@nimbus-sh/worker 0.10.0 → 0.11.0

package/public/_assets/runtime/{node-shims-7b4dd7a76d95d21e.js → node-shims-06565b121555c194.js}

@@ -2,10 +2,37 @@
 // ═══════════════════════════════════════════════════════════════════════
 // ──  Format helper ──────────────────────────────────────────────────
 // ═══════════════════════════════════════════════════════════════════════
+function __isErrorValue(v) {
+  return v instanceof Error || Object.prototype.toString.call(v) === "[object Error]";
+}
+// Node's util.inspect(err); JSON.stringify drops non-enumerable name/message/stack.
+function __fmtError(e, seen) {
+  if (seen.has(e)) return "[Circular *]";
+  seen.add(e);
+  let text;
+  try { text = typeof e.stack === "string" && e.stack ? e.stack : Error.prototype.toString.call(e); }
+  catch { text = String(e); }
+  const fields = [];
+  for (const key of Object.keys(e)) {
+    if (key === "cause") continue;
+    let value;
+    try { value = e[key]; } catch { continue; }
+    fields.push(key + ": " + __fmtField(value, seen));
+  }
+  if (Object.prototype.hasOwnProperty.call(e, "cause")) fields.push("[cause]: " + __fmtField(e.cause, seen));
+  if (fields.length === 0) return text;
+  return text + " {\n" + fields.map((f) => "  " + f.split("\n").join("\n  ")).join(",\n") + "\n}";
+}
+function __fmtField(v, seen) {
+  if (typeof v === "string") return JSON.stringify(v);
+  if (v !== null && typeof v === "object" && __isErrorValue(v)) return __fmtError(v, seen);
+  return __fmt(v);
+}
 function __fmt(v) {
   if (v === null) return "null";
   if (v === undefined) return "undefined";
   if (typeof v === "object") {
+    if (__isErrorValue(v)) return __fmtError(v, new Set());
     try { return JSON.stringify(v); } catch { return String(v); }
   }
   return String(v);
@@ -58,6 +85,41 @@ async function __nimbusUseRpcResultUnref(promise, use) {
   finally { __nimbusDisposeRpcResult(value); }
 }
 
+/**
+ * The ACQUIRE barrier, taken before the program sees anything that arrived
+ * from outside it: a response or body from the network, a relayed socket
+ * frame, a request routed to one of its ports, a stdin packet or signal, a
+ * child's output or exit. Each of those can be the second half of a causal
+ * chain that began with a write somewhere else — `echo v2 > f; curl :3000`,
+ * a child that writes a file and then exits — and the handler's synchronous
+ * reads must see that write. Nothing but this barrier carries it.
+ *
+ * What the supervisor delivers — a request, a stdin packet, a child's output
+ * or exit — carries the answer to this barrier with it (`delivered`,
+ * session/rpc.ts _acquireOnDelivery), computed after the thing delivered was
+ * queued, so the barrier applies that answer instead of asking, and the
+ * program resumes with no round trip of its own. It asks when there is none
+ * or it cannot use the one delivered. A resumption the supervisor does not
+ * deliver — a timer, the network — always asks.
+ *
+ * The barrier is installed by the fs module, which is evaluated after this
+ * point; a facet with no supervisor has none and nothing to be coherent with.
+ */
+async function __nimbusInboundBarrier(delivered) {
+  const acquire = globalThis.__nimbusVfsAcquireBarrier;
+  if (typeof acquire === "function") await acquire(delivered);
+}
+
+/**
+ * The arguments this process asks its ACQUIRE with (the fs module's
+ * _acquireArgs), for a delivery to be answered from: a long poll sends them,
+ * and what it delivers comes back carrying fsAcquire's answer to them.
+ */
+function __nimbusVfsAcquireArgs() {
+  const args = globalThis.__nimbusVfsAcquireArgs;
+  return typeof args === "function" ? args() : undefined;
+}
+
 // ═══════════════════════════════════════════════════════════════════════
 // ──  Precompiled wasm ───────────────────────────────────────────────
 // A wasm image can only become a WebAssembly.Module through the Worker
@@ -287,13 +349,11 @@ function __nimbusWasmDigest(bytes) {
   // supervisor round trip per outbound request, not a hidden one. It is the
   // price of the guarantee.
   //
-  // The barriers live on globalThis because the fs module installs them and
-  // is evaluated after this one; a facet with no supervisor bound has none,
-  // and there is nothing to be coherent with.
+  // The RELEASE barrier lives on globalThis because the fs module installs it
+  // and is evaluated after this one; the ACQUIRE is __nimbusInboundBarrier.
   const __resumeCoherent = async (pending) => {
     const value = await pending;
-    const acquire = globalThis.__nimbusVfsAcquireBarrier;
-    if (typeof acquire === "function") await acquire();
+    await __nimbusInboundBarrier();
     return value;
   };
   const __barriered = async (input, init) => {
@@ -323,6 +383,15 @@ function __nimbusWasmDigest(bytes) {
 
 let __nimbusLiveStdinPump = null;
 let __nimbusProcessExitReported = false;
+// Set when the program has exited: its timers are cleared and its writes refused.
+let __nimbusProgramStopped = false;
+let __nimbusExitEmitted = false;
+// 'exit' listeners run once, synchronously, before the program is stopped.
+function __nimbusEmitExit(code) {
+  if (__nimbusExitEmitted) return;
+  __nimbusExitEmitted = true;
+  try { __processEvents.emit("exit", code); } catch {}
+}
 let __nimbusProcessExitResolve = null;
 let __nimbusProcessExitCode = null;
 const __nimbusProcessExitPromise = new Promise((resolve) => {
@@ -673,29 +742,205 @@ const __fsMod = (() => {
   // ── VFS bundle lookup (fast path — in-memory) ──
   function _bundleLookup(absPath) {
     const k = _strip(absPath);
-    if (__vfsBundle && k in __vfsBundle) return __vfsBundle[k];
-    // Also check writes
+    if (globalThis.__nimbusProfileStaged) globalThis.__nimbusProfileStaged.delete(k);
+    // The parked write first, as _writtenCell reads: it is this process's own,
+    // newer than anything the store holds, and it is the live cell (a store
+    // read reassembles a copy, which a write loop would pay for per write).
     if (__vfsWrites && k in __vfsWrites) return __vfsWrites[k];
+    if (__vfsBundle && k in __vfsBundle) return __vfsBundle[k];
+    // The same bytes under the name they are held by: through a symlink, or
+    // under the old name of a rename this process has not seen land yet.
+    if (__vfsBundle && _nsActive()) {
+      const real = _nsRealKey(k);
+      if (real !== null && real !== k && real in __vfsBundle) return __vfsBundle[real];
+    }
     return undefined;
   }
 
-  // __vfsMetadata is not declared in every embedding of these shims, so the
-  // one guarded reference lives here and every other reader goes through it.
-  function _metadataTable() {
-    return (typeof __vfsMetadata !== "undefined" && __vfsMetadata) ? __vfsMetadata : null;
-  }
-
-  // Same guard, same reason: the SQLite resident store is spliced into the
-  // resident-process body only. The one-shot exec path runs in a stateless
-  // loaded worker with no facet storage at all, so these shims must still work
-  // with the resident set on the heap and this is the single place that asks.
+  // Whether the store is bound: every embedding of these shims boots one (a
+  // facet's SQLite, or a one-shot's heap), and this is the single place that asks.
   function _residentStorePresent() {
     return typeof __residentAdmit === "function" && typeof __residentReady !== "undefined" && __residentReady;
   }
 
+  // ── The namespace (resident facets) ──
+  //
+  // A resident facet's store holds every name the credential can see, with
+  // its stat, exact at the cursor (vfs/facet-resident-store.ts). While it
+  // does, it answers every synchronous metadata question — stat, exists,
+  // readdir, realpath, access — and an absent name is known absent, so none
+  // of them records a miss or refuses. While it does not (a relist failed,
+  // until the next barrier repairs it), each of them is refused by name
+  // (_nsRequire).
+  //
+  // What the table cannot know is this process's own structural effects that
+  // the authority has not reported back yet, so those sit in an overlay, one
+  // entry per path: "absent" / "absentTree" (unlink, rmdir, rm), "dir"
+  // (mkdir; `hide` when nothing was there, so no stale child shows through)
+  // and "alias" (a rename: the new name denotes what the old one did). An
+  // entry retires once its mutation has settled AND a barrier begun after
+  // that has applied, because such a barrier's delta is answered after the
+  // mutation committed, so the table then shows it or anything later.
+  function _nsActive() {
+    return typeof __nsReady === "function" && __nsReady();
+  }
+  // The namespace answers every synchronous metadata question, or none. While
+  // it is not ready (a relist failed, until the next barrier repairs it) a
+  // synchronous call is refused, naming why and the asynchronous form that
+  // answers now. A launch never runs user code before it is ready.
+  function _nsRequire(syscall, displayPath, asyncForm) {
+    if (_nsActive()) return;
+    _stats.namespaceRefusals++;
+    const why = typeof __nsNotReadyCause === "function" ? __nsNotReadyCause() : "the process was started without one";
+    const err = _fsErr("EAGAIN", syscall, displayPath);
+    err.message = "EAGAIN: " + syscall + " '" + String(displayPath) + "': the namespace is being rebuilt after " + why
+      + (_supervisor() ? "; use " + asyncForm : "");
+    throw err;
+  }
+  const _nsOwn = new Map();
+  let _nsFresh = [];
+  let _barrierBegins = 0;
+  function _nsOwnSet(k, state, extra) {
+    const before = _nsOwn.get(k);
+    const entry = { state, from: extra?.from, hide: !!extra?.hide, settled: null };
+    try { __residentNamespaceOverlayDelta(_nsOwnCost(k, entry) - (before ? _nsOwnCost(k, before) : 0)); }
+    catch (error) {
+      // The view is sealed by the store. Let the already-projected structural
+      // operation reach its authority/ack; aborting midway would strand
+      // earlier overlays with no owning mutation to retire them.
+      if (__residentInHeap && error?.code === "ENOSPC") return;
+      throw error;
+    }
+    _nsOwn.set(k, entry);
+    _nsFresh.push(entry);
+  }
+  function _nsOwnCost(k, entry) { return __namespaceRowBytes("", k, entry.from); }
+  /** Hand the overlay entries made since the last mutation to the one being queued. */
+  function _nsTakeFresh() {
+    const mine = _nsFresh;
+    _nsFresh = [];
+    return () => { for (const entry of mine) if (entry.settled === null) entry.settled = _barrierBegins; };
+  }
+  function _nsRetire(begin) {
+    for (const [k, entry] of _nsOwn) if (entry.settled !== null && entry.settled < begin) {
+      _nsOwn.delete(k);
+      __residentNamespaceOverlayDelta(-_nsOwnCost(k, entry));
+    }
+  }
+
+  /**
+   * The overlay's word on `k`: "absent", { alias } (look the table up at
+   * this key instead), { dir } (own directory), { hide } (the table knows
+   * nothing under an own fresh directory), or null (ask the table).
+   */
+  function _nsOwnView(k) {
+    if (_nsOwn.size === 0) return null;
+    const own = _nsOwn.get(k);
+    if (own) {
+      if (own.state === "absent" || own.state === "absentTree") return "absent";
+      if (own.state === "alias") return { alias: own.from };
+      return { dir: true };
+    }
+    for (let i = k.lastIndexOf("/"); i > 0; i = k.lastIndexOf("/", i - 1)) {
+      const above = _nsOwn.get(k.slice(0, i));
+      if (!above) continue;
+      if (above.state === "absent" || above.state === "absentTree") return "absent";
+      if (above.state === "alias") return { alias: above.from + k.slice(i) };
+      if (above.hide) return { hide: true };
+    }
+    return null;
+  }
+
+  /** The table key `k` denotes (overlay and symlinks applied), or null. */
+  function _nsRealKey(k) {
+    const own = _nsOwnView(k);
+    if (own === "absent" || (own && (own.dir || own.hide))) return null;
+    const found = __nsResolve(own && own.alias !== undefined ? own.alias : k, true);
+    return found && found !== "ELOOP" ? found.path : null;
+  }
+
+  function _nsRowMeta(row) {
+    const kind = Number(row.kind);
+    return {
+      type: kind === 1 ? "directory" : kind === 2 ? "symlink" : "file",
+      size: Number(row.size), mode: Number(row.mode), uid: Number(row.uid), gid: Number(row.gid),
+      atime: Number(row.atime), mtime: Number(row.mtime), ctime: Number(row.ctime),
+    };
+  }
+
+  /**
+   * Everything the namespace says about `k`: a stat record, "absent", or
+   * "ELOOP". Own pending writes and directories first, then the overlay,
+   * then the table, then content this process wrote that the table has not
+   * caught up with.
+   */
+  function _nsMeta(k, follow) {
+    if (k === "") return _nsRowMeta(__nsResolve("", true).row);
+    if (__vfsWrites && k in __vfsWrites && _denialCode(__vfsWrites[k]) === null) {
+      const size = _byteLen(__vfsWrites[k]);
+      if (_createdHere.has(k)) {
+        return { type: "file", size, mode: 0o100666 & ~__processUmask, uid: cred.uid, gid: cred.gid, own: true };
+      }
+      // A rewrite of a file that was there: its owner and mode stay what the
+      // authority says they are.
+      const found = __nsResolve(k, follow);
+      if (found && found !== "ELOOP" && Number(found.row.kind) === 0) return { ..._nsRowMeta(found.row), size };
+    }
+    const own = _nsOwnView(k);
+    if (own === "absent") return "absent";
+    if (own && own.dir) return { type: "directory", size: 0, mode: 0o40777 & ~__processUmask, uid: cred.uid, gid: cred.gid, own: true };
+    // A directory this process made hides what the namespace held under its
+    // name before, but not what this process has put there since: those rows
+    // are its own writes, recorded when the authority accepted them.
+    if (!own || own.alias !== undefined || (own.hide && _createdHere.has(k))) {
+      const found = __nsResolve(own && own.alias !== undefined ? own.alias : k, follow);
+      if (found === "ELOOP") return "ELOOP";
+      if (found) return _nsRowMeta(found.row);
+    }
+    // The namespace is exact, so a name it lacks is not there, whatever bytes
+    // the module map carries under it (a file removed since the map was
+    // built). Content never stands in for metadata.
+    return "absent";
+  }
+
+  /** Names directly under directory `k`: Map name → type. */
+  function _nsList(k) {
+    const names = new Map();
+    const own = _nsOwnView(k);
+    if (own !== "absent" && !(own && own.hide) && !(own && own.dir && _nsOwn.get(k)?.hide)) {
+      const real = __nsResolve(own && own.alias !== undefined ? own.alias : k, true);
+      if (real && real !== "ELOOP") {
+        for (const child of __nsChildren(real.path)) {
+          names.set(child.name, child.kind === 1 ? "directory" : child.kind === 2 ? "symlink" : "file");
+        }
+      }
+    }
+    const prefix = k ? k + "/" : "";
+    if (__vfsWrites) {
+      for (const wk in __vfsWrites) {
+        if (!wk.startsWith(prefix)) continue;
+        const rest = wk.slice(prefix.length);
+        const slash = rest.indexOf("/");
+        if (rest) names.set(slash < 0 ? rest : rest.slice(0, slash), slash < 0 ? "file" : "directory");
+      }
+    }
+    for (const [ok, entry] of _nsOwn) {
+      if (!ok.startsWith(prefix) || ok.slice(prefix.length).includes("/")) continue;
+      const name = ok.slice(prefix.length);
+      if (entry.state === "absent" || entry.state === "absentTree") { if (!(__vfsWrites && ok in __vfsWrites)) names.delete(name); }
+      else if (entry.state === "dir") names.set(name, "directory");
+      else {
+        const meta = _nsMeta(ok, false);
+        if (meta !== "absent" && meta !== "ELOOP") names.set(name, meta.type);
+      }
+    }
+    return names;
+  }
+
   function _metadata(absPath) {
-    const table = _metadataTable();
-    return table ? table[_strip(absPath)] : undefined;
+    _nsRequire("stat", absPath, "fs.promises.stat");
+    const meta = _nsMeta(_strip(absPath), true);
+    return meta === "absent" || meta === "ELOOP" ? undefined : meta;
   }
 
   function _denialCode(cell) {
@@ -703,52 +948,13 @@ const __fsMod = (() => {
       typeof cell.error === "string" ? cell.error : null;
   }
 
-  // Removal retracts the path from the sync existence view — __vfsMetadata
-  // (spawn-time stat records) and __vfsManifest (directory shape). Without
-  // it, existsSync keeps reporting a file this process already deleted and
-  // the sync read path reports that file as merely non-resident.
+  // Removal retracts the path from the sync existence view: the namespace's
+  // overlay of this process's own effects says it is gone until a barrier's
+  // delta does.
   function _forgetSyncPath(k) {
+    _createdHere.delete(k);
     _announcedDirs.delete(k);
-    const metadata = _metadataTable();
-    if (metadata) delete metadata[k];
-    if (!__vfsManifest) return;
-    delete __vfsManifest[k];
-    const slash = k.lastIndexOf("/");
-    const parent = slash >= 0 ? k.slice(0, slash) : "";
-    const name = slash >= 0 ? k.slice(slash + 1) : k;
-    const siblings = __vfsManifest[parent];
-    if (!siblings) return;
-    const at = siblings.indexOf(name);
-    if (at !== -1) siblings.splice(at, 1);
-  }
-
-  /**
-   * Put a path into the sync EXISTENCE view — the inverse of _forgetSyncPath.
-   *
-   * A content cell is not existence. An invalidation drops content and is
-   * documented to leave the name behind so existsSync cannot fabricate an
-   * ENOENT for a file that was merely rewritten — but a file this process just
-   * created has no manifest entry and no spawn-time stat record, so its cell
-   * WAS the name, and evicting it retracted a file the program had written
-   * itself. Recording the name where every other name lives is what makes that
-   * documented asymmetry true.
-   *
-   * The parent's listing is the right home for it. Where the parent has no
-   * listing the entry is created only for a directory this process made, since
-   * that is the only case in which it knows the whole contents and calling the
-   * directory enumerated is honest.
-   */
-  function _announceSyncPath(k) {
-    if (!__vfsManifest || k === "") return;
-    const slash = k.lastIndexOf("/");
-    const parent = slash >= 0 ? k.slice(0, slash) : "";
-    const name = slash >= 0 ? k.slice(slash + 1) : k;
-    let siblings = __vfsManifest[parent];
-    if (!Array.isArray(siblings)) {
-      if (!__vfsDirs || !(parent in __vfsDirs)) return;
-      siblings = __vfsManifest[parent] = [];
-    }
-    if (siblings.indexOf(name) === -1) siblings.push(name);
+    _nsOwnSet(k, "absent");
   }
 
   /**
@@ -757,41 +963,67 @@ const __fsMod = (() => {
    * content carried. One place, because every sync mutation owes all three.
    */
   function _parkWrite(k, cell) {
+    _noteCreation(k);
     __vfsWrites[k] = cell;
     if (__vfsBundle) __vfsBundle[k] = cell;
     delete __vfsBundleRevisions[k];
-    _announceSyncPath(k);
+  }
+
+  /**
+   * The paths this process itself created, whose owner and mode are its own:
+   * its uid and gid, and what its umask leaves. Every other stat answer comes
+   * from the authority's metadata, and a path the authority never described
+   * is not given one. A stat invented from the reader's own credential made a
+   * root-owned file read as the reader's own and writable.
+   *
+   * A path counts as created when nothing was there before the write and the
+   * view KNOWS nothing was there. Unknown is not created: a file the process
+   * never staged may exist at the authority, owned by someone else.
+   */
+  const _createdHere = new Set();
+  function _noteCreation(k) {
+    if (_createdHere.has(k)) return;
+    const absPath = "/" + k;
+    // Known absent: the namespace names everything this credential can see.
+    if (_statLadder(absPath) !== undefined) return;
+    _createdHere.add(k);
+  }
+  function _forgetCreation(k) {
+    const prefix = k + "/";
+    for (const key of [..._createdHere]) if (key === k || key.startsWith(prefix)) _createdHere.delete(key);
   }
 
   function _forgetSyncTree(k) {
     const prefix = k + "/";
+    _forgetCreation(k);
+    _nsOwnSet(k, "absentTree");
     for (const dir of _announcedDirs) if (dir.startsWith(prefix)) _announcedDirs.delete(dir);
-    const metadata = _metadataTable();
-    if (metadata) {
-      for (const mk of Object.keys(metadata)) if (mk.startsWith(prefix)) delete metadata[mk];
-    }
-    if (__vfsManifest) {
-      for (const dk of Object.keys(__vfsManifest)) if (dk.startsWith(prefix)) delete __vfsManifest[dk];
-    }
     _forgetSyncPath(k);
   }
 
   /**
    * The honest error for a sync read the resident view cannot serve. A facet
    * has no synchronous I/O primitive, so a sync read is limited to content
-   * staged into this process — but the sync existence view (__vfsMetadata +
-   * __vfsManifest) knows far more paths than the content bundle carries.
-   * ENOENT is only correct when the path is unknown there too; for a path
-   * that demonstrably exists it sends the caller hunting for a missing file
-   * instead of awaiting the read that would return it.
+   * staged into this process, but the namespace names every path the
+   * credential can see. ENOENT is correct only when it names none; for a path
+   * that exists it would send the caller hunting for a missing file instead
+   * of awaiting the read that would return it.
    */
   function _notResidentError(absPath, displayPath, syscall, asyncForm) {
     const st = _statLadder(absPath);
-    if (st === undefined) {
-      if (!_absenceIsKnown(absPath)) _recordUnmapped(absPath, syscall);
-      return _fsErr("ENOENT", syscall, displayPath);
-    }
+    if (st === undefined) return _fsErr("ENOENT", syscall, displayPath);
     if (st.isDirectory()) return _fsErr("EISDIR", syscall, displayPath);
+    // Unreadable to this credential: the namespace's mode says so, and no
+    // bytes could have been staged for it.
+    if (!_modeAllows(st, 4)) return _fsErr("EACCES", syscall, displayPath);
+    if (typeof __residentStorageMiss === "function" && __residentStorageMiss(_strip(absPath))) {
+      // The process's own write, which neither its store nor its heap budget
+      // could hold: the workspace's storage is full.
+      const full = _fsErr("ENOSPC", syscall, displayPath);
+      full.message = "ENOSPC: workspace storage is full; '" + String(displayPath) + "' is readable asynchronously"
+        + (_supervisor() ? " (" + asyncForm + ")" : "");
+      return full;
+    }
     _recordResidencyMiss(absPath);
     const err = _fsErr("EAGAIN", syscall, displayPath);
     err.message += " — '" + String(displayPath) + "' exists but its content is not " +
@@ -925,7 +1157,9 @@ const __fsMod = (() => {
       let meta;
       // A thrown stat is the authority failing to answer, not an answer:
       // nothing is learned, and the miss stands.
-      try { meta = await __nimbusUseRpcResult(supervisor.stat(absPath), (r) => r); }
+      // Queued on the path: the program's own later mutations of it must not overtake the stat.
+      const observe = () => __nimbusUseRpcResult(supervisor.stat(absPath), (r) => r);
+      try { meta = await (_hasVfsMutationQueue() ? __nimbusQueueVfsMutation(absPath, observe, false) : observe()); }
       catch { return; }
       if (meta === null || meta === undefined) { _observedAbsent.add(k); return; }
       if (meta.type === "directory") return;
@@ -963,193 +1197,46 @@ const __fsMod = (() => {
     }
   };
 
-  /**
-   * Has this directory's content been enumerated, or merely mentioned?
-   *
-   * __vfsManifest is a walk of SELECTED roots — the cwd subtree, its
-   * node_modules, the entry script's own package — not of the filesystem. A
-   * directory with an entry there was listed by that walk, so its child list
-   * is complete and a name that is not in it is genuinely not there. A
-   * directory with no entry was never opened, and knows nothing. __vfsDirs
-   * holds the directories this process created itself, which it therefore
-   * knows the contents of by construction.
-   *
-   * Conflating the two is what let a synchronous readdir of a real directory
-   * outside the walk answer with an empty array — not an error, not a refusal,
-   * a positive assertion that a populated directory is empty. Every caller
-   * that used to end in "not found, so absent" goes through here first.
-   */
-  function _dirEnumerated(k) {
-    return (!!__vfsManifest && k in __vfsManifest) || (!!__vfsDirs && k in __vfsDirs);
-  }
 
