@volter/browser-wali 0.1.166 → 0.1.168

package/dist/filesystem.js

@@ -1,8 +1,16 @@
+// File-call rules translated from The Emscripten Authors' WasmFS syscalls.cpp
+// (Copyright 2021, MIT), 862dc0d48acc4134a0088d27ac8f5dd18baba1cd; see ../LICENSE.
+// Storage, shared descriptors and process state remain owned by this kernel.
+import { createWaliDevice, waliDeviceStat } from "./special-files.js";
 import { realtimeMilliseconds } from "./monotonic-clock.js";
+import { gatherWaliWriteVector } from "./write-vector.js";
+import { setBrowserFileTimes } from "@volter/browser-runtime/browser-file-times.js";
 import { WaliDescriptionRegistry, WaliProcessDescriptorTable } from "./descriptors.js";
+import { WaliSharedPipeHost } from "./shared-pipes.js";
 import { createProcessFilesystemMutationGuard } from "@volter/browser-runtime/browser-process-filesystem-policy.js";
 import { BufferedWaliStdin } from "./stdin.js";
 import { readWaliSymlink, resolveWaliSymlinkPath, writeWaliSymlink } from "./symlink.js";
+import { absoluteWaliPath, normalizeWaliPath } from "./paths.js";
 import { PR_WALI, PR_WALI_TREE_ADOPT, PR_WALI_TREE_CONFIRM, PR_WALI_TREE_DECLINE, PR_WALI_TREE_RELEASE, PRIVATE_TREE_INODES, PRIVATE_TREE_WINDOW_BASE, PRIVATE_TREE_WINDOW_SIZE, decodePrivateTree, encodePrivateTree, inPrivateTreeWindow, } from "./private-tree.js";
 let reportedDroppedEnvironment = false;
 const AT_FDCWD = -100;
@@ -15,6 +23,10 @@ const O_TRUNC = 0x200;
 const O_APPEND = 0x400;
 const O_NONBLOCK = 0x800;
 const O_DIRECTORY = 0x1_0000;
+const O_NOFOLLOW = 0x2_0000;
+const AT_EMPTY_PATH = 0x1000;
+const AT_NO_AUTOMOUNT = 0x800;
+const AT_EACCESS = 0x200;
 const SEEK_SET = 0;
 const SEEK_CUR = 1;
 const SEEK_END = 2;
@@ -53,9 +65,9 @@ export class WaliFileDescriptorTable {
     files;
     specialDescriptors;
     stdioAliases;
-    descriptorStatusFlags = new Map();
     stdin;
     nextDescription = 1;
+    fileCreationMask;
     cwd;
     guestFilesystem;
     assertWritable;
@@ -64,8 +76,9 @@ export class WaliFileDescriptorTable {
     privateTreeDeclined = false;
     constructor(options) {
         this.options = options;
+        this.fileCreationMask = (options.fileCreationMask ?? 0o022) & 0o777;
         this.descriptors = options.descriptors ?? new WaliProcessDescriptorTable(new WaliDescriptionRegistry());
-        this.files = this.descriptors.view("file");
+        this.files = this.descriptors.view("file", (file) => file.inode?.close());
         this.specialDescriptors = this.descriptors.view("special", (value) => value.close?.());
         this.stdioAliases = this.descriptors.view("stdio");
         this.cwd = normalizePath("/", options.cwd);
@@ -93,6 +106,9 @@ export class WaliFileDescriptorTable {
             ...(fs.truncateSync ? { truncateSync: (path, length) => fs.truncateSync(this.assertWritable(path), length) } : {}),
             mkdirSync: (path, settings) => fs.mkdirSync(this.assertWritable(path), settings),
             unlinkSync: (path) => fs.unlinkSync(this.assertWritable(path)),
+            // A writable alias must not let the guest mutate an immutable source.
+            ...(fs.linkSync ? { linkSync: (source, destination) => fs.linkSync(this.assertWritable(source), this.assertWritable(destination)) } : {}),
+            ...(fs.openFileSync ? { openFileSync: fs.openFileSync.bind(fs) } : {}),
             rmdirSync: (path) => fs.rmdirSync(this.assertWritable(path)),
             renameSync: (from, to) => fs.renameSync(this.assertWritable(from), this.assertWritable(to)),
             ...(fs.chmodSync ? { chmodSync: (path, mode) => fs.chmodSync(this.assertWritable(path), mode) } : {}),
@@ -101,7 +117,7 @@ export class WaliFileDescriptorTable {
             ...(fs.restoreNodeSync ? { restoreNodeSync: (path, node) => fs.restoreNodeSync(this.assertWritable(path), node) } : {}),
         } : fs;
         this.stdin = "read" in options.stdin ? options.stdin : new BufferedWaliStdin(options.stdin);
-        if (!options.descriptors) {
+        if (!options.descriptors || options.initializeStdio) {
             for (const fd of [0, 1, 2])
                 this.specialDescriptors.set(fd, { stdio: fd });
         }
@@ -117,6 +133,7 @@ export class WaliFileDescriptorTable {
             SYS_open: (path, flags, mode) => this.open(this.readCString(Number(path)), Number(flags), Number(mode)),
             SYS_openat: (dirfd, path, flags, mode) => this.openAt(Number(dirfd), this.readCString(Number(path)), Number(flags), Number(mode)),
             SYS_close: (fd) => this.close(Number(fd)),
+            SYS_ioctl: (fd, request, argument) => this.ioctl(Number(fd), Number(request), Number(argument)),
             SYS_read: (fd, pointer, length) => this.read(Number(fd), Number(pointer), Number(length)),
             SYS_pread64: (fd, pointer, length, offset) => this.pread(Number(fd), Number(pointer), Number(length), Number(offset)),
             SYS_write: (fd, pointer, length) => this.write(Number(fd), Number(pointer), Number(length)),
@@ -128,13 +145,19 @@ export class WaliFileDescriptorTable {
             SYS_pwritev: (fd, iov, count, offset, high) => this.pwritev(Number(fd), Number(iov), Number(count), vectorOffset(offset, high)),
             SYS_lseek: (fd, offset, whence) => this.lseek(Number(fd), Number(offset), Number(whence)),
             SYS_ftruncate: (fd, length) => this.ftruncate(Number(fd), Number(length)),
+            SYS_truncate: (path, length) => this.truncate(this.readCString(Number(path)), Number(length)),
             SYS_fstat: (fd, stat) => this.fstat(Number(fd), Number(stat)),
             SYS_stat: (path, stat) => this.stat(this.readCString(Number(path)), Number(stat), false),
             SYS_lstat: (path, stat) => this.stat(this.readCString(Number(path)), Number(stat), true),
             SYS_newfstatat: (dirfd, path, stat, flags) => this.statAt(Number(dirfd), this.readCString(Number(path)), Number(stat), Number(flags)),
-            SYS_access: (path) => this.access(this.readCString(Number(path))),
-            SYS_faccessat: (dirfd, path) => this.accessAt(Number(dirfd), this.readCString(Number(path))),
-            SYS_faccessat2: (dirfd, path) => this.accessAt(Number(dirfd), this.readCString(Number(path))),
+            SYS_access: (path, mode) => this.accessAt(AT_FDCWD, this.readCString(Number(path)), Number(mode), 0),
+            SYS_faccessat: (dirfd, path, mode) => this.accessAt(Number(dirfd), this.readCString(Number(path)), Number(mode), 0),
+            SYS_faccessat2: (dirfd, path, mode, flags) => this.accessAt(Number(dirfd), this.readCString(Number(path)), Number(mode), Number(flags)),
+            SYS_umask: (mask) => {
+                const previous = this.fileCreationMask;
+                this.fileCreationMask = Number(mask) & 0o777;
+                return BigInt(previous);
+            },
             SYS_chmod: (path, mode) => this.chmod(this.readCString(Number(path)), Number(mode)),
             SYS_fchmod: (fd, mode) => this.fchmod(Number(fd), Number(mode)),
             SYS_fchmodat: (dirfd, path, mode, flags) => this.chmodAt(Number(dirfd), this.readCString(Number(path)), Number(mode), Number(flags)),
@@ -149,10 +172,13 @@ export class WaliFileDescriptorTable {
             SYS_inotify_init1: () => this.inotifyInit(),
             SYS_inotify_add_watch: (fd, path) => this.inotifyAddWatch(Number(fd), this.readCString(Number(path))),
             SYS_inotify_rm_watch: (fd) => this.specialDescriptors.has(Number(fd)) ? 0n : -9n,
-            SYS_rmdir: (path) => this.mutate(() => this.fs().rmdirSync(this.resolveFilesystemPath(this.resolve(this.readCString(Number(path))), false))),
-            SYS_unlink: (path) => this.mutate(() => this.fs().unlinkSync(this.resolveFilesystemPath(this.resolve(this.readCString(Number(path))), false))),
+            SYS_rmdir: (path) => this.unlinkAt(AT_FDCWD, this.readCString(Number(path)), AT_REMOVEDIR),
+            SYS_unlink: (path) => this.unlinkAt(AT_FDCWD, this.readCString(Number(path)), 0),
             SYS_unlinkat: (dirfd, path, flags) => this.unlinkAt(Number(dirfd), this.readCString(Number(path)), Number(flags)),
+            SYS_link: (source, destination) => this.linkAt(AT_FDCWD, this.readCString(Number(source)), AT_FDCWD, this.readCString(Number(destination)), 0),
+            SYS_linkat: (sourceDirfd, source, destinationDirfd, destination, flags) => this.linkAt(Number(sourceDirfd), this.readCString(Number(source)), Number(destinationDirfd), this.readCString(Number(destination)), Number(flags)),
             SYS_rename: (from, to) => this.rename(this.readCString(Number(from)), this.readCString(Number(to))),
+            SYS_renameat: (fromDirfd, from, toDirfd, to) => this.rename(this.readCString(Number(from)), this.readCString(Number(to)), Number(fromDirfd), Number(toDirfd)),
             SYS_utimensat: (dirfd, path, times, flags) => this.utimensat(Number(dirfd), Number(path), Number(times), Number(flags)),
             SYS_symlink: (target, link) => this.symlink(this.readCString(Number(target)), this.readCString(Number(link)), AT_FDCWD),
             SYS_symlinkat: (target, dirfd, link) => this.symlink(this.readCString(Number(target)), this.readCString(Number(link)), Number(dirfd)),
@@ -190,15 +216,17 @@ export class WaliFileDescriptorTable {
             this.options.filesystem.mkdirSync("/tmp", { recursive: true });
         }
         catch { /* already present */ }
-        // The env file is one `name=value` per line, so it cannot carry a value
-        // with a line break or a name that is not an identifier. A shell's own
+        // Legacy artifacts read one `name=value` per line. The owned linker now
+        // supplies direct environment imports; rebuilt programs never use this
+        // compatibility path. Old artifacts still cannot carry a line break.
