@nimbus-sh/worker 0.10.0 → 0.11.0

package/dist/vfs/facet-resident-store.js

@@ -181,16 +181,8 @@
  * \`__residentSynchronizeFromSupervisor\`.
  */
 import { FS_LIST_PAGE_LIMIT, FS_READ_BATCH_PATH_LIMIT, FS_READ_BATCH_REQUEST_BYTES, } from '@nimbus-sh/core/constants.js';
-/**
- * Bytes of file content in one row.
- *
- * The measured ceiling is 2,199,981 bytes in a single value (bisected, with a
- * 12-char key; the limit is on the row, so a longer path buys less). 1 MiB
- * leaves better than 2x of headroom against a limit whose exact form is not
- * contractual, and keeps the per-read allocation of a large file bounded.
- * Files at or under it — effectively all of them — are one row and one query.
- */
-export const RESIDENT_CHUNK_BYTES = 1_048_576;
+import { FACET_OWN_WRITE_MEMORY_BYTES } from '@nimbus-sh/platform/limits.js';
+import { RESIDENT_CHUNK_BYTES } from './facet-resident-limits.js';
 /**
  * Rows written before the materialiser yields.
  *
@@ -217,6 +209,8 @@ export const RESIDENT_FILL_BATCH_BYTES = FS_READ_BATCH_REQUEST_BYTES;
  * The in-facet store. Spliced into the generated module ahead of the shims, in
  * the same way `VFS_WRITE_LEDGER_SOURCE` is (`facets/manager.ts`), because it
  * has to close over the same module scope the shims read `__vfsBundle` from.
+ * Like the ledger and the shims it reaches the facet as a staged asset
+ * (scripts/bundle-node-shims.mjs), not through the Worker bundle.
  *
  * It presents a Proxy rather than a new API on purpose. `_bundleLookup`,
  * `_writtenCell`, `__readFileOr`, `__fileExists` and the directory scans all
@@ -227,10 +221,11 @@ export const RESIDENT_FILL_BATCH_BYTES = FS_READ_BATCH_REQUEST_BYTES;
  * rather than a new one.
  */
 export const FACET_RESIDENT_STORE_SOURCE = `
-// The facet's own SQLite, bound once the DO exists. Module scope has no ctx,
-// so every trap below runs in handler context, which is also the only context
-// that reads the resident set.
-let __residentSql = null;
+// The store's tables (__residentTablesOnSql or __residentTablesInMemory),
+// bound once the process exists. Module scope has no ctx, so every trap below
+// runs in handler context, which is also the only context that reads the
+// resident set.
+let __residentT = null;
 let __residentReady = false;
 
 /**
@@ -283,49 +278,246 @@ const __RESIDENT_MAX_LIST_PAGES = 4096;
  * and the kind is stored rather than inferred so a text file whose bytes happen
  * to be valid UTF-8 does not change shape between a write and a read.
  */
+const __RESIDENT_SCHEMA = "2";
+
+// N18: the session's storage ledger admits this facet's database growth
+// before it happens. The supervisor grants an allowance (the ledger records
+// it under this facet's name); the store never grows its database past
+// \`__residentCap\`, and asks for more, asynchronously, when it would. What
+// does not fit is not held: a fill degrades to reads through the session,
+// and an own write goes to the session only. Null: no ledger (no cap).
+let __residentCap = null;
+let __residentFacet = null;
+let __residentSupervisor = null;
+let __residentGrantAsk = null;
+const __RESIDENT_ROW_BYTES = 256;
+function __namespaceRowBytes(parent, name, target) {
+  // JavaScript keeps path/target strings in the heap. Charge UTF-16 storage
+  // plus the existing row allowance, even when the engine can compress text.
+  return __RESIDENT_ROW_BYTES + 2 * (String(parent).length + String(name).length + (target == null ? 0 : String(target).length));
+}
+
+function __residentDbBytes() {
+  // A one-shot's heap is one budget: the store's tables and the own writes
+  // held beside them (__residentHold) count against the same cap.
+  return __residentT.bytes() + (__residentInHeap ? __residentHeldBytes + __residentNamespaceOverlayBytes + __residentNamespaceReserveBytes : 0);
+}
+
+/** Whether the store is a one-shot's heap (__residentBindInMemory) rather than a facet's SQLite. */
+let __residentInHeap = false;
+let __residentNamespaceOverlayBytes = 0;
+let __residentNamespaceReserveBytes = 0;
+function __residentNamespaceOverlayDelta(bytes) {
+  if (!__residentInHeap) return;
+  if (bytes > 0 && __residentCap !== null && __residentDbBytes() + bytes > __residentCap) {
+    const cause = "namespace storage budget exceeded (" + __residentCap + " bytes)";
+    __nsMarkReady(__residentT, false, cause);
+    throw Object.assign(new Error(cause), { code: "ENOSPC" });
+  }
+  __residentNamespaceOverlayBytes += bytes;
+}
+
+/**
+ * Whether the store may grow by \`bytes\` now; when not, and \`ask\`, more room
+ * is asked for. A copy of an own write never asks: the session's copy is the
+ * one that must have the room, and the cache must not take it first.
+ */
+function __residentFits(bytes, ask = true) {
+  if (__residentCap === null) return true;
+  if (__residentDbBytes() + bytes <= __residentCap) return true;
+  if (ask) void __residentAskGrant(bytes);
+  return false;
+}
+
+/**
+ * Ask the ledger for \`bytes\` more, reporting what the database measures.
+ * Exactly what is needed: room granted and unused is room the session's own
+ * writes cannot have. Resolves to whether \`bytes\` now fit.
+ */
+function __residentAskGrant(bytes) {
+  const supervisor = __residentSupervisor;
+  if (__residentCap === null) return Promise.resolve(true);
+  // A store with no ledger row (a one-shot's heap) has a fixed budget: no one to ask.
+  if (__residentFacet === null || !supervisor || typeof supervisor.fsStorageGrant !== "function") return Promise.resolve(false);
+  if (__residentGrantAsk) return __residentGrantAsk.then(() => __residentDbBytes() + bytes <= __residentCap);
+  const want = Math.max(0, __residentDbBytes() + bytes - __residentCap);
+  __residentGrantAsk = (async () => {
+    try {
+      const answer = await supervisor.fsStorageGrant(__residentFacet, want, __residentDbBytes());
+      const granted = Number(answer && answer.granted) || 0;
+      __residentCap += granted;
+      if (answer && typeof answer.cap === "number") __residentCap = Math.max(__residentCap, answer.cap);
+    } catch {}
+  })().finally(() => { __residentGrantAsk = null; });
+  return __residentGrantAsk.then(() => __residentDbBytes() + bytes <= __residentCap);
+}
+
+/** Room for \`bytes\` before an asynchronous fill writes them: true when they fit. */
+async function __residentEnsureRoom(bytes) {
+  if (__residentCap === null || __residentDbBytes() + bytes <= __residentCap) return true;
+  return __residentAskGrant(bytes);
+}
+
+/**
+ * What holding a cell costs the database: its bytes (a text cell's UTF-8
+ * length) on overflow pages (1% over, for page headers and the b-tree pages
+ * above them), a row per chunk and head, and a page of slack. The manager
+ * charges a launch's module map the same way (manager.ts residentCellCost).
+ */
+function __residentCellCost(cell) {
+  const isText = typeof cell === "string";
+  const size = isText ? cell.length : __residentBytes(cell).byteLength;
+  const limit = isText ? Math.floor(__RESIDENT_CHUNK_BYTES / 3) : __RESIDENT_CHUNK_BYTES;
+  const chunks = Math.max(1, Math.ceil(size / limit));
+  return Math.ceil((isText ? __residentUtf8Length(cell) : size) * 1.01) + (chunks + 1) * __RESIDENT_ROW_BYTES + 4096;
+}
+
+function __residentUtf8Length(text) {
+  let bytes = 0;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (c < 0x80) bytes += 1;
+    else if (c < 0x800) bytes += 2;
+    // A surrogate pair is one 4-byte character; a lone surrogate encodes as 3.
+    else if (c >= 0xd800 && c < 0xdc00 && i + 1 < text.length && (text.charCodeAt(i + 1) & 0xfc00) === 0xdc00) { bytes += 4; i++; }
+    else bytes += 3;
+  }
+  return bytes;
+}
+
+/** Room for what an ACQUIRE answer pushes, asked for before it is applied. */
+async function __residentRoomForPushed(result) {
+  if (__residentCap === null || !result || !Array.isArray(result.paths)) return;
+  let bytes = 0;
+  for (const entry of result.paths) {
+    if (entry && entry.bytes != null) bytes += __residentCellCost(__residentBytes(entry.bytes));
+  }
+  if (bytes > 0) await __residentEnsureRoom(bytes);
+}
+
+/** What the database measures, after a fill batch: the ledger settles to it, or records overshoot. */
+async function __residentReportSize() {
+  const supervisor = __residentSupervisor;
+  if (__residentCap === null || __residentFacet === null || !supervisor || typeof supervisor.fsStorageGrant !== "function") return;
+  try { await supervisor.fsStorageGrant(__residentFacet, 0, __residentDbBytes()); } catch {}
+}
+
+/** The allowance this launch was admitted for (the fabric's startArgs.storage). */
+function __residentSetStorage(storage, supervisor) {
+  __residentSupervisor = supervisor || null;
+  if (!storage || typeof storage.facet !== "string" || typeof storage.grant !== "number") return;
+  __residentFacet = storage.facet;
+  __residentCap = __residentDbBytes() + storage.grant;
+}
+
+/** The cap this store enforces, for startProcess to report. */
+function __residentStorageCap() {
+  return __residentCap;
+}
+
+// An own write the store could not hold (no room in the session's storage)
+// is kept here, so the program still reads what it wrote: a bounded LRU
+// (Map order is recency) of { cell, rev }, dated like a file row (own until
+// its write-back is acknowledged, then the write's revision) and judged by
+// every report like one. A path it could not keep either is remembered by
+// name only, so a miss on it says why.
+const __residentHeld = new Map();
+let __residentHeldBytes = 0;
+const __residentUnheld = new Set();
+const __RESIDENT_HELD_MAX_BYTES = ${FACET_OWN_WRITE_MEMORY_BYTES};
+
+function __residentCellSize(held) {
+  const cell = held.cell;
+  return typeof cell === "string" ? cell.length * 3 : __residentBytes(cell).byteLength;
+}
+
+function __residentForgetHeld(path) {
+  const cell = __residentHeld.get(path);
+  if (cell !== undefined) {
+    __residentHeld.delete(path);
+    __residentHeldBytes -= __residentCellSize(cell);
+  }
+  __residentUnheld.delete(path);
+}
+
+function __residentHold(path, cell) {
+  __residentForgetHeld(path);
+  const size = __residentCellSize({ cell });
+  // In a facet the held cells have their own bound. In a one-shot's heap they
+  // share the store's: what the cap leaves beside the tables.
+  const limit = __residentInHeap ? Math.max(0, Number(__residentCap) - __residentT.bytes() - __residentNamespaceOverlayBytes - __residentNamespaceReserveBytes) : __RESIDENT_HELD_MAX_BYTES;
+  if (size > limit) { __residentUnheld.add(path); return; }
+  while (__residentHeldBytes + size > limit) {
+    const [oldest, old] = __residentHeld.entries().next().value;
+    __residentHeld.delete(oldest);
+    __residentHeldBytes -= __residentCellSize(old);
+    __residentUnheld.add(oldest);
+  }
+  __residentHeld.set(path, { cell, rev: __RK_OWN_WRITE });
+  __residentHeldBytes += size;
+}
+
+/** Whether a miss on \`path\` is the storage's: its own write was held nowhere. */
+function __residentStorageMiss(path) {
+  return __residentUnheld.has(path);
+}
 const __RK_TEXT = 0;
 const __RK_BINARY = 1;
 const __RK_DENIED = 2;
 
 /**
- * The revision of a cell this facet wrote and has not flushed.
+ * The revision of a cell holding this facet's own bytes that the authority has
+ * not acknowledged yet: a write that has not flushed, or a cell one of its own
+ * mutations holds while that mutation is in flight (\`__residentLease\`).
  *
  * Read-your-writes: strictly newer than anything the authority could report,
  * so it is never evicted by a delta and never mistaken for something the
  * authority vouched for. A distinct sentinel rather than NULL, because NULL
  * would reintroduce the undated row the NOT NULL constraint exists to forbid.
+ *
+ * It is the ONE revision a delta cannot evict, so it must mean exactly that
+ * and nothing else. The acknowledgement dates the row (\`__residentStamp\`),
+ * and bytes the authority served are dated as they are installed
+ * (\`__residentFill\`). A row left here after either would hold its bytes
+ * against every later write by anyone, for the life of the store.
  */
 const __RK_OWN_WRITE = -1;
 