-  /** Does the content bundle itself describe children under this directory? */
-  function _bundleHasChildren(k) {
-    if (!__vfsBundle) return false;
-    return __residentAnyUnder(k ? k + "/" : "");
-  }
 
-  /**
-   * Can the view say this path is ABSENT, as opposed to say nothing at all?
-   *
-   * With no supervisor bound there is no authority to be ignorant of: the
-   * staged tables ARE the filesystem, the async form reads out of those same
-   * tables, and a name that is not in them is not anywhere. Ignorance is a
-   * property of the gap between a process and an authority it cannot reach
-   * synchronously, so where there is no authority there is no gap.
-   */
-  function _absenceIsKnown(absPath) {
-    if (!_supervisor()) return true;
-    const k = _strip(absPath);
-    if (k === "") return true;
-    const segments = k.split("/");
-    // Deepest enumerated ancestor, because that is the only one that can
-    // testify. Walking up rather than looking only at the immediate parent is
-    // what makes a whole missing subtree answerable from one listing: if
-    // $HOME was enumerated and holds no .config, then nothing under .config
-    // is there either, and a program probing three levels down deserves that
-    // answer rather than three refusals.
-    for (let i = segments.length - 1; i >= 0; i--) {
-      const dir = segments.slice(0, i).join("/");
-      if (!_dirEnumerated(dir)) continue;
-      const child = segments.slice(0, i + 1).join("/");
-      const children = (__vfsManifest && __vfsManifest[dir]) || [];
-      const present = children.indexOf(segments[i]) !== -1
-        || (!!__vfsDirs && child in __vfsDirs)
-        || (!!__vfsBundle && child in __vfsBundle);
-      // The component is not in a directory that was listed: absent, and so is
-      // everything below it. If it IS there, only its own enumeration settles
-      // what it contains, so nothing short of the immediate parent will do.
-      if (!present) return true;
-      return i === segments.length - 1;
-    }
-    return false;
-  }
 
-  /**
-   * A path the sync view never mapped: record the ignorance, and repair it.
-   *
-   * Sibling of _notResidentError and the same bargain — the file may well be
-   * there, the process simply cannot look without blocking. The callers answer
-   * ENOENT, which is provisional rather than fabricated: this records the miss
-   * and pulls in the listing that settles the question, and the exit report
-   * reads the ledger. If the path was genuinely absent the repair proves it
-   * and the entry retires — the program's not-found branch was the right
-   * branch and it reached it through the right errno. If the path WAS there,
-   * the entry survives and the run is failed by name.
-   *
-   * EAGAIN was tried here and is the wrong answer to hand a program even
-   * though it is the honest description of the situation. It cannot arise from
-   * a real POSIX filesystem, so nothing branches on it, and the catch block
-   * that receives it was written for a missing file and rethrows instead:
-   * measured, create-next-app reads $HOME/.config/<tool>/config.json through
-   * the conf package, is handed EAGAIN for a file that was never there, and
-   * dies before writing one template file. Read a config, treat ENOENT as "no
-   * config yet", rethrow anything else is the near-universal shape. Refusing
-   * bought nothing the ledger was not already delivering, and cost every
-   * program that idiom.
-   *
-   * A LISTING is the exception and still refuses — see readdirSync. An array is
-   * a complete enumeration by definition, so there is no provisional form of
-   * it: an empty one asserts that a directory nothing ever opened is empty,
-   * which is how a scaffolder was told its template directory held nothing,
-   * wrote nothing, and exited 0.
-   */
-  function _recordUnmapped(absPath, syscall) {
-    const k = _strip(absPath);
-    _recordMiss(k);
-    // A listing wants the path's own contents; a read wants its bytes. Both
-    // also want the boundary listing, which is the only thing that can prove
-    // the path was not there — and fetching one repair and then the other
-    // would refuse the same access twice, once for being unmapped and once for
-    // having no resident content. _faultOnce collapses them where they meet.
-    _faultInBoundary(k);
-    if (syscall === "scandir") { _faultInDirectory(k); return; }
-    _faultIn(k);
-  }
 
-  /**
-   * The shallowest directory on this path whose contents the view does not
-   * know: the child of the deepest ancestor that WAS enumerated.
-   *
-   * That, not the immediate parent, is the listing a refusal has to pull in.
-   * For a path that is not there the parent is usually not there either, so
-   * its readdir fails, the view learns nothing, and the ledger keeps an entry
-   * no repair can ever retire — the run is failed over a file that was simply
-   * absent. The boundary directory is different: the enumerated ancestor's own
-   * listing already proved it is present, so it can be read, and reading it
-   * either names the next component or proves the whole subtree absent.
-   *
-   * With nothing enumerated at all the boundary is the root, which is one
-   * listing away from making the next level answerable.
-   */
-  function _unknownBoundary(k) {
-    const segments = k.split("/");
-    for (let i = segments.length - 1; i >= 0; i--) {
-      if (_dirEnumerated(segments.slice(0, i).join("/"))) {
-        return segments.slice(0, i + 1).join("/");
-      }
-    }
-    return "";
-  }
 
-  function _faultInBoundary(k) {
-    _faultInDirectory(_unknownBoundary(k));
-  }
 
-  /**
-   * The refusal, for the two callers that have no provisional answer to give.
-   *
-   * A listing cannot say "not found" usefully, and neither can a write that
-   * needs the prior content it is splicing onto. Everywhere else the sync view
-   * answers ENOENT and lets the exit report settle whether that was true; here
-   * there is no branch the program could take that would be right, so the
-   * honest EAGAIN is also the useful one.
-   */
-  function _refuseUnmapped(absPath, displayPath, syscall, asyncForm) {
-    _recordUnmapped(absPath, syscall);
-    const err = _fsErr("EAGAIN", syscall, displayPath);
-    err.message += " — '" + String(displayPath) + "' lies outside the filesystem view "
-      + "staged into the process, so a synchronous call cannot tell what is there, "
-      + "and synchronous I/O cannot block to find out"
-      + (_supervisor() ? "; " + asyncForm + " answers from the live filesystem" : "");
-    return err;
-  }
 
-  /**
-   * Pull a directory listing in. _readdirAsync already records what it learns
-   * into __vfsManifest, so one call both answers the fault and converges the
-   * sync view on the async one — there is no second merge path to keep honest.
-   */
-  function _faultInDirectory(k) {
-    if (!_supervisor() || _dirEnumerated(k) || !_faultOnce("listing", k)) return;
-    try { _repairs.push(_readdirAsync("/" + k, undefined).catch(() => {})); }
-    catch { /* speculative */ }
+
+
+  // What the authority says of a path after this process's own async request
+  // (a stat, read or accepted write) is what the sync view answers for it
+  // from then on, as it would after the delta that reports it
+  // (facet-resident-store's __nsNoteLiveStat).
+  //
+  // The lstat rides the read batch (_queueBatchRequest) rather than a call
+  // of its own: a resumption refetches every path it owes at once
+  // (_acquireAndRefetch), and a learn per path made that one lstat call per
+  // path — 1,601 in flight from one facet after a program wrote 1,600 files,
+  // some of which stayed pending and never reached the session
+  // (preview/new/lucide-barrel-cache-widens, measured 2026-09-28). Batched,
+  // the learns cost a round trip per batch, as the reads before them do.
+  async function _learnLive(absPath, supervisor) {
+    if (!supervisor || typeof supervisor.fsReadBatch !== "function") return;
+    let stat;
+    try { stat = await _queueBatchRequest(supervisor, { path: absPath, lstat: true }, 0); } catch { return; }
+    __nsNoteLiveStat(_strip(absPath), stat ?? null);
   }
 
   /**
-   * Retire the refusals a repair turned into honest absence.
-   *
-   * A refusal is only a wrong answer when the path was THERE and the process
-   * was denied it. Where the listing comes back and shows the name is simply
-   * not present, the program's not-found branch was the right branch all
-   * along — it merely reached it through the wrong errno — and failing the run
-   * over that would fail every module resolver, which probes dozens of paths
-   * that do not exist by design. So what stays in the ledger is exactly the
-   * harmful set: content that exists and was not served.
+   * Retire the misses a repair turned into honest absence. A miss is a wrong
+   * answer only when the path was THERE and the process was denied it: one on
+   * a name the namespace does not have (or the authority did not have when it
+   * was asked) was the program's not-found branch, taken for the right
+   * reason. Failing the run over those would fail every module resolver,
+   * which probes dozens of paths that do not exist by design.
    */
   function _settleProvenAbsences() {
     if (_residencyMisses.size === 0) return;
     for (const k of [..._residencyMisses]) {
-      const absPath = "/" + k;
-      // The authority did not have it when we asked, so nothing was withheld —
-      // whatever is at the path now, this process put there.
-      if (_observedAbsent.has(k)) { _residencyMisses.delete(k); continue; }
-      if (_statLadder(absPath) !== undefined) continue;
-      if (_absenceIsKnown(absPath)) { _residencyMisses.delete(k); continue; }
-      // Still unprovable, because the listing that would settle it lies below
-      // the one already fetched. Ask for the next one; the settle loop waits.
-      _faultInBoundary(k);
+      if (_observedAbsent.has(k) || (_nsActive() && _statLadder("/" + k) === undefined)) _residencyMisses.delete(k);
     }
   }
 
@@ -1218,6 +1305,10 @@ const __fsMod = (() => {
 
   const _localTimes = globalThis.__nimbusVfsTimes || (globalThis.__nimbusVfsTimes = Object.create(null));
   const _localModes = globalThis.__nimbusVfsModes || (globalThis.__nimbusVfsModes = Object.create(null));
+  // Modes set locally that the authority has not received yet. Delivered once:
+  // re-sending on every flush made each read of the path a chmod, which bumped
+  // its revision and evicted the process's own cell (create-astro EAGAIN).
+  const _pendingModes = globalThis.__nimbusVfsPendingModes || (globalThis.__nimbusVfsPendingModes = new Set());
 
   function _coerceMode(value, syscall, p) {
     const n = typeof value === "string" ? parseInt(value, 8) : Number(value);
@@ -1242,11 +1333,9 @@ const __fsMod = (() => {
       atimeMs: _coerceTimeMs(atime, syscall, p),
       mtimeMs: _coerceTimeMs(mtime, syscall, p),
     };
+    // The sync view answers these times ahead of the namespace's (_statObject)
+    // until the utimes is reported back, as a write's own bytes are.
     _localTimes[k] = time;
-    // A spawn-time stat record answers statSync ahead of _localTimes, so it
-    // must carry the new times too or the sync view keeps the old mtime.
-    const meta = _metadata(absPath);
-    if (meta) { meta.atime = time.atimeMs; meta.mtime = time.mtimeMs; }
     return time;
   }
 
@@ -1300,7 +1389,7 @@ const __fsMod = (() => {
   // ══ Cache coherence: ACQUIRE + read-through fill ═════════════════════
   //
   // The supervisor's SQLite VFS is the only authority. Everything in this
-  // facet — __vfsBundle, __vfsMetadata, __vfsManifest, __vfsDirs — is a
+  // facet — the resident store, __vfsBundle, __vfsDirs — is a
   // cache of it, and __vfsWrites is this process's own not-yet-flushed
   // mutations.
   //
@@ -1328,6 +1417,24 @@ const __fsMod = (() => {
   //             a frame arrives as a supervisor reply the same barrier
   //             rides on (see the relayed WebSocket below).
   //
+  // The supervisor's own deliveries are resumptions too. Each takes
+  // __nimbusInboundBarrier before the program sees it, and each carries the
+  // barrier's answer, computed by the supervisor after the thing delivered
+  // was queued (protocol §3's piggybacked inv), so the barrier applies it
+  // instead of asking and the delivery costs no round trip of its own:
+  //   - request: a request routed to one of the process's ports, in the
+  //             dispatch every resident's server shares (__nimbusServeHttp).
+  //             The supervisor starts it, so it holds no cursor of this
+  //             process's and answers "nothing since now", which stands in
+  //             only when no write preceded the request since this process
+  //             last caught up (protocol §9.2); otherwise the barrier asks.
+  //   - stdin:  a stdin packet — input, its end, a signal, a resize — for an
+  //             attached process (__makeProcessStdin's pump).
+  //   - child:  a spawned child's output and its exit (_runReadLoop,
+  //             _runWaitLoop).
+  // Stdin and child output are long polls, so they send this process's
+  // ACQUIRE arguments (_acquireArgs) and are answered from exactly those.
+  //
   // Keep this list empty. An entry here is a documented hole in the owner's
   // invariant, not a TODO: it means some process can be woken by something
   // this system does not mediate, and its next synchronous read can serve
@@ -1349,8 +1456,18 @@ const __fsMod = (() => {
   // envelope — there is no reason to invent a second surface for it.
   const _stats = globalThis.__nimbusVfsCoherence
     || (globalThis.__nimbusVfsCoherence = {
-      fills: 0, filledBytes: 0, invalidations: 0, poisons: 0,
+      fills: 0, filledBytes: 0, invalidations: 0, poisons: 0, pushes: 0,
       reconciles: 0, selfWrites: 0, misses: 0,
+      // ACQUIREs that got no answer (see _acquireBarrier), and the last reason.
+      barrierFailures: 0, lastBarrierFailure: "",
+      // Barriers that held their resumption on an own write's acknowledgement
+      // (_awaitReportedOwnWrites).
+      ownWriteWaits: 0,
+      // The namespace's failure state (a relist failed): synchronous calls
+      // refused with its cause (_nsRequire), and barriers that repaired it.
+      namespaceRefusals: 0, namespaceRepairs: 0,
+      // Repairs a delta from the store's durable floor answered, with no listing.
+      floorRepairs: 0,
     });
 
   /**
@@ -1383,8 +1500,6 @@ const __fsMod = (() => {
     let evicted = false;
     delete __vfsBundleRevisions[k];
     if (__vfsBundle && k in __vfsBundle) { delete __vfsBundle[k]; evicted = true; }
-    const metadata = _metadataTable();
-    if (metadata && k in metadata) { delete metadata[k]; evicted = true; }
     return evicted;
   }
 
@@ -1399,15 +1514,107 @@ const __fsMod = (() => {
   const _owedRefetch = new Set();
 
   // An own-mutation lease can end in an eviction (a peer wrote inside the
-  // window). The ledger owning that decision is spliced AHEAD of this
-  // closure, so it is handed the one eviction path rather than keeping a
-  // second copy of it: content view, stat view, the invalidation count and
-  // the refetch debt move together here or not at all.
-  globalThis.__nimbusEvictResidentCell = (k) => {
+  // window), and so can a flush whose revision a barrier's report outran.
+  // The ledger owning those decisions is spliced AHEAD of this closure, so it
+  // is handed the one eviction path rather than keeping a second copy of it:
+  // content view, stat view, the invalidation count and the refetch debt
+  // move together here or not at all.
+  function _evictOwed(k) {
     if (!_evictResident(k)) return;
     _stats.invalidations++;
     _owedRefetch.add(k);
-  };
+  }
+  globalThis.__nimbusEvictResidentCell = _evictOwed;
+
+  /**
+   * Live reads in flight, per path: each one's fill ticket, which carries
+   * the highest revision a barrier reported for the path while that read was
+   * outstanding.
+   *
+   * A barrier that reports a path nobody holds has nothing to evict and
+   * CONSUMES the report: the cursor moves past it and no later delta names it
+   * again. A read of that path already in flight may have been served before
+   * the mutation the report describes, and its bytes would then be installed
+   * behind the only message that could have evicted them. So the report is
+   * kept on the read until it lands, and the read installs only if nothing
+   * newer than its cursor was reported under it (_installResident).
+   *
+   * One ticket per read, not one per path: a read that begins after a report
+   * or a poison is judged only by what is reported after it began. Sharing the
+   * earlier read's record condemned the read issued to replace it.
+   */
+  const _fillReports = new Map();
+
+  /**
+   * Begin a live read of `k`: the cursor it is issued under — every mutation
+   * at or below it is already in the bytes it returns — and what has been
+   * reported against it since, nothing yet. Called after the read's barrier
+   * and before its RPC.
+   */
+  function _beginFill(k) {
+    const fill = { k, rev: _cursor.rev, reported: -1 };
+    let live = _fillReports.get(k);
+    if (!live) {
+      live = new Set();
+      _fillReports.set(k, live);
+    }
+    live.add(fill);
+    return fill;
+  }
+
+  function _endFill(fill) {
+    const live = _fillReports.get(fill.k);
+    if (!live) return;
+    live.delete(fill);
+    if (live.size === 0) _fillReports.delete(fill.k);
+  }
+
+  /** A barrier reported `k` at `rev`: remember it on every read of it in flight. */
+  function _noteFillReport(k, rev) {
+    const live = _fillReports.get(k);
+    if (live) for (const fill of live) if (rev > fill.reported) fill.reported = rev;
+  }
+
+  /**
+   * Note one delta entry on everything in flight that it covers: its path,
+   * or, for a subtree-scoped or structural entry, every path at or under it.
+   * The ledger does the same for this facet's own writes and mutations.
+   */
+  function _noteReport(entry) {
+    if (!entry.subtree && !entry.structural) {
+      __nimbusNoteVfsReport(entry.path, entry.rev);
+      _noteFillReport(entry.path, entry.rev);
+      return;
+    }
+    __nimbusNoteVfsReportUnder(entry.path, entry.rev);
+    const under = entry.path + "/";
+    for (const k of [..._fillReports.keys()]) {
+      if (k === entry.path || k.startsWith(under)) _noteFillReport(k, entry.rev);
+    }
+  }
+
+  /**
+   * The resident cells a delta entry covers: its path, or, for a
+   * subtree-scoped or structural entry, every cell at or under it. Such an
+   * entry stands for changes it does not name (a directory that went, one
+   * whose mode, owner or group changed, or something beneath it this facet
+   * may not see), so each cell there is judged as a named one would be.
+   */
+  function _coveredCells(entry) {
+    if (!entry.subtree && !entry.structural) return [entry.path];
+    const under = entry.path + "/";
+    const cells = new Set();
+    for (const table of [__vfsBundle, __vfsBundleRevisions]) {
+      if (!table) continue;
+      for (const k of Object.keys(table)) if (k === entry.path || k.startsWith(under)) cells.add(k);
+    }
+    return [...cells];
+  }
+
+  /** The cursor moved without a delta (a poison), so no read in flight can be dated. */
+  function _spoilFills() {
+    for (const live of _fillReports.values()) for (const fill of live) fill.reported = Infinity;
+  }
 
   /**
    * Install bytes the supervisor just served as the resident cell for a
@@ -1421,42 +1628,30 @@ const __fsMod = (() => {
    * returned, so it has nothing to invalidate. The bytes are already paid
    * for; caching them costs one map insert.
    *
+   * `fill` (_beginFill) dates them, and it is also the reason an install can
+   * be declined: a barrier that reported the path above the read's cursor
+   * while the read was in flight may describe a mutation the bytes predate,
+   * and that report is gone once consumed. Declining costs the next sync
+   * read a miss; installing would cost a stale byte nothing ever evicts.
+   *
    * The parent's manifest entry gains the name too, so the existence view
    * cannot go on denying a file whose bytes this process is holding.
    */
-  function _installResident(absPath, bytes) {
+  function _installResident(absPath, bytes, fill) {
     if (!__vfsBundle) return;
     const k = _strip(absPath);
     if (k === "") return;
+    if (fill.reported > fill.rev) return;
     // Never over a cell this facet owns.
     //
     // A pending write is strictly newer than anything the authority can
     // report, and __vfsBundle is what sync reads consult first, so installing
     // over it would serve the program bytes older than its own write.
-    //
-    // A STAMPED cell is this facet's own flushed write, and the barrier this
-    // read passed on the way in reported nobody else has touched the path
-    // since — so the bytes are already what is being installed, and the only
-    // thing the install would change is to drop the stamp. It did: a
-    // speculative repair issued by an earlier refused read landed after the
-    // flush, unstamped the cell, and the next ACQUIRE evicted the facet's own
-    // output. Measured at selfWrites 0 / invalidations 1 / fills 2 for one
-    // written file, against 1 / 0 / 0 with the repair absent.
     if (__vfsWrites && k in __vfsWrites) return;
-    if (__vfsBundleRevisions[k] !== undefined) return;
-    __vfsBundle[k] = bytes;
-    // Keep the stat view consistent with the bytes now held. Without this
-    // the content view is fresh while statSync still reports the
-    // spawn-time length, so a program can read N bytes and be told the
-    // file is M — an inconsistency introduced BY the fill. Only the size
-    // is corrected: type, mode, ownership and timestamps stay as the
-    // authority last reported them, so mtime-based change detection
-    // (make, tsc --build, watchers) does not see every read as a change.
-    const metadata = _metadataTable();
-    if (metadata && k in metadata) {
-      metadata[k] = { ...metadata[k], size: _byteLen(bytes) };
-    }
-    _announceSyncPath(k);
+    // The store dates the row at the read's cursor, so the next delta that
+    // names the path above it evicts it. It declines, itself, to replace own
+    // bytes or a row dated later than this read can vouch for.
+    if (!__residentFill(k, bytes, fill.rev)) return;
     _stats.fills++;
     _stats.filledBytes += _byteLen(bytes);
   }
@@ -1492,25 +1687,86 @@ const __fsMod = (() => {
     return _residentRepair;
   }
 
+  /**
+   * Set while the store holds only what a repair could NOT vouch for: rows it
+   * had to drop rather than prove current. Nothing but another repair brings
+   * those back — a delta names what changed, not what this facet lost — so
+   * every barrier repairs until one vouches, however the ACQUIRE is answered.
+   */
+  let _storeRepairOwed = false;
+
+  /**
+   * The repair's first try: the delta from the store's durable floor
+   * (__residentCursor), asked as every barrier asks it. True when it applied
+   * (the repair is done); false when a listing is needed after all.
+   */
+  async function _repairFromFloor(supervisor, result) {
+    if (!supervisor || typeof supervisor.fsAcquire !== "function" || !_nsActive()) return false;
+    if (result !== null && result.poison === true) return false;
+    const floor = __residentCursor();
+    if (floor === null || (result !== null && result.epoch !== floor.epoch)) return false;
+    let delta;
+    try {
+      delta = await __nimbusUseRpcResult(supervisor.fsAcquire(floor.epoch, floor.rev, { namespace: true }), (r) => r);
+    } catch { return false; }
+    if (!delta || delta.poison === true || typeof delta.rev !== "number" || delta.epoch !== floor.epoch) return false;
+    if (Array.isArray(delta.paths)) for (const entry of delta.paths) _noteReport(entry);
+    await __residentRoomForPushed(delta);
+    const applied = __residentAdmit(delta);
+    for (const dir of applied.relist) await __nsRelist(supervisor, dir);
+    if (!_nsActive()) return false;
+    _cursor.epoch = applied.cursor.epoch;
+    _cursor.rev = applied.cursor.rev;
+    _stats.invalidations += applied.dropped.length;
+    // What it should hold and lost (dropped by this delta, or by the barrier
+    // that could not vouch for its rows), refetched by the namespace's stats.
+    const refilled = await __residentRefillFromNamespace(supervisor, applied.dropped);
+    _stats.fills += refilled.filled;
+    _stats.filledBytes += refilled.bytes;
+    _stats.floorRepairs++;
+    _storeRepairOwed = false;
+    return true;
+  }
+
+  /**
+   * `result` is the ACQUIRE answer that asked for the repair: a poison, a
+   * delta arriving while a repair is owed, or null for a barrier that got no
+   * answer at all.
+   */
   async function _runResidentRepair(supervisor, result) {
+    // Within one epoch, with the change log intact and the namespace
+    // answering, the store's rows are dated through its own durable cursor, so
+    // the delta from there names everything that moved since. Only an epoch
+    // change, a poison (the log truncated past the cursor), or a namespace
+    // that stopped answering needs the listing.
+    if (await _repairFromFloor(supervisor, result)) return;
+    const ownAtStart = __residentOwnPaths();
     let repaired;
     try { repaired = await __residentSynchronizeFromSupervisor(supervisor); }
     catch { repaired = null; }
     if (!repaired || !repaired.cursor) {
       // The pass could not vouch for a single row — a supervisor replaced
-      // mid-enumeration, an enumeration that came back short. A row that
-      // cannot be dated must not be served, so the cold cache the poison asked
-      // for is taken after all, and the pass runs once more to repopulate what
-      // it just dropped.
-      __residentAdmit(result);
-      _cursor.epoch = result.epoch;
-      _cursor.rev = result.rev;
+      // mid-enumeration, an enumeration that came back short, an authority it
+      // could not reach. A row that cannot be dated must not be served, so the
+      // cold cache is taken after all, and the pass runs once more to
+      // repopulate what it just dropped. An answer with a cursor is admitted as
+      // it would have been; a barrier with no answer drops every dated row and
+      // keeps the cursor it had, which the next delta is still owed from.
+      if (result) {
+        __residentAdmit(result);
+        _cursor.epoch = result.epoch;
+        _cursor.rev = result.rev;
+      } else {
+        __residentDropDated();
+      }
       try { repaired = await __residentSynchronizeFromSupervisor(supervisor); }
       catch { repaired = null; }
     } else if (repaired.reconciled) {
       _stats.reconciles++;
     }
-    if (!repaired || !repaired.cursor) return;
+    _settleSkippedReports(ownAtStart, repaired);
+    _storeRepairOwed = !(repaired && repaired.cursor);
+    if (_storeRepairOwed) return;
     _cursor.epoch = repaired.cursor.epoch;
     _cursor.rev = repaired.cursor.rev;
     _stats.invalidations += repaired.dropped;
@@ -1518,6 +1774,41 @@ const __fsMod = (() => {
     _stats.filledBytes += repaired.bytes;
   }
 
