diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f348c1b995..6e4e1cfe272 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,11 +15,9 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # macOS, because `toyos-fat32`'s fixtures are formatted with `newfs_msdos`
-  # and `hdiutil`.
   host:
     if: github.event_name == 'merge_group' || github.event.pull_request.draft == false
-    runs-on: macos-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -37,7 +35,7 @@ jobs:
             toyos/target
             kernel/target
             bootloader/target
-          key: host-${{ github.run_id }}
-          restore-keys: host-
+          key: host-linux-${{ github.run_id }}
+          restore-keys: host-linux-
 
       - run: cargo run -- --ci host
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 3b7808ad94f..c9010b31699 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   host:
-    runs-on: macos-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -35,8 +35,8 @@ jobs:
             toyos/target
             kernel/target
             bootloader/target
-          key: host-${{ github.run_id }}
-          restore-keys: host-
+          key: host-linux-${{ github.run_id }}
+          restore-keys: host-linux-
 
       - run: cargo run -- --ci host
 
@@ -46,7 +46,7 @@ jobs:
         uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: *host-paths
-          key: host-${{ github.run_id }}
+          key: host-linux-${{ github.run_id }}
 
   # Publishes this tree's toolchain if nobody has, and on main moves the SDK
   # alias onto it. Bare `ubuntu-24.04`, not a container: its glibc is the
@@ -209,3 +209,5 @@ jobs:
           sh "$RUNNER_TEMP/rustup-init.sh" -y --profile minimal --default-toolchain stable
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - run: env -u GITHUB_ACTIONS -u CI cargo run -- --build-only
+      # The host suite's macOS arms run here alone: `ci.yml`'s `host` is Linux.
+      - run: cargo run -- --ci host
diff --git a/Cargo.lock b/Cargo.lock
index 5a9bffbf3c5..cc05a45c729 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1007,6 +1007,7 @@ version = "0.1.0"
 name = "toyos-fat32"
 version = "0.1.0"
 dependencies = [
+ "fatfs",
  "toyos-fat32-check",
  "toyos-tmpdir",
  "toyos-wallclock",
diff --git a/NOTICE b/NOTICE
index 8738752851e..517fd70bc36 100644
--- a/NOTICE
+++ b/NOTICE
@@ -309,3 +309,88 @@ the tool, not the bytes a user's own data becomes when the tool writes it: the
 layout is a published on-disk format, not a copyrightable work of the program,
 and the file contents are ours. The tool is not distributed with this repository
 in any form.
+
+
+toyos-fat32/tests/fixtures/ — volumes macOS's FAT tools wrote
+--------------------------------------------------------------
+
+    blank-512.runs     3,672 bytes, of a  67,108,864-byte raw volume
+      sha256 4f1686152769fb4b064a78b0a2287c8b54bff3ec1e279b35c8f337d538a45f78
+      raw    51dfc22ac6ab939a28f8cf113da48cbb75eb0b4f5a4d2b79c9f09522a58fe052
+    blank-4k.runs      3,672 bytes, of a 314,572,800-byte raw volume
+      sha256 14e98fc505450882f4d284fb712d32b4f9e4d50c1bfc86702ace8f0adee745e0
+      raw    788974e418ac37cb43f65057f609bd4234b4f5fffb10e8be7563a608b423e137
+    read-512.runs    336,152 bytes, of a  67,108,864-byte raw volume
+      sha256 6bef14efca36070830f5a4a2b1dc9b69a0e2627679cc5c9ed542acaa4ece416c
+      raw    911903c9338144f65df86a6f98d87c375725806a709db3bb48d772fe3b719fbb
+    read-4k.runs      55,032 bytes, of a 314,572,800-byte raw volume
+      sha256 cab78e1ea6c46b0a04a0de32a24f1a6ac90a2017dd7188745de2d603c5ab121b
+      raw    cb4cefe9a9b2b17371ec20fa8a49b16475f2434ff5ed5d9277c99bef3cdd592c
+    hostile.runs      36,536 bytes, of a  67,108,864-byte raw volume
+      sha256 c570b3c6944f47d2cd1498da14f12c4a98dc85683f782624181917eba68f9066
+      raw    1750198122459dee8f1b4d54ac460d9689279189d6ff59f6072d57d00dbbd68e
+    empty-file.runs    6,264 bytes, of a  67,108,864-byte raw volume
+      sha256 68a6abf1626e4bdf6b3586d3f52b2d7051390e4e18beb31258dd0021bb3e96b9
+      raw    ff0e162a36ccf76d1aa5cb36ce47c0d728442bf926d59af498d0d55820bcfd85
+    Boot stub: Copyright (c) 1998 Robert Nordier
+    Licence text: licenses/BSD-2-Clause-newfs_msdos.txt
+    SPDX-License-Identifier: (MIT OR Apache-2.0) AND BSD-2-Clause
+
+`toyos-fat32`'s host tests read these volumes, and write into the two blank
+ones. The only honest judge of a FAT reader is bytes a FAT implementation that
+is not ours wrote, and these are those bytes. Each is committed as its runs of
+nonzero 512-byte sectors, which `Image::fixture` in
+`toyos-fat32/tests/common/mod.rs` expands into a sparse file; the raw digest is
+of that expansion, and equals the digest of what the tools wrote.
+
+They were made once, on macOS 27.0.1 (build 26A434), with Apple's `msdosfs`
+project at SourceVersion 845000003000001 (`/sbin/newfs_msdos`, sha256
+29b3d7daa299583015c823ea6ebce643c030a79c8bc26b9bf9c23deb4c6d1a73) and
+`/usr/bin/hdiutil`, by a throwaway program making the invocations
+`toyos-fat32/tests/common/mod.rs` made at fa134154c with a fixed label. Per
+volume, on a sparse file of the raw size:
+
+    hdiutil attach -imagekey diskimage-class=CRawDiskImage -nobrowse -nomount <file>
+    newfs_msdos -F 32 -S 512 -c <c> -v <label> /dev/disk4
+    hdiutil detach /dev/disk4
+    hdiutil attach -imagekey diskimage-class=CRawDiskImage -nobrowse <file>
+    # the files below written under /Volumes/<label> with std::fs, parents
+    # created, in order; then every `._*` sidecar macOS left there deleted
+    hdiutil detach /dev/disk4
+
+    volume      -c  label        files
+    blank-512    1  TFBLANK      none
+    blank-4k     8  TFBLANK4K    none
+    read-512     1  TFREAD       the ten `populated` lists in tests/host_read.rs
+    read-4k      8  TFREAD4K     the three `a_four_kib_cluster_volume_reads_the_same` lists
+    hostile      1  TFHOSTILE    sub/deeper/ (mkdir -p first), plain.txt "a short file",
+                                 "A Long Name For Entries.bin" pattern(20000, 5),
+                                 sub/inner.dat pattern(4000, 6), sub/deeper/leaf.txt "leaf"
+    empty-file   1  TFEMPTYFILE  empty.txt "", full.txt "twelve bytes"
+
+`pattern` is the one in `toyos-fat32/tests/common/mod.rs`. Nothing in this
+repository runs either tool: the suite reads only what is committed here.
+
+**What in them is not ours.** The names and contents of the files are this
+repository's test bytes, and the layout — boot sector, FSInfo, FATs, directory
+entries — is the published on-disk format, data the tools computed rather than
+a work of theirs. Two things the tools wrote are not:
+
+- Every boot sector, sector 0 and its backup at sector 6, carries at offset
+  0x5A the 84 bytes of `newfs_msdos`'s `bootcode[]`: 39 bytes of x86 that print
+  a message through the BIOS, wait for a key and reboot, then "Non-system disk"
+  and "Press any key to reboot". They are byte for byte that array in FreeBSD's
+  `sbin/newfs_msdos/mkfs_msdos.c`, Robert Nordier's under BSD-2-Clause, and in
+  Apple's `msdosfs` at tag `msdosfs-788.100.31`
+  (`lib_newfs_msdos/newfs_data_types.h`, taken from
+  `newfs_msdos.tproj/newfs_msdos.c`, which carries Nordier's notice under
+  Apple's). The volumes are declared as carrying it under BSD-2-Clause, whose
+  one condition on redistribution in binary form is reproducing the notice,
+  which the licence text above does verbatim.
+- The freed clusters still hold the AppleDouble sidecars macOS wrote beside
+  every file and the generation then deleted: Apple's AppleDouble header with
+  its `Mac OS X` filler, an eleven-byte `com.apple.provenance` attribute, and
+  the stock phrase "This resource fork intentionally left blank". That is
+  machine-written metadata and a short phrase, and no licence is claimed for
+  it. It stays because the deleted entries and their long-name runs in front
+  of them are input a reader has to skip.
diff --git a/issues/build/apps-on-toyos-window-terminal-toybox-and-doom-build-for-toyos-alone.md b/issues/build/apps-on-toyos-window-terminal-toybox-and-doom-build-for-toyos-alone.md
new file mode 100644
index 00000000000..dcbdf16d871
--- /dev/null
+++ b/issues/build/apps-on-toyos-window-terminal-toybox-and-doom-build-for-toyos-alone.md
@@ -0,0 +1,25 @@
+---
+status: open
+kind: defect
+opened: 2026-10-01
+---
+
+# Apps on toyos-window, terminal, toybox and doom build or run on ToyOS alone
+
+A userland app builds and runs on macOS, Linux, Windows and ToyOS from the same
+source (owner's ruling). These do not. Each row below is
+`cargo check --manifest-path userland/<app>/Cargo.toml --target x86_64-unknown-linux-gnu`,
+run on the macOS dev host:
+
+| app | exit | what stops it |
+|---|---|---|
+| editor, files, paint, filepicker | 0 | they compile, but `toyos-abi/src/syscall.rs` issues ToyOS's `syscall` on every OS, so `toyos-window` reaches no display off ToyOS |
+| terminal | 101 | "unresolved import `std::os::toyos`" |
+| toybox, doom | 101 | `alsa-sys`, which cpal's Linux backend links: its `build.rs` finds ALSA only through `pkg-config`, so a Linux build needs `libasound2-dev` installed |
+
+doom's `build.rs` also panics on any target the build system does not name a C
+compiler for. With `--target x86_64-pc-windows-msvc` it exits 101 with
+"CC_x86_64_pc_windows_msvc is unset".
+
+**Exit:** each builds with a plain `cargo build` for Linux, macOS and Windows,
+and opens its window there.
diff --git a/issues/build/the-build-runs-host-tools-outside-rust-and-qemu.md b/issues/build/the-build-runs-host-tools-outside-rust-and-qemu.md
index b00a133dd5f..b0239d20584 100644
--- a/issues/build/the-build-runs-host-tools-outside-rust-and-qemu.md
+++ b/issues/build/the-build-runs-host-tools-outside-rust-and-qemu.md
@@ -32,7 +32,6 @@ arrives and is not one. M4 and M5 are stages of `issues/build/toyos-builds-itsel
 | `gh` | `src/release.rs` asks whether a toolchain release exists, creates it and moves the `sdk-<version>` alias, on the nightly's `build` runner | refused: not C or C++ source, it is Go | `src/release.rs` speaks GitHub's REST API itself |
 | `ssh` | `src/metal.rs` reaches the T14's Ubuntu with it, only in the metal loop | refused: a Rust tool does it, the repository's own russh client `crate::build::ssh_client_host`, which `src/metaltalk.rs` already drives | `src/metal.rs` drives that client, or Ubuntu leaves the loop |
 | `cc`, `c++`, `ar` and `xcrun` on a macOS host, Apple's Command Line Tools | what the Linux row's tools do, and rustc asks `xcrun` for the SDK on every host link that names no `SDKROOT` (`rust/compiler/rustc_codegen_ssa/src/back/apple.rs`), as `src/llvm.rs` does for the LLVM's key | refused: one host OS alone | M5: no host in the loop |
-| `newfs_msdos` and `hdiutil` | `toyos-fat32`'s host tests format and mount their fixtures with them (`toyos-fat32/tests/common/mod.rs`), which keeps the `host` job on `macos-latest` | refused: one host OS alone | `issues/filesystem/fat32-suite-needs-macos-binaries.md` |
 | `diag/flash.sh` | the owner's flash of a stick by hand: `bash`, and the `stat`, `seq`, `tr`, `grep`, `cut` and `sync` it strings together | refused: shell of our own | `issues/build/the-owners-flash-script-runs-diskutil.md` |
 | `diskutil` and `plutil` | `diag/flash.sh`, and `diskutil` in the README's flashing steps | refused: one host OS alone | `issues/build/the-owners-flash-script-runs-diskutil.md` |
 | `shasum`, a Perl script on macOS | `diag/flash.sh` hashes the image with it | refused: a Rust tool does it, `sha2`, which `src/release.rs` hashes with | `issues/build/the-owners-flash-script-runs-diskutil.md` |
diff --git a/issues/build/the-host-job-runs-the-toolchain-the-runner-ships.md b/issues/build/the-host-job-runs-the-toolchain-the-runner-ships.md
index 79f14184869..a221e5731b3 100644
--- a/issues/build/the-host-job-runs-the-toolchain-the-runner-ships.md
+++ b/issues/build/the-host-job-runs-the-toolchain-the-runner-ships.md
@@ -4,11 +4,11 @@ kind: tooling
 opened: 2026-09-03
 ---
 
-# The host job tracks whatever toolchain `macos-latest` ships, and a runner roll reds every open pull request at once
+# The host job tracks whatever toolchain ships, and a runner roll reds every open pull request at once
 
 `35383398^:.github/workflows/host-tests.yml`'s `host` job installs no Rust toolchain: it
 runs `rustc -vV; cargo -V; rustup component add clippy` on whatever
-`macos-latest` ships that day, and there is no root `rust-toolchain.toml` —
+ships that day, and there is no root `rust-toolchain.toml` —
 only `kernel/`, `bootloader/` and `userland/` pin one, each to a target list
 and none to a version.
 