-function __residentBind(ctx) {
-  const sql = ctx && ctx.storage && ctx.storage.sql;
-  if (!sql || typeof sql.exec !== "function") {
-    throw new Error(
-      "Nimbus: this facet has no synchronous SQLite (ctx.storage.sql); " +
-      "the resident set cannot be served and every sync read would raise EAGAIN"
-    );
+/**
+ * The store's own operations, over the four tables it keeps: 'file' (one row
+ * per held path: kind, size, chunk count, revision, content key), 'chunk'
+ * (the bytes), 'meta' (schema, cursor, namespace readiness) and 'ns' (the
+ * namespace: a stat per visible name, keyed (parent, name)). Everything above
+ * this seam decides; the backing only stores. There are exactly two backings,
+ * with one contract:
+ *
+ * - __residentTablesOnSql: the process facet's own SQLite (ctx.storage.sql),
+ *   durable across the facet's incarnations. Every statement the store has
+ *   ever issued lives here, unchanged.
+ * - __residentTablesInMemory: a one-shot process's store, in its heap, for
+ *   the life of the run (runOnce hosts no SQLite). Same rows, same answers,
+ *   and a byte count that plays the database's size for the store's budget.
+ *
+ * Rows come back as plain objects with the column names as keys: file heads
+ * { kind, size, chunks }, chunks { txt, bin } (bin as the backing holds it;
+ * callers normalise with __residentBytes), ns rows with every stat column.
+ */
+function __residentTablesOnSql(sql) {
+  let schema = null;
+  for (const row of sql.exec("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'meta'")) schema = "";
+  if (schema !== null) for (const row of sql.exec("SELECT v FROM meta WHERE k = 'schema'")) schema = String(row.v);
+  if (schema !== __RESIDENT_SCHEMA) {
+    for (const table of ["chunk", "file", "ns", "meta"]) sql.exec("DROP TABLE IF EXISTS " + table);
   }
-  // 'file' carries one row per path, so existence, size and kind are one query
-  // that never touches content. 'chunk' carries the bytes. Splitting them is
-  // what makes _statLadder and __fileExists cheap: the common case reads a
-  // short row and never pages a megabyte of blob in to answer "is it there".
-  // 'rev' is NOT NULL, and that constraint IS the coherence guarantee rather
-  // than a note about it. An undated row can never be invalidated, so it would
-  // be served stale forever; making the column nullable would leave the rule
-  // to be remembered at every insert, and the one that forgot would be
-  // indistinguishable from the ones that did not. Here the row simply cannot
-  // be written. This is the r2-cache posture — an unverifiable key cannot be
-  // constructed — moved to the only storage layer this store has.
-  //
-  // __RK_OWN_WRITE is the one negative value: this facet's own unflushed
-  // bytes, which are strictly newer than anything the authority can report and
-  // are always readable. It is a real provenance, not an absence of one.
+  // 'ckey' is the authority's content identity for the bytes (equal keys,
+  // equal bytes), when it said so; null for bytes it did not describe.
   sql.exec(
     "CREATE TABLE IF NOT EXISTS file (" +
       "path TEXT PRIMARY KEY, kind INTEGER NOT NULL, size INTEGER NOT NULL, " +
-      "chunks INTEGER NOT NULL, rev INTEGER NOT NULL CHECK (rev >= -1)" +
+      "chunks INTEGER NOT NULL, rev INTEGER NOT NULL CHECK (rev >= -1), ckey TEXT" +
     ")"
   );
+  sql.exec("CREATE INDEX IF NOT EXISTS file_ckey ON file (ckey) WHERE ckey IS NOT NULL");
   sql.exec(
     "CREATE TABLE IF NOT EXISTS chunk (" +
       "path TEXT NOT NULL, part INTEGER NOT NULL, txt TEXT, bin BLOB, " +
@@ -335,9 +527,390 @@ function __residentBind(ctx) {
   // The store's own cursor, in the same storage as the rows it describes, so
   // the two cannot be separated by an isolate restart.
   sql.exec("CREATE TABLE IF NOT EXISTS meta (k TEXT PRIMARY KEY, v TEXT NOT NULL)");
-  __residentSql = sql;
+  sql.exec("INSERT OR REPLACE INTO meta (k, v) VALUES ('schema', ?)", __RESIDENT_SCHEMA);
+  // The namespace: every name the process's credential can see, with its stat
+  // and no content. Keyed (parent, name) so a point lookup and a directory
+  // listing are both one index seek, and no path is stored twice.
+  sql.exec(
+    "CREATE TABLE IF NOT EXISTS ns (" +
+      "parent TEXT NOT NULL, name TEXT NOT NULL, kind INTEGER NOT NULL, size INTEGER NOT NULL, " +
+      "mode INTEGER NOT NULL, uid INTEGER NOT NULL, gid INTEGER NOT NULL, atime REAL NOT NULL, " +
+      "mtime REAL NOT NULL, ctime REAL NOT NULL, ino INTEGER NOT NULL, rev INTEGER NOT NULL, target TEXT, " +
+      "PRIMARY KEY (parent, name)" +
+    ") WITHOUT ROWID"
+  );
+  const first = (rows) => { for (const row of rows) return row; return undefined; };
+  const ranged = (select, from, to, tail = "") => to === null
+    ? sql.exec(select + " WHERE path >= ?" + tail, from)
+    : sql.exec(select + " WHERE path >= ? AND path < ?" + tail, from, to);
+  return {
+    bytes() {
+      const size = sql.databaseSize;
+      if (typeof size === "number" && size > 0) return size;
+      for (const row of sql.exec("SELECT page_count * page_size AS n FROM pragma_page_count(), pragma_page_size()")) return Number(row.n);
+      return 0;
+    },
+    databaseSize() { return Number(sql.databaseSize ?? 0); },
+    metaGet(k) { const row = first(sql.exec("SELECT v FROM meta WHERE k = ?", k)); return row === undefined ? undefined : String(row.v); },
+    metaSet(k, v) { sql.exec("INSERT OR REPLACE INTO meta (k, v) VALUES (?, ?)", k, v); },
+    fileHead(path) { return first(sql.exec("SELECT kind, size, chunks FROM file WHERE path = ?", path)); },
+    fileRev(path) { const row = first(sql.exec("SELECT rev FROM file WHERE path = ?", path)); return row === undefined ? undefined : Number(row.rev); },
+    fileRevKey(path) { return first(sql.exec("SELECT rev, ckey FROM file WHERE path = ?", path)); },
+    fileOwnSize(path) {
+      const row = first(sql.exec("SELECT size FROM file WHERE path = ? AND rev = ?", path, __RK_OWN_WRITE));
+      return row === undefined ? undefined : Number(row.size);
+    },
+    filePut(path, kind, size, chunks, rev, ckey) {
+      sql.exec("INSERT OR REPLACE INTO file (path, kind, size, chunks, rev, ckey) VALUES (?, ?, ?, ?, ?, ?)", path, kind, size, chunks, rev, ckey);
+    },
+    fileSetRev(path, rev) { sql.exec("UPDATE file SET rev = ? WHERE path = ?", rev, path); },
+    fileStampOwn(path, rev) { sql.exec("UPDATE file SET rev = ? WHERE path = ? AND rev = ?", rev, path, __RK_OWN_WRITE); },
+    fileDelete(path) { sql.exec("DELETE FROM file WHERE path = ?", path); },
+    fileByKey(ckey, notPath) {
+      return first(sql.exec("SELECT path, kind, size, chunks FROM file WHERE ckey = ? AND rev >= 0 AND path <> ? LIMIT 1", ckey, notPath));
+    },
+    filePaths(from, to) { return [...ranged("SELECT path FROM file", from, to)].map((row) => String(row.path)); },
+    fileAny(from, to) { return first(ranged("SELECT path FROM file", from, to, " LIMIT 1")) !== undefined; },
+    fileRevsIn(from, to) { return [...ranged("SELECT path, rev FROM file", from, to)]; },
+    // In key order, as every other scan here is: the primary key's index
+    // serves it, and both backings then answer in one order.
+    fileAllPaths() { return [...sql.exec("SELECT path FROM file ORDER BY path")].map((row) => String(row.path)); },
+    fileRows() { return [...sql.exec("SELECT path, rev, ckey FROM file ORDER BY path")]; },
+    fileOwnPaths() { return [...sql.exec("SELECT path FROM file WHERE rev = ? ORDER BY path", __RK_OWN_WRITE)].map((row) => String(row.path)); },
+    fileStats() { return first(sql.exec("SELECT count(*) AS n, coalesce(sum(size), 0) AS b FROM file")); },
+    chunkFirst(path) { return first(sql.exec("SELECT txt, bin FROM chunk WHERE path = ? AND part = 0", path)); },
+    chunkParts(path) { return [...sql.exec("SELECT txt, bin FROM chunk WHERE path = ? ORDER BY part", path)]; },
+    chunkAddText(path, part, txt) { sql.exec("INSERT INTO chunk (path, part, txt) VALUES (?, ?, ?)", path, part, txt); },
+    chunkAddBin(path, part, bin) { sql.exec("INSERT INTO chunk (path, part, bin) VALUES (?, ?, ?)", path, part, bin); },
+    chunkSetBin(path, part, bin) { sql.exec("INSERT OR REPLACE INTO chunk (path, part, bin) VALUES (?, ?, ?)", path, part, bin); },
+    chunkCopy(to, from) { sql.exec("INSERT INTO chunk (path, part, txt, bin) SELECT ?, part, txt, bin FROM chunk WHERE path = ?", to, from); },
+    chunkDelete(path) { sql.exec("DELETE FROM chunk WHERE path = ?", path); },
+    // Own rows are the one provenance a new incarnation cannot date.
+    dropOwn() {
+      sql.exec("DELETE FROM chunk WHERE path IN (SELECT path FROM file WHERE rev = ?)", __RK_OWN_WRITE);
+      sql.exec("DELETE FROM file WHERE rev = ?", __RK_OWN_WRITE);
+    },
+    // Every dated row, and any chunk no own row claims.
+    dropDated() {
+      sql.exec("DELETE FROM chunk WHERE path NOT IN (SELECT path FROM file WHERE rev = ?)", __RK_OWN_WRITE);
+      sql.exec("DELETE FROM file WHERE rev <> ?", __RK_OWN_WRITE);
+    },
+    // Every dated row and its chunks.
+    dropDatedFiles() {
+      sql.exec("DELETE FROM chunk WHERE path IN (SELECT path FROM file WHERE rev <> ?)", __RK_OWN_WRITE);
+      sql.exec("DELETE FROM file WHERE rev <> ?", __RK_OWN_WRITE);
+    },
+    clear() {
+      sql.exec("DELETE FROM chunk");
+      sql.exec("DELETE FROM file");
+      sql.exec("DELETE FROM ns");
+      sql.exec("DELETE FROM meta");
+    },
+    nsPut(parent, name, kind, size, mode, uid, gid, atime, mtime, ctime, ino, rev, target) {
+      sql.exec(
+        "INSERT OR REPLACE INTO ns (parent, name, kind, size, mode, uid, gid, atime, mtime, ctime, ino, rev, target) " +
+          "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        parent, name, kind, size, mode, uid, gid, atime, mtime, ctime, ino, rev, target,
+      );
+    },
+    nsGet(parent, name) {
+      return first(sql.exec(
+        "SELECT kind, size, mode, uid, gid, atime, mtime, ctime, ino, rev, target FROM ns WHERE parent = ? AND name = ?",
+        parent, name,
+      ));
+    },
+    nsDelete(parent, name) { sql.exec("DELETE FROM ns WHERE parent = ? AND name = ?", parent, name); },
+    nsDeleteChildren(parent) { sql.exec("DELETE FROM ns WHERE parent = ?", parent); },
+    nsDeleteParents(from, to) {
+      if (to === null) sql.exec("DELETE FROM ns WHERE parent >= ?", from);
+      else sql.exec("DELETE FROM ns WHERE parent >= ? AND parent < ?", from, to);
+    },
+    nsClear() { sql.exec("DELETE FROM ns"); },
+    nsKeys() { return [...sql.exec("SELECT parent, name FROM ns")]; },
+    nsOfKind(kind) { return [...sql.exec("SELECT parent, name FROM ns WHERE kind = ?", kind)]; },
+    nsChildren(parent) { return [...sql.exec("SELECT name, kind FROM ns WHERE parent = ?", parent)]; },
+    nsCount() { const row = first(sql.exec("SELECT count(*) AS n FROM ns")); return row === undefined ? 0 : Number(row.n); },
+  };
+}
+
+function __residentBind(ctx) {
+  const sql = ctx && ctx.storage && ctx.storage.sql;
+  if (!sql || typeof sql.exec !== "function") {
+    throw new Error(
+      "Nimbus: this facet has no synchronous SQLite (ctx.storage.sql); " +
+      "the resident set cannot be served and every sync read would raise EAGAIN"
+    );
+  }
+  return __residentBindTables(__residentTablesOnSql(sql));
+}
+
+/**
+ * The one-shot backing: the same tables, in the process's heap, for the life
+ * of one run. A one-shot is hosted by runOnce, which gives it no SQLite, and
+ * it keeps nothing after it exits. Its answers are the SQLite backing's:
+ * scans come back in key order (a b-tree's), reads hand back copies (a
+ * program that writes into a Buffer it read must not change the store), and
+ * \`bytes()\` counts what it holds in the units __residentCellCost charges (a
+ * row, and the payload's bytes), so the store's one budget rule serves both.
+ */
+function __residentTablesInMemory() {
+  const files = new Map();
+  const chunks = new Map();
+  const meta = new Map();
+  const ns = new Map();
+  const byKey = new Map();
+  let sorted = null;
+  let used = 0;
+  let names = 0;
+  let namespaceBytes = 0;
+  const utf8 = (text) => __residentUtf8Length(text);
+  // SQLite's binary collation orders TEXT by its UTF-8 bytes: code-point
+  // order, which UTF-16 comparison is not past the BMP.
+  const cmp = (a, b) => {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i++) {
+      const x = a.codePointAt(i), y = b.codePointAt(i);
+      if (x !== y) return x < y ? -1 : 1;
+      if (x > 0xffff) i++;
+    }
+    return a.length === b.length ? 0 : a.length < b.length ? -1 : 1;
+  };
+  const payload = (cell) => (cell.txt != null ? utf8(cell.txt) : cell.bin ? cell.bin.byteLength : 0);
+  const unkey = (path, row) => {
+    if (row && row.ckey != null) {
+      const set = byKey.get(row.ckey);
+      if (set) { set.delete(path); if (set.size === 0) byKey.delete(row.ckey); }
+    }
+  };
+  const paths = () => {
+    if (sorted === null) sorted = [...files.keys()].sort(cmp);
+    return sorted;
+  };
+  const lowerBound = (list, from) => {
+    let lo = 0, hi = list.length;
+    while (lo < hi) { const mid = (lo + hi) >>> 1; if (cmp(list[mid], from) < 0) lo = mid + 1; else hi = mid; }
+    return lo;
+  };
+  const inRange = (from, to) => {
+    const list = paths();
+    const out = [];
+    for (let i = lowerBound(list, from); i < list.length && (to === null || cmp(list[i], to) < 0); i++) out.push(list[i]);
+    return out;
+  };
+  const copy = (cell) => ({ txt: cell.txt ?? null, bin: cell.bin ? cell.bin.slice() : null });
+  const dropChunks = (path) => {
+    const parts = chunks.get(path);
+    if (!parts) return;
+    for (const cell of parts.values()) used -= __RESIDENT_ROW_BYTES + payload(cell);
+    chunks.delete(path);
+  };
+  const dropFile = (path) => {
+    const row = files.get(path);
+    if (row === undefined) return;
+    unkey(path, row);
+    files.delete(path);
+    sorted = null;
+    used -= __RESIDENT_ROW_BYTES;
+  };
+  const addChunk = (path, part, cell, replace) => {
+    let parts = chunks.get(path);
+    if (!parts) { parts = new Map(); chunks.set(path, parts); }
+    const had = parts.get(part);
+    if (had !== undefined) {
+      if (!replace) throw new Error("UNIQUE constraint failed: chunk.path, chunk.part");
+      used -= __RESIDENT_ROW_BYTES + payload(had);
+    }
+    parts.set(part, cell);
+    used += __RESIDENT_ROW_BYTES + payload(cell);
+  };
+  const nsRow = (parent, name) => { const dir = ns.get(parent); return dir ? dir.get(name) : undefined; };
+  const nsDrop = (parent, name) => {
+    const dir = ns.get(parent);
+    const row = dir?.get(name);
+    if (row === undefined) return;
+    dir.delete(name);
+    names--;
+    const bytes = __namespaceRowBytes(parent, name, row.target);
+    used -= bytes; namespaceBytes -= bytes;
+    if (dir.size === 0) ns.delete(parent);
+  };
+  const nsDropParent = (parent) => {
+    const dir = ns.get(parent);
+    if (!dir) return;
+    names -= dir.size;
+    for (const [name, row] of dir) {
+      const bytes = __namespaceRowBytes(parent, name, row.target);
+      used -= bytes; namespaceBytes -= bytes;
+    }
+    ns.delete(parent);
+  };
+  const byName = cmp;
+  const dropWhere = (keepFile, keepChunkPath) => {
+    for (const path of [...chunks.keys()]) if (!keepChunkPath(path)) dropChunks(path);
+    for (const [path, row] of [...files]) if (!keepFile(row)) dropFile(path);
+  };
+  return {
+    bytes() { return used; },
+    databaseSize() { return used; },
+    metaGet(k) { return meta.get(k); },
+    metaSet(k, v) { meta.set(k, String(v)); },
+    fileHead(path) { const row = files.get(path); return row === undefined ? undefined : { kind: row.kind, size: row.size, chunks: row.chunks }; },
+    fileRev(path) { const row = files.get(path); return row === undefined ? undefined : row.rev; },
+    fileRevKey(path) { const row = files.get(path); return row === undefined ? undefined : { rev: row.rev, ckey: row.ckey }; },
+    fileOwnSize(path) { const row = files.get(path); return row !== undefined && row.rev === __RK_OWN_WRITE ? row.size : undefined; },
+    filePut(path, kind, size, chunkCount, rev, ckey) {
+      if (!(rev >= -1)) throw new Error("CHECK constraint failed: rev >= -1");
+      const had = files.get(path);
+      if (had === undefined) { sorted = null; used += __RESIDENT_ROW_BYTES; } else unkey(path, had);
+      const row = { kind: Number(kind), size: Number(size), chunks: Number(chunkCount), rev: Number(rev), ckey: ckey == null ? null : String(ckey) };
+      files.set(path, row);
+      if (row.ckey !== null) { let set = byKey.get(row.ckey); if (!set) { set = new Set(); byKey.set(row.ckey, set); } set.add(path); }
+    },
+    fileSetRev(path, rev) { const row = files.get(path); if (row !== undefined) row.rev = Number(rev); },
+    fileStampOwn(path, rev) { const row = files.get(path); if (row !== undefined && row.rev === __RK_OWN_WRITE) row.rev = Number(rev); },
+    fileDelete(path) { dropFile(path); },
+    fileByKey(ckey, notPath) {
+      const set = byKey.get(String(ckey));
+      if (!set) return undefined;
+      for (const path of set) {
+        const row = files.get(path);
+        if (path !== notPath && row && row.rev >= 0) return { path, kind: row.kind, size: row.size, chunks: row.chunks };
+      }
+      return undefined;
+    },
+    filePaths(from, to) { return inRange(from, to); },
+    fileAny(from, to) { const list = paths(); const i = lowerBound(list, from); return i < list.length && (to === null || cmp(list[i], to) < 0); },
+    fileRevsIn(from, to) { return inRange(from, to).map((path) => ({ path, rev: files.get(path).rev })); },
+    fileAllPaths() { return [...paths()]; },
+    fileRows() { return paths().map((path) => { const row = files.get(path); return { path, rev: row.rev, ckey: row.ckey }; }); },
+    fileOwnPaths() { return paths().filter((path) => files.get(path).rev === __RK_OWN_WRITE); },
+    fileStats() { let b = 0; for (const row of files.values()) b += row.size; return { n: files.size, b }; },
+    chunkFirst(path) { const parts = chunks.get(path); const cell = parts && parts.get(0); return cell === undefined ? undefined : copy(cell); },
+    chunkParts(path) {
+      const parts = chunks.get(path);
+      if (!parts) return [];
+      return [...parts.keys()].sort((a, b) => a - b).map((part) => copy(parts.get(part)));
+    },
+    chunkAddText(path, part, txt) { addChunk(path, Number(part), { txt: String(txt), bin: null }, false); },
+    chunkAddBin(path, part, bin) { addChunk(path, Number(part), { txt: null, bin: __residentBytes(bin).slice() }, false); },
+    chunkSetBin(path, part, bin) { addChunk(path, Number(part), { txt: null, bin: __residentBytes(bin).slice() }, true); },
+    chunkCopy(to, from) {
+      const parts = chunks.get(from);
+      if (!parts) return;
+      // One statement in SQLite: a conflicting part fails the whole copy, and nothing lands.
+      const held = chunks.get(to);
+      if (held) for (const part of parts.keys()) if (held.has(part)) throw new Error("UNIQUE constraint failed: chunk.path, chunk.part");
+      for (const [part, cell] of [...parts]) addChunk(to, part, copy(cell), false);
+    },
+    chunkDelete(path) { dropChunks(path); },
+    dropOwn() {
+      const own = new Set(paths().filter((path) => files.get(path).rev === __RK_OWN_WRITE));
+      dropWhere((row) => row.rev !== __RK_OWN_WRITE, (path) => !own.has(path));
+    },
+    dropDated() {
+      const own = new Set(paths().filter((path) => files.get(path).rev === __RK_OWN_WRITE));
+      dropWhere((row) => row.rev === __RK_OWN_WRITE, (path) => own.has(path));
+    },
+    dropDatedFiles() {
+      const dated = new Set(paths().filter((path) => files.get(path).rev !== __RK_OWN_WRITE));
+      dropWhere((row) => row.rev === __RK_OWN_WRITE, (path) => !dated.has(path));
+    },
+    clear() {
+      files.clear(); chunks.clear(); meta.clear(); ns.clear(); byKey.clear();
+      sorted = null; used = 0; names = 0; namespaceBytes = 0;
+    },
+    nsPut(parent, name, kind, size, mode, uid, gid, atime, mtime, ctime, ino, rev, target) {
+      let dir = ns.get(parent);
+      const previous = dir?.get(name);
+      const bytes = __namespaceRowBytes(parent, name, target);
+      const growth = bytes - (previous === undefined ? 0 : __namespaceRowBytes(parent, name, previous.target));
+      if (__residentInHeap && __residentCap !== null && used + __residentHeldBytes + __residentNamespaceOverlayBytes + __residentNamespaceReserveBytes + growth > __residentCap) {
+        const cause = "namespace storage budget exceeded (" + __residentCap + " bytes)";
+        __nsMarkReady(__residentT, false, cause);
+        throw Object.assign(new Error(cause), { code: "ENOSPC" });
+      }
+      if (!dir) { dir = new Map(); ns.set(parent, dir); }
+      if (previous === undefined) names++;
+      used += growth; namespaceBytes += growth;
+      dir.set(name, {
+        kind: Number(kind), size: Number(size), mode: Number(mode), uid: Number(uid), gid: Number(gid),
+        atime: Number(atime), mtime: Number(mtime), ctime: Number(ctime), ino: Number(ino), rev: Number(rev),
+        target: target == null ? null : String(target),
+      });
+    },
+    nsGet(parent, name) { const row = nsRow(parent, name); return row === undefined ? undefined : { ...row }; },
+    nsDelete(parent, name) { nsDrop(parent, name); },
+    nsDeleteChildren(parent) { nsDropParent(parent); },
+    nsDeleteParents(from, to) {
+      for (const parent of [...ns.keys()]) if (cmp(parent, from) >= 0 && (to === null || cmp(parent, to) < 0)) nsDropParent(parent);
+    },
+    nsClear() { used -= namespaceBytes; names = 0; namespaceBytes = 0; ns.clear(); },
+    nsBytes() { return namespaceBytes; },
+    nsKeys() {
+      const out = [];
+      for (const parent of [...ns.keys()].sort(byName)) for (const name of [...ns.get(parent).keys()].sort(byName)) out.push({ parent, name });
+      return out;
+    },
+    nsOfKind(kind) {
+      const out = [];
+      for (const parent of [...ns.keys()].sort(byName)) {
+        const dir = ns.get(parent);
+        for (const name of [...dir.keys()].sort(byName)) if (dir.get(name).kind === Number(kind)) out.push({ parent, name });
+      }
+      return out;
+    },
+    nsChildren(parent) {
+      const dir = ns.get(parent);
+      if (!dir) return [];
+      return [...dir.keys()].sort(byName).map((name) => ({ name, kind: dir.get(name).kind }));
+    },
+    nsCount() { return names; },
+  };
+}
+
+/**
+ * A one-shot's store: the heap backing, capped at \`budget\` bytes and never
+ * growing past it (there is no ledger row to grow).
+ */
+function __residentBindInMemory(budget) {
+  const t = __residentBindTables(__residentTablesInMemory());
+  __residentInHeap = true;
+  __residentFacet = null;
+  __residentCap = Number(budget);
+  __residentNamespaceOverlayBytes = 0;
+  __residentNamespaceReserveBytes = 0;
+  return t;
+}
+
+/**
+ * Bind the store to its tables: a facet's SQLite (__residentBind), or a
+ * one-shot's heap (__residentTablesInMemory).
+ *
+ * 'file' carries one row per path, so existence, size and kind are one query
+ * that never touches content. 'chunk' carries the bytes. Splitting them is
+ * what makes _statLadder and __fileExists cheap: the common case reads a
+ * short row and never pages a megabyte of blob in to answer "is it there".
+ * 'rev' is never undated, and that IS the coherence guarantee rather than a
+ * note about it. An undated row can never be invalidated, so it would be
+ * served stale forever. The SQLite backing makes the column NOT NULL, so such
+ * a row cannot be written; this is the r2-cache posture (an unverifiable key
+ * cannot be constructed) moved to the only storage layer this store has.
+ *
+ * __RK_OWN_WRITE is the one negative value: this facet's own bytes that the
+ * authority has not acknowledged, which are strictly newer than anything it
+ * can report and are always readable. It is a real provenance, not an absence
+ * of one.
+ */
+function __residentBindTables(t) {
+  // A store can outlive its process. Own rows left by an earlier one are
+  // writes that never reached the authority or cells whose acknowledgement it
+  // never saw: neither can be dated, so neither is a file.
+  t.dropOwn();
+  __residentT = t;
   __residentReady = true;
-  return sql;
+  __nsLoadLinks(t);
+  __nsOk = t.metaGet("ns") === "1";
+  return t;
 }
 