+  /**
+   * Deliver the reports a repair moved the cursor over.
+   *
+   * A repair moves the cursor without a delta, so what a delta would have
+   * reported reaches nothing on its own. A dated row the pass kept is proven
+   * current by its listed revision and needs nothing more. A row of this
+   * facet's own bytes is kept whatever the listing says — and its report is
+   * exactly what the write or mutation that owns it needs, to judge its own
+   * acknowledgement against. The pass hands those back (`own`), and they are
+   * noted here as a delta's would have been; one acknowledged since the pass
+   * looked was dated by a receipt that could not see the report, so it is
+   * judged here directly.
+   *
+   * With nothing datable — across incarnations, against a short listing, or
+   * a pass that failed outright — every own row, and every row that was own
+   * when the repair began, is judged as though a peer wrote it last: an
+   * eviction and a refetch, never a stale byte.
+   */
+  function _settleSkippedReports(ownAtStart, repaired) {
+    const reports = new Map();
+    if (repaired && repaired.cursor && repaired.reconciled && Array.isArray(repaired.own)) {
+      for (const entry of repaired.own) reports.set(entry.path, entry.rev);
+    } else {
+      for (const k of ownAtStart) reports.set(k, Infinity);
+      if (repaired && Array.isArray(repaired.own)) for (const entry of repaired.own) reports.set(entry.path, Infinity);
+      for (const k of Object.keys(__vfsOwnLeases)) reports.set(k, Infinity);
+      for (const k of Object.keys(__vfsWrites)) reports.set(k, Infinity);
+    }
+    for (const [k, rev] of reports) {
+      __nimbusNoteVfsReport(k, rev);
+      const provenance = __residentProvenance(k);
+      if (provenance !== undefined && provenance !== -1 && provenance < rev) _evictOwed(k);
+    }
+  }
+
   /**
    * ACQUIRE. Apply every invalidation the supervisor has for this facet,
    * then re-stamp the cursor.
@@ -1543,65 +1834,247 @@ const __fsMod = (() => {
    * left. Comparing revisions rather than names keeps the peer case intact:
    * a peer writing the same path afterwards reports a HIGHER revision than
    * our stamp, so that invalidation still lands.
+   *
+   * An ACQUIRE that gets no answer is a poison too, never an empty delta. It
+   * has learned nothing about what changed, and the resumption behind it is
+   * about to serve every row it holds. The call is a pure read, so a dropped
+   * one is already retried where the supervisor makes it (SupervisorRPC,
+   * fabric's idempotent), and what arrives here failed those retries, came
+   * from a host that could not serve it, or answered without a cursor. The
+   * rows are repaired against the listing exactly as for a poison; with no
+   * cursor to adopt, the one held is kept and still owed every change since.
+   * The barrier itself never throws: the operation or callback behind it
+   * runs either way, against rows that were vouched for or a colder cache.
+   *
+   * A repair is single-flight, and while one runs no delta may be admitted
+   * at all: the repair has already dropped the rows it could not vouch for,
+   * so a report of one of them finds nothing to evict and is consumed, and
+   * the repair then installs it at its listing's revision and publishes the
+   * listing's cursor over the one the delta advanced. So any barrier answered
+   * while a repair runs joins it, whether its own answer needed a repair or
+   * was an ordinary delta, and the listing may predate that answer — the rows
+   * it vouches for are another barrier's answer, not this one's — so a joiner
+   * waits for it and then asks again: a delta from the repaired cursor names
+   * everything since. Only the barrier that started a repair resumes on it
+   * alone.
+   *
+   * `delivered` is an answer the supervisor delivered with the resumption
+   * this barrier is taken for; it stands in for the first ACQUIRE when it can
+   * (_deliveredAnswer). Everything after is the same for an answer delivered
+   * and one asked for, so a repair, a join or a poison follows exactly the
+   * path it always has.
+   *
+   * Last, the barrier waits out every own write or mutation that a report —
+   * this answer's or an earlier one's — is outstanding against, until its
+   * acknowledgement says which came first (__nimbusReportedOwnAcknowledgements).
+   * Until then the resumption could run on own bytes the authority applied
+   * before a peer overwrote them. Nothing is waited on unless such a report
+   * exists.
    */
-  async function _acquireBarrier(supervisor) {
+  async function _acquireBarrier(supervisor, delivered) {
     if (!supervisor || typeof supervisor.fsAcquire !== "function") return [];
-    let result;
-    // Through the RPC helper like every other supervisor call, because it IS
-    // one: the barrier is the first thing an async read issues, and while it
-    // was uncounted __nimbusPendingOps read zero for a whole round trip. A
-    // one-shot facet's event loop, which exits when no handle is live, then
-    // ended the program mid-read — measured as an fs.promises.readFile whose
-    // .then never ran, no error, no output, intermittently, and never when a
-    // pending timer happened to hold the program open.
-    try { result = await __nimbusUseRpcResult(supervisor.fsAcquire(_cursor.epoch, _cursor.rev), (r) => r); }
-    catch { return []; }
-    if (!result || typeof result.rev !== "number") return [];
-    // Paths that held content before this eviction are the ones worth
-    // refetching at a resumption boundary — a later sync read of any of them
-    // would otherwise miss. Collected before the delete so the membership
-    // test is against the pre-eviction bundle.
-    const wereResident = [];
+    const fromDelivery = _deliveredAnswer(delivered);
+    // The overlay of this facet's own structural effects retires what settled
+    // before the answer was asked for: a delivered answer was asked for when
+    // its arguments were built, a fetched one now.
+    const begin = fromDelivery ? _argsBegin(delivered.args) : ++_barrierBegins;
+    let result = fromDelivery || await _acquire(supervisor);
     // When the resident set lives in the facet's own SQLite, the STORE applies
     // the delta. That is not an optimisation, it is where provenance has to
     // live: a facet's SQLite outlives its module scope, so a new incarnation
     // opens onto rows a previous one wrote while every heap-side stamp that
     // described them is gone. Rows carry their own revision, __vfsBundleRevisions
     // cannot follow them there, and two provenance stores would be one too many.
-    if (_residentStorePresent()) {
-      if (result.poison) {
-        _stats.poisons++;
-        await _repairPoisonedStore(supervisor, result);
-        // Nothing is returned because a dropped cell is either refetched by
-        // the repair or gone from the authority too.
-        return [];
+    {
+      // A namespace that stopped answering (a relist failed) is a failure
+      // state, not a mode: every barrier the process reaches repairs it, once,
+      // until a listing restores it.
+      let namespaceAsked = false;
+      for (let joins = 0; ; joins++) {
+        const joining = _residentRepair !== null;
+        const namespaceOwed = !namespaceAsked && !_nsActive();
+        // A sealed heap view can release acknowledged overlays before its
+        // listing; otherwise the old overlay and replacement rows would
+        // consume the same scarce allowance while preventing each other's
+        // repair. Nothing synchronous may consult the sealed view here.
+        if (namespaceOwed && __residentInHeap) _nsRetire(begin);
+        const needsRepair = result === null || result.poison === true || _storeRepairOwed || namespaceOwed;
+        if (!joining && !needsRepair) break;
+        if (namespaceOwed) { namespaceAsked = true; _stats.namespaceRepairs++; }
+        if (needsRepair) {
+          if (result !== null && result.poison === true) _stats.poisons++;
+          _spoilFills();
+        }
+        await (joining ? _residentRepair : _repairPoisonedStore(supervisor, result));
+        // A repair's listing is walked page by page at successive revisions,
+        // so even the barrier that started it asks once more: the delta from
+        // the listing's cursor leaves the namespace exact. Unanswered, it
+        // resumes on the repair's rows as they are, which the listing vouched
+        // for; the namespace then waits for the next barrier.
+        if (!joining) {
+          if (_storeRepairOwed) return [];
+          result = await _acquire(supervisor);
+          if (result === null || result.poison === true) { _nsRetire(begin); return []; }
+          continue;
+        }
+        if (joins + 1 >= _REPAIR_JOINS_MAX) {
+          // Every repair this barrier waited on was someone else's. Rather
+          // than resume on rows none of them vouched for as of its own
+          // answer, it drops them and leaves the repair owed: a colder cache,
+          // never a stale byte. Any repair still to finish lists after this.
+          __residentDropDated();
+          _storeRepairOwed = true;
+          __nimbusNoteUnnamedReports();
+          await _awaitReportedOwnWrites();
+          return [];
+        }
+        result = await _acquire(supervisor);
+      }
+      // The store keeps a row of this facet's own bytes over any report, so
+      // the report is noted first: the write or mutation that owns the row
+      // judges it against its own revision when that arrives, as it does for
+      // a heap cell. A read in flight gets the same note.
+      if (Array.isArray(result.paths)) {
+        for (const entry of result.paths) _noteReport(entry);
       }
+      // N18: room for what it pushes, before it is held.
+      await __residentRoomForPushed(result);
       const applied = __residentAdmit(result);
-      _cursor.epoch = result.epoch;
-      _cursor.rev = result.rev;
+      _cursor.epoch = applied.cursor.epoch;
+      _cursor.rev = applied.cursor.rev;
+      // A directory that became searchable has descendants no delta names.
+      for (const dir of applied.relist) await __nsRelist(supervisor, dir);
+      _nsRetire(begin);
       _stats.invalidations += applied.dropped.length;
+      _stats.selfWrites += applied.kept;
+      _stats.pushes += applied.pushed || 0;
+      await _awaitReportedOwnWrites();
       return applied.dropped;
     }
-    if (result.poison) {
-      if (__vfsBundle) for (const k of Object.keys(__vfsBundle)) { wereResident.push(k); _evictResident(k); }
-      _stats.poisons++;
-    } else if (Array.isArray(result.paths)) {
-      for (const entry of result.paths) {
-        const k = entry.path;
-        // This cursor is about to advance past the report, so a path with
-        // one of this facet's own writes in flight keeps the number: only
-        // that write's own revision, when it arrives, can say whether the
-        // report was itself or a peer. Everything else ignores it.
-        __nimbusNoteVfsReport(k, entry.rev);
-        if (__vfsBundleRevisions[k] >= entry.rev) { _stats.selfWrites++; continue; }
-        const held = !!(__vfsBundle && k in __vfsBundle);
-        if (_evictResident(k)) _stats.invalidations++;
-        if (held) wereResident.push(k);
+  }
+
+  /**
+   * Hold the resumption behind a barrier on every own write or mutation a
+   * report is outstanding against, until its acknowledgement says which came
+   * first (__nimbusReportedOwnAcknowledgements). Counted, because the wait is
+   * also paid when the report was the write itself coming back, which the
+   * facet cannot tell apart until the acknowledgement lands.
+   */
+  async function _awaitReportedOwnWrites() {
+    const acks = __nimbusReportedOwnAcknowledgements();
+    if (acks === null) return;
+    _stats.ownWriteWaits++;
+    await acks;
+  }
+
+  /**
+   * Repairs someone else started that one barrier waits on, in a row, before
+   * it stops asking again and drops what it cannot vouch for. A bound on the
+   * barrier's own liveness, not a tuning knob: each join waits a whole repair,
+   * so the fourth means repairs keep being started under it.
+   */
+  const _REPAIR_JOINS_MAX = 4;
+
+  /**
+   * What this facet asks its ACQUIRE with: its cursor. Built in one place, so
+   * what a delivery is answered from (a long poll sends these,
+   * `__nimbusVfsAcquireArgs`) is exactly what fsAcquire would be asked.
+   */
+  function _acquireArgs() {
+    // Every build is the start of an answer the overlay may retire against.
+    const begin = ++_barrierBegins;
+    const key = _cursor.epoch + "@" + _cursor.rev;
+    if (!_argsBegins.has(key)) _argsBegins.set(key, begin);
+    const options = _residentStorePresent() && typeof __residentAcquireOptions === "function"
+      ? __residentAcquireOptions() : undefined;
+    return options
+      ? { epoch: _cursor.epoch, cursor: _cursor.rev, options }
+      : { epoch: _cursor.epoch, cursor: _cursor.rev };
+  }
+  /**
+   * The earliest begin of any arguments built at a cursor: a delivered answer
+   * may answer any of them, and retiring against the earliest is the one
+   * that is never too late. Cursors left behind are forgotten.
+   */
+  const _argsBegins = new Map();
+  function _argsBegin(args) {
+    const key = args.epoch + "@" + args.cursor;
+    const begin = _argsBegins.get(key) ?? 0;
+    for (const k of [..._argsBegins.keys()]) {
+      const [epoch, rev] = [k.slice(0, k.lastIndexOf("@")), Number(k.slice(k.lastIndexOf("@") + 1))];
+      if (epoch !== _cursor.epoch || rev < _cursor.rev) _argsBegins.delete(k);
+    }
+    return begin;
+  }
+
+  /**
+   * One ACQUIRE: the authority's answer, or null when there is none — the
+   * call failed past the supervisor's own retries, the host could not serve
+   * it, or the answer carried no cursor. A null is counted where the
+   * coherence stats are read, and is never an empty delta (_acquireBarrier).
+   */
+  async function _acquire(supervisor) {
+    // Through the RPC helper like every other supervisor call, because it IS
+    // one: the barrier is the first thing an async read issues, and while it
+    // was uncounted __nimbusPendingOps read zero for a whole round trip. A
+    // one-shot facet's event loop, which exits when no handle is live, then
+    // ended the program mid-read — measured as an fs.promises.readFile whose
+    // .then never ran, no error, no output, intermittently, and never when a
+    // pending timer happened to hold the program open.
+    try {
+      const args = _acquireArgs();
+      const result = await __nimbusUseRpcResult(
+        args.options ? supervisor.fsAcquire(args.epoch, args.cursor, args.options) : supervisor.fsAcquire(args.epoch, args.cursor),
+        (r) => r,
+      );
+      if (!result || typeof result.rev !== "number" || typeof result.epoch !== "string") {
+        throw new Error("fsAcquire answered without a cursor");
       }
+      return _currentAnswer(result);
+    } catch (error) {
+      _stats.barrierFailures++;
+      _stats.lastBarrierFailure = (error && error.message) || String(error);
+      return null;
     }
-    _cursor.epoch = result.epoch;
-    _cursor.rev = result.rev;
-    return wereResident;
+  }
+
+  /**
+   * An answer as it stands against this facet's cursor now.
+   *
+   * Answers can be admitted in another order than they were given: an
+   * answer a long poll delivers was asked for before the barrier that
+   * overtook it. Everything at or below the cursor is admitted already, by
+   * whichever answer took the cursor past it — an answer is complete from
+   * the cursor it was asked from, which is never ahead of the cursor now, and
+   * names each path at its newest revision in its range. So only the entries
+   * above the cursor are news, and the cursor never moves back. An answer in
+   * another epoch, or a poison, is left as it is.
+   */
+  function _currentAnswer(result) {
+    if (result.poison === true || result.epoch !== _cursor.epoch) return result;
+    if (result.rev <= _cursor.rev) return { ...result, rev: _cursor.rev, paths: [] };
+    const paths = result.paths.filter((entry) => entry.rev > _cursor.rev);
+    return paths.length === result.paths.length ? result : { ...result, paths };
+  }
+
+  /**
+   * The answer a delivery carried (session/rpc.ts _acquireOnDelivery), as it
+   * stands against the cursor now, or null when it cannot stand in for
+   * asking. It can when it answers from a cursor this facet has reached, in
+   * this epoch: everything at or below that cursor is admitted, and the
+   * answer names everything after it up to the moment of delivery. The
+   * barrier asks, as it always has, when there is no answer or it is a
+   * poison, in another epoch, or from a cursor this facet has not reached — a
+   * routed request is answered from the supervisor's own cursor, "nothing
+   * since now", which stands in only for a facet that is already there.
+   */
+  function _deliveredAnswer(delivered) {
+    if (!delivered || typeof delivered !== "object") return null;
+    const { args, answer } = delivered;
+    if (!args || !answer || answer.poison === true || !Array.isArray(answer.paths)) return null;
+    if (typeof answer.rev !== "number" || answer.epoch !== _cursor.epoch || args.epoch !== _cursor.epoch) return null;
+    if (!(args.cursor <= _cursor.rev)) return null;
+    return _currentAnswer(answer);
   }
 
   /**
@@ -1623,9 +2096,22 @@ const __fsMod = (() => {
    * This closes staleness of RESIDENT cells across an untrusted resumption.
    * A first synchronous touch of a NON-resident path is the separate
    * residency floor and is unaffected — it still raises EAGAIN, correctly.
+   *
+   * Two resumptions can barrier at once — a child's output and its exit
+   * arrive together — and both deltas name the same changed path. The first
+   * to land evicts it and starts the refetch; the second finds no row and
+   * would release its callback while that refetch is still in flight, onto
+   * a miss. So a barrier also waits for every refetch still in flight.
+   * It does not read those paths again. A refetch in flight installs its
+   * bytes unless a barrier has since reported the path above the cursor it
+   * was issued under, or a poison spoiled it (_installResident). Only then
+   * does a later barrier read the path itself, and only if nothing holds it
+   * by now. Re-reading every in-flight path at every resumption cost a dev
+   * server 50 reads per request while a peer's refetch of 50 files ran: 500
+   * reads over ten resumptions, and under steady load the set never drained.
    */
-  async function _acquireAndRefetch(supervisor) {
-    const stale = await _acquireBarrier(supervisor);
+  async function _acquireAndRefetch(supervisor, delivered) {
+    const stale = await _acquireBarrier(supervisor, delivered);
     // Plus what an own-mutation lease dropped since the last resumption:
     // the same debt this function exists to settle, owed by an eviction
     // that had no barrier to report it (see _owedRefetch).
@@ -1633,8 +2119,58 @@ const __fsMod = (() => {
       for (const k of _owedRefetch) if (stale.indexOf(k) === -1) stale.push(k);
       _owedRefetch.clear();
     }
-    if (stale.length === 0) return;
-    await Promise.all(stale.map((k) => _liveReadFile("/" + k, undefined, true).catch(() => {})));
+    // Taken before this barrier's own refetches join the map.
+    const inFlight = [..._refetching];
+    const reads = stale.map(_refetch);
+    for (const [k, refetch] of inFlight) {
+      if (stale.indexOf(k) !== -1) continue;
+      if (!(refetch.fill.reported > refetch.fill.rev)) reads.push(refetch.done);
+      else if (!(__vfsBundle && k in __vfsBundle)) reads.push(_refetch(k));
+    }
+    if (reads.length > 0) await Promise.all(reads);
+  }
+
+  /**
+   * Refetches in flight, per path: the newest read of it, and the fill
+   * ticket that read installs under — the cursor it was issued at, and the
+   * reports noted against it since.
+   */
+  const _refetching = new Map();
+
+  /**
+   * Read `k` live and install it, behind the barrier just taken. Settles
+   * either way: a refetch that fails leaves the path missing, which the next
+   * read of it answers.
+   *
+   * `read` settles once this read has landed and its install was made or
+   * declined. `done`, which the resumptions wait on, may wait once more. An
+   * install is declined when a barrier reported the path above this read's
+   * cursor, or a poison spoiled it, and settling there would release every
+   * waiter onto the miss it left while something else is already filling
+   * the path: the newer refetch a barrier issued to replace this one, or the
+   * repair that poison started. So `done` waits on what is in flight at the
+   * moment this read settles, that refetch's own read and install and that
+   * repair, and then settles whether or not the path is held. It never
+   * follows a refetch issued after that. A peer that rewrites the path
+   * faster than one read round trip outdates every refetch with the next
+   * resumption's report, and following them held every resumption, including
+   * those that never read the path, until the writer stopped (1528 ms against
+   * 33 ms). A path left unheld is read live by its next read.
+   */
+  function _refetch(k) {
+    const fill = _beginFill(k);
+    const refetch = { fill, read: null, done: null };
+    refetch.read = _liveReadFile("/" + k, undefined, fill).then(() => {}, () => {}).then(() => {
+      _endFill(fill);
+      if (_refetching.get(k) === refetch) _refetching.delete(k);
+    });
+    refetch.done = refetch.read.then(() => {
+      if (__vfsBundle && k in __vfsBundle) return undefined;
+      const newer = _refetching.get(k);
+      return Promise.all([newer && newer.read, _residentRepair]);
+    });
+    _refetching.set(k, refetch);
+    return refetch.done;
   }
 
   /**
@@ -1646,14 +2182,15 @@ const __fsMod = (() => {
    * its fetch handler; binding the supervisor when the wrappers are
    * installed would silently leave every resident-TUI timer unbarriered.
    *
-   * Published on globalThis because the two other untrusted resumptions —
-   * an outbound fetch response and a relayed socket frame — are delivered
-   * by code outside this closure. One barrier, three boundaries.
+   * Published on globalThis because the other resumptions — an outbound
+   * fetch response, a relayed socket frame, and everything the supervisor
+   * delivers (`__nimbusInboundBarrier`, with the answer it delivered) — are
+   * handed to the program by code outside this closure.
    */
-  async function _resumptionAcquire() {
+  async function _resumptionAcquire(delivered) {
     const supervisor = _supervisor();
     if (!supervisor || typeof supervisor.fsAcquire !== "function") return;
-    await _acquireAndRefetch(supervisor);
+    await _acquireAndRefetch(supervisor, delivered);
   }
 
   /**
@@ -1687,6 +2224,7 @@ const __fsMod = (() => {
     if (globalThis.__nimbusResumptionBarriersInstalled) return;
     globalThis.__nimbusResumptionBarriersInstalled = true;
     globalThis.__nimbusVfsAcquireBarrier = _resumptionAcquire;
+    globalThis.__nimbusVfsAcquireArgs = _acquireArgs;
     globalThis.__nimbusVfsReleaseBarrier = _resumptionRelease;
     const _setTimeout = globalThis.setTimeout;
     const _setInterval = globalThis.setInterval;
@@ -1794,8 +2332,9 @@ const __fsMod = (() => {
   // `method` names the supervisor RPC when it differs from the syscall the
   // caller reports (lchown rides `chown`, rm rides `fsRemove`).
   function _queueStructuralMutation(absPath, syscall, displayPath, rpc, after, method) {
+    const settle = _nsTakeFresh();
     const supervisor = _supervisor();
-    if (!supervisor || typeof supervisor[method || syscall] !== "function") return null;
+    if (!supervisor || typeof supervisor[method || syscall] !== "function") { settle(); return null; }
     const queued = _hasVfsMutationQueue();
     const before = queued && after ? after() : null;
     const run = async () => {
@@ -1811,7 +2350,11 @@ const __fsMod = (() => {
       );
       _markVfsStale();
     };
-    return queued ? __nimbusQueueVfsMutation(absPath, run) : run();
+    const out = queued ? __nimbusQueueVfsMutation(absPath, run) : run();
+    // Settled either way: a failed mutation leaves the authority as it was,
+    // which the next barrier's table shows.
+    Promise.resolve(out).then(settle, settle);
+    return out;
   }
 
