diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index 05d8113ace68..7d4a70a37877 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -536,6 +536,8 @@ added:
   - v20.16.0
 -->
 
+* Returns: {Promise}
+
 The `blob.bytes()` method returns the byte of the `Blob` object as a `Promise<Uint8Array>`.
 
 ```js
@@ -566,6 +568,7 @@ added:
 * `start` {number} The starting index.
 * `end` {number} The ending index.
 * `type` {string} The content-type for the new `Blob`
+* Returns: {Blob}
 
 Creates and returns a new `Blob` containing a subset of this `Blob` objects
 data. The original `Blob` is not altered.
@@ -5278,6 +5281,7 @@ added:
 > Stability: 3 - Legacy. Use `Buffer.from(data, 'base64')` instead.
 
 * `data` {any} The Base64-encoded input string.
+* Returns: {string}
 
 Decodes a string of Base64-encoded data into bytes, and encodes those bytes
 into a string using Latin-1 (ISO-8859-1).
@@ -5308,6 +5312,7 @@ added:
 > Stability: 3 - Legacy. Use `buf.toString('base64')` instead.
 
 * `data` {any} An ASCII (Latin1) string.
+* Returns: {string}
 
 Decodes a string into bytes using Latin-1 (ISO-8859), and encodes those bytes
 into a string using Base64.
diff --git a/doc/api/ffi.md b/doc/api/ffi.md
index 158aadffa3e3..54de34da7a18 100644
--- a/doc/api/ffi.md
+++ b/doc/api/ffi.md
@@ -126,13 +126,26 @@ raw pointer `bigint` values. For pointer-like parameters, `null`, `undefined`,
 strings, `Buffer`, typed array, `DataView`, and `ArrayBuffer` values are
 converted on the JavaScript side before calling the optimized native wrapper.
 
-Optimized Fast FFI calls support at most 8 function arguments, but the exact
-limit depends on the architecture and on the argument types, because each
-argument must fit in the registers used by the platform trampoline. Integer
-and pointer arguments are limited to 7 on AArch64 and to 6 on x86-64, while
-floating-point arguments can use up to 8 on both. Functions that exceed these
-limits, including any function with more than 8 arguments, use the generic FFI
-call path instead.
+Optimized Fast FFI calls fall back to the generic FFI call path when a
+function's arguments or return type do not fit the platform-specific fast
+trampoline. Fast FFI calls support at most 8 total arguments, and the
+register and argument limits differ per architecture:
+
+| Architecture               | Max integer/pointer args                  | Max floating-point args | Buffer-shaped args | Buffer-shaped + FP together | Narrow (8/16-bit) return |
+| -------------------------- | ----------------------------------------- | ----------------------- | ------------------ | --------------------------- | ------------------------ |
+| AArch64                    | 7 (6 when a buffer-shaped arg is present) | 8                       | Supported          | Not supported               | Supported                |
+| x86-64, Linux/macOS (SysV) | 6 (4 when a buffer-shaped arg is present) | 8                       | Supported          | Not supported               | Supported                |
+| x86-64, Windows (Win64)    | 3 (total arguments also capped at 3)      | 3                       | Not supported      | N/A                         | Supported                |
+| s390x                      | 4                                         | 4                       | Not supported      | N/A                         | Not supported            |
+| PPC64LE                    | 7                                         | 8                       | Not supported      | N/A                         | Not supported            |
+| LoongArch64                | 7                                         | 8                       | Not supported      | N/A                         | Not supported            |
+| RISC-V (64-bit)            | 7                                         | 8                       | Not supported      | N/A                         | Not supported            |
+
+PPC64BE has no fast-call trampoline and always uses the generic call path.
+"Buffer-shaped args" means `Buffer`, typed array, `DataView`, or `ArrayBuffer`
+values passed as pointer-like arguments. Functions whose argument or return
+types exceed the limits for the current platform use the generic FFI call
+path instead.
 
 ## Signature objects
 
diff --git a/doc/api/fs.md b/doc/api/fs.md
index f95b1d85abec..a880c54dc69e 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1191,6 +1191,8 @@ changes:
    description: No longer experimental.
 -->
 
+* Returns: {Promise}
+
 Calls `filehandle.close()` and returns a promise that fulfills when the
 filehandle is closed.
 
@@ -1332,6 +1334,10 @@ changes:
 Asynchronously copies `src` to `dest`. By default, `dest` is overwritten if it
 already exists.