 function __residentRequire() {
@@ -354,24 +927,21 @@ function __residentRequire() {
       "the program runs; serving a row now would serve bytes of unknown age."
     );
   }
-  return __residentSql;
+  return __residentT;
 }
 
 /** The persisted cursor, or null when this store has never been populated. */
 function __residentCursor() {
   if (!__residentReady) return null;
-  let epoch = null, rev = null;
-  for (const row of __residentSql.exec("SELECT k, v FROM meta WHERE k IN ('epoch','rev')")) {
-    if (row.k === "epoch") epoch = String(row.v);
-    else rev = Number(row.v);
-  }
-  return epoch === null || rev === null ? null : { epoch, rev };
+  const epoch = __residentT.metaGet("epoch");
+  const rev = __residentT.metaGet("rev");
+  return epoch === undefined || rev === undefined ? null : { epoch, rev: Number(rev) };
 }
 
 /** Stamp the store with the authority state its rows are known-good at. */
-function __residentWriteCursor(sql, cursor) {
-  sql.exec("INSERT OR REPLACE INTO meta (k, v) VALUES ('epoch', ?)", String(cursor.epoch));
-  sql.exec("INSERT OR REPLACE INTO meta (k, v) VALUES ('rev', ?)", String(Number(cursor.rev)));
+function __residentWriteCursor(t, cursor) {
+  t.metaSet("epoch", String(cursor.epoch));
+  t.metaSet("rev", String(Number(cursor.rev)));
 }
 
