[SaladDay]

Native filesystem calls currently turn each path component into a separate remote lookup. Batch eligible metadata requests within their original syscall using the existing File.Walk operation. The kernel still executes each syscall; exact syscall epochs and actual FUSE parent/node identities prevent reuse across operations. This remains inside the common View/File adapter, with no Harness branches, new executor, remote protocol or setting.

Use cilium/ebpf for a shared, bounded Linux amd64 scope observer. If BPF is unavailable, the same ordinary FUSE mapping remains functional. Preserve handle checks, permissions and pinned mount topology. Return unused Walk references through existing cleanup, and detach all kernel programs when the last View closes.

Measured unchanged native Claude fixture at 100 ms injected File latency: Bash 41.909→25.333 seconds, Read 12.229→5.672 seconds; final counts 278/61 File operations. The complete earlier same-binary 0/5/100 ms matrix also passed. This does not eliminate residual high-latency metadata cost. Host-wide early filtering costs approximately 67 ns per unregistered syscall in the local alternating benchmark while at least one scoped View exists; the optimization currently supports amd64 only. No additional capability beyond the existing deployment set is required.

Validation: independent fresh review found no P0–P2 issues; focused Go tests/race/vet, real FUSE/POSIX/lock tests, shared-loader/LRU/epoch/reference cleanup tests, and native file verification/shutdown passed. Explicit BPF denial preserved the baseline native behavior and complete File operation counts. Final targeted native 100 ms rerun passed after lifecycle cleanup. Linux arm64 and Darwin arm64 package builds passed; the real microsandbox helper Makefile target passed with -mod=readonly. Rebase onto 3eeb64d was patch-equivalent. Live qualification remains pending integration.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}