   /**
@@ -1824,25 +2367,33 @@ const __fsMod = (() => {
    * effect while the lease still holds the cell, so the stamp the end
    * settles describes a cell that already carries the mutation.
    *
-   * Heap-side stamps do not describe rows in the resident store, so store
-   * mode has no lease to take and is left to the store's own provenance.
+   * The ledger takes the lease on whichever holds the stamp: a heap stamp,
+   * or the resident store's row. Without it a store row the mutation
+   * overlaid would be left as own bytes nobody ever dates, which the barrier
+   * keeps against every later write by anyone.
+   *
+   * From lease to receipt it is an acknowledgement in flight
+   * (__nimbusOwnAcknowledgement): a barrier that reports the path waits for
+   * it, rather than resume on bytes the receipt may yet show a peer outran.
    */
-  async function _ownMutation(absPath, rpc, apply) {
+  function _ownMutation(absPath, rpc, apply) {
     const key = _strip(absPath);
-    const held = !_residentStorePresent() && __nimbusBeginOwnMutation(key);
-    let receipt;
-    let landed = false;
-    try { receipt = await rpc(); landed = true; }
-    finally {
-      // The local effect follows the mutation landing, not the receipt: the
-      // receipt only settles the stamp, and a supervisor that answers
-      // without one still applied the bytes. The end runs even if applying
-      // throws: a lease left open pins its cell at Infinity, which is the one
-      // state in this protocol that can serve a stale byte forever.
-      try { if (landed && apply) apply(receipt); }
-      finally { __nimbusEndOwnMutation(key, held, receipt); }
-    }
-    return receipt;
+    return __nimbusOwnAcknowledgement(key, async () => {
+      const held = __nimbusBeginOwnMutation(key);
+      let receipt;
+      let landed = false;
+      try { receipt = await rpc(); landed = true; }
+      finally {
+        // The local effect follows the mutation landing, not the receipt: the
+        // receipt only settles the stamp, and a supervisor that answers
+        // without one still applied the bytes. The end runs even if applying
+        // throws: a lease left open pins its cell at Infinity, which is the one
+        // state in this protocol that can serve a stale byte forever.
+        try { if (landed && apply) apply(receipt); }
+        finally { __nimbusEndOwnMutation(key, held, receipt); }
+      }
+      return receipt;
+    });
   }
 
   // A sync caller has no frame to receive the outcome. The ledger already
@@ -1877,6 +2428,8 @@ const __fsMod = (() => {
         "write", absPath,
         (result) => result,
       ),
+      true,
+      true,
     );
   }
 
@@ -1887,13 +2440,18 @@ const __fsMod = (() => {
       await _flushParkedWrite(absPath, supervisor);
       _markVfsStale();
     }
-    // Pending sync chmod rides along with any flush of the same path
-    // (idempotent — the entry stays so local statSync remains coherent).
-    if (k in _localModes && typeof supervisor.chmod === "function") {
-      await _ownMutation(
-        absPath,
-        () => _fsRpc(supervisor.chmod(absPath, _localModes[k]), "chmod", absPath, (result) => result),
-      );
+    // A pending sync chmod rides along with the next flush of the same path.
+    if (_pendingModes.has(k) && typeof supervisor.chmod === "function") {
+      _pendingModes.delete(k);
+      try {
+        await _ownMutation(
+          absPath,
+          () => _fsRpc(supervisor.chmod(absPath, _localModes[k]), "chmod", absPath, (result) => result),
+        );
+      } catch (error) {
+        _pendingModes.add(k);
+        throw error;
+      }
       _markVfsStale();
     }
   }
@@ -1981,8 +2539,11 @@ const __fsMod = (() => {
     const atime = new Date(Number(meta?.atime || meta?.mtime || Date.now()));
     const mode = Number(meta?.mode ?? (isDir ? 0o755 : 0o644));
     const stat = _localStatObject(key, isDir, isSymlink, size, mode, meta?.uid, meta?.gid);
-    stat.atime = atime;
-    stat.mtime = mtime;
+    // This process's own utimes, until it is reported back, ahead of the
+    // namespace's (_recordLocalTimes).
+    const own = key === undefined ? undefined : _localTimes[key];
+    stat.atime = own && Number.isFinite(own.atimeMs) ? new Date(own.atimeMs) : atime;
+    stat.mtime = own && Number.isFinite(own.mtimeMs) ? new Date(own.mtimeMs) : mtime;
     stat.ctime = new Date(Number(meta?.ctime ?? meta?.mtime ?? Date.now()));
     stat.birthtime = stat.ctime;
     return stat;
@@ -2015,24 +2576,32 @@ const __fsMod = (() => {
   // multi-MB file for one RPC frame.
   const READ_STREAM_CHUNK_BYTES = 65536;
 
-  // Ranged reads issued in the same microtask turn travel as ONE batch.
+  // Ranged reads issued in the same microtask turn travel as ONE batch, and
+  // so do lstats (_learnLive): one request kind each, one round trip.
   //
   // A round trip costs an order of magnitude more than the read behind it,
   // so a program awaiting reads one at a time pays for round trips and
   // nothing else. Nothing here changes what a read sees: every request is
-  // the same live ranged read, executed in order, in the caller's turn. The
-  // gather window is one microtask, so it can only capture reads the program
-  // had already issued concurrently — a sequential loop batches nothing
-  // because it has issued nothing else to batch.
+  // the same live ranged read or lstat, executed in order, in the caller's
+  // turn. The gather window is one microtask, so it can only capture
+  // requests the program had already issued concurrently — a sequential
+  // loop batches nothing because it has issued nothing else to batch.
   const READ_BATCH_PATH_LIMIT = 1024;
   const READ_BATCH_REQUEST_BYTES = 4194304;
   let _openReadBatch = null;
 
   function _queueRangeRead(supervisor, absPath, pos, want) {
+    return _queueBatchRequest(supervisor, { path: absPath, offset: pos, length: want }, want);
+  }
+
+  // `request` in the open batch, `bytes` of file content counted against the
+  // batch's bound. Settles with the entry's bytes for a range, its stat for
+  // an lstat.
+  function _queueBatchRequest(supervisor, request, bytes) {
     let batch = _openReadBatch;
     if (batch && (
       batch.requests.length >= READ_BATCH_PATH_LIMIT
-      || batch.bytes + want > READ_BATCH_REQUEST_BYTES
+      || batch.bytes + bytes > READ_BATCH_REQUEST_BYTES
     )) {
       _openReadBatch = null;
       _flushReadBatch(batch);
@@ -2042,17 +2611,24 @@ const __fsMod = (() => {
       batch = { supervisor, requests: [], settlers: [], bytes: 0 };
       _openReadBatch = batch;
       queueMicrotask(() => {
-        if (_openReadBatch === batch) _openReadBatch = null;
+        // A batch a bound closed was flushed then; sending it here too would
+        // read every entry of it twice.
+        if (_openReadBatch !== batch) return;
+        _openReadBatch = null;
         _flushReadBatch(batch);
       });
     }
-    batch.bytes += want;
-    batch.requests.push({ path: absPath, offset: pos, length: want });
-    return new Promise((resolve, reject) => { batch.settlers.push({ resolve, reject }); });
+    batch.bytes += bytes;
+    batch.requests.push(request);
+    const settler = Promise.withResolvers();
+    batch.settlers.push(settler);
+    return settler.promise;
   }
 
   async function _flushReadBatch(batch) {
-    globalThis.__nimbusFsRpcReads++;
+    // A read round trip is one that carries a range; a batch of learns
+    // (lstat requests) is metadata, which the read count leaves out.
+    if (batch.requests.some((request) => request.lstat !== true)) globalThis.__nimbusFsRpcReads++;
     try {
       const entries = await __nimbusUseRpcResult(
         batch.supervisor.fsReadBatch(batch.requests), (r) => r,
@@ -2063,6 +2639,8 @@ const __fsMod = (() => {
           const err = new Error(entry.error.message);
           if (entry.error.code) err.code = entry.error.code;
           batch.settlers[i].reject(err);
+        } else if (batch.requests[i].lstat === true) {
+          batch.settlers[i].resolve(entry ? entry.stat : null);
         } else {
           batch.settlers[i].resolve(entry ? entry.bytes : null);
         }
@@ -2127,59 +2705,83 @@ const __fsMod = (() => {
     return parts;
   }
 
-  async function _liveReadFile(p, opts, skipAcquire) {
+  async function _liveReadFile(p, opts, refetch) {
     const absPath = _resolve(p);
     const encoding = typeof opts === "string" ? opts : opts?.encoding;
     const supervisor = _supervisor();
     if (!supervisor) throw _fsErr("ENOENT", "open", p);
-    // The refetch step of _acquireAndRefetch has already acquired against a
-    // fresh cursor, so re-acquiring here would be a redundant round trip
-    // that always returns "still R". Every other caller acquires.
-    if (!skipAcquire) await _acquireBarrier(supervisor);
-
-    if (typeof supervisor.fsReadRange === "function") {
-      // Chunked: the caller wants the whole file, but nothing upstream has
-      // to hold it all at once to produce it.
-      //
-      // A short chunk is the only signal the file ended, so this walk could
-      // only ever have one chunk in flight — 65 sequential round trips for a
-      // 4 MiB file, each costing far more than the read behind it. The FIRST
-      // chunk still costs exactly one trip and settles it for every file
-      // that fits in one. When it comes back full there is demonstrably
-      // more, and a stat says how much, so the remainder is issued together
-      // and the read batch carries it in a single trip.
-      const parts = [];
-      let total = 0;
-      for (;;) {
-        const chunk = await _readRangeAt(absPath, p, total, READ_STREAM_CHUNK_BYTES);
-        if (chunk === null) break;
-        parts.push(chunk);
-        total += chunk.byteLength;
-        if (chunk.byteLength < READ_STREAM_CHUNK_BYTES) break;
-        if (typeof supervisor.stat !== "function") continue;
-        for (const rest of await _readChunksFrom(absPath, p, supervisor, total)) {
-          parts.push(rest);
-          total += rest.byteLength;
+    // A refetch (_refetch) has already acquired against a fresh cursor and
+    // holds the fill ticket issued under it, so re-acquiring here would be a
+    // redundant round trip that always returns "still R". Every other caller
+    // acquires, and its fill ticket is its own.
+    if (!refetch) await _acquireBarrier(supervisor);
+    const fill = refetch || _beginFill(_strip(absPath));
+    try {
+      if (typeof supervisor.fsReadRange === "function") {
+        // Chunked: the caller wants the whole file, but nothing upstream has
+        // to hold it all at once to produce it.
+        //
+        // A short chunk is the only signal the file ended, so this walk could
+        // only ever have one chunk in flight — 65 sequential round trips for a
+        // 4 MiB file, each costing far more than the read behind it. The FIRST
+        // chunk still costs exactly one trip and settles it for every file
+        // that fits in one. When it comes back full there is demonstrably
+        // more, and a stat says how much, so the remainder is issued together
+        // and the read batch carries it in a single trip.
+        const parts = [];
+        let total = 0;
+        for (;;) {
+          const chunk = await _readRangeAt(absPath, p, total, READ_STREAM_CHUNK_BYTES);
+          if (chunk === null) break;
+          parts.push(chunk);
+          total += chunk.byteLength;
+          if (chunk.byteLength < READ_STREAM_CHUNK_BYTES) break;
+          if (typeof supervisor.stat !== "function") continue;
+          for (const rest of await _readChunksFrom(absPath, p, supervisor, total)) {
+            parts.push(rest);
+            total += rest.byteLength;
+          }
+          break;
         }
-        break;
+        const bytes = parts.length === 1 ? parts[0] : _concatBytes(parts, total);
+        _installResident(absPath, bytes, fill);
+        await _learnLive(absPath, supervisor);
+        return encoding ? _asString(bytes) : __BufferMod.from(bytes);
       }
-      const bytes = parts.length === 1 ? parts[0] : _concatBytes(parts, total);
-      _installResident(absPath, bytes);
-      return encoding ? _asString(bytes) : __BufferMod.from(bytes);
-    }
 
-    if (typeof supervisor.readFile === "function") {
-      await _flushLocalPathToSupervisor(absPath, supervisor);
-      const text = await _fsReadRpc(supervisor.readFile(absPath), "open", p, (result) => result);
-      if (text !== null && text !== undefined) {
-        _installResident(absPath, text);
-        return encoding ? _asString(text) : __BufferMod.from(text);
+      if (typeof supervisor.readFile === "function") {
+        await _flushLocalPathToSupervisor(absPath, supervisor);
+        const text = await _fsReadRpc(supervisor.readFile(absPath), "open", p, (result) => result);
+        if (text !== null && text !== undefined) {
+          _installResident(absPath, text, fill);
+          await _learnLive(absPath, supervisor);
+          return encoding ? _asString(text) : __BufferMod.from(text);
+        }
       }
+    } finally {
+      if (!refetch) _endFill(fill);
     }
 
     throw _fsErr("ENOENT", "open", p);
   }
 
+
+
+  /** Paths whose write-back this process issued and the authority accepted. */
+  const _acceptedHere = new Set();
+  globalThis.__nimbusVfsWriteLanded = (key) => {
+    const k = String(key).replace(/^\/+/, "");
+    _acceptedHere.add(k);
+  };
+
+  // The authority refused a parked write (vfs-write-ledger): the record may
+  // be that write's, so it is forgotten and the next access asks the authority.
+  globalThis.__nimbusVfsWriteRefused = (key) => {
+    const k = String(key).replace(/^\/+/, "");
+    _createdHere.delete(k);
+    _acceptedHere.delete(k);
+  };
+
   function _concatBytes(parts, total) {
     const out = new Uint8Array(total);
     let off = 0;
@@ -2251,24 +2853,11 @@ const __fsMod = (() => {
         // its shape: the sync existence view must not go on contradicting a
         // directory this very process has enumerated. Names only — size, mode
         // and ownership are not observable here and are never invented.
-        if (__vfsManifest) __vfsManifest[key] = entries.map((entry) => entry.name);
-        // Which of the children are directories IS observable here, and it is
-        // the one fact a later synchronous listing cannot recover on its own —
-        // an unwalked subdirectory has no manifest entry, so without this it
-        // reads back as a file. A directory's size is 0 in this filesystem, so
-        // recording it invents nothing; file children are left alone, because
-        // their size is not knowable from a listing and must not be guessed.
-        const metadataTable = _metadataTable();
-        if (metadataTable) {
-          for (const entry of entries) {
-            if (entry.type !== "directory") continue;
-            const child = prefix + entry.name;
-            if (child in metadataTable) continue;
-            metadataTable[child] = {
-              type: "directory", size: 0, mode: 0o755, uid: cred.uid, gid: cred.gid,
-            };
-          }
-        }
+        // The listed directory and its child directories get the authority's
+        // own stat: a later synchronous stat or listing of them needs a record
+        // saying what they are, and a record says who owns them, which a
+        // listing does not. So it is asked for, never assumed (one lstat per
+        // child directory, concurrently).
         if (opts?.withFileTypes) {
           return entries
             .map((entry) => _direntObject(entry.name, entry.type, absPath))
@@ -2326,6 +2915,8 @@ const __fsMod = (() => {
         _fsRpc(supervisor.writeFile(absPath, content), "write", p, (result) => result)
       );
       _markVfsStale();
+      // Accepted: the authority's stat is what the sync view keeps for it.
+      await _learnLive(absPath, supervisor);
     }
   }
 
@@ -2344,6 +2935,7 @@ const __fsMod = (() => {
       ),
     );
     _markVfsStale();
+    await _learnLive(absPath, supervisor);
   }
 
   // The async structural calls ARE the sync ones, awaited: the same local
@@ -2451,11 +3043,27 @@ const __fsMod = (() => {
     if (!supervisor && !existsSync(p)) throw _fsErr("ENOENT", syscall, p);
   }
 
+  /**
+   * chmod(2): only the owner or root changes a mode (EPERM). The local
+   * overlay is what statSync reports and what the local permission checks
+   * read, so a mode set here without that check made a root-owned file
+   * writable in the process's own view.
+   */
+  function _ensureModeOwner(absPath, syscall, p) {
+    if (Number(cred.uid) === 0) return;
+    const stat = _statLadder(absPath);
+    if (stat === undefined) throw _fsErr("ENOENT", syscall, p);
+    if (Number(stat.uid) !== Number(cred.uid)) throw _fsErr("EPERM", syscall, p);
+  }
+
   function chmodSync(p, mode) {
     if (!existsSync(p)) throw _fsErr("ENOENT", "chmod", p);
+    _ensureModeOwner(_resolve(p), "chmod", p);
     // Local-visible immediately (statSync overlay); the live write-through
     // rides the next flush of the same path — same fidelity as utimesSync.
-    _localModes[_strip(_resolve(p))] = _coerceMode(mode, "chmod", p);
+    const k = _strip(_resolve(p));
+    _localModes[k] = _coerceMode(mode, "chmod", p);
+    _pendingModes.add(k);
   }
 
   async function _chmodAsync(p, mode) {
@@ -2467,7 +3075,9 @@ const __fsMod = (() => {
       throw _fsErr("ENOENT", "chmod", p);
     }
     const m = _coerceMode(mode, "chmod", p);
+    if (localExists) _ensureModeOwner(absPath, "chmod", p);
     _localModes[_strip(absPath)] = m;
+    _pendingModes.add(_strip(absPath));
     if (supervisor && typeof supervisor.chmod === "function") {
       await _flushLocalPathToSupervisor(absPath, supervisor);
       _markVfsStale();
@@ -2519,6 +3129,18 @@ const __fsMod = (() => {
     }
     const nextUid = _coerceId(uid, syscall, p);
     const nextGid = _coerceId(gid, syscall, p);
+    // chown(2): root changes anything; the owner may only set the group to
+    // one of its own groups, and never the owner. Checked before the local
+    // row changes: that row is what the local permission checks read.
+    if (Number(cred.uid) !== 0) {
+      const stat = _statLadder(absPath);
+      if (stat === undefined) throw _fsErr("ENOENT", syscall, p);
+      const groups = [Number(cred.gid), ...cred.groups.map(Number)];
+      if (Number(stat.uid) !== Number(cred.uid) || nextUid !== Number(stat.uid)
+        || (nextGid !== Number(stat.gid) && !groups.includes(nextGid))) {
+        throw _fsErr("EPERM", syscall, p);
+      }
+    }
     const meta = _metadata(absPath);
     if (meta) { meta.uid = nextUid; meta.gid = nextGid; }
     // The parked write must be registered on the tail BEFORE the chown is
@@ -2535,21 +3157,25 @@ const __fsMod = (() => {
   function lchownSync(p, uid, gid) { _detachStructuralMutation(_chownQueued(p, uid, gid, { followSymlinks: false }, "lchown")); }
   function lchmodSync(p, mode) { chmodSync(p, mode); }
 
+  /**
+   * Whether this process may WANT (r=4, w=2, x=1) a path whose stat is
+   * META, by POSIX's owner/group/other rule. Only a stat that states the
+   * owner, group and mode can be judged; one that does not is not judged in
+   * the process's favour: absent fields used to default to mode 0644 and
+   * owner 1000, which made any undescribed file the reader's own.
+   */
   function _modeAllows(meta, want) {
     if (want === 0) return true;
-    const mode = Number(meta?.mode ?? 0o644) & 0o777;
+    const mode = Number(meta?.mode);
+    const uid = Number(meta?.uid);
+    const gid = Number(meta?.gid);
+    if (!Number.isInteger(mode) || !Number.isInteger(uid) || !Number.isInteger(gid)) return false;
+    const bits = mode & 0o777;
     const currentUid = Number(cred.uid);
-    const currentGid = Number(cred.gid);
+    if (currentUid === 0) return (want & 1) === 0 || (bits & 0o111) !== 0;
     const groups = cred.groups.map(Number);
-    if (currentUid === 0) {
-      if ((want & 1) !== 0 && (mode & 0o111) === 0) return false;
-      return true;
-    }
-    const shift = currentUid === Number(meta?.uid ?? 1000)
-      ? 6
-      : (currentGid === Number(meta?.gid ?? 1000) || groups.includes(Number(meta?.gid ?? 1000))) ? 3 : 0;
-    const available = (mode >> shift) & 7;
-    return (available & want) === want;
+    const shift = currentUid === uid ? 6 : (Number(cred.gid) === gid || groups.includes(gid)) ? 3 : 0;
+    return (((bits >> shift) & 7) & want) === want;
   }
 
   function _ensureAncestorsTraversable(absPath, syscall, p) {
@@ -2563,34 +3189,31 @@ const __fsMod = (() => {
   function _ensureWritable(absPath, syscall, p) {
     _ensureAncestorsTraversable(absPath, syscall, p);
     const cell = _bundleLookup(absPath);
-    const meta = _metadata(absPath);
-    // The ladder rather than existsSync: a write to a path outside the staged
-    // view is a legitimate create, and must not be turned into a refusal by
-    // the check that guards it.
-    if (meta !== undefined || cell !== undefined || _statLadder(absPath) !== undefined) {
-      const denial = _denialCode(cell);
-      if (denial || !_modeAllows(meta, 2)) throw _fsErr(denial || "EACCES", syscall, p);
+    const denial = _denialCode(cell);
+    if (denial) throw _fsErr(denial, syscall, p);
+    // Judged on what the authority says of the path (or of a file this
+    // process made), never on the bytes held under its name.
+    const stat = _statLadder(absPath);
+    if (stat !== undefined) {
+      if (!_modeAllows(stat, 2)) throw _fsErr("EACCES", syscall, p);
       return;
     }
+    // Nothing there: a create, judged by the parent the namespace describes.
 
     const parent = __pathMod.dirname(absPath);
-    const parentMeta = _metadata(parent);
-    if (parentMeta) {
-      if (parentMeta.type && parentMeta.type !== "directory") throw _fsErr("ENOTDIR", syscall, p);
-      if (!_modeAllows(parentMeta, 3)) throw _fsErr("EACCES", syscall, p);
+    const parentStat = _statLadder(parent);
+    if (parentStat !== undefined) {
+      if (!parentStat.isDirectory()) throw _fsErr("ENOTDIR", syscall, p);
+      if (!_modeAllows(parentStat, 3)) throw _fsErr("EACCES", syscall, p);
       return;
     }
 
-    const parentKey = _strip(parent);
-    const parentIsLocal = parent === cwd || parent === "/" ||
-      (!!__vfsDirs && parentKey in __vfsDirs) ||
-      (!!__vfsManifest && parentKey in __vfsManifest);
-    if (parentIsLocal || _supervisor()) return;
     throw _fsErr("ENOENT", syscall, p);
   }
 
   function accessSync(p, mode) {
     const absPath = _resolve(p);
+    _nsRequire("access", p, "fs.promises.access");
     const cell = _bundleLookup(absPath);
     const meta = _metadata(absPath);
     if (cell === undefined && meta === undefined && !existsSync(p)) throw _fsErr("ENOENT", "access", p);
@@ -2601,7 +3224,10 @@ const __fsMod = (() => {
     _ensureAncestorsTraversable(absPath, "access", p);
     const denial = _denialCode(cell);
     if ((requested & 4) !== 0 && denial) throw _fsErr(denial, "access", p);
-    if (!_modeAllows(meta, requested)) throw _fsErr("EACCES", "access", p);
+    if (requested === 0) return;
+    const stat = _statLadder(absPath);
+    if (stat === undefined) throw _fsErr("ENOENT", "access", p);
+    if (!_modeAllows(stat, requested)) throw _fsErr("EACCES", "access", p);
   }
 
   async function _accessAsync(p, mode) {
@@ -2712,42 +3338,12 @@ const __fsMod = (() => {
   // ── existsSync ──
   function existsSync(p) {
     const absPath = _resolve(p);
-    const k = _strip(absPath);
-    if (_metadata(absPath) !== undefined) { _residencySatisfied(absPath); return true; }
-    if (__vfsBundle && k in __vfsBundle) { _residencySatisfied(absPath); return true; }
-    if (__vfsWrites && k in __vfsWrites) { _residencySatisfied(absPath); return true; }
-    if (__vfsDirs && k in __vfsDirs) { _residencySatisfied(absPath); return true; }
-    // W2.5b root-cause fix: consult the manifest BEFORE falling back to
-    // the O(N) bundle-prefix scan. The manifest is uncapped and always
-    // reflects the real directory shape, even when the file content for
-    // a directory's contents was excluded by the 4 MiB / 500-file content
-    if (__vfsManifest) {
-      if (k in __vfsManifest) { _residencySatisfied(absPath); return true; }
-      // Path may be a file listed by its parent's manifest entry.
-      const slash = k.lastIndexOf("/");
-      const parent = slash >= 0 ? k.slice(0, slash) : "";
-      const name = slash >= 0 ? k.slice(slash + 1) : k;
-      const sib = __vfsManifest[parent];
-      if (sib && sib.indexOf(name) !== -1) { _residencySatisfied(absPath); return true; }
-    }
-    // Last-resort: bundle dir entries
-    if (__vfsBundle && (k in __vfsBundle || __residentAnyUnder(k + "/"))) {
-      _residencySatisfied(absPath);
-      return true;
-    }
-    // Nothing found — which is only an answer if the enclosing directory was
-    // enumerated. Node's existsSync never throws, so the false below is
-    // provisional: the miss is recorded, the listing that settles it is pulled
-    // in, and the exit report fails the run if the path turns out to have been
-    // there all along.
-    if (!_absenceIsKnown(absPath)) {
-      _recordUnmapped(absPath, "access");
-      return false;
-    }
+    _nsRequire("access", p, "fs.promises.access");
     _residencySatisfied(absPath);
-    return false;
+    return _statLadder(absPath) !== undefined;
   }
 