 
+Symbolic links are followed. If `src` is a symbolic link, the target file is
+copied. If `dest` is a symbolic link, the target file is overwritten unless
+`mode` contains `fs.constants.COPYFILE_EXCL`.
+
 No guarantees are made about the atomicity of the copy operation. If an
 error occurs after the destination file has been opened for writing, an attempt
 will be made to remove the destination.
@@ -2850,6 +2856,10 @@ callback function. Node.js makes no guarantees about the atomicity of the copy
 operation. If an error occurs after the destination file has been opened for
 writing, Node.js will attempt to remove the destination.
 
+Symbolic links are followed. If `src` is a symbolic link, the target file is
+copied. If `dest` is a symbolic link, the target file is overwritten unless
+`mode` contains `fs.constants.COPYFILE_EXCL`.
+
 `mode` is an optional integer that specifies the behavior
 of the copy operation. It is possible to create a mask consisting of the bitwise
 OR of two or more values (e.g.
@@ -6019,6 +6029,10 @@ already exists. Returns `undefined`. Node.js makes no guarantees about the
 atomicity of the copy operation. If an error occurs after the destination file
 has been opened for writing, Node.js will attempt to remove the destination.
 
+Symbolic links are followed. If `src` is a symbolic link, the target file is
+copied. If `dest` is a symbolic link, the target file is overwritten unless
+`mode` contains `fs.constants.COPYFILE_EXCL`.
+
 `mode` is an optional integer that specifies the behavior
 of the copy operation. It is possible to create a mask consisting of the bitwise
 OR of two or more values (e.g.
@@ -7351,6 +7365,8 @@ changes:
    description: No longer experimental.
 -->
 
+* Returns: {Promise}
+
 Calls `dir.close()` if the directory handle is open, and returns a promise that
 fulfills when disposal is complete.
 
@@ -8416,6 +8432,7 @@ of bytes written is passed as the first argument to the event handler.
     * `writeBufferLen` {number}
     * `remainingBufferLen`: {number}
   * `sync`: {boolean} Perform writes synchronously.
+* Returns: {fs.Utf8Stream}
 
 #### `utf8Stream.append`
 
diff --git a/doc/api/tty.md b/doc/api/tty.md
index 03f86cd66052..cbfb3cc78377 100644
--- a/doc/api/tty.md
+++ b/doc/api/tty.md
@@ -86,6 +86,11 @@ characters. <kbd>Ctrl</kbd>+<kbd>C</kbd> will no longer cause a `SIGINT` when
 in this mode. This mode does not affect terminal output processing, such as
 newline translation on Unix terminals.
 
+On Windows, `setRawMode()` requires write permission to the console input
+buffer. When opening `"\\\\.\\CONIN$"` with the [`fs.open()`][] family of APIs
+(for passing into `new tty.ReadStream()`), be sure to use a read/write flag
+such as `'r+'`.
+
 ## Class: `tty.WriteStream`
 
 <!-- YAML
@@ -342,6 +347,7 @@ The `tty.isatty()` method returns `true` if the given `fd` is associated with
 a TTY and `false` if it is not, including whenever `fd` is not a non-negative
 integer.
 
+[`fs.open()`]: fs.md#fsopenpath-flags-mode-callback
 [`net.Socket` constructor]: net.md#new-netsocketoptions
 [`process.stderr`]: process.md#processstderr
 [`process.stdin`]: process.md#processstdin
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index d0da887062bd..5a0522ba4240 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -3182,10 +3182,11 @@ Maybe<void> ExtractRowValues(Environment* env,
 }
 
 MaybeLocal<Value> StatementExecutionHelper::All(Environment* env,
-                                                DatabaseSync* db,
-                                                sqlite3_stmt* stmt,
-                                                bool return_arrays,
-                                                bool use_big_ints) {
+                                                StatementSync* statement) {
+  DatabaseSync* db = statement->db_.get();
+  sqlite3_stmt* stmt = statement->statement_.get();
+  const bool return_arrays = statement->return_arrays_;
+  const bool use_big_ints = statement->use_big_ints_;
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
   int r;
@@ -3211,13 +3212,10 @@ MaybeLocal<Value> StatementExecutionHelper::All(Environment* env,
       rows.emplace_back(row_array);
     } else {
       if (row_keys.size() == 0) {
-        row_keys.reserve(num_cols);
-        for (int i = 0; i < num_cols; ++i) {
-          Local<Name> key;
-          if (!ColumnNameToName(env, stmt, i).ToLocal(&key)) {
-            return MaybeLocal<Value>();
-          }
-          row_keys.emplace_back(key);
+        // Reuses the statement's internalized column names instead of
+        // re-interning them on every call.