 /**
@@ -384,55 +954,148 @@ function __residentWriteCursor(sql, cursor) {
  *
  * Returns the paths that WERE held and are now gone, which is what
  * \`_acquireAndRefetch\` re-reads live — the same contract \`_acquireBarrier\`
- * already has.
+ * already has — and how many named rows were kept because their revision
+ * already covers the report (this facet's own writes coming back).
  */
 function __residentAdmit(result) {
   if (!__residentReady) throw new Error("Nimbus: __residentAdmit before __residentBind");
-  const sql = __residentSql;
+  const t = __residentT;
   const dropped = [];
+  const relist = [];
+  let kept = 0, pushed = 0;
+  const epoch = result && result.epoch != null ? String(result.epoch) : null;
+  const rev = result && result.rev != null ? Number(result.rev) : null;
+  if (epoch === null || rev === null) {
+    throw new Error(
+      "Nimbus: fsAcquire returned no cursor; the resident store stays sealed " +
+      "rather than serving rows it cannot date"
+    );
+  }
+  // Answers can be admitted out of the order they were served in (two
+  // barriers in flight). One older than the store's cursor describes a state
+  // the store has already moved past: admitting it would move the cursor
+  // back and install its bytes over newer ones. Within an epoch the cursor
+  // only moves forward, and only entries above it are applied.
+  const at = __residentCursor();
+  const floor = at !== null && !__residentSealed && at.epoch === epoch && !(result && result.poison) ? at.rev : null;
+  if (floor !== null && rev <= floor) {
+    return { dropped, kept, pushed: 0, relist, cursor: at, stale: rev < floor };
+  }
+  // The namespace moves with the cursor or not at all: a delta without stats,
+  // or a poison, leaves it describing a revision the cursor has left, so it
+  // stops answering until a listing restores it.
+  // An answer naming no path changes no name, with or without stats.
+  const namespaced = __nsOk && !!result && !result.poison
+    && (result.namespace === true || (Array.isArray(result.paths) && result.paths.length === 0))
+    && (!Array.isArray(result.paths) || result.paths.every((entry) => entry.stat === null || __nsDescribes(entry.stat)));
+  if (!namespaced) {
+    __nsMarkReady(t, false, !result || result.poison ? "the session's change log was truncated past this process's cursor"
+      : "a change reported without the stat every name needs");
+  }
   if (!result || result.poison) {
     // A delta admission has no absolute listing to vouch for a row, so a
-    // poison here means nothing held can be kept. Two statements rather than a
-    // delete per path: a poison at pi scale is 7,141 rows, and eviction is on
-    // the hot path (measured 45 ms whole-store, vs a per-row walk).
+    // poison here means nothing the authority dated can be kept.
     //
     // This is the LAST resort, not the poison policy.
     // \`__residentSynchronizeFromSupervisor\` repairs the same poison against
     // absolute per-path revisions and keeps every row it can prove current;
     // dropping the store is what made a poison cost a whole filesystem.
-    sql.exec("DELETE FROM chunk");
-    sql.exec("DELETE FROM file");
+    __residentDropDated();
   } else if (Array.isArray(result.paths)) {
     for (const entry of result.paths) {
+      if (floor !== null && Number(entry.rev) <= floor) continue;
       const path = entry.path;
-      // A row at or above the reported revision is this facet's own write
-      // coming back; anything else is someone else's and is dropped. An
-      // unflushed own-write (__RK_OWN_WRITE) is newer than any authority
-      // revision by construction and is kept — read-your-writes survives a
-      // peer's mutation of the same path, exactly as it does in heap.
-      let held = false, stamped = 0;
-      for (const row of sql.exec("SELECT rev FROM file WHERE path = ?", path)) {
-        held = true; stamped = Number(row.rev);
+      if (namespaced && __nsReady()) {
+        const again = __nsApplyEntry(t, entry);
+        if (again !== null) relist.push(again);
+      }
+      // A row at or above the reported revision already holds that mutation —
+      // this facet's own write coming back, or bytes fetched after it; anything
+      // else is someone else's and is dropped. A row of own bytes
+      // (__RK_OWN_WRITE) is newer than any authority revision by construction
+      // and is kept — read-your-writes survives a peer's mutation of the same
+      // path, and the report is adjudicated when the write's own revision
+      // arrives (the shims note it for the ledger before admitting).
+      // A subtree-scoped or structural entry covers every row at or under its
+      // path, each judged the same way: something beneath it this facet may
+      // not see changed, or the directory went, or who may enter it did. A
+      // row there may be stale, or no longer this facet's to be served.
+      if (entry.subtree || entry.structural) {
+        const end = __residentPrefixEnd(path + "/");
+        for (const row of t.fileRevsIn(path + "/", end)) {
+          const stamped = Number(row.rev);
+          if (stamped === __RK_OWN_WRITE || stamped >= Number(entry.rev)) continue;
+          t.chunkDelete(row.path);
+          t.fileDelete(row.path);
+          dropped.push(String(row.path));
+        }
+        for (const [heldPath, heldCell] of [...__residentHeld]) {
+          if (!heldPath.startsWith(path + "/") || heldCell.rev === __RK_OWN_WRITE || heldCell.rev >= Number(entry.rev)) continue;
+          __residentForgetHeld(heldPath);
+        }
+        // Names under it may have become hidden or visible without being
+        // named: the namespace relists that subtree.
+        if (namespaced && entry.subtree && entry.stat && entry.stat.type === "directory") relist.push(path);
+      }
+      let held = false, stamped = 0, heldKey = null;
+      const row = t.fileRevKey(path);
+      if (row !== undefined) {
+        held = true; stamped = Number(row.rev); heldKey = row.ckey == null ? null : String(row.ckey);
+      }
+      if (held && (stamped === __RK_OWN_WRITE || stamped >= Number(entry.rev))) { kept++; continue; }
+      // A cell held in memory (an own write the store had no room for) is
+      // judged the same way; superseded, it goes, and the report's bytes, if
+      // any, are held as the store can.
+      const heldCell = __residentHeld.get(path);
+      if (heldCell !== undefined) {
+        if (heldCell.rev === __RK_OWN_WRITE || heldCell.rev >= Number(entry.rev)) { kept++; continue; }
+        __residentForgetHeld(path);
+      }
+      // The same bytes under a newer revision (a chmod, a touch, a rewrite
+      // with identical content): kept, and dated at the report.
+      if (held && heldKey !== null && entry.contentKey != null && heldKey === String(entry.contentKey)) {
+        t.fileSetRev(path, Number(entry.rev));
+        kept++;
+        continue;
+      }
+      // Pushed content: the file's bytes at the answer's revision, so dating
+      // them at the path's own revision cannot be newer than they are.
+      if (entry.bytes != null && entry.stat && entry.stat.type === "file") {
+        if (__residentPut(t, path, __residentBytes(entry.bytes), Number(entry.rev), entry.contentKey)) pushed++;
+        else if (held) dropped.push(path);
+        continue;
       }
       if (!held) continue;
-      if (stamped === __RK_OWN_WRITE || stamped >= Number(entry.rev)) continue;
-      sql.exec("DELETE FROM chunk WHERE path = ?", path);
-      sql.exec("DELETE FROM file WHERE path = ?", path);
+      t.chunkDelete(path);
+      t.fileDelete(path);
       dropped.push(path);
     }
   }
-  const epoch = result && result.epoch != null ? String(result.epoch) : null;
-  const rev = result && result.rev != null ? Number(result.rev) : null;
-  if (epoch === null || rev === null) {
-    throw new Error(
-      "Nimbus: fsAcquire returned no cursor; the resident store stays sealed " +
-      "rather than serving rows it cannot date"
-    );
-  }
-  __residentWriteCursor(sql, { epoch, rev });
+  __residentWriteCursor(t, { epoch, rev });
   __residentSealed = false;
   __residentSealReason = "";
-  return { dropped, cursor: { epoch, rev } };
+  return { dropped, kept, pushed, relist, cursor: { epoch, rev } };
+}
+
+/**
+ * Drop every row the authority dated, and nothing else: what a poison does to
+ * the rows when nothing can vouch for them. The cursor is left alone, because
+ * a store that holds no dated row cannot hold a stale one whatever its cursor
+ * says.
+ *
+ * This facet's own bytes are not the authority's to vouch for, and stay:
+ * dropping a row a write or mutation still in flight owns would hand the next
+ * fill the pre-write bytes. Its acknowledgement dates it, or evicts it, when
+ * it lands.
+ *
+ * Two statements rather than a delete per path: at pi scale that is 7,141
+ * rows, and this is on the hot path (measured 45 ms whole-store, vs a per-row
+ * walk).
+ */
+function __residentDropDated() {
+  if (!__residentReady) throw new Error("Nimbus: __residentDropDated before __residentBind");
+  __residentT.dropDated();
+  for (const [path, held] of [...__residentHeld]) if (held.rev !== __RK_OWN_WRITE) __residentForgetHeld(path);
 }
 
 /** Re-seal — for a store whose backing is being replaced (slot handover). */
@@ -443,13 +1106,7 @@ function __residentSeal(reason) {
 
 /** One row of 'file', or undefined. The existence/shape query. */
 function __residentHead(path) {
-  const sql = __residentRequire();
-  return __residentHeadOn(sql, path);
-}
-
-function __residentHeadOn(sql, path) {
-  for (const row of sql.exec("SELECT kind, size, chunks FROM file WHERE path = ?", path)) return row;
-  return undefined;
+  return __residentRequire().fileHead(path);
 }
 
 /**
@@ -461,22 +1118,28 @@ function __residentHeadOn(sql, path) {
  * is not held.
  */
 function __residentGet(path) {
+  if (globalThis.__nimbusProfileStaged) globalThis.__nimbusProfileStaged.delete(String(path).replace(/^\\/+/, ""));
   const head = __residentHead(path);
-  if (head === undefined) return undefined;
+  if (head === undefined) {
+    const held = __residentHeld.get(path);
+    if (held === undefined) return undefined;
+    __residentHeld.delete(path);
+    __residentHeld.set(path, held);
+    return held.cell;
+  }
   const kind = Number(head.kind);
   if (kind === __RK_DENIED) return { error: "EACCES" };
-  const sql = __residentRequire();
+  const t = __residentRequire();
   const chunks = Number(head.chunks);
   if (chunks === 1) {
-    for (const row of sql.exec("SELECT txt, bin FROM chunk WHERE path = ? AND part = 0", path)) {
-      return kind === __RK_TEXT ? row.txt : __residentBytes(row.bin);
-    }
-    return undefined;
+    const row = t.chunkFirst(path);
+    if (row === undefined) return undefined;
+    return kind === __RK_TEXT ? row.txt : __residentBytes(row.bin);
   }
   // Chunked: a file past the single-value ceiling. Reassembled here so callers
   // never learn the file was split.
   const parts = [];
-  for (const row of sql.exec("SELECT txt, bin FROM chunk WHERE path = ? ORDER BY part", path)) {
+  for (const row of t.chunkParts(path)) {
     parts.push(kind === __RK_TEXT ? row.txt : __residentBytes(row.bin));
   }
   if (parts.length === 0) return undefined;
@@ -503,15 +1166,14 @@ function __residentBytes(value) {
  * (read-your-writes) and never mistaken for something the authority vouched
  * for. There is no third case: the column refuses one.
  */
-function __residentPut(sql, path, cell, rev) {
-  sql.exec("DELETE FROM chunk WHERE path = ?", path);
+function __residentPut(t, path, cell, rev, ckey) {
+  // Whatever this puts supersedes a held cell, held or not.
+  __residentForgetHeld(path);
+  t.chunkDelete(path);
   const stamp = typeof rev === "number" ? rev : __RK_OWN_WRITE;
   if (cell && typeof cell === "object" && cell.error) {
-    sql.exec(
-      "INSERT OR REPLACE INTO file (path, kind, size, chunks, rev) VALUES (?, ?, 0, 0, ?)",
-      path, __RK_DENIED, stamp
-    );
-    return;
+    t.filePut(path, __RK_DENIED, 0, 0, stamp, null);
+    return true;
   }
   const isText = typeof cell === "string";
   const kind = isText ? __RK_TEXT : __RK_BINARY;
@@ -521,20 +1183,26 @@ function __residentPut(sql, path, cell, rev) {
   // multi-byte string would otherwise cross it while measuring short.
   const limit = isText ? Math.floor(__RESIDENT_CHUNK_BYTES / 3) : __RESIDENT_CHUNK_BYTES;
   const chunks = Math.max(1, Math.ceil(size / limit));
+  // Not admitted: nothing is held for the path (its old bytes are gone above).
+  if (!__residentFits(__residentCellCost(cell), stamp !== __RK_OWN_WRITE)) {
+    t.fileDelete(path);
+    if (stamp === __RK_OWN_WRITE) __residentHold(path, cell);
+    return false;
+  }
   for (let part = 0; part < chunks; part++) {
     const slice = body.slice(part * limit, (part + 1) * limit);
-    if (isText) sql.exec("INSERT INTO chunk (path, part, txt) VALUES (?, ?, ?)", path, part, slice);
-    else sql.exec("INSERT INTO chunk (path, part, bin) VALUES (?, ?, ?)", path, part, slice);
+    if (isText) t.chunkAddText(path, part, slice);
+    else t.chunkAddBin(path, part, slice);
   }
-  sql.exec(
-    "INSERT OR REPLACE INTO file (path, kind, size, chunks, rev) VALUES (?, ?, ?, ?, ?)",
-    path, kind, size, chunks, stamp
-  );
+  t.filePut(path, kind, size, chunks, stamp, stamp === __RK_OWN_WRITE || ckey == null ? null : String(ckey));
+  return true;
 }
 
 /** One chunk row, written as it arrives. The streaming filler's primitive. */
-function __residentPutChunk(sql, path, part, bytes) {
-  sql.exec("INSERT OR REPLACE INTO chunk (path, part, bin) VALUES (?, ?, ?)", path, part, bytes);
+function __residentPutChunk(t, path, part, bytes) {
+  if (!__residentFits(Math.ceil(bytes.byteLength * 1.01) + __RESIDENT_ROW_BYTES + 4096)) return false;
+  t.chunkSetBin(path, part, bytes);
+  return true;
 }
 
