+      filePath = decodeURIComponent(u.pathname);
+    } catch { filePath = id.replace(/^file:\\/\\//, ""); }
+    id = filePath;
+  }
   // X.5-P: literal "." / ".." are CommonJS aliases for "./" / "../".
   // Pre-fix they slipped past the startsWith("./")/("../") guards (which
   // require >= 3 / >= 4 chars respectively) and fell into the bare-spec
@@ -8333,43 +8942,137 @@ function __resolveFrom(id, fromDir) {
   if (id.startsWith("#")) {
     return __resolveImportsField(id, fromDir);
   }
-  // Bare specifier → node_modules resolution
+  // Bare specifier: the enclosing package's own name resolves through its
+  // exports map (Node's LOAD_PACKAGE_SELF), then node_modules resolution.
+  // Once the enclosing package claims the name, its map is the whole
+  // answer: a subpath it does not expose is not found, never a
+  // node_modules copy's.
+  const self = __resolvePackageSelf(id, fromDir);
+  if (self) return self.resolved;
   return __resolveNodeModule(id, fromDir);
 }
 
-globalThis.__nimbusImportMetaResolve = function __nimbusImportMetaResolve(specifier, parentUrl) {
-  const currentFromParent = typeof parentUrl === "string" && parentUrl.startsWith("file:")
-    ? parentUrl.replace(/^file:\\/\\/\\/+/, "")
-    : "";
-  const current = currentFromParent || (
-    typeof globalThis.__currentModulePath === "string"
-      ? globalThis.__currentModulePath.replace(/^\\/+/, "")
-      : ""
-  );
-  const fromDir = current.includes("/") ? current.substring(0, current.lastIndexOf("/")) : "";
-  const text = String(specifier);
-  if (text.startsWith("file:")) return text;
-  if (text.startsWith("./") || text.startsWith("../") || text.startsWith("/")) {
-    return new URL(text, current ? "file:///" + current : "file:///").href;
-  }
-  const resolved = __resolveFrom(text, fromDir);
-  // Node throws ERR_MODULE_NOT_FOUND rather than answering with the specifier
-  // it could not resolve, and packages are written against that: the standard
-  // shape is a try/catch that reports something the user can act on. Handing
-  // back the bare specifier passes the "unresolved" case off as a URL, so
-  // fileURLToPath downstream yields a path that was never on disk and the
-  // eventual error names a phantom file instead of the missing package.
-  // typescript@7 does exactly this: with the specifier echoed back it reports
-  // "Executable not found: @typescript/typescript-linux-x64/lib/tsc", where
-  // its own catch would have said the platform package is missing.
-  if (!resolved) {
-    const err = new Error(
-      "Cannot find package '" + text + "' imported from " + (current || fromDir || "<unknown>"),
-    );
-    err.code = "ERR_MODULE_NOT_FOUND";
-    throw err;
+// ═══════════════════════════════════════════════════════════════════════
+// ──  import() — Node's ESM loader ────────────────────────────────────
+// ═══════════════════════════════════════════════════════════════════════
+// A cell's dynamic import() reaches here with its module's URL
+// (core/runtime/dynamic-import-rewrite.ts). Resolution is Node's ESM
+// algorithm (core/_shared/esm-resolver.ts, interpolated below): the "import"
+// conditions, no extension probing, a directory refused by name, file: URLs,
+// Node's error codes and messages. What resolves loads through the same
+// module cache require uses, shaped as the namespace Node would give.
+// Node's builtins that exist only with the scheme; the rest of the table is
+// the process's own builtins, undici among them, which the process provides
+// in place of any installed copy (see builtins.undici above).
+const __ESM_SCHEME_ONLY_BUILTINS = new Set(["test", "test/reporters", "sqlite", "sea"]);
+// Node's ESM resolver (core/_shared/esm-resolver.ts, compiled once by
+// scripts/bundle-facet-workers.mjs): declares createEsmResolver.