+        // A shell's own
         // parameters (`?`, a newline-valued IFS) reach here through every lane's
         // spawn; refusing the whole spawn for them is what killed a script's
         // `spawn("ffmpeg")`. They are dropped and named once.
         const dropped = [];
         const lines = [];
         for (const [name, value] of Object.entries(env)) {
-            if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(name) || /[\u0000\r\n]/u.test(value)) {
+            if (/[=\u0000\r\n]/u.test(name) || /[\u0000\r\n]/u.test(value)) {
                 dropped.push(name);
                 continue;
             }
@@ -226,7 +254,8 @@ export class WaliFileDescriptorTable {
         // The range, not the whole file sliced: a mapping is read in pieces, and
         // each piece copied the file entire (2026-09-27, Blender reading a `.blend`).
         const fs = this.fs();
-        return fs.readRangeSync ? fs.readRangeSync(file.path, offset, length) : fs.readFileSync(file.path).slice(offset, offset + length);
+        return file.inode ? file.inode.read(offset, length).slice()
+            : fs.readRangeSync ? fs.readRangeSync(file.path, offset, length) : fs.readFileSync(file.path).slice(offset, offset + length);
     }
     mappingPath(fd) {
         const file = this.files.get(fd);
@@ -270,7 +299,7 @@ export class WaliFileDescriptorTable {
         return this.specialDescriptors.get(fd)?.browserProcessPipe;
     }
     copyForFork(memory) {
-        return new WaliFileDescriptorTable({ ...this.options, cwd: this.cwd, memory, descriptors: this.descriptors.copy() });
+        return new WaliFileDescriptorTable({ ...this.options, initializeStdio: false, fileCreationMask: this.fileCreationMask, cwd: this.cwd, memory, descriptors: this.descriptors.copy() });
     }
     copyForExec(memory, stdio) {
         const descriptors = this.descriptors.copy();
@@ -282,17 +311,45 @@ export class WaliFileDescriptorTable {
             });
         }
         descriptors.exec();
-        return new WaliFileDescriptorTable({ ...this.options, cwd: this.cwd, memory, descriptors });
+        return new WaliFileDescriptorTable({ ...this.options, initializeStdio: false, fileCreationMask: this.fileCreationMask, cwd: this.cwd, memory, descriptors });
     }
     currentWorkingDirectory() { return this.cwd; }
-    ioctl(fd, request) {
+    creationMask() { return this.fileCreationMask; }
+    // Translated from Emscripten libsyscall.js and wasmfs/syscalls.cpp (MIT),
+    // 862dc0d48acc4134a0088d27ac8f5dd18baba1cd. The kernel owns the description;
+    // terminal settings are dispatched separately to the attached tty.
+    ioctl(fd, request, argument) {
         if (!this.hasFd(fd))
-            return;
-        // FIONBIO/FIOCLEX/FIONCLEX only mutate descriptor flags. Browser pipes
-        // are already nonblocking and close-on-exec is handled by the spawn ABI.
-        if (request === 0x5421 || request === 0x5451 || request === 0x5450)
+            return -9n;
+        const operation = request >>> 0;
+        if (operation === 0x5451 || operation === 0x5450) {
+            return this.fcntl(fd, 2, operation === 0x5451 ? 1 : 0);
+        }
+        if (operation !== 0x5421 && operation !== 0x541b)
+            return -25n;
+        const file = this.files.get(fd);
+        if (operation === 0x541b && (!file || file.directory))
+            return -25n;
+        const memory = this.options.memory();
+        if (!Number.isSafeInteger(argument) || argument <= 0 || argument + 4 > memory.buffer.byteLength)
+            return -14n;
+        if (operation === 0x5421) {
+            const nonblocking = this.memoryView().getInt32(argument, true) !== 0;
+            const flags = this.fcntl(fd, 3, 0);
+            if (flags < 0n)
+                return flags;
+            return this.fcntl(fd, 4, nonblocking ? Number(flags) | O_NONBLOCK : Number(flags) & ~O_NONBLOCK);
+        }
+        if (!file)
+            return -25n;
+        try {
+            const remaining = Math.max(0, (file.inode?.stat() ?? this.fs().statSync(file.path)).size - file.position);
+            this.memoryView().setInt32(argument, remaining, true);
             return 0n;
-        return;
+        }
+        catch (error) {
+            return negativeErrno(error);
+        }
     }
     pollDescriptor(fd, events) {
         if (fd < 0 || !this.hasFd(fd))
@@ -302,9 +359,12 @@ export class WaliFileDescriptorTable {
             return special.poll?.(events) ?? 0;
         const stdio = this.stdioFd(fd);
         let returned = 0;
-        if ((events & 0x1) && stdio === 0 && this.stdin.poll())
+        const terminal = this.terminalFd(fd);
+        const input = terminal ? this.options.terminalStdin : this.stdin;
+        const mode = this.statusFlags(fd) & O_ACCMODE;
+        if ((events & 0x1) && stdio === 0 && (!terminal || mode !== O_WRONLY) && input?.poll())
             returned |= 0x1;
-        if ((events & 0x4) && stdio !== 0)
+        if ((events & 0x4) && (stdio !== 0 || (terminal && mode !== 0)))
             returned |= 0x4;
         return returned;
     }
@@ -359,20 +419,22 @@ export class WaliFileDescriptorTable {
         }
         return text;
     }
-    resolve(path) { return normalizePath(this.cwd, path); }
+    resolve(path) { return absoluteWaliPath(this.cwd, path); }
     resolveAt(dirfd, path) {
         if (path.startsWith("/"))
-            return normalizePath("/", path);
+            return path;
         if (dirfd === AT_FDCWD)
             return this.resolve(path);
         const directory = this.files.get(dirfd);
-        if (!directory?.directory)
+        if (!directory)
+            throw errno(this.hasFd(dirfd) ? "ENOTDIR" : "EBADF");
+        if (!directory.directory)
             throw errno("ENOTDIR");
-        return normalizePath(directory.path, path);
+        return absoluteWaliPath(directory.path, path);
     }
     open(path, flags, mode) {
         try {
-            return BigInt(this.openResolved(this.resolveFilesystemPath(this.resolve(path)), flags, mode));
+            return BigInt(this.openPath(this.resolve(path), flags, mode));
         }
         catch (error) {
             return negativeErrno(error);
@@ -380,45 +442,65 @@ export class WaliFileDescriptorTable {
     }
     openAt(dirfd, path, flags, mode) {
         try {
-            return BigInt(this.openResolved(this.resolveFilesystemPath(this.resolveAt(dirfd, path)), flags, mode));
+            return BigInt(this.openPath(this.resolveAt(dirfd, path), flags, mode));
         }
         catch (error) {
             return negativeErrno(error);
         }
     }
+    openPath(path, flags, mode) {
+        if ((flags & O_ACCMODE) === O_ACCMODE)
+            throw errno("EINVAL");
+        // Linux >=6.4 rejects this pair instead of creating a regular file and
+        // then failing O_DIRECTORY (the old behaviour still in pinned WasmFS).
+        if ((flags & O_CREAT) && (flags & O_DIRECTORY))
+            throw errno("EINVAL");
+        const exclusive = Boolean((flags & O_CREAT) && (flags & O_EXCL));
+        const resolved = this.resolveFilesystemPath(path, !(exclusive || (flags & O_NOFOLLOW)));
+        const target = exclusive || (flags & O_NOFOLLOW) ? this.virtualLink(resolved) ?? this.readSymlink(resolved) : undefined;
+        const entry = exclusive || (flags & O_NOFOLLOW) ? statIfPresent(this.fs(), resolved, true) : undefined;
+        const link = target !== undefined || entry?.isSymbolicLink?.();
+        // Linux O_EXCL checks the link itself, even when its target is absent.
