diff --git a/Cargo.lock b/Cargo.lock
index 13c286c2b33..e07e5c65ebe 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1090,7 +1090,7 @@ checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "rustc-std-workspace-core",
 ]
diff --git a/bootloader/Cargo.lock b/bootloader/Cargo.lock
index 35ed32ef024..928fd536ebf 100644
--- a/bootloader/Cargo.lock
+++ b/bootloader/Cargo.lock
@@ -110,7 +110,7 @@ dependencies = [
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-acpi"
diff --git a/console/system.toml b/console/system.toml
index e4a9393a78f..64a7407a57f 100644
--- a/console/system.toml
+++ b/console/system.toml
@@ -27,6 +27,7 @@ start = ["logd", "console"]
 # reads the kernel's records with `logread`, which is `Rights::LOG |
 # Rights::WAIT` on a `SysCap` duplicate, and serves `log` to the console.
 [programs.logd]
+service = true
 syscap = ["logread"]
 serves = ["log"]
 
diff --git a/diag/system.toml b/diag/system.toml
index 47b87060ebe..7892237af94 100644
--- a/diag/system.toml
+++ b/diag/system.toml
@@ -36,6 +36,7 @@ start = ["logd", "toybox"]
 # `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands it every
 # program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.toybox]
diff --git a/issues/build/a-lane-s-tap-socket-path-is-past-sun-len-on-the-dev-host.md b/issues/build/a-lane-s-tap-socket-path-is-past-sun-len-on-the-dev-host.md
new file mode 100644
index 00000000000..a055bb032a6
--- /dev/null
+++ b/issues/build/a-lane-s-tap-socket-path-is-past-sun-len-on-the-dev-host.md
@@ -0,0 +1,27 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-26
+---
+
+# A lane's tap socket path is past `SUN_LEN` on the dev host
+
+`lan_mdns_answer` reds on the macOS dev host, wide and alone:
+
+```
+connect to QEMU's /private/var/folders/gr/mr4_fg4n34jb417sx1g5cgxc0000gp/T/toyos-tmp-89085-0/tests-0/lane-3/tap-out-0.sock: path must be shorter than SUN_LEN
+```
+
+That path is 104 bytes, and macOS's `sun_path` holds 104 including the NUL.
+`tests/common/segment.rs`'s `Tap::in_lane` puts both sockets in
+`lane::dir()`, which since `toyos-tmpdir` is
+`$TMPDIR/toyos-tmp-<pid>-<n>/tests-<n>/lane-<i>/`, and the dev host's
+`$TMPDIR` resolves to 57 bytes (`/private/var/folders/…/T/`) before any of
+that. A five-digit pid is enough to cross the limit. Seen on
+`wt/toyos-layout` after it merged `origin/main` at `e48604c0`; nothing on that
+branch touches the lane or the tap.
+
+## Exit condition
+
+A tap socket's path fits `sun_path` on every host the suite runs on, and
+`lan_mdns_answer` is green on the dev host.
diff --git a/issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md b/issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md
deleted file mode 100644
index 890e24edf3e..00000000000
--- a/issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-24
----
-
-# `sshd_fail_closed` assumes a `/home` no earlier boot of its lane wrote
-
-`sshd_fail_closed` owes `sshd: minted a new host identity at
-/home/root/.ssh/host_ed25519`, and boots `tests/sshdcase` on the lane's shared
-scratch disk (`tests/common/qemu.rs`: "Reused across the boots of one lane").
-Any earlier boot of the same lane whose sshd ran leaves its identity on that
-disk, and this boot then reads it and mints nothing.
-
-Seen on CI (run 35984557404, shard 5): `lan_talk` ran first in the lane and its
-sshd minted a key; `sshd_fail_closed` then said `host identity SHA256:yYw2…`
-with the same fingerprint on both of its runs and no `minted` line, red twice.
-On main the two had not shared a shard. `lan_talk` now boots a disk of its own,
-which removes this one neighbour and not the premise.
-
-## Exit condition
-
-`sshd_fail_closed` boots a disk of its own, as `tests/common/pkg.rs` does, so
-its verdict does not depend on which tests the shard split put before it.
diff --git a/issues/build/twenty-seven-sdk-doc-lines-name-a-path-that-is-gone.md b/issues/build/twenty-seven-sdk-doc-lines-name-a-path-that-is-gone.md
deleted file mode 100644
index 0d2df595059..00000000000