 /**
@@ -546,63 +1214,125 @@ function __residentPutChunk(sql, path, part, bytes) {
  * a large file leaves chunks nothing can read, never a short file something
  * can. Writing the head first would invert that into a truncated read.
  */
-function __residentPutHead(sql, path, kind, size, chunks, rev) {
-  sql.exec(
-    "INSERT OR REPLACE INTO file (path, kind, size, chunks, rev) VALUES (?, ?, ?, ?, ?)",
-    path, kind, size, chunks, typeof rev === "number" ? rev : __RK_OWN_WRITE
+function __residentPutHead(t, path, kind, size, chunks, rev, ckey) {
+  t.filePut(
+    path, kind, size, chunks, typeof rev === "number" ? rev : __RK_OWN_WRITE,
+    typeof rev === "number" && ckey != null ? String(ckey) : null,
   );
 }
 
-function __residentDelete(sql, path) {
-  const had = __residentHead(path) !== undefined;
-  sql.exec("DELETE FROM chunk WHERE path = ?", path);
-  sql.exec("DELETE FROM file WHERE path = ?", path);
+/**
+ * Hold \`path\` with the bytes of a dated row whose content identity is
+ * \`ckey\`, by copying rows inside this store: equal keys are equal bytes, so
+ * no fetch is needed. Returns whether a source existed.
+ */
+function __residentCopyByKey(t, path, ckey, rev) {
+  const source = t.fileByKey(String(ckey), path);
+  if (source === undefined) return false;
+  if (!__residentFits(Number(source.size) + (Number(source.chunks) + 1) * __RESIDENT_ROW_BYTES)) return false;
+  t.chunkDelete(path);
+  t.chunkCopy(path, String(source.path));
+  t.filePut(path, Number(source.kind), Number(source.size), Number(source.chunks), rev, String(ckey));
+  return true;
+}
+
+function __residentDelete(t, path) {
+  const had = __residentHead(path) !== undefined || __residentHeld.has(path);
+  __residentForgetHeld(path);
+  t.chunkDelete(path);
+  t.fileDelete(path);
   return had;
 }
 
 /**
- * The filler's door: write a cell whose provenance is the authority revision it
- * was read at. Legal while SEALED, because populating is exactly what a sealed
- * store is for — the seal stops READS of undated rows, not the writes that date
- * them.
+ * What a row is dated at: its revision, __RK_OWN_WRITE for this facet's own
+ * unacknowledged bytes, or undefined when the path is not held.
  */
-function __residentPopulate(path, cell, rev) {
-  if (!__residentReady) throw new Error("Nimbus: __residentPopulate before __residentBind");
-  if (typeof rev !== "number") {
-    throw new Error(
-      "Nimbus: refusing to populate '" + path + "' with no authority revision. " +
-      "An undated row cannot be invalidated, so it would be served stale forever."
-    );
-  }
-  __residentPut(__residentSql, path, cell, rev);
+function __residentProvenance(path) {
+  return __residentRequire().fileRev(path);
 }
 
 /**
- * The revision a cell is known-good at — the same stamp __vfsBundleRevisions
- * held in heap, moved into the row it describes so the two cannot drift. Only
- * a flush of this facet's own bytes sets one; the ACQUIRE barrier is the only
- * reader; an unstamped cell is simply evicted. Preserved verbatim from
- * _shared/vfs-write-ledger.ts, because a store that dropped it would make every
- * flush evict the facet's own output.
+ * Date this facet's own bytes with the revision the authority acknowledged
+ * them at: the revision a flushed write produced, or the one an own mutation's
+ * receipt settles on. The store's half of the stamp \`__vfsBundleRevisions\`
+ * carries in heap (_shared/vfs-write-ledger.ts), kept in the row it describes
+ * so the two cannot drift.
+ *
+ * Only a row still holding own bytes is dated. One that was dropped or
+ * replaced meanwhile holds something this acknowledgement says nothing about.
+ *
+ * Without it nothing dates an own row, and __RK_OWN_WRITE is the revision a
+ * delta never evicts: a file this process wrote would serve its own bytes over
+ * every later write to it by anyone.
  */
 function __residentStamp(path, rev) {
-  __residentSql.exec("UPDATE file SET rev = ? WHERE path = ?", rev, path);
+  const heldCell = __residentHeld.get(path);
+  if (heldCell !== undefined && heldCell.rev === __RK_OWN_WRITE) heldCell.rev = rev;
+  const t = __residentRequire();
+  const size = t.fileOwnSize(path);
+  if (size === undefined) return;
+  t.fileStampOwn(path, rev);
+  __nsNoteOwnFile(path, size, rev);
+}
+
+/**
+ * Hold a dated row as this facet's own for the window of one of its own
+ * mutations (a ranged write, a truncate, a chmod), and return the revision it
+ * was dated at: the mutation's receipt is judged against it when the window
+ * closes (\`__nimbusEndOwnMutation\`). Undefined when there is no dated row —
+ * an own row is held already, and an absent one has nothing to protect.
+ *
+ * The hold is what keeps a barrier that reports the mutation before its own
+ * response arrives from evicting the cell the mutation is about to overlay.
+ * The supervisor answers fsAcquire at once, while a write's response waits on
+ * the Durable Object's output gate, so that ordering is ordinary.
+ */
+function __residentLease(path) {
+  const t = __residentRequire();
+  const rev = t.fileRev(path);
+  if (rev === undefined || rev === __RK_OWN_WRITE) return undefined;
+  t.fileSetRev(path, __RK_OWN_WRITE);
+  return rev;
 }
 
-function __residentRevision(path) {
-  const sql = __residentRequire();
-  for (const row of sql.exec("SELECT rev FROM file WHERE path = ?", path)) {
-    const rev = Number(row.rev);
-    return rev === __RK_OWN_WRITE ? undefined : rev;
+/**
+ * Install bytes a live read returned, dated \`rev\`: the cursor the read was
+ * issued under, so the bytes hold every mutation at or below it. An async read
+ * must write through, or the next synchronous read goes back in time relative
+ * to what the program was just handed (protocol §5.9).
+ *
+ * Refused over a row of own bytes, which are newer than anything a read can
+ * return, and over a row dated after \`rev\`, which is newer than this read can
+ * vouch for. Returns whether the bytes were installed.
+ */
+function __residentFill(path, cell, rev) {
+  if (typeof rev !== "number" || rev < 0) {
+    throw new Error(
+      "Nimbus: refusing to fill '" + path + "' with no authority revision. " +
+      "An undated row cannot be invalidated, so it would be served stale forever."
+    );
   }
-  return undefined;
+  const t = __residentRequire();
+  const held = t.fileRev(path);
+  if (held !== undefined && (held === __RK_OWN_WRITE || held > rev)) return false;
+  const heldCell = __residentHeld.get(path);
+  if (heldCell !== undefined && (heldCell.rev === __RK_OWN_WRITE || heldCell.rev > rev)) return false;
+  return __residentPut(t, path, cell, rev);
 }
 
 /** Every held path. Backs the Object.keys / for-in scans in the shims. */
 function __residentKeys() {
-  const out = [];
-  for (const row of __residentRequire().exec("SELECT path FROM file")) out.push(String(row.path));
-  return out;
+  return __residentRequire().fileAllPaths();
+}
+
+/**
+ * Every path held as this facet's own unacknowledged bytes: the rows a
+ * poison's repair keeps without a revision to vouch for them, whose reports
+ * the shims deliver to their owners (\`_settleSkippedReports\`).
+ */
+function __residentOwnPaths() {
+  return __residentRequire().fileOwnPaths();
 }
 
 /**
@@ -640,12 +1370,7 @@ function __residentPrefixEnd(prefix) {
 function __residentKeysUnder(prefix) {
   const from = String(prefix);
   const to = __residentPrefixEnd(from);
-  const out = [];
-  const rows = to === null
-    ? __residentRequire().exec("SELECT path FROM file WHERE path >= ?", from)
-    : __residentRequire().exec("SELECT path FROM file WHERE path >= ? AND path < ?", from, to);
-  for (const row of rows) out.push(String(row.path));
-  return out;
+  return __residentRequire().filePaths(from, to);
 }
 