+        if (exclusive && (link || entry !== undefined
+            || ["/dev/null", "/dev/random", "/dev/urandom"].includes(resolved)))
+            throw errno("EEXIST");
+        if ((flags & O_NOFOLLOW) && link)
+            throw errno("ELOOP");
+        checkFileName(resolved);
+        const descriptor = this.procDescriptor(resolved);
+        if (descriptor !== undefined)
+            return this.reopenDescriptor(descriptor, flags, mode);
+        return this.openResolved(resolved, flags, mode);
+    }
     openResolved(path, flags, mode) {
         // O_CLOEXEC is recorded here for every kind of descriptor open makes: musl
         // no longer follows it with F_SETFD (musl 0003), which was the only thing
         // marking these special files (review of dfd87b6).
-        if (path === "/dev/null") {
-            return this.markCloseOnExecNumber(this.allocateSpecial({
-                read: () => new Uint8Array(),
-                write: (value) => BigInt(value.byteLength),
-                poll: (events) => ((events & 1) ? 1 : 0) | ((events & 4) ? 4 : 0),
-                fcntl: (command) => command === 3 ? BigInt(flags) : [1, 2, 4].includes(command) ? 0n : -22n,
-            }), flags);
-        }
-        if (path === "/dev/urandom" || path === "/dev/random") {
-            return this.markCloseOnExecNumber(this.allocateSpecial({
-                read: (length) => {
-                    if (!Number.isSafeInteger(length) || length < 0)
-                        return -22n;
-                    const value = new Uint8Array(length);
-                    for (let offset = 0; offset < value.byteLength; offset += 65_536) {
-                        crypto.getRandomValues(value.subarray(offset, Math.min(offset + 65_536, value.byteLength)));
-                    }
-                    return value;
-                },
-                write: (value) => BigInt(value.byteLength),
-                poll: (events) => ((events & 1) ? 1 : 0) | ((events & 4) ? 4 : 0),
-                fcntl: (command) => command === 3 ? BigInt(flags) : [1, 2, 4].includes(command) ? 0n : -22n,
-            }), flags);
+        if (path === "/dev/tty") {
+            if (flags & O_DIRECTORY)
+                throw errno("ENOTDIR");
+            const fd = this.allocateFd();
+            this.specialDescriptors.set(fd, { stdio: 0, terminal: true, stat: () => waliDeviceStat(path) });
+            Atomics.store(this.descriptors.registry.pipeMetadata, this.descriptors.entries[fd].description * 3 + 1, flags & ~O_CLOEXEC_FLAG);
+            // The calling realm validates controlling-session membership through
+            // ttyopen before returning this fd. The filesystem owner owns the fd;
+            // terminal input/output stay on the caller's attached transport.
+            return this.markCloseOnExecNumber(fd, flags);
+        }
+        const device = createWaliDevice(path, flags);
+        if (device) {
+            if (flags & O_DIRECTORY)
+                throw errno("ENOTDIR");
+            const fd = this.allocateFd();
+            this.specialDescriptors.set(fd, device);
+            return this.markCloseOnExecNumber(fd, flags);
         }
+        const fd = this.allocateFd();
         const fs = this.fs();
         // One lookup where the store answers ENOENT from statSync (a snapshot store's); exists-then-stat resolved it twice.
-        let found = fs.linkTargetSync ? statIfPresent(fs, path) : fs.existsSync(path) ? fs.statSync(path) : undefined;
+        let found = this.virtualStat(path, false) ?? (fs.linkTargetSync ? statIfPresent(fs, path) : fs.existsSync(path) ? fs.statSync(path) : undefined);
         const exists = found !== undefined;
-        if ((flags & O_ACCMODE) !== 0 || (!exists && (flags & O_CREAT)))
+        if ((flags & O_ACCMODE) !== 0 || (flags & O_TRUNC) || (!exists && (flags & O_CREAT)))
             this.assertWritable(path);
         if (!exists && !(flags & O_CREAT))
             throw errno("ENOENT");
@@ -426,30 +508,41 @@ export class WaliFileDescriptorTable {
             throw errno("EEXIST");
         if (!exists) {
             fs.writeFileSync(path, new Uint8Array());
-            fs.chmodSync?.(path, mode & 0o7777);
+            fs.chmodSync?.(path, mode & 0o7777 & ~this.fileCreationMask);
             this.options.fileLocks?.created?.(path);
             found = fs.statSync(path);
         }
         const stat = found;
         if ((flags & O_DIRECTORY) && !stat.isDirectory())
             throw errno("ENOTDIR");
-        if (stat.isDirectory() && (flags & O_ACCMODE) !== 0)
+        if (stat.isDirectory() && ((flags & O_ACCMODE) !== 0 || (flags & O_CREAT) || (flags & O_TRUNC)))
             throw errno("EISDIR");
-        const truncated = (flags & O_TRUNC) !== 0 && (flags & O_ACCMODE) !== 0 && stat.isFile();
+        // doOpen does not recheck the mode of the file it just created: creating
+        // mode 0400 with O_RDWR still returns a writable open description.
+        if (exists) {
+            if ((flags & O_ACCMODE) !== O_WRONLY)
+                checkFilePermission(stat, 4);
+            if ((flags & O_ACCMODE) !== 0 || (flags & O_TRUNC))
+                checkFilePermission(stat, 2);
+        }
+        const truncated = (flags & O_TRUNC) !== 0 && stat.isFile();
         if (truncated) {
             if (fs.truncateSync)
                 fs.truncateSync(path, 0);
             else
                 fs.writeFileSync(path, new Uint8Array());
         }
-        const fd = this.allocateFd();
         const directory = stat.isDirectory();
+        const virtualDirectory = ["/proc", "/proc/self", "/proc/self/fd"].includes(path);
+        const entries = directory && !virtualDirectory ? this.directoryEntries(path) : undefined;
         this.files.set(fd, {
             path,
+            ...(!directory && fs.openFileSync ? { inode: fs.openFileSync(path) } : {}),
             flags,
-            // The stat above is the file's size unless this open emptied it.
-            position: flags & O_APPEND && !truncated && stat.isFile() ? stat.size : 0,
+            // O_APPEND chooses EOF on each write; open itself starts at zero.
+            position: 0,
             directory,
+            ...(entries ? { entries } : {}),
             description: this.nextDescription++,
         });
         this.descriptors.entries[fd].flags = flags & 0x80000 ? 1 : 0;
@@ -471,8 +564,8 @@ export class WaliFileDescriptorTable {
      *
      * Scanning costs one probe per open descriptor, and a process has a handful.
      */
-    allocateFd(minimum = 3) {
-        const maximum = this.options.descriptorMaximum ?? 65_535;
+    allocateFd(minimum = 0) {
+        const maximum = Math.min(this.options.descriptorMaximum ?? 65_535, this.descriptors.descriptorLimit - 1);
         for (let fd = Math.max(minimum, 0); fd <= maximum; fd += 1) {
             // A private tree's numbers are its libc's, held or given back (ADR-0047).
             if (inPrivateTreeWindow(fd)) {
@@ -489,7 +582,6 @@ export class WaliFileDescriptorTable {
     }
     close(fd) {
         if (this.stdioAliases.delete(fd)) {
-            this.descriptorStatusFlags.delete(fd);
             this.setSharedStdioAlias(fd, undefined);
             return 0n;
         }
@@ -526,9 +618,14 @@ export class WaliFileDescriptorTable {
             if (length < 0)
                 throw errno("EINVAL");
             if (this.stdioFd(fd) === 0) {
-                if ((this.statusFlags(fd) & O_NONBLOCK) && !this.stdin.poll())
+                if (this.terminalFd(fd) && (this.statusFlags(fd) & O_ACCMODE) === O_WRONLY)
+                    return -9n;
+                const input = this.terminalFd(fd) ? this.options.terminalStdin : this.stdin;
+                if (!input)
+                    return -95n; // No independent terminal transport was supplied.
+                if ((this.statusFlags(fd) & O_NONBLOCK) && !input.poll())
                     return -11n;
-                const chunk = this.stdin.read(length);
+                const chunk = input.read(length);
                 this.copyIn(pointer, chunk);
                 return BigInt(chunk.byteLength);
             }
@@ -552,7 +649,7 @@ export class WaliFileDescriptorTable {
                 throw errno("EBADF");
             const fs = this.fs();
             // A view where the filesystem offers one: copied into the program's memory at once, so one copy, not two.