--- a/issues/build/twenty-seven-sdk-doc-lines-name-a-path-that-is-gone.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-04
----
-
-# Twenty-seven SDK doc lines name `/bin`, which no longer exists
-
-## Reproduction
-
-```
-rg -n --pcre2 '(?<![A-Za-z0-9_/.])/(bin|lib|share|etc)(/|(?![A-Za-z0-9_/.-]))' \
-   toyos-abi/src toyos/src userland/toyos-window/src
-```
-
-Twenty-seven lines, all doc comments: `/bin/init`, `/bin/logd`, `/bin/toybox`,
-`/bin/ps`, `/bin/shutdown`, `/bin/sshd`, `/bin/terminal`, `/bin/console`,
-`/bin/ls`. ROOT mounts at `/system` since the hierarchy landed, so every one of
-them names a path no image carries.
-
-## Why the branch that moved the rest left them
-
-`src/CLAUDE.md`: a doc-comment change under `toyos-abi/src` costs a sysroot
-claim exactly like a layout change (`SYSROOT_SOURCES` in `src/toolchain.rs` is
-`toyos-abi/src`, `toyos/src`, `userland/libc/src`, and `standing` asks `git
-diff` over them). A claim refuses every other checkout on this host until the
-claimant lands, and it also makes the claiming branch unable to build its own
-base — which is the arm a negative control needs. `userland/toyos-window` is
-one of the five crates the ToyOSOrg forks resolve by version off crates.io, so
-a change there is a published bump plus every dependent's pin
-(`src/sdkversion.rs` refuses the pair).
-
-So the cost of correcting these lines is not the lines: it is a sysroot claim
-and an SDK version bump, and neither is worth spending on prose.
-
-## Exit condition
-
-The next branch that claims the sysroot for its own reason deletes them in the
-same commit — deleted rather than corrected, per the owner's rule on wrong
-prose — and `userland/toyos-window`'s one line goes with the next bump of that
-crate. `LOG_DOC_BIN` in `src/build.rs` is the directory the `Rights::LOG` doc
-gate strips, and it moves in that same commit or the gate stops seeing a doc
-that names the wrong one. This file closes when the `rg` above is empty.
diff --git a/issues/filesystem/a-directory-on-data-survives-no-reboot.md b/issues/filesystem/a-directory-on-data-survives-no-reboot.md
new file mode 100644
index 00000000000..4fa2928e343
--- /dev/null
+++ b/issues/filesystem/a-directory-on-data-survives-no-reboot.md
@@ -0,0 +1,33 @@
+---
+status: open
+kind: defect
+opened: 2026-09-26
+---
+
+# A directory on DATA survives no reboot, and takes a child whose parent was never made
+
+The DATA adapter answers every `create_dir` with `NotSupported`
+(`kernel/src/bcachefs_adapter.rs`), so the VFS keeps the directory itself in
+`created_dirs` (`kernel/src/vfs.rs`). Two things follow:
+
+- **A child is taken whose parent was never made.** `create_dir("/home/toy/Apps")`
+  succeeds with no `/home/toy`, so `std::fs::create_dir_all` makes the leaf and
+  nothing above it. init makes every level in turn for this reason (`make_dir`
+  in `userland/init/src/main.rs`).
+- **It is memory.** Nothing reaches the volume, so an empty directory is gone
+  at the next boot; init remakes the session home and each service's `/state`
+  every boot.
+
+Seen building `layout_fresh_boot`: `read_dir /home/toy: entity not found` from
+a boot whose init had just made `/home/toy/Apps`.
+
+## Owner
+
+The storage track, `issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md`:
+real bcachefs under DATA carries directories.
+
+## What would close it
+
+DATA stores directories, `create_dir` refuses a missing parent, and
+`created_dirs` is gone or kept only for a mount that has no directories and
+says so.
diff --git a/issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md b/issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md
index 6f91bed1942..ec664e139c6 100644
--- a/issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md
+++ b/issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md
@@ -9,15 +9,15 @@ opened: 2026-09-05
 A stage of `issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md`;
 where a program's own data goes depends on it.
 
