@nimbus-sh/worker 0.9.0 → 0.11.0

package/public/_assets/runtime/resident-store-6ffb1939c53d982f.js

@@ -0,0 +1,2264 @@
+// The store's tables (__residentTablesOnSql or __residentTablesInMemory),
+// bound once the process exists. Module scope has no ctx, so every trap below
+// runs in handler context, which is also the only context that reads the
+// resident set.
+let __residentT = null;
+let __residentReady = false;
+
+/**
+ * Reads are SEALED until this incarnation has reconciled the store against the
+ * authority. This is the whole coherence design, and it is a seal rather than a
+ * check because a check gets forgotten.
+ *
+ * The hazard is specific to putting the resident set in storage, and it is
+ * created by the property that makes the design affordable: a facet's SQLite
+ * survives a fresh module scope (measured — same facet name, new loader key,
+ * new module token, 7,141 rows and 45.7 MB intact). So a new incarnation opens
+ * onto rows written by a PREVIOUS one, while every in-heap stamp and cursor
+ * that described them is gone. Heap-side provenance cannot survive the thing it
+ * is meant to describe, so provenance lives in the rows: 'file.rev' per path,
+ * '(epoch, rev)' for the store, both in this SQLite.
+ *
+ * Sealed is the initial state and `__residentAdmit` is the only thing that
+ * clears it, so a row cannot be served by an incarnation that has not applied
+ * the authority's delta. There is one gate and it is on the only door —
+ * `__residentRequire`, which every read, scan and write goes through.
+ */
+let __residentSealed = true;
+/**
+ * Set when this facet booted from a snapshot carrying no cursor, so the store
+ * holds nothing. Read by residency-miss reporting: without it, "not resident"
+ * is indistinguishable from "resident set was never adoptable", and the second
+ * is a much more actionable thing to be told.
+ */
+let __residentUndated = false;
+let __residentSealReason = "the store has not reconciled with the authority in this incarnation";
+
+const __RESIDENT_CHUNK_BYTES = 1048576;
+const __RESIDENT_BATCH_ROWS = 512;
+const __RESIDENT_BATCH_PATHS = 1024;
+const __RESIDENT_BATCH_BYTES = 4194304;
+const __RESIDENT_LIST_PAGE = 8192;
+/**
+ * Pages one enumeration may take before it gives up.
+ *
+ * A bound rather than an unbounded loop because `fsList` is a network call in
+ * a boot path: a supervisor that never reported a null `next` would spin here
+ * forever and the process would never start. At the page size above this
+ * admits filesystems into the tens of millions of paths, so it bounds a defect
+ * rather than a workload.
+ */
+const __RESIDENT_MAX_LIST_PAGES = 4096;
+
+/**
+ * Cell kinds. A cell is one of the three things __vfsBundle has always held,
+ * and the kind is stored rather than inferred so a text file whose bytes happen
+ * to be valid UTF-8 does not change shape between a write and a read.
+ */
+const __RESIDENT_SCHEMA = "2";
+
+// N18: the session's storage ledger admits this facet's database growth
+// before it happens. The supervisor grants an allowance (the ledger records
+// it under this facet's name); the store never grows its database past
+// `__residentCap`, and asks for more, asynchronously, when it would. What
+// does not fit is not held: a fill degrades to reads through the session,
+// and an own write goes to the session only. Null: no ledger (no cap).
+let __residentCap = null;
+let __residentFacet = null;
+let __residentSupervisor = null;
+let __residentGrantAsk = null;
+const __RESIDENT_ROW_BYTES = 256;
+function __namespaceRowBytes(parent, name, target) {
+  // JavaScript keeps path/target strings in the heap. Charge UTF-16 storage
+  // plus the existing row allowance, even when the engine can compress text.
+  return __RESIDENT_ROW_BYTES + 2 * (String(parent).length + String(name).length + (target == null ? 0 : String(target).length));
+}
+
+function __residentDbBytes() {
+  // A one-shot's heap is one budget: the store's tables and the own writes
+  // held beside them (__residentHold) count against the same cap.
+  return __residentT.bytes() + (__residentInHeap ? __residentHeldBytes + __residentNamespaceOverlayBytes + __residentNamespaceReserveBytes : 0);
+}
+
+/** Whether the store is a one-shot's heap (__residentBindInMemory) rather than a facet's SQLite. */
+let __residentInHeap = false;
+let __residentNamespaceOverlayBytes = 0;
+let __residentNamespaceReserveBytes = 0;
+function __residentNamespaceOverlayDelta(bytes) {
+  if (!__residentInHeap) return;
+  if (bytes > 0 && __residentCap !== null && __residentDbBytes() + bytes > __residentCap) {
+    const cause = "namespace storage budget exceeded (" + __residentCap + " bytes)";
+    __nsMarkReady(__residentT, false, cause);
+    throw Object.assign(new Error(cause), { code: "ENOSPC" });
+  }
+  __residentNamespaceOverlayBytes += bytes;
+}
+
+/**
+ * Whether the store may grow by `bytes` now; when not, and `ask`, more room
+ * is asked for. A copy of an own write never asks: the session's copy is the
+ * one that must have the room, and the cache must not take it first.
+ */
+function __residentFits(bytes, ask = true) {
+  if (__residentCap === null) return true;
+  if (__residentDbBytes() + bytes <= __residentCap) return true;
+  if (ask) void __residentAskGrant(bytes);
+  return false;
+}
+
+/**
+ * Ask the ledger for `bytes` more, reporting what the database measures.
+ * Exactly what is needed: room granted and unused is room the session's own
+ * writes cannot have. Resolves to whether `bytes` now fit.
+ */
+function __residentAskGrant(bytes) {
+  const supervisor = __residentSupervisor;
+  if (__residentCap === null) return Promise.resolve(true);
+  // A store with no ledger row (a one-shot's heap) has a fixed budget: no one to ask.
+  if (__residentFacet === null || !supervisor || typeof supervisor.fsStorageGrant !== "function") return Promise.resolve(false);
+  if (__residentGrantAsk) return __residentGrantAsk.then(() => __residentDbBytes() + bytes <= __residentCap);
+  const want = Math.max(0, __residentDbBytes() + bytes - __residentCap);
+  __residentGrantAsk = (async () => {
+    try {
+      const answer = await supervisor.fsStorageGrant(__residentFacet, want, __residentDbBytes());
+      const granted = Number(answer && answer.granted) || 0;
+      __residentCap += granted;
+      if (answer && typeof answer.cap === "number") __residentCap = Math.max(__residentCap, answer.cap);
+    } catch {}
+  })().finally(() => { __residentGrantAsk = null; });
+  return __residentGrantAsk.then(() => __residentDbBytes() + bytes <= __residentCap);
+}
+
+/** Room for `bytes` before an asynchronous fill writes them: true when they fit. */
+async function __residentEnsureRoom(bytes) {
+  if (__residentCap === null || __residentDbBytes() + bytes <= __residentCap) return true;
+  return __residentAskGrant(bytes);
+}
+
+/**
+ * What holding a cell costs the database: its bytes (a text cell's UTF-8
+ * length) on overflow pages (1% over, for page headers and the b-tree pages
+ * above them), a row per chunk and head, and a page of slack. The manager
+ * charges a launch's module map the same way (manager.ts residentCellCost).
+ */
+function __residentCellCost(cell) {
+  const isText = typeof cell === "string";
+  const size = isText ? cell.length : __residentBytes(cell).byteLength;
+  const limit = isText ? Math.floor(__RESIDENT_CHUNK_BYTES / 3) : __RESIDENT_CHUNK_BYTES;
+  const chunks = Math.max(1, Math.ceil(size / limit));
+  return Math.ceil((isText ? __residentUtf8Length(cell) : size) * 1.01) + (chunks + 1) * __RESIDENT_ROW_BYTES + 4096;
+}
+
+function __residentUtf8Length(text) {
+  let bytes = 0;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (c < 0x80) bytes += 1;
+    else if (c < 0x800) bytes += 2;
+    // A surrogate pair is one 4-byte character; a lone surrogate encodes as 3.
+    else if (c >= 0xd800 && c < 0xdc00 && i + 1 < text.length && (text.charCodeAt(i + 1) & 0xfc00) === 0xdc00) { bytes += 4; i++; }
+    else bytes += 3;
+  }
+  return bytes;
+}
+
+/** Room for what an ACQUIRE answer pushes, asked for before it is applied. */
+async function __residentRoomForPushed(result) {
+  if (__residentCap === null || !result || !Array.isArray(result.paths)) return;
+  let bytes = 0;
+  for (const entry of result.paths) {
+    if (entry && entry.bytes != null) bytes += __residentCellCost(__residentBytes(entry.bytes));
+  }
+  if (bytes > 0) await __residentEnsureRoom(bytes);
+}
+
+/** What the database measures, after a fill batch: the ledger settles to it, or records overshoot. */
+async function __residentReportSize() {
+  const supervisor = __residentSupervisor;
+  if (__residentCap === null || __residentFacet === null || !supervisor || typeof supervisor.fsStorageGrant !== "function") return;
+  try { await supervisor.fsStorageGrant(__residentFacet, 0, __residentDbBytes()); } catch {}
+}
+
+/** The allowance this launch was admitted for (the fabric's startArgs.storage). */
+function __residentSetStorage(storage, supervisor) {
+  __residentSupervisor = supervisor || null;
+  if (!storage || typeof storage.facet !== "string" || typeof storage.grant !== "number") return;
+  __residentFacet = storage.facet;
+  __residentCap = __residentDbBytes() + storage.grant;
+}
+
+/** The cap this store enforces, for startProcess to report. */
+function __residentStorageCap() {
+  return __residentCap;
+}
+
+// An own write the store could not hold (no room in the session's storage)
+// is kept here, so the program still reads what it wrote: a bounded LRU
+// (Map order is recency) of { cell, rev }, dated like a file row (own until
+// its write-back is acknowledged, then the write's revision) and judged by
+// every report like one. A path it could not keep either is remembered by
+// name only, so a miss on it says why.
+const __residentHeld = new Map();
+let __residentHeldBytes = 0;
+const __residentUnheld = new Set();
+const __RESIDENT_HELD_MAX_BYTES = 33554432;
+
+function __residentCellSize(held) {
+  const cell = held.cell;
+  return typeof cell === "string" ? cell.length * 3 : __residentBytes(cell).byteLength;
+}
+
+function __residentForgetHeld(path) {
+  const cell = __residentHeld.get(path);
+  if (cell !== undefined) {
+    __residentHeld.delete(path);
+    __residentHeldBytes -= __residentCellSize(cell);
+  }
+  __residentUnheld.delete(path);
+}
+
+function __residentHold(path, cell) {
+  __residentForgetHeld(path);
+  const size = __residentCellSize({ cell });
+  // In a facet the held cells have their own bound. In a one-shot's heap they
+  // share the store's: what the cap leaves beside the tables.
+  const limit = __residentInHeap ? Math.max(0, Number(__residentCap) - __residentT.bytes() - __residentNamespaceOverlayBytes - __residentNamespaceReserveBytes) : __RESIDENT_HELD_MAX_BYTES;
+  if (size > limit) { __residentUnheld.add(path); return; }
+  while (__residentHeldBytes + size > limit) {
+    const [oldest, old] = __residentHeld.entries().next().value;
+    __residentHeld.delete(oldest);
+    __residentHeldBytes -= __residentCellSize(old);
+    __residentUnheld.add(oldest);
+  }
+  __residentHeld.set(path, { cell, rev: __RK_OWN_WRITE });
+  __residentHeldBytes += size;
+}
+
+/** Whether a miss on `path` is the storage's: its own write was held nowhere. */
+function __residentStorageMiss(path) {
+  return __residentUnheld.has(path);
+}
+const __RK_TEXT = 0;
+const __RK_BINARY = 1;
+const __RK_DENIED = 2;
+
+/**
+ * The revision of a cell holding this facet's own bytes that the authority has
+ * not acknowledged yet: a write that has not flushed, or a cell one of its own
+ * mutations holds while that mutation is in flight (`__residentLease`).
+ *
+ * Read-your-writes: strictly newer than anything the authority could report,
+ * so it is never evicted by a delta and never mistaken for something the
+ * authority vouched for. A distinct sentinel rather than NULL, because NULL
+ * would reintroduce the undated row the NOT NULL constraint exists to forbid.
+ *
+ * It is the ONE revision a delta cannot evict, so it must mean exactly that
+ * and nothing else. The acknowledgement dates the row (`__residentStamp`),
+ * and bytes the authority served are dated as they are installed
+ * (`__residentFill`). A row left here after either would hold its bytes
+ * against every later write by anyone, for the life of the store.
+ */
+const __RK_OWN_WRITE = -1;
+
+/**
+ * The store's own operations, over the four tables it keeps: 'file' (one row
+ * per held path: kind, size, chunk count, revision, content key), 'chunk'
+ * (the bytes), 'meta' (schema, cursor, namespace readiness) and 'ns' (the
+ * namespace: a stat per visible name, keyed (parent, name)). Everything above
+ * this seam decides; the backing only stores. There are exactly two backings,
+ * with one contract:
+ *
+ * - __residentTablesOnSql: the process facet's own SQLite (ctx.storage.sql),
+ *   durable across the facet's incarnations. Every statement the store has
+ *   ever issued lives here, unchanged.
+ * - __residentTablesInMemory: a one-shot process's store, in its heap, for
+ *   the life of the run (runOnce hosts no SQLite). Same rows, same answers,
+ *   and a byte count that plays the database's size for the store's budget.
+ *
+ * Rows come back as plain objects with the column names as keys: file heads
+ * { kind, size, chunks }, chunks { txt, bin } (bin as the backing holds it;
+ * callers normalise with __residentBytes), ns rows with every stat column.