@@ -64,20 +64,15 @@ default 1.97.1 after the fix.
 
 A moving input under every verdict is a supply-chain decision, not a
 convenience, and every guest lane's container image is pinned by digest, never
-by tag; the host job's `macos-latest` toolchain is not. The
+by tag; the host job's toolchain is not. The
 `CLAUDE.md` principle for
 `rust/`, this project's own compiler fork, is "kept current with upstream" — a
-deliberate track-stable choice, stated and owned. The host job's ambient
-`macos-latest` toolchain has never been stated as either: it is not pinned like
-a container image, and it is not declared track-stable like `rust/` — it simply
-moves when Apple's
-runner image moves, silently, until a new lint reds every open pull request on
-the same morning.
+deliberate track-stable choice, stated and owned.
 
 **The decision owed, not taken here:** pin a toolchain version in the host job
 (`actions-rs`-style `rust-toolchain` input, or a root `rust-toolchain.toml`
 covering the host workspace too) and roll it deliberately on its own PR when
 the tree is ready to adopt a new compiler's lints — or keep tracking whatever
-`macos-latest` ships and accept that a runner-image roll reds every open pull
+ships and accept that a runner-image roll reds every open pull
 request until someone lands the fix, the way today's did. Both are legitimate
 engineering positions; this entry does not choose between them.
diff --git a/issues/build/the-userland-gate-reads-an-attribute-only-where-a-line-starts.md b/issues/build/the-userland-gate-reads-an-attribute-only-where-a-line-starts.md
new file mode 100644
index 00000000000..eba641d215e
--- /dev/null
+++ b/issues/build/the-userland-gate-reads-an-attribute-only-where-a-line-starts.md
@@ -0,0 +1,25 @@
+---
+status: open
+kind: tooling
+opened: 2026-10-01
+---
+
+# The userland gate reads an attribute only where a line starts, so a test after code on its line runs nowhere
+
+`src/userlandhost.rs`'s `scan` reads a line for attributes only if the line
+starts with one. `fn _hidden() {} #[test] fn runs_nowhere() { panic!("never run") }`
+is a test to rustc and none to the gate. Appended to a package `host` never
+builds, it runs in no `cargo test`, and `every_userland_test_is_in_the_gate`
+stays green.
+
+Measured with `src/userlandhost.rs` byte for byte as at 5620b737e. Each row is
+a checked patch, built with `cargo run -- --build-only` (exit 0 for all),
+judged with `cargo test --lib userlandhost::tests::every_userland_test_is_in_the_gate`,
+and reverted:
+
+| appended to | form | gate |
+|---|---|---|
+| `userland/snake/src/main.rs` | the one line above | 0 |
+
+**Exit:** the scan reads an attribute wherever on a line it starts, a comment
+still holds none, and the one-line form reds.
diff --git a/issues/filesystem/fat32-suite-needs-macos-binaries.md b/issues/filesystem/fat32-suite-needs-macos-binaries.md
deleted file mode 100644
index 0606aefe00a..00000000000
--- a/issues/filesystem/fat32-suite-needs-macos-binaries.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-08-08
----
-
-# This suite still formats and populates through two macOS binaries
-
-**The judge is ours as of 2026-08-08.** `fsck_msdos` is gone from all three
-places it was used — `src/image.rs`, `tests/common/volumes.rs` and
-`toyos-fat32/tests/common/mod.rs` — replaced by `toyos-fat32-check/`, written
-from fatgen103 and derived from neither our writer nor our reader. The stale FAT mirror and duplicate 8.3 names, both of which
-`fsck_msdos` silently accepted, are among the twelve corruptions the new
-checker catches and it did not.
-
-**What is left is `newfs_msdos` and `hdiutil`**, and they are the harder half
-because they are not a judge. `Image::formatted` shells out to
-`/sbin/newfs_msdos -F 32` through a `hdiutil` device node, and the volumes are
-populated through a real macOS `msdosfs` mount. That is the *point* of this
-suite — our reader against bytes we did not write, and our writer's output read
-back by a driver that is not ours — so replacing them is not "write a
-formatter", it is deciding what independent implementation takes their place.
-Consequence today: `cargo test` in this crate runs on the owner's laptop and
-nowhere else, `host-tests.yml` is on `macos-latest` for this reason alone, and a
-Linux contributor cannot run the FAT32 suite at all.
-
-Scope, if someone takes it. `fatfs` is an ordinary crates.io crate already in
-this tree's dependency graph and is a genuinely independent FAT32
-implementation: it can format a volume and write files into one, which covers
-both roles. What it does *not* give is what `msdosfs` gives — a second reader
-written by people with no sight of our code — so a suite built on `fatfs` alone
-tests our writer against one other implementation rather than against the
-platform. Whether that is enough is the decision, and it is the owner's. Note
-that `src/image.rs` already uses `fatfs` for exactly one thing (formatting the
-empty volume), so the precedent exists and its limits are recorded there.
-
-**The owner ruled on 2026-09-01: `fatfs` replaces both binaries.** The judge
-is already ours and already independent — `toyos-fat32-check`, written from
-fatgen103 and derived from neither our writer nor our reader — so what
-`newfs_msdos` and `hdiutil` still supply is a *fixture* that produces bytes we
-did not write, not an oracle. `fatfs` supplies that, `src/image.rs` already
-uses it to format the empty volume, and the precedent's limits are recorded
-there. What is knowingly given up is `msdosfs` as a second *reader* written by
-people with no sight of our code; the ruling accepts that, because the oracle
-role is filled and the cost of keeping it is that this suite runs on one laptop
-and `host-tests.yml` is pinned to `macos-latest` for that alone. Closing this
-removes the pin.
-
-Nothing in the *guest* suite is affected: `tests/common/volumes.rs` needs no
-formatter, only the judge.
diff --git a/licenses/BSD-2-Clause-newfs_msdos.txt b/licenses/BSD-2-Clause-newfs_msdos.txt
new file mode 100644
index 00000000000..d7c4c36029a
--- /dev/null
+++ b/licenses/BSD-2-Clause-newfs_msdos.txt
@@ -0,0 +1,24 @@
+Copyright (c) 1998 Robert Nordier
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in
+   the documentation and/or other materials provided with the
+   distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS
+OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/src/licence.rs b/src/licence.rs
index c309857aa25..2c402c12d46 100644
--- a/src/licence.rs
+++ b/src/licence.rs
@@ -285,6 +285,46 @@ pub const COMMITTED_FILES: &[(&str, &str, &str, Terms)] = &[
         "NOTICE",
         Terms::Spdx("MIT OR Apache-2.0"),
     ),
+    // FAT32 volumes macOS's `newfs_msdos` formatted and its `msdosfs`
+    // populated, as runs of nonzero sectors. Each boot sector carries
+    // `newfs_msdos`'s boot stub; `NOTICE` carries its notice, each raw digest
+    // and the commands.
+    (
+        "toyos-fat32/tests/fixtures/blank-4k.runs",
+        "14e98fc505450882f4d284fb712d32b4f9e4d50c1bfc86702ace8f0adee745e0",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
+    (
+        "toyos-fat32/tests/fixtures/blank-512.runs",
+        "4f1686152769fb4b064a78b0a2287c8b54bff3ec1e279b35c8f337d538a45f78",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
+    (
+        "toyos-fat32/tests/fixtures/empty-file.runs",
+        "68a6abf1626e4bdf6b3586d3f52b2d7051390e4e18beb31258dd0021bb3e96b9",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
+    (
+        "toyos-fat32/tests/fixtures/hostile.runs",
+        "c570b3c6944f47d2cd1498da14f12c4a98dc85683f782624181917eba68f9066",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
+    (
+        "toyos-fat32/tests/fixtures/read-4k.runs",
+        "cab78e1ea6c46b0a04a0de32a24f1a6ac90a2017dd7188745de2d603c5ab121b",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
+    (
+        "toyos-fat32/tests/fixtures/read-512.runs",
+        "6bef14efca36070830f5a4a2b1dc9b69a0e2627679cc5c9ed542acaa4ece416c",
+        "NOTICE",
+        Terms::Spdx("(MIT OR Apache-2.0) AND BSD-2-Clause"),
+    ),
     (
         "assets/DOOM1.WAD",
         "1d7d43be501e67d927e415e0b8f3e29c3bf33075e859721816f652a526cac771",
diff --git a/src/llvm.rs b/src/llvm.rs
index 695dba9f621..6b505d942c9 100644
--- a/src/llvm.rs
+++ b/src/llvm.rs
@@ -620,11 +620,16 @@ mod tests {
         let config = config_text(Path::new(KEYED_BUILD_DIR), &host_triple(), tools);
         let base = key(&fork);
         assert_eq!(key_of(&fork, RECIPE, &config, &tools.identity), base);
-        let linux = config_text(Path::new(KEYED_BUILD_DIR), "x86_64-unknown-linux-gnu", tools);
+        let elsewhere = if host_triple() == "x86_64-unknown-linux-gnu" {
+            "aarch64-unknown-linux-gnu"
+        } else {
+            "x86_64-unknown-linux-gnu"
+        };
+        let elsewhere = config_text(Path::new(KEYED_BUILD_DIR), elsewhere, tools);
         for (what, other) in [
             ("the recipe", key_of(&fork, "another recipe", &config, &tools.identity)),
             ("the [llvm]", key_of(&fork, RECIPE, &config.replace("X86", "RISCV;X86"), &tools.identity)),
-            ("the host", key_of(&fork, RECIPE, &linux, &tools.identity)),
+            ("the host", key_of(&fork, RECIPE, &elsewhere, &tools.identity)),
             ("the host's tools", key_of(&fork, RECIPE, &config, "/usr/bin/gcc\ngcc 14\n")),
         ] {
             assert_ne!(other, base, "{what} did not move the key");
@@ -658,7 +663,7 @@ mod tests {
         for tool in [&tools.cc, &tools.cxx] {
             assert!(tool.is_absolute() && tool.is_file(), "{} is no compiler", tool.display());
             let at = lines.iter().position(|l| Path::new(l) == tool.as_path()).unwrap_or_else(|| panic!("{}", tools.identity));
-            assert!(lines[at + 1].contains("version"), "{} said no version: {}", tool.display(), tools.identity);
+            assert!(lines[at + 1].chars().any(|c| c.is_ascii_digit()), "{} said no version: {}", tool.display(), tools.identity);
         }
         assert!(lines.iter().any(|l| l.starts_with("cmake version")), "{}", tools.identity);
         if host_triple().ends_with("apple-darwin") {
diff --git a/toyos-fat32-check/tests/common/mod.rs b/toyos-fat32-check/tests/common/mod.rs
index 27da6a0dfe6..425390b73d1 100644
--- a/toyos-fat32-check/tests/common/mod.rs
+++ b/toyos-fat32-check/tests/common/mod.rs
@@ -1,12 +1,10 @@
 //! A FAT32 volume built here, byte by byte, from the specification.
 //!
 //! The mutation tests need a volume they can break in exactly one place, and
-//! they need to know where that place is. Nothing in this repository can hand
-//! them one: `newfs_msdos` is a macOS binary, which is the dependency this
-//! crate exists to remove, and `toyos-fat32` is the writer under judgement.
-//! So the fixture is written from fatgen103 the same way the checker reads it,
-//! and its being clean is asserted first — a mutation from a volume the checker
-//! already complains about proves nothing.
+//! they need to know where that place is. So the fixture is written from
+//! fatgen103 the same way the checker reads it, and its being clean is asserted
+//! first — a mutation from a volume the checker already complains about proves
+//! nothing.
 //!
 //! The layout is the smallest one FAT32 admits: 512-byte sectors, one sector to
 //! a cluster, and 65,600 clusters, which is 75 above the 65,525 that separates
diff --git a/toyos-fat32/Cargo.toml b/toyos-fat32/Cargo.toml
index 0eb076144c5..13025ddd7ae 100644
--- a/toyos-fat32/Cargo.toml
+++ b/toyos-fat32/Cargo.toml
@@ -31,3 +31,6 @@ toyos-wallclock = { path = "../toyos-wallclock" }
 toyos-fat32-check = { path = "../toyos-fat32-check" }
 # Test scratch that is gone on every way out; `--ci host` reds on any left behind.
 toyos-tmpdir = { path = "../toyos-tmpdir" }
+# The reader this crate's output is read back by: a third party's FAT
+# implementation, sharing no code with this crate.
+fatfs = "0.3.6"
diff --git a/toyos-fat32/tests/common/mod.rs b/toyos-fat32/tests/common/mod.rs
index 6a0a03bb04c..e228aafe57f 100644
--- a/toyos-fat32/tests/common/mod.rs
+++ b/toyos-fat32/tests/common/mod.rs
@@ -1,11 +1,12 @@
 //! Host-side scaffolding: real FAT32 images made by macOS, devices that carry
 //! them, and the volume-checker gate.
 //!
-//! Nothing here formats a volume. The images come from `newfs_msdos`, are
-//! populated through a real mount, and are judged by `toyos-fat32-check`, which
-//! is written from the specification and shares no code with this crate — so
-//! the ground truth on both sides of every test is something other than the
-//! driver under test.
+//! Nothing here formats a volume. The images are `tests/fixtures/`: macOS's
+//! `newfs_msdos` formatted each and its `msdosfs` populated it, once, and
+//! `NOTICE` records the commands and the release. They are judged by
+//! `toyos-fat32-check`, which is written from the specification and shares no
+//! code with this crate — so the ground truth on both sides of every test is
+//! something other than the driver under test.
 //!
 //! **A device here standing in for the kernel adapter models that adapter's
 //! cache wherever the two can differ.** A write refused after it reached the
@@ -22,45 +23,10 @@ use std::fs::{File, OpenOptions};
 use std::io::Read;
 use std::os::unix::fs::FileExt;
 use std::path::{Path, PathBuf};
-use std::process::Command;
-use std::sync::atomic::{AtomicU32, Ordering};
-use std::sync::Mutex;
 