+${ESM_RESOLVER_PREAMBLE}
+const __esmResolver = createEsmResolver({
+  kind(path) {
+    const st = __fsMod.statSync(path, { throwIfNoEntry: false });
+    return !st ? null : st.isDirectory() ? "directory" : st.isFile() ? "file" : null;
+  },
+  realpath(path) {
+    try { return __fsMod.realpathSync(path); } catch { return path; }
+  },
+  readText(path) { return __readFileOr(path, null); },
+  isBuiltin(specifier) {
+    const scheme = specifier.startsWith("node:");
+    const name = scheme ? specifier.slice(5) : specifier;
+    if (!scheme && __ESM_SCHEME_ONLY_BUILTINS.has(name)) return false;
+    return Object.prototype.hasOwnProperty.call(builtins, name);
+  },
+  cjsResolve(specifier, parentPath) {
+    try {
+      const dir = parentPath.slice(0, parentPath.lastIndexOf("/")).replace(/^\\/+/, "");
+      const found = __resolveFrom(specifier, dir);
+      return found ? "/" + String(found).replace(/^\\/+/, "") : null;
+    } catch { return null; }
+  },
+});
+const __esmNamespaces = new Map();
+/** A module namespace: its names sorted, read through to the exports. */
+function __esmNamespaceOf(names, read) {
+  const ns = Object.create(null);
+  for (const name of [...names].sort()) {
+    Object.defineProperty(ns, name, { enumerable: true, get: () => read(name) });
+  }
+  Object.defineProperty(ns, Symbol.toStringTag, { value: "Module" });
+  return Object.preventExtensions(ns);
+}
+function __esmLoad(resolution) {
+  const cached = __esmNamespaces.get(resolution.url);
+  if (cached) return cached;
+  let ns;
+  if (resolution.format === "builtin") {
+    const mod = __requireFrom("node:" + resolution.builtin, "");
+    const names = new Set(mod && (typeof mod === "object" || typeof mod === "function") ? Object.keys(mod) : []);
+    names.add("default");
+    ns = __esmNamespaceOf(names, (name) => name === "default" ? mod : mod[name]);
+  } else if (resolution.format === "data") {
+    const match = /^data:application\\/json(;[^,]*)?,/.exec(resolution.url);
+    if (!match) {
+      throw Object.assign(new Error("Nimbus: a data: URL module can only be JSON here; code cannot be compiled after the process starts: " + resolution.url.slice(0, 64)), { code: "ERR_NIMBUS_DATA_MODULE" });
+    }
+    const body = resolution.url.slice(match[0].length);
+    const value = JSON.parse(match[1] && match[1].includes(";base64") ? atob(body) : decodeURIComponent(body));
+    ns = __esmNamespaceOf(["default"], () => value);
+  } else {
+    const key = resolution.path.replace(/^\\/+/, "");
+    const esm = resolution.format === "module"
+      || (resolution.format === "detect" && globalThis.__nimbusEsmModules && globalThis.__nimbusEsmModules.has(key));
+    // Canonical queryless ESM shares evaluation with require() and static
+    // imports lowered to require(). Queries/fragments are distinct jobs.
+    const variant = esm && (resolution.url.includes("?") || resolution.url.includes("#"));
+    const exports = __loadModule(key, variant ? resolution.url : key);
+    if (resolution.format === "json") {
+      ns = __esmNamespaceOf(["default"], () => exports);
+    } else if (esm) {
+      // The ESM→CJS transform's exports: the module's own names, live.
+      const names = exports && typeof exports === "object" ? Object.keys(exports).filter((name) => name !== "__esModule") : [];
+      ns = __esmNamespaceOf(names, (name) => exports[name]);
+    } else {
+      // CommonJS: module.exports is the default, its names the named exports.
+      const mod = exports;
+      const names = new Set(mod && (typeof mod === "object" || typeof mod === "function") ? Object.keys(mod) : []);
+      names.delete("default");
+      names.add("default");
+      ns = __esmNamespaceOf(names, (name) => name === "default" ? mod : mod[name]);
+    }
   }
-  return "file:///" + resolved.replace(/^\\/+/, "");
+  __esmNamespaces.set(resolution.url, ns);
+  return ns;
+}
+globalThis.__nimbusDynamicImport = function __nimbusDynamicImport(parentUrl, specifier, options) {
+  return Promise.resolve().then(() => {
+    const text = String(specifier);
+    const attributes = {};
+    // V8's own checks and messages (node 22), which run before resolution.
+    if (options !== undefined) {
+      if (options === null || typeof options !== "object") throw new TypeError("The second argument to import() must be an object");
+      const withAttributes = options.with;
+      if (withAttributes !== undefined) {
+        if (withAttributes === null || typeof withAttributes !== "object") throw new TypeError("The 'assert' option must be an object");
+        for (const key of Object.keys(withAttributes)) {
+          if (typeof withAttributes[key] !== "string") throw new TypeError("Import assertion value must be a string");
+          attributes[key] = withAttributes[key];
+        }
+      }
+    }
+    const resolution = __esmResolver.resolveSync(text, parentUrl);
+    __esmResolver.validateAttributes(resolution.url, resolution.format, attributes);
+    return __esmLoad(resolution);
+  });
+};
+
+// Node's import.meta.resolve, synchronous as in Node: the URL a specifier
+// names, even for a file or directory that will not load.
+globalThis.__nimbusImportMetaResolve = function __nimbusImportMetaResolve(specifier, parentUrl) {
+  const parent = typeof parentUrl === "string" && parentUrl.startsWith("file:")
+    ? parentUrl
+    : "file:///" + String(globalThis.__currentModulePath || "[eval]").replace(/^\\/+/, "");
+  return __esmResolver.metaResolveSync(String(specifier), parent);
 };
 
 /**