+ */
+function __residentTablesOnSql(sql) {
+  let schema = null;
+  for (const row of sql.exec("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'meta'")) schema = "";
+  if (schema !== null) for (const row of sql.exec("SELECT v FROM meta WHERE k = 'schema'")) schema = String(row.v);
+  if (schema !== __RESIDENT_SCHEMA) {
+    for (const table of ["chunk", "file", "ns", "meta"]) sql.exec("DROP TABLE IF EXISTS " + table);
+  }
+  // 'ckey' is the authority's content identity for the bytes (equal keys,
+  // equal bytes), when it said so; null for bytes it did not describe.
+  sql.exec(
+    "CREATE TABLE IF NOT EXISTS file (" +
+      "path TEXT PRIMARY KEY, kind INTEGER NOT NULL, size INTEGER NOT NULL, " +
+      "chunks INTEGER NOT NULL, rev INTEGER NOT NULL CHECK (rev >= -1), ckey TEXT" +
+    ")"
+  );
+  sql.exec("CREATE INDEX IF NOT EXISTS file_ckey ON file (ckey) WHERE ckey IS NOT NULL");
+  sql.exec(
+    "CREATE TABLE IF NOT EXISTS chunk (" +
+      "path TEXT NOT NULL, part INTEGER NOT NULL, txt TEXT, bin BLOB, " +
+      "PRIMARY KEY (path, part)" +
+    ")"
+  );
+  // The store's own cursor, in the same storage as the rows it describes, so
+  // the two cannot be separated by an isolate restart.
+  sql.exec("CREATE TABLE IF NOT EXISTS meta (k TEXT PRIMARY KEY, v TEXT NOT NULL)");
+  sql.exec("INSERT OR REPLACE INTO meta (k, v) VALUES ('schema', ?)", __RESIDENT_SCHEMA);
+  // The namespace: every name the process's credential can see, with its stat
+  // and no content. Keyed (parent, name) so a point lookup and a directory
+  // listing are both one index seek, and no path is stored twice.
+  sql.exec(
+    "CREATE TABLE IF NOT EXISTS ns (" +
+      "parent TEXT NOT NULL, name TEXT NOT NULL, kind INTEGER NOT NULL, size INTEGER NOT NULL, " +
+      "mode INTEGER NOT NULL, uid INTEGER NOT NULL, gid INTEGER NOT NULL, atime REAL NOT NULL, " +
+      "mtime REAL NOT NULL, ctime REAL NOT NULL, ino INTEGER NOT NULL, rev INTEGER NOT NULL, target TEXT, " +
+      "PRIMARY KEY (parent, name)" +
+    ") WITHOUT ROWID"
+  );
+  const first = (rows) => { for (const row of rows) return row; return undefined; };
+  const ranged = (select, from, to, tail = "") => to === null
+    ? sql.exec(select + " WHERE path >= ?" + tail, from)
+    : sql.exec(select + " WHERE path >= ? AND path < ?" + tail, from, to);
+  return {
+    bytes() {
+      const size = sql.databaseSize;
+      if (typeof size === "number" && size > 0) return size;
+      for (const row of sql.exec("SELECT page_count * page_size AS n FROM pragma_page_count(), pragma_page_size()")) return Number(row.n);
+      return 0;
+    },
+    databaseSize() { return Number(sql.databaseSize ?? 0); },
+    metaGet(k) { const row = first(sql.exec("SELECT v FROM meta WHERE k = ?", k)); return row === undefined ? undefined : String(row.v); },
+    metaSet(k, v) { sql.exec("INSERT OR REPLACE INTO meta (k, v) VALUES (?, ?)", k, v); },
+    fileHead(path) { return first(sql.exec("SELECT kind, size, chunks FROM file WHERE path = ?", path)); },
+    fileRev(path) { const row = first(sql.exec("SELECT rev FROM file WHERE path = ?", path)); return row === undefined ? undefined : Number(row.rev); },
+    fileRevKey(path) { return first(sql.exec("SELECT rev, ckey FROM file WHERE path = ?", path)); },
+    fileOwnSize(path) {
+      const row = first(sql.exec("SELECT size FROM file WHERE path = ? AND rev = ?", path, __RK_OWN_WRITE));
+      return row === undefined ? undefined : Number(row.size);
+    },
+    filePut(path, kind, size, chunks, rev, ckey) {
+      sql.exec("INSERT OR REPLACE INTO file (path, kind, size, chunks, rev, ckey) VALUES (?, ?, ?, ?, ?, ?)", path, kind, size, chunks, rev, ckey);
+    },
+    fileSetRev(path, rev) { sql.exec("UPDATE file SET rev = ? WHERE path = ?", rev, path); },
+    fileStampOwn(path, rev) { sql.exec("UPDATE file SET rev = ? WHERE path = ? AND rev = ?", rev, path, __RK_OWN_WRITE); },
+    fileDelete(path) { sql.exec("DELETE FROM file WHERE path = ?", path); },
+    fileByKey(ckey, notPath) {
+      return first(sql.exec("SELECT path, kind, size, chunks FROM file WHERE ckey = ? AND rev >= 0 AND path <> ? LIMIT 1", ckey, notPath));
+    },
+    filePaths(from, to) { return [...ranged("SELECT path FROM file", from, to)].map((row) => String(row.path)); },
+    fileAny(from, to) { return first(ranged("SELECT path FROM file", from, to, " LIMIT 1")) !== undefined; },
+    fileRevsIn(from, to) { return [...ranged("SELECT path, rev FROM file", from, to)]; },
+    // In key order, as every other scan here is: the primary key's index
+    // serves it, and both backings then answer in one order.
+    fileAllPaths() { return [...sql.exec("SELECT path FROM file ORDER BY path")].map((row) => String(row.path)); },
+    fileRows() { return [...sql.exec("SELECT path, rev, ckey FROM file ORDER BY path")]; },
+    fileOwnPaths() { return [...sql.exec("SELECT path FROM file WHERE rev = ? ORDER BY path", __RK_OWN_WRITE)].map((row) => String(row.path)); },
+    fileStats() { return first(sql.exec("SELECT count(*) AS n, coalesce(sum(size), 0) AS b FROM file")); },
+    chunkFirst(path) { return first(sql.exec("SELECT txt, bin FROM chunk WHERE path = ? AND part = 0", path)); },
+    chunkParts(path) { return [...sql.exec("SELECT txt, bin FROM chunk WHERE path = ? ORDER BY part", path)]; },
+    chunkAddText(path, part, txt) { sql.exec("INSERT INTO chunk (path, part, txt) VALUES (?, ?, ?)", path, part, txt); },
+    chunkAddBin(path, part, bin) { sql.exec("INSERT INTO chunk (path, part, bin) VALUES (?, ?, ?)", path, part, bin); },
+    chunkSetBin(path, part, bin) { sql.exec("INSERT OR REPLACE INTO chunk (path, part, bin) VALUES (?, ?, ?)", path, part, bin); },
+    chunkCopy(to, from) { sql.exec("INSERT INTO chunk (path, part, txt, bin) SELECT ?, part, txt, bin FROM chunk WHERE path = ?", to, from); },
+    chunkDelete(path) { sql.exec("DELETE FROM chunk WHERE path = ?", path); },
+    // Own rows are the one provenance a new incarnation cannot date.
+    dropOwn() {
+      sql.exec("DELETE FROM chunk WHERE path IN (SELECT path FROM file WHERE rev = ?)", __RK_OWN_WRITE);
+      sql.exec("DELETE FROM file WHERE rev = ?", __RK_OWN_WRITE);
+    },
+    // Every dated row, and any chunk no own row claims.
+    dropDated() {
+      sql.exec("DELETE FROM chunk WHERE path NOT IN (SELECT path FROM file WHERE rev = ?)", __RK_OWN_WRITE);
+      sql.exec("DELETE FROM file WHERE rev <> ?", __RK_OWN_WRITE);
+    },
+    // Every dated row and its chunks.
+    dropDatedFiles() {
+      sql.exec("DELETE FROM chunk WHERE path IN (SELECT path FROM file WHERE rev <> ?)", __RK_OWN_WRITE);
+      sql.exec("DELETE FROM file WHERE rev <> ?", __RK_OWN_WRITE);
+    },
+    clear() {
+      sql.exec("DELETE FROM chunk");
+      sql.exec("DELETE FROM file");
+      sql.exec("DELETE FROM ns");
+      sql.exec("DELETE FROM meta");
+    },
+    nsPut(parent, name, kind, size, mode, uid, gid, atime, mtime, ctime, ino, rev, target) {
+      sql.exec(
+        "INSERT OR REPLACE INTO ns (parent, name, kind, size, mode, uid, gid, atime, mtime, ctime, ino, rev, target) " +
+          "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        parent, name, kind, size, mode, uid, gid, atime, mtime, ctime, ino, rev, target,
+      );
+    },
+    nsGet(parent, name) {
+      return first(sql.exec(
+        "SELECT kind, size, mode, uid, gid, atime, mtime, ctime, ino, rev, target FROM ns WHERE parent = ? AND name = ?",
+        parent, name,
+      ));
+    },
+    nsDelete(parent, name) { sql.exec("DELETE FROM ns WHERE parent = ? AND name = ?", parent, name); },
+    nsDeleteChildren(parent) { sql.exec("DELETE FROM ns WHERE parent = ?", parent); },
+    nsDeleteParents(from, to) {
+      if (to === null) sql.exec("DELETE FROM ns WHERE parent >= ?", from);
+      else sql.exec("DELETE FROM ns WHERE parent >= ? AND parent < ?", from, to);
+    },
+    nsClear() { sql.exec("DELETE FROM ns"); },
+    nsKeys() { return [...sql.exec("SELECT parent, name FROM ns")]; },
+    nsOfKind(kind) { return [...sql.exec("SELECT parent, name FROM ns WHERE kind = ?", kind)]; },
+    nsChildren(parent) { return [...sql.exec("SELECT name, kind FROM ns WHERE parent = ?", parent)]; },
+    nsCount() { const row = first(sql.exec("SELECT count(*) AS n FROM ns")); return row === undefined ? 0 : Number(row.n); },
+  };
+}
+
+function __residentBind(ctx) {
+  const sql = ctx && ctx.storage && ctx.storage.sql;
+  if (!sql || typeof sql.exec !== "function") {
+    throw new Error(
+      "Nimbus: this facet has no synchronous SQLite (ctx.storage.sql); " +
+      "the resident set cannot be served and every sync read would raise EAGAIN"
+    );
+  }
+  return __residentBindTables(__residentTablesOnSql(sql));
+}
+
+/**
+ * The one-shot backing: the same tables, in the process's heap, for the life
+ * of one run. A one-shot is hosted by runOnce, which gives it no SQLite, and
+ * it keeps nothing after it exits. Its answers are the SQLite backing's:
+ * scans come back in key order (a b-tree's), reads hand back copies (a
+ * program that writes into a Buffer it read must not change the store), and
+ * `bytes()` counts what it holds in the units __residentCellCost charges (a
+ * row, and the payload's bytes), so the store's one budget rule serves both.
+ */
+function __residentTablesInMemory() {
+  const files = new Map();
+  const chunks = new Map();
+  const meta = new Map();
+  const ns = new Map();
+  const byKey = new Map();
+  let sorted = null;
+  let used = 0;
+  let names = 0;
+  let namespaceBytes = 0;
+  const utf8 = (text) => __residentUtf8Length(text);
+  // SQLite's binary collation orders TEXT by its UTF-8 bytes: code-point
+  // order, which UTF-16 comparison is not past the BMP.