+
   // ── statSync ──
   function statSync(p, opts) {
     const absPath = _resolve(p);
@@ -2760,16 +3356,12 @@ const __fsMod = (() => {
   // classify a miss without redoing the resolve and ancestor walk it just
   // performed — that path runs on every module-resolution probe.
   function _statResolved(absPath, p, opts) {
+    _nsRequire("stat", p, "fs.promises.stat");
     const stat = _statLadder(absPath);
-    // An answer settles the path, including the honest "not there" below —
-    // what the ledger is for is reads that went unanswered, not reads that came
-    // back with news the caller did not want. A PROVISIONAL not-there is not an
-    // answer, so the unmapped branch deliberately leaves the record standing.
-    if (stat !== undefined) { _residencySatisfied(absPath); return stat; }
-    // Nothing in the view describes the path, and there are two very different
-    // reasons for that. Only one of them means the file is not there.
-    if (_absenceIsKnown(absPath)) _residencySatisfied(absPath);
-    else _recordUnmapped(absPath, "stat");
+    // An answer settles the path, including the honest "not there": the
+    // namespace names every path this credential can see.
+    _residencySatisfied(absPath);
+    if (stat !== undefined) return stat;
     // Node's statSync honors { throwIfNoEntry: false } by returning undefined
     // for a missing path instead of throwing.
     if (opts && opts.throwIfNoEntry === false) return undefined;
@@ -2782,154 +3374,45 @@ const __fsMod = (() => {
    * MEANS — absence and ignorance are different answers and only one of them
    * is a condition a program can act on, so the callers classify.
    */
-  function _statLadder(absPath) {
+  function _statLadder(absPath, noFollow) {
     const k = _strip(absPath);
-    // Content written this exec session is newer than the spawn-time
-    // metadata snapshot, so it — not __vfsMetadata — is authoritative for
-    // size. Without this, fstatSync/statSync on a file we just wrote report
-    // the pre-write length.
-    if (__vfsWrites && k in __vfsWrites && _denialCode(__vfsWrites[k]) === null) {
-      const meta = _metadata(absPath);
-      const size = _byteLen(__vfsWrites[k]);
-      // Correct only the size — reusing the metadata record keeps the type
-      // and the recorded timestamps stable, so mtime-based change detection
-      // (make, tsc --build, watchers) does not see every call as a change.
-      if (meta) return _statObject({ ...meta, size }, k);
-      return _localStatObject(
-        k, false, false, size, 0o666 & ~__processUmask, cred.uid, cred.gid,
-      );
-    }
-    const metadata = _metadata(absPath);
-    if (metadata) return _statObject(metadata, k);
-    // Check if it's a known directory written this exec session
-    if (__vfsDirs && k in __vfsDirs) {
-      return _localStatObject(k, true, false, 0, 0o777 & ~__processUmask, cred.uid, cred.gid);
-    }
-    // W2.5b: consult uncapped manifest first for directory shape.
-    if (__vfsManifest && k in __vfsManifest) {
-      return _localStatObject(k, true, false, 0, 0o755, cred.uid, cred.gid);
-    }
-    // File with content embedded?
-    const content = _bundleLookup(absPath);
-    if (content !== undefined) {
-      // _byteLen handles both string (UTF-8 encode) and Uint8Array
-      // (byteLength) — fixes binary writes from reporting the
-      // post-corruption byte count.
-      const size = _byteLen(content);
-      return _localStatObject(k, false, false, size, 0o666 & ~__processUmask, cred.uid, cred.gid);
-    }
-    // File listed in parent's manifest but content was capped out — return
-    // a zero-size file stat so callers like fs.stat / fs.statSync see the
-    // file as present (downstream readFileSync will surface ENOENT if it
-    // actually tries to read content; many consumers only need stat).
-    if (__vfsManifest) {
-      const slash = k.lastIndexOf("/");
-      const parent = slash >= 0 ? k.slice(0, slash) : "";
-      const name = slash >= 0 ? k.slice(slash + 1) : k;
-      const sib = __vfsManifest[parent];
-      if (sib && sib.indexOf(name) !== -1) {
-        return _localStatObject(k, false, false, 0, 0o644, cred.uid, cred.gid);
-      }
-    }
-    // Last-resort: bundle prefix scan (legacy path).
-    if (__vfsBundle && __residentAnyUnder(k + "/")) {
-      return _localStatObject(k, true, false, 0, 0o755, cred.uid, cred.gid);
-    }
-    return undefined;
+    _nsRequire("stat", absPath, "fs.promises.stat");
+    const meta = _nsMeta(k, !noFollow);
+    if (meta === "absent" || meta === "ELOOP") return undefined;
+    return meta.own
+      ? _localStatObject(k, meta.type === "directory", false, meta.size, meta.mode & 0o7777, meta.uid, meta.gid)
+      : _statObject(meta, k);
   }
 
   // ── lstatSync (alias for statSync in our VFS — no symlinks) ──
-  function lstatSync(p, opts) { return statSync(p, opts); }
+  function lstatSync(p, opts) {
+    const absPath = _resolve(p);
+    _nsRequire("lstat", p, "fs.promises.lstat");
+    _ensureAncestorsTraversable(absPath, "lstat", p);
+    const stat = _statLadder(absPath, true);
+    if (stat !== undefined) return stat;
+    if (opts && opts.throwIfNoEntry === false) return undefined;
+    throw _fsErr("ENOENT", "lstat", p);
+  }
 
   // ── readdirSync ──
-  // W2.5b root-cause fix: prefer the uncapped __vfsManifest for directory
-  // listings. The legacy bundle-prefix scan is kept as a fallback for paths
-  // not in the manifest (e.g. dirs created at exec time via mkdirSync) and
-  // is unioned with __vfsWrites so newly-written files become visible.
+  // The namespace's listing of the directory, with this process's own
+  // structural effects over it (_nsList).
   function readdirSync(p, opts) {
     const absPath = _resolve(p);
+    _nsRequire("scandir", p, "fs.promises.readdir");
     _ensureAncestorsTraversable(absPath, "scandir", p);
     const metadata = _metadata(absPath);
     if (metadata && !_modeAllows(metadata, 4)) throw _fsErr("EACCES", "scandir", p);
     const k = _strip(absPath);
-    // A listing is the one answer with no way to express doubt: an array is a
-    // complete enumeration by definition, so returning what happens to be
-    // known asserts that nothing else is there. Only a directory the walk
-    // enumerated, or one this process created, can honestly be listed.
-    if (!_dirEnumerated(k) && !_bundleHasChildren(k)) {
-      // An authority exists that this call cannot reach, so an empty array
-      // would be a claim about a directory nothing ever opened. Refuse, and
-      // pull the listing in for the next one.
-      //
-      // This is the one caller that keeps refusing. Everywhere else the sync
-      // view answers a path it cannot map with the not-found the program was
-      // written to handle, provisionally, and lets the exit report settle
-      // whether that answer was true. A listing has no such answer to give:
-      // "no config yet, write one" is an idiom every program implements, and
-      // there is no counterpart for a directory — a caller handed ENOENT for a
-      // template tree has nowhere to go but the same wrong branch an empty
-      // array sent it down, and the array at least it could not detect.
-      if (_supervisor()) {
-        throw _refuseUnmapped(absPath, p, "scandir", "fs.promises.readdir");
-      }
-      // No authority: the staged tables are the whole filesystem. A path they
-      // do not describe is missing, and one they describe with no children is
-      // genuinely empty.
-      if (_statLadder(absPath) === undefined) throw _fsErr("ENOENT", "scandir", p);
-    }
-    const prefix = k ? k + "/" : "";
-    const names = new Set();
-    // 1. Manifest-supplied children (the authoritative source for installed pkgs).
-    if (__vfsManifest && k in __vfsManifest) {
-      for (const n of __vfsManifest[k]) names.add(n);
-    }
-    // 2. Bundle-prefix fallback (covers older paths or runtime-mkdir'd ones
-    //    that aren't in the manifest yet).
-    if (__vfsBundle) {
-      for (const bk of __residentUnder(prefix)) {
-        const seg = bk.substring(prefix.length).split("/")[0];
-        if (seg) names.add(seg);
-      }
-    }
-    // 3. Files written during this exec session.
-    if (__vfsWrites) {
-      for (const wk in __vfsWrites) {
-        if (wk.startsWith(prefix)) {
-          const rest = wk.substring(prefix.length);
-          const seg = rest.split("/")[0];
-          if (seg) names.add(seg);
-        }
-      }
-    }
-    // 4. Dirs created during this exec session.
-    if (__vfsDirs) {
-      for (const dk in __vfsDirs) {
-        if (dk.startsWith(prefix)) {
-          const rest = dk.substring(prefix.length);
-          const seg = rest.split("/")[0];
-          if (seg) names.add(seg);
-        }
-      }
-    }
+    const st = _statLadder(absPath);
+    if (st === undefined) throw _fsErr("ENOENT", "scandir", p);
+    if (!st.isDirectory()) throw _fsErr("ENOTDIR", "scandir", p);
     _residencySatisfied(absPath);
-    const arr = [...names].sort();
-    if (opts?.withFileTypes) {
-      return arr.map(n => {
-        const fp = prefix + n;
-        // Manifest is the definitive isDir source; fall back to bundle scan.
-        // The metadata record sits between them: a directory that was listed
-        // but never walked has no manifest entry of its own, and calling it a
-        // file is how a template tree full of subdirectories reads back as a
-        // tree full of nothing.
-        const isDir =
-          (!!__vfsManifest && fp in __vfsManifest) ||
-          (!!__vfsDirs && fp in __vfsDirs) ||
-          _metadata(fp)?.type === "directory" ||
-          (!!__vfsBundle && __residentAnyUnder(fp + "/"));
-        return _direntObject(n, isDir ? "directory" : "file", absPath);
-      });
-    }
-    return arr;
+    const listed = _nsList(k);
+    const sorted = [...listed.keys()].sort();
+    if (!opts?.withFileTypes) return sorted;
+    return sorted.map((n) => _direntObject(n, listed.get(n), absPath));
   }
 
   // ── mkdirSync ──
@@ -2943,11 +3426,16 @@ const __fsMod = (() => {
     if (opts?.recursive) {
       const parts = k.split("/").filter(Boolean);
       let cur = "";
-      for (const part of parts) { cur = cur ? cur + "/" + part : part; __vfsDirs[cur] = true; created.push(cur); }
+      for (const part of parts) { cur = cur ? cur + "/" + part : part; _noteCreation(cur); __vfsDirs[cur] = true; created.push(cur); }
     } else {
+      _noteCreation(k);
       __vfsDirs[k] = true;
       created.push(k);
     }
+    for (const dir of created) {
+      const was = _nsMeta(dir, true);
+      if (was === "absent") _nsOwnSet(dir, "dir", { hide: true });
+    }
     const queued = _queueStructuralMutation(absPath, "mkdir", p, (supervisor) => supervisor.mkdir(absPath));
     // Told, not merely known locally: _announceLocalDirs must not issue a
     // second mkdir for a directory whose own RPC is already in the queue.
@@ -2957,9 +3445,30 @@ const __fsMod = (() => {
   function mkdirSync(p, opts) { _detachStructuralMutation(_mkdirQueued(p, opts)); }
 
   // ── unlinkSync ──
+  /**
+   * unlink(2)/rmdir(2)/rename(2) of an existing name: the parent must be
+   * writable and searchable, and in a sticky directory (/tmp, 1777) only the
+   * file's owner, the directory's owner or root may remove it. Checked before
+   * the local view changes, so a refusal leaves the process's view intact. A
+   * name whose owner this view does not know is refused as a miss.
+   */
+  function _ensureRemovable(absPath, syscall, p) {
+    _ensureAncestorsTraversable(absPath, syscall, p);
+    const k = _strip(absPath);
+    const parent = _statLadder(__pathMod.dirname(absPath));
+    if (parent === undefined) return;
+    if (!_modeAllows(parent, 3)) throw _fsErr("EACCES", syscall, p);
+    if ((Number(parent.mode) & 0o1000) === 0 || Number(cred.uid) === 0 || Number(parent.uid) === Number(cred.uid)) return;
+    if (_createdHere.has(k)) return;
+    const target = _statLadder(absPath, true);
+    if (target === undefined) return;
+    if (Number(target.uid) !== Number(cred.uid)) throw _fsErr("EPERM", syscall, p);
+  }
+
   function _unlinkQueued(p) {
     const absPath = _resolve(p);
     const k = _strip(absPath);
+    _ensureRemovable(absPath, "unlink", p);
     if (__vfsBundle) delete __vfsBundle[k];
     if (__vfsWrites) delete __vfsWrites[k];
     _forgetSyncPath(k);
@@ -2971,6 +3480,7 @@ const __fsMod = (() => {
   function _rmdirQueued(p) {
     const absPath = _resolve(p);
     const k = _strip(absPath);
+    _ensureRemovable(absPath, "rmdir", p);
     if (__vfsDirs) delete __vfsDirs[k];
     _forgetSyncPath(k);
     return _queueStructuralMutation(
@@ -2985,21 +3495,29 @@ const __fsMod = (() => {
   function _renameQueued(oldP, newP) {
     const oldAbs = _resolve(oldP);
     const newAbs = _resolve(newP);
+    // The name leaves its directory and lands in another (replacing what is
+    // there): both are removals by POSIX's rule.
+    _ensureRemovable(oldAbs, "rename", oldP);
+    if (_statLadder(newAbs, true) !== undefined) _ensureRemovable(newAbs, "rename", newP);
+    else _ensureWritable(newAbs, "rename", newP);
     const oldK = _strip(oldAbs);
     const newK = _strip(newAbs);
+    // The table still holds the old name until the rename is reported, so the
+    // new name reads through to it and the old one reads as gone.
+    const nsFrom = _nsRealKey(oldK);
+    // What this process created travels with the name; what it did not stays
+    // the authority's, whatever the move does to the local tables.
+    const oldPrefix = oldK + "/";
+    const createdMoved = [..._createdHere]
+      .filter((key) => key === oldK || key.startsWith(oldPrefix))
+      .map((key) => newK + key.slice(oldK.length));
     const content = __vfsBundle?.[oldK] ?? __vfsWrites?.[oldK];
     if (content !== undefined) {
       _parkWrite(newK, content);
       if (__vfsBundle) delete __vfsBundle[oldK];
       delete __vfsBundleRevisions[oldK];
       delete __vfsWrites[oldK];
-      // The stat record travels with the content: dropping it would lose the
-      // mode/ownership, and leaving it behind would keep the source path
-      // reporting as an existing file this rename already moved away.
-      const metadata = _metadataTable();
-      const moved = metadata ? metadata[oldK] : undefined;
       _forgetSyncPath(oldK);
-      if (moved) metadata[newK] = moved;
     } else if (__vfsDirs && oldK in __vfsDirs) {
       // A directory this process made travels under its new name, so the
       // sync view stops listing the old one and _announceLocalDirs cannot
@@ -3014,6 +3532,16 @@ const __fsMod = (() => {
       }
       _forgetSyncTree(oldK);
     }
+    _forgetCreation(oldK);
+    _forgetCreation(newK);
+    for (const key of createdMoved) _createdHere.add(key);
+    for (const [ok, entry] of [..._nsOwn]) {
+      if ((ok === oldK || ok.startsWith(oldPrefix)) && entry.state === "dir") {
+        _nsOwnSet(newK + ok.slice(oldK.length), "dir", { hide: entry.hide });
+      }
+    }
+    if (nsFrom !== null && !_nsOwn.has(newK)) _nsOwnSet(newK, "alias", { from: nsFrom });
+    _nsOwnSet(oldK, "absentTree");
     const queued = _queueStructuralMutation(
       oldAbs, "rename", oldP,
       (supervisor) => supervisor.rename(oldAbs, newAbs),
@@ -3180,7 +3708,16 @@ const __fsMod = (() => {
   // Sync realpath stays local and identity-resolves. Async symlink
   // operations use the live supervisor bridge below.
   // .native static is required by TypeScript's getNodeSystem at
-  function realpathSync(p, opts) { return _resolve(String(p)); }
+  function realpathSync(p, opts) {
+    const absPath = _resolve(String(p));
+    _nsRequire("realpath", p, "fs.promises.realpath");
+    const k = _strip(absPath);
+    const meta = _nsMeta(k, true);
+    if (meta === "ELOOP") throw _fsErr("ELOOP", "realpath", p);
+    if (meta === "absent") throw _fsErr("ENOENT", "realpath", p);
+    const real = _nsRealKey(k);
+    return real === null ? absPath : "/" + real;
+  }
   realpathSync.native = realpathSync;
 
   // ── Async variants (thin wrappers returning via callback) ──
@@ -3208,6 +3745,11 @@ const __fsMod = (() => {
     _mkdirAsync(p, opts).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); });
   }
   function unlink(p, cb) { _unlinkAsync(p).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); }); }
+  // The callback form proper-lockfile (via graceful-fs) releases its lock directory with.
+  function rmdir(p, opts, cb) {
+    if (typeof opts === "function") { cb = opts; opts = undefined; }
+    _rmdirAsync(p).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); });
+  }
   function rename(oldP, newP, cb) { _renameAsync(oldP, newP).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); }); }
   function utimes(p, atime, mtime, cb) { _utimesAsync(p, atime, mtime).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); }); }
   function lutimes(p, atime, mtime, cb) { _utimesAsync(p, atime, mtime, { followSymlinks: false }).then(() => { if (cb) cb(null); }).catch((e) => { if (cb) cb(e); }); }
@@ -3264,11 +3806,8 @@ const __fsMod = (() => {
     // Non-resident and non-empty: writing onto a zero-filled base would
     // silently destroy the bytes we cannot see. Refuse instead.
     if (st !== undefined && st.size !== 0) throw _notResidentError(absPath, p, syscall, asyncForm);
-    // Absent or empty — an empty base IS the true prior content, but only
-    // where absence is knowledge. A path the view never mapped may hold bytes
-    // this process cannot see, and an O_APPEND descriptor onto a zero-filled
-    // base would overwrite the file with the fragment it meant to add.
-    if (st === undefined && !_absenceIsKnown(absPath)) throw _refuseUnmapped(absPath, p, syscall, asyncForm);
+    // Absent or empty: an empty base is the true prior content (the namespace
+    // names every path this credential can see).
     return new Uint8Array(0);
   }
 