 /**
@@ -657,11 +1382,310 @@ function __residentKeysUnder(prefix) {
 function __residentHasUnder(prefix) {
   const from = String(prefix);
   const to = __residentPrefixEnd(from);
-  const rows = to === null
-    ? __residentRequire().exec("SELECT path FROM file WHERE path >= ? LIMIT 1", from)
-    : __residentRequire().exec("SELECT path FROM file WHERE path >= ? AND path < ? LIMIT 1", from, to);
-  for (const _row of rows) return true;
-  return false;
+  return __residentRequire().fileAny(from, to);
+}
+
+// ── The namespace ───────────────────────────────────────────────────────────
+//
+// Every name the credential can see, exact at the store's cursor: filled from
+// a complete listing, then moved forward by each ACQUIRE delta, whose entries
+// carry the path's stat at the answer's revision (null when it is gone). A
+// change of presence or stat is always a logged mutation of that path, except
+// what vanishes beneath a removed or replaced directory, which the delta
+// application drops by subtree. So a synchronous stat, exists or readdir is
+// answered exactly, and an absent name is known to be absent.
+//
+// This table holds the AUTHORITY's view only. The process's own pending
+// structural effects are an overlay kept by the shims, retired once a barrier
+// begun after they settled has applied.
+
+const __NS_FILE = 0;
+const __NS_DIR = 1;
+const __NS_LINK = 2;
+/** Symlink hops before a resolution is ELOOP, as Linux's MAXSYMLINKS. */
+const __NS_MAX_HOPS = 40;
+/** Paths of every symlink in the table: resolution walks only past these. */
+let __nsLinks = new Set();
+/** The credential names are judged traversable for. */
+let __nsCred = null;
+
+function __nsSetCred(cred) { __nsCred = cred || null; }
+
+function __nsSplit(k) {
+  const i = k.lastIndexOf("/");
+  return i < 0 ? ["", k] : [k.slice(0, i), k.slice(i + 1)];
+}
+
+function __nsKindCode(type) {
+  return type === "directory" ? __NS_DIR : type === "symlink" ? __NS_LINK : __NS_FILE;
+}
+
+function __nsLoadLinks(t) {
+  __nsLinks = new Set();
+  for (const row of t.nsOfKind(__NS_LINK)) {
+    const parent = String(row.parent);
+    __nsLinks.add(parent ? parent + "/" + String(row.name) : String(row.name));
+  }
+}
+
+/** Whether the table describes the store's cursor. */
+function __nsReady() {
+  return __residentReady && !__residentSealed && __nsOk;
+}
+
+/** The persisted 'ns' flag, mirrored in heap because every stat asks it. */
+let __nsOk = false;
+/** Why the namespace stopped answering, while it does not: what a refused sync call names. */
+let __nsCause = "the process has not listed it yet";
+
+function __nsMarkReady(t, ready, cause) {
+  t.metaSet("ns", ready ? "1" : "0");
+  __nsOk = !!ready;
+  if (!ready) __nsCause = String(cause || "a change it could not follow");
+}
+
+/** Why the namespace is not answering (meaningful only while __nsReady() is false). */
+function __nsNotReadyCause() {
+  if (!__residentReady) return "the process's store is not bound";
+  if (__residentSealed) return __residentSealReason || "the store has not reconciled with the session";
+  return __nsCause;
+}
+
+/**
+ * Whether a stat from the authority describes its name: a type, and the
+ * mode, owner and group every permission check reads. One without them is
+ * no record. Stored, its missing fields would become zeros, a root-owned
+ * mode-0 file the authority never reported. The namespace then stops
+ * answering (as for a delta without stats) until a listing that does
+ * describe every name restores it.
+ */
+function __nsDescribes(stat) {
+  if (!stat || typeof stat.type !== "string") return false;
+  for (const field of ["mode", "uid", "gid"]) {
+    if (stat[field] === null || stat[field] === undefined || !Number.isInteger(Number(stat[field]))) return false;
+  }
+  return true;
+}
+
+function __nsPut(t, k, stat, rev, target) {
+  const [parent, name] = __nsSplit(k);
+  const kind = __nsKindCode(stat.type);
+  t.nsPut(
+    parent, name, kind, Number(stat.size) || 0, Number(stat.mode) || 0, Number(stat.uid) || 0,
+    Number(stat.gid) || 0, Number(stat.atime) || 0, Number(stat.mtime) || 0, Number(stat.ctime) || 0,
+    Number(stat.ino) || 0, Number(rev) || 0, kind === __NS_LINK ? String(target ?? "") : null,
+  );
+  if (kind === __NS_LINK) __nsLinks.add(k); else __nsLinks.delete(k);
+}
+
+// The authority operation may succeed while metadata cannot be cached.
+// nsPut has sealed the sync view on heap ENOSPC; preserve the async result.
+function __nsTryPut(t, k, stat, rev, target) {
+  try { __nsPut(t, k, stat, rev, target); return true; }
+  catch (error) {
+    if (__residentInHeap && error && error.code === "ENOSPC") return false;
+    throw error;
+  }
+}
+
+/** Delete everything beneath \`k\`, and \`k\` itself when \`self\`. */
+function __nsDeleteTree(t, k, self) {
+  if (k === "") {
+    t.nsClear();
+    __nsLinks = new Set();
+    return;
+  }
+  const prefix = k + "/";
+  const end = __residentPrefixEnd(prefix);
+  t.nsDeleteChildren(k);
+  t.nsDeleteParents(prefix, end);
+  if (self) {
+    const [parent, name] = __nsSplit(k);
+    t.nsDelete(parent, name);
+    __nsLinks.delete(k);
+  }
+  for (const link of __nsLinks) if (link.startsWith(prefix)) __nsLinks.delete(link);
+}
+
+/** The row at exactly \`k\` (no symlink resolution), or undefined. */
+function __nsRowAt(t, k) {
+  if (k === "") {
+    return { kind: __NS_DIR, size: 0, mode: 0o40755, uid: 0, gid: 0, atime: 0, mtime: 0, ctime: 0, ino: 1, rev: 0, target: null };
+  }
+  const [parent, name] = __nsSplit(k);
+  return t.nsGet(parent, name);
+}
+
+function __nsJoinTarget(linkPath, target) {
+  const t = String(target);
+  const parts = (t.startsWith("/") ? [] : __nsSplit(linkPath)[0].split("/").filter(Boolean));
+  for (const seg of t.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") parts.pop(); else parts.push(seg);
+  }
+  return parts.join("/");
+}
+
+/**
+ * Resolve \`k\` through the symlinks the namespace holds: { path, row } for the
+ * name it denotes, null when nothing is there, or "ELOOP". The leaf is
+ * followed only when \`followLeaf\`. Walks component by component only when a
+ * symlink sits on the path; otherwise it is one lookup.
+ */
+function __nsResolve(k, followLeaf) {
+  const t = __residentRequire();
+  let path = k;
+  for (let hops = 0; hops <= __NS_MAX_HOPS; hops++) {
+    let redirected = false;
+    if (__nsLinks.size > 0) {
+      const segs = path.split("/");
+      for (let i = 1; i <= segs.length; i++) {
+        const prefix = segs.slice(0, i).join("/");
+        if (!__nsLinks.has(prefix)) continue;
+        if (i === segs.length && !followLeaf) break;
+        const row = __nsRowAt(t, prefix);
+        if (!row || Number(row.kind) !== __NS_LINK) break;
+        const rest = segs.slice(i).join("/");
+        const target = __nsJoinTarget(prefix, row.target);
+        path = rest ? (target ? target + "/" + rest : rest) : target;
+        redirected = true;
+        break;
+      }
+    }
+    if (redirected) continue;
+    const row = __nsRowAt(t, path);
+    return row === undefined ? null : { path, row };
+  }
+  return "ELOOP";
+}
+
+/** The entries directly under directory \`k\` (already resolved): [{ name, kind }]. */
+function __nsChildren(k) {
+  return __residentRequire().nsChildren(k).map((row) => ({ name: String(row.name), kind: Number(row.kind) }));
+}
+
+/** Whether the credential may search directory \`row\` (POSIX x). */
+function __nsTraversable(row) {
+  const cred = __nsCred;
+  if (!row || Number(row.kind) !== __NS_DIR) return false;
+  const mode = Number(row.mode) & 0o777;
+  if (!cred) return true;
+  if (Number(cred.uid) === 0) return (mode & 0o111) !== 0;
+  const groups = Array.isArray(cred.groups) ? cred.groups.map(Number) : [];
+  const shift = Number(cred.uid) === Number(row.uid) ? 6
+    : (Number(cred.gid) === Number(row.gid) || groups.includes(Number(row.gid))) ? 3 : 0;
+  return ((mode >> shift) & 1) === 1;
+}
+
+/**
+ * Apply one delta entry that carries a stat. Returns a directory whose
+ * subtree must be relisted — one that just became searchable, whose
+ * descendants no delta names — or null.
+ */
+function __nsApplyEntry(t, entry) {
+  const k = String(entry.path).replace(/^\\/+/, "");
+  if (k === "") return null;
+  if (entry.stat === null) { __nsDeleteTree(t, k, true); return null; }
+  const before = __nsRowAt(t, k);
+  if (!__nsTryPut(t, k, entry.stat, entry.rev, entry.linkTarget)) return null;
+  const after = __nsRowAt(t, k);
+  if (Number(after.kind) !== __NS_DIR) { __nsDeleteTree(t, k, false); return null; }
+  const was = before !== undefined && __nsTraversable(before);
+  const now = __nsTraversable(after);
+  if (was && !now) __nsDeleteTree(t, k, false);
+  if (!was && now && before !== undefined) return k;
+  return null;
+}
+
+/**
+ * Bring the table to a complete listing: upsert what differs, delete what the
+ * listing no longer names. \`entries\` are VfsListEntry (path, stat, rev,
+ * linkTarget). Called once per enumeration, after its last page.
+ */
+function __nsReplace(t, entries) {
+  const listed = new Set();
+  for (const entry of entries) listed.add(String(entry.path).replace(/^\\/+/, ""));
+  // Remove stale rows before admitting replacements; do not transiently
+  // charge both versions of a complete namespace against the fixed cap.
+  for (const row of t.nsKeys()) {
+    const parent = String(row.parent);
+    const k = parent ? parent + "/" + String(row.name) : String(row.name);
+    if (!listed.has(k)) { t.nsDelete(parent, String(row.name)); __nsLinks.delete(k); }
+  }
+  // Free shrinking text before growing another surviving row; final-state
+  // admission must not depend on alphabetical replacement order.
+  if (__residentInHeap) {
+    for (const entry of entries) {
+      const k = String(entry.path).replace(/^\\/+/, "");
+      if (!k) continue;
+      const [parent, name] = __nsSplit(k);
+      const held = t.nsGet(parent, name);
+      if (held && __namespaceRowBytes(parent, name, held.target) > __namespaceRowBytes(parent, name, entry.linkTarget)) {
+        __nsPut(t, k, entry.stat, entry.rev, entry.linkTarget);
+      }
+    }
+  }
+  for (const entry of entries) {
+    const k = String(entry.path).replace(/^\\/+/, "");
+    if (k === "") continue;
+    listed.add(k);
+    const held = __nsRowAt(t, k);
+    const s = entry.stat;
+    if (held !== undefined
+      && Number(held.kind) === __nsKindCode(s.type) && Number(held.size) === Number(s.size)
+      && Number(held.mode) === Number(s.mode) && Number(held.uid) === Number(s.uid)
+      && Number(held.gid) === Number(s.gid) && Number(held.mtime) === Number(s.mtime)
+      && Number(held.ctime) === Number(s.ctime) && Number(held.ino) === Number(s.ino)
+      && Number(held.rev) === Number(entry.rev)
+      && (held.target ?? null) === (entry.linkTarget ?? null)) continue;
+    __nsPut(t, k, s, entry.rev, entry.linkTarget);
+  }
+}
+
+/**
+ * Record this facet's own acknowledged write in the namespace before the
+ * delta that reports it: a file it created is then listed at once. Only
+ * when the table has nothing as new, so an authority stat already applied at
+ * or past \`rev\` is never overwritten by this approximation; the delta that
+ * reports the write replaces it with the authority's stat.
+ */
+function __nsNoteOwnFile(k, size, rev) {
+  if (!__nsReady()) return;
+  const t = __residentT;
+  const held = __nsRowAt(t, k);
+  if (held !== undefined && Number(held.rev) >= rev) return;
+  const now = Date.now();
+  __nsTryPut(t, k, {
+    // A file the process created: its umask's mode, until the delta reports
+    // the authority's own stat for it.
+    type: "file", size, mode: held ? Number(held.mode) : 0o100666 & ~Number(__nsCred?.umask ?? 0o022),
+    uid: held ? Number(held.uid) : Number(__nsCred?.uid ?? 0),
+    gid: held ? Number(held.gid) : Number(__nsCred?.gid ?? 0),
+    atime: now, mtime: now, ctime: now, ino: held ? Number(held.ino) : 0,
+  }, rev, null);
+}
+
+/**
+ * Record what the authority just said of a name this process asked about (an
+ * async stat, read or accepted write): the sync view answers it at once,
+ * as it would after the delta that reports it. Dated at the store's cursor,
+ * so any row as new is kept, and the next delta naming the path replaces it
+ * with the authority's own dating. \`stat\` null: the authority said it is not
+ * there, and a row older than the cursor goes.
+ */
+function __nsNoteLiveStat(k, stat) {
+  if (!__nsReady()) return;
+  const cursor = __residentCursor();
+  if (cursor === null) return;
+  const t = __residentT;
+  const held = __nsRowAt(t, k);
+  if (held !== undefined && Number(held.rev) >= cursor.rev) return;
+  if (stat === null) {
+    if (held !== undefined) { const [parent, name] = __nsSplit(k); t.nsDelete(parent, name); __nsLinks.delete(k); }
+    return;
+  }
+  if (!__nsDescribes(stat)) return;
+  __nsTryPut(t, k, stat, cursor.rev, stat.linkTarget ?? stat.target ?? null);
 }
 
 /**
@@ -671,27 +1695,30 @@ function __residentHasUnder(prefix) {
  * next tenant a filesystem, and dropping the rows while leaving a cursor behind
  * would leave the store claiming to be current at a revision it holds nothing
  * from. Clearing the cursor forces the next incarnation through
- * \`__residentAdmit\` from scratch.
+ * \`__residentAdmit\` from scratch. \`__residentBoot\` clears the same way when a
+ * kept store cannot be reconciled.
  */
 function __residentClear() {
   if (!__residentReady) throw new Error("Nimbus: __residentClear before __residentBind");
-  const sql = __residentSql;
-  sql.exec("DELETE FROM chunk");
-  sql.exec("DELETE FROM file");
-  sql.exec("DELETE FROM meta");
-  __residentSeal("the store was cleared for slot reuse");
+  __residentT.clear();
+  // Held cells go with the rows, but for own writes still in flight.
+  for (const [path, held] of [...__residentHeld]) if (held.rev !== __RK_OWN_WRITE) __residentForgetHeld(path);
+  __nsLinks = new Set();
+  __nsOk = false;
+  __residentSeal("the store was cleared");
 }
 
 function __residentStats() {
   if (!__residentReady) throw new Error("Nimbus: __residentStats before __residentBind");
-  const sql = __residentSql;
-  let files = 0, bytes = 0;
-  for (const row of sql.exec("SELECT count(*) AS n, coalesce(sum(size), 0) AS b FROM file")) {
-    files = Number(row.n); bytes = Number(row.b);
-  }
+  const t = __residentT;
+  const counted = t.fileStats();
+  const files = counted === undefined ? 0 : Number(counted.n);
+  const bytes = counted === undefined ? 0 : Number(counted.b);
+  const names = t.nsCount();
   return {
-    files, bytes,
-    databaseSize: Number(sql.databaseSize ?? 0),
+    files, bytes, names,
+    namespace: __nsReady(),
+    databaseSize: t.databaseSize(),
     sealed: __residentSealed,
     undatedSnapshot: __residentUndated,
     cursor: __residentCursor(),
@@ -699,26 +1726,219 @@ function __residentStats() {
 }
 