+  const cmp = (a, b) => {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i++) {
+      const x = a.codePointAt(i), y = b.codePointAt(i);
+      if (x !== y) return x < y ? -1 : 1;
+      if (x > 0xffff) i++;
+    }
+    return a.length === b.length ? 0 : a.length < b.length ? -1 : 1;
+  };
+  const payload = (cell) => (cell.txt != null ? utf8(cell.txt) : cell.bin ? cell.bin.byteLength : 0);
+  const unkey = (path, row) => {
+    if (row && row.ckey != null) {
+      const set = byKey.get(row.ckey);
+      if (set) { set.delete(path); if (set.size === 0) byKey.delete(row.ckey); }
+    }
+  };
+  const paths = () => {
+    if (sorted === null) sorted = [...files.keys()].sort(cmp);
+    return sorted;
+  };
+  const lowerBound = (list, from) => {
+    let lo = 0, hi = list.length;
+    while (lo < hi) { const mid = (lo + hi) >>> 1; if (cmp(list[mid], from) < 0) lo = mid + 1; else hi = mid; }
+    return lo;
+  };
+  const inRange = (from, to) => {
+    const list = paths();
+    const out = [];
+    for (let i = lowerBound(list, from); i < list.length && (to === null || cmp(list[i], to) < 0); i++) out.push(list[i]);
+    return out;
+  };
+  const copy = (cell) => ({ txt: cell.txt ?? null, bin: cell.bin ? cell.bin.slice() : null });
+  const dropChunks = (path) => {
+    const parts = chunks.get(path);
+    if (!parts) return;
+    for (const cell of parts.values()) used -= __RESIDENT_ROW_BYTES + payload(cell);
+    chunks.delete(path);
+  };
+  const dropFile = (path) => {
+    const row = files.get(path);
+    if (row === undefined) return;
+    unkey(path, row);
+    files.delete(path);
+    sorted = null;
+    used -= __RESIDENT_ROW_BYTES;
+  };
+  const addChunk = (path, part, cell, replace) => {
+    let parts = chunks.get(path);
+    if (!parts) { parts = new Map(); chunks.set(path, parts); }
+    const had = parts.get(part);
+    if (had !== undefined) {
+      if (!replace) throw new Error("UNIQUE constraint failed: chunk.path, chunk.part");
+      used -= __RESIDENT_ROW_BYTES + payload(had);
+    }
+    parts.set(part, cell);
+    used += __RESIDENT_ROW_BYTES + payload(cell);
+  };
+  const nsRow = (parent, name) => { const dir = ns.get(parent); return dir ? dir.get(name) : undefined; };
+  const nsDrop = (parent, name) => {
+    const dir = ns.get(parent);
+    const row = dir?.get(name);
+    if (row === undefined) return;
+    dir.delete(name);
+    names--;
+    const bytes = __namespaceRowBytes(parent, name, row.target);
+    used -= bytes; namespaceBytes -= bytes;
+    if (dir.size === 0) ns.delete(parent);
+  };
+  const nsDropParent = (parent) => {
+    const dir = ns.get(parent);
+    if (!dir) return;
+    names -= dir.size;
+    for (const [name, row] of dir) {
+      const bytes = __namespaceRowBytes(parent, name, row.target);
+      used -= bytes; namespaceBytes -= bytes;
+    }
+    ns.delete(parent);
+  };
+  const byName = cmp;
+  const dropWhere = (keepFile, keepChunkPath) => {
+    for (const path of [...chunks.keys()]) if (!keepChunkPath(path)) dropChunks(path);
+    for (const [path, row] of [...files]) if (!keepFile(row)) dropFile(path);
+  };
+  return {
+    bytes() { return used; },
+    databaseSize() { return used; },
+    metaGet(k) { return meta.get(k); },
+    metaSet(k, v) { meta.set(k, String(v)); },
+    fileHead(path) { const row = files.get(path); return row === undefined ? undefined : { kind: row.kind, size: row.size, chunks: row.chunks }; },
+    fileRev(path) { const row = files.get(path); return row === undefined ? undefined : row.rev; },
+    fileRevKey(path) { const row = files.get(path); return row === undefined ? undefined : { rev: row.rev, ckey: row.ckey }; },
+    fileOwnSize(path) { const row = files.get(path); return row !== undefined && row.rev === __RK_OWN_WRITE ? row.size : undefined; },
+    filePut(path, kind, size, chunkCount, rev, ckey) {
+      if (!(rev >= -1)) throw new Error("CHECK constraint failed: rev >= -1");
+      const had = files.get(path);
+      if (had === undefined) { sorted = null; used += __RESIDENT_ROW_BYTES; } else unkey(path, had);
+      const row = { kind: Number(kind), size: Number(size), chunks: Number(chunkCount), rev: Number(rev), ckey: ckey == null ? null : String(ckey) };
+      files.set(path, row);
+      if (row.ckey !== null) { let set = byKey.get(row.ckey); if (!set) { set = new Set(); byKey.set(row.ckey, set); } set.add(path); }
+    },
+    fileSetRev(path, rev) { const row = files.get(path); if (row !== undefined) row.rev = Number(rev); },
+    fileStampOwn(path, rev) { const row = files.get(path); if (row !== undefined && row.rev === __RK_OWN_WRITE) row.rev = Number(rev); },
+    fileDelete(path) { dropFile(path); },
+    fileByKey(ckey, notPath) {
+      const set = byKey.get(String(ckey));
+      if (!set) return undefined;
+      for (const path of set) {
+        const row = files.get(path);
+        if (path !== notPath && row && row.rev >= 0) return { path, kind: row.kind, size: row.size, chunks: row.chunks };
+      }
+      return undefined;
+    },
+    filePaths(from, to) { return inRange(from, to); },
+    fileAny(from, to) { const list = paths(); const i = lowerBound(list, from); return i < list.length && (to === null || cmp(list[i], to) < 0); },
+    fileRevsIn(from, to) { return inRange(from, to).map((path) => ({ path, rev: files.get(path).rev })); },
+    fileAllPaths() { return [...paths()]; },
+    fileRows() { return paths().map((path) => { const row = files.get(path); return { path, rev: row.rev, ckey: row.ckey }; }); },
+    fileOwnPaths() { return paths().filter((path) => files.get(path).rev === __RK_OWN_WRITE); },
+    fileStats() { let b = 0; for (const row of files.values()) b += row.size; return { n: files.size, b }; },
+    chunkFirst(path) { const parts = chunks.get(path); const cell = parts && parts.get(0); return cell === undefined ? undefined : copy(cell); },
+    chunkParts(path) {
+      const parts = chunks.get(path);
+      if (!parts) return [];
+      return [...parts.keys()].sort((a, b) => a - b).map((part) => copy(parts.get(part)));
+    },
+    chunkAddText(path, part, txt) { addChunk(path, Number(part), { txt: String(txt), bin: null }, false); },
+    chunkAddBin(path, part, bin) { addChunk(path, Number(part), { txt: null, bin: __residentBytes(bin).slice() }, false); },
+    chunkSetBin(path, part, bin) { addChunk(path, Number(part), { txt: null, bin: __residentBytes(bin).slice() }, true); },
+    chunkCopy(to, from) {
+      const parts = chunks.get(from);
+      if (!parts) return;
+      // One statement in SQLite: a conflicting part fails the whole copy, and nothing lands.
+      const held = chunks.get(to);
+      if (held) for (const part of parts.keys()) if (held.has(part)) throw new Error("UNIQUE constraint failed: chunk.path, chunk.part");
+      for (const [part, cell] of [...parts]) addChunk(to, part, copy(cell), false);
+    },
+    chunkDelete(path) { dropChunks(path); },
+    dropOwn() {
+      const own = new Set(paths().filter((path) => files.get(path).rev === __RK_OWN_WRITE));
+      dropWhere((row) => row.rev !== __RK_OWN_WRITE, (path) => !own.has(path));
+    },
+    dropDated() {
+      const own = new Set(paths().filter((path) => files.get(path).rev === __RK_OWN_WRITE));
+      dropWhere((row) => row.rev === __RK_OWN_WRITE, (path) => own.has(path));
+    },
+    dropDatedFiles() {
+      const dated = new Set(paths().filter((path) => files.get(path).rev !== __RK_OWN_WRITE));
+      dropWhere((row) => row.rev === __RK_OWN_WRITE, (path) => !dated.has(path));
+    },
+    clear() {
+      files.clear(); chunks.clear(); meta.clear(); ns.clear(); byKey.clear();
+      sorted = null; used = 0; names = 0; namespaceBytes = 0;
+    },
+    nsPut(parent, name, kind, size, mode, uid, gid, atime, mtime, ctime, ino, rev, target) {
+      let dir = ns.get(parent);
+      const previous = dir?.get(name);
+      const bytes = __namespaceRowBytes(parent, name, target);
+      const growth = bytes - (previous === undefined ? 0 : __namespaceRowBytes(parent, name, previous.target));
+      if (__residentInHeap && __residentCap !== null && used + __residentHeldBytes + __residentNamespaceOverlayBytes + __residentNamespaceReserveBytes + growth > __residentCap) {
+        const cause = "namespace storage budget exceeded (" + __residentCap + " bytes)";
+        __nsMarkReady(__residentT, false, cause);
+        throw Object.assign(new Error(cause), { code: "ENOSPC" });
+      }
+      if (!dir) { dir = new Map(); ns.set(parent, dir); }
+      if (previous === undefined) names++;
+      used += growth; namespaceBytes += growth;
+      dir.set(name, {
+        kind: Number(kind), size: Number(size), mode: Number(mode), uid: Number(uid), gid: Number(gid),
+        atime: Number(atime), mtime: Number(mtime), ctime: Number(ctime), ino: Number(ino), rev: Number(rev),
+        target: target == null ? null : String(target),
+      });
+    },
+    nsGet(parent, name) { const row = nsRow(parent, name); return row === undefined ? undefined : { ...row }; },
+    nsDelete(parent, name) { nsDrop(parent, name); },
+    nsDeleteChildren(parent) { nsDropParent(parent); },
+    nsDeleteParents(from, to) {
+      for (const parent of [...ns.keys()]) if (cmp(parent, from) >= 0 && (to === null || cmp(parent, to) < 0)) nsDropParent(parent);
+    },
+    nsClear() { used -= namespaceBytes; names = 0; namespaceBytes = 0; ns.clear(); },
+    nsBytes() { return namespaceBytes; },
+    nsKeys() {
+      const out = [];
+      for (const parent of [...ns.keys()].sort(byName)) for (const name of [...ns.get(parent).keys()].sort(byName)) out.push({ parent, name });
+      return out;
+    },
+    nsOfKind(kind) {
+      const out = [];
+      for (const parent of [...ns.keys()].sort(byName)) {
+        const dir = ns.get(parent);
+        for (const name of [...dir.keys()].sort(byName)) if (dir.get(name).kind === Number(kind)) out.push({ parent, name });
+      }
+      return out;
+    },
+    nsChildren(parent) {
+      const dir = ns.get(parent);
+      if (!dir) return [];
+      return [...dir.keys()].sort(byName).map((name) => ({ name, kind: dir.get(name).kind }));
+    },
+    nsCount() { return names; },
+  };
+}
+
+/**
+ * A one-shot's store: the heap backing, capped at `budget` bytes and never
+ * growing past it (there is no ledger row to grow).
+ */
+function __residentBindInMemory(budget) {
+  const t = __residentBindTables(__residentTablesInMemory());
+  __residentInHeap = true;
+  __residentFacet = null;
+  __residentCap = Number(budget);
+  __residentNamespaceOverlayBytes = 0;
+  __residentNamespaceReserveBytes = 0;
+  return t;
+}
+
+/**
+ * Bind the store to its tables: a facet's SQLite (__residentBind), or a
+ * one-shot's heap (__residentTablesInMemory).
+ *
+ * 'file' carries one row per path, so existence, size and kind are one query
+ * that never touches content. 'chunk' carries the bytes. Splitting them is
+ * what makes _statLadder and __fileExists cheap: the common case reads a
+ * short row and never pages a megabyte of blob in to answer "is it there".
+ * 'rev' is never undated, and that IS the coherence guarantee rather than a
+ * note about it. An undated row can never be invalidated, so it would be
+ * served stale forever. The SQLite backing makes the column NOT NULL, so such
+ * a row cannot be written; this is the r2-cache posture (an unverifiable key
+ * cannot be constructed) moved to the only storage layer this store has.
+ *
+ * __RK_OWN_WRITE is the one negative value: this facet's own bytes that the
+ * authority has not acknowledged, which are strictly newer than anything it
+ * can report and are always readable. It is a real provenance, not an absence
+ * of one.
+ */
+function __residentBindTables(t) {
+  // A store can outlive its process. Own rows left by an earlier one are
+  // writes that never reached the authority or cells whose acknowledgement it
+  // never saw: neither can be dated, so neither is a file.
+  t.dropOwn();
+  __residentT = t;
+  __residentReady = true;
+  __nsLoadLinks(t);
+  __nsOk = t.metaGet("ns") === "1";
+  return t;
+}
+
+function __residentRequire() {
+  if (!__residentReady) {
+    throw new Error(
+      "Nimbus: the resident store was read before its facet bound its SQLite. " +
+      "__residentBind(ctx) must run in the process DO constructor, ahead of the program."
+    );
+  }
+  if (__residentSealed) {
+    throw new Error(
+      "Nimbus: the resident store is sealed — " + __residentSealReason + ". " +
+      "__residentAdmit(fsAcquire(...)) must apply the authority's delta before " +
+      "the program runs; serving a row now would serve bytes of unknown age."
+    );
+  }
+  return __residentT;
+}
+
+/** The persisted cursor, or null when this store has never been populated. */
+function __residentCursor() {
+  if (!__residentReady) return null;
+  const epoch = __residentT.metaGet("epoch");
+  const rev = __residentT.metaGet("rev");
+  return epoch === undefined || rev === undefined ? null : { epoch, rev: Number(rev) };
+}
+
+/** Stamp the store with the authority state its rows are known-good at. */
+function __residentWriteCursor(t, cursor) {
+  t.metaSet("epoch", String(cursor.epoch));
+  t.metaSet("rev", String(Number(cursor.rev)));
+}
+
+/**
+ * Apply one authority delta and unseal.
+ *
+ * `result` is exactly what `supervisor.fsAcquire(epoch, cursor)` returns
+ * (`VfsAcquireResult` — runtime/os-contracts.ts), so this store slots into the
+ * ACQUIRE/RELEASE protocol the shims already run rather than beside it. One
+ * cache, one invariant.
+ *
+ * Returns the paths that WERE held and are now gone, which is what
+ * `_acquireAndRefetch` re-reads live — the same contract `_acquireBarrier`
+ * already has — and how many named rows were kept because their revision
+ * already covers the report (this facet's own writes coming back).
+ */
+function __residentAdmit(result) {
+  if (!__residentReady) throw new Error("Nimbus: __residentAdmit before __residentBind");
+  const t = __residentT;
+  const dropped = [];
+  const relist = [];
+  let kept = 0, pushed = 0;
+  const epoch = result && result.epoch != null ? String(result.epoch) : null;
+  const rev = result && result.rev != null ? Number(result.rev) : null;
+  if (epoch === null || rev === null) {
+    throw new Error(
+      "Nimbus: fsAcquire returned no cursor; the resident store stays sealed " +
+      "rather than serving rows it cannot date"
+    );
+  }
+  // Answers can be admitted out of the order they were served in (two
+  // barriers in flight). One older than the store's cursor describes a state
+  // the store has already moved past: admitting it would move the cursor
+  // back and install its bytes over newer ones. Within an epoch the cursor
+  // only moves forward, and only entries above it are applied.
+  const at = __residentCursor();
+  const floor = at !== null && !__residentSealed && at.epoch === epoch && !(result && result.poison) ? at.rev : null;
+  if (floor !== null && rev <= floor) {
+    return { dropped, kept, pushed: 0, relist, cursor: at, stale: rev < floor };
+  }
+  // The namespace moves with the cursor or not at all: a delta without stats,
+  // or a poison, leaves it describing a revision the cursor has left, so it
+  // stops answering until a listing restores it.
+  // An answer naming no path changes no name, with or without stats.