 use toyos_fat32::{BlockAccess, IoError};
 use toyos_tmpdir::TempDir;
 
-/// `hdiutil` hands out device nodes from one global pool and mounts into one
-/// global `/Volumes`. Two tests attaching at once is a race in macOS, not in
-/// this crate, so attach/detach pairs are serialised.
-static HDIUTIL: Mutex<()> = Mutex::new(());
-
-static LABEL_SEQ: AtomicU32 = AtomicU32::new(0);
-
-fn run(cmd: &mut Command) -> (bool, String) {
-    let out = cmd.output().unwrap_or_else(|e| panic!("failed to run {cmd:?}: {e}"));
-    let mut text = String::from_utf8_lossy(&out.stdout).into_owned();
-    text.push_str(&String::from_utf8_lossy(&out.stderr));
-    (out.status.success(), text)
-}
-
-/// Delete every `._*` AppleDouble sidecar `root` or a directory under it
-/// holds — recursively, since macOS drops one beside any file it touches on
-/// a mount at any depth. A directory that vanished mid-walk (macOS removing
-/// its own sidecar concurrently) is not an error: there is nothing left in
-/// it to delete.
-fn delete_apple_double_sidecars(root: &Path) {
-    let Ok(entries) = std::fs::read_dir(root) else { return };
-    for entry in entries.flatten() {
-        let path = entry.path();
-        let is_dir = entry.file_type().map(|t| t.is_dir()).unwrap_or(false);
-        if is_dir {
-            delete_apple_double_sidecars(&path);
-        } else if path.file_name().and_then(|n| n.to_str()).is_some_and(|n| n.starts_with("._")) {
-            let _ = std::fs::remove_file(&path);
-        }
-    }
-}
-
 // ---------------------------------------------------------------- devices
 
 /// A device backed by a file, which only ever issues whole 4096-byte block
@@ -435,46 +401,35 @@ impl AdapterCache {
 
 pub struct Image {
     pub path: PathBuf,
-    label: String,
     /// Where the image file is, gone with it.
     _dir: TempDir,
 }
 
 impl Image {
-    /// A sparse file of `bytes`, formatted by `newfs_msdos -F 32` through a
-    /// `hdiutil` device node.
+    /// `tests/fixtures/<name>.runs` expanded into a sparse file of this test's
+    /// own, which the test may write.
     ///
-    /// `newfs_msdos` refuses a plain file — it wants a device to ask for the
-    /// partition offset — so the file is attached first. The file stays sparse
-    /// throughout, which is what makes a 300 MB volume with 4 KiB clusters
-    /// affordable.
-    pub fn new(name: &str, bytes: u64, sectors_per_cluster: u32) -> Image {
-        let seq = LABEL_SEQ.fetch_add(1, Ordering::Relaxed);
-        let label = format!("TF{:09}", (std::process::id() * 1000 + seq) % 1_000_000_000);
+    /// The form is the image's length, then each run of nonzero 512-byte
+    /// sectors as its offset, its length and its bytes, every number a
+    /// little-endian `u64`. Everything between two runs is zero, which a sparse
+    /// file holds for nothing, so a 300 MB volume with 4 KiB clusters costs what
+    /// is on it.
+    pub fn fixture(name: &str) -> Image {
+        let source = Path::new(env!("CARGO_MANIFEST_DIR")).join(format!("tests/fixtures/{name}.runs"));
+        let runs = std::fs::read(&source).unwrap_or_else(|e| panic!("{}: {e}", source.display()));
+        let word = |at: usize| u64::from_le_bytes(runs[at..at + 8].try_into().expect("eight bytes"));
         let dir = TempDir::new(&format!("fat32-{name}"));
-        let path = dir.join(format!("{label}.img"));
+        let path = dir.join(format!("{name}.img"));
         let file = File::create(&path).expect("create image");
-        file.set_len(bytes).expect("size image");
-        drop(file);
-
-        let guard = HDIUTIL.lock().unwrap_or_else(|e| e.into_inner());
-        let dev = attach(&path, false).0;
-        let (ok, out) = run(Command::new("/sbin/newfs_msdos").args([
-            "-F",
-            "32",
-            "-S",
-            "512",
-            "-c",
-            &sectors_per_cluster.to_string(),
-            "-v",
-            &label,
-            &dev,
-        ]));
-        detach(&dev);
-        drop(guard);
-        assert!(ok, "newfs_msdos failed on {}:\n{out}", path.display());
-
-        Image { path, label, _dir: dir }
+        file.set_len(word(0)).expect("size image");
+        let mut at = 8;
+        while at < runs.len() {
+            let (offset, len) = (word(at), word(at + 8) as usize);
+            assert!(offset + len as u64 <= word(0), "{}: a run at {offset} ends past the image", source.display());
+            file.write_all_at(&runs[at + 16..at + 16 + len], offset).expect("write a run");
+            at += 16 + len;
+        }
+        Image { path, _dir: dir }
     }
 
     pub fn size(&self) -> u64 {
@@ -498,26 +453,6 @@ impl Image {
         assert_fats_agree(g, &self.bytes(g.fat_base_offset(g.num_fats) as usize));
     }
 
-    /// Attach and mount, run `f`, remove the files macOS leaves behind, and
-    /// detach.
-    pub fn with_mount<T>(&self, f: impl FnOnce(&Path) -> T) -> T {
-        let guard = HDIUTIL.lock().unwrap_or_else(|e| e.into_inner());
-        let (dev, mount) = attach(&self.path, true);
-        let mount = mount.unwrap_or_else(|| panic!("{} did not mount", self.path.display()));
-        let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| f(Path::new(&mount))));
-        // AppleDouble sidecars and Spotlight state are macOS's, not the test's.
-        delete_apple_double_sidecars(Path::new(&mount));
-        for junk in [".fseventsd", ".Spotlight-V100", ".Trashes", ".TemporaryItems"] {
-            let _ = std::fs::remove_dir_all(Path::new(&mount).join(junk));
-        }
-        detach(&dev);
-        drop(guard);
-        match result {
-            Ok(v) => v,
-            Err(p) => std::panic::resume_unwind(p),
-        }
-    }
-
     /// Assert the volume checker finds nothing to complain about.
     ///
     /// Silence is the whole gate: [`toyos_fat32_check::check`] answers with the
@@ -535,37 +470,6 @@ impl Image {
     }
 }
 
-fn attach(path: &Path, mount: bool) -> (String, Option<String>) {
-    let mut cmd = Command::new("/usr/bin/hdiutil");
-    cmd.args(["attach", "-imagekey", "diskimage-class=CRawDiskImage", "-nobrowse"]);
-    if !mount {
-        cmd.arg("-nomount");
-    }
-    cmd.arg(path);
-    let (ok, out) = run(&mut cmd);
-    assert!(ok, "hdiutil attach failed for {}:\n{out}", path.display());
-
-    let line = out.lines().find(|l| l.starts_with("/dev/")).unwrap_or_else(|| {
-        panic!("no device node in hdiutil output for {}:\n{out}", path.display())
-    });
-    let mut parts = line.split('\t').map(str::trim);
-    let dev = parts.next().unwrap_or_default().to_string();
-    let mount = line.split('\t').map(str::trim).find(|p| p.starts_with("/Volumes/")).map(String::from);
-    (dev, mount)
-}
-
-fn detach(dev: &str) {
-    for _ in 0..10 {
-        let (ok, _) = run(Command::new("/usr/bin/hdiutil").args(["detach", dev]));
-        if ok {
-            return;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(200));
-    }
-    let (ok, out) = run(Command::new("/usr/bin/hdiutil").args(["detach", "-force", dev]));
-    assert!(ok, "could not detach {dev}:\n{out}");
-}
-
 // ------------------------------------------------------------- assertions
 
 /// The error a mount was supposed to produce.
diff --git a/toyos-fat32/tests/fixtures/blank-4k.runs b/toyos-fat32/tests/fixtures/blank-4k.runs
new file mode 100644
index 00000000000..86500171731
Binary files /dev/null and b/toyos-fat32/tests/fixtures/blank-4k.runs differ
diff --git a/toyos-fat32/tests/fixtures/blank-512.runs b/toyos-fat32/tests/fixtures/blank-512.runs
new file mode 100644
index 00000000000..a48ee55a92a
Binary files /dev/null and b/toyos-fat32/tests/fixtures/blank-512.runs differ
diff --git a/toyos-fat32/tests/fixtures/empty-file.runs b/toyos-fat32/tests/fixtures/empty-file.runs
new file mode 100644
index 00000000000..b5920ba5ce0
Binary files /dev/null and b/toyos-fat32/tests/fixtures/empty-file.runs differ
diff --git a/toyos-fat32/tests/fixtures/hostile.runs b/toyos-fat32/tests/fixtures/hostile.runs
new file mode 100644
index 00000000000..009e2b4d26b
Binary files /dev/null and b/toyos-fat32/tests/fixtures/hostile.runs differ
diff --git a/toyos-fat32/tests/fixtures/read-4k.runs b/toyos-fat32/tests/fixtures/read-4k.runs
new file mode 100644
index 00000000000..98221aa8188
Binary files /dev/null and b/toyos-fat32/tests/fixtures/read-4k.runs differ
diff --git a/toyos-fat32/tests/fixtures/read-512.runs b/toyos-fat32/tests/fixtures/read-512.runs
new file mode 100644
index 00000000000..880a8788337
Binary files /dev/null and b/toyos-fat32/tests/fixtures/read-512.runs differ
diff --git a/toyos-fat32/tests/host_read.rs b/toyos-fat32/tests/host_read.rs
index f346b240b17..84723c8e1ef 100644
--- a/toyos-fat32/tests/host_read.rs
+++ b/toyos-fat32/tests/host_read.rs
@@ -1,13 +1,10 @@
 //! Direction one of the gate: macOS writes the volume, this crate reads it.
 //!
-//! Everything asserted here has ground truth outside this repository — the
-//! bytes came from `newfs_msdos` and the macOS `msdosfs` driver, so a reader
-//! that agrees with itself cannot pass.
+//! The bytes came from `newfs_msdos` and the macOS `msdosfs` driver, so a
+//! reader that agrees with itself cannot pass.
 