 /**
- * Adopt the module map's bundle into the store — the first fill, and the one
- * that costs nothing extra, because those bytes are already in the facet.
+ * Make this incarnation's store servable before the program's first
+ * instruction. The one boot path the resident body takes.
  *
- * Idempotent per SLOT, not per process: a warm slot already holds these rows
- * and re-adopting would rewrite 45 MB to reach the same state. The cursor the
- * bundle was read at is the store's cursor after a cold adopt; on a warm slot
- * the PERSISTED cursor wins, because it describes what the rows actually are
- * and the module's cursor only describes what this spawn happened to stage.
+ * A COLD store — no persisted cursor — adopts this spawn's own snapshot, the
+ * module bundle dated at the cursor it was read at, and then fills the rest of
+ * the filesystem from the authority. Its rows are current as of the spawn
+ * whether or not the fill completes, which is all the protocol asks of a
+ * process's first block (§5.3); the first ACQUIRE's delta brings them the rest
+ * of the way.
+ *
+ * A KEPT store holds a PREVIOUS process's rows, dated against a cursor this
+ * incarnation has never applied. A durable application's facet is one: it
+ * keeps its \`app-slot-\` name across launches and its release never deletes
+ * storage, so every relaunch or re-drive of the application opens what its
+ * last process left. The rows are the asset — inside one supervisor
+ * incarnation a relaunch fetches what changed, not the filesystem; across two,
+ * whose revisions are unrelated, the reconcile rebuilds every dated row — and
+ * they are also arbitrarily old: only the reconcile says which of them still
+ * describe the filesystem, and nothing else runs before the program's first
+ * synchronous reads. So the store stays SEALED through the reconcile, and a
+ * reconcile that cannot vouch for its rows — the listing failed, came back
+ * short, or there is no supervisor to ask — does not open it. The kept store
+ * is emptied instead and this launch boots exactly as a cold one does: the
+ * rare failure costs a relaunch its speedup, never a stale byte.
+ *
+ * The previous process's own unacknowledged rows are the one thing the
+ * reconcile cannot judge, since it keeps own rows whatever the listing says.
+ * \`__residentBind\` drops them before any of this runs.
+ *
+ * \`takeBundle\` hands over the module bundle and drops the module's own
+ * reference to it. The parsed bundle is the largest allocation in the facet
+ * before the program starts, so a cold boot releases it the moment it is
+ * adopted, and a kept store that reconciles never adopts it at all.
+ *
+ * Returns the cursor to publish and, when the boot fell short of the whole
+ * filesystem, why.
+ */
+async function __residentBoot(takeBundle, moduleCursor, supervisor) {
+  if (!__residentReady) throw new Error("Nimbus: __residentBoot before __residentBind");
+  let failure = null;
+  if (__residentCursor() !== null) {
+    let pass = null;
+    try { pass = await __residentSynchronizeFromSupervisor(supervisor); }
+    catch (e) { failure = (e && e.message) || String(e); }
+    if (pass && pass.cursor) return { cursor: await __residentCatchUp(supervisor, pass.cursor), failure: null };
+    failure = "a kept store could not be reconciled ("
+      + (failure || (pass && (pass.skipped || pass.incomplete)) || "the listing vouched for nothing")
+      + "); it was emptied and this launch booted from its own snapshot";
+  }
+  // A store with no cursor holds nothing any incarnation can date.
+  __residentClear();
+  const bundle = takeBundle();
+  // The module map is the program's code: it is held whole or the launch
+  // fails. Spawn admitted it (N18); this is room for it now, asked for when
+  // the store's cap does not already cover it.
+  let moduleBytes = 0;
+  for (const path of Object.keys(bundle || {})) moduleBytes += __residentCellCost(bundle[path]);
+  if (!(await __residentEnsureRoom(moduleBytes))) {
+    throw Object.assign(new Error(
+      "ENOSPC: workspace storage is full: this process's modules (" + Math.ceil(moduleBytes / 1048576)
+        + " MiB) do not fit in what is left of the session's storage"
+    ), { code: "ENOSPC" });
+  }
+  const adopted = __residentAdoptModuleBundle(bundle, moduleCursor);
+  // The pass that just failed is not retried. The store now holds what a
+  // cold launch whose fill failed holds, and its first ACQUIRE's delta
+  // brings it current the same way.
+  if (failure !== null) return { cursor: adopted, failure };
+  let pass = null;
+  try { pass = await __residentSynchronizeFromSupervisor(supervisor); }
+  catch (e) { failure = (e && e.message) || String(e); }
+  if (pass && pass.cursor) return { cursor: await __residentCatchUp(supervisor, pass.cursor), failure };
+  return { cursor: adopted, failure };
+}
+
+/**
+ * The acquire options this store asks for: stats with every delta entry, and
+ * the content of files changed under the push roots — the process's working
+ * tree and /tmp, where what a peer writes after launch is what it goes on to
+ * read (build output, manifests, temp files), less dependencies and VCS state.
+ */
+let __residentPushRoots = [];
+/** Dependencies and VCS state: written in bulk, read through the module map or not at all. */
+const __RESIDENT_PUSH_EXCLUDE = ["node_modules", ".git"];
+function __residentSetPushRoots(roots) {
+  __residentPushRoots = (Array.isArray(roots) ? roots : []).map((r) => String(r).replace(/^\\/+|\\/+$/g, ""));
+}
+/** Whether a changed file at \`path\` is one the push roots would carry. */
+function __residentPushable(path) {
+  for (const root of __residentPushRoots) {
+    if (root !== "" && path !== root && !path.startsWith(root + "/")) continue;
+    const rest = root === "" ? path : path.slice(root.length + 1);
+    if (!rest.split("/").some((seg) => __RESIDENT_PUSH_EXCLUDE.includes(seg))) return true;
+  }
+  return false;
+}
+function __residentAcquireOptions() {
+  return __residentPushRoots.length > 0
+    ? { namespace: true, push: { roots: __residentPushRoots, exclude: __RESIDENT_PUSH_EXCLUDE } }
+    : { namespace: true };
+}
+
+/**
+ * One delta from a listing's cursor, applied before the program runs. A
+ * listing's pages are walked at successive revisions, so the namespace it
+ * builds can mix states no single revision had (a rename seen on both sides
+ * or neither); the delta from its cursor names every path that moved during
+ * the walk, and leaves the table exact at the delta's revision. At boot there
+ * are no own writes, so nothing here needs the ledger's report notes.
+ */
+async function __residentCatchUp(supervisor, cursor) {
+  if (!supervisor || typeof supervisor.fsAcquire !== "function") return cursor;
+  let result;
+  try { result = await supervisor.fsAcquire(cursor.epoch, cursor.rev, __residentAcquireOptions()); }
+  catch { result = null; }
+  if (!result || result.poison || typeof result.rev !== "number" || typeof result.epoch !== "string") {
+    // Unanswered: the namespace keeps the listing's revision, which the
+    // program's first barrier brings forward like any other.
+    return cursor;
+  }
+  await __residentRoomForPushed(result);
+  const applied = __residentAdmit(result);
+  for (const dir of applied.relist) await __nsRelist(supervisor, dir);
+  // A dropped row was held, so it is wanted again at its new revision.
+  const refetch = [];
+  for (const path of applied.dropped) {
+    const found = __nsResolve(path, false);
+    if (!found || found === "ELOOP" || Number(found.row.kind) !== __NS_FILE) continue;
+    refetch.push({ path, size: Number(found.row.size), rev: Number(found.row.rev), epoch: applied.cursor.epoch });
+  }
+  if (refetch.length > 0) await __residentFetchFiles(supervisor, refetch);
+  return applied.cursor;
+}
+
+/**
+ * Re-read the names beneath \`dir\` from the authority: a directory that just
+ * became searchable, whose descendants no delta will ever name.
+ */
+async function __nsRelist(supervisor, dir) {
+  if (!supervisor || typeof supervisor.fsList !== "function") { __nsMarkReady(__residentT, false, "the session cannot list its filesystem"); return; }
+  const t = __residentT;
+  const prefix = dir + "/";
+  const seen = [];
+  let replaceBytes = 0;
+  let incomingBytes = 0;
+  if (__residentInHeap) {
+    for (const row of t.nsKeys()) {
+      const key = row.parent ? row.parent + "/" + row.name : row.name;
+      if (!key.startsWith(prefix)) continue;
+      replaceBytes += __namespaceRowBytes(row.parent, row.name, t.nsGet(row.parent, row.name)?.target);
+    }
+  }
+  let after = prefix;
+  let done = false;
+  for (let page = 0; page < __RESIDENT_MAX_LIST_PAGES && !done; page++) {
+    let listed;
+    try { listed = await supervisor.fsList(after, __RESIDENT_LIST_PAGE); }
+    catch (e) { __nsMarkReady(t, false, "a listing of /" + dir + " failed (" + ((e && e.message) || String(e)) + ")"); return; }
+    if (!listed || !Array.isArray(listed.entries)) { __nsMarkReady(t, false, "a listing of /" + dir + " came back without entries"); return; }
+    for (const entry of listed.entries) {
+      const k = String(entry.path).replace(/^\\/+/, "");
+      if (!k.startsWith(prefix)) {
+        if (k > prefix) { done = true; break; }
+        continue;
+      }
+      if (entry.stat) {
+        if (__residentInHeap && __residentCap !== null) {
+          const [parent, name] = __nsSplit(k);
+          incomingBytes += __namespaceRowBytes(parent, name, entry.linkTarget);
+          if (__residentDbBytes() - replaceBytes + incomingBytes > __residentCap) {
+            __nsMarkReady(t, false, "namespace storage budget exceeded (" + __residentCap + " bytes)");
+            return;
+          }
+        }
+        seen.push(entry);
+      }
+    }
+    if (listed.next === null || listed.next === undefined) done = true;
+    else after = listed.next;
+  }
+  if (!done) { __nsMarkReady(t, false, "a listing of /" + dir + " did not finish"); return; }
+  if (!seen.every((entry) => __nsDescribes(entry.stat))) { __nsMarkReady(t, false, "a listing of /" + dir + " named an entry without its stat"); return; }
+  // Exactly what the listing has under the directory: a name it no longer
+  // shows (hidden now, or gone) leaves, one it shows is written.
+  __nsDeleteTree(t, dir, false);
+  for (const entry of seen) __nsPut(t, String(entry.path).replace(/^\\/+/, ""), entry.stat, entry.rev, entry.linkTarget);
+}
+
+/**
+ * The launch's data plan (facets/data-plan.ts): the paths whose content a
+ * synchronous read may want, held from boot beside the module map. A launch
+ * with none (a re-entry by an inbound request) holds what it already had.
+ */
+let __residentPlan = new Set();
+function __residentSetPlan(paths) {
+  __residentPlan = new Set(Array.isArray(paths) ? paths.map((p) => String(p).replace(/^\\/+/, "")) : []);
+}
+
+/**
+ * Adopt the module map's bundle into an EMPTY store — the first fill, and the
+ * one that costs nothing extra, because those bytes are already in the facet.
+ * The cursor the bundle was read at becomes the store's.
  *
  * Returns the cursor the caller should publish, so there is one answer to
  * "what state does this facet cache" rather than two that can disagree.
  */
 function __residentAdoptModuleBundle(bundle, moduleCursor) {
   if (!__residentReady) throw new Error("Nimbus: __residentAdoptModuleBundle before __residentBind");
-  const persisted = __residentCursor();
-  if (persisted) {
-    // Warm slot. Its rows are already dated; do not touch them.
-    __residentSealed = false;
-    __residentSealReason = "";
-    return persisted;
+  if (__residentCursor() !== null) {
+    // Adopting over a kept store would re-date its rows at this spawn's
+    // cursor without checking one of them. __residentBoot reconciles a kept
+    // store, or empties it first.
+    throw new Error("Nimbus: a module bundle is adopted only into an empty store");
   }
   if (!moduleCursor || moduleCursor.epoch == null || moduleCursor.rev == null) {
     // An undated snapshot. Adopt NOTHING and serve an empty store.
@@ -741,7 +1961,7 @@ function __residentAdoptModuleBundle(bundle, moduleCursor) {
   }
   const rev = Number(moduleCursor.rev);
   for (const path of Object.keys(bundle || {})) {
-    __residentPut(__residentSql, path, bundle[path], rev);
+    __residentPut(__residentT, path, bundle[path], rev);
   }
   return __residentAdmit({ poison: false, paths: [], epoch: String(moduleCursor.epoch), rev }).cursor;
 }
@@ -750,13 +1970,12 @@ function __residentAdoptModuleBundle(bundle, moduleCursor) {
  * Enumerate the whole filesystem, one page at a time.
  *
  * WHAT EXISTS has to come from the authority, not from anything the facet was
- * shipped, and that was measured rather than assumed: for a working tree
- * holding a 25 MiB file outside the cwd, \`__MODULE_VFS_METADATA\` arrived with
- * FOUR entries — "home", "opt", "var", "home/user" — every one a directory.
- * Metadata covers the bundle plus ancestors; the manifest is per-directory
- * child names for the directories that happened to be walked. A store that
- * enumerated from either would hold only what the bundle already had, which is
- * the admission problem it exists to delete.
+ * shipped. That was measured rather than assumed: for a working tree holding a
+ * 25 MiB file outside the cwd, the spawn-time stat table this replaced arrived
+ * with FOUR entries ("home", "opt", "var", "home/user"), every one a
+ * directory. A launch ships only what it staged plus its ancestors; a store
+ * that enumerated from that would hold only what the bundle already had, which
+ * is the admission problem it exists to delete.
  *
  * Every page is dated, and a page whose epoch differs from the first ABORTS
  * the listing. The supervisor was replaced mid-walk, so the pages already
@@ -767,6 +1986,9 @@ function __residentAdoptModuleBundle(bundle, moduleCursor) {
  */
 async function __residentEnumerate(supervisor) {
   const entries = [];
+  // Every name, whatever its kind: the namespace is built from these.
+  const names = [];
+  let namespaceBytes = 0;
   let after = null;
   let cursor = null;
   for (let page = 0; page < __RESIDENT_MAX_LIST_PAGES; page++) {
@@ -777,13 +1999,26 @@ async function __residentEnumerate(supervisor) {
     if (cursor === null) {
       cursor = { epoch: String(listed.epoch), rev: Number(listed.rev) };
     } else if (String(listed.epoch) !== cursor.epoch) {
-      return { entries, cursor, complete: false, reason: "the supervisor changed incarnation mid-enumeration" };
+      return { entries, names, cursor, complete: false, reason: "the supervisor changed incarnation mid-enumeration" };
     }
     for (const entry of listed.entries) {
+      if (entry.stat) {
+        if (__residentInHeap && __residentCap !== null) {
+          const key = String(entry.path).replace(/^\\/+/, "");
+          const [parent, name] = __nsSplit(key);
+          if (key) namespaceBytes += __namespaceRowBytes(parent, name, entry.linkTarget);
+          if (__residentDbBytes() - __residentT.nsBytes() + namespaceBytes > __residentCap) {
+            const cause = "namespace storage budget exceeded (" + __residentCap + " bytes)";
+            __nsMarkReady(__residentT, false, cause);
+            throw Object.assign(new Error(cause), { code: "ENOSPC" });
+          }
+        }
+        names.push(entry);
+      }
       // Directories carry no content, and a symlink's size is its TARGET's
       // length rather than the resolved file's — reading one by that size
-      // would store a truncated file and call it whole. Both are left to fall
-      // through to the supervisor, which is a miss, never a wrong answer.
+      // would store a truncated file and call it whole. Content is fetched
+      // by the path a symlink resolves to.
       if (entry.kind !== "file") continue;
       const path = String(entry.path).replace(/^\\/+/, "");
       if (!path) continue;
@@ -795,14 +2030,14 @@ async function __residentEnumerate(supervisor) {
       if (!Number.isSafeInteger(size) || size < 0 || !Number.isSafeInteger(rev) || rev < 0) {
         throw new Error("Nimbus: fsList returned unusable metadata for '" + path + "'");
       }
-      entries.push({ path, size, rev, epoch: cursor.epoch });
+      entries.push({ path, size, rev, epoch: cursor.epoch, ckey: entry.contentKey == null ? null : String(entry.contentKey) });
     }
     if (listed.next === null || listed.next === undefined) {
-      return { entries, cursor, complete: true, reason: null };
+      return { entries, names, namespaceBytes, cursor, complete: true, reason: null };
     }
     after = listed.next;
   }
-  return { entries, cursor, complete: false, reason: "the filesystem exceeded the enumeration page bound" };
+  return { entries, names, cursor, complete: false, reason: "the filesystem exceeded the enumeration page bound" };
 }
 