+  const namespaced = __nsOk && !!result && !result.poison
+    && (result.namespace === true || (Array.isArray(result.paths) && result.paths.length === 0))
+    && (!Array.isArray(result.paths) || result.paths.every((entry) => entry.stat === null || __nsDescribes(entry.stat)));
+  if (!namespaced) {
+    __nsMarkReady(t, false, !result || result.poison ? "the session's change log was truncated past this process's cursor"
+      : "a change reported without the stat every name needs");
+  }
+  if (!result || result.poison) {
+    // A delta admission has no absolute listing to vouch for a row, so a
+    // poison here means nothing the authority dated can be kept.
+    //
+    // This is the LAST resort, not the poison policy.
+    // `__residentSynchronizeFromSupervisor` repairs the same poison against
+    // absolute per-path revisions and keeps every row it can prove current;
+    // dropping the store is what made a poison cost a whole filesystem.
+    __residentDropDated();
+  } else if (Array.isArray(result.paths)) {
+    for (const entry of result.paths) {
+      if (floor !== null && Number(entry.rev) <= floor) continue;
+      const path = entry.path;
+      if (namespaced && __nsReady()) {
+        const again = __nsApplyEntry(t, entry);
+        if (again !== null) relist.push(again);
+      }
+      // A row at or above the reported revision already holds that mutation —
+      // this facet's own write coming back, or bytes fetched after it; anything
+      // else is someone else's and is dropped. A row of own bytes
+      // (__RK_OWN_WRITE) is newer than any authority revision by construction
+      // and is kept — read-your-writes survives a peer's mutation of the same
+      // path, and the report is adjudicated when the write's own revision
+      // arrives (the shims note it for the ledger before admitting).
+      // A subtree-scoped or structural entry covers every row at or under its
+      // path, each judged the same way: something beneath it this facet may
+      // not see changed, or the directory went, or who may enter it did. A
+      // row there may be stale, or no longer this facet's to be served.
+      if (entry.subtree || entry.structural) {
+        const end = __residentPrefixEnd(path + "/");
+        for (const row of t.fileRevsIn(path + "/", end)) {
+          const stamped = Number(row.rev);
+          if (stamped === __RK_OWN_WRITE || stamped >= Number(entry.rev)) continue;
+          t.chunkDelete(row.path);
+          t.fileDelete(row.path);
+          dropped.push(String(row.path));
+        }
+        for (const [heldPath, heldCell] of [...__residentHeld]) {
+          if (!heldPath.startsWith(path + "/") || heldCell.rev === __RK_OWN_WRITE || heldCell.rev >= Number(entry.rev)) continue;
+          __residentForgetHeld(heldPath);
+        }
+        // Names under it may have become hidden or visible without being
+        // named: the namespace relists that subtree.
+        if (namespaced && entry.subtree && entry.stat && entry.stat.type === "directory") relist.push(path);
+      }
+      let held = false, stamped = 0, heldKey = null;
+      const row = t.fileRevKey(path);
+      if (row !== undefined) {
+        held = true; stamped = Number(row.rev); heldKey = row.ckey == null ? null : String(row.ckey);
+      }
+      if (held && (stamped === __RK_OWN_WRITE || stamped >= Number(entry.rev))) { kept++; continue; }
+      // A cell held in memory (an own write the store had no room for) is
+      // judged the same way; superseded, it goes, and the report's bytes, if
+      // any, are held as the store can.
+      const heldCell = __residentHeld.get(path);
+      if (heldCell !== undefined) {
+        if (heldCell.rev === __RK_OWN_WRITE || heldCell.rev >= Number(entry.rev)) { kept++; continue; }
+        __residentForgetHeld(path);
+      }
+      // The same bytes under a newer revision (a chmod, a touch, a rewrite
+      // with identical content): kept, and dated at the report.
+      if (held && heldKey !== null && entry.contentKey != null && heldKey === String(entry.contentKey)) {
+        t.fileSetRev(path, Number(entry.rev));
+        kept++;
+        continue;
+      }
+      // Pushed content: the file's bytes at the answer's revision, so dating
+      // them at the path's own revision cannot be newer than they are.
+      if (entry.bytes != null && entry.stat && entry.stat.type === "file") {
+        if (__residentPut(t, path, __residentBytes(entry.bytes), Number(entry.rev), entry.contentKey)) pushed++;
+        else if (held) dropped.push(path);
+        continue;
+      }
+      if (!held) continue;
+      t.chunkDelete(path);
+      t.fileDelete(path);
+      dropped.push(path);
+    }
+  }
+  __residentWriteCursor(t, { epoch, rev });
+  __residentSealed = false;
+  __residentSealReason = "";
+  return { dropped, kept, pushed, relist, cursor: { epoch, rev } };
+}
+
+/**
+ * Drop every row the authority dated, and nothing else: what a poison does to
+ * the rows when nothing can vouch for them. The cursor is left alone, because
+ * a store that holds no dated row cannot hold a stale one whatever its cursor
+ * says.
+ *
+ * This facet's own bytes are not the authority's to vouch for, and stay:
+ * dropping a row a write or mutation still in flight owns would hand the next
+ * fill the pre-write bytes. Its acknowledgement dates it, or evicts it, when
+ * it lands.
+ *
+ * Two statements rather than a delete per path: at pi scale that is 7,141
+ * rows, and this is on the hot path (measured 45 ms whole-store, vs a per-row
+ * walk).
+ */
+function __residentDropDated() {
+  if (!__residentReady) throw new Error("Nimbus: __residentDropDated before __residentBind");
+  __residentT.dropDated();
+  for (const [path, held] of [...__residentHeld]) if (held.rev !== __RK_OWN_WRITE) __residentForgetHeld(path);
+}
+
+/** Re-seal — for a store whose backing is being replaced (slot handover). */
+function __residentSeal(reason) {
+  __residentSealed = true;
+  __residentSealReason = String(reason || "resealed");
+}
+
+/** One row of 'file', or undefined. The existence/shape query. */
+function __residentHead(path) {
+  return __residentRequire().fileHead(path);
+}
+
+/**
+ * The synchronous read. THE point of this module: a plain, non-async function
+ * that returns content, so a fs.readFileSync call stack never has to yield.
+ *
+ * Returns exactly what __vfsBundle has always returned — a string, a
+ * Uint8Array, or an { error: "EACCES" } denial — or undefined for a cell that
+ * is not held.
+ */
+function __residentGet(path) {
+  if (globalThis.__nimbusProfileStaged) globalThis.__nimbusProfileStaged.delete(String(path).replace(/^\/+/, ""));
+  const head = __residentHead(path);
+  if (head === undefined) {
+    const held = __residentHeld.get(path);
+    if (held === undefined) return undefined;
+    __residentHeld.delete(path);
+    __residentHeld.set(path, held);
+    return held.cell;
+  }
+  const kind = Number(head.kind);
+  if (kind === __RK_DENIED) return { error: "EACCES" };
+  const t = __residentRequire();
+  const chunks = Number(head.chunks);
+  if (chunks === 1) {
+    const row = t.chunkFirst(path);
+    if (row === undefined) return undefined;
+    return kind === __RK_TEXT ? row.txt : __residentBytes(row.bin);
+  }
+  // Chunked: a file past the single-value ceiling. Reassembled here so callers
+  // never learn the file was split.
+  const parts = [];
+  for (const row of t.chunkParts(path)) {
+    parts.push(kind === __RK_TEXT ? row.txt : __residentBytes(row.bin));
+  }
+  if (parts.length === 0) return undefined;
+  if (kind === __RK_TEXT) return parts.join("");
+  const total = parts.reduce((n, p) => n + p.byteLength, 0);
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const p of parts) { out.set(p, at); at += p.byteLength; }
+  return out;
+}
+
+function __residentBytes(value) {
+  if (value instanceof Uint8Array) return value;
+  if (value instanceof ArrayBuffer) return new Uint8Array(value);
+  return new Uint8Array(0);
+}
+
+/**
+ * Write one cell, chunking past the single-value ceiling.
+ *
+ * `rev` is the authority revision these bytes were read at, and it is what
+ * makes the row datable. Omitting it means the cell is this facet's own
+ * unflushed write, stored as __RK_OWN_WRITE — always readable
+ * (read-your-writes) and never mistaken for something the authority vouched
+ * for. There is no third case: the column refuses one.
+ */
+function __residentPut(t, path, cell, rev, ckey) {
+  // Whatever this puts supersedes a held cell, held or not.
+  __residentForgetHeld(path);
+  t.chunkDelete(path);
+  const stamp = typeof rev === "number" ? rev : __RK_OWN_WRITE;
+  if (cell && typeof cell === "object" && cell.error) {
+    t.filePut(path, __RK_DENIED, 0, 0, stamp, null);
+    return true;
+  }
+  const isText = typeof cell === "string";
+  const kind = isText ? __RK_TEXT : __RK_BINARY;
+  const body = isText ? cell : __residentBytes(cell);
+  const size = isText ? body.length : body.byteLength;
+  // Chunk on the encoded length for text, since the ceiling is on bytes and a
+  // multi-byte string would otherwise cross it while measuring short.
+  const limit = isText ? Math.floor(__RESIDENT_CHUNK_BYTES / 3) : __RESIDENT_CHUNK_BYTES;
+  const chunks = Math.max(1, Math.ceil(size / limit));
+  // Not admitted: nothing is held for the path (its old bytes are gone above).
+  if (!__residentFits(__residentCellCost(cell), stamp !== __RK_OWN_WRITE)) {
+    t.fileDelete(path);
+    if (stamp === __RK_OWN_WRITE) __residentHold(path, cell);
+    return false;
+  }
+  for (let part = 0; part < chunks; part++) {
+    const slice = body.slice(part * limit, (part + 1) * limit);
+    if (isText) t.chunkAddText(path, part, slice);
+    else t.chunkAddBin(path, part, slice);
+  }
+  t.filePut(path, kind, size, chunks, stamp, stamp === __RK_OWN_WRITE || ckey == null ? null : String(ckey));
+  return true;
+}
+
+/** One chunk row, written as it arrives. The streaming filler's primitive. */
+function __residentPutChunk(t, path, part, bytes) {
+  if (!__residentFits(Math.ceil(bytes.byteLength * 1.01) + __RESIDENT_ROW_BYTES + 4096)) return false;
+  t.chunkSetBin(path, part, bytes);
+  return true;
+}
+
+/**
+ * The head row, written LAST by the streaming filler.
+ *
+ * Order is the durability rule here: without a head row `__residentHead`
+ * returns undefined and the path simply misses, falling through to the
+ * supervisor exactly as it would have. So a fill interrupted part way through
+ * a large file leaves chunks nothing can read, never a short file something
+ * can. Writing the head first would invert that into a truncated read.
+ */
+function __residentPutHead(t, path, kind, size, chunks, rev, ckey) {
+  t.filePut(
+    path, kind, size, chunks, typeof rev === "number" ? rev : __RK_OWN_WRITE,
+    typeof rev === "number" && ckey != null ? String(ckey) : null,
+  );
+}
+
+/**
+ * Hold `path` with the bytes of a dated row whose content identity is
+ * `ckey`, by copying rows inside this store: equal keys are equal bytes, so
+ * no fetch is needed. Returns whether a source existed.
+ */
+function __residentCopyByKey(t, path, ckey, rev) {
+  const source = t.fileByKey(String(ckey), path);
+  if (source === undefined) return false;
+  if (!__residentFits(Number(source.size) + (Number(source.chunks) + 1) * __RESIDENT_ROW_BYTES)) return false;
+  t.chunkDelete(path);
+  t.chunkCopy(path, String(source.path));
+  t.filePut(path, Number(source.kind), Number(source.size), Number(source.chunks), rev, String(ckey));
+  return true;
+}
+
+function __residentDelete(t, path) {
+  const had = __residentHead(path) !== undefined || __residentHeld.has(path);
+  __residentForgetHeld(path);
+  t.chunkDelete(path);
+  t.fileDelete(path);
+  return had;
+}
+
+/**
+ * What a row is dated at: its revision, __RK_OWN_WRITE for this facet's own
+ * unacknowledged bytes, or undefined when the path is not held.
+ */
+function __residentProvenance(path) {
+  return __residentRequire().fileRev(path);
+}
+
+/**
+ * Date this facet's own bytes with the revision the authority acknowledged
+ * them at: the revision a flushed write produced, or the one an own mutation's
+ * receipt settles on. The store's half of the stamp `__vfsBundleRevisions`
+ * carries in heap (_shared/vfs-write-ledger.ts), kept in the row it describes
+ * so the two cannot drift.
+ *
+ * Only a row still holding own bytes is dated. One that was dropped or
+ * replaced meanwhile holds something this acknowledgement says nothing about.
+ *
+ * Without it nothing dates an own row, and __RK_OWN_WRITE is the revision a
+ * delta never evicts: a file this process wrote would serve its own bytes over
+ * every later write to it by anyone.
+ */
+function __residentStamp(path, rev) {
+  const heldCell = __residentHeld.get(path);
+  if (heldCell !== undefined && heldCell.rev === __RK_OWN_WRITE) heldCell.rev = rev;
+  const t = __residentRequire();
+  const size = t.fileOwnSize(path);
+  if (size === undefined) return;
+  t.fileStampOwn(path, rev);
+  __nsNoteOwnFile(path, size, rev);
+}
+
+/**
+ * Hold a dated row as this facet's own for the window of one of its own
+ * mutations (a ranged write, a truncate, a chmod), and return the revision it
+ * was dated at: the mutation's receipt is judged against it when the window
+ * closes (`__nimbusEndOwnMutation`). Undefined when there is no dated row —
+ * an own row is held already, and an absent one has nothing to protect.
+ *
+ * The hold is what keeps a barrier that reports the mutation before its own
+ * response arrives from evicting the cell the mutation is about to overlay.
+ * The supervisor answers fsAcquire at once, while a write's response waits on
+ * the Durable Object's output gate, so that ordering is ordinary.