 mod common;
 
-use std::fs;
-
 use common::{pattern, read_all, sorted_walk, walk_expectation, Image};
 use toyos_fat32::{Error, Fat32};
 
@@ -20,37 +17,27 @@ struct Fixture {
     files: Vec<(String, Vec<u8>)>,
 }
 
-/// A volume with one of everything that has ever broken a FAT reader.
-fn populated(sectors_per_cluster: u32, cluster_bytes: usize) -> Fixture {
+/// A volume with one of everything that has ever broken a FAT reader, and the
+/// files macOS wrote to it in this order.
+fn populated() -> Fixture {
     let files: Vec<(String, Vec<u8>)> = vec![
         ("UPPER.TXT".into(), b"a pure 8.3 name needs no long entry".to_vec()),
         ("hello.txt".into(), b"lowercase, which 8.3 cannot hold".to_vec()),
         ("A very long file name that needs several LFN entries.txt".into(), b"lfn".to_vec()),
         ("\u{fc}n\u{ef}c\u{f6}d\u{e9}.txt".into(), "non-ascii".as_bytes().to_vec()),
         ("empty.bin".into(), Vec::new()),
-        ("exactly-one-cluster.bin".into(), pattern(cluster_bytes, 1)),
-        ("one-byte-over.bin".into(), pattern(cluster_bytes + 1, 2)),
+        ("exactly-one-cluster.bin".into(), pattern(CLUSTER, 1)),
+        ("one-byte-over.bin".into(), pattern(CLUSTER + 1, 2)),
         ("sub/one.txt".into(), b"in a subdirectory".to_vec()),
         ("sub/nested/deep.bin".into(), pattern(300 * 1024, 3)),
-        ("sub/nested/A Second Long Name.dat".into(), pattern(3 * cluster_bytes, 4)),
+        ("sub/nested/A Second Long Name.dat".into(), pattern(3 * CLUSTER, 4)),
     ];
-
-    let image = Image::new("read", 64 * 1024 * 1024, sectors_per_cluster);
-    image.with_mount(|mount| {
-        for (name, data) in &files {
-            let path = mount.join(name);
-            if let Some(parent) = path.parent() {
-                fs::create_dir_all(parent).expect("mkdir");
-            }
-            fs::write(&path, data).expect("write");
-        }
-    });
-    Fixture { image, files }
+    Fixture { image: Image::fixture("read-512"), files }
 }
 
 #[test]
 fn walk_sees_exactly_what_the_host_wrote() {
-    let fx = populated(1, CLUSTER);
+    let fx = populated();
     let mut fs = Fat32::mount(fx.image.device()).expect("mount");
 
     assert_eq!(sorted_walk(&mut fs), walk_expectation(&fx.files));
@@ -60,7 +47,7 @@ fn walk_sees_exactly_what_the_host_wrote() {
 /// Ignoring those bits reports `HELLO.TXT`, which is a different file name.
 #[test]
 fn lowercase_short_names_survive() {
-    let fx = populated(1, CLUSTER);
+    let fx = populated();
     let mut fs = Fat32::mount(fx.image.device()).expect("mount");
     let names: Vec<String> = fs.read_dir("", 64).expect("read_dir").into_iter().map(|e| e.name).collect();
     assert!(names.contains(&String::from("hello.txt")), "{names:?}");
@@ -69,7 +56,7 @@ fn lowercase_short_names_survive() {
 
 #[test]
 fn every_file_reads_back_byte_for_byte() {
-    let fx = populated(1, CLUSTER);
+    let fx = populated();
     let mut fs = Fat32::mount(fx.image.device()).expect("mount");
     for (name, data) in &fx.files {
         assert_eq!(&read_all(&mut fs, name), data, "contents of {name}");
@@ -79,7 +66,7 @@ fn every_file_reads_back_byte_for_byte() {
 
 #[test]
 fn reads_land_correctly_at_every_offset_and_length() {
-    let fx = populated(1, CLUSTER);
+    let fx = populated();
     let mut fs = Fat32::mount(fx.image.device()).expect("mount");
     let name = "sub/nested/deep.bin";
     let truth = &fx.files.iter().find(|(n, _)| n == name).expect("fixture").1;
@@ -103,7 +90,7 @@ fn reads_land_correctly_at_every_offset_and_length() {
 
 #[test]
 fn subdirectories_list_independently() {
-    let fx = populated(1, CLUSTER);
+    let fx = populated();
     let mut fs = Fat32::mount(fx.image.device()).expect("mount");
 
     let mut top: Vec<String> = fs.read_dir("sub", 64).expect("read_dir").into_iter().map(|e| e.name).collect();
@@ -122,7 +109,7 @@ fn subdirectories_list_independently() {
 /// and no file behind it. A reader that treats it as a file invents one.
 #[test]
 fn the_volume_label_is_not_a_file() {
-    let fx = populated(1, CLUSTER);
+    let fx = populated();
     let mut fs = Fat32::mount(fx.image.device()).expect("mount");
     let names: Vec<String> = fs.read_dir("", 64).expect("read_dir").into_iter().map(|e| e.name).collect();
     assert!(!names.iter().any(|n| n.starts_with("TF")), "label leaked into the listing: {names:?}");
@@ -130,7 +117,7 @@ fn the_volume_label_is_not_a_file() {
 
 #[test]
 fn missing_paths_are_not_found_rather_than_anything_else() {
-    let fx = populated(1, CLUSTER);
+    let fx = populated();
     let mut fs = Fat32::mount(fx.image.device()).expect("mount");
     assert_eq!(fs.open("nope.txt").unwrap_err(), Error::NotFound);
     assert_eq!(fs.open("sub/nope.txt").unwrap_err(), Error::NotFound);
@@ -144,7 +131,7 @@ fn missing_paths_are_not_found_rather_than_anything_else() {
 /// looks for `EFI/BOOT/BOOTX64.EFI`.
 #[test]
 fn lookup_ignores_case() {
-    let fx = populated(1, CLUSTER);
+    let fx = populated();
     let mut fs = Fat32::mount(fx.image.device()).expect("mount");
     assert!(fs.exists("HELLO.TXT").expect("exists"));
     assert!(fs.exists("upper.txt").expect("exists"));
@@ -154,7 +141,7 @@ fn lookup_ignores_case() {
 
 #[test]
 fn extents_cover_the_file_and_point_at_its_bytes() {
-    let fx = populated(1, CLUSTER);
+    let fx = populated();
     let mut fs = Fat32::mount(fx.image.device()).expect("mount");
     let name = "sub/nested/deep.bin";
     let truth = &fx.files.iter().find(|(n, _)| n == name).expect("fixture").1;
@@ -192,17 +179,7 @@ fn a_four_kib_cluster_volume_reads_the_same() {
     ];
     // 65_525 clusters of 4 KiB is the floor for FAT32, so this volume cannot
     // be smaller. It is sparse, so it costs what is written to it.
-    let image = Image::new("read4k", 300 * 1024 * 1024, 8);
-    image.with_mount(|mount| {
-        for (name, data) in &files {
-            let path = mount.join(name);
-            if let Some(p) = path.parent() {
-                fs::create_dir_all(p).expect("mkdir");
-            }
-            fs::write(&path, data).expect("write");
-        }
-    });
-
+    let image = Image::fixture("read-4k");
     let mut fs = Fat32::mount(image.device()).expect("mount");
     assert_eq!(fs.geometry().bytes_per_cluster(), 4096);
     for (name, data) in &files {
diff --git a/toyos-fat32/tests/host_write.rs b/toyos-fat32/tests/host_write.rs
index ddbb61c2a71..4d4bb214031 100644
--- a/toyos-fat32/tests/host_write.rs
+++ b/toyos-fat32/tests/host_write.rs
@@ -2,16 +2,16 @@
 //! are not this crate judge it.
 //!
 //! A write that only this crate's own reader can read back certifies nothing,
-//! so every test here ends with [`common::Image::fsck`] finding no fault and a
-//! real macOS mount producing the exact bytes. Neither judge shares a line with
-//! the code under test: the checker is written from the specification, and the
-//! mount is the operating system's.
+//! so every test here ends with [`common::Image::fsck`] finding no fault and
+//! the `fatfs` crate reading back the exact bytes. Neither judge shares a line
+//! with the code under test: the checker is written from the specification, and
+//! the reader is a third party's FAT implementation.
 
 mod common;
 
 use std::collections::BTreeMap;
 use std::fs;
-use std::path::Path;
+use std::io::{Cursor, Read};
 
 use common::{pattern, read_all, sorted_walk, walk_expectation, write_new, Image};
 use toyos_fat32::{Error, Fat32, FatTime};
@@ -22,28 +22,46 @@ fn stamp() -> FatTime {
     FatTime::from_unix_secs(1_717_245_296)
 }
 
-fn image(name: &str) -> Image {
-    Image::new(name, 64 * 1024 * 1024, 1)
+/// One 512-byte cluster per sector, which is what the T14's log partition has
+/// and what makes "the chain holds three more clusters than the size needs" a
+/// three-cluster append rather than a 12 KiB one.
+fn image() -> Image {
+    Image::fixture("blank-512")
 }
 
-/// Everything under `mount`, as path → bytes, with directories as empty
-/// entries suffixed with `/`.
-fn host_tree(mount: &Path) -> BTreeMap<String, Vec<u8>> {
-    fn walk(root: &Path, dir: &Path, out: &mut BTreeMap<String, Vec<u8>>) {
-        for e in fs::read_dir(dir).expect("read_dir") {
-            let e = e.expect("entry");
-            let path = e.path();
-            let rel = path.strip_prefix(root).expect("relative").to_string_lossy().into_owned();
-            if e.file_type().expect("file_type").is_dir() {
-                out.insert(format!("{rel}/"), Vec::new());
-                walk(root, &path, out);
-            } else {
-                out.insert(rel, fs::read(&path).expect("read"));
+/// The volume as `fatfs` mounts it. It wants a writable, seekable device even
+/// to read, so it is handed a copy and the image stays the test's.
+fn host(image: &Image) -> fatfs::FileSystem<Cursor<Vec<u8>>> {
+    let volume = fs::read(&image.path).expect("read the volume back");
+    fatfs::FileSystem::new(Cursor::new(volume), fatfs::FsOptions::new())
+        .expect("fatfs mounts the volume")
+}
+
+/// Everything on the volume as `fatfs` reads it, as path → bytes, with
+/// directories as empty entries suffixed with `/`.
+fn host_tree(image: &Image) -> BTreeMap<String, Vec<u8>> {
+    fn walk(dir: &fatfs::Dir<'_, Cursor<Vec<u8>>>, prefix: &str, out: &mut BTreeMap<String, Vec<u8>>) {
+        for e in dir.iter() {
+            let e = e.expect("read a directory entry");
+            let name = e.file_name();
+            if name == "." || name == ".." {
+                continue;
             }
+            let path = format!("{prefix}{name}");
+            let (key, bytes) = if e.is_dir() {
+                walk(&e.to_dir(), &format!("{path}/"), out);
+                (format!("{path}/"), Vec::new())
+            } else {
+                let mut bytes = Vec::new();
+                e.to_file().read_to_end(&mut bytes).unwrap_or_else(|e| panic!("read {path}: {e}"));
+                (path, bytes)
+            };
+            assert!(out.insert(key.clone(), bytes).is_none(), "{key} is listed twice");
         }
     }
+    let fs = host(image);
     let mut out = BTreeMap::new();
-    walk(mount, mount, &mut out);
+    walk(&fs.root_dir(), "", &mut out);
     out
 }
 