-A user is two things: `/home/<user>`, a directory on DATA holding Documents,
-Downloads, `.config/<app>` and `.local/<app>`; and a row in the manifest from
+A user is two things: `/home/<user>`, a directory on DATA laid out as
+`issues/filesystem/where-everything-lives.md` rules; and a row in the manifest from
 which init builds a login session's namespace, the way it builds every system
 program's from `system.toml`. Nothing else names a user: no numeric id the
 kernel checks, no password file, no ambient "current user" a process can ask
 for. A session holds its home tree because init moved that directory's handle
 into it, and a program launched inside the session holds what the session's
-launcher row grants it. Until this lands there is one implicit user and a
-package writes under `/apps/<name>/` only.
+launcher row grants it. Until this lands there is one user, `toy`, whose home
+init makes at boot.
 
 Stage 3 of `issues/isolation/every-program-sees-only-the-files-it-was-given.md`, and blocked on its first two stages: a user is isolated only
 once a session's view is all it can name. The mount protocol and real bcachefs
diff --git a/issues/filesystem/shell-c-discards-the-cwd-its-launch-carried.md b/issues/filesystem/shell-c-discards-the-cwd-its-launch-carried.md
index 2664f9f715b..42ce55239fb 100644
--- a/issues/filesystem/shell-c-discards-the-cwd-its-launch-carried.md
+++ b/issues/filesystem/shell-c-discards-the-cwd-its-launch-carried.md
@@ -24,7 +24,7 @@ down, where `set_current_dir(&home)` is at least a stated policy.
 
 ## Reproduction
 
-Spawn `/system/bin/shell` with `Command::current_dir("/home/root")` and the
+Spawn `/system/bin/shell` with `Command::current_dir("/home/toy")` and the
 arguments `-c`, `pwd`. It answers `/`.
 
 Read from the source rather than measured: `pkg_install_gbae`'s
diff --git a/issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md b/issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md
index 21926aa1e54..ab75fa8b02a 100644
--- a/issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md
+++ b/issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md
@@ -46,7 +46,7 @@ volume, handed to whichever server recognises its superblock.
 |---|---|---|---|
 | ESP | FAT32, firmware's rule | `/boot` | kernel only |
 | ROOT | bcachefs image the build writes | `/system` | no; versioned per release |
-| DATA | bcachefs, formatted on first boot | `/apps`, `/home` | yes |
+| DATA | bcachefs, formatted on first boot | `/apps`, `/config`, `/home`, `/state` | yes |
 | LOG | FAT32 while a Mac has to read the dev stick | `/log` | yes |
 
 `/tmp` has no backing. The dev loop keeps the ESP and ROOT on the stick and
@@ -90,22 +90,13 @@ NTFS by the same shape if wanted.
 
 ## Paths
 
-No drive letters, no `/usr`, `/var`, `/opt`, `/dev`, `/proc` or `/sys`:
-devices and processes are capabilities and syscalls here, not files. Each
-process sees the directories its parent gave it
-(`issues/isolation/every-program-sees-only-the-files-it-was-given.md`).
-
-- `/boot` — bootloader, kernel, kernel arguments.
-- `/system` — the OS image, read-only, versioned: today's `bin`, `lib`, `share`
-  and the manifest.
-- `/apps/<name>` — each installed program in its own directory with its own
-  binaries, data and manifest row; doom moves here with its WAD.
-- `/home/<user>` — Documents, Downloads, `.config/<app>` for settings,
-  `.local/<app>` for saves and caches.
-- `/log`, `/tmp` — as today.
-- `/media/<label>` — foreign and unassigned volumes; a Windows disk is
-  `/media/windows`: one more directory capability, served by the server that
-  recognises the volume.
+The tree, its names and how a program finds them are
+`issues/filesystem/where-everything-lives.md`. What this track owes it is the
+mount structure: a mount point is exactly one top-level name
+(`kernel/src/vfs.rs`, `ROOT_ENTRIES` and the array indexed by it), so
+`/media/<label>` for a foreign volume — a Windows disk is `/media/windows` — is
+a nested mount the structure cannot represent. The mount protocol owes that,
+and `/media` is an empty directory until then.
 