+ */
+function __residentLease(path) {
+  const t = __residentRequire();
+  const rev = t.fileRev(path);
+  if (rev === undefined || rev === __RK_OWN_WRITE) return undefined;
+  t.fileSetRev(path, __RK_OWN_WRITE);
+  return rev;
+}
+
+/**
+ * Install bytes a live read returned, dated `rev`: the cursor the read was
+ * issued under, so the bytes hold every mutation at or below it. An async read
+ * must write through, or the next synchronous read goes back in time relative
+ * to what the program was just handed (protocol §5.9).
+ *
+ * Refused over a row of own bytes, which are newer than anything a read can
+ * return, and over a row dated after `rev`, which is newer than this read can
+ * vouch for. Returns whether the bytes were installed.
+ */
+function __residentFill(path, cell, rev) {
+  if (typeof rev !== "number" || rev < 0) {
+    throw new Error(
+      "Nimbus: refusing to fill '" + path + "' with no authority revision. " +
+      "An undated row cannot be invalidated, so it would be served stale forever."
+    );
+  }
+  const t = __residentRequire();
+  const held = t.fileRev(path);
+  if (held !== undefined && (held === __RK_OWN_WRITE || held > rev)) return false;
+  const heldCell = __residentHeld.get(path);
+  if (heldCell !== undefined && (heldCell.rev === __RK_OWN_WRITE || heldCell.rev > rev)) return false;
+  return __residentPut(t, path, cell, rev);
+}
+
+/** Every held path. Backs the Object.keys / for-in scans in the shims. */
+function __residentKeys() {
+  return __residentRequire().fileAllPaths();
+}
+
+/**
+ * Every path held as this facet's own unacknowledged bytes: the rows a
+ * poison's repair keeps without a revision to vouch for them, whose reports
+ * the shims deliver to their owners (`_settleSkippedReports`).
+ */
+function __residentOwnPaths() {
+  return __residentRequire().fileOwnPaths();
+}
+
+/**
+ * The exclusive upper bound of a prefix under the BINARY collation SQLite gives
+ * a TEXT PRIMARY KEY — the successor of the last code unit it can increment.
+ * Null when there is none (an empty prefix, or one ending in U+FFFF), and the
+ * caller then scans open-ended, which is correct and merely slower.
+ *
+ * Every caller passes a directory prefix ending in '/', so the increment is
+ * '/' → '0' and UTF-16 and UTF-8 orderings agree exactly. They diverge only
+ * around the surrogate range, which no path segment separator lives in.
+ */
+function __residentPrefixEnd(prefix) {
+  for (let i = prefix.length - 1; i >= 0; i--) {
+    const code = prefix.charCodeAt(i);
+    if (code < 0xffff) return prefix.slice(0, i) + String.fromCharCode(code + 1);
+  }
+  return null;
+}
+
+/**
+ * Paths under a directory prefix, as a bounded index range scan.
+ *
+ * The shims ask this constantly — readdirSync's union with the manifest,
+ * existsSync of a directory, node's own module resolution, rm -rf, watch
+ * globbing. In heap it was a for-in over every key; here it must be a range
+ * scan on both ends, because that is the only version that is actually cheaper:
+ * an open-ended `path >= prefix` with a LIKE filter still visits every row
+ * after the prefix, and going back through the object protocol visits every row
+ * AND reads every file's bytes.
+ *
+ * Two bounds also mean no LIKE, so a real path containing '%' or '_' needs no
+ * escaping — those are only wildcards to an operator this no longer uses.
+ */
+function __residentKeysUnder(prefix) {
+  const from = String(prefix);
+  const to = __residentPrefixEnd(from);
+  return __residentRequire().filePaths(from, to);
+}
+
+/**
+ * Whether ANY path is held under a prefix — the same range, stopped at the
+ * first row. The hot half: it is what answers "is this a directory" on node's
+ * module-resolution path, where materialising the subtree would be the cost all
+ * over again.
+ */
+function __residentHasUnder(prefix) {
+  const from = String(prefix);
+  const to = __residentPrefixEnd(from);
+  return __residentRequire().fileAny(from, to);
+}
+
+// ── The namespace ───────────────────────────────────────────────────────────
+//
+// Every name the credential can see, exact at the store's cursor: filled from
+// a complete listing, then moved forward by each ACQUIRE delta, whose entries
+// carry the path's stat at the answer's revision (null when it is gone). A
+// change of presence or stat is always a logged mutation of that path, except
+// what vanishes beneath a removed or replaced directory, which the delta
+// application drops by subtree. So a synchronous stat, exists or readdir is
+// answered exactly, and an absent name is known to be absent.
+//
+// This table holds the AUTHORITY's view only. The process's own pending
+// structural effects are an overlay kept by the shims, retired once a barrier
+// begun after they settled has applied.
+
+const __NS_FILE = 0;
+const __NS_DIR = 1;
+const __NS_LINK = 2;
+/** Symlink hops before a resolution is ELOOP, as Linux's MAXSYMLINKS. */
+const __NS_MAX_HOPS = 40;
+/** Paths of every symlink in the table: resolution walks only past these. */
+let __nsLinks = new Set();
+/** The credential names are judged traversable for. */
+let __nsCred = null;
+
+function __nsSetCred(cred) { __nsCred = cred || null; }
+
+function __nsSplit(k) {
+  const i = k.lastIndexOf("/");
+  return i < 0 ? ["", k] : [k.slice(0, i), k.slice(i + 1)];
+}
+
+function __nsKindCode(type) {
+  return type === "directory" ? __NS_DIR : type === "symlink" ? __NS_LINK : __NS_FILE;
+}
+
+function __nsLoadLinks(t) {
+  __nsLinks = new Set();
+  for (const row of t.nsOfKind(__NS_LINK)) {
+    const parent = String(row.parent);
+    __nsLinks.add(parent ? parent + "/" + String(row.name) : String(row.name));
+  }
+}
+
+/** Whether the table describes the store's cursor. */
+function __nsReady() {
+  return __residentReady && !__residentSealed && __nsOk;
+}
+
+/** The persisted 'ns' flag, mirrored in heap because every stat asks it. */
+let __nsOk = false;
+/** Why the namespace stopped answering, while it does not: what a refused sync call names. */
+let __nsCause = "the process has not listed it yet";
+
+function __nsMarkReady(t, ready, cause) {
+  t.metaSet("ns", ready ? "1" : "0");
+  __nsOk = !!ready;
+  if (!ready) __nsCause = String(cause || "a change it could not follow");
+}
+
+/** Why the namespace is not answering (meaningful only while __nsReady() is false). */
+function __nsNotReadyCause() {
+  if (!__residentReady) return "the process's store is not bound";
+  if (__residentSealed) return __residentSealReason || "the store has not reconciled with the session";
+  return __nsCause;
+}
+
+/**
+ * Whether a stat from the authority describes its name: a type, and the
+ * mode, owner and group every permission check reads. One without them is
+ * no record. Stored, its missing fields would become zeros, a root-owned
+ * mode-0 file the authority never reported. The namespace then stops
+ * answering (as for a delta without stats) until a listing that does
+ * describe every name restores it.
+ */
+function __nsDescribes(stat) {
+  if (!stat || typeof stat.type !== "string") return false;
+  for (const field of ["mode", "uid", "gid"]) {
+    if (stat[field] === null || stat[field] === undefined || !Number.isInteger(Number(stat[field]))) return false;
+  }
+  return true;
+}
+
+function __nsPut(t, k, stat, rev, target) {
+  const [parent, name] = __nsSplit(k);
+  const kind = __nsKindCode(stat.type);
+  t.nsPut(
+    parent, name, kind, Number(stat.size) || 0, Number(stat.mode) || 0, Number(stat.uid) || 0,
+    Number(stat.gid) || 0, Number(stat.atime) || 0, Number(stat.mtime) || 0, Number(stat.ctime) || 0,
+    Number(stat.ino) || 0, Number(rev) || 0, kind === __NS_LINK ? String(target ?? "") : null,
+  );
+  if (kind === __NS_LINK) __nsLinks.add(k); else __nsLinks.delete(k);
+}
+
+// The authority operation may succeed while metadata cannot be cached.
+// nsPut has sealed the sync view on heap ENOSPC; preserve the async result.
+function __nsTryPut(t, k, stat, rev, target) {
+  try { __nsPut(t, k, stat, rev, target); return true; }
+  catch (error) {
+    if (__residentInHeap && error && error.code === "ENOSPC") return false;
+    throw error;
+  }
+}
+
+/** Delete everything beneath `k`, and `k` itself when `self`. */
+function __nsDeleteTree(t, k, self) {
+  if (k === "") {
+    t.nsClear();
+    __nsLinks = new Set();
+    return;
+  }
+  const prefix = k + "/";
+  const end = __residentPrefixEnd(prefix);
+  t.nsDeleteChildren(k);
+  t.nsDeleteParents(prefix, end);
+  if (self) {
+    const [parent, name] = __nsSplit(k);
+    t.nsDelete(parent, name);
+    __nsLinks.delete(k);
+  }
+  for (const link of __nsLinks) if (link.startsWith(prefix)) __nsLinks.delete(link);
+}
+
+/** The row at exactly `k` (no symlink resolution), or undefined. */
+function __nsRowAt(t, k) {
+  if (k === "") {
+    return { kind: __NS_DIR, size: 0, mode: 0o40755, uid: 0, gid: 0, atime: 0, mtime: 0, ctime: 0, ino: 1, rev: 0, target: null };
+  }
+  const [parent, name] = __nsSplit(k);
+  return t.nsGet(parent, name);
+}
+
+function __nsJoinTarget(linkPath, target) {
+  const t = String(target);
+  const parts = (t.startsWith("/") ? [] : __nsSplit(linkPath)[0].split("/").filter(Boolean));
+  for (const seg of t.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") parts.pop(); else parts.push(seg);
+  }
+  return parts.join("/");
+}
+
+/**
+ * Resolve `k` through the symlinks the namespace holds: { path, row } for the
+ * name it denotes, null when nothing is there, or "ELOOP". The leaf is
+ * followed only when `followLeaf`. Walks component by component only when a
+ * symlink sits on the path; otherwise it is one lookup.
+ */
+function __nsResolve(k, followLeaf) {
+  const t = __residentRequire();
+  let path = k;
+  for (let hops = 0; hops <= __NS_MAX_HOPS; hops++) {
+    let redirected = false;
+    if (__nsLinks.size > 0) {
+      const segs = path.split("/");
+      for (let i = 1; i <= segs.length; i++) {
+        const prefix = segs.slice(0, i).join("/");
+        if (!__nsLinks.has(prefix)) continue;
+        if (i === segs.length && !followLeaf) break;
+        const row = __nsRowAt(t, prefix);
+        if (!row || Number(row.kind) !== __NS_LINK) break;
+        const rest = segs.slice(i).join("/");
+        const target = __nsJoinTarget(prefix, row.target);
+        path = rest ? (target ? target + "/" + rest : rest) : target;
+        redirected = true;
+        break;
+      }
+    }
+    if (redirected) continue;
+    const row = __nsRowAt(t, path);
+    return row === undefined ? null : { path, row };
+  }
+  return "ELOOP";
+}
+
+/** The entries directly under directory `k` (already resolved): [{ name, kind }]. */
+function __nsChildren(k) {
+  return __residentRequire().nsChildren(k).map((row) => ({ name: String(row.name), kind: Number(row.kind) }));
+}
+
+/** Whether the credential may search directory `row` (POSIX x). */
+function __nsTraversable(row) {
+  const cred = __nsCred;
+  if (!row || Number(row.kind) !== __NS_DIR) return false;
+  const mode = Number(row.mode) & 0o777;
+  if (!cred) return true;
+  if (Number(cred.uid) === 0) return (mode & 0o111) !== 0;
+  const groups = Array.isArray(cred.groups) ? cred.groups.map(Number) : [];
+  const shift = Number(cred.uid) === Number(row.uid) ? 6
+    : (Number(cred.gid) === Number(row.gid) || groups.includes(Number(row.gid))) ? 3 : 0;
+  return ((mode >> shift) & 1) === 1;
+}
+
+/**
+ * Apply one delta entry that carries a stat. Returns a directory whose
+ * subtree must be relisted — one that just became searchable, whose
+ * descendants no delta names — or null.
+ */
+function __nsApplyEntry(t, entry) {
+  const k = String(entry.path).replace(/^\/+/, "");
+  if (k === "") return null;
+  if (entry.stat === null) { __nsDeleteTree(t, k, true); return null; }
+  const before = __nsRowAt(t, k);
+  if (!__nsTryPut(t, k, entry.stat, entry.rev, entry.linkTarget)) return null;
+  const after = __nsRowAt(t, k);
+  if (Number(after.kind) !== __NS_DIR) { __nsDeleteTree(t, k, false); return null; }
+  const was = before !== undefined && __nsTraversable(before);
+  const now = __nsTraversable(after);
+  if (was && !now) __nsDeleteTree(t, k, false);
+  if (!was && now && before !== undefined) return k;
+  return null;
+}
+
+/**
+ * Bring the table to a complete listing: upsert what differs, delete what the
+ * listing no longer names. `entries` are VfsListEntry (path, stat, rev,
+ * linkTarget). Called once per enumeration, after its last page.
+ */
+function __nsReplace(t, entries) {
+  const listed = new Set();
+  for (const entry of entries) listed.add(String(entry.path).replace(/^\/+/, ""));
+  // Remove stale rows before admitting replacements; do not transiently
+  // charge both versions of a complete namespace against the fixed cap.
+  for (const row of t.nsKeys()) {
+    const parent = String(row.parent);
+    const k = parent ? parent + "/" + String(row.name) : String(row.name);
+    if (!listed.has(k)) { t.nsDelete(parent, String(row.name)); __nsLinks.delete(k); }
+  }
+  // Free shrinking text before growing another surviving row; final-state
+  // admission must not depend on alphabetical replacement order.