@@ -53,12 +71,8 @@ fn the_host_accepts_a_volume_we_populated() {
         ("PLAIN.TXT", b"a pure 8.3 name".to_vec()),
         ("lowercase.txt", b"needs a long entry to keep its case".to_vec()),
         ("A Rather Long Name With Spaces.dat", pattern(5000, 11)),
-        // Greek pi and an astral emoji: neither has a canonical decomposition,
-        // so the name macOS reads back is the name we wrote. A character that
-        // does have one — any Latin letter with a diaeresis — comes back
-        // decomposed, because macOS normalises at the mount layer and not in
-        // the directory entry. The emoji is also the surrogate-pair case: it
-        // is two UTF-16 units in one long-name entry.
+        // The emoji is the surrogate-pair case: two UTF-16 units in one
+        // long-name entry.
         ("\u{3c0}-constant.txt", "non-ascii long name".as_bytes().to_vec()),
         ("emoji-\u{1F600}.txt", "outside the basic plane".as_bytes().to_vec()),
         ("zero.bin", Vec::new()),
@@ -66,7 +80,7 @@ fn the_host_accepts_a_volume_we_populated() {
         ("dir/deeper/still.bin", pattern(20_000, 12)),
     ];
 
-    let image = image("write");
+    let image = image();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
         fs.create_dir("dir", stamp()).expect("mkdir dir");
@@ -79,7 +93,7 @@ fn the_host_accepts_a_volume_we_populated() {
 
     image.fsck();
 
-    let tree = image.with_mount(host_tree);
+    let tree = host_tree(&image);
     for (name, data) in &files {
         let got = tree.get(*name).unwrap_or_else(|| panic!("{name} missing; host saw {:?}", tree.keys()));
         assert_eq!(got, data, "contents of {name}");
@@ -89,36 +103,36 @@ fn the_host_accepts_a_volume_we_populated() {
     assert_eq!(tree.len(), files.len() + 2);
 }
 
-/// The timestamp reaches the host's idea of mtime. FAT stores local time with
-/// no zone, and macOS reads it back in the machine's zone, so the two can
-/// differ by hours — the day is what is checkable without inventing a zone.
+/// The timestamp is the one we stamped, field for field. FAT stores local time
+/// with no zone and `fatfs` applies none, so the fields come back as written.
 #[test]
 fn the_host_sees_the_timestamp_we_stamped() {
-    let image = image("time");
+    let image = image();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
         write_new(&mut fs, "dated.txt", b"x", stamp());
         fs.sync().expect("sync");
     }
     image.fsck();
-    let secs = image.with_mount(|mount| {
-        fs::metadata(mount.join("dated.txt"))
-            .expect("stat")
-            .modified()
-            .expect("mtime")
-            .duration_since(std::time::UNIX_EPOCH)
-            .expect("epoch")
-            .as_secs()
-    });
-    let delta = secs.abs_diff(1_717_245_296);
-    assert!(delta < 24 * 3600, "host read {secs}, we wrote 1717245296");
+    let host = host(&image);
+    let entry = host
+        .root_dir()
+        .iter()
+        .map(|e| e.expect("read a directory entry"))
+        .find(|e| e.file_name() == "dated.txt")
+        .expect("dated.txt is listed");
+    let t = entry.modified();
+    assert_eq!(
+        (t.date.year, t.date.month, t.date.day, t.time.hour, t.time.min, t.time.sec),
+        (2024, 6, 1, 12, 34, 56)
+    );
 }
 
 /// One cluster is 512 bytes here, so these lengths straddle the boundary a
 /// naive write handles by writing the first cluster twice.
 #[test]
 fn files_crossing_cluster_boundaries_are_intact() {
-    let image = image("boundary");
+    let image = image();
     let lengths = [1usize, 511, 512, 513, 1023, 1024, 1025, 4096, 8191];
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
@@ -128,12 +142,10 @@ fn files_crossing_cluster_boundaries_are_intact() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        for len in lengths {
-            let got = fs::read(mount.join(format!("len{len}.bin"))).expect("read");
-            assert_eq!(got, pattern(len, len as u64), "length {len}");
-        }
-    });
+    let tree = host_tree(&image);
+    for len in lengths {
+        assert_eq!(tree[&format!("len{len}.bin")], pattern(len, len as u64), "length {len}");
+    }
 }
 
 /// A directory cluster holds 16 entries here. Sixty files with long names need
@@ -141,7 +153,7 @@ fn files_crossing_cluster_boundaries_are_intact() {
 /// stays walkable across the join.
 #[test]
 fn a_directory_grows_into_further_clusters() {
-    let image = image("dirgrow");
+    let image = image();
     let names: Vec<String> = (0..60).map(|i| format!("A Long Enough Name To Need Entries {i:03}.log")).collect();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
@@ -152,19 +164,14 @@ fn a_directory_grows_into_further_clusters() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        let mut got: Vec<String> = fs::read_dir(mount.join("logs"))
-            .expect("read_dir")
-            .map(|e| e.expect("entry").file_name().to_string_lossy().into_owned())
-            .collect();
-        got.sort();
-        let mut want = names.clone();
-        want.sort();
-        assert_eq!(got, want);
-        for (i, name) in names.iter().enumerate() {
-            assert_eq!(fs::read(mount.join("logs").join(name)).expect("read"), pattern(100, i as u64 + 1));
-        }
-    });
+    let tree = host_tree(&image);
+    let got: Vec<&str> = tree.keys().filter_map(|k| k.strip_prefix("logs/")).filter(|k| !k.is_empty()).collect();
+    let mut want: Vec<&str> = names.iter().map(String::as_str).collect();
+    want.sort();
+    assert_eq!(got, want);
+    for (i, name) in names.iter().enumerate() {
+        assert_eq!(tree[&format!("logs/{name}")], pattern(100, i as u64 + 1));
+    }
 }
 
 /// Short names must stay unique inside a directory. These all reduce to the
@@ -172,7 +179,7 @@ fn a_directory_grows_into_further_clusters() {
 /// past.
 #[test]
 fn colliding_short_names_stay_unique() {
-    let image = image("collide");
+    let image = image();
     let names: Vec<String> = (0..40).map(|i| format!("boot-{i:04}.log")).collect();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
@@ -182,13 +189,12 @@ fn colliding_short_names_stay_unique() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        for (i, name) in names.iter().enumerate() {
-            assert_eq!(fs::read(mount.join(name)).expect("read"), format!("entry {i}").into_bytes(), "{name}");
-        }
-    });
+    let tree = host_tree(&image);
+    for (i, name) in names.iter().enumerate() {
+        assert_eq!(tree[name], format!("entry {i}").into_bytes(), "{name}");
+    }
 
-    // The host mount cannot check this: it reads the long names, as
+    // `fatfs` cannot check this: it reads the long names, as
     // `fsck_msdos` did before the checker replaced it. Asked here through the
     // crate's own device as well, because a name this crate generated is what
     // is under test and the failure names the eleven bytes.
@@ -206,7 +212,7 @@ fn colliding_short_names_stay_unique() {
 /// if they did not — see [`common::assert_fats_agree`].
 #[test]
 fn every_fat_copy_stays_in_step() {
-    let image = image("mirrors");
+    let image = image();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
         assert_eq!(fs.geometry().num_fats, 2, "the corpus has one FAT, so this proves nothing");
@@ -225,7 +231,7 @@ fn every_fat_copy_stays_in_step() {
 
 #[test]
 fn appending_extends_the_chain() {
-    let image = image("append");
+    let image = image();
     let chunk = pattern(700, 21);
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
@@ -238,9 +244,7 @@ fn appending_extends_the_chain() {
     }
     image.fsck();
     let want: Vec<u8> = chunk.iter().cycle().take(50 * chunk.len()).copied().collect();
-    image.with_mount(|mount| {
-        assert_eq!(fs::read(mount.join("grown.bin")).expect("read"), want);
-    });
+    assert_eq!(host_tree(&image)["grown.bin"], want);
 }
 
 /// Delete a large file, then write another that must land on the clusters the
@@ -248,7 +252,7 @@ fn appending_extends_the_chain() {
 /// cross-link `fsck` will find.
 #[test]
 fn deleted_clusters_come_back() {
-    let image = image("reuse");
+    let image = image();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
         let before = fs.free_bytes().expect("free");
@@ -265,17 +269,16 @@ fn deleted_clusters_come_back() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        assert!(!mount.join("big.bin").exists());
-        assert_eq!(fs::read(mount.join("second.bin")).expect("read"), pattern(2_000_000, 32));
-    });
+    let tree = host_tree(&image);
+    assert!(!tree.contains_key("big.bin"));
+    assert_eq!(tree["second.bin"], pattern(2_000_000, 32));
 }
 
 /// Filling the volume must end in `NoSpace` with the filesystem still sound —
 /// not a partly written chain, and not a panic.
 #[test]
 fn a_full_volume_refuses_cleanly() {
-    let image = image("full");
+    let image = image();
     let mut written = 0u64;
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
@@ -315,7 +318,7 @@ fn a_full_volume_refuses_cleanly() {
 
 #[test]
 fn rename_moves_a_file_between_directories() {
-    let image = image("rename");
+    let image = image();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
         fs.create_dir("from", stamp()).expect("mkdir");
@@ -325,18 +328,17 @@ fn rename_moves_a_file_between_directories() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        assert!(!mount.join("from/Original Long Name.txt").exists());
-        assert_eq!(fs::read(mount.join("to/Renamed Long Name.txt")).expect("read"), b"payload");
-        assert_eq!(fs::read_dir(mount.join("from")).expect("read_dir").count(), 0);
-    });
+    let tree = host_tree(&image);
+    assert_eq!(tree["to/Renamed Long Name.txt"], b"payload");
+    assert!(tree.contains_key("from/"));
+    assert!(!tree.keys().any(|k| k.starts_with("from/") && k != "from/"), "{:?}", tree.keys());
 }
 
 /// A moved directory's `..` must point at its new parent. The checker is what
 /// notices; a mount reads the path it walked down and never asks.
 #[test]
 fn rename_repoints_a_moved_directorys_parent() {
-    let image = image("mvdir");
+    let image = image();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
         fs.create_dir_all("a/movable", stamp()).expect("mkdir");
@@ -346,14 +348,12 @@ fn rename_repoints_a_moved_directorys_parent() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        assert_eq!(fs::read(mount.join("b/moved/file.txt")).expect("read"), b"inside");
-    });
+    assert_eq!(host_tree(&image)["b/moved/file.txt"], b"inside");
 }
 
 #[test]
 fn truncation_releases_clusters_and_the_host_agrees() {
-    let image = image("trunc");
+    let image = image();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
         write_new(&mut fs, "shrink.bin", &pattern(100_000, 51), stamp());
@@ -372,19 +372,17 @@ fn truncation_releases_clusters_and_the_host_agrees() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        let got = fs::read(mount.join("shrink.bin")).expect("read");
-        assert_eq!(got.len(), 5000);
-        assert_eq!(&got[..1000], &pattern(100_000, 51)[..1000]);
-        assert!(got[1000..].iter().all(|&b| b == 0), "grow did not zero-fill");
-    });
+    let got = &host_tree(&image)["shrink.bin"];
+    assert_eq!(got.len(), 5000);
+    assert_eq!(&got[..1000], &pattern(100_000, 51)[..1000]);
+    assert!(got[1000..].iter().all(|&b| b == 0), "grow did not zero-fill");
 }
 
 /// A write starting past the end of a file must zero the gap, not expose the
 /// previous owner of the clusters it allocated.
 #[test]
 fn sparse_writes_zero_the_gap() {
-    let image = image("sparse");
+    let image = image();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
         // Dirty a region first, then free it, so the clusters the sparse write
@@ -399,18 +397,16 @@ fn sparse_writes_zero_the_gap() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        let got = fs::read(mount.join("holes.bin")).expect("read");
-        assert_eq!(got.len(), 50_004);
-        assert_eq!(&got[..4], b"head");
-        assert_eq!(&got[50_000..], b"tail");
-        assert!(got[4..50_000].iter().all(|&b| b == 0), "gap not zeroed");
-    });
+    let got = &host_tree(&image)["holes.bin"];
+    assert_eq!(got.len(), 50_004);
+    assert_eq!(&got[..4], b"head");
+    assert_eq!(&got[50_000..], b"tail");
+    assert!(got[4..50_000].iter().all(|&b| b == 0), "gap not zeroed");
 }
 