@@ -3531,6 +4070,10 @@ const __fsMod = (() => {
     if (!exists && !fl.create) throw _fsErr("ENOENT", "open", path);
     if (exists && fl.create && fl.exclusive) throw _fsErr("EEXIST", "open", path);
     let size = liveMeta ? (Number(liveMeta.size) || 0) : (localStat ? localStat.size : 0);
+    // The authority answered, so what it said is what the sync view keeps:
+    // its stat when something is there, and when nothing is, the file this
+    // open creates is the process's own.
+    if (!liveMeta && supervisor && !localStat) _createdHere.add(_strip(absPath));
     if (!exists) {
       await _writeFileAsync(path, new Uint8Array(0));
       if (mode !== undefined && mode !== null) {
@@ -3555,6 +4098,7 @@ const __fsMod = (() => {
     if (!exists && !fl.create) throw _fsErr("ENOENT", "open", path);
     if (exists && fl.create && fl.exclusive) throw _fsErr("EEXIST", "open", path);
     if (fl.write || !exists) _ensureWritable(absPath, "open", path);
+    if (!exists) _noteCreation(_strip(absPath));
     let size = exists ? st.size : 0;
     // O_TRUNC means "make it empty", so zeroing is the requested semantic,
     // and creating a genuinely absent file is too. O_APPEND must NEVER
@@ -3683,7 +4227,10 @@ const __fsMod = (() => {
   function fchmodSync(fd, mode) {
     if (_isStdioFd(fd)) throw _fsErr("EINVAL", "fchmod", fd);
     const handle = _fdHandle(fd, "fchmod");
-    _localModes[_strip(handle._abs)] = _coerceMode(mode, "fchmod", handle._path);
+    const k = _strip(handle._abs);
+    _ensureModeOwner(handle._abs, "fchmod", handle._path);
+    _localModes[k] = _coerceMode(mode, "fchmod", handle._path);
+    _pendingModes.add(k);
   }
   function fchownSync(fd, uid, gid) {
     if (_isStdioFd(fd)) throw _fsErr("EINVAL", "fchown", fd);
@@ -4023,15 +4570,16 @@ const __fsMod = (() => {
       // not just the local cache — is required so a subsequent async fs op
       // (e.g. fs.promises.rename of a copied file, as create-cloudflare
       // does for __dot__gitignore) sees the copy in the VFS instead of
-      // ENOENT.
-      __vfsDirs[destK] = true;
+      // ENOENT. Each directory is made as mkdir makes it, so the namespace's
+      // overlay lists it for the writes beneath it.
+      await _mkdirAsync("/" + destK, { recursive: true });
       const walk = async (relDir) => {
         const absDir = relDir ? srcAbs + "/" + relDir : srcAbs;
         const ents = await _readdirAsync(absDir, { withFileTypes: true });
         for (const ent of ents) {
           const rel = relDir ? relDir + "/" + ent.name : ent.name;
           if (ent.isDirectory && ent.isDirectory()) {
-            __vfsDirs[destK + "/" + rel] = true;
+            await _mkdirAsync("/" + destK + "/" + rel, { recursive: true });
             await walk(rel);
           } else {
             await _writeFileAsync("/" + destK + "/" + rel, await _readFileAsync(srcAbs + "/" + rel));
@@ -4204,7 +4752,7 @@ const __fsMod = (() => {
     openSync, closeSync, readSync, writeSync, fstatSync, ftruncateSync, fsyncSync, fdatasyncSync,
     futimesSync, fchmodSync, fchownSync, readvSync, writevSync,
     open, close, read, write, fstat, ftruncate, fsync, fdatasync, fchmod, futimes, readv, writev,
-    readFile, writeFile, appendFile, stat, lstat, readdir, exists, mkdir, unlink, rename, utimes, lutimes, chmod, lchmod, chown, lchown, fchown, access,
+    readFile, writeFile, appendFile, stat, lstat, readdir, exists, mkdir, unlink, rmdir, rename, utimes, lutimes, chmod, lchmod, chown, lchown, fchown, access,
     rm, cp, truncate, copyFile, mkdtemp, link, symlink, readlink, realpath, opendir, statfs,
     Dirent: __Dirent,
     Dir: __Dir,
@@ -4381,8 +4929,7 @@ const __NimbusRelayedWebSocket = (() => {
           // The barrier the whole relay exists for. Every frame is now a
           // supervisor reply, so it can carry the invalidation delta, and
           // user code runs only after the resident set has caught up.
-          const acquire = globalThis.__nimbusVfsAcquireBarrier;
-          if (typeof acquire === "function") await acquire();
+          await __nimbusInboundBarrier();
           this._deliver(event);
         }
       }
@@ -6138,9 +6685,14 @@ const __undiciMod = (() => {
 // ──  util module ────────────────────────────────────────────────────
 // ═══════════════════════════════════════════════════════════════════════
 const __utilMod = {
-  inspect: (o, opts) => { try { return JSON.stringify(o, null, 2); } catch { return String(o); } },
-  format: (fmt, ...a) => {
-    if (typeof fmt !== "string") return [fmt, ...a].map(__fmt).join(" ");
+  inspect: (o, opts) => {
+    if (o !== null && typeof o === "object" && __isErrorValue(o)) return __fmtError(o, new Set());
+    try { return JSON.stringify(o, null, 2); } catch { return String(o); }
+  },
+  format: (...args) => {
+    if (args.length === 0) return "";
+    const [fmt, ...a] = args;
+    if (typeof fmt !== "string") return args.map(__fmt).join(" ");
     let i = 0;
     return fmt.replace(/%[sdifjoO%]/g, (m) => {
       if (m === "%%") return "%";
@@ -6149,7 +6701,7 @@ const __utilMod = {
       if (m === "%s") return String(v);
       if (m === "%d" || m === "%i" || m === "%f") return Number(v).toString();
       if (m === "%j") { try { return JSON.stringify(v); } catch { return "[Circular]"; } }
-      if (m === "%o" || m === "%O") { try { return JSON.stringify(v, null, 2); } catch { return String(v); } }
+      if (m === "%o" || m === "%O") return __utilMod.inspect(v);
       return String(v);
     }) + (i < a.length ? " " + a.slice(i).map(__fmt).join(" ") : "");
   },
@@ -6416,11 +6968,31 @@ const __utilMod = {
 // (set+restored by __loadModule per call). When set, the fallback becomes
 // "file:///" + __currentModulePath so relative URLs resolve against
 // the real on-VFS module location — restoring proper import.meta.url
+//
+// The leniency is scoped to calls that PASSED a base. `new URL(x)` with one
+// argument is Node's strict absolute-URL parse: it throws
+// TypeError [ERR_INVALID_URL] for anything that is not already a URL, and
+// that throw is load-bearing rather than incidental. Node's own ESM
+// resolver — and every vendored copy of it, including exsolve, which is what
+// `nuxt dev` resolves `@nuxt/kit` and `nuxt` with — spells the
+// bare-specifier test as
+//     try { resolved = new URL(specifier); } catch { packageResolve(…); }
+// Swallowing the throw made `new URL("@nuxt/kit")` answer
+// file:///@nuxt/kit, so moduleResolve never reached packageResolve and
+// finalizeResolution stat'd /@nuxt/kit — the FILESYSTEM ROOT — instead of
+// walking <from>/node_modules. Two syscalls and every bare import in the
+// project was unresolvable. The bundler breakage this wrapper exists for
+// (`new URL(rel, import.meta.url)` where the rolldown/esbuild polyfill
+// reduced import.meta.url to null/undefined) is always a two-argument call,
+// so requiring the base argument keeps that fix and restores Node's
+// contract for the one-argument form. URL.canParse, which is bound
+// straight off the native constructor below, already answered false for
+// these strings; the constructor now agrees with it.
 (() => {
   const _Orig = globalThis.URL;
   class _Shim extends _Orig {
     constructor(input, base) {
-      if (base == null && typeof input === "string") {
+      if (arguments.length >= 2 && base == null && typeof input === "string") {
         try { super(input); return; }
         catch {
           // X.5-M3: prefer current module path when known, so
@@ -7002,6 +7574,13 @@ const __childProcessMod = (() => {
   /**
    * Read-loop for a single fd. Long-polls cpReadOutput, pushes chunks
    * into the Readable via .push, handles closure.
+   *
+   * What the child printed, and that it closed the stream, is news from
+   * another process, which may have written files before it printed. So a
+   * reply that delivers anything takes the barrier first, and a 'data'
+   * handler that reads what the child wrote reads it current. The poll sends
+   * this process's ACQUIRE arguments and the reply carries the answer, so the
+   * barrier costs no round trip of its own.
    */
   async function _runReadLoop(child, fd, stream, sinceSeqRef) {
     // Exponential backoff for idle children: start at 100ms, double up
@@ -7014,12 +7593,14 @@ const __childProcessMod = (() => {
     while (HAS_SUPERVISOR && child.pid && !child._streamsClosed) {
       try {
         const r = await __nimbusUseRpcResult(
-          __supervisor.cpReadOutput(child.pid, fd, sinceSeqRef.value, backoff),
+          __supervisor.cpReadOutput(child.pid, fd, sinceSeqRef.value, backoff, __nimbusVfsAcquireArgs()),
           (result) => result,
         );
-        if (r && Array.isArray(r.chunks) && r.chunks.length > 0) {
+        const chunks = r && Array.isArray(r.chunks) ? r.chunks : [];
+        if (chunks.length > 0 || (r && r.closed)) await __nimbusInboundBarrier(r.acquired);
+        if (chunks.length > 0) {
           backoff = 100;  // reset — child is producing
-          for (const c of r.chunks) {
+          for (const c of chunks) {
             // The queue hands back bytes; a Readable given a string would
             // encode it again.
             stream.write(__BufferMod.from(c.data));
@@ -7047,16 +7628,19 @@ const __childProcessMod = (() => {
 
   /**
    * Wait-loop: long-poll cpWait until the child reports exit. Emits
-   * 'exit' once stamped.
+   * 'exit' once stamped, behind the barrier: a child's exit is how a parent
+   * learns the files it wrote are there. Answered on the reply, as for the
+   * child's output.
    */
   async function _runWaitLoop(child) {
     while (HAS_SUPERVISOR && child.pid && !child._exitFired) {
       try {
         const r = await __nimbusUseRpcResult(
-          __supervisor.cpWait(child.pid, 1000),
+          __supervisor.cpWait(child.pid, 1000, __nimbusVfsAcquireArgs()),
           (result) => result,
         );
         if (r && r.done) {
+          await __nimbusInboundBarrier(r.acquired);
           child.exitCode = r.exitCode;
           child.signalCode = r.signal;
           child._exitFired = true;
@@ -7237,7 +7821,7 @@ const __childProcessMod = (() => {
    *      stdout/stderr/exit events fire. Callers like cross-spawn.sync
    *      that read result.status get null until the spawn settles.
    *   3. When the parent facet's main drain settles __pendingIO before
-   *      reportExit (facet-manager.ts), the result object's fields are
+   *      reportExit (facets/manager.ts), the result object's fields are
    *      filled in by the time the supervisor sees the parent exit.
    *
    * Cross-spawn.sync's typical pattern is "const r = spawnSync(...);
@@ -7580,7 +8164,7 @@ function __makeProcessStdin() {
         // facet, so counting it as in-flight work would mean the entry drain
         // never sees the program finish.
         packet = await __nimbusUseRpcResultUnref(
-          __supervisor.cpReadStdin(liveChildPid, 1000),
+          __supervisor.cpReadStdin(liveChildPid, 1000, __nimbusVfsAcquireArgs()),
           (result) => result,
         );
         readFailures = 0;
@@ -7597,6 +8181,18 @@ function __makeProcessStdin() {
         await new Promise((resolve) => setTimeout(resolve, 500));
         continue;
       }
+      // A packet that delivers anything — input, its end, a signal, a resize
+      // — hands the program news from outside it, and whatever sent the news
+      // may have written files first (a shell's `echo v2 > f` before the
+      // keystroke, the editor's save before the signal). So it takes the
+      // barrier before any handler sees it. The poll sent this process's
+      // ACQUIRE arguments and the packet carries the answer, so a keystroke
+      // costs no round trip of its own. An empty poll delivers nothing and
+      // costs nothing.
+      if (packet && (packet.resize || packet.signal || packet.ended
+          || (packet.data && packet.data.byteLength > 0))) {
+        await __nimbusInboundBarrier(packet.acquired);
+      }
       if (packet && packet.resize) {
         __nimbusTtyColumns = Number(packet.resize.columns) || __nimbusTtyColumns;
         __nimbusTtyRows = Number(packet.resize.rows) || __nimbusTtyRows;
@@ -7713,6 +8309,7 @@ function __makeProcessOutputStream(streamName) {
     errored: null,
     write(d, enc, cb) {
       if (typeof enc === "function") cb = enc;
+      if (__nimbusProgramStopped) return true;
       // The reported result is text; decode the bytes at this edge only.
       const s = __nimbusOutText(streamName, __nimbusOutBytes(d, enc));
       if (streamName === "stderr") stderr += s;
@@ -7758,6 +8355,8 @@ function __makeProcessOutputStream(streamName) {
 function __nimbusReportProcessExit(code, reason) {
   if (__nimbusProcessExitReported) return;
   __nimbusProcessExitCode = Number(code ?? 0);
+  __nimbusProgramStopped = true;
+  try { if (typeof globalThis.__nimbusStopProgramTimers === "function") globalThis.__nimbusStopProgramTimers(); } catch {}
   try { if (__nimbusProcessExitResolve) __nimbusProcessExitResolve(__nimbusProcessExitCode); } catch {}
   // Generated lifecycle owners defer the terminal supervisor report until
   // their durability boundary has drained. Reporting here would retire the
@@ -7797,7 +8396,7 @@ const __processMod = {
   chdir: (d) => { cwd = __pathMod.resolve(cwd || "/home/user", d); },
   exit: (code) => {
     exitCode = code ?? 0;
-    try { __processEvents.emit("exit", exitCode); } catch {}
+    __nimbusEmitExit(exitCode);
     __nimbusReportProcessExit(exitCode, "");
     throw new __ProcessExit(exitCode);
   },
@@ -8211,14 +8810,27 @@ builtins.http = (() => {
       return new __hostResponse("Nimbus: no HTTP server is listening in this process", { status: 502 });
     }
     const url = new URL(request.url);
+    // The request carries the answer to its own barrier (below). It is
+    // Nimbus's, not the program's, so the program does not see it.
+    let delivered;
+    try { delivered = JSON.parse(request.headers.get("X-Nimbus-Vfs-Acquired") || "null"); } catch {}
     const headers = {};
-    request.headers.forEach((v, k) => { headers[k] = v; });
+    request.headers.forEach((v, k) => { if (k !== "x-nimbus-vfs-acquired") headers[k] = v; });
     // Bytes, not text: a UTF-8 decode corrupts every binary upload, and the
     // decoded string is not the TypedArray receiver Buffer methods require.
     let body = null;
     if (request.method !== "GET" && request.method !== "HEAD") {
       body = new Uint8Array(await request.arrayBuffer());
     }
+    // A request is a resumption like any other, and often the second half of
+    // a causal chain — `echo v2 > f; curl :3000` — so the handler runs behind
+    // the barrier, after the body has arrived. Sited here, in the dispatch
+    // every resident's server shares, not in a caller that happens to yield
+    // through a barriered timer on the way. The supervisor routed it, so it
+    // arrives with an answer, which is enough when no write preceded the
+    // request since this process last caught up (session/rpc.ts
+    // _acquireForRoutedRequest); otherwise the barrier asks.
+    await __nimbusInboundBarrier(delivered);
     const res = server._handleRequest(url.pathname + url.search, request.method, headers, body);
     // Return once headers are known. A handler that never sends headers is
     // bounded by a header timeout (NOT a body-finish cap) so a hung handler
@@ -9053,38 +9665,12 @@ builtins["node:util/types"] = builtins["util/types"];
 // skips it via the same FACET_PROVIDED_PACKAGES list.
 builtins.undici = __undiciMod;
 
-/**
- * A cell's dynamic import() call.
- *
- * A cell is compiled with new Function, so an import() left in its body
- * is the RUNTIME's: it resolves against the module map and hands back the
- * platform's own builtins, not this process's. Real Vite reaches
- * node:http that way (config.js:14968), got a server whose listen bound no
- * port here, and the facet exited with no handles the moment boot returned.
- *
- * The ESM→CJS rewriter routes those calls here with the cell's own
- * require, so resolution is the one the process already has. The result is
- * shaped as a module namespace, since import() resolves to one and callers
- * destructure named exports off it.
- */
-globalThis.__nimbusCellImport = (req, id) => Promise.resolve().then(() => {
-  const loaded = req(id);
-  if (loaded && (loaded.__esModule || loaded[Symbol.toStringTag] === "Module")) return loaded;
-  // A CJS module's exports ARE the namespace's named exports, with the whole
-  // object as the default export — what an ESM importer of a CJS module sees.
-  if (loaded && (typeof loaded === "object" || typeof loaded === "function")) {
-    const ns = Object.create(null);
-    for (const key of Object.keys(loaded)) ns[key] = loaded[key];
-    if (!("default" in ns)) ns.default = loaded;
-    Object.defineProperty(ns, Symbol.toStringTag, { value: "Module" });
-    return ns;
-  }
-  return { default: loaded };
-});
 // ═══════════════════════════════════════════════════════════════════════
 // ──  require() — full Node.js module resolution ─────────────────────
 // ═══════════════════════════════════════════════════════════════════════
 const __moduleCache = new Map();
+// package → why the package ABI policy says it cannot run here (wasm-swap-registry.ts).
+const __nimbusAbiAdvisories = new Map([["sharp","Native libvips bindings; not portable to Workers. … try: no Workers-compatible target — render server-side or use Cloudflare Images. For the wasm32 build see @img/sharp-wasm32 entry below."],["sqlite3","Native sqlite3 .node binding. … try: better-sqlite3-wasm (untested by Nimbus) or sql.js once wasm asset loading is available."],["better-sqlite3","Native sqlite .node binding. … try: better-sqlite3-wasm (untested by Nimbus) or @libsql/client if its subpath exports resolve in your project."],["canvas","Native Cairo bindings. … try: canvaskit-wasm (Skia -> WASM, canvas-API-compatible, ~7MB; untested by Nimbus) or @resvg/resvg-wasm for SVG."],["sodium-native","Native libsodium. … try: tweetnacl (pure JS, untested by Nimbus) or libsodium-wrappers (WASM, untested by Nimbus)."],["node-pty","PTY syscalls unavailable in workerd. … try: no Workers-compatible target — use the Nimbus built-in shell."],["robotjs","Desktop automation; sandboxed Workers cannot access OS UI. … try: no Workers-compatible target."],["electron","Embedded Chromium runtime; not applicable to Workers. … try: no Workers-compatible target."],["bcrypt","Native bcrypt; pure-JS bcryptjs has an equivalent sync API but the require() name differs and Nimbus does not yet support npm aliases. … try: change `require(\"bcrypt\")` to `require(\"bcryptjs\")`, then `npm install bcryptjs`. APIs are sync-compatible."],["argon2","Native Argon2 C bindings. … try: hash-wasm for argon2d, argon2i, and argon2id."],["node-sass","Native libsass; deprecated upstream. … try: sass (dart-sass, pure JS)."],["grpc","Deprecated native gRPC. … try: @grpc/grpc-js (pure JS, untested end-to-end in Nimbus)."],["@swc/core","Native Rust SWC. … try: @swc/wasm-web for transform/parse only; it does not provide the native Plugin API."],["prisma","Native query engine; not portable to Workers in this configuration. … try: @prisma/adapter-d1 (Prisma official Workers adapter, untested by Nimbus), or migrate to drizzle-orm + @libsql/client (untested by Nimbus)."],["@prisma/client","Same as `prisma` (native query engine). … try: @prisma/adapter-d1 (untested by Nimbus), or drizzle-orm + @libsql/client (untested)."],["puppeteer","Bundled Chromium binary (~150 MB). … try: no Workers-compatible target for the bundled binary — use puppeteer-core + Cloudflare Browser Rendering (untested by Nimbus)."],["playwright","Bundled browsers (~300 MB). … try: no Workers-compatible target for bundled browsers — use @playwright/test against a remote browser endpoint (untested by Nimbus)."],["sql.js","Installs but fails at runtime because dist/sql-wasm.wasm is not available to the runtime loader. … try: For SQL in Workers, consider Cloudflare D1 or @libsql/client."],["@swc/wasm-web","Installs but fails at runtime because its generated code path depends on workerd-blocked dynamic code generation. … try: For ESM transforms consider esbuild-wasm."],["@img/sharp-wasm32","WASM build of sharp; package is wasm32-cpu-only and libvips initThreads() requires pthread support unavailable in Workers. … try: wasm-vips may work for simple pipelines; for complex pipelines, render server-side and ship pixels."],["@napi-rs/canvas","Native bindings only (linux-x64-gnu/musl, darwin-arm64/x64, android-arm64, linux-arm64-gnu/musl, win32-x64-msvc, linux-arm-gnueabihf). No WASM build published. … try: canvaskit-wasm (Skia -> WASM, canvas-API-compatible, ~7MB; untested by Nimbus) or @resvg/resvg-wasm for SVG."],["@napi-rs/canvas-wasm32-wasi","@napi-rs/canvas does not publish a wasm32-wasi variant on npm (404). The @napi-rs/canvas project ships only native bindings. No WASM/WASI build exists. … try: canvaskit-wasm (Skia -> WASM, canvas-API-compatible; untested by Nimbus) or @resvg/resvg-wasm for SVG."],["@tailwindcss/oxide","Native Rust Tailwind v4 oxide engine; ships only platform-specific .node bindings plus a wasm32-wasi shard. workerd has no node:wasi, and bare native bindings cannot dlopen. … try: no Workers-compatible target — Tailwind v3 (`tailwindcss@^3`) is pure JS and works in Workers (untested by Nimbus). Tailwind v4 inherently requires the Rust oxide engine."],["lightningcss","Native Rust CSS parser; ships platform-specific .node bindings plus a wasm32-wasi-only `lightningcss-wasm` package. workerd has no node:wasi, and the package probes libc through child_process.execSync. … try: no Workers-compatible target today — postcss + cssnano (pure JS, untested by Nimbus) cover most lightningcss use cases. For CSS minification only: clean-css (pure JS, untested by Nimbus)."],["rolldown","Native Rust bundler that Vite 8 loads at startup. Its only non-native build, @rolldown/binding-wasm32-wasi, is a wasm32-wasip1-threads binary, and Workers run one thread per isolate with Atomics.wait disabled. … try: no Workers-compatible target — rolldown publishes no single-threaded build, so tools that load Vite 8 themselves (Astro 7) cannot start here."],["@rolldown/binding-wasm32-wasi","wasm32-wasip1-threads build of rolldown: it imports a shared memory and wasi thread-spawn, its Rust locks and thread parking execute memory.atomic.wait32, and its loader needs node:wasi and worker_threads. Workers run one thread per isolate with Atomics.wait disabled. … try: no Workers-compatible target — rolldown publishes no single-threaded build."]]);
 
 /**
  * Direct VFS bundle access for module resolution.
@@ -9110,24 +9696,8 @@ function __readFileOr(path, fallback) {
 }
 function __fileExists(path) {
   const k = path.replace(/^\/+/, "");
-  if (__vfsBundle && k in __vfsBundle) return true;
-  if (__vfsWrites && k in __vfsWrites) return true;
-  if (__vfsDirs && k in __vfsDirs) return true;
-  // Consult the uncapped manifest (directory shape) so resolution sees
-  // installed files whose content was excluded from the bounded snapshot
-  // (e.g. web-streams-polyfill's ponyfill/package.json, reached via a
-  // parent-relative main). Mirrors existsSync's manifest probe.
-  if (__vfsManifest) {
-    if (k in __vfsManifest) return true;
-    const slash = k.lastIndexOf("/");
-    const parent = slash >= 0 ? k.slice(0, slash) : "";
-    const name = slash >= 0 ? k.slice(slash + 1) : k;
-    const sib = __vfsManifest[parent];
-    if (sib && sib.indexOf(name) !== -1) return true;
-  }
-  // Check for directory by looking for any key with this prefix
-  if (__vfsBundle && __residentAnyUnder(k + "/")) return true;
-  return false;
+  // The namespace answers exactly (vfs/facet-resident-store.ts).
+  return __fsMod.existsSync("/" + k);
 }
 // W3.5 Fix A: strict-file membership probe. __fileExists also returns true for
 // directories (it has to — __resolveNodeModule and __resolveImportsField call
@@ -9139,26 +9709,8 @@ function __fileExists(path) {
 // the fastify ret/dist/types failure.
 function __pathIsFile(path) {
   const k = path.replace(/^\/+/, "");
-  if (__vfsBundle && k in __vfsBundle) return true;
-  if (__vfsWrites && k in __vfsWrites) return true;
-  // Consult the manifest as a strict-file probe: a name listed in its
-  // parent's manifest entry is a file (directories are manifest KEYS).
-  // This lets resolution find files whose content was excluded from the
-  // bounded snapshot without re-introducing the directory short-circuit
-  // (__vfsManifest[k] being a directory key is deliberately NOT matched).
-  if (__vfsManifest) {
-    const slash = k.lastIndexOf("/");
-    const parent = slash >= 0 ? k.slice(0, slash) : "";
-    const name = slash >= 0 ? k.slice(slash + 1) : k;
-    const sib = __vfsManifest[parent];
-    if (sib && sib.indexOf(name) !== -1 && !(k in __vfsManifest)) return true;
-  }
-  // Last resort: the full fs view (live SQLite VFS) for paths outside the
-  // bounded snapshot/manifest entirely — e.g. the /tmp/.npx-cache tree,
-  // which the project snapshot never covers. stat-as-file only.
-  try { const st = __fsMod.statSync("/" + k); if (st && st.isFile && st.isFile()) return true; } catch {}
-  // Deliberately does NOT consult __vfsDirs nor do the prefix scan.
-  return false;
+  const st = __fsMod.statSync("/" + k, { throwIfNoEntry: false });
+  return !!st && st.isFile();
 }
 function __resolveFile(base) {
   // Mirrors Node's LOAD_AS_FILE + LOAD_AS_DIRECTORY (require_2 spec):
@@ -9231,15 +9783,12 @@ function __resolveFile(base) {
 }
 
 // __compiledModules is defined at MODULE TOP LEVEL in the generator code
-// (facet-manager.ts) so new Function() runs during module evaluation.
+// (facets/manager.ts) so new Function() runs during module evaluation.
 
 // ── Single-source-of-truth exports/imports resolver (W2) ───────────────
 // Emitted from src/_shared/exports-resolver.ts via getExportsResolverJS().
 // Declares: resolveExports, resolveConditionValue, resolvePackageEntry,
 //           DEFAULT_ESM_CONDITIONS, DEFAULT_CJS_CONDITIONS.
-// the prior hand-rolled __resolvePkgEntry only honoured top-level
-// require|default|import and dropped subpath maps, wildcards, nested
-// conditions, the imports field, and null-target enforcement.
 