 Users are a track of their own,
 `issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md`: a `/home/<user>`
diff --git a/issues/filesystem/where-everything-lives.md b/issues/filesystem/where-everything-lives.md
new file mode 100644
index 00000000000..8ec1c6c1988
--- /dev/null
+++ b/issues/filesystem/where-everything-lives.md
@@ -0,0 +1,122 @@
+---
+status: open
+kind: track
+opened: 2026-09-26
+---
+
+# Where everything lives, and how a program finds it
+
+The owner ruled this layout on 2026-09-26. This file is where it is recorded:
+`issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md` says what
+backs each name, and
+`issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md` and
+`issues/isolation/every-program-sees-only-the-files-it-was-given.md` say who
+may reach it. Every line below is the owner's ruling.
+
+## The tree
+
+```
+/system                read-only, signed: bin, lib, etc, and
+                       share/{fonts, icons, themes, sounds, backgrounds, licenses, doc}
+/config                machine settings the owner changes; a file here overrides /system/etc
+/state/<program>       a system service's private persistent data
+/apps/<name>           installed packages; no layout is required inside one
+/home/<user>           Desktop Documents Downloads Music Pictures Videos Fonts Apps/<name>/
+/boot                  bootloader, kernel, kernel arguments; the updater's alone
+/log  /media           logs; foreign volumes, one /media/<label> each
+/tmp                   private per program
+```
+
+`/system` is signed because the image is:
+`issues/boot-media/the-machine-updates-itself-without-ubuntu.md` signs it, and
+until that lands nothing verifies it.
+
+## The rules
+
+- **No drive letters, no `/usr`, `/var`, `/opt`, `/dev`, `/proc` or `/sys`**:
+  devices and processes are capabilities and syscalls here, not files.
+- **No dotfile and no hidden folder anywhere in the layout.** A third-party
+  program that hard-codes `~/.something` may still create one, but only inside
+  its own app folder: the owner accepted that as the honest limit.
+- **English names, never translated.**
+- **A path means the same file in every view.** `/tmp` is the one exception:
+  it is private per program. A view hides names and never renames one.
+- **A program learns a location from an environment variable init sets**
+  (`HOME` and those like it). A location grants nothing, because the view
+  decides what a program can reach. On ToyOS `std::env::home_dir()` is `$HOME`
+  or `None`, with no fallback, and `temp_dir()` is `/tmp`. A program init did
+  not start carries the `HOME` its caller named or init answered for it, never
+  its parent's own.
+- **`/home/<user>/Apps/<name>` is one app's private data for that user**, and
+  it is that app's `HOME`. Inside it ToyOS answers config, data, cache and
+  state as the visible `Config`, `Data`, `Cache` and `State`.
+- **Fonts**: the system's are in `/system/share/fonts`, a user's in
+  `/home/<user>/Fonts`. sans-serif and system-ui are Open Sans, monospace is
+  JetBrains Mono, and serif is empty until a licence-clean one is chosen.
+- **The time zone is machine-wide in `/config`.** The keyboard layout and the
+  language are machine defaults in `/config`, and per-user overrides come with
+  the users track.
+- **The dev image's user is `toy`.** There is no `root` user and no
+  `/home/root`.
+- An app finds its own files next to its binary (`current_exe()`).
+
+## Stages
+
+1. **Everything that needs no isolation.** `/config` and `/state` are DATA
+   names; init makes `/home/toy`, its eight folders, and each service's
+   `/state/<name>`, and it sets `HOME` from each row (`service = true` in
+   `system.toml`, which a row that serves a port must say); a program no row