+  if (__residentInHeap) {
+    for (const entry of entries) {
+      const k = String(entry.path).replace(/^\/+/, "");
+      if (!k) continue;
+      const [parent, name] = __nsSplit(k);
+      const held = t.nsGet(parent, name);
+      if (held && __namespaceRowBytes(parent, name, held.target) > __namespaceRowBytes(parent, name, entry.linkTarget)) {
+        __nsPut(t, k, entry.stat, entry.rev, entry.linkTarget);
+      }
+    }
+  }
+  for (const entry of entries) {
+    const k = String(entry.path).replace(/^\/+/, "");
+    if (k === "") continue;
+    listed.add(k);
+    const held = __nsRowAt(t, k);
+    const s = entry.stat;
+    if (held !== undefined
+      && Number(held.kind) === __nsKindCode(s.type) && Number(held.size) === Number(s.size)
+      && Number(held.mode) === Number(s.mode) && Number(held.uid) === Number(s.uid)
+      && Number(held.gid) === Number(s.gid) && Number(held.mtime) === Number(s.mtime)
+      && Number(held.ctime) === Number(s.ctime) && Number(held.ino) === Number(s.ino)
+      && Number(held.rev) === Number(entry.rev)
+      && (held.target ?? null) === (entry.linkTarget ?? null)) continue;
+    __nsPut(t, k, s, entry.rev, entry.linkTarget);
+  }
+}
+
+/**
+ * Record this facet's own acknowledged write in the namespace before the
+ * delta that reports it: a file it created is then listed at once. Only
+ * when the table has nothing as new, so an authority stat already applied at
+ * or past `rev` is never overwritten by this approximation; the delta that
+ * reports the write replaces it with the authority's stat.
+ */
+function __nsNoteOwnFile(k, size, rev) {
+  if (!__nsReady()) return;
+  const t = __residentT;
+  const held = __nsRowAt(t, k);
+  if (held !== undefined && Number(held.rev) >= rev) return;
+  const now = Date.now();
+  __nsTryPut(t, k, {
+    // A file the process created: its umask's mode, until the delta reports
+    // the authority's own stat for it.
+    type: "file", size, mode: held ? Number(held.mode) : 0o100666 & ~Number(__nsCred?.umask ?? 0o022),
+    uid: held ? Number(held.uid) : Number(__nsCred?.uid ?? 0),
+    gid: held ? Number(held.gid) : Number(__nsCred?.gid ?? 0),
+    atime: now, mtime: now, ctime: now, ino: held ? Number(held.ino) : 0,
+  }, rev, null);
+}
+
+/**
+ * Record what the authority just said of a name this process asked about (an
+ * async stat, read or accepted write): the sync view answers it at once,
+ * as it would after the delta that reports it. Dated at the store's cursor,
+ * so any row as new is kept, and the next delta naming the path replaces it
+ * with the authority's own dating. `stat` null: the authority said it is not
+ * there, and a row older than the cursor goes.
+ */
+function __nsNoteLiveStat(k, stat) {
+  if (!__nsReady()) return;
+  const cursor = __residentCursor();
+  if (cursor === null) return;
+  const t = __residentT;
+  const held = __nsRowAt(t, k);
+  if (held !== undefined && Number(held.rev) >= cursor.rev) return;
+  if (stat === null) {
+    if (held !== undefined) { const [parent, name] = __nsSplit(k); t.nsDelete(parent, name); __nsLinks.delete(k); }
+    return;
+  }
+  if (!__nsDescribes(stat)) return;
+  __nsTryPut(t, k, stat, cursor.rev, stat.linkTarget ?? stat.target ?? null);
+}
+
+/**
+ * Drop every cell AND the cursor, and re-seal.
+ *
+ * This is slot handover, not invalidation: a returned slot must not hand the
+ * next tenant a filesystem, and dropping the rows while leaving a cursor behind
+ * would leave the store claiming to be current at a revision it holds nothing
+ * from. Clearing the cursor forces the next incarnation through
+ * `__residentAdmit` from scratch. `__residentBoot` clears the same way when a
+ * kept store cannot be reconciled.
+ */
+function __residentClear() {
+  if (!__residentReady) throw new Error("Nimbus: __residentClear before __residentBind");
+  __residentT.clear();
+  // Held cells go with the rows, but for own writes still in flight.
+  for (const [path, held] of [...__residentHeld]) if (held.rev !== __RK_OWN_WRITE) __residentForgetHeld(path);
+  __nsLinks = new Set();
+  __nsOk = false;
+  __residentSeal("the store was cleared");
+}
+
+function __residentStats() {
+  if (!__residentReady) throw new Error("Nimbus: __residentStats before __residentBind");
+  const t = __residentT;
+  const counted = t.fileStats();
+  const files = counted === undefined ? 0 : Number(counted.n);
+  const bytes = counted === undefined ? 0 : Number(counted.b);
+  const names = t.nsCount();
+  return {
+    files, bytes, names,
+    namespace: __nsReady(),
+    databaseSize: t.databaseSize(),
+    sealed: __residentSealed,
+    undatedSnapshot: __residentUndated,
+    cursor: __residentCursor(),
+  };
+}
+
+/**
+ * Make this incarnation's store servable before the program's first
+ * instruction. The one boot path the resident body takes.
+ *
+ * A COLD store — no persisted cursor — adopts this spawn's own snapshot, the
+ * module bundle dated at the cursor it was read at, and then fills the rest of
+ * the filesystem from the authority. Its rows are current as of the spawn
+ * whether or not the fill completes, which is all the protocol asks of a
+ * process's first block (§5.3); the first ACQUIRE's delta brings them the rest
+ * of the way.
+ *
+ * A KEPT store holds a PREVIOUS process's rows, dated against a cursor this
+ * incarnation has never applied. A durable application's facet is one: it
+ * keeps its `app-slot-` name across launches and its release never deletes
+ * storage, so every relaunch or re-drive of the application opens what its
+ * last process left. The rows are the asset — inside one supervisor
+ * incarnation a relaunch fetches what changed, not the filesystem; across two,
+ * whose revisions are unrelated, the reconcile rebuilds every dated row — and
+ * they are also arbitrarily old: only the reconcile says which of them still
+ * describe the filesystem, and nothing else runs before the program's first
+ * synchronous reads. So the store stays SEALED through the reconcile, and a
+ * reconcile that cannot vouch for its rows — the listing failed, came back
+ * short, or there is no supervisor to ask — does not open it. The kept store
+ * is emptied instead and this launch boots exactly as a cold one does: the
+ * rare failure costs a relaunch its speedup, never a stale byte.
+ *
+ * The previous process's own unacknowledged rows are the one thing the
+ * reconcile cannot judge, since it keeps own rows whatever the listing says.
+ * `__residentBind` drops them before any of this runs.
+ *
+ * `takeBundle` hands over the module bundle and drops the module's own
+ * reference to it. The parsed bundle is the largest allocation in the facet
+ * before the program starts, so a cold boot releases it the moment it is
+ * adopted, and a kept store that reconciles never adopts it at all.
+ *
+ * Returns the cursor to publish and, when the boot fell short of the whole
+ * filesystem, why.
+ */
+async function __residentBoot(takeBundle, moduleCursor, supervisor) {
+  if (!__residentReady) throw new Error("Nimbus: __residentBoot before __residentBind");
+  let failure = null;
+  if (__residentCursor() !== null) {
+    let pass = null;
+    try { pass = await __residentSynchronizeFromSupervisor(supervisor); }
+    catch (e) { failure = (e && e.message) || String(e); }
+    if (pass && pass.cursor) return { cursor: await __residentCatchUp(supervisor, pass.cursor), failure: null };
+    failure = "a kept store could not be reconciled ("
+      + (failure || (pass && (pass.skipped || pass.incomplete)) || "the listing vouched for nothing")
+      + "); it was emptied and this launch booted from its own snapshot";
+  }
+  // A store with no cursor holds nothing any incarnation can date.
+  __residentClear();
+  const bundle = takeBundle();
+  // The module map is the program's code: it is held whole or the launch
+  // fails. Spawn admitted it (N18); this is room for it now, asked for when
+  // the store's cap does not already cover it.
+  let moduleBytes = 0;
+  for (const path of Object.keys(bundle || {})) moduleBytes += __residentCellCost(bundle[path]);
+  if (!(await __residentEnsureRoom(moduleBytes))) {
+    throw Object.assign(new Error(
+      "ENOSPC: workspace storage is full: this process's modules (" + Math.ceil(moduleBytes / 1048576)
+        + " MiB) do not fit in what is left of the session's storage"
+    ), { code: "ENOSPC" });
+  }
+  const adopted = __residentAdoptModuleBundle(bundle, moduleCursor);
+  // The pass that just failed is not retried. The store now holds what a
+  // cold launch whose fill failed holds, and its first ACQUIRE's delta
+  // brings it current the same way.
+  if (failure !== null) return { cursor: adopted, failure };
+  let pass = null;
+  try { pass = await __residentSynchronizeFromSupervisor(supervisor); }
+  catch (e) { failure = (e && e.message) || String(e); }
+  if (pass && pass.cursor) return { cursor: await __residentCatchUp(supervisor, pass.cursor), failure };
+  return { cursor: adopted, failure };
+}
+
+/**
+ * The acquire options this store asks for: stats with every delta entry, and
+ * the content of files changed under the push roots — the process's working
+ * tree and /tmp, where what a peer writes after launch is what it goes on to
+ * read (build output, manifests, temp files), less dependencies and VCS state.
+ */
+let __residentPushRoots = [];
+/** Dependencies and VCS state: written in bulk, read through the module map or not at all. */
+const __RESIDENT_PUSH_EXCLUDE = ["node_modules", ".git"];
+function __residentSetPushRoots(roots) {
+  __residentPushRoots = (Array.isArray(roots) ? roots : []).map((r) => String(r).replace(/^\/+|\/+$/g, ""));
+}
+/** Whether a changed file at `path` is one the push roots would carry. */
+function __residentPushable(path) {
+  for (const root of __residentPushRoots) {
+    if (root !== "" && path !== root && !path.startsWith(root + "/")) continue;
+    const rest = root === "" ? path : path.slice(root.length + 1);
+    if (!rest.split("/").some((seg) => __RESIDENT_PUSH_EXCLUDE.includes(seg))) return true;
+  }
+  return false;
+}
+function __residentAcquireOptions() {
+  return __residentPushRoots.length > 0
+    ? { namespace: true, push: { roots: __residentPushRoots, exclude: __RESIDENT_PUSH_EXCLUDE } }
+    : { namespace: true };
+}
+
+/**
+ * One delta from a listing's cursor, applied before the program runs. A
+ * listing's pages are walked at successive revisions, so the namespace it
+ * builds can mix states no single revision had (a rename seen on both sides
+ * or neither); the delta from its cursor names every path that moved during
+ * the walk, and leaves the table exact at the delta's revision. At boot there
+ * are no own writes, so nothing here needs the ledger's report notes.
+ */
+async function __residentCatchUp(supervisor, cursor) {
+  if (!supervisor || typeof supervisor.fsAcquire !== "function") return cursor;
+  let result;
+  try { result = await supervisor.fsAcquire(cursor.epoch, cursor.rev, __residentAcquireOptions()); }
+  catch { result = null; }
+  if (!result || result.poison || typeof result.rev !== "number" || typeof result.epoch !== "string") {
+    // Unanswered: the namespace keeps the listing's revision, which the
+    // program's first barrier brings forward like any other.
+    return cursor;
+  }
+  await __residentRoomForPushed(result);
+  const applied = __residentAdmit(result);
+  for (const dir of applied.relist) await __nsRelist(supervisor, dir);
+  // A dropped row was held, so it is wanted again at its new revision.
+  const refetch = [];
+  for (const path of applied.dropped) {
+    const found = __nsResolve(path, false);
+    if (!found || found === "ELOOP" || Number(found.row.kind) !== __NS_FILE) continue;
+    refetch.push({ path, size: Number(found.row.size), rev: Number(found.row.rev), epoch: applied.cursor.epoch });
+  }
+  if (refetch.length > 0) await __residentFetchFiles(supervisor, refetch);
+  return applied.cursor;
+}
+
+/**
+ * Re-read the names beneath `dir` from the authority: a directory that just
+ * became searchable, whose descendants no delta will ever name.
+ */
+async function __nsRelist(supervisor, dir) {
+  if (!supervisor || typeof supervisor.fsList !== "function") { __nsMarkReady(__residentT, false, "the session cannot list its filesystem"); return; }
+  const t = __residentT;
+  const prefix = dir + "/";
+  const seen = [];
+  let replaceBytes = 0;
+  let incomingBytes = 0;
+  if (__residentInHeap) {
+    for (const row of t.nsKeys()) {
+      const key = row.parent ? row.parent + "/" + row.name : row.name;
+      if (!key.startsWith(prefix)) continue;
+      replaceBytes += __namespaceRowBytes(row.parent, row.name, t.nsGet(row.parent, row.name)?.target);
+    }
+  }
+  let after = prefix;
+  let done = false;
+  for (let page = 0; page < __RESIDENT_MAX_LIST_PAGES && !done; page++) {
+    let listed;
+    try { listed = await supervisor.fsList(after, __RESIDENT_LIST_PAGE); }
+    catch (e) { __nsMarkReady(t, false, "a listing of /" + dir + " failed (" + ((e && e.message) || String(e)) + ")"); return; }
+    if (!listed || !Array.isArray(listed.entries)) { __nsMarkReady(t, false, "a listing of /" + dir + " came back without entries"); return; }
+    for (const entry of listed.entries) {
+      const k = String(entry.path).replace(/^\/+/, "");
+      if (!k.startsWith(prefix)) {
+        if (k > prefix) { done = true; break; }
+        continue;
+      }
+      if (entry.stat) {
+        if (__residentInHeap && __residentCap !== null) {
+          const [parent, name] = __nsSplit(k);
+          incomingBytes += __namespaceRowBytes(parent, name, entry.linkTarget);
+          if (__residentDbBytes() - replaceBytes + incomingBytes > __residentCap) {
+            __nsMarkReady(t, false, "namespace storage budget exceeded (" + __residentCap + " bytes)");
+            return;
+          }
+        }
+        seen.push(entry);
+      }
+    }
+    if (listed.next === null || listed.next === undefined) done = true;
+    else after = listed.next;
+  }
+  if (!done) { __nsMarkReady(t, false, "a listing of /" + dir + " did not finish"); return; }
+  if (!seen.every((entry) => __nsDescribes(entry.stat))) { __nsMarkReady(t, false, "a listing of /" + dir + " named an entry without its stat"); return; }
+  // Exactly what the listing has under the directory: a name it no longer
+  // shows (hidden now, or gone) leaves, one it shows is written.