-            const chunk = fs.viewRangeSync
+            const chunk = file.inode ? file.inode.read(file.position, length) : fs.viewRangeSync
                 ? fs.viewRangeSync(file.path, file.position, length)
                 : fs.readRangeSync
                     ? fs.readRangeSync(file.path, file.position, length)
@@ -566,13 +663,20 @@ export class WaliFileDescriptorTable {
         }
     }
     write(fd, pointer, length) {
+        return this.writeBytes(fd, pointer, length);
+    }
+    /** One vector is one destination write and one shared-offset advance. */
+    writeBytes(fd, pointer, length, gathered) {
         try {
             const stdio = this.stdioFd(fd);
+            if (this.terminalFd(fd))
+                return (this.statusFlags(fd) & O_ACCMODE) === 0 ? -9n
+                    : this.options.emitTerminal?.(gathered ?? this.copyOut(pointer, length)) ?? -95n;
             if (stdio === 1 || stdio === 2)
-                return this.options.emit(stdio, this.copyOut(pointer, length));
+                return this.options.emit(stdio, gathered ?? this.copyOut(pointer, length));
             const special = this.specialDescriptors.get(fd);
             if (special)
-                return special.write?.(this.copyOut(pointer, length)) ?? -9n;
+                return special.write?.(gathered ?? this.copyOut(pointer, length)) ?? -9n;
             const file = this.files.get(fd);
             if (!file)
                 throw errno("EBADF");
@@ -581,32 +685,46 @@ export class WaliFileDescriptorTable {
             if ((file.flags & O_ACCMODE) === 0)
                 throw errno("EBADF");
             const fs = this.fs();
+            if (file.inode) {
+                this.assertWritable(file.path);
+                if (file.flags & O_APPEND)
+                    file.position = file.inode.stat().size;
+                if (!gathered)
+                    assertRange(this.options.memory(), pointer, length);
+                file.inode.write(file.position, gathered ?? this.memoryBytes().subarray(pointer, pointer + length));
+                file.position += length;
+                return BigInt(length);
+            }
             if (fs.writeRangeSync) {
                 if (file.flags & O_APPEND)
                     file.position = fs.statSync(file.path).size;
                 // A view, not a copy: the file copies what it keeps (2026-09-27, one copy of every write fewer).
-                assertRange(this.options.memory(), pointer, length);
-                fs.writeRangeSync(file.path, file.position, this.memoryBytes().subarray(pointer, pointer + length));
+                if (!gathered)
+                    assertRange(this.options.memory(), pointer, length);
+                fs.writeRangeSync(file.path, file.position, gathered ?? this.memoryBytes().subarray(pointer, pointer + length));
                 file.position += length;
                 return BigInt(length);
             }
-            const chunk = this.copyOut(pointer, length);
+            const value = gathered ?? this.copyOut(pointer, length);
             const current = fs.readFileSync(file.path);
             if (file.flags & O_APPEND)
                 file.position = current.byteLength;
-            const size = Math.max(current.byteLength, file.position + chunk.byteLength);
+            const size = Math.max(current.byteLength, file.position + value.byteLength);
             const next = new Uint8Array(size);
             next.set(current);
-            next.set(chunk, file.position);
+            next.set(value, file.position);
             fs.writeFileSync(file.path, next);
-            file.position += chunk.byteLength;
-            return BigInt(chunk.byteLength);
+            file.position += value.byteLength;
+            return BigInt(value.byteLength);
         }
         catch (error) {
             return negativeErrno(error);
         }
     }
     pread(fd, pointer, length, offset) {
+        const special = this.specialDescriptors.get(fd);
+        if (special)
+            return !special.seek ? -29n : !Number.isSafeInteger(offset) || offset < 0 ? -22n : this.read(fd, pointer, length);
         const file = this.files.get(fd);
         if (!file)
             return -9n;
@@ -622,6 +740,9 @@ export class WaliFileDescriptorTable {
         }
     }
     pwrite(fd, pointer, length, offset) {
+        const special = this.specialDescriptors.get(fd);
+        if (special)
+            return !special.seek ? -29n : !Number.isSafeInteger(offset) || offset < 0 ? -22n : this.write(fd, pointer, length);
         const file = this.files.get(fd);
         if (!file)
             return -9n;
@@ -641,6 +762,9 @@ export class WaliFileDescriptorTable {
     }
     /** pread over a vector: the same answers, each buffer in turn at the offset, the position unmoved. */
     preadv(fd, pointer, count, offset) {
+        const special = this.specialDescriptors.get(fd);
+        if (special)
+            return !special.seek ? -29n : !Number.isSafeInteger(offset) || offset < 0 ? -22n : this.readv(fd, pointer, count);
         const file = this.files.get(fd);
         if (!file)
             return -9n;
@@ -657,6 +781,9 @@ export class WaliFileDescriptorTable {
     }
     /** pwrite over a vector, as pwrite: at the offset whatever O_APPEND says, the position unmoved. */
     pwritev(fd, pointer, count, offset) {
+        const special = this.specialDescriptors.get(fd);
+        if (special)
+            return !special.seek ? -29n : !Number.isSafeInteger(offset) || offset < 0 ? -22n : this.writev(fd, pointer, count);
         const file = this.files.get(fd);
         if (!file)
             return -9n;
@@ -689,29 +816,45 @@ export class WaliFileDescriptorTable {
         return total;
     }
     writev(fd, pointer, count) {
-        let total = 0n;
-        for (let index = 0; index < count; index += 1) {
-            const offset = pointer + index * 8;
-            assertRange(this.options.memory(), offset, 8);
-            const result = this.write(fd, this.memoryView().getUint32(offset, true), this.memoryView().getUint32(offset + 4, true));
-            if (result < 0n)
-                return total > 0n ? total : result;
-            total += result;
-        }
-        return total;
+        const value = gatherWaliWriteVector(this.options.memory(), pointer, count);
+        return typeof value === "bigint" ? value : this.writeBytes(fd, 0, value.byteLength, value);
+    }
+    // OpenFileState::create caches dirents in Emscripten file_table.cpp/h
+    // (Copyright 2021, MIT/NCSA), pinned at 862dc0d4. Each process retains the
+    // same description on dup/fork; kernel storage supplies the entry metadata.
+    directoryEntries(path) {
+        const fs = this.fs();
+        const entries = [];
+        const virtual = path === "/proc" ? ["self"] : path === "/proc/self" ? ["fd"]
+            : path === "/proc/self/fd" ? this.descriptors.entries.flatMap((entry, fd) => entry ? [String(fd)] : []) : undefined;
+        for (const name of [".", "..", ...(virtual ?? fs.readdirSync(path))]) {
+            const entryPath = name === "." ? path : name === ".."
+                ? normalizePath(path, "..") : normalizePath(path, name);
+            const stat = this.virtualStat(entryPath, true) ?? statIfPresent(fs, entryPath, true);
+            if (!stat)
+                continue; // A backend entry removed during enumeration.
+            const link = this.virtualLink(entryPath) ?? this.readSymlink(entryPath);
+            const type = link !== undefined || stat.isSymbolicLink?.() ? 10
+                : (stat.mode ?? 0) & 0o170000 ? ((stat.mode & 0o170000) >>> 12)
+                    : stat.isDirectory() ? 4 : 8;
+            entries.push({ name, inode: stat.ino ?? 1, type });
+        }
+        return entries;
     }
     getdents64(fd, pointer, count) {
         try {
+            if (!Number.isSafeInteger(count) || count < 24)
+                throw errno("EINVAL");
             const directory = this.files.get(fd);
             if (!directory)
                 throw errno("EBADF");
             if (!directory.directory)
                 throw errno("ENOTDIR");
-            const entries = [".", "..", ...this.fs().readdirSync(directory.path)];
+            const entries = directory.entries ??= this.directoryEntries(directory.path);
             let written = 0;
             while (directory.position < entries.length) {
-                const name = entries[directory.position];
-                const nameBytes = new TextEncoder().encode(name);
+                const entry = entries[directory.position];
+                const nameBytes = new TextEncoder().encode(entry.name);
                 const recordLength = alignTo(19 + nameBytes.byteLength + 1, 8);
                 if (recordLength > count - written) {
                     if (written === 0)
@@ -720,13 +863,10 @@ export class WaliFileDescriptorTable {
                 }
                 const record = pointer + written;
                 assertRange(this.options.memory(), record, recordLength);
-                const entryPath = name === "." ? directory.path : name === ".."
-                    ? normalizePath(directory.path, "..") : normalizePath(directory.path, name);
-                const stat = this.fs().statSync(entryPath);
-                this.memoryView().setBigUint64(record, BigInt(directory.position + 1), true);
+                this.memoryView().setBigUint64(record, BigInt(entry.inode), true);
                 this.memoryView().setBigInt64(record + 8, BigInt(directory.position + 1), true);
                 this.memoryView().setUint16(record + 16, recordLength, true);
-                this.memoryView().setUint8(record + 18, stat.isDirectory() ? 4 : 8);
+                this.memoryView().setUint8(record + 18, entry.type);
                 this.memoryBytes().fill(0, record + 19, record + recordLength);
                 this.memoryBytes().set(nameBytes, record + 19);
                 directory.position += 1;
@@ -740,13 +880,14 @@ export class WaliFileDescriptorTable {
     }
     lseek(fd, offset, whence) {
         try {
+            const special = this.specialDescriptors.get(fd);
+            if (special)
+                return special.seek?.(offset, whence) ?? -29n;
             const file = this.files.get(fd);
             if (!file)
                 throw errno("EBADF");
-            if (file.directory)
-                throw errno("EINVAL");
             const base = whence === SEEK_SET ? 0 : whence === SEEK_CUR ? file.position
-                : whence === SEEK_END ? this.fs().statSync(file.path).size : undefined;
+                : whence === SEEK_END && !file.directory ? (file.inode?.stat() ?? this.fs().statSync(file.path)).size : undefined;
             // An offset or a position past 2^53 - 1 is not one a double holds (musl 0005's lseek says the same).