 // ── exports-resolver.js (auto-generated; keep in sync with src/_shared/exports-resolver.ts) ──
 const DEFAULT_ESM_CONDITIONS = ['import', 'module', 'browser', 'default'];
@@ -9335,6 +9884,14 @@ function resolvePackageEntry(pkg, subpath, conditions) {
   }
   return subpath;
 }
+
+function packageSelfReferenceSubpath(pkg, specifier) {
+  if (!pkg || typeof pkg.name !== 'string' || pkg.name.length === 0) return null;
+  if (pkg.exports === undefined || pkg.exports === null) return null;
+  if (specifier === pkg.name) return '.';
+  if (!specifier.startsWith(pkg.name + '/')) return null;
+  return '.' + specifier.slice(pkg.name.length);
+}
 // ── end exports-resolver.js ────────────────────────────────────────────
 
 
@@ -9386,8 +9943,8 @@ function __resolvePkgSubpath(pkgDir, pkg, subpath) {
   }
   let entry = resolvePackageEntry(pkg, subpath, __NIMBUS_CJS_CONDITIONS);
   // X.5-F R3: ESM-condition fallback for pure-ESM packages whose
-  // dist/.mjs files were transformed to CJS by transformEsmInBundle
-  // at install time (facet-manager.ts:842, W3.5 Fix B). Without this,
+  // dist/.mjs files were transformed to CJS
+  // by transformEsmInBundle (facets/manager.ts). Without this,
   // packages like nuxt — whose exports map only contains
   // {types, import} for the root subpath — return null from the CJS
   // walk and dead-end with "Cannot find module 'nuxt'" even though
@@ -9430,10 +9987,6 @@ function __resolvePkgSubpath(pkgDir, pkg, subpath) {
   return __resolveFile(pkgDir + "/" + rel);
 }
 
-/** Back-compat name used elsewhere in this file. */
-function __resolvePkgEntry(pkgDir) {
-  return __resolvePkgSubpath(pkgDir, null, ".");
-}
 
 /**
  * Resolve a bare specifier (e.g. "react", "@scope/pkg", "pkg/sub/path")
@@ -9482,32 +10035,23 @@ function __resolveNodeModule(name, fromDir) {
 }
 
 /**
- * Resolve a #name imports-field specifier from the nearest enclosing
- * package.json. Returns the resolved file or null.
+ * Node's "package scope" of a directory (readPackageScope): the nearest
+ * enclosing package.json, walking up from fromDir. The FIRST package.json
+ * found is the scope, even when it lacks the field the caller wants — the
+ * imports field and the self-reference rule both belong to the importing
+ * module's own package, never to an ancestor past it. The walk never
+ * crosses a node_modules directory: a file that sits directly under one
+ * belongs to no package, not to the project above it. Returns { dir, pkg }
+ * (pkg null when the file is unparseable) or null when no package.json
+ * encloses fromDir.
  */
-function __resolveImportsField(name, fromDir) {
-  // Walk up looking for the nearest package.json. Stop at the first one
-  // (Node spec: imports field of the importing module's package).
+function __nearestPackageScope(fromDir) {
   let dir = (fromDir || "").replace(/^\/+/, "");
   while (true) {
+    if (dir === "node_modules" || dir.endsWith("/node_modules")) return null;
     const pkgJsonPath = (dir ? dir + "/" : "") + "package.json";
     if (__fileExists(pkgJsonPath)) {
-      const pkg = __readPkgJson(dir);
-      if (pkg && pkg.imports) {
-        const target = resolveExports(pkg.imports, name, __NIMBUS_CJS_CONDITIONS);
-        if (target) {
-          // Imports targets are relative to the package root (dir)
-          if (target.startsWith("./")) {
-            return __resolveFile((dir ? dir + "/" : "") + target.slice(2));
-          }
-          if (target.startsWith("/")) {
-            return __resolveFile(target.slice(1));
-          }
-          // Bare specifier — re-resolve as a node_module from this dir
-          return __resolveNodeModule(target, dir);
-        }
-      }
-      return null; // first package.json wins, even if no imports field
+      return { dir, pkg: __readPkgJson(dir) };
     }
     if (!dir) return null;
     const lastSlash = dir.lastIndexOf("/");
@@ -9515,38 +10059,96 @@ function __resolveImportsField(name, fromDir) {
   }
 }
 
+/**
+ * Resolve a #name imports-field specifier from the nearest enclosing
+ * package.json. Returns the resolved file or null.
+ */
+function __resolveImportsField(name, fromDir) {
+  // First package.json wins, even if no imports field (Node spec: imports
+  // field of the importing module's package).
+  const scope = __nearestPackageScope(fromDir);
+  if (!scope || !scope.pkg || !scope.pkg.imports) return null;
+  const dir = scope.dir;
+  const target = resolveExports(scope.pkg.imports, name, __NIMBUS_CJS_CONDITIONS);
+  if (!target) return null;
+  // Imports targets are relative to the package root (dir)
+  if (target.startsWith("./")) {
+    return __resolveFile((dir ? dir + "/" : "") + target.slice(2));
+  }
+  if (target.startsWith("/")) {
+    return __resolveFile(target.slice(1));
+  }
+  // Bare specifier — re-resolve as a node_module from this dir
+  return __resolveNodeModule(target, dir);
+}
+
+/**
+ * Node's LOAD_PACKAGE_SELF: a bare specifier naming the enclosing package
+ * itself (`require('<its-name>')`, `require('<its-name>/sub')`) resolves
+ * through that package's own `exports` map — only when the nearest
+ * package.json has `exports` AND its `name` matches, and only through
+ * `exports` (no main/index probing: a subpath the map does not expose is
+ * not exported). Sits between the imports-field branch and the
+ * node_modules walk, where Node puts it. Returns the resolved file or null.
+ *
+ * Conditions are the ones the node_modules walk uses for the same
+ * require: the runtime's CJS set first, the ESM set when the map exposes
+ * the subpath only under `import` (dynamic import() is lowered onto this
+ * require chain, see __resolvePkgSubpath).
+ *
+ * Tri-state, as in Node: null when the rule does not apply (the caller
+ * walks node_modules); { resolved: null } when the enclosing package claims
+ * the name but its map does not expose the subpath or the target is
+ * missing — Node throws ERR_PACKAGE_PATH_NOT_EXPORTED / MODULE_NOT_FOUND
+ * there and never consults node_modules, so neither does the caller.
+ */
+function __resolvePackageSelf(name, fromDir) {
+  const scope = __nearestPackageScope(fromDir);
+  if (!scope || !scope.pkg) return null;
+  const subpath = packageSelfReferenceSubpath(scope.pkg, name);
+  if (subpath === null) return null;
+  let entry = resolveExports(scope.pkg.exports, subpath, __NIMBUS_CJS_CONDITIONS);
+  if (entry == null) entry = resolveExports(scope.pkg.exports, subpath, DEFAULT_ESM_CONDITIONS);
+  if (entry == null) return { resolved: null };
+  return { resolved: __resolveFile((scope.dir ? scope.dir + "/" : "") + entry.replace(/^\.\/+/, "")) };
+}
+
 // ═══════════════════════════════════════════════════════════════════════
-// ──  X.5-S: __mkCompiledFn — conditional-param-rename wrap for new Function
+// ──  __mkCompiledFn — the request-time fallback compile ──────────────
 // ═══════════════════════════════════════════════════════════════════════
-//
-// vite's chunks/node.js (transitive bundle of open@10.2.0) contains the
-// ESM idiom `const __dirname = path.dirname(fileURLToPath(import.meta.url))`.
-// W3.5 Fix B's esbuild ESM→CJS transform preserves that line verbatim
-// while substituting `import.meta` with `const import_meta = {}`. Wrapping
-// the body in `new Function("exports","require","module","__filename","__dirname", code)`
-// then collides at parse time:
-//
-//     SyntaxError: Identifier '__dirname' has already been declared
-//
-// (VERIFY-23417C5 §4 #1 / X5M3-retro §"Next bucket".) The helper RENAMES
-// the conflicting param to a placeholder name so the body's own
-// `const __dirname` becomes the single declarer. We rename rather than
-// drop because callers pass 5 positional arguments and dropping a slot
-// would mis-align downstream slots (e.g. the USER_CODE wrap appends
-// `console` / `process` / etc. after `__dirname`). Renaming preserves
-// slot alignment while letting the body's binding win.
-//
-// Symmetric for `__filename` because open@10's idiom often emits both.
+// One definition, from core/_shared/compiled-fn.ts (interpolated above as
+// MK_COMPILED_FN_SOURCE); here it serves a cell the startup precompile set
+// did not include, where the runtime permits it. See that file for why the
+// collision is detected by compiling rather than by scanning the source.
+
 function __mkCompiledFn(code) {
-  const reFn = /(?:^|\n|;)\s*(?:const|let|var)\s+__filename\s*=/m;
-  const reDn = /(?:^|\n|;)\s*(?:const|let|var)\s+__dirname\s*=/m;
-  const reRequire = /(?:^|\n|;)\s*(?:const|let|var)\s+require\s*=/m;
-  const fnName = reFn.test(code) ? "__filename__nimbus_unused" : "__filename";
-  const dnName = reDn.test(code) ? "__dirname__nimbus_unused"  : "__dirname";
-  const requireName = reRequire.test(code) ? "require__nimbus_unused" : "require";
-  return new Function("exports", requireName, "module", fnName, dnName, code);
+  // Node strips a leading shebang from every module before evaluation;
+  // bin scripts are commonly bundled verbatim with their
+  // "#!/usr/bin/env node" line, which is a SyntaxError under new Function.
+  if (typeof code === "string" && code.charCodeAt(0) === 35 && code.charCodeAt(1) === 33) {
+    const __nl = code.indexOf("\n");
+    code = __nl >= 0 ? code.slice(__nl + 1) : "";
+  }
+  const __base = ["exports", "require", "module", "__filename", "__dirname"];
+  const __params = __base.slice();
+  let __error;
+  // Each pass renames exactly the parameter the parser reported; a module
+  // may declare more than one, so the loop runs once per slot at most.
+  for (let __attempt = 0; __attempt <= __base.length; __attempt++) {
+    try { return new Function(...__params, code); }
+    catch (e) {
+      __error = e;
+      // V8 (workerd) and JavaScriptCore (bun, the unit tests) word it differently.
+      const __m = /Identifier '([$\w]+)' has already been declared|Cannot declare a \w+ variable twice: '([$\w]+)'/.exec((e && e.message) || "");
+      const __slot = __m ? __base.indexOf(__m[1] || __m[2]) : -1;
+      if (__slot < 0 || __params[__slot] !== __base[__slot]) throw e;
+      __params[__slot] = __base[__slot] + "__nimbus_unused";
+    }
+  }
+  throw __error;
 }
 
+
 function __exportsTarget(mod) {
   const value = mod.exports;
   if (value && (typeof value === "object" || typeof value === "function")) return value;
@@ -9597,11 +10199,12 @@ function __makeLoadingExports(mod) {
  * Load and execute a JS/JSON module from VFS.
  * Returns the module.exports value.
  */
-function __loadModule(resolvedPath) {
-  if (__moduleCache.has(resolvedPath)) return __moduleCache.get(resolvedPath);
+function __loadModule(resolvedPath, evaluationKey = resolvedPath) {
+  if (globalThis.__nimbusProfileStaged) globalThis.__nimbusProfileStaged.delete(String(resolvedPath).replace(/^\/+/, ""));
+  if (__moduleCache.has(evaluationKey)) return __moduleCache.get(evaluationKey);
 
   const mod = { exports: {} };
-  __moduleCache.set(resolvedPath, __makeLoadingExports(mod));
+  __moduleCache.set(evaluationKey, __makeLoadingExports(mod));
 
   const code = __readFileOr(resolvedPath, null);
   if (code === null) throw new Error("Cannot read module: " + resolvedPath);
@@ -9609,7 +10212,7 @@ function __loadModule(resolvedPath) {
   // JSON
   if (resolvedPath.endsWith(".json")) {
     mod.exports = JSON.parse(code);
-    __moduleCache.set(resolvedPath, mod.exports);
+    __moduleCache.set(evaluationKey, mod.exports);
     return mod.exports;
   }
 
@@ -9632,6 +10235,16 @@ function __loadModule(resolvedPath) {
   // const import_meta = {}. Save+restore for recursive __loadModule.
   const __prevModulePath = globalThis.__currentModulePath;
   globalThis.__currentModulePath = resolvedPath;
+  const moduleUrl = evaluationKey.startsWith("file:")
+    ? evaluationKey : builtins.url.pathToFileURL("/" + resolvedPath).href;
+  // Evaluation metadata lives on the module, not in source text. Keeping
+  // it here preserves the five CommonJS arguments and captures the parent
+  // even when import.meta.resolve is extracted and called later.
+  const importMeta = Object.assign(Object.create(null), {
+    url: moduleUrl,
+    resolve: (specifier) => globalThis.__nimbusImportMetaResolve(specifier, moduleUrl),
+  });
+  Object.defineProperty(mod, "__nimbusImportMeta", { value: importMeta });
   try {
     // Use pre-compiled function from startup (new Function allowed at module eval time)
     // Normalize path to match VFS bundle key format (no leading /)
@@ -9656,7 +10269,7 @@ function __loadModule(resolvedPath) {
       } catch (evalErr) {
         // W3.5 Fix C: if the file was in the bundle but its pre-compile
         // failed at facet startup, surface the original SyntaxError
-        // instead of the misleading "file was not pre-bundled" text.
+        // instead of the misleading "not in this launch's module map" text.
         const normalizedPath2 = resolvedPath.replace(/^\/+/, "");
         const compileErr =
           (typeof __compileFailures !== "undefined" && __compileFailures &&
@@ -9668,22 +10281,27 @@ function __loadModule(resolvedPath) {
           );
         }
         if (evalErr.message && evalErr.message.includes("Code generation from strings disallowed")) {
-          throw new Error("Cannot load module '" + resolvedPath + "': file was not pre-bundled. Add it to the VFS bundle.");
+          // Not a read miss (the text is here) and nothing in the process can
+          // answer it, so it is kept apart from the read ledger that settles those.
+          (globalThis.__nimbusModuleMisses ??= new Set()).add(normalizedPath2);
+          throw new Error("Cannot load module '" + resolvedPath + "': it was not in this launch's module map; the next launch of the same command stages it.");
         }
         throw evalErr;
       }
     }
   } catch (e) {
-    __moduleCache.delete(resolvedPath);
+    __moduleCache.delete(evaluationKey);
     if (e && typeof e === "object" && !e.__nimbusModulePath) {
       try {
-        e.__nimbusModulePath = resolvedPath;
-        if (typeof e.message === "string") {
-          e.message += "\nNimbus module: " + resolvedPath;
-        }
-        if (typeof e.stack === "string" && !e.stack.includes("Nimbus module:")) {
-          e.stack += "\nNimbus module: " + resolvedPath;
-        }
+        Object.defineProperty(e, "__nimbusModulePath", { value: resolvedPath, configurable: true, writable: true });
+        const at = resolvedPath.lastIndexOf("node_modules/");
+        const parts = at < 0 ? [] : resolvedPath.slice(at + 13).split("/");
+        const pkg = parts[0] && parts[0].startsWith("@") ? parts[0] + "/" + parts[1] : parts[0];
+        const advisory = pkg ? __nimbusAbiAdvisories.get(pkg) : undefined;
+        const note = "\nNimbus module: " + resolvedPath
+          + (advisory ? "\nNimbus: " + pkg + " has no Workers-compatible build: " + advisory : "");
+        if (typeof e.message === "string") e.message += note;
+        if (typeof e.stack === "string" && !e.stack.includes("Nimbus module:")) e.stack += note;
       } catch {}
     }
     throw e;
@@ -9692,7 +10310,7 @@ function __loadModule(resolvedPath) {
   }
 
   // Update cache with final exports (module.exports may have been reassigned)
-  __moduleCache.set(resolvedPath, mod.exports);
+  __moduleCache.set(evaluationKey, mod.exports);
   return mod.exports;
 }
 
@@ -9701,6 +10319,25 @@ function __loadModule(resolvedPath) {
  * Returns the resolved VFS path, or null.
  */
 function __resolveFrom(id, fromDir) {
+  // An absolute file: URL is a specifier Node accepts: `import(href)` is the
+  // portable way to load a path a resolver just handed back, and it is what
+  // every package that resolves before it imports emits — @nuxt/cli's
+  // loadKit does `import(pathToFileURL(resolveModulePath('@nuxt/kit', …)).href)`.
+  // The ESM→CJS transform funnels those imports through this one resolver, so
+  // the scheme has to come off before the specifier is classified: with it on,
+  // the file: URL misses the absolute-path branch below and gets looked up as
+  // if it were the name of a package.
+  if (typeof id === "string" && id.startsWith("file:")) {
+    let filePath;
+    try {
+      const u = new URL(id);
+      // .pathname drops the query a cache-busting importer appends
+      // (`import(href + "?t=" + Date.now())` is the standard HMR spelling),
+      // and the decode is what node:url's fileURLToPath does with it.
+      filePath = decodeURIComponent(u.pathname);
+    } catch { filePath = id.replace(/^file:\/\//, ""); }
+    id = filePath;
+  }
   // X.5-P: literal "." / ".." are CommonJS aliases for "./" / "../".
   // Pre-fix they slipped past the startsWith("./")/("../") guards (which
   // require >= 3 / >= 4 chars respectively) and fell into the bare-spec
@@ -9730,43 +10367,634 @@ function __resolveFrom(id, fromDir) {
   if (id.startsWith("#")) {
     return __resolveImportsField(id, fromDir);
   }
-  // Bare specifier → node_modules resolution
+  // Bare specifier: the enclosing package's own name resolves through its
+  // exports map (Node's LOAD_PACKAGE_SELF), then node_modules resolution.
+  // Once the enclosing package claims the name, its map is the whole
+  // answer: a subpath it does not expose is not found, never a
+  // node_modules copy's.
+  const self = __resolvePackageSelf(id, fromDir);
+  if (self) return self.resolved;
   return __resolveNodeModule(id, fromDir);
 }
 