+   names carries the `HOME` init answers for it, never its spawner's own;
+   the kernel makes no home, and lists a directory it carries; the keyboard
+   layout is `/config/keyboard-layout`; sshd keeps its identity and key list
+   in `/state/sshd`; the shell's history is in `Apps/shell/State`; std's
+   `home_dir` reads `$HOME`. **Exit**: `layout_fresh_boot` is green.
+2. **An app's `HOME` is its folder.** init launches an app from `/apps` (and
+   each desktop app in the image) with `HOME=/home/<user>/Apps/<name>`, makes
+   the folder and its `Config Data Cache State`, and puts nothing else of the
+   home in that app's view. It needs
+   `issues/isolation/every-program-sees-only-the-files-it-was-given.md` stage 2.
+   **Exit**: a launched app's `home_dir()` is its folder, it cannot name
+   another app's folder, and the shell's history is still
+   `/home/<user>/Apps/shell/State/history` (`OWN_FOLDER` in `userland/shell`).
+3. **Users.** The users track creates `/home/<user>` and its folders from a
+   login row, and `toy` stops being a constant in `toyos-manifest`.
+   **Exit**: init names no user.
+4. **The time zone.** One file in `/config` names the machine's zone, one
+   program writes it, and local time is read through it rather than recovered
+   by subtracting `SYS_CLOCK_REALTIME` from `SYS_CLOCK_EPOCH`. **Exit**: a
+   guest test sets the zone and reads its local time back, and nothing
+   recovers the zone by subtraction.
+5. **The language.** One file in `/config` names the machine's default
+   language, one program writes it, and init sets it on every program it
+   starts. **Exit**: a guest test sets the language and a program init starts
+   reads it back.
+6. **Fonts ship as files.** JetBrains Mono and Open Sans ship as TTFs under
+   `/system/share/fonts` from `assets/fonts/`, the console's raster stays its
+   own asset, and each OFL text ships once, under `/system/share/licenses`.
+   **Exit**: an image carries both families there and their licence texts
+   under `/system/share/licenses`, and none under `/system/share/fonts`.
+7. **The upstream arms**, none opened until the owner opens it:
+   - fontdb and fontique scan `/system/share/fonts` and `$HOME/Fonts` from the
+     start, and fontique maps the families above. **Exit**: both prepared
+     branches carry both folders and the family table.
+   - dirs-sys answers `home_dir` from std, and the six user folders and the
+     four `Config Data Cache State` directories under `$HOME` by their names
+     here. **Exit**: `dirs` and `directories` build for ToyOS and answer this
+     layout.
+   - home answers from std. **Exit**: `home` builds for ToyOS.
+   - tempfile takes the unix create-then-unlink path once std's
+     `create_new` and unlink-while-open are measured on ToyOS. **Exit**:
+     `tempfile` makes files on ToyOS.
+   - sys-locale reads the language init sets from `/config`. **Exit**:
+     `sys-locale` answers on ToyOS.
+   - rustls-native-certs reads a CA bundle under `/system/etc`, once something
+     needs native roots. **Exit**: the first native-roots consumer runs.
+
+## Not moved
+
+`/log/lease.txt` stays on `/log`. It is not netd's lease: it is the
+`--exit-with-lease` bench report the metal loop reads off the stick's FAT log
+volume, as it reads `/log/metal-*.bin`, and the DATA volume is not readable
+there. It goes with
+`issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md`.
diff --git a/issues/isolation/sshd-authorized-keys-unprotected.md b/issues/isolation/sshd-authorized-keys-unprotected.md
index 7fc3e6f49be..ac78b264422 100644
--- a/issues/isolation/sshd-authorized-keys-unprotected.md
+++ b/issues/isolation/sshd-authorized-keys-unprotected.md
@@ -6,8 +6,8 @@ opened: 2026-08-06
 