             if (base === undefined || !Number.isSafeInteger(offset) || base + offset < 0 || !Number.isSafeInteger(base + offset))
                 throw errno("EINVAL");
@@ -759,6 +900,9 @@ export class WaliFileDescriptorTable {
     }
     ftruncate(fd, length) {
         try {
+            const special = this.specialDescriptors.get(fd);
+            if (special)
+                return special.truncate?.(length) ?? -22n;
             const file = this.files.get(fd);
             if (!file)
                 throw errno("EBADF");
@@ -769,6 +913,12 @@ export class WaliFileDescriptorTable {
             if (!Number.isSafeInteger(length) || length < 0)
                 throw errno("EINVAL");
             const fs = this.fs();
+            if (file.inode) {
+                this.assertWritable(file.path);
+                if (file.inode.stat().size !== length)
+                    file.inode.truncate(length);
+                return 0n;
+            }
             if (fs.truncateSync) {
                 if (fs.statSync(file.path).size !== length)
                     fs.truncateSync(file.path, length);
@@ -786,9 +936,44 @@ export class WaliFileDescriptorTable {
             return negativeErrno(error);
         }
     }
+    truncate(path, length) {
+        try {
+            const resolved = this.resolveFilesystemPath(this.resolve(path));
+            if (waliDeviceStat(resolved))
+                throw errno("EINVAL");
+            const fs = this.fs();
+            const stat = fs.statSync(resolved);
+            if (!stat.isFile())
+                throw errno("EISDIR");
+            checkFilePermission(stat, 2);
+            if (!Number.isSafeInteger(length) || length < 0)
+                throw errno("EINVAL");
+            if (fs.truncateSync)
+                fs.truncateSync(resolved, length);
+            else {
+                const resized = new Uint8Array(length);
+                resized.set(fs.readFileSync(resolved).subarray(0, length));
+                fs.writeFileSync(resolved, resized);
+            }
+            return 0n;
+        }
+        catch (error) {
+            return negativeErrno(error);
+        }
+    }
     stat(path, pointer, lstat) {
         try {
             const resolved = this.resolveFilesystemPath(this.resolve(path), !lstat);
+            const virtual = this.virtualStat(resolved, lstat);
+            if (virtual) {
+                writeStat(this.memoryView(), pointer, virtual);
+                return 0n;
+            }
+            const device = waliDeviceStat(resolved);
+            if (device) {
+                writeStat(this.memoryView(), pointer, device);
+                return 0n;
+            }
             const fs = this.fs();
             // A snapshot store's statSync answers ENOENT itself: asking existsSync first resolved the path twice.
             if (!fs.linkTargetSync && !fs.existsSync(resolved))
@@ -796,7 +981,7 @@ export class WaliFileDescriptorTable {
             const target = lstat ? this.readSymlink(resolved) : undefined;
             writeStat(this.memoryView(), pointer, target === undefined
                 ? (lstat && fs.lstatSync ? fs.lstatSync(resolved) : fs.statSync(resolved))
-                : syntheticSymlinkStat(target));
+                : { ...fs.statSync(resolved), ...syntheticSymlinkStat(target) });
             return 0n;
         }
         catch (error) {
@@ -805,15 +990,32 @@ export class WaliFileDescriptorTable {
     }
     statAt(dirfd, path, pointer, flags) {
         try {
-            if (flags & ~AT_SYMLINK_NOFOLLOW)
+            if (flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH | AT_NO_AUTOMOUNT))
                 throw errno("EINVAL");
+            // getFileAt with AT_EMPTY_PATH addresses the open description directly,
+            // including a non-directory fd; AT_FDCWD means the current directory.
+            if (!path && (flags & AT_EMPTY_PATH)) {
+                return dirfd === AT_FDCWD ? this.stat(this.cwd, pointer, false) : this.fstat(dirfd, pointer);
+            }
             const noFollow = Boolean(flags & AT_SYMLINK_NOFOLLOW);
             const resolved = this.resolveFilesystemPath(this.resolveAt(dirfd, path), !noFollow);
+            const virtual = this.virtualStat(resolved, noFollow);
+            if (virtual) {
+                writeStat(this.memoryView(), pointer, virtual);
+                return 0n;
+            }
+            const device = waliDeviceStat(resolved);
+            if (device) {
+                writeStat(this.memoryView(), pointer, device);
+                return 0n;
+            }
             const fs = this.fs();
             if (!fs.linkTargetSync && !fs.existsSync(resolved))
                 throw errno("ENOENT");
             const target = noFollow ? this.readSymlink(resolved) : undefined;
-            writeStat(this.memoryView(), pointer, target === undefined ? fs.statSync(resolved) : syntheticSymlinkStat(target));
+            writeStat(this.memoryView(), pointer, target === undefined
+                ? (noFollow && fs.lstatSync ? fs.lstatSync(resolved) : fs.statSync(resolved))
+                : { ...fs.statSync(resolved), ...syntheticSymlinkStat(target) });
             return 0n;
         }
         catch (error) {
@@ -826,27 +1028,38 @@ export class WaliFileDescriptorTable {
                 writeStat(this.memoryView(), pointer, syntheticTerminalStat());
                 return 0n;
             }
+            const special = this.specialDescriptors.get(fd);
+            const stat = special?.stat?.();
+            if (stat) {
+                writeStat(this.memoryView(), pointer, stat);
+                return 0n;
+            }
             const file = this.files.get(fd);
             if (!file)
                 throw errno("EBADF");
-            writeStat(this.memoryView(), pointer, this.fs().statSync(file.path));
+            writeStat(this.memoryView(), pointer, this.virtualStat(file.path, false) ?? (file.inode?.stat() ?? this.fs().statSync(file.path)));
             return 0n;
         }
         catch (error) {
             return negativeErrno(error);
         }
     }
-    access(path) {
+    accessAt(dirfd, path, mode, flags) {
         try {
-            return this.fs().existsSync(this.resolveFilesystemPath(this.resolve(path))) ? 0n : -2n;
-        }
-        catch (error) {
-            return negativeErrno(error);
-        }
-    }
-    accessAt(dirfd, path) {
-        try {
-            return this.fs().existsSync(this.resolveFilesystemPath(this.resolveAt(dirfd, path))) ? 0n : -2n;
+            if (mode & ~7 || flags & ~(AT_EACCESS | AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH))
+                throw errno("EINVAL");
+            const noFollow = Boolean(flags & AT_SYMLINK_NOFOLLOW);
+            const resolved = !path && (flags & AT_EMPTY_PATH)
+                ? dirfd === AT_FDCWD ? this.cwd : this.files.get(dirfd)?.path
+                : this.resolveFilesystemPath(this.resolveAt(dirfd, path), !noFollow);
+            if (resolved === undefined)
+                throw errno("EBADF");
+            const fs = this.fs();
+            const target = noFollow ? this.readSymlink(resolved) : undefined;
+            const stat = this.virtualStat(resolved, noFollow) ?? waliDeviceStat(resolved) ?? (target !== undefined ? syntheticSymlinkStat(target)
+                : noFollow && fs.lstatSync ? fs.lstatSync(resolved) : fs.statSync(resolved));
+            checkFilePermission(stat, mode);
+            return 0n;
         }
         catch (error) {
             return negativeErrno(error);
@@ -885,7 +1098,12 @@ export class WaliFileDescriptorTable {
         if (!file)
             return -9n;
         try {
-            this.fs().chmodSync?.(file.path, mode & 0o7777);
+            if (file.inode) {
+                this.assertWritable(file.path);
+                file.inode.chmod(mode & 0o7777);
+            }
+            else
+                this.fs().chmodSync?.(file.path, mode & 0o7777);
             return 0n;
         }
         catch (error) {
@@ -914,24 +1132,34 @@ export class WaliFileDescriptorTable {
         return 0n;
     }
     getcwd(pointer, size) {
-        const encoded = new TextEncoder().encode(`${this.cwd}\0`);
-        if (encoded.byteLength > size)
-            return -34n;
-        this.copyIn(pointer, encoded);
-        return BigInt(encoded.byteLength);
+        try {
+            if (!pointer && size > 0)
+                throw errno("EFAULT");
+            if (size === 0)
+                throw errno("EINVAL");
+            if (this.cwd !== "/" && !this.fs().existsSync(this.cwd))
+                throw errno("ENOENT");
+            const encoded = new TextEncoder().encode(`${this.cwd}\0`);
+            if (encoded.byteLength > size)
+                throw errno("ERANGE");
+            this.copyIn(pointer, encoded);
+            return BigInt(encoded.byteLength);
+        }
+        catch (error) {
+            return negativeErrno(error);
+        }
     }
     mkdir(path, mode) {
-        return this.mutate(() => {
-            const resolved = this.resolveFilesystemPath(this.resolve(path), false);
-            this.fs().mkdirSync(resolved);
-            this.fs().chmodSync?.(resolved, mode & 0o7777);
-        });
+        return this.mkdirAt(AT_FDCWD, path, mode);
     }
     mkdirAt(dirfd, path, mode) {
         try {
-            const resolved = this.resolveFilesystemPath(this.resolveAt(dirfd, path), false);
+            const resolved = this.resolveFilesystemPath(this.resolveAt(dirfd, path), false, true);
+            checkFileName(resolved);
+            if (statIfPresent(this.fs(), resolved, true))
+                throw errno("EEXIST");
             this.fs().mkdirSync(resolved);
-            this.fs().chmodSync?.(resolved, mode & 0o7777);
+            this.fs().chmodSync?.(resolved, mode & 0o7777 & ~this.fileCreationMask);
             return 0n;
         }
         catch (error) {
@@ -976,21 +1204,70 @@ export class WaliFileDescriptorTable {
         try {
             if (flags & ~AT_REMOVEDIR)
                 throw errno("EINVAL");
+            const removeDirectory = Boolean(flags & AT_REMOVEDIR);
+            const leaf = path.replace(/\/+$/u, "").split("/").at(-1);
+            if (removeDirectory && leaf === ".")