 #[test]
 fn empty_directories_are_removable_and_full_ones_are_not() {
-    let image = image("rmdir");
+    let image = image();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
         fs.create_dir("keep", stamp()).expect("mkdir");
@@ -423,17 +419,16 @@ fn empty_directories_are_removable_and_full_ones_are_not() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        assert!(!mount.join("gone").exists());
-        assert!(mount.join("keep/file.txt").exists());
-    });
+    let tree = host_tree(&image);
+    assert!(!tree.contains_key("gone/") && !tree.contains_key("gone"));
+    assert!(tree.contains_key("keep/file.txt"));
 }
 
 /// Round trip through both readers: the host's, and this crate's own on a
 /// volume this crate wrote.
 #[test]
 fn our_own_reader_agrees_with_the_host_on_our_own_volume() {
-    let image = image("roundtrip");
+    let image = image();
     let files: Vec<(&str, Vec<u8>)> = vec![
         ("SHORT.BIN", pattern(300, 71)),
         ("a long one.bin", pattern(9_000, 72)),
@@ -457,7 +452,7 @@ fn our_own_reader_agrees_with_the_host_on_our_own_volume() {
         assert_eq!(&read_all(&mut fs, n), d, "{n}");
     }
 
-    let tree = image.with_mount(host_tree);
+    let tree = host_tree(&image);
     for (n, d) in &files {
         assert_eq!(tree.get(*n).unwrap_or_else(|| panic!("{n} missing")), d);
     }
@@ -467,7 +462,7 @@ fn our_own_reader_agrees_with_the_host_on_our_own_volume() {
 /// did not know that would leave two entries the host cannot tell apart.
 #[test]
 fn creating_an_existing_name_in_another_case_is_refused() {
-    let image = image("case");
+    let image = image();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
         write_new(&mut fs, "Report.TXT", b"first", stamp());
@@ -476,15 +471,13 @@ fn creating_an_existing_name_in_another_case_is_refused() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        assert_eq!(fs::read_dir(mount).expect("read_dir").count(), 1);
-    });
+    assert_eq!(host_tree(&image).keys().collect::<Vec<_>>(), ["Report.TXT"]);
 }
 
 /// A 4 KiB cluster volume: the same code with different arithmetic.
 #[test]
 fn four_kib_clusters_write_correctly() {
-    let image = Image::new("write4k", 300 * 1024 * 1024, 8);
+    let image = Image::fixture("blank-4k");
     let big = pattern(300_000, 81);
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
@@ -496,18 +489,17 @@ fn four_kib_clusters_write_correctly() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        assert_eq!(fs::read(mount.join("x/y/z/Big File.bin")).expect("read"), big);
-        assert_eq!(fs::read(mount.join("edge4095.bin")).expect("read"), pattern(4095, 82));
-        assert_eq!(fs::read(mount.join("edge4097.bin")).expect("read"), pattern(4097, 83));
-    });
+    let tree = host_tree(&image);
+    assert_eq!(tree["x/y/z/Big File.bin"], big);
+    assert_eq!(tree["edge4095.bin"], pattern(4095, 82));
+    assert_eq!(tree["edge4097.bin"], pattern(4097, 83));
 }
 
 /// The use this crate exists for: append a log line at a time and have the
 /// result readable on another machine.
 #[test]
 fn a_log_file_written_a_line_at_a_time() {
-    let image = image("log");
+    let image = image();
     let lines: Vec<String> = (0..500).map(|i| format!("[{i:04}] a line of kernel log output\n")).collect();
     {
         let mut fs = Fat32::mount(image.device()).expect("mount");
@@ -524,16 +516,13 @@ fn a_log_file_written_a_line_at_a_time() {
         fs.sync().expect("sync");
     }
     image.fsck();
-    image.with_mount(|mount| {
-        let got = fs::read_to_string(mount.join("TOYOS/boot.log")).expect("read");
-        assert_eq!(got, lines.concat());
-    });
+    assert_eq!(host_tree(&image)["TOYOS/boot.log"], lines.concat().into_bytes());
 }
 
 /// `same_entry` answers by entry location, so a case-only name is the same entry.
 #[test]
 fn same_entry_is_case_insensitive_identity() {
-    let image = image("identity");
+    let image = image();
     let mut fs = Fat32::mount(image.device()).expect("mount");
     fs.create("Report.TXT", stamp()).expect("create");
     fs.create("Other.bin", stamp()).expect("create");
@@ -556,13 +545,6 @@ fn complaints(image: &Image) -> Vec<String> {
     toyos_fat32_check::check(&bytes).iter().map(|c| format!("{c}")).collect()
 }
 
-/// One 512-byte cluster per sector, which is what the T14's log partition has
-/// and what makes "the chain holds three more clusters than the size needs" a
-/// three-cluster append rather than a 12 KiB one.
-fn small_cluster_image(name: &str) -> Image {
-    Image::new(name, 64 * 1024 * 1024, 1)
-}
-
 /// **The shape the bench's own stick came back with**: `DIR_FileSize` needing
 /// N clusters and the chain holding N+3, because the flush that would have
 /// recorded them did not run.
@@ -573,7 +555,7 @@ fn small_cluster_image(name: &str) -> Image {
 /// second is [`Fat32::reconcile`] closing it.
 #[test]
 fn a_chain_that_outran_its_entry_is_reconciled() {
-    let image = small_cluster_image("reconcile-size");
+    let image = image();
     let mut fs = Fat32::mount(image.device()).expect("mount");
     let mut f = fs.create("BOOT.LOG", stamp()).expect("create");
 
@@ -601,12 +583,10 @@ fn a_chain_that_outran_its_entry_is_reconciled() {
     assert!(!f.needs_reconcile());
     drop(fs);
     image.fsck();
-    image.with_mount(|mount| {
-        let got = fs::read(mount.join("BOOT.LOG")).expect("read");
-        assert_eq!(got.len(), recorded.len() + more.len());
-        assert_eq!(&got[..recorded.len()], &recorded[..]);
-        assert_eq!(&got[recorded.len()..], &more[..]);
-    });
+    let got = &host_tree(&image)["BOOT.LOG"];
+    assert_eq!(got.len(), recorded.len() + more.len());
+    assert_eq!(&got[..recorded.len()], &recorded[..]);
+    assert_eq!(&got[recorded.len()..], &more[..]);
 }
 
 /// The same window's other end, and the shape the device boot left: a file
@@ -614,7 +594,7 @@ fn a_chain_that_outran_its_entry_is_reconciled() {
 /// cluster.
 #[test]
 fn a_chain_no_entry_reaches_is_reconciled() {
-    let image = small_cluster_image("reconcile-orphan");
+    let image = image();
     let mut fs = Fat32::mount(image.device()).expect("mount");
     let mut f = fs.create("STICK.BIN", stamp()).expect("create");
 