 /**
@@ -834,6 +2069,23 @@ async function __residentEnumerate(supervisor) {
  * whose path moved at that same revision.
  */
 async function __residentFetchFiles(supervisor, files) {
+  // Content already held under another path, or wanted twice in this batch,
+  // is fetched once: equal keys are equal bytes (the second copy is local).
+  const t = __residentT;
+  const requested = files.length;
+  let copied = 0;
+  const wanted = [];
+  const later = [];
+  const fetching = new Set();
+  for (const file of files) {
+    if (file.ckey != null) {
+      if (__residentCopyByKey(t, file.path, file.ckey, file.rev)) { copied++; continue; }
+      if (fetching.has(file.ckey)) { later.push(file); continue; }
+      fetching.add(file.ckey);
+    }
+    wanted.push(file);
+  }
+  files = wanted;
   // One flat list of ranges across all files, so packing is a single pass and
   // a 25 MiB file and a 40-byte one are the same shape.
   const ranges = [];
@@ -850,6 +2102,7 @@ async function __residentFetchFiles(supervisor, files) {
         offset,
         length: Math.min(__RESIDENT_CHUNK_BYTES, Math.max(0, file.size - offset)),
         size: file.size,
+        ckey: file.ckey ?? null,
       });
     }
   }
@@ -872,6 +2125,12 @@ async function __residentFetchFiles(supervisor, files) {
       batch.push(ranges[at]);
       at++;
     }
+    // N18: room for the batch first; what the ledger will not admit is read
+    // through the session instead of held.
+    if (!(await __residentEnsureRoom(bytes + batch.length * __RESIDENT_ROW_BYTES))) {
+      for (const r of batch) failedPaths.add(r.path);
+      continue;
+    }
     let results;
     try {
       results = await supervisor.fsReadBatch(
@@ -890,7 +2149,7 @@ async function __residentFetchFiles(supervisor, files) {
         // path this store will not hold, and a read of it falls through to
         // exactly the miss it would have had before.
         if (entry && entry.error && entry.error.code === "EACCES" && range.part === 0) {
-          __residentPut(__residentSql, range.path, { error: "EACCES" }, range.rev);
+          __residentPut(t, range.path, { error: "EACCES" }, range.rev);
           filled++;
         } else failedPaths.add(range.path);
         continue;
@@ -899,11 +2158,11 @@ async function __residentFetchFiles(supervisor, files) {
       const chunk = __residentBytes(entry.bytes);
       if (chunk.byteLength !== range.length) { failedPaths.add(range.path); continue; }
       fetchedBytes += chunk.byteLength;
-      __residentPutChunk(__residentSql, range.path, range.part, chunk);
+      if (!__residentPutChunk(t, range.path, range.part, chunk)) { failedPaths.add(range.path); continue; }
       const seen = (landed.get(range.path) || 0) + 1;
       landed.set(range.path, seen);
       if (seen === range.parts && !failedPaths.has(range.path)) {
-        __residentPutHead(__residentSql, range.path, __RK_BINARY, range.size, range.parts, range.rev);
+        __residentPutHead(t, range.path, __RK_BINARY, range.size, range.parts, range.rev, range.ckey);
         filled++;
       }
     }
@@ -914,11 +2173,19 @@ async function __residentFetchFiles(supervisor, files) {
   // nothing will ever serve.
   for (const path of failedPaths) {
     failed++;
-    __residentSql.exec("DELETE FROM chunk WHERE path = ?", path);
-    __residentSql.exec("DELETE FROM file WHERE path = ?", path);
+    t.chunkDelete(path);
+    t.fileDelete(path);
   }
 
-  return { requested: files.length, filled, failed, bytes: fetchedBytes, ranges: ranges.length };
+  for (const file of later) {
+    if (__residentCopyByKey(t, file.path, file.ckey, file.rev)) copied++;
+    else failed++;
+  }
+  if (ranges.length > 0) await __residentReportSize();
+  return {
+    requested, filled: filled + copied, failed,
+    bytes: fetchedBytes, ranges: ranges.length, copied,
+  };
 }
 
 /**
@@ -963,9 +2230,16 @@ async function __residentFetchFiles(supervisor, files) {
  * had, and a poisoned caller has already taken its cold cache through
  * \`__residentAdmit\`.
  *
- * A row stamped __RK_OWN_WRITE is this facet's own unflushed write — newer
- * than anything the authority can report — and is kept whether listed or not,
- * the same read-your-writes rule the delta path applies.
+ * A row stamped __RK_OWN_WRITE is this facet's own unacknowledged bytes —
+ * newer than anything the authority can report — and is kept whether listed
+ * or not, the same read-your-writes rule the delta path applies. But the
+ * pass moves the cursor without a delta, so the report a delta would have
+ * carried for such a path is returned instead (\`own\`): the listed revision,
+ * or the listing's own cursor for a path it no longer lists, which bounds
+ * whatever removed it. The write or mutation that owns the row adjudicates it
+ * when its revision arrives, exactly as it does a delta's report. Across
+ * incarnations, or against a short listing, no report can be dated and each
+ * comes back null.
  *
  * Writes landing DURING the pass are covered the way they always were: the
  * published cursor is the one read BEFORE the walk, so they report revisions
@@ -994,12 +2268,13 @@ async function __residentSynchronizeFromSupervisor(supervisor) {
     return { requested: 0, filled: 0, failed: 0, skipped: "fsList reported no authority cursor" };
   }
 
-  const sql = __residentSql;
+  const t = __residentT;
   const held = __residentCursor();
   // May a row this pass cannot prove current be DROPPED? Only against a
   // complete enumeration: a truncated one cannot tell a path that was removed
   // from one that was never walked.
   const judgeable = listing.complete;
+  const describable = judgeable && listing.names.every((entry) => __nsDescribes(entry.stat));
   // May a held revision be COMPARED with a listed one? Only inside one
   // supervisor incarnation: across a restart the clocks are unrelated, and an
   // untouched path lists at rev 0, which would vouch for anything.
@@ -1009,44 +2284,103 @@ async function __residentSynchronizeFromSupervisor(supervisor) {
   for (const file of listing.entries) listed.set(file.path, file);
 
   const rows = [];
-  for (const row of sql.exec("SELECT path, rev FROM file")) {
-    rows.push({ path: String(row.path), rev: Number(row.rev) });
+  for (const row of t.fileRows()) {
+    rows.push({ path: String(row.path), rev: Number(row.rev), ckey: row.ckey == null ? null : String(row.ckey) });
   }
   const current = new Set();
   const dropped = [];
+  const own = [];
+  let rekeyed = 0;
   for (const row of rows) {
     const entry = listed.get(row.path);
-    const keep = row.rev === __RK_OWN_WRITE
-      || (comparable && entry !== undefined && row.rev >= entry.rev)
-      || !judgeable;
+    if (row.rev === __RK_OWN_WRITE) {
+      current.add(row.path);
+      own.push({
+        path: row.path,
+        rev: !comparable ? null : entry !== undefined ? entry.rev : listing.cursor.rev,
+      });
+      continue;
+    }
+    const keep = (comparable && entry !== undefined && row.rev >= entry.rev) || !judgeable;
     if (keep) { current.add(row.path); continue; }
+    // The listing names the same bytes (a revision moved, the content did
+    // not, or another epoch): kept and dated at the listing. Equal keys are
+    // equal bytes, so this needs no comparable clock.
+    if (entry !== undefined && row.ckey !== null && entry.ckey != null && row.ckey === entry.ckey) {
+      t.fileSetRev(row.path, entry.rev);
+      current.add(row.path);
+      rekeyed++;
+      continue;
+    }
     dropped.push(row.path);
   }
+  // Cells held in the heap (own writes the store had no room for) are judged
+  // as file rows are, on every path a file row is (N18). Undated, a write-back
+  // still in flight: newer than anything listed, it stays and is reported as
+  // own. Dated: kept only where the listing proves it current; otherwise it
+  // goes, and is fetched again like any dropped row, so a sync read of it is
+  // a miss rather than bytes the authority has replaced.
+  for (const [path, cell] of [...__residentHeld]) {
+    if (current.has(path)) continue;
+    const entry = listed.get(path);
+    if (cell.rev === __RK_OWN_WRITE) {
+      current.add(path);
+      own.push({ path, rev: !comparable ? null : entry !== undefined ? entry.rev : listing.cursor.rev });
+      continue;
+    }
+    if ((comparable && entry !== undefined && cell.rev >= entry.rev) || !judgeable) { current.add(path); continue; }
+    __residentForgetHeld(path);
+    dropped.push(path);
+  }
   // Sweep what could not be vouched for. When NOTHING could — a new supervisor
   // incarnation, whose revisions say nothing about ours — that is every row but
   // this facet's own unflushed writes, and at pi scale a per-path delete would
   // be ~32,000 statements in one turn against an object that has been observed
   // resetting under exactly that load. So it is a predicate there, and per path
   // where a reconcile has made the set small by construction.
-  if (dropped.length > 0 && !comparable) {
-    sql.exec("DELETE FROM chunk WHERE path IN (SELECT path FROM file WHERE rev <> ?)", __RK_OWN_WRITE);
-    sql.exec("DELETE FROM file WHERE rev <> ?", __RK_OWN_WRITE);
+  if (dropped.length > 0 && !comparable && rekeyed === 0) {
+    t.dropDatedFiles();
   } else {
     for (const path of dropped) {
-      sql.exec("DELETE FROM chunk WHERE path = ?", path);
-      sql.exec("DELETE FROM file WHERE path = ?", path);
+      t.chunkDelete(path);
+      t.fileDelete(path);
     }
   }
 
+  // What to hold: the launch's data plan, every row this pass had to drop as
+  // stale — it was held for a reason — and what the pushes a poison lost
+  // would have carried: files under the push roots changed since the cursor
+  // (all of them there, when the revisions are not comparable).
+  const plan = __residentPlan;
+  const wanted = new Set(dropped);
   const fetch = [];
-  for (const file of listing.entries) if (!current.has(file.path)) fetch.push(file);
-  const filled = await __residentFetchFiles(supervisor, fetch);
+  for (const file of listing.entries) {
+    if (current.has(file.path)) continue;
+    if (plan.has(file.path) || wanted.has(file.path)
+      || (__residentPushable(file.path) && (!comparable || file.rev > held.rev))) fetch.push(file);
+  }
+  // Reserve mandatory metadata growth while optional data is fetched, but
+  // retain the existing namespace publication order across the await.
+  const namespaceGrowth = __residentInHeap && describable ? Math.max(0, listing.namespaceBytes - t.nsBytes()) : 0;
+  if (__residentInHeap && __residentCap !== null && __residentDbBytes() + namespaceGrowth > __residentCap) {
+    const cause = "namespace storage budget exceeded (" + __residentCap + " bytes)";
+    __nsMarkReady(t, false, cause);
+    throw Object.assign(new Error(cause), { code: "ENOSPC" });
+  }
+  __residentNamespaceReserveBytes += namespaceGrowth;
+  let filled;
+  try { filled = await __residentFetchFiles(supervisor, fetch); }
+  finally { __residentNamespaceReserveBytes -= namespaceGrowth; }
 
   // The cursor may only advance to a state the rows actually describe, and
   // after a truncated listing they do not: a path in an unwalked page could
   // have moved since the held cursor and would never be reported again.
   if (judgeable) {
-    __residentWriteCursor(sql, listing.cursor);
+    // A listing that cannot describe every name restores the rows it vouches
+    // for and the cursor, but not the namespace (see __nsDescribes).
+    if (describable) __nsReplace(t, listing.names);
+    __residentWriteCursor(t, listing.cursor);
+    __nsMarkReady(t, describable, "the session's listing named an entry without its stat");
     __residentUndated = false;
     __residentSealed = false;
     __residentSealReason = "";
@@ -1059,7 +2393,9 @@ async function __residentSynchronizeFromSupervisor(supervisor) {
     bytes: filled.bytes,
     ranges: filled.ranges,
     kept: current.size,
+    rekeyed,
     dropped: dropped.length,
+    own,
     reconciled: comparable,
     complete: listing.complete,
     cursor: judgeable ? listing.cursor : null,
@@ -1067,6 +2403,45 @@ async function __residentSynchronizeFromSupervisor(supervisor) {
   };
 }
 
+/**
+ * Refetch, after a delta the store applied without a listing, what it should
+ * hold and does not: the paths the delta dropped and the launch's data plan.
+ * The namespace (current as of that delta) gives each one's size and
+ * revision, as a listing entry would.
+ */
+async function __residentRefillFromNamespace(supervisor, dropped) {
+  const t = __residentT;
+  const cursor = __residentCursor();
+  if (cursor === null) return { requested: 0, filled: 0, failed: 0, bytes: 0 };
+  const fetch = [];
+  const seen = new Set();
+  for (const path of [...dropped, ...__residentPlan]) {
+    if (seen.has(path)) continue;
+    seen.add(path);
+    if (__residentHead(path) !== undefined || __residentHeld.has(path)) continue;
+    const row = __nsRowAt(t, path);
+    if (row === undefined || Number(row.kind) !== __NS_FILE) continue;
+    fetch.push({ path, size: Number(row.size), rev: Number(row.rev), epoch: cursor.epoch, ckey: null });
+  }
+  return __residentFetchFiles(supervisor, fetch);
+}
+
+/**
+ * The launch's last step before user code: the namespace must answer, since
+ * every synchronous stat, exists and readdir reads it. A boot that left it
+ * unready (its listing failed, came back short, or could not describe every
+ * name) is repaired once more. Resolves to null when it answers, or to the
+ * launch's failure, naming why; nothing is ever run on a namespace that
+ * does not.
+ */
+async function __residentRequireNamespace(supervisor, bootFailure) {
+  if (__nsReady()) return null;
+  try { await __residentSynchronizeFromSupervisor(supervisor); } catch {}
+  if (__nsReady()) return null;
+  return "node: the process was not started: its view of the filesystem could not be listed ("
+    + __nsNotReadyCause() + (bootFailure ? "; " + bootFailure : "") + ")";
+}
+
 /**
  * The resident set, as the shims have always seen it.
  *
@@ -1079,7 +2454,7 @@ const __nimbusResidentBundle = new Proxy(Object.create(null), {
   },
   has(_t, path) {
     if (typeof path !== "string") return false;
-    return __residentHead(path) !== undefined;
+    return __residentHead(path) !== undefined || __residentHeld.has(path);
   },
   set(_t, path, cell) {
     // The program's own write, stamped __RK_OWN_WRITE: not the authority's