+                throw errno("EINVAL");
             const resolved = this.resolveFilesystemPath(this.resolveAt(dirfd, path), false);
-            if (flags & AT_REMOVEDIR)
-                this.fs().rmdirSync(resolved);
+            const fs = this.fs();
+            const stat = fs.lstatSync?.(resolved) ?? fs.statSync(resolved);
+            if (resolved === "/")
+                throw errno("EBUSY");
+            if (stat.isDirectory()) {
+                if (!removeDirectory)
+                    throw errno("EISDIR");
+                if (fs.readdirSync(resolved).length > 0)
+                    throw errno("ENOTEMPTY");
+            }
+            else if (removeDirectory)
+                throw errno("ENOTDIR");
+            checkFilePermission(fs.statSync(resolved.slice(0, resolved.lastIndexOf("/")) || "/"), 2);
+            if (removeDirectory)
+                fs.rmdirSync(resolved);
             else
-                this.fs().unlinkSync(resolved);
+                fs.unlinkSync(resolved);
             return 0n;
         }
         catch (error) {
             return negativeErrno(error);
         }
     }
-    rename(from, to) {
+    linkAt(sourceDirfd, sourcePath, destinationDirfd, destinationPath, flags) {
+        return this.mutate(() => {
+            const follow = 0x400; // Linux AT_SYMLINK_FOLLOW
+            if (flags & ~(follow | AT_EMPTY_PATH))
+                throw errno("EINVAL");
+            // AT_EMPTY_PATH needs the capability model and an inode handle for an
+            // unlinked source. Do not substitute the descriptor's old pathname.
+            if (!sourcePath && (flags & AT_EMPTY_PATH))
+                throw errno("EPERM");
+            if (!sourcePath || !destinationPath)
+                throw errno("ENOENT");
+            const source = this.resolveFilesystemPath(this.resolveAt(sourceDirfd, sourcePath), Boolean(flags & follow));
+            const destination = this.resolveFilesystemPath(this.resolveAt(destinationDirfd, destinationPath), false);
+            checkFileName(destination);
+            if (this.virtualStat(source, true) || waliDeviceStat(source))
+                throw errno("EXDEV");
+            const fs = this.fs();
+            const stat = fs.lstatSync?.(source) ?? fs.statSync(source);
+            if (stat.isDirectory())
+                throw errno("EPERM");
+            if (this.virtualStat(destination, true) || waliDeviceStat(destination) || fs.existsSync(destination))
+                throw errno("EEXIST");
+            const directory = fs.statSync(destination.slice(0, destination.lastIndexOf("/")) || "/");
+            if (!directory.isDirectory())
+                throw errno("ENOTDIR");
+            checkFilePermission(directory, 3);
+            if (!fs.linkSync)
+                throw errno("ENOSYS");
+            fs.linkSync(source, destination);
+            this.options.fileLocks?.created?.(destination);
+        });
+    }
+    rename(from, to, fromDirfd = AT_FDCWD, toDirfd = AT_FDCWD) {
         return this.mutate(() => {
-            const source = this.resolveFilesystemPath(this.resolve(from), false);
-            const destination = this.resolveFilesystemPath(this.resolve(to), false);
+            const source = this.resolveFilesystemPath(this.resolveAt(fromDirfd, from), false);
+            const destination = this.resolveFilesystemPath(this.resolveAt(toDirfd, to), false);
             // Moving a directory the held tree is under moves the tree: the libc's to release first (ADR-0047).
             if (this.privateTree && (underRoot(this.privateTree.root, source) || underRoot(this.privateTree.root, destination)))
                 throw errno("EREMOTE");
@@ -1003,11 +1280,14 @@ export class WaliFileDescriptorTable {
             if (fs.existsSync(source)) {
                 if (source === destination)
                     return;
-                const directory = fs.statSync(source).isDirectory();
+                if (source === "/" || destination === "/")
+                    throw errno("EBUSY");
+                checkFileName(destination);
+                const directory = (fs.lstatSync?.(source) ?? fs.statSync(source)).isDirectory();
                 if (directory && destination.startsWith(`${source}/`))
                     throw errno("EINVAL");
                 if (fs.existsSync(destination)) {
-                    const into = fs.statSync(destination).isDirectory();
+                    const into = (fs.lstatSync?.(destination) ?? fs.statSync(destination)).isDirectory();
                     if (directory && !into)
                         throw errno("ENOTDIR");
                     if (!directory && into)
@@ -1051,8 +1331,8 @@ export class WaliFileDescriptorTable {
             };
             const atimeMs = readTime(0, stat.atimeMs ?? stat.mtimeMs ?? now);
             const mtimeMs = readTime(1, stat.mtimeMs ?? now);
-            if (filesystem.utimesSync)
-                filesystem.utimesSync(path, new Date(atimeMs), new Date(mtimeMs));
+            if (filesystem.utimesSync || filesystem.utimesMsSync)
+                setBrowserFileTimes(filesystem, path, atimeMs, mtimeMs);
             else if (stat.isFile())
                 filesystem.writeFileSync(path, filesystem.readFileSync(path));
             return 0n;
@@ -1063,12 +1343,12 @@ export class WaliFileDescriptorTable {
     }
     readlink(path, pointer, size, dirfd) {
         try {
-            if (!Number.isSafeInteger(size) || size < 0)
+            if (!Number.isSafeInteger(size) || size <= 0)
                 throw errno("EINVAL");
-            const resolved = this.resolveAt(dirfd, path);
+            let resolved = this.resolveAt(dirfd, path);
             if (this.privateTree && underRoot(resolved, this.privateTree.root))
                 throw errno("EREMOTE");
-            let target;
+            let target = this.virtualLink(resolved);
             if (resolved === "/proc/self/exe")
                 target = this.options.executablePath ?? "/usr/bin/wali-program";
             const descriptorMatch = /^\/proc\/self\/fd\/(\d+)$/u.exec(resolved);
@@ -1077,12 +1357,14 @@ export class WaliFileDescriptorTable {
                 if (descriptor)
                     target = descriptor.path;
             }
+            if (target === undefined)
+                resolved = this.resolveFilesystemPath(resolved, false);
             target ??= this.readSymlink(resolved);
             // musl realpath(3) probes every path component with readlink(2).
             // Existing non-symlinks must report EINVAL; ENOENT means the component
             // itself is missing and makes canonicalization fail.
             if (!target)
-                return this.fs().existsSync(resolved) ? -22n : -2n;
+                return this.virtualStat(resolved, false) || waliDeviceStat(resolved) || this.fs().existsSync(resolved) ? -22n : -2n;
             const encoded = new TextEncoder().encode(target).subarray(0, size);
             this.copyIn(pointer, encoded);
             return BigInt(encoded.byteLength);
@@ -1094,6 +1376,7 @@ export class WaliFileDescriptorTable {
     symlink(target, link, dirfd) {
         try {
             const resolved = this.resolveFilesystemPath(this.resolveAt(dirfd, link), false);
+            checkFileName(resolved);
             writeWaliSymlink(this.fs(), target, resolved);
             return 0n;
         }
@@ -1101,8 +1384,21 @@ export class WaliFileDescriptorTable {
             return negativeErrno(error);
         }
     }
-    resolveFilesystemPath(path, followFinal = true) {
-        const resolved = resolveWaliSymlinkPath(this.fs(), path, followFinal);
+    resolveFilesystemPath(path, followFinal = true, allowMissingDirectory = false) {
+        const resolved = resolveWaliSymlinkPath(this.fs(), path, followFinal, allowMissingDirectory, candidate => {
+            const target = this.virtualLink(candidate, false);
+            if (target !== undefined)
+                return { directory: false, target };
+            if (["/proc", "/proc/self", "/proc/self/fd"].includes(candidate))
+                return { directory: true };
+            const fd = this.procDescriptor(candidate);
+            if (fd === undefined || !this.hasFd(fd))
+                return;
+            const file = this.files.get(fd);
+            // Directory magic links must support descendants (fd/N/name). Files
+            // remain magic leaves so reopen applies the caller's requested flags.
+            return file?.directory ? { directory: false, target: file.path } : { directory: false };
+        });
         // A held private tree is the libc's: a path that reaches it here (a symlink
         // elsewhere, a directory descriptor) is EREMOTE, and the libc releases the
         // tree and asks again (ADR-0047 §3).