+        if (!statement->GetCachedColumnNames(&row_keys)) {
+          return MaybeLocal<Value>();
         }
       }
       DCHECK_EQ(row_keys.size(), row_values.size());
@@ -3232,9 +3230,10 @@ MaybeLocal<Value> StatementExecutionHelper::All(Environment* env,
 }
 
 MaybeLocal<Object> StatementExecutionHelper::Run(Environment* env,
-                                                 DatabaseSync* db,
-                                                 sqlite3_stmt* stmt,
-                                                 bool use_big_ints) {
+                                                 StatementSync* statement) {
+  DatabaseSync* db = statement->db_.get();
+  sqlite3_stmt* stmt = statement->statement_.get();
+  const bool use_big_ints = statement->use_big_ints_;
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
   // Declared before the reset below so that it outlives it: sqlite3_reset()
@@ -3319,10 +3318,11 @@ BaseObjectPtr<StatementSyncIterator> StatementExecutionHelper::Iterate(
 }
 
 MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
-                                                DatabaseSync* db,
-                                                sqlite3_stmt* stmt,
-                                                bool return_arrays,
-                                                bool use_big_ints) {
+                                                StatementSync* statement) {
+  DatabaseSync* db = statement->db_.get();
+  sqlite3_stmt* stmt = statement->statement_.get();
+  const bool return_arrays = statement->return_arrays_;
+  const bool use_big_ints = statement->use_big_ints_;
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
   // Declared before the reset below so that it outlives it: sqlite3_reset()
@@ -3360,13 +3360,10 @@ MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
     result = Array::New(isolate, row_values.data(), row_values.size());
   } else {
     LocalVector<Name> keys(isolate);
-    keys.reserve(num_cols);
-    for (int i = 0; i < num_cols; ++i) {
-      Local<Name> key;
-      if (!ColumnNameToName(env, stmt, i).ToLocal(&key)) {
-        return MaybeLocal<Value>();
-      }
-      keys.emplace_back(key);
+    // Reuses the statement's internalized column names instead of
+    // re-interning them on every call.
+    if (!statement->GetCachedColumnNames(&keys)) {
+      return MaybeLocal<Value>();
     }
 
     DCHECK_EQ(keys.size(), row_values.size());
@@ -3399,12 +3396,7 @@ void StatementSync::All(const FunctionCallbackInfo<Value>& args) {
     if (needs_reset) sqlite3_reset(stmt->statement_.get());
   });
   Local<Value> result;
-  if (StatementExecutionHelper::All(env,
-                                    stmt->db_.get(),
-                                    stmt->statement_.get(),
-                                    stmt->return_arrays_,
-                                    stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::All(env, stmt).ToLocal(&result)) {
     RESET_AND_CHECK(
         isolate, stmt->db_.get(), stmt->statement_.get(), needs_reset, void());
     args.GetReturnValue().Set(result);
@@ -3452,12 +3444,7 @@ void StatementSync::Get(const FunctionCallbackInfo<Value>& args) {
   }
 
   Local<Value> result;
-  if (StatementExecutionHelper::Get(env,
-                                    stmt->db_.get(),
-                                    stmt->statement_.get(),
-                                    stmt->return_arrays_,
-                                    stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::Get(env, stmt).ToLocal(&result)) {
     args.GetReturnValue().Set(result);
   }
 }
@@ -3478,9 +3465,7 @@ void StatementSync::Run(const FunctionCallbackInfo<Value>& args) {
   }
 
   Local<Object> result;
-  if (StatementExecutionHelper::Run(
-          env, stmt->db_.get(), stmt->statement_.get(), stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::Run(env, stmt).ToLocal(&result)) {
     args.GetReturnValue().Set(result);
   }
 }
@@ -3821,9 +3806,7 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
   }
 
   Local<Object> result;
-  if (StatementExecutionHelper::Run(
-          env, stmt->db_.get(), stmt->statement_.get(), stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::Run(env, stmt.get()).ToLocal(&result)) {
     args.GetReturnValue().Set(result);
   }
 }
@@ -3881,12 +3864,7 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
   }
 
   Local<Value> result;
-  if (StatementExecutionHelper::Get(env,
-                                    stmt->db_.get(),
-                                    stmt->statement_.get(),
-                                    stmt->return_arrays_,
-                                    stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::Get(env, stmt.get()).ToLocal(&result)) {