-globalThis.__nimbusImportMetaResolve = function __nimbusImportMetaResolve(specifier, parentUrl) {
-  const currentFromParent = typeof parentUrl === "string" && parentUrl.startsWith("file:")
-    ? parentUrl.replace(/^file:\/\/\/+/, "")
-    : "";
-  const current = currentFromParent || (
-    typeof globalThis.__currentModulePath === "string"
-      ? globalThis.__currentModulePath.replace(/^\/+/, "")
-      : ""
-  );
-  const fromDir = current.includes("/") ? current.substring(0, current.lastIndexOf("/")) : "";
-  const text = String(specifier);
-  if (text.startsWith("file:")) return text;
-  if (text.startsWith("./") || text.startsWith("../") || text.startsWith("/")) {
-    return new URL(text, current ? "file:///" + current : "file:///").href;
-  }
-  const resolved = __resolveFrom(text, fromDir);
-  // Node throws ERR_MODULE_NOT_FOUND rather than answering with the specifier
-  // it could not resolve, and packages are written against that: the standard
-  // shape is a try/catch that reports something the user can act on. Handing
-  // back the bare specifier passes the "unresolved" case off as a URL, so
-  // fileURLToPath downstream yields a path that was never on disk and the
-  // eventual error names a phantom file instead of the missing package.
-  // typescript@7 does exactly this: with the specifier echoed back it reports
-  // "Executable not found: @typescript/typescript-linux-x64/lib/tsc", where
-  // its own catch would have said the platform package is missing.
-  if (!resolved) {
-    const err = new Error(
-      "Cannot find package '" + text + "' imported from " + (current || fromDir || "<unknown>"),
+// ═══════════════════════════════════════════════════════════════════════
+// ──  import() — Node's ESM loader ────────────────────────────────────
+// ═══════════════════════════════════════════════════════════════════════
+// A cell's dynamic import() reaches here with its module's URL
+// (core/runtime/dynamic-import-rewrite.ts). Resolution is Node's ESM
+// algorithm (core/_shared/esm-resolver.ts, interpolated below): the "import"
+// conditions, no extension probing, a directory refused by name, file: URLs,
+// Node's error codes and messages. What resolves loads through the same
+// module cache require uses, shaped as the namespace Node would give.
+// Node's builtins that exist only with the scheme; the rest of the table is
+// the process's own builtins, undici among them, which the process provides
+// in place of any installed copy (see builtins.undici above).
+const __ESM_SCHEME_ONLY_BUILTINS = new Set(["test", "test/reporters", "sqlite", "sea"]);
+// Node's ESM resolver (core/_shared/esm-resolver.ts, compiled once by
+// scripts/bundle-facet-workers.mjs): declares createEsmResolver.
+function createEsmResolver(host) {
+  const conditions =   new Set(["node", "import", "module-sync"]);
+  const ask = {
+    *kind(path) {
+      const kind = yield host.kind(path);
+      return kind === "file" || kind === "directory" ? kind : null;
+    },
+    *readText(path) {
+      const text = yield host.readText(path);
+      return typeof text === "string" ? text : null;
+    },
+    *realpath(path) {
+      const real = yield host.realpath(path);
+      return typeof real === "string" ? real : path;
+    },
+    *cjsResolve(specifier, parentPath) {
+      const found = yield host.cjsResolve(specifier, parentPath);
+      return typeof found === "string" ? found : null;
+    }
+  };
+  function codedError(Ctor, code, message) {
+    return Object.assign(new Ctor(message), { code });
+  }
+  const codeOf = (error) => error !== null && typeof error === "object" && "code" in error ? error.code : void 0;
+  const filePath = (url) => decodeURIComponent(new URL(String(url)).pathname);
+  const fileUrl = (path) => {
+    const url = new URL("file://");
+    url.pathname = path;
+    return url;
+  };
+  function isRelativeSpecifier(specifier) {
+    if (specifier[0] !== ".") return false;
+    if (specifier.length === 1 || specifier[1] === "/") return true;
+    return specifier[1] === "." && (specifier.length === 2 || specifier[2] === "/");
+  }
+  const isRelativeOrAbsolute = (specifier) => specifier !== "" && (specifier[0] === "/" || isRelativeSpecifier(specifier));
+  function* readPackageConfig(pjsonPath, specifier, base) {
+    const text = (yield* ask.kind(pjsonPath)) === "file" ? yield* ask.readText(pjsonPath) : null;
+    if (text === null) return { exists: false, pjsonPath, type: "none" };
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw codedError(
+        Error,
+        "ERR_INVALID_PACKAGE_CONFIG",
+        `Invalid package config ${pjsonPath}` + (base ? ` while importing ${JSON.stringify(specifier)} from ${base}` : "") + "."
+      );
+    }
+    const config = { exists: true, pjsonPath, type: "none" };
+    if (parsed === null || typeof parsed !== "object") return config;
+    if (typeof parsed.name === "string") config.name = parsed.name;
+    if (typeof parsed.main === "string") config.main = parsed.main;
+    if ("exports" in parsed) config.exports = parsed.exports;
+    if (parsed.imports !== null && typeof parsed.imports === "object") config.imports = parsed.imports;
+    if (parsed.type === "module" || parsed.type === "commonjs") config.type = parsed.type;
+    return config;
+  }
+  function* packageScopeConfig(resolved) {
+    let pjsonUrl = new URL("./package.json", resolved);
+    while (true) {
+      if (pjsonUrl.pathname.endsWith("node_modules/package.json")) break;
+      const config = yield* readPackageConfig(filePath(pjsonUrl), resolved.href, void 0);
+      if (config.exists) return config;
+      const last = pjsonUrl;
+      pjsonUrl = new URL("../package.json", pjsonUrl);
+      if (pjsonUrl.pathname === last.pathname) break;
+    }
+    return { exists: false, pjsonPath: filePath(pjsonUrl), type: "none" };
+  }
+  function invalidPackageTarget(key, target, pjsonUrl, internal, base) {
+    const text = typeof target === "object" && target !== null ? JSON.stringify(target, null, "") : `${target}`;
+    const pkgPath = filePath(new URL(".", pjsonUrl));
+    const related = !internal && text.length > 0 && !text.startsWith("./");
+    const tail = `in the package config ${pkgPath}package.json imported from ${base}${related ? '; targets must start with "./"' : ""}`;
+    return codedError(
+      Error,
+      "ERR_INVALID_PACKAGE_TARGET",
+      key === "." ? `Invalid "exports" main target ${JSON.stringify(text)} defined ${tail}` : `Invalid "${internal ? "imports" : "exports"}" target ${JSON.stringify(text)} defined for '${key}' ${tail}`
     );
-    err.code = "ERR_MODULE_NOT_FOUND";
-    throw err;
   }
-  return "file:///" + resolved.replace(/^\/+/, "");
+  const invalidSegment = /(^|\\|\/)((\.|%2e)(\.|%2e)?|(n|%6e|%4e)(o|%6f|%4f)(d|%64|%44)(e|%65|%45)(_|%5f)(m|%6d|%4d)(o|%6f|%4f)(d|%64|%44)(u|%75|%55)(l|%6c|%4c)(e|%65|%45)(s|%73|%53))?(\\|\/|$)/i;
+  const deprecatedInvalidSegment = /(^|\\|\/)((\.|%2e)(\.|%2e)?|(n|%6e|%4e)(o|%6f|%4f)(d|%64|%44)(e|%65|%45)(_|%5f)(m|%6d|%4d)(o|%6f|%4f)(d|%64|%44)(u|%75|%55)(l|%6c|%4c)(e|%65|%45)(s|%73|%53))(\\|\/|$)/i;
+  function* resolveTargetString(target, subpath, match, pjsonUrl, base, pattern, internal, isPathMap) {
+    if (subpath !== "" && !pattern && target[target.length - 1] !== "/") {
+      throw invalidPackageTarget(match, target, pjsonUrl, internal, base);
+    }
+    if (!target.startsWith("./")) {
+      if (internal && !target.startsWith("../") && !target.startsWith("/")) {
+        let isUrl = false;
+        try {
+          new URL(target);
+          isUrl = true;
+        } catch {
+        }
+        if (!isUrl) {
+          const exportTarget = pattern ? target.replace(/\*/g, () => subpath) : target + subpath;
+          return yield* packageResolve(exportTarget, pjsonUrl.href);
+        }
+      }
+      throw invalidPackageTarget(match, target, pjsonUrl, internal, base);
+    }
+    if (invalidSegment.test(target.slice(2)) && deprecatedInvalidSegment.test(target.slice(2))) {
+      throw invalidPackageTarget(match, target, pjsonUrl, internal, base);
+    }
+    const resolved = new URL(target, pjsonUrl);
+    if (!resolved.pathname.startsWith(new URL(".", pjsonUrl).pathname)) {
+      throw invalidPackageTarget(match, target, pjsonUrl, internal, base);
+    }
+    if (subpath === "") return resolved;
+    if (invalidSegment.test(subpath) && deprecatedInvalidSegment.test(subpath) && !isPathMap) {
+      const request = pattern ? match.replace("*", () => subpath) : match + subpath;
+      throw codedError(
+        TypeError,
+        "ERR_INVALID_MODULE_SPECIFIER",
+        `Invalid module "${request}" request is not a valid match in pattern "${match}" for the "${internal ? "imports" : "exports"}" resolution of ${filePath(pjsonUrl)} imported from ${base}`
+      );
+    }
+    if (pattern) return new URL(resolved.href.replace(/\*/g, () => subpath));
+    return new URL(subpath, resolved);
+  }
+  function* resolveTarget(pjsonUrl, target, subpath, key, base, pattern, internal, isPathMap) {
+    if (typeof target === "string") {
+      return yield* resolveTargetString(target, subpath, key, pjsonUrl, base, pattern, internal, isPathMap);
+    }
+    if (Array.isArray(target)) {
+      if (target.length === 0) return null;
+      let lastException;
+      for (const item of target) {
+        let result;
+        try {
+          result = yield* resolveTarget(pjsonUrl, item, subpath, key, base, pattern, internal, isPathMap);
+        } catch (error) {
+          lastException = error;
+          if (codeOf(error) === "ERR_INVALID_PACKAGE_TARGET") continue;
+          throw error;
+        }
+        if (result === void 0) continue;
+        if (result === null) {
+          lastException = null;
+          continue;
+        }
+        return result;
+      }
+      if (lastException === void 0 || lastException === null) return lastException;
+      throw lastException;
+    }
+    if (typeof target === "object" && target !== null) {
+      const keys = Object.getOwnPropertyNames(target);
+      for (const condition of keys) {
+        if (/^\d+$/.test(condition) && String(Number(condition)) === condition && Number(condition) < 4294967295) {
+          throw codedError(
+            Error,
+            "ERR_INVALID_PACKAGE_CONFIG",
+            `Invalid package config ${filePath(pjsonUrl)} while importing ${fileUrl(base).href}. "exports" cannot contain numeric property keys.`
+          );
+        }
+      }
+      for (const condition of keys) {
+        if (condition !== "default" && !conditions.has(condition)) continue;
+        const result = yield* resolveTarget(
+          pjsonUrl,
+          Reflect.get(target, condition),
+          subpath,
+          key,
+          base,
+          pattern,
+          internal,
+          isPathMap
+        );
+        if (result === void 0) continue;
+        return result;
+      }
+      return void 0;
+    }
+    if (target === null) return null;
+    throw invalidPackageTarget(key, target, pjsonUrl, internal, base);
+  }
+  function patternKeyCompare(a, b) {
+    const aStar = a.indexOf("*");
+    const bStar = b.indexOf("*");
+    const baseA = aStar === -1 ? a.length : aStar + 1;
+    const baseB = bStar === -1 ? b.length : bStar + 1;
+    if (baseA > baseB) return -1;
+    if (baseB > baseA) return 1;
+    if (aStar === -1) return 1;
+    if (bStar === -1) return -1;
+    if (a.length > b.length) return -1;
+    if (b.length > a.length) return 1;
+    return 0;
+  }
+  function bestPattern(map, name) {
+    let best = "";
+    let bestSubpath = "";
+    for (const key of Object.getOwnPropertyNames(map)) {
+      const star = key.indexOf("*");
+      if (star === -1 || !name.startsWith(key.slice(0, star))) continue;
+      const trailer = key.slice(star + 1);
+      if (name.length >= key.length && name.endsWith(trailer) && patternKeyCompare(best, key) === 1 && key.lastIndexOf("*") === star) {
+        best = key;
+        bestSubpath = name.slice(star, name.length - trailer.length);
+      }
+    }
+    return best ? { key: best, subpath: bestSubpath } : null;
+  }
+  function exportsNotFound(subpath, pjsonUrl, base) {
+    const pkgPath = filePath(new URL(".", pjsonUrl));
+    return codedError(
+      Error,
+      "ERR_PACKAGE_PATH_NOT_EXPORTED",
+      subpath === "." ? `No "exports" main defined in ${pkgPath}package.json imported from ${base}` : `Package subpath '${subpath}' is not defined by "exports" in ${pkgPath}package.json imported from ${base}`
+    );
+  }
+  function* packageExportsResolve(pjsonUrl, subpath, config, base) {
+    let exports = config.exports;
+    const isSugar = (() => {
+      if (typeof exports === "string" || Array.isArray(exports)) return true;
+      if (typeof exports !== "object" || exports === null) return false;
+      let sugar = false;
+      let i = 0;
+      for (const key of Object.getOwnPropertyNames(exports)) {
+        const current = key === "" || key[0] !== ".";
+        if (i++ === 0) sugar = current;
+        else if (sugar !== current) {
+          throw codedError(
+            Error,
+            "ERR_INVALID_PACKAGE_CONFIG",
+            `Invalid package config ${filePath(pjsonUrl)} while importing ${fileUrl(base).href}. "exports" cannot contain some keys starting with '.' and some not. The exports object must either be an object of package subpath keys or an object of main entry condition name keys only.`
+          );
+        }
+      }
+      return sugar;
+    })();
+    if (isSugar) exports = { ".": exports };
+    const map = exports;
+    if (Object.prototype.hasOwnProperty.call(map, subpath) && !subpath.includes("*") && !subpath.endsWith("/")) {
+      const result = yield* resolveTarget(pjsonUrl, map[subpath], "", subpath, base, false, false, false);
+      if (result == null) throw exportsNotFound(subpath, pjsonUrl, base);
+      return result;
+    }
+    const best = bestPattern(map, subpath);
+    if (best) {
+      const result = yield* resolveTarget(pjsonUrl, map[best.key], best.subpath, best.key, base, true, false, subpath.endsWith("/"));
+      if (result == null) throw exportsNotFound(subpath, pjsonUrl, base);
+      return result;
+    }
+    throw exportsNotFound(subpath, pjsonUrl, base);
+  }
+  function* packageImportsResolve(name, baseUrl) {
+    const base = filePath(baseUrl);
+    if (name === "#" || name.startsWith("#/") || name.endsWith("/")) {
+      throw codedError(TypeError, "ERR_INVALID_MODULE_SPECIFIER", `Invalid module "${name}" is not a valid internal imports specifier name imported from ${base}`);
+    }
+    const config = yield* packageScopeConfig(new URL(baseUrl));
+    let pjsonUrl;
+    if (config.exists) {
+      pjsonUrl = fileUrl(config.pjsonPath);
+      const imports = config.imports;
+      if (imports) {
+        if (Object.prototype.hasOwnProperty.call(imports, name) && !name.includes("*")) {
+          const result = yield* resolveTarget(pjsonUrl, imports[name], "", name, base, false, true, false);
+          if (result != null) return result;
+        } else {
+          const best = bestPattern(imports, name);
+          if (best) {
+            const result = yield* resolveTarget(pjsonUrl, imports[best.key], best.subpath, best.key, base, true, true, false);
+            if (result != null) return result;
+          }
+        }
+      }
+    }
+    const where = pjsonUrl ? ` in package ${filePath(new URL(".", pjsonUrl))}package.json` : "";
+    throw codedError(TypeError, "ERR_PACKAGE_IMPORT_NOT_DEFINED", `Package import specifier "${name}" is not defined${where} imported from ${base}`);
+  }
+  function* legacyMainResolve(pjsonUrl, config, base) {
+    const tries = [];
+    if (config.main !== void 0) {
+      for (const suffix of ["", ".js", ".json", ".node", "/index.js", "/index.json", "/index.node"]) tries.push(`./${config.main}${suffix}`);
+    }
+    tries.push("./index.js", "./index.json", "./index.node");
+    for (const candidate of tries) {
+      const url = new URL(candidate, pjsonUrl);
+      if ((yield* ask.kind(filePath(url))) === "file") return url;
+    }
+    const dir = fileUrl(filePath(new URL(".", pjsonUrl)).replace(/\/+/g, "/"));
+    const missing = filePath(new URL(config.main ?? "index.js", dir));
+    throw codedError(Error, "ERR_MODULE_NOT_FOUND", `Cannot find package '${missing}' imported from ${base}`);
+  }
+  function* packageResolve(specifier, baseUrl) {
+    if (host.isBuiltin(specifier)) return new URL("node:" + specifier);
+    const base = filePath(baseUrl);
+    let separator = specifier.indexOf("/");
+    let valid = true;
+    let scoped = false;
+    if (specifier[0] === "@") {
+      scoped = true;
+      if (separator === -1 || specifier.length === 0) valid = false;
+      else separator = specifier.indexOf("/", separator + 1);
+    }
+    const name = separator === -1 ? specifier : specifier.slice(0, separator);
+    if (/^\.|%|\\/.test(name)) valid = false;
+    if (!valid) {
+      throw codedError(TypeError, "ERR_INVALID_MODULE_SPECIFIER", `Invalid module "${specifier}" is not a valid package name imported from ${base}`);
+    }
+    const subpath = "." + (separator === -1 ? "" : specifier.slice(separator));
+    const self = yield* packageScopeConfig(new URL(baseUrl));
+    if (self.exists && self.exports != null && self.name === name) {
+      return yield* packageExportsResolve(fileUrl(self.pjsonPath), subpath, self, base);
+    }
+    let pjsonUrl = new URL("./node_modules/" + name + "/package.json", baseUrl);
+    let pjsonPath = filePath(pjsonUrl);
+    let lastPath;
+    do {
+      if ((yield* ask.kind(pjsonPath.slice(0, pjsonPath.length - 13))) !== "directory") {
+        lastPath = pjsonPath;
+        pjsonUrl = new URL((scoped ? "../../../../node_modules/" : "../../../node_modules/") + name + "/package.json", pjsonUrl);
+        pjsonPath = filePath(pjsonUrl);
+        continue;
+      }
+      const config = yield* readPackageConfig(pjsonPath, specifier, base);
+      if (config.exports != null) return yield* packageExportsResolve(pjsonUrl, subpath, config, base);
+      if (subpath === ".") return yield* legacyMainResolve(pjsonUrl, config, base);
+      return new URL(subpath, pjsonUrl);
+    } while (pjsonPath.length !== lastPath.length);
+    throw codedError(Error, "ERR_MODULE_NOT_FOUND", `Cannot find package '${name}' imported from ${base}`);
+  }
+  function* formatOf(url, path) {
+    const base = path.slice(path.lastIndexOf("/") + 1);
+    const dot = base.lastIndexOf(".");
+    const ext = dot > 0 ? base.slice(dot) : "";
+    if (ext === ".mjs" || ext === ".mts") return "module";
+    if (ext === ".cjs" || ext === ".cts") return "commonjs";
+    if (ext === ".json") return "json";
+    if (ext === ".js" || ext === ".ts" || ext === "") {
+      const type = (yield* packageScopeConfig(url)).type;
+      if (type === "module") return "module";
+      if (type === "commonjs") return "commonjs";
+      return "detect";
+    }
+    throw codedError(TypeError, "ERR_UNKNOWN_FILE_EXTENSION", `Unknown file extension "${ext}" for ${path}`);
+  }
+  function* finalizeResolution(resolved, baseUrl) {
+    const base = filePath(baseUrl);
+    if (/%2f|%5c/i.test(resolved.pathname)) {
+      throw codedError(
+        TypeError,
+        "ERR_INVALID_MODULE_SPECIFIER",
+        `Invalid module "${resolved.pathname}" must not include encoded "/" or "\\" characters imported from ${base}`
+      );
+    }
+    const path = filePath(resolved);
+    const kind = path.endsWith("/") ? "directory" : yield* ask.kind(path);
+    if (kind === "directory") {
+      throw Object.assign(
+        codedError(Error, "ERR_UNSUPPORTED_DIR_IMPORT", `Directory import '${path}' is not supported resolving ES modules imported from ${base}`),
+        { url: resolved.href }
+      );
+    }
+    if (kind !== "file") {
+      throw Object.assign(
+        codedError(Error, "ERR_MODULE_NOT_FOUND", `Cannot find module '${path}' imported from ${base}`),
+        { url: resolved.href }
+      );
+    }
+    const real = yield* ask.realpath(path);
+    const url = fileUrl(real);
+    url.search = resolved.search;
+    url.hash = resolved.hash;
+    return { url: url.href, path: real };
+  }
+  function* moduleResolve(specifier, parentUrl) {
+    let resolved;
+    if (isRelativeOrAbsolute(specifier)) resolved = new URL(specifier, parentUrl);
+    else if (specifier[0] === "#") resolved = yield* packageImportsResolve(specifier, parentUrl);
+    else {
+      try {
+        resolved = new URL(specifier);
+      } catch {
+        resolved = yield* packageResolve(specifier, parentUrl);
+      }
+    }
+    if (resolved.protocol === "node:") return { url: "node:" + resolved.pathname, builtin: resolved.pathname };
+    if (resolved.protocol !== "file:") return { url: resolved.href };
+    return yield* finalizeResolution(resolved, parentUrl);
+  }
+  function* loadable(resolved) {
+    if (resolved.builtin !== void 0) {
+      if (!host.isBuiltin("node:" + resolved.builtin)) {
+        throw codedError(Error, "ERR_UNKNOWN_BUILTIN_MODULE", `No such built-in module: node:${resolved.builtin}`);
+      }
+      return { url: resolved.url, builtin: resolved.builtin, format: "builtin" };
+    }
+    if (resolved.url.startsWith("data:")) return { url: resolved.url, format: "data" };
+    if (resolved.path === void 0) {
+      throw codedError(
+        Error,
+        "ERR_UNSUPPORTED_ESM_URL_SCHEME",
+        `Only URLs with a scheme in: file and data are supported by the default ESM loader. Received protocol '${new URL(resolved.url).protocol}'`
+      );
+    }
+    return { url: resolved.url, path: resolved.path, format: yield* formatOf(new URL(resolved.url), resolved.path) };
+  }
+  function* commonJsHint(specifier, parentUrl) {
+    let found = yield* ask.cjsResolve(specifier, filePath(parentUrl));
+    if (found === null) return null;
+    if (isRelativeSpecifier(specifier)) {
+      const from = parentUrl.slice("file://".length, parentUrl.lastIndexOf("/")).split("/").filter(Boolean);
+      const to = fileUrl(found).pathname.split("/").filter(Boolean);
+      let common = 0;
+      while (common < from.length && common < to.length && from[common] === to[common]) common++;
+      found = [...from.slice(common).map(() => ".."), ...to.slice(common)].join("/");
+      if (!found.startsWith("../")) found = `./${found}`;
+    } else if (specifier[0] && specifier[0] !== "/" && specifier[0] !== ".") {
+      const slash = specifier.indexOf("/");
+      const pkg = slash === -1 ? specifier : specifier.slice(0, slash);
+      const needle = `/node_modules/${pkg}/`;
+      const at = found.lastIndexOf(needle);
+      found = at !== -1 ? pkg + "/" + found.slice(at + needle.length).split("/").map(encodeURIComponent).join("/") : fileUrl(found).href;
+    }
+    return found;
+  }
+  function* resolveWithHint(specifier, parentUrl) {
+    try {
+      return yield* moduleResolve(specifier, parentUrl);
+    } catch (error) {
+      const code = codeOf(error);
+      if (error instanceof Error && (code === "ERR_MODULE_NOT_FOUND" || code === "ERR_UNSUPPORTED_DIR_IMPORT")) {
+        const asGiven = specifier.startsWith("file://") ? filePath(specifier) : specifier;
+        const found = yield* commonJsHint(asGiven, parentUrl);
+        if (found && found !== asGiven) error.message += `
+Did you mean to import ${JSON.stringify(found)}?`;
+      }
+      throw error;
+    }
+  }
+  function* importTarget(specifier, parentUrl) {
+    return yield* loadable(yield* resolveWithHint(specifier, parentUrl));
+  }
+  function* metaResolve(specifier, parentUrl) {
+    try {
+      return (yield* moduleResolve(specifier, parentUrl)).url;
+    } catch (error) {
+      const code = codeOf(error);
+      if ((code === "ERR_MODULE_NOT_FOUND" || code === "ERR_UNSUPPORTED_DIR_IMPORT") && error !== null && typeof error === "object" && "url" in error && typeof error.url === "string") return error.url;
+      throw error;
+    }
+  }
+  function runSync(steps) {
+    let next = steps.next();
+    while (!next.done) {
+      if (next.value instanceof Promise) throw new Error("resolveSync: the host answered asynchronously");
+      next = steps.next(next.value);
+    }
+    return next.value;
+  }
+  return {
+    async resolve(specifier, parentUrl) {
+      const steps = importTarget(specifier, parentUrl);
+      let next = steps.next();
+      while (!next.done) {
+        let answer;
+        try {
+          answer = await next.value;
+        } catch (error) {
+          next = steps.throw(error);
+          continue;
+        }
+        next = steps.next(answer);
+      }
+      return next.value;
+    },
+    resolveSync: (specifier, parentUrl) => runSync(importTarget(specifier, parentUrl)),
+    metaResolveSync: (specifier, parentUrl) => runSync(metaResolve(specifier, parentUrl)),
+    validateAttributes(url, format, attributes) {
+      for (const key of Object.keys(attributes)) {
+        if (key !== "type") {
+          throw codedError(TypeError, "ERR_IMPORT_ATTRIBUTE_UNSUPPORTED", `Import attribute "${key}" with value "${attributes[key]}" is not supported in ${url}`);
+        }
+      }
+      const type = attributes.type;
+      if (format === "json" || format === "data" && /^data:application\/json(?:;[^,]*)?,/.test(url)) {
+        if (type === "json") return;
+        if (!("type" in attributes)) {
+          throw codedError(TypeError, "ERR_IMPORT_ATTRIBUTE_MISSING", `Module "${url}" needs an import attribute of "type: json"`);
+        }
+      } else if (type == null) {
+        return;
+      }
+      if (typeof type !== "string") {
+        throw codedError(TypeError, "ERR_INVALID_ARG_TYPE", `The "type" argument must be of type string. Received ${typeof type}`);
+      }
+      if (type !== "json") {
+        throw codedError(TypeError, "ERR_IMPORT_ATTRIBUTE_UNSUPPORTED", `Import attribute "type" with value "${type}" is not supported in ${url}`);
+      }
+      throw codedError(TypeError, "ERR_IMPORT_ATTRIBUTE_TYPE_INCOMPATIBLE", `Module "${url}" is not of type "json"`);
+    }
+  };
+}
+const __esmResolver = createEsmResolver({
+  kind(path) {
+    const st = __fsMod.statSync(path, { throwIfNoEntry: false });
+    return !st ? null : st.isDirectory() ? "directory" : st.isFile() ? "file" : null;
+  },
+  realpath(path) {
+    try { return __fsMod.realpathSync(path); } catch { return path; }
+  },
+  readText(path) { return __readFileOr(path, null); },
+  isBuiltin(specifier) {
+    const scheme = specifier.startsWith("node:");
+    const name = scheme ? specifier.slice(5) : specifier;
+    if (!scheme && __ESM_SCHEME_ONLY_BUILTINS.has(name)) return false;
+    return Object.prototype.hasOwnProperty.call(builtins, name);
+  },
+  cjsResolve(specifier, parentPath) {
+    try {
+      const dir = parentPath.slice(0, parentPath.lastIndexOf("/")).replace(/^\/+/, "");
+      const found = __resolveFrom(specifier, dir);
+      return found ? "/" + String(found).replace(/^\/+/, "") : null;
+    } catch { return null; }
+  },
+});
+const __esmNamespaces = new Map();
+/** A module namespace: its names sorted, read through to the exports. */
+function __esmNamespaceOf(names, read) {
+  const ns = Object.create(null);
+  for (const name of [...names].sort()) {
+    Object.defineProperty(ns, name, { enumerable: true, get: () => read(name) });
+  }
+  Object.defineProperty(ns, Symbol.toStringTag, { value: "Module" });
+  return Object.preventExtensions(ns);
+}
+function __esmLoad(resolution) {
+  const cached = __esmNamespaces.get(resolution.url);
+  if (cached) return cached;
+  let ns;
+  if (resolution.format === "builtin") {
+    const mod = __requireFrom("node:" + resolution.builtin, "");
+    const names = new Set(mod && (typeof mod === "object" || typeof mod === "function") ? Object.keys(mod) : []);
+    names.add("default");
+    ns = __esmNamespaceOf(names, (name) => name === "default" ? mod : mod[name]);
+  } else if (resolution.format === "data") {
+    const match = /^data:application\/json(;[^,]*)?,/.exec(resolution.url);
+    if (!match) {
+      throw Object.assign(new Error("Nimbus: a data: URL module can only be JSON here; code cannot be compiled after the process starts: " + resolution.url.slice(0, 64)), { code: "ERR_NIMBUS_DATA_MODULE" });
+    }
+    const body = resolution.url.slice(match[0].length);
+    const value = JSON.parse(match[1] && match[1].includes(";base64") ? atob(body) : decodeURIComponent(body));
+    ns = __esmNamespaceOf(["default"], () => value);
+  } else {
+    const key = resolution.path.replace(/^\/+/, "");
+    const esm = resolution.format === "module"
+      || (resolution.format === "detect" && globalThis.__nimbusEsmModules && globalThis.__nimbusEsmModules.has(key));
+    // Canonical queryless ESM shares evaluation with require() and static
+    // imports lowered to require(). Queries/fragments are distinct jobs.
+    const variant = esm && (resolution.url.includes("?") || resolution.url.includes("#"));
+    const exports = __loadModule(key, variant ? resolution.url : key);
+    if (resolution.format === "json") {
+      ns = __esmNamespaceOf(["default"], () => exports);
+    } else if (esm) {
+      // The ESM→CJS transform's exports: the module's own names, live.
+      const names = exports && typeof exports === "object" ? Object.keys(exports).filter((name) => name !== "__esModule") : [];
+      ns = __esmNamespaceOf(names, (name) => exports[name]);
+    } else {
+      // CommonJS: module.exports is the default, its names the named exports.
+      const mod = exports;
+      const names = new Set(mod && (typeof mod === "object" || typeof mod === "function") ? Object.keys(mod) : []);
+      names.delete("default");
+      names.add("default");
+      ns = __esmNamespaceOf(names, (name) => name === "default" ? mod : mod[name]);
+    }
+  }
+  __esmNamespaces.set(resolution.url, ns);
+  return ns;
+}
+globalThis.__nimbusDynamicImport = function __nimbusDynamicImport(parentUrl, specifier, options) {
+  return Promise.resolve().then(() => {
+    const text = String(specifier);
+    const attributes = {};
+    // V8's own checks and messages (node 22), which run before resolution.
+    if (options !== undefined) {
+      if (options === null || typeof options !== "object") throw new TypeError("The second argument to import() must be an object");
+      const withAttributes = options.with;
+      if (withAttributes !== undefined) {
+        if (withAttributes === null || typeof withAttributes !== "object") throw new TypeError("The 'assert' option must be an object");
+        for (const key of Object.keys(withAttributes)) {
+          if (typeof withAttributes[key] !== "string") throw new TypeError("Import assertion value must be a string");
+          attributes[key] = withAttributes[key];
+        }
+      }
+    }
+    const resolution = __esmResolver.resolveSync(text, parentUrl);
+    __esmResolver.validateAttributes(resolution.url, resolution.format, attributes);
+    return __esmLoad(resolution);
+  });
+};
+
+// Node's import.meta.resolve, synchronous as in Node: the URL a specifier
+// names, even for a file or directory that will not load.
+globalThis.__nimbusImportMetaResolve = function __nimbusImportMetaResolve(specifier, parentUrl) {
+  const parent = typeof parentUrl === "string" && parentUrl.startsWith("file:")
+    ? parentUrl
+    : "file:///" + String(globalThis.__currentModulePath || "[eval]").replace(/^\/+/, "");
+  return __esmResolver.metaResolveSync(String(specifier), parent);
 };
 
 /**