@@ -1110,11 +1406,136 @@ export class WaliFileDescriptorTable {
             throw errno("EREMOTE");
         return resolved;
     }
+    procDescriptor(path) {
+        const match = /^\/proc\/self\/fd\/(\d+)$/u.exec(path);
+        return match ? Number(match[1]) : undefined;
+    }
+    virtualLink(path, descriptors = true) {
+        if (path === "/dev/fd")
+            return "/proc/self/fd";
+        if (path === "/dev/stdin")
+            return "/proc/self/fd/0";
+        if (path === "/dev/stdout")
+            return "/proc/self/fd/1";
+        if (path === "/dev/stderr")
+            return "/proc/self/fd/2";
+        if (!descriptors)
+            return;
+        const fd = this.procDescriptor(path);
+        if (fd === undefined)
+            return;
+        const description = this.descriptors.get(fd);
+        if (!description)
+            throw errno("ENOENT");
+        const file = this.files.get(fd);
+        if (file)
+            return file.path;
+        if (description.kind === "pipe")
+            return `pipe:[${description.value.pipe + 1}]`;
+        const special = this.specialDescriptors.get(fd);
+        const rdev = special?.stat?.().rdev;
+        if (rdev !== undefined)
+            return rdev === 0x103 ? "/dev/null" : rdev === 0x108 ? "/dev/random"
+                : rdev === 0x109 ? "/dev/urandom" : "/dev/tty";
+        if (special?.stdio !== undefined)
+            return "/dev/tty";
+        return `anon_inode:[${description.kind}]`;
+    }
+    virtualStat(path, noFollow) {
+        if (noFollow) {
+            const target = this.virtualLink(path);
+            if (target !== undefined)
+                return syntheticSymlinkStat(target);
+        }
+        if (["/proc", "/proc/self", "/proc/self/fd"].includes(path))
+            return {
+                isFile: () => false, isDirectory: () => true, size: 0, mode: 0o040555,
+            };
+        const fd = this.procDescriptor(path);
+        if (fd === undefined)
+            return;
+        const description = this.descriptors.get(fd);
+        if (!description)
+            throw errno("ENOENT");
+        const file = this.files.get(fd);
+        if (file)
+            return (file.inode?.stat() ?? this.fs().statSync(file.path));
+        if (description.kind === "pipe")
+            return {
+                isFile: () => false, isDirectory: () => false, size: 0, mode: 0o010666,
+                ino: description.value.pipe + 1,
+            };
+        return this.specialDescriptors.get(fd)?.stat?.() ?? syntheticTerminalStat();
+    }
+    reopenDescriptor(fd, flags, mode) {
+        const description = this.descriptors.get(fd);
+        if (!description)
+            throw errno("ENOENT");
+        const stat = this.virtualStat(`/proc/self/fd/${fd}`, false);
+        if ((flags & O_DIRECTORY) && !stat.isDirectory())
+            throw errno("ENOTDIR");
+        if ((flags & O_ACCMODE) !== O_WRONLY)
+            checkFilePermission(stat, 4);
+        if ((flags & O_ACCMODE) !== 0)
+            checkFilePermission(stat, 2);
+        const file = this.files.get(fd);
+        if (file) {
+            if (!file.inode)
+                return this.openResolved(file.path, flags & ~(O_CREAT | O_EXCL), mode);
+            if ((flags & O_ACCMODE) !== 0 || (flags & O_TRUNC))
+                this.assertWritable(file.path);
+            const next = this.allocateFd();
+            const inode = file.inode.retain();
+            try {
+                if (flags & O_TRUNC)
+                    inode.truncate(0);
+                this.files.set(next, { path: file.path, inode, flags, position: 0, directory: false,
+                    description: this.nextDescription++ });
+                return this.markCloseOnExecNumber(next, flags);
+            }
+            catch (error) {
+                inode.close();
+                throw error;
+            }
+        }
+        if (description.kind === "pipe" && this.options.descriptorState) {
+            const host = new WaliSharedPipeHost(this.options.memory, { ...this.options.descriptorState,
+                table: this.descriptors.sharedEntries.buffer }, this.descriptors);
+            const result = host.reopen(fd, flags);
+            if (result < 0n)
+                throw errno(result === -24n ? "EMFILE" : "EOPNOTSUPP");
+            return Number(result);
+        }
+        const target = this.virtualLink(`/proc/self/fd/${fd}`);
+        if (target === "/dev/tty" && this.specialDescriptors.get(fd)?.terminal)
+            return this.openResolved(target, flags, mode);
+        const device = target && createWaliDevice(target, flags);
+        if (device) {
+            const next = this.allocateFd();
+            this.specialDescriptors.set(next, device);
+            return this.markCloseOnExecNumber(next, flags);
+        }
+        const special = this.specialDescriptors.get(fd);
+        if (special?.stdio !== undefined) {
+            // Host streams currently expose one direction rather than an inode
+            // that can be reopened in either direction. Do not return a descriptor
+            // whose access mode promises I/O its transport cannot perform.
+            if ((flags & O_ACCMODE) !== (special.stdio === 0 ? 0 : O_WRONLY))
+                throw errno("EOPNOTSUPP");
+            const next = this.allocateFd();
+            this.specialDescriptors.set(next, { stdio: special.stdio });
+            Atomics.store(this.descriptors.registry.pipeMetadata, this.descriptors.entries[next].description * 3 + 1, flags & ~O_CLOEXEC_FLAG);
+            return this.markCloseOnExecNumber(next, flags);
+        }
+        throw errno("EOPNOTSUPP");
+    }
     readSymlink(path) {
         return readWaliSymlink(this.fs(), path);
     }
-    dup(fd, target, minimum = 3) {
-        const maximum = this.options.descriptorMaximum ?? 65_535;
+    dup(fd, target, minimum = 0) {
+        if (target === fd && this.hasFd(fd))
+            return BigInt(fd);
+        const maximum = Math.min(this.options.descriptorMaximum ?? 65_535, this.descriptors.descriptorLimit - 1);
         const stdio = this.stdioFd(fd);
         if (stdio !== undefined) {
             const next = target ?? this.allocateFd(minimum);
@@ -1122,8 +1543,8 @@ export class WaliFileDescriptorTable {
                 return -9n;
             if (next === fd)
                 return BigInt(next);
+            this.close(next);
             this.descriptors.set(next, this.descriptors.get(fd));
-            this.descriptorStatusFlags.set(next, this.statusFlags(fd));
             this.setSharedStdioAlias(next, stdio);
             return BigInt(next);
         }
@@ -1147,7 +1568,7 @@ export class WaliFileDescriptorTable {
             // wasmfs/syscalls.cpp __syscall_fcntl64 F_DUPFD: every open file,
             // including special files, shares its description through the table.
             // Our kernel retains process ownership and FD_CLOEXEC semantics.
-            if (argument < 0 || argument > (this.options.descriptorMaximum ?? 65_535))
+            if (argument < 0 || argument >= this.descriptors.descriptorLimit || argument > (this.options.descriptorMaximum ?? 65_535))
                 return -22n;
             if (special?.duplicate)
                 return special.duplicate(argument, command === 1030);
@@ -1176,13 +1597,18 @@ export class WaliFileDescriptorTable {
         if (command === 3)
             return BigInt(this.statusFlags(fd));
         if (command === 4) {
+            // libsyscall F_SETFL: change only mutable status bits. Access mode,
+            // creation flags and descriptor CLOEXEC are not replaced by the argument.