     args.GetReturnValue().Set(result);
   }
 }
@@ -3918,12 +3896,7 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
     if (needs_reset) sqlite3_reset(stmt->statement_.get());
   });
   Local<Value> result;
-  if (StatementExecutionHelper::All(env,
-                                    stmt->db_.get(),
-                                    stmt->statement_.get(),
-                                    stmt->return_arrays_,
-                                    stmt->use_big_ints_)
-          .ToLocal(&result)) {
+  if (StatementExecutionHelper::All(env, stmt.get()).ToLocal(&result)) {
     RESET_AND_CHECK(
         isolate, stmt->db_.get(), stmt->statement_.get(), needs_reset, void());
     args.GetReturnValue().Set(result);
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 475a759e75e8..705cefb1811b 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -178,14 +178,9 @@ using StatementPtr = DeleteFnPtr<sqlite3_stmt, FinalizeStatement>;
 class StatementExecutionHelper {
  public:
   static v8::MaybeLocal<v8::Value> All(Environment* env,
-                                       DatabaseSync* db,
-                                       sqlite3_stmt* stmt,
-                                       bool return_arrays,
-                                       bool use_big_ints);
+                                       StatementSync* statement);
   static v8::MaybeLocal<v8::Object> Run(Environment* env,
-                                        DatabaseSync* db,
-                                        sqlite3_stmt* stmt,
-                                        bool use_big_ints);
+                                        StatementSync* statement);
   static BaseObjectPtr<StatementSyncIterator> Iterate(
       Environment* env, BaseObjectPtr<StatementSync> stmt);
   static v8::MaybeLocal<v8::Value> ColumnToValue(Environment* env,
@@ -196,10 +191,7 @@ class StatementExecutionHelper {
                                                    sqlite3_stmt* stmt,
                                                    const int column);
   static v8::MaybeLocal<v8::Value> Get(Environment* env,
-                                       DatabaseSync* db,
-                                       sqlite3_stmt* stmt,
-                                       bool return_arrays,
-                                       bool use_big_ints);
+                                       StatementSync* statement);
 };
 
 class DatabaseSync;
diff --git a/test/parallel/test-common-wpt-backends.js b/test/parallel/test-common-wpt-backends.js
index f201adde64e1..10aa619bc8d5 100644
--- a/test/parallel/test-common-wpt-backends.js
+++ b/test/parallel/test-common-wpt-backends.js
@@ -73,7 +73,15 @@ async function collect(backend, throws) {
     },
   });
 
-  await handle.finished;
+  const watchdog = setTimeout(
+    common.mustNotCall(`The ${backend} WPT backend did not finish`),
+    common.platformTimeout(10_000),
+  );
+  try {
+    await handle.finished;
+  } finally {
+    clearTimeout(watchdog);
+  }
   return events;
 }
 
diff --git a/tools/doc/man-page.doc-kit.config.mjs b/tools/doc/man-page.doc-kit.config.mjs
index bed71a8cb80c..93c947c29011 100644
--- a/tools/doc/man-page.doc-kit.config.mjs
+++ b/tools/doc/man-page.doc-kit.config.mjs
@@ -5,7 +5,14 @@ import { fileURLToPath } from 'node:url';
 
 const root = new URL('../../', import.meta.url);
 
-const fromRoot = (path) => fileURLToPath(new URL(path, root));
+// POSIX separators, because `input` is a glob pattern and a backslash reads as
+// an escape character, which would mangle Windows paths into non-matches.
+const fromRoot = (path) =>
+  fileURLToPath(new URL(path, root)).replaceAll('\\', '/');
+
+// doc-kit only treats a value as local when it parses as a `file:` URL, and a
+// Windows drive letter parses as a URL scheme, so these must stay URLs.
+const urlFromRoot = (path) => new URL(path, root).href;
 
 export default {
   target: ['man-page'],
@@ -15,7 +22,7 @@ export default {
     output: fromRoot('tools/doc/.manpagecheck'),
 
     // Point every loadable URL at its local file so no network request is made.
-    changelog: fromRoot('CHANGELOG.md'),
-    index: fromRoot('doc/api/index.md'),
+    changelog: urlFromRoot('CHANGELOG.md'),
+    index: urlFromRoot('doc/api/index.md'),
   },
 };
diff --git a/tools/doc/package-lock.json b/tools/doc/package-lock.json
index a63b70a7d3c3..20912317efc8 100644
--- a/tools/doc/package-lock.json
+++ b/tools/doc/package-lock.json
@@ -4572,9 +4572,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.27.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
-      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"