@@ -631,7 +611,5 @@ fn a_chain_no_entry_reaches_is_reconciled() {
     fs.sync().expect("sync");
     drop(fs);
     image.fsck();
-    image.with_mount(|mount| {
-        assert_eq!(fs::read(mount.join("STICK.BIN")).expect("read"), data);
-    });
+    assert_eq!(host_tree(&image)["STICK.BIN"], data);
 }
diff --git a/toyos-fat32/tests/hostile.rs b/toyos-fat32/tests/hostile.rs
index ae681255239..11de355a738 100644
--- a/toyos-fat32/tests/hostile.rs
+++ b/toyos-fat32/tests/hostile.rs
@@ -39,14 +39,7 @@ const PREFIX_BYTES: usize = 3072 * 512;
 fn corpus() -> &'static (Vec<u8>, u64) {
     static ONCE: OnceLock<(Vec<u8>, u64)> = OnceLock::new();
     ONCE.get_or_init(|| {
-        let image = Image::new("hostile", 64 * 1024 * 1024, 1);
-        image.with_mount(|mount| {
-            std::fs::create_dir_all(mount.join("sub/deeper")).expect("mkdir");
-            std::fs::write(mount.join("plain.txt"), b"a short file").expect("write");
-            std::fs::write(mount.join("A Long Name For Entries.bin"), pattern(20_000, 5)).expect("write");
-            std::fs::write(mount.join("sub/inner.dat"), pattern(4000, 6)).expect("write");
-            std::fs::write(mount.join("sub/deeper/leaf.txt"), b"leaf").expect("write");
-        });
+        let image = Image::fixture("hostile");
         image.fsck();
         (image.bytes(PREFIX_BYTES), image.size())
     })
@@ -507,11 +500,7 @@ fn the_caller_limit_is_the_named_directorys_and_not_the_volumes() {
 /// with a kernel line calling a healthy volume corrupt.
 #[test]
 fn an_empty_file_is_not_a_corrupt_directory() {
-    let image = Image::new("empty-file", 64 * 1024 * 1024, 1);
-    image.with_mount(|mount| {
-        std::fs::write(mount.join("empty.txt"), b"").expect("write");
-        std::fs::write(mount.join("full.txt"), b"twelve bytes").expect("write");
-    });
+    let image = Image::fixture("empty-file");
     image.fsck();
     let mut fs = Fat32::mount(SparseDevice::from_prefix(&image.bytes(PREFIX_BYTES), image.size()))
         .expect("mount");
diff --git a/toyos-libc-copies/Cargo.toml b/toyos-libc-copies/Cargo.toml
index 55b2b580851..0487c33e712 100644
--- a/toyos-libc-copies/Cargo.toml
+++ b/toyos-libc-copies/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "toyos-libc-copies"
-description = "A host differential test of userland libc's self-contained modules: its copies, fills and square roots against core's, its UTF-8 reader against core's, and its number reader and long double widening against the host C library and compiler-builtins."
+description = "A host differential test of userland libc's self-contained modules: its copies, fills and square roots against core's, its UTF-8 reader against core's, its number reader against the host C library and exact IEEE 754 rounding, and its long double widening against compiler-builtins."
 version = "0.1.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
diff --git a/toyos-libc-copies/src/exact_hex.rs b/toyos-libc-copies/src/exact_hex.rs
new file mode 100644
index 00000000000..7129e0c4c1c
--- /dev/null
+++ b/toyos-libc-copies/src/exact_hex.rs
@@ -0,0 +1,155 @@
+//! The value a hexadecimal floating-point number denotes, rounded to an IEEE
+//! 754 binary format by IEEE 754's rule: to nearest, ties to even, with
+//! subnormals. Every digit is four bits and the one rounding sees all of them,
+//! so this judges what `strtod` and `strtof` must answer for hexadecimal input.
+
+/// An IEEE 754 binary interchange format: `k` bits of storage, `p` of precision.
+#[derive(Clone, Copy)]
+pub(crate) struct Format {
+    k: u32,
+    p: u32,
+}
+
+pub(crate) const BINARY32: Format = Format { k: 32, p: 24 };
+pub(crate) const BINARY64: Format = Format { k: 64, p: 53 };
+
+/// The bits of `number` rounded to `format`. `number` is a sign, `0x` and
+/// hexadecimal digits around at most one point, then optionally `p` and a
+/// signed decimal exponent.
+pub(crate) fn round(number: &str, format: Format) -> u64 {
+    let Format { k, p } = format;
+    let emax = (1i128 << (k - p - 1)) - 1;
+    let emin = 1 - emax;
+    let (negative, unsigned) = match number.strip_prefix('-') {
+        Some(rest) => (true, rest),
+        None => (false, number.strip_prefix('+').unwrap_or(number)),
+    };
+    let unsigned = unsigned.strip_prefix("0x").or_else(|| unsigned.strip_prefix("0X")).expect("a 0x prefix");
+    let (digits, exponent) = unsigned.split_once(['p', 'P']).unwrap_or((unsigned, "0"));
+    let (whole, fraction) = digits.split_once('.').unwrap_or((digits, ""));
+    // The number is the integer `bits` times 2^scale.
+    let bits: Vec<bool> = whole
+        .chars()
+        .chain(fraction.chars())
+        .map(|c| c.to_digit(16).expect("a hexadecimal digit"))
+        .flat_map(|d| (0..4).rev().map(move |i| d >> i & 1 == 1))
+        .collect();
+    let scale = exponent.parse::<i128>().expect("a decimal exponent") - 4 * fraction.len() as i128;
+    let sign = u64::from(negative) << (k - 1);
+    let Some(first) = bits.iter().position(|&b| b) else { return sign };
+    let bits = &bits[first..];
+    // `bits[i]` weighs 2^(top - i). The last bit kept weighs 2^quantum: `p`
+    // bits down from the leading one, but never below the least subnormal.
+    let top = scale + (bits.len() - 1) as i128;
+    let quantum = (top - i128::from(p - 1)).max(emin - i128::from(p - 1));
+    let kept = top - quantum + 1;
+    let bit = |i: i128| usize::try_from(i).ok().and_then(|i| bits.get(i)).is_some_and(|&b| b);
+    let mut significand = (0..kept).fold(0u64, |s, i| s << 1 | u64::from(bit(i)));
+    let half = bit(kept);
+    let sticky = bits.iter().enumerate().any(|(i, &b)| b && i as i128 > kept);
+    if half && (sticky || significand & 1 == 1) {
+        significand += 1;
+    }
+    // A carry out of the top makes one more bit of the same value.
+    let (significand, quantum) =
+        if significand >> p == 1 { (significand >> 1, quantum + 1) } else { (significand, quantum) };
+    // The leading bit's weight is 2^(quantum + t), biased by `emax`.
+    let t = p - 1;
+    let magnitude = if significand >> t == 0 {
+        // Subnormal or zero: the quantum is the least, the biased exponent 0.
+        significand
+    } else if quantum + i128::from(t) > emax {
+        // Infinity: every exponent bit set, the fraction clear.
+        ((2 * emax + 1) as u64) << t
+    } else {
+        ((quantum + i128::from(t) + emax) as u64) << t | significand & ((1 << t) - 1)
+    };
+    sign | magnitude
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{round, BINARY32, BINARY64};
+    use crate::strtonum_differential::Rng;
+
+    /// IEEE 754's corners of both formats, and its ties, each with its bits.
+    #[test]
+    fn the_formats_corners_and_ties_round_to_their_bits() {
+        for (number, bits) in [
+            ("0x1p0", 1f64.to_bits()),
+            ("-0x0p0", (-0f64).to_bits()),
+            ("0x1p-52", f64::EPSILON.to_bits()),
+            ("0x1.fffffffffffffp1023", f64::MAX.to_bits()),
+            ("0x1p-1022", f64::MIN_POSITIVE.to_bits()),
+            ("0x1p-1074", 1),
+            ("0x1.00000000000008p0", 0x3ff0_0000_0000_0000),
+            ("0x1.00000000000018p0", 0x3ff0_0000_0000_0002),
+            ("0x1.000000000000080000000001p0", 0x3ff0_0000_0000_0001),
+            ("0x1.fffffffffffff7ffp1023", f64::MAX.to_bits()),
+            ("0x1.fffffffffffff8p1023", f64::INFINITY.to_bits()),
+            ("-0x1p1024", f64::NEG_INFINITY.to_bits()),
+            ("0x1p-1075", 0),
+            ("0x1.8p-1074", 2),
+            ("0x0.fffffffffffff8p-1022", f64::MIN_POSITIVE.to_bits()),
+            // A subnormal that rounding twice gets wrong.
+            ("0X1.c63b83507cf448000P-1025", 0x0003_8c77_06a0_f9e9),
+            ("0x1p-99999999999999999999", 0),
+        ] {
+            assert_eq!(round(number, BINARY64), bits, "{number}");
+        }
+        for (number, bits) in [
+            ("0x1p0", 1f32.to_bits()),
+            ("0x1.fffffep127", f32::MAX.to_bits()),
+            ("0x1.ffffffp127", f32::INFINITY.to_bits()),
+            ("0x1p-126", f32::MIN_POSITIVE.to_bits()),
+            ("0x1p-149", 1),
+            ("0x1p-150", 0),
+            ("0x1.000001p0", 0x3f80_0000),
+            ("0x1.000003p0", 0x3f80_0002),
+        ] {
+            assert_eq!(round(number, BINARY32), u64::from(bits), "{number}");
+        }
+    }
+
+    fn pow2_f64(e: i32) -> f64 {
+        f64::from_bits(((e + 1023) as u64) << 52)
+    }
+
+    fn pow2_f32(e: i32) -> f32 {
+        f32::from_bits(((e + 127) as u32) << 23)
+    }
+
+    /// The machine as a second judge, where it rounds exactly once: an integer
+    /// cast to a float is rounded to nearest, ties to even, and so is a product,
+    /// which is exact while it stays normal. Each number is kept bits, then
+    /// `dropped` bits holding a tie, a tie with a bit below it, or anything,
+    /// lined up so that the rounding falls between the two.
+    #[test]
+    fn it_rounds_as_the_machine_does() {
+        let mut rng = Rng(0x6a09_e667_f3bc_c908);
+        let mut random = |bits: u32| u128::from(rng.next()) & ((1 << bits) - 1);
+        for _ in 0..100_000 {
+            let dropped = 1 + (random(64) % 52) as u32;
+            let half = 1u128 << (dropped - 1);
+            let tail = [half, half | 1, random(dropped)][random(64) as usize % 3];
+            // Normal: as many kept bits as the format holds, rounded by the cast,
+            // then scaled no further than the format reaches.
+            let m = (random(52) | 1 << 52) << dropped | tail;
+            let e = (random(64) % 1800) as i32 - 900;
+            assert_eq!(round(&format!("{m:#x}p{e}"), BINARY64), (m as f64 * pow2_f64(e)).to_bits(), "{m:#x}p{e}");
+            let m = (random(23) | 1 << 23) << dropped | tail;
+            let e = (random(64) % 100) as i32 - 50;
+            assert_eq!(round(&format!("{m:#x}p{e}"), BINARY32), u64::from((m as f32 * pow2_f32(e)).to_bits()), "{m:#x}p{e}");
+            // Subnormal: fewer kept bits, so the cast is exact and the product
+            // rounds, at the least subnormal.
+            let m = random((53 - dropped).min(52)) << dropped | tail;
+            let e = -1074 - dropped as i32;
+            let machine = m as f64 * pow2_f64(-1000) * pow2_f64(e + 1000);
+            assert_eq!(round(&format!("{m:#x}p{e}"), BINARY64), machine.to_bits(), "{m:#x}p{e}");
+            let m = random((53 - dropped).min(23)) << dropped | tail;
+            let e = -149 - dropped as i32;
+            let machine = (m as f64 * pow2_f64(e)) as f32;
+            assert_eq!(round(&format!("{m:#x}p{e}"), BINARY32), u64::from(machine.to_bits()), "{m:#x}p{e}");
+        }
+    }
+}
diff --git a/toyos-libc-copies/src/lib.rs b/toyos-libc-copies/src/lib.rs
index 386cee5b3e0..543eef1b2cb 100644
--- a/toyos-libc-copies/src/lib.rs
+++ b/toyos-libc-copies/src/lib.rs
@@ -4,9 +4,10 @@
 //! against `copy_within` and `fill`, with the two buffers overlapping both ways;
 //! and its square roots against `f64::sqrt` and `f32::sqrt`. Each host
 //! architecture checks its own module. The UTF-8 reader against
-//! `core::str::from_utf8`, the number reader against the host C library's,
-//! AArch64's `long double` widening against compiler-builtins', and the errno
-//! codes against `include/errno.h`.
+//! `core::str::from_utf8`, the number reader against the host C library's and
+//! IEEE 754's rounding of hexadecimal input computed exactly, AArch64's
+//! `long double` widening against compiler-builtins', and the errno codes
+//! against `include/errno.h`.
 
 #[cfg(test)]
 extern crate alloc;
@@ -23,6 +24,8 @@ mod utf8;
 
 #[cfg(test)]
 mod errno_codes;
+#[cfg(test)]
+mod exact_hex;
 #[cfg(all(test, target_arch = "aarch64"))]
 mod long_double;
 #[cfg(test)]
diff --git a/toyos-libc-copies/src/strtonum_differential.rs b/toyos-libc-copies/src/strtonum_differential.rs
index b817416c901..36657ff9e29 100644
--- a/toyos-libc-copies/src/strtonum_differential.rs
+++ b/toyos-libc-copies/src/strtonum_differential.rs
@@ -1,10 +1,12 @@
 //! libc's number reader against the host C library's `strtod`, `strtof`,
-//! `strtol` and `strtoul`: the value, bit for bit, where it ends, and the
+//! `strtol` and `strtoul`: where it ends, the value, bit for bit, and the
 //! `ERANGE` and `EINVAL` C requires, over a corpus of the grammar's corners and
 //! seeded random numbers, hexadecimal ones with a rounding tie in half of them.
+//! A hexadecimal number's value is held to [`exact_hex`] instead of the host's.
 
 use std::ffi::{c_int, CString};
 
+use crate::exact_hex::{self, BINARY32, BINARY64};
 use crate::strtonum::{self, Read, Refusal};
 
 unsafe extern "C" {
@@ -22,8 +24,11 @@ const ERANGE: c_int = 34;
 const EINVAL: c_int = 22;
 
 /// What the host's reader answers for `s`: the value, where it ends, `errno`.
+///
+/// `end` starts at `s`, which is where C says a reading that converts nothing
+/// ends: glibc leaves it unwritten for a base C does not define.
 fn host<T>(s: &CString, read: impl Fn(*const u8, *mut *mut u8) -> T) -> (T, usize, c_int) {
-    let mut end = std::ptr::null_mut();
+    let mut end = s.as_ptr().cast::<u8>().cast_mut();
     // SAFETY: the host's errno slot is this thread's.
     unsafe { *errno_location() = 0 };
     let value = read(s.as_ptr().cast(), &mut end);
@@ -61,24 +66,35 @@ fn ours<F: strtonum::Float + Copy + Into<f64>>(s: &CString) -> Read<F> {
     narrow
 }
 
-/// `s` read as a `double` and a `float`, against the host. `ERANGE` is held
-/// against the host's only for an overflow: C leaves an underflow's to each
+/// The number a reading took, `taken`, without its leading space, if it is
+/// hexadecimal.
+fn hexadecimal(taken: &str) -> Option<&str> {
+    let number = taken.trim_start_matches([' ', '\t', '\n', '\x0b', '\x0c', '\r']);
+    let unsigned = number.strip_prefix(['+', '-']).unwrap_or(number);
+    (unsigned.starts_with("0x") || unsigned.starts_with("0X")).then_some(number)
+}
+
+/// `s` read as a `double` and a `float`: where it ends against the host, and
+/// the value against the host's or, for a hexadecimal number, [`exact_hex`]'s.
+/// `ERANGE` is held only for an overflow: C leaves an underflow's to each
 /// library.
 fn judge_float(s: &str) {
     let c = CString::new(s).unwrap();
     // SAFETY: `c` is NUL-terminated.
-    let (value, end, errno) = host(&c, |s, e| unsafe { strtod(s, e) });
+    let (value, end, _) = host(&c, |s, e| unsafe { strtod(s, e) });
     let read = ours::<f64>(&c);
-    assert!(same(read.value, value), "{s:?}: {:e} ({:#x}), the host's {value:e} ({:#x})", read.value, read.value.to_bits(), value.to_bits());
     assert_eq!(read.end, end, "{s:?}: where it ends");
-    if value.is_infinite() && !s.to_ascii_lowercase().contains("inf") {
-        assert_eq!((errno_of(&read.refused), errno), (ERANGE, ERANGE), "{s:?}: an overflow");
+    let want = hexadecimal(&s[..end]).map_or(value, |n| f64::from_bits(exact_hex::round(n, BINARY64)));
+    assert!(same(read.value, want), "{s:?}: {:e} ({:#x}), the judge's {want:e} ({:#x})", read.value, read.value.to_bits(), want.to_bits());
+    if want.is_infinite() && !s.to_ascii_lowercase().contains("inf") {
+        assert_eq!(errno_of(&read.refused), ERANGE, "{s:?}: an overflow");
     }
     // SAFETY: as above.
     let (value, end, _) = host(&c, |s, e| unsafe { strtof(s, e) });
     let read = ours::<f32>(&c);
-    assert!(same(read.value.into(), value.into()), "{s:?}: float {:e}, the host's {value:e}", read.value);
     assert_eq!(read.end, end, "{s:?}: where the float ends");
+    let want = hexadecimal(&s[..end]).map_or(value, |n| f32::from_bits(exact_hex::round(n, BINARY32).try_into().unwrap()));
+    assert!(same(read.value.into(), want.into()), "{s:?}: float {:e}, the judge's {want:e}", read.value);
 }
 