+  __nsDeleteTree(t, dir, false);
+  for (const entry of seen) __nsPut(t, String(entry.path).replace(/^\/+/, ""), entry.stat, entry.rev, entry.linkTarget);
+}
+
+/**
+ * The launch's data plan (facets/data-plan.ts): the paths whose content a
+ * synchronous read may want, held from boot beside the module map. A launch
+ * with none (a re-entry by an inbound request) holds what it already had.
+ */
+let __residentPlan = new Set();
+function __residentSetPlan(paths) {
+  __residentPlan = new Set(Array.isArray(paths) ? paths.map((p) => String(p).replace(/^\/+/, "")) : []);
+}
+
+/**
+ * Adopt the module map's bundle into an EMPTY store — the first fill, and the
+ * one that costs nothing extra, because those bytes are already in the facet.
+ * The cursor the bundle was read at becomes the store's.
+ *
+ * Returns the cursor the caller should publish, so there is one answer to
+ * "what state does this facet cache" rather than two that can disagree.
+ */
+function __residentAdoptModuleBundle(bundle, moduleCursor) {
+  if (!__residentReady) throw new Error("Nimbus: __residentAdoptModuleBundle before __residentBind");
+  if (__residentCursor() !== null) {
+    // Adopting over a kept store would re-date its rows at this spawn's
+    // cursor without checking one of them. __residentBoot reconciles a kept
+    // store, or empties it first.
+    throw new Error("Nimbus: a module bundle is adopted only into an empty store");
+  }
+  if (!moduleCursor || moduleCursor.epoch == null || moduleCursor.rev == null) {
+    // An undated snapshot. Adopt NOTHING and serve an empty store.
+    //
+    // Not a throw, because this is a real path rather than a misuse: a facet
+    // whose first contact is an inbound HTTP request runs
+    // `__nimbusEnsureStarted(env, ctx)` with no start args, so it has no
+    // cursor to offer. Refusing would turn a served port into a dead one.
+    //
+    // Not an adopt either, because rows nothing can date are the stale-read
+    // bug. An EMPTY store is safe to serve for the reason the seal exists at
+    // all — it has no row whose age could be wrong — and a miss is an answer
+    // the shims already handle, falling through to the supervisor exactly as
+    // they do today after a poison. So this is strictly no worse than the
+    // current behaviour and cannot serve a stale byte.
+    __residentUndated = true;
+    __residentSealed = false;
+    __residentSealReason = "";
+    return null;
+  }
+  const rev = Number(moduleCursor.rev);
+  for (const path of Object.keys(bundle || {})) {
+    __residentPut(__residentT, path, bundle[path], rev);
+  }
+  return __residentAdmit({ poison: false, paths: [], epoch: String(moduleCursor.epoch), rev }).cursor;
+}
+
+/**
+ * Enumerate the whole filesystem, one page at a time.
+ *
+ * WHAT EXISTS has to come from the authority, not from anything the facet was
+ * shipped. That was measured rather than assumed: for a working tree holding a
+ * 25 MiB file outside the cwd, the spawn-time stat table this replaced arrived
+ * with FOUR entries ("home", "opt", "var", "home/user"), every one a
+ * directory. A launch ships only what it staged plus its ancestors; a store
+ * that enumerated from that would hold only what the bundle already had, which
+ * is the admission problem it exists to delete.
+ *
+ * Every page is dated, and a page whose epoch differs from the first ABORTS
+ * the listing. The supervisor was replaced mid-walk, so the pages already
+ * collected describe a filesystem that no longer exists and the revision they
+ * would be dated at is meaningless. Returning short is safe — the rows simply
+ * are not there and the reads miss — while stitching the two halves together
+ * would date one incarnation's bytes at another's clock.
+ */
+async function __residentEnumerate(supervisor) {
+  const entries = [];
+  // Every name, whatever its kind: the namespace is built from these.
+  const names = [];
+  let namespaceBytes = 0;
+  let after = null;
+  let cursor = null;
+  for (let page = 0; page < __RESIDENT_MAX_LIST_PAGES; page++) {
+    const listed = await supervisor.fsList(after, __RESIDENT_LIST_PAGE);
+    if (!listed || !Array.isArray(listed.entries)) {
+      throw new Error("Nimbus: fsList returned no page");
+    }
+    if (cursor === null) {
+      cursor = { epoch: String(listed.epoch), rev: Number(listed.rev) };
+    } else if (String(listed.epoch) !== cursor.epoch) {
+      return { entries, names, cursor, complete: false, reason: "the supervisor changed incarnation mid-enumeration" };
+    }
+    for (const entry of listed.entries) {
+      if (entry.stat) {
+        if (__residentInHeap && __residentCap !== null) {
+          const key = String(entry.path).replace(/^\/+/, "");
+          const [parent, name] = __nsSplit(key);
+          if (key) namespaceBytes += __namespaceRowBytes(parent, name, entry.linkTarget);
+          if (__residentDbBytes() - __residentT.nsBytes() + namespaceBytes > __residentCap) {
+            const cause = "namespace storage budget exceeded (" + __residentCap + " bytes)";
+            __nsMarkReady(__residentT, false, cause);
+            throw Object.assign(new Error(cause), { code: "ENOSPC" });
+          }
+        }
+        names.push(entry);
+      }
+      // Directories carry no content, and a symlink's size is its TARGET's
+      // length rather than the resolved file's — reading one by that size
+      // would store a truncated file and call it whole. Content is fetched
+      // by the path a symlink resolves to.
+      if (entry.kind !== "file") continue;
+      const path = String(entry.path).replace(/^\/+/, "");
+      if (!path) continue;
+      const size = Number(entry.size);
+      // The path's own last-mutation revision. It is what makes a held row
+      // verifiable without fetching its bytes, and so what makes a poison
+      // repairable rather than fatal — see __residentSynchronizeFromSupervisor.
+      const rev = Number(entry.rev);
+      if (!Number.isSafeInteger(size) || size < 0 || !Number.isSafeInteger(rev) || rev < 0) {
+        throw new Error("Nimbus: fsList returned unusable metadata for '" + path + "'");
+      }
+      entries.push({ path, size, rev, epoch: cursor.epoch, ckey: entry.contentKey == null ? null : String(entry.contentKey) });
+    }
+    if (listed.next === null || listed.next === undefined) {
+      return { entries, names, namespaceBytes, cursor, complete: true, reason: null };
+    }
+    after = listed.next;
+  }
+  return { entries, names, cursor, complete: false, reason: "the filesystem exceeded the enumeration page bound" };
+}
+
+/**
+ * Fetch these files from the authority and install them, each dated at the
+ * revision the listing reported it at.
+ *
+ * THE BATCH BOUNDS ARE THE SUPERVISOR'S AND ARE NOT NEGOTIABLE HERE.
+ * `_rpcFsReadBatch` validates with zod and rejects the WHOLE call, so an
+ * over-packed batch loses every path in it rather than degrading. Three
+ * separate bounds apply at once and the packing below respects all three:
+ *
+ *   paths per call      __RESIDENT_BATCH_PATHS   (FS_READ_BATCH_PATH_LIMIT)
+ *   requested bytes     __RESIDENT_BATCH_BYTES   (FS_READ_BATCH_REQUEST_BYTES)
+ *   bytes per range     __RESIDENT_CHUNK_BYTES   (the single-value ceiling)
+ *
+ * Every file is split into __RESIDENT_CHUNK_BYTES ranges — most files are one
+ * short range — and the ranges are packed into calls. That makes the large
+ * file the SAME path as the small one rather than a special case, and it means
+ * no whole-file buffer is ever held: each range is written straight into its
+ * own chunk row as it lands, and the head row follows only once every range of
+ * that file has.
+ *
+ * A row is stamped with its OWN listed revision rather than with the global
+ * cursor. Both are conservative — a write landing mid-fetch reports a revision
+ * above the stamp, so the next ACQUIRE evicts and refetches, while stamping
+ * newer than the bytes would keep a stale row forever — but the per-path
+ * revision is the tighter of the two, and it is the one that survives a
+ * reconcile: a row dated at the global cursor is indistinguishable from a row
+ * whose path moved at that same revision.
+ */
+async function __residentFetchFiles(supervisor, files) {
+  // Content already held under another path, or wanted twice in this batch,
+  // is fetched once: equal keys are equal bytes (the second copy is local).
+  const t = __residentT;
+  const requested = files.length;
+  let copied = 0;
+  const wanted = [];
+  const later = [];
+  const fetching = new Set();
+  for (const file of files) {
+    if (file.ckey != null) {
+      if (__residentCopyByKey(t, file.path, file.ckey, file.rev)) { copied++; continue; }
+      if (fetching.has(file.ckey)) { later.push(file); continue; }
+      fetching.add(file.ckey);
+    }
+    wanted.push(file);
+  }
+  files = wanted;
+  // One flat list of ranges across all files, so packing is a single pass and
+  // a 25 MiB file and a 40-byte one are the same shape.
+  const ranges = [];
+  for (const file of files) {
+    const parts = Math.max(1, Math.ceil(file.size / __RESIDENT_CHUNK_BYTES));
+    for (let part = 0; part < parts; part++) {
+      const offset = part * __RESIDENT_CHUNK_BYTES;
+      ranges.push({
+        path: file.path,
+        rev: file.rev,
+        epoch: file.epoch,
+        part,
+        parts,
+        offset,
+        length: Math.min(__RESIDENT_CHUNK_BYTES, Math.max(0, file.size - offset)),
+        size: file.size,
+        ckey: file.ckey ?? null,
+      });
+    }
+  }
+
+  // Per-file landed-part counts, so a head row is written only once every
+  // range of that file is in. See __residentPutHead.
+  const landed = new Map();
+  let filled = 0, failed = 0, fetchedBytes = 0;
+  const failedPaths = new Set();
+
+  for (let at = 0; at < ranges.length;) {
+    const batch = [];
+    let bytes = 0;
+    while (
+      at < ranges.length
+      && batch.length < __RESIDENT_BATCH_PATHS
+      && (batch.length === 0 || bytes + ranges[at].length <= __RESIDENT_BATCH_BYTES)
+    ) {
+      bytes += ranges[at].length;
+      batch.push(ranges[at]);
+      at++;
+    }
+    // N18: room for the batch first; what the ledger will not admit is read
+    // through the session instead of held.
+    if (!(await __residentEnsureRoom(bytes + batch.length * __RESIDENT_ROW_BYTES))) {
+      for (const r of batch) failedPaths.add(r.path);
+      continue;
+    }
+    let results;
+    try {
+      results = await supervisor.fsReadBatch(
+        batch.map((r) => ({ path: r.path, offset: r.offset, length: r.length, expectedEpoch: r.epoch, expectedRevision: r.rev }))
+      );
+    } catch {
+      for (const r of batch) failedPaths.add(r.path);
+      continue;
+    }
+    for (let i = 0; i < batch.length; i++) {
+      const range = batch[i];
+      const entry = results && results[i];
+      if (!entry || entry.error) {
+        // A denial is a real answer and is stored as one, so a later read
+        // reports EACCES synchronously instead of missing. Anything else is a
+        // path this store will not hold, and a read of it falls through to
+        // exactly the miss it would have had before.
+        if (entry && entry.error && entry.error.code === "EACCES" && range.part === 0) {
+          __residentPut(t, range.path, { error: "EACCES" }, range.rev);
+          filled++;
+        } else failedPaths.add(range.path);
+        continue;
+      }
+      if (entry.bytes === null || entry.bytes === undefined) { failedPaths.add(range.path); continue; }
+      const chunk = __residentBytes(entry.bytes);
+      if (chunk.byteLength !== range.length) { failedPaths.add(range.path); continue; }
+      fetchedBytes += chunk.byteLength;
+      if (!__residentPutChunk(t, range.path, range.part, chunk)) { failedPaths.add(range.path); continue; }
+      const seen = (landed.get(range.path) || 0) + 1;
+      landed.set(range.path, seen);
+      if (seen === range.parts && !failedPaths.has(range.path)) {
+        __residentPutHead(t, range.path, __RK_BINARY, range.size, range.parts, range.rev, range.ckey);
+        filled++;
+      }
+    }
+  }
+
+  // A file whose ranges did not all land has chunk rows and no head, so it is
+  // unreadable rather than short. Drop them so the slot does not carry bytes
+  // nothing will ever serve.
+  for (const path of failedPaths) {
+    failed++;
+    t.chunkDelete(path);
+    t.fileDelete(path);
+  }
+
+  for (const file of later) {
+    if (__residentCopyByKey(t, file.path, file.ckey, file.rev)) copied++;
+    else failed++;
+  }
+  if (ranges.length > 0) await __residentReportSize();
+  return {
+    requested, filled: filled + copied, failed,
+    bytes: fetchedBytes, ranges: ranges.length, copied,
+  };
+}
+
+/**
+ * Bring the store to the authority's current state — the one repair path, used
+ * both to populate a facet before its first instruction and to recover a
+ * poisoned cursor.