+            const mutable = O_APPEND | O_NONBLOCK | 0x2000 /* O_ASYNC */ | 0x4000 /* O_DIRECT */ | 0x40000 /* O_NOATIME */;
             const stdio = this.stdioFd(fd);
-            if (stdio !== undefined)
-                this.descriptorStatusFlags.set(fd, argument);
+            if (stdio !== undefined) {
+                const id = this.descriptors.entries[fd].description;
+                Atomics.store(this.descriptors.registry.pipeMetadata, id * 3 + 1, (this.statusFlags(fd) & ~mutable) | (argument & mutable));
+            }
             else {
                 const file = this.files.get(fd);
                 if (file)
-                    file.flags = (file.flags & O_ACCMODE) | (argument & ~O_ACCMODE);
+                    file.flags = (file.flags & ~mutable) | (argument & mutable);
             }
             return 0n;
         }
@@ -1241,7 +1667,7 @@ export class WaliFileDescriptorTable {
         const offset = safeOffset(view.getBigInt64(pointer + 8, true));
         const length = safeOffset(view.getBigInt64(pointer + 16, true));
         const base = whence === SEEK_SET ? 0 : whence === SEEK_CUR ? file.position
-            : whence === SEEK_END ? this.fs().statSync(file.path).size : undefined;
+            : whence === SEEK_END ? (file.inode?.stat() ?? this.fs().statSync(file.path)).size : undefined;
         if (base === undefined)
             throw errno("EINVAL");
         let start = base + offset;
@@ -1347,6 +1773,9 @@ export class WaliFileDescriptorTable {
         return BigInt(scan());
     }
     hasFd(fd) {
+        if (this.options.descriptorState && !this.options.descriptors)
+            return Number.isInteger(fd) && fd >= 0 && fd < 65_536
+                && Atomics.load(new Int32Array(this.options.descriptorState.table), fd) !== 0;
         return this.descriptors.get(fd) !== undefined;
     }
     /** Descriptor aliases retain the identity of their terminal stream. */
@@ -1355,24 +1784,46 @@ export class WaliFileDescriptorTable {
             const state = this.options.descriptorState;
             if (fd < 0 || fd >= 65_536)
                 return;
-            const id = Atomics.load(new Int32Array(state.table), fd);
-            const stream = Atomics.load(new Int32Array(state.descriptions), id * 3 + 2) - 1;
+            const id = Atomics.load(this.options.descriptors ? this.descriptors.sharedEntries : new Int32Array(state.table), fd);
+            const encoded = Atomics.load(new Int32Array(state.descriptions), id * 3 + 2);
+            if (encoded === 4)
+                return 0;
+            const stream = encoded - 1;
             return stream >= 0 && stream <= 2 ? stream : undefined;
         }
         return this.specialDescriptors.get(fd)?.stdio;
     }
+    terminalFd(fd) {
+        const state = this.options.descriptorState;
+        if (!state)
+            return this.specialDescriptors.get(fd)?.terminal === true;
+        if (fd < 0 || fd >= 65_536)
+            return false;
+        const id = Atomics.load(this.options.descriptors ? this.descriptors.sharedEntries : new Int32Array(state.table), fd);
+        return Atomics.load(new Int32Array(state.descriptions), id * 3 + 2) === 4;
+    }
+    terminalAvailable(pointer) {
+        if (!this.options.terminalStdin)
+            return -95n;
+        if (pointer <= 0 || pointer + 4 > this.options.memory().buffer.byteLength)
+            return -14n;
+        this.memoryView().setInt32(pointer, this.options.terminalStdin.available?.() ?? 0, true);
+        return 0n;
+    }
     setSharedStdioAlias(fd, target) {
         if (fd < 0 || fd >= (this.options.stdioAliasRegistry?.length ?? 0))
             return;
         Atomics.store(this.options.stdioAliasRegistry, fd, target ?? -1);
     }
     statusFlags(fd) {
-        const stored = this.descriptorStatusFlags.get(fd);
-        if (stored !== undefined)
-            return stored;
         const stdio = this.stdioFd(fd);
-        if (stdio !== undefined)
-            return stdio === 0 ? 0 : O_WRONLY;
+        if (stdio !== undefined) {
+            const state = this.options.descriptorState;
+            const table = state && !this.options.descriptors ? new Int32Array(state.table) : this.descriptors.sharedEntries;
+            const metadata = state ? new Int32Array(state.descriptions) : this.descriptors.registry.pipeMetadata;
+            const id = Atomics.load(table, fd);
+            return Atomics.load(metadata, id * 3 + 1) | (stdio === 0 || this.terminalFd(fd) ? 0 : O_WRONLY);
+        }
         return this.files.get(fd)?.flags ?? O_RDWR;
     }
     mutate(operation) {
@@ -1409,7 +1860,7 @@ export class WaliFileDescriptorTable {
                             else
                                 fs.writeFileSync(node.path, node.content);
                             fs.chmodSync?.(node.path, node.mode & 0o7777);
-                            fs.utimesSync?.(node.path, new Date(node.atimeMs), new Date(node.mtimeMs));
+                            setBrowserFileTimes(fs, node.path, node.atimeMs, node.mtimeMs);
                         }
                     }
                 this.privateTree = undefined;
@@ -1546,7 +1997,7 @@ export class WaliFileDescriptorTable {
                 else
                     fs.writeFileSync(node.path, node.content);
                 fs.chmodSync?.(node.path, node.mode & 0o7777);
-                fs.utimesSync?.(node.path, new Date(node.atimeMs), new Date(node.mtimeMs));
+                setBrowserFileTimes(fs, node.path, node.atimeMs, node.mtimeMs);
             }
         }
         for (const descriptor of descriptors) {
@@ -1555,7 +2006,10 @@ export class WaliFileDescriptorTable {
             if (descriptor.group === descriptor.fd) {
                 this.files.set(descriptor.fd, {
                     path: descriptor.path, flags: descriptor.flags, position: descriptor.position,
-                    directory: descriptor.directory, description: this.nextDescription++,
+                    ...(!descriptor.directory && fs.openFileSync ? { inode: fs.openFileSync(descriptor.path) } : {}),
+                    directory: descriptor.directory,
+                    ...(descriptor.directory ? { entries: this.directoryEntries(descriptor.path) } : {}),
+                    description: this.nextDescription++,
                 });
             }
             else {
@@ -1570,6 +2024,19 @@ export class WaliFileDescriptorTable {
         return 0n;
     }
 }
+/** WasmFS's single-user mode checks; identity/credential policy is a separate seam. */
+function checkFilePermission(stat, requested) {
+    const mode = stat.mode ?? (stat.isDirectory() ? 0o777 : 0o666);
+    if (((requested & 4) && !(mode & 0o444))
+        || ((requested & 2) && !(mode & 0o222))
+        || ((requested & 1) && !(mode & 0o111)))
+        throw errno("EACCES");
+}
+function checkFileName(path) {
+    // WASMFS_NAME_MAX is Linux's 255-byte component limit, not a work budget.
+    if (new TextEncoder().encode(path.slice(path.lastIndexOf("/") + 1)).byteLength > 255)
+        throw errno("ENAMETOOLONG");
+}
 /** preadv's offset: one 64-bit argument, or two 32-bit halves from a libc that splits it (musl's own preadv.c). */
 function vectorOffset(offset, high) {
     if (high === undefined)
@@ -1585,19 +2052,11 @@ function normalizePath(cwd, path) {
     // Most paths a program names are already normal: itself, without the split.
     if (isNormalPath(path))
         return path;
-    const components = [];
     const value = path.startsWith("/") ? path : `${cwd}/${path}`;
-    for (const component of value.replaceAll("\\", "/").split("/")) {
-        if (!component || component === ".")
-            continue;
-        if (component === "..")
-            components.pop();
-        else
-            components.push(component);
-    }
-    return `/${components.join("/")}`;
+    const normalized = normalizeWaliPath(value);
+    return normalized === "/" ? "/" : normalized.replace(/\/$/u, "");
 }
-/** Absolute, no empty, `.` or `..` component, no trailing slash, and no backslash (which `normalizePath` turns into one). */
+/** Absolute with no empty/dot component or trailing slash; backslash is a literal character. */
 function isNormalPath(path) {
     if (path.charCodeAt(0) !== 47)
         return false;
@@ -1606,8 +2065,6 @@ function isNormalPath(path) {
     let start = 1;
     for (let index = 1; index <= path.length; index += 1) {
         const code = index < path.length ? path.charCodeAt(index) : 47;
-        if (code === 92)
-            return false;
         if (code !== 47)
             continue;
         const length = index - start;
@@ -1637,9 +2094,9 @@ function assertRange(memory, pointer, length) {
         throw new WebAssembly.RuntimeError("WALI filesystem memory access is out of bounds.");
 }
 /** The stat of `path`, or undefined when the store says ENOENT; any other failure is thrown. */
-function statIfPresent(fs, path) {
+function statIfPresent(fs, path, noFollow = false) {
     try {
-        return fs.statSync(path);
+        return noFollow && fs.lstatSync ? fs.lstatSync(path) : fs.statSync(path);
     }
     catch (error) {
         if (/\bENOENT\b/u.test(error instanceof Error ? error.message : String(error)))
@@ -1657,8 +2114,9 @@ function writeStat(view, pointer, stat) {
     setUint64(view, pointer, stat.dev ?? 1);
     setUint64(view, pointer + 8, stat.ino ?? 1);
     setUint64(view, pointer + 16, stat.nlink ?? 1);
-    const kind = stat.isSymbolicLink?.() ? S_IFLNK : stat.isDirectory() ? S_IFDIR : S_IFREG;
-    view.setUint32(pointer + 24, kind | (stat.mode ?? (stat.isDirectory() ? 0o755 : 0o644)), true);
+    // A device supplies S_IFCHR; ORing S_IFREG into it made it S_IFLNK.
+    const kind = (stat.mode ?? 0) & 0o170000 || (stat.isSymbolicLink?.() ? S_IFLNK : stat.isDirectory() ? S_IFDIR : S_IFREG);
+    view.setUint32(pointer + 24, kind | ((stat.mode ?? (stat.isDirectory() ? 0o755 : 0o644)) & 0o7777), true);
     view.setUint32(pointer + 28, stat.uid ?? 1000, true);
     view.setUint32(pointer + 32, stat.gid ?? 1000, true);
     view.setUint32(pointer + 36, 0, true);
@@ -1732,10 +2190,10 @@ function errno(errnoName) {
     return error;
 }
 const ERRNO_NUMBERS = {
-    EPERM: 1n, ENOENT: 2n, EIO: 5n, EBADF: 9n, EAGAIN: 11n, ENOMEM: 12n, EACCES: 13n,
+    EPERM: 1n, ENOENT: 2n, EINTR: 4n, EIO: 5n, ENXIO: 6n, EBADF: 9n, EAGAIN: 11n, ENOMEM: 12n, EACCES: 13n,
     EFAULT: 14n, EBUSY: 16n, EEXIST: 17n, EXDEV: 18n, ENOTDIR: 20n, EISDIR: 21n,
     EINVAL: 22n, EMFILE: 24n, ENOSPC: 28n, ESPIPE: 29n, EROFS: 30n, ERANGE: 34n,
-    ENOSYS: 38n, ENOTEMPTY: 39n, ELOOP: 40n, ENAMETOOLONG: 36n, EREMOTE: 66n,
+    ENOSYS: 38n, ENOTEMPTY: 39n, ELOOP: 40n, ENAMETOOLONG: 36n, EREMOTE: 66n, EOPNOTSUPP: 95n,
 };
 function negativeErrno(error) {
     // The errno's own name first, and the message parsed only for an error that has none.