 /// `s` read as `long` and `unsigned long` in `base`, against the host. Where a
@@ -100,10 +116,10 @@ fn judge_int(s: &str, base: i32) {
 }
 
 /// A seeded xorshift, so a red names the case that reproduces it.
-struct Rng(u64);
+pub(crate) struct Rng(pub(crate) u64);
 
 impl Rng {
-    fn next(&mut self) -> u64 {
+    pub(crate) fn next(&mut self) -> u64 {
         self.0 ^= self.0 << 13;
         self.0 ^= self.0 >> 7;
         self.0 ^= self.0 << 17;
@@ -120,7 +136,7 @@ impl Rng {
 }
 
 #[test]
-fn the_grammar_s_corners_agree_with_the_host() {
+fn the_grammar_s_corners_read_as_judged() {
     for s in [
         "", " ", "+", "-", ".", "e5", "0x", "0X", "0x.", "0x.p1", "0xp1", "0x1p", "0x1p+", "0x1p-x", "1e", "1e+",
         "1e-x", ".5", "5.", "-.5e-3", " \t\n\x0b\x0c\r+1.5", "1.5xyz", "inf", "-INFINITY", "infinit", "infx", "nan",
@@ -128,7 +144,7 @@ fn the_grammar_s_corners_agree_with_the_host() {
         "-0x0p0", "0.000", "-0", "1e309", "-1e309", "1e-400", "4.9e-324", "2.4703282292062328e-324",
         "2.4703282292062327e-324", "1.7976931348623157e308", "1.7976931348623158e308", "1.7976931348623159e308",
         "0x1.fffffffffffffp1023", "0x1.fffffffffffff7p1023", "0x1.fffffffffffff8p1023", "0x1p1024", "0x1p-1074",
-        "0x1p-1075", "0x1.0000000000001p-1075", "0x1.8p-1075", "0x1p-1076", "0x0.0000000000001p-1022",
+        "0x1p-1075", "0x1.0000000000001p-1075", "0x1.8p-1075", "0x1p-1076", "0x0.0000000000001p-1022", "0X1.c63b83507cf448000P-1025",
         "0x0.00000000000008p-1022", "0x0.00000000000018p-1022", "0x1.00000000000008p0", "0x1.00000000000018p0",
         "0x1.000000000000080000000000000000001p0", "0x1.0000000000000800000p0", "0x10000000000000080p0",
         "0x10000000000000180p-4", "0x.000000000000000000000000000000000000000001p200", "0x1p-99999999999999999999",
@@ -153,7 +169,7 @@ fn the_grammar_s_corners_agree_with_the_host() {
 /// ranges and past them, and in half of them a `double`'s 53 bits followed by
 /// exactly half a unit, or half and a sticky bit, the ties to even.
 #[test]
-fn random_hexadecimal_numbers_round_as_the_host_s() {
+fn random_hexadecimal_numbers_round_as_ieee_754_rounds_them() {
     let mut rng = Rng(0x9e37_79b9_7f4a_7c15);
     for _ in 0..200_000 {
         let mut s = String::new();
diff --git a/userland/Cargo.lock b/userland/Cargo.lock
index 5489d455e17..b2cf8e7820d 100644
--- a/userland/Cargo.lock
+++ b/userland/Cargo.lock
@@ -78,6 +78,19 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -367,6 +380,18 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
+[[package]]
+name = "calloop-wayland-source"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95a66a987056935f7efce4ab5668920b5d0dac4a7c99991a67395f13702ddd20"
+dependencies = [
+ "calloop",
+ "rustix 0.38.44",
+ "wayland-backend",
+ "wayland-client",
+]
+
 [[package]]
 name = "cbc"
 version = "0.1.2"
@@ -968,6 +993,12 @@ dependencies = [
  "winit",
 ]
 
+[[package]]
+name = "downcast-rs"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
+
 [[package]]
 name = "dpi"
 version = "0.1.1"
@@ -1142,6 +1173,12 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
 [[package]]
 name = "fdeflate"
 version = "0.3.7"
@@ -1963,6 +2000,15 @@ version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
+[[package]]
+name = "memmap2"
+version = "0.9.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "metalprobe"
 version = "0.1.0"
@@ -2951,6 +2997,15 @@ dependencies = [
 name = "proctest"
 version = "0.1.0"
 
+[[package]]
+name = "quick-xml"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.45"
@@ -3443,6 +3498,12 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
 [[package]]
 name = "scrypt"
 version = "0.12.0-rc.10"
@@ -3678,6 +3739,31 @@ version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
+[[package]]
+name = "smithay-client-toolkit"
+version = "0.19.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3457dea1f0eb631b4034d61d4d8c32074caa6cd1ab2d59f2327bd8461e2c0016"
+dependencies = [
+ "bitflags 2.11.0",
+ "calloop",
+ "calloop-wayland-source",
+ "cursor-icon",
+ "libc",
+ "log",
+ "memmap2",
+ "rustix 0.38.44",
+ "thiserror 1.0.69",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-csd-frame",
+ "wayland-cursor",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+ "wayland-scanner",
+ "xkeysym",
+]
+
 [[package]]
 name = "smol_str"
 version = "0.2.2"
@@ -3729,7 +3815,9 @@ version = "0.4.8"
 source = "git+https://github.com/ToyOSOrg/softbuffer?branch=toyos-0.4.8#b36854df3cb4e589c124e9ecfa492b4e5b331c05"
 dependencies = [
  "bytemuck",
+ "fastrand",
  "js-sys",
+ "memmap2",
  "ndk",
  "objc2 0.6.4",
  "objc2-core-foundation",
@@ -3738,9 +3826,13 @@ dependencies = [
  "objc2-quartz-core 0.3.2",
  "raw-window-handle",
  "redox_syscall 0.5.18",
+ "rustix 1.1.4",
  "toyos-window",
  "tracing",
  "wasm-bindgen",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-sys",
  "web-sys",
  "windows-sys 0.61.2",
 ]
@@ -4489,6 +4581,115 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "wayland-backend"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38a91b4eaddff87b1cd1074985e3713da4af2c49742d1b356b2c01670a67a078"
+dependencies = [
+ "cc",
+ "downcast-rs",
+ "rustix 1.1.4",
+ "scoped-tls",
+ "smallvec",
+ "wayland-sys",
+]
+
+[[package]]
+name = "wayland-client"
+version = "0.31.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c36a0f861ad76d0901f2800b46321410d9f73f2ea88aac0650d86c32688073"
+dependencies = [
+ "bitflags 2.11.0",
+ "rustix 1.1.4",
+ "wayland-backend",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-csd-frame"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625c5029dbd43d25e6aa9615e88b829a5cad13b2819c4ae129fdbb7c31ab4c7e"
+dependencies = [
+ "bitflags 2.11.0",
+ "cursor-icon",
+ "wayland-backend",
+]
+
+[[package]]
+name = "wayland-cursor"
+version = "0.31.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a52d18780be9b1314328a3de5f930b73d2200112e3849ca6cb11822793fb34d"
+dependencies = [
+ "rustix 1.1.4",
+ "wayland-client",
+ "xcursor",
+]
+
+[[package]]
+name = "wayland-protocols"
+version = "0.32.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23d0c813de3daa2ed6520af85a3bd49b0e722a3078506899aa9686fea58dc4b6"
+dependencies = [
+ "bitflags 2.11.0",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-plasma"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b6d8cf1eb2c1c31ed1f5643c88a6e53538129d4af80030c8cabd1f9fa884d91"
+dependencies = [
+ "bitflags 2.11.0",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-wlr"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb04e52f7836d7c7976c78ca0250d61e33873c34156a2a1fc9474828ec268234"
+dependencies = [
+ "bitflags 2.11.0",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-scanner"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
+dependencies = [
+ "proc-macro2",
+ "quick-xml",
+ "quote",
+]
+
+[[package]]
+name = "wayland-sys"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8eab23fefc9e41f8e841df4a9c707e8a8c4ed26e944ef69297184de2785e3be"
+dependencies = [
+ "dlib",
+ "log",
+ "once_cell",
+ "pkg-config",
+]
+
 [[package]]
 name = "web-sys"
 version = "0.3.91"
@@ -4799,6 +5000,7 @@ name = "winit"
 version = "0.30.13"
 source = "git+https://github.com/ToyOSOrg/winit?branch=toyos-0.30.13#f58e1f3bca784d97056fe47475c2dca8c6386816"
 dependencies = [
+ "ahash",
  "android-activity",
  "atomic-waker",
  "bitflags 2.11.0",
@@ -4812,6 +5014,7 @@ dependencies = [
  "dpi",
  "js-sys",
  "libc",
+ "memmap2",
  "ndk",
  "objc2 0.5.2",
  "objc2-app-kit",
@@ -4822,12 +5025,17 @@ dependencies = [
  "raw-window-handle",
  "redox_syscall 0.4.1",
  "rustix 0.38.44",
+ "smithay-client-toolkit",
  "smol_str",
  "toyos-window",
  "tracing",
  "unicode-segmentation",
  "wasm-bindgen",
  "wasm-bindgen-futures",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-plasma",
  "web-sys",
  "web-time",
  "windows-sys 0.52.0",
@@ -4952,6 +5160,12 @@ dependencies = [
  "rustix 1.1.4",
 ]
 
+[[package]]
+name = "xcursor"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "163b33ed8786455e2fa5d72f554057ce3f3182425434f756cd39c99839d88e23"
+
 [[package]]
 name = "xkbcommon-dl"
 version = "0.4.2"
diff --git a/userland/calc/Cargo.toml b/userland/calc/Cargo.toml
index 9e7da0bc254..b58ee1d6d0d 100644
--- a/userland/calc/Cargo.toml
+++ b/userland/calc/Cargo.toml
@@ -16,5 +16,9 @@ toyos-font = { path = "../toyos-font" }
 winit = { version = "0.30", default-features = false, features = ["rwh_06"] }
 softbuffer = { version = "0.4", default-features = false }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+winit = { version = "0.30", default-features = false, features = ["wayland", "wayland-dlopen"] }
+softbuffer = { version = "0.4", default-features = false, features = ["wayland", "wayland-dlopen"] }
+
 [build-dependencies]
 fontdue = "0.9"
diff --git a/userland/doom/Cargo.toml b/userland/doom/Cargo.toml
index c77c4b8f1ff..feca4d69569 100644
--- a/userland/doom/Cargo.toml
+++ b/userland/doom/Cargo.toml
@@ -11,6 +11,10 @@ winit = { version = "0.30", default-features = false, features = ["rwh_06"] }
 softbuffer = { version = "0.4", default-features = false }
 rustysynth = "1.3"
 
+[target.'cfg(target_os = "linux")'.dependencies]
+winit = { version = "0.30", default-features = false, features = ["wayland", "wayland-dlopen"] }
+softbuffer = { version = "0.4", default-features = false, features = ["wayland", "wayland-dlopen"] }
+
 [build-dependencies]
 cc = "1.1"
 ureq = { version = "3", default-features = false, features = ["rustls-no-provider", "rustls-webpki-roots"] }
diff --git a/userland/snake/Cargo.toml b/userland/snake/Cargo.toml
index 8bf22b4076c..a4fc958ba2e 100644
--- a/userland/snake/Cargo.toml
+++ b/userland/snake/Cargo.toml
@@ -10,5 +10,9 @@ toyos-font = { path = "../toyos-font" }
 winit = { version = "0.30", default-features = false, features = ["rwh_06"] }
 softbuffer = { version = "0.4", default-features = false }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+winit = { version = "0.30", default-features = false, features = ["wayland", "wayland-dlopen"] }
+softbuffer = { version = "0.4", default-features = false, features = ["wayland", "wayland-dlopen"] }
+
 [build-dependencies]
 fontdue = "0.9"