+ *
+ * It turns "a capped prefetch" into "the filesystem", which is what makes a
+ * first synchronous read of an untouched file succeed, and it is the only
+ * blocking step: the waiting is done here so the reads that follow never have
+ * to.
+ *
+ * WHY A POISON DOES NOT DROP THE ROWS. A poison says only that
+ * `invalidatedSince` cannot describe the distance from our cursor to now —
+ * the invalidation log is bounded at 256 KiB (sqlite-vfs.ts) and ordinary
+ * write churn trims it past a live cursor as a matter of course. It says
+ * nothing about the rows, and the rows are the asset: at pi scale ~16k files
+ * and ~96 MB that dropping forces back over the wire, awaited inside the
+ * ACQUIRE barrier, on every poison. That is a cost defect, not a coherence
+ * one, and it was measured taking an agent turn past the DO CPU limit.
+ *
+ * `fsList` does not touch the log and reports every path's ABSOLUTE
+ * revision, which is strictly more information than a delta. So the rows are
+ * RECONCILED instead: a row at or above its listed revision is proven current
+ * and kept, a row below it or no longer listed goes, and only what actually
+ * moved is refetched. Every surviving row is vouched for by revision, so the
+ * no-stale-byte guarantee is exactly as unconditional as it was on the drop
+ * path — the delta is simply not the only way to establish it.
+ *
+ * The comparison is sound ONLY within one supervisor incarnation and ONLY
+ * against a complete enumeration:
+ *
+ *   - revisions from different epochs are unrelated clocks, and after a
+ *     restart an untouched path lists at rev 0, which would vouch for anything;
+ *   - a truncated listing cannot tell a path that was REMOVED from one that
+ *     was never walked, so dropping unlisted rows against it would delete a
+ *     live cache for no reason.
+ *
+ * Neither is verifiable ⇒ nothing is dropped and nothing is vouched for; the
+ * pass degrades to filling what the store does not hold, which is exactly what
+ * it did before rows could be verified. The caller keeps whatever cursor it
+ * had, and a poisoned caller has already taken its cold cache through
+ * `__residentAdmit`.
+ *
+ * A row stamped __RK_OWN_WRITE is this facet's own unacknowledged bytes —
+ * newer than anything the authority can report — and is kept whether listed
+ * or not, the same read-your-writes rule the delta path applies. But the
+ * pass moves the cursor without a delta, so the report a delta would have
+ * carried for such a path is returned instead (`own`): the listed revision,
+ * or the listing's own cursor for a path it no longer lists, which bounds
+ * whatever removed it. The write or mutation that owns the row adjudicates it
+ * when its revision arrives, exactly as it does a delta's report. Across
+ * incarnations, or against a short listing, no report can be dated and each
+ * comes back null.
+ *
+ * Writes landing DURING the pass are covered the way they always were: the
+ * published cursor is the one read BEFORE the walk, so they report revisions
+ * above it and the next ACQUIRE evicts whatever they touched.
+ */
+async function __residentSynchronizeFromSupervisor(supervisor) {
+  if (!__residentReady) throw new Error("Nimbus: __residentSynchronizeFromSupervisor before __residentBind");
+  if (!supervisor || typeof supervisor.fsReadBatch !== "function") {
+    return { requested: 0, filled: 0, failed: 0, skipped: "no fsReadBatch on this supervisor" };
+  }
+  if (typeof supervisor.fsList !== "function") {
+    // Without the enumeration the store cannot know what it is missing, so it
+    // fills nothing beyond the adopted bundle and every read behaves exactly
+    // as it did before this store existed — a smaller resident set, never a
+    // wrong one. That is the failure direction to keep.
+    return { requested: 0, filled: 0, failed: 0, skipped: "supervisor cannot enumerate the filesystem (no fsList)" };
+  }
+
+  let listing;
+  try {
+    listing = await __residentEnumerate(supervisor);
+  } catch (e) {
+    return { requested: 0, filled: 0, failed: 0, skipped: "fsList failed: " + ((e && e.message) || String(e)) };
+  }
+  if (!listing.cursor) {
+    return { requested: 0, filled: 0, failed: 0, skipped: "fsList reported no authority cursor" };
+  }
+
+  const t = __residentT;
+  const held = __residentCursor();
+  // May a row this pass cannot prove current be DROPPED? Only against a
+  // complete enumeration: a truncated one cannot tell a path that was removed
+  // from one that was never walked.
+  const judgeable = listing.complete;
+  const describable = judgeable && listing.names.every((entry) => __nsDescribes(entry.stat));
+  // May a held revision be COMPARED with a listed one? Only inside one
+  // supervisor incarnation: across a restart the clocks are unrelated, and an
+  // untouched path lists at rev 0, which would vouch for anything.
+  const comparable = judgeable && !!held && held.epoch === listing.cursor.epoch;
+
+  const listed = new Map();
+  for (const file of listing.entries) listed.set(file.path, file);
+
+  const rows = [];
+  for (const row of t.fileRows()) {
+    rows.push({ path: String(row.path), rev: Number(row.rev), ckey: row.ckey == null ? null : String(row.ckey) });
+  }
+  const current = new Set();
+  const dropped = [];
+  const own = [];
+  let rekeyed = 0;
+  for (const row of rows) {
+    const entry = listed.get(row.path);
+    if (row.rev === __RK_OWN_WRITE) {
+      current.add(row.path);
+      own.push({
+        path: row.path,
+        rev: !comparable ? null : entry !== undefined ? entry.rev : listing.cursor.rev,
+      });
+      continue;
+    }
+    const keep = (comparable && entry !== undefined && row.rev >= entry.rev) || !judgeable;
+    if (keep) { current.add(row.path); continue; }
+    // The listing names the same bytes (a revision moved, the content did
+    // not, or another epoch): kept and dated at the listing. Equal keys are
+    // equal bytes, so this needs no comparable clock.
+    if (entry !== undefined && row.ckey !== null && entry.ckey != null && row.ckey === entry.ckey) {
+      t.fileSetRev(row.path, entry.rev);
+      current.add(row.path);
+      rekeyed++;
+      continue;
+    }
+    dropped.push(row.path);
+  }
+  // Cells held in the heap (own writes the store had no room for) are judged
+  // as file rows are, on every path a file row is (N18). Undated, a write-back
+  // still in flight: newer than anything listed, it stays and is reported as
+  // own. Dated: kept only where the listing proves it current; otherwise it
+  // goes, and is fetched again like any dropped row, so a sync read of it is
+  // a miss rather than bytes the authority has replaced.
+  for (const [path, cell] of [...__residentHeld]) {
+    if (current.has(path)) continue;
+    const entry = listed.get(path);
+    if (cell.rev === __RK_OWN_WRITE) {
+      current.add(path);
+      own.push({ path, rev: !comparable ? null : entry !== undefined ? entry.rev : listing.cursor.rev });
+      continue;
+    }
+    if ((comparable && entry !== undefined && cell.rev >= entry.rev) || !judgeable) { current.add(path); continue; }
+    __residentForgetHeld(path);
+    dropped.push(path);
+  }
+  // Sweep what could not be vouched for. When NOTHING could — a new supervisor
+  // incarnation, whose revisions say nothing about ours — that is every row but
+  // this facet's own unflushed writes, and at pi scale a per-path delete would
+  // be ~32,000 statements in one turn against an object that has been observed
+  // resetting under exactly that load. So it is a predicate there, and per path
+  // where a reconcile has made the set small by construction.
+  if (dropped.length > 0 && !comparable && rekeyed === 0) {
+    t.dropDatedFiles();
+  } else {
+    for (const path of dropped) {
+      t.chunkDelete(path);
+      t.fileDelete(path);
+    }
+  }
+
+  // What to hold: the launch's data plan, every row this pass had to drop as
+  // stale — it was held for a reason — and what the pushes a poison lost
+  // would have carried: files under the push roots changed since the cursor
+  // (all of them there, when the revisions are not comparable).
+  const plan = __residentPlan;
+  const wanted = new Set(dropped);
+  const fetch = [];
+  for (const file of listing.entries) {
+    if (current.has(file.path)) continue;
+    if (plan.has(file.path) || wanted.has(file.path)
+      || (__residentPushable(file.path) && (!comparable || file.rev > held.rev))) fetch.push(file);
+  }
+  // Reserve mandatory metadata growth while optional data is fetched, but
+  // retain the existing namespace publication order across the await.
+  const namespaceGrowth = __residentInHeap && describable ? Math.max(0, listing.namespaceBytes - t.nsBytes()) : 0;
+  if (__residentInHeap && __residentCap !== null && __residentDbBytes() + namespaceGrowth > __residentCap) {
+    const cause = "namespace storage budget exceeded (" + __residentCap + " bytes)";
+    __nsMarkReady(t, false, cause);
+    throw Object.assign(new Error(cause), { code: "ENOSPC" });
+  }
+  __residentNamespaceReserveBytes += namespaceGrowth;
+  let filled;
+  try { filled = await __residentFetchFiles(supervisor, fetch); }
+  finally { __residentNamespaceReserveBytes -= namespaceGrowth; }
+
+  // The cursor may only advance to a state the rows actually describe, and
+  // after a truncated listing they do not: a path in an unwalked page could
+  // have moved since the held cursor and would never be reported again.
+  if (judgeable) {
+    // A listing that cannot describe every name restores the rows it vouches
+    // for and the cursor, but not the namespace (see __nsDescribes).
+    if (describable) __nsReplace(t, listing.names);
+    __residentWriteCursor(t, listing.cursor);
+    __nsMarkReady(t, describable, "the session's listing named an entry without its stat");
+    __residentUndated = false;
+    __residentSealed = false;
+    __residentSealReason = "";
+  }
+
+  return {
+    requested: filled.requested,
+    filled: filled.filled,
+    failed: filled.failed,
+    bytes: filled.bytes,
+    ranges: filled.ranges,
+    kept: current.size,
+    rekeyed,
+    dropped: dropped.length,
+    own,
+    reconciled: comparable,
+    complete: listing.complete,
+    cursor: judgeable ? listing.cursor : null,
+    ...(listing.reason ? { incomplete: listing.reason } : {}),
+  };
+}
+
+/**
+ * Refetch, after a delta the store applied without a listing, what it should
+ * hold and does not: the paths the delta dropped and the launch's data plan.
+ * The namespace (current as of that delta) gives each one's size and
+ * revision, as a listing entry would.
+ */
+async function __residentRefillFromNamespace(supervisor, dropped) {
+  const t = __residentT;
+  const cursor = __residentCursor();
+  if (cursor === null) return { requested: 0, filled: 0, failed: 0, bytes: 0 };
+  const fetch = [];
+  const seen = new Set();
+  for (const path of [...dropped, ...__residentPlan]) {
+    if (seen.has(path)) continue;
+    seen.add(path);
+    if (__residentHead(path) !== undefined || __residentHeld.has(path)) continue;
+    const row = __nsRowAt(t, path);
+    if (row === undefined || Number(row.kind) !== __NS_FILE) continue;
+    fetch.push({ path, size: Number(row.size), rev: Number(row.rev), epoch: cursor.epoch, ckey: null });
+  }
+  return __residentFetchFiles(supervisor, fetch);
+}
+
+/**
+ * The launch's last step before user code: the namespace must answer, since
+ * every synchronous stat, exists and readdir reads it. A boot that left it
+ * unready (its listing failed, came back short, or could not describe every
+ * name) is repaired once more. Resolves to null when it answers, or to the
+ * launch's failure, naming why; nothing is ever run on a namespace that
+ * does not.
+ */
+async function __residentRequireNamespace(supervisor, bootFailure) {
+  if (__nsReady()) return null;
+  try { await __residentSynchronizeFromSupervisor(supervisor); } catch {}
+  if (__nsReady()) return null;
+  return "node: the process was not started: its view of the filesystem could not be listed ("
+    + __nsNotReadyCause() + (bootFailure ? "; " + bootFailure : "") + ")";
+}
+
+/**
+ * The resident set, as the shims have always seen it.
+ *
+ * Every trap is synchronous, because every reader of __vfsBundle is.
+ */
+const __nimbusResidentBundle = new Proxy(Object.create(null), {
+  get(_t, path) {
+    if (typeof path !== "string") return undefined;
+    return __residentGet(path);
+  },
+  has(_t, path) {
+    if (typeof path !== "string") return false;
+    return __residentHead(path) !== undefined || __residentHeld.has(path);
+  },
+  set(_t, path, cell) {
+    // The program's own write, stamped __RK_OWN_WRITE: not the authority's
+    // yet, newer than anything it could report, and replaced with a real
+    // revision by the ledger when the write-back lands.
+    if (typeof path !== "string") return true;
+    __residentPut(__residentRequire(), path, cell, undefined);
+    return true;
+  },
+  deleteProperty(_t, path) {
+    if (typeof path === "string") __residentDelete(__residentRequire(), path);
+    return true;
+  },
+  ownKeys() { return __residentKeys(); },
+  getOwnPropertyDescriptor(_t, path) {
+    if (typeof path !== "string") return undefined;
+    if (__residentHead(path) === undefined) return undefined;
+    // Configurable so 'delete' is legal and enumerable so for-in and
+    // Object.keys see it — the two things every scan site depends on.
+    //
+    // An ACCESSOR, not a data descriptor, and that is the whole point: a
+    // for-in or Object.keys over a Proxy asks this trap about every key, so a
+    // data descriptor had to produce `value` — reading every file's bytes out
+    // of SQLite to answer a question about NAMES. Measured at pi scale, one
+    // such scan read 87 MiB and threw all of it away. A getter answers the
+    // name question for free and still returns the bytes to anything that
+    // genuinely reads the property.
+    return { configurable: true, enumerable: true, get() { return __residentGet(path); } };
+  },
+});