 # Sshd's keys are as protected as any other file, which is not at all
 
-`/home/root/.ssh/host_ed25519` is the machine's SSH private key and
-`/home/root/.ssh/authorized_keys` is the list of who may log in. There is no
+`/state/sshd/host_ed25519` is the machine's SSH private key and
+`/state/sshd/authorized_keys` is the list of who may log in. There is no
 user model and no file permissions, so **any process on the machine can read
 the first and rewrite the second** — the second being the one that matters:
 appending a line to it is a remote login, and nothing stops a process doing it.
diff --git a/kernel/Cargo.lock b/kernel/Cargo.lock
index 9b18c6188e2..27590e95506 100644
--- a/kernel/Cargo.lock
+++ b/kernel/Cargo.lock
@@ -75,7 +75,7 @@ checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-acpi"
diff --git a/kernel/src/main.rs b/kernel/src/main.rs
index ae9b72b77d3..22873881bed 100644
--- a/kernel/src/main.rs
+++ b/kernel/src/main.rs
@@ -220,9 +220,9 @@ fn register_gpu(driver: Box<dyn gpu::Gpu>, info: gpu::GpuInfo) {
     gpu::register(driver, info);
 }
 
-/// The two names DATA answers to. One filesystem, so `/apps/x` and `/home/x`
-/// are two directories of it and never two volumes.
-const DATA_PATHS: [&str; 2] = ["apps", "home"];
+/// The names DATA answers to. One filesystem, so `/apps/x` and `/home/x` are
+/// two directories of it and never two volumes.
+const DATA_PATHS: [&str; 4] = ["apps", "config", "home", "state"];
 
 /// The boot from power-on, off the loader's TSC readings and `complete`'s, at
 /// the calibrated rate. The TSC counts from reset, so the first span is
@@ -564,30 +564,30 @@ unsafe fn kernel_main(kernel_args: &KernelArgs) -> ! {
     fat32_adapter::probe_boot_disks();
     rootfs::hold_source();
 
-    // One filesystem, two paths: `/apps` and `/home` are two directories of
-    // DATA, so one sync settles both and neither can outlive the other.
+    // One filesystem, four paths: each of `DATA_PATHS` is a directory of DATA,
+    // so one sync settles them all and none can outlive the others.
     // tmpfs when there is no DATA volume this kernel may write: persistence is
     // the only difference, so the earlier refusal doesn't cascade. Nothing at
     // all when the volume is ours and did not mount.
     #[cfg_attr(not(feature = "boot-actuators"), allow(unused_variables))]
-    let (data_cache, home) = match bcachefs_adapter::open_data() {
+    let data_cache = match bcachefs_adapter::open_data() {
         bcachefs_adapter::Data::Mounted(cache, fs) => {
             let adapter = bcachefs_adapter::BcacheFsAdapter::new(fs, Arc::clone(&cache));
             vfs::lock().mount(&DATA_PATHS, Box::new(adapter), UserAccess::ReadWrite);
-            (Some(cache), true)
+            Some(cache)
         }
         bcachefs_adapter::Data::Volatile => {
-            log!("storage: /apps and /home are a tmpfs — they will not survive a reboot");
+            log!("storage: /apps, /config, /home and /state are a tmpfs — they will not survive a reboot");
             vfs::lock().mount(
                 &DATA_PATHS,
                 Box::new(crate::tmpfs::TmpFs::new()),
                 UserAccess::ReadWrite,
             );
-            (None, true)
+            None
         }
         bcachefs_adapter::Data::Absent => {
-            log!("storage: /apps and /home are absent this boot — the DATA volume is ours and did not mount");
-            (None, false)
+            log!("storage: /apps, /config, /home and /state are absent this boot — the DATA volume is ours and did not mount");
+            None
         }
     };
 
@@ -608,13 +608,6 @@ unsafe fn kernel_main(kernel_args: &KernelArgs) -> ! {
         None => log!("log-volume: not mounted; this boot's kernel log stays in memory"),
     }
 
-    // Fixed kernel strings well under MAX_PATH: a refusal here is a kernel bug, so this fails fast instead of returning an error.
-    // Not on an absent `/home`: the VFS's own directory set would answer for a directory nothing holds.
-    if home {
-        vfs::lock().create_dir("/home/root").expect("boot: /home/root exceeds MAX_PATH");
-        vfs::lock().create_dir("/home/root/.config").expect("boot: /home/root/.config exceeds MAX_PATH");
-    }
-
 
     // After the mounts above: the FAT reopen control drives `/log`.
     #[cfg(feature = "boot-actuators")]
diff --git a/kernel/src/vfs.rs b/kernel/src/vfs.rs
index bb01f2eabcb..e4b2a3811fb 100644
--- a/kernel/src/vfs.rs
+++ b/kernel/src/vfs.rs
@@ -126,7 +126,8 @@ pub enum UserAccess {
 
 /// The entries `/` has, in listing order. `/` is synthesized rather than
 /// mounted: it is no filesystem, and nothing outside this set can be mounted.
-pub const ROOT_ENTRIES: [&str; 7] = ["apps", "boot", "home", "log", "media", "system", "tmp"];
+pub const ROOT_ENTRIES: [&str; 9] =
+    ["apps", "boot", "config", "home", "log", "media", "state", "system", "tmp"];
 
 struct Mount {
     fs: Box<dyn FileSystem>,
@@ -384,6 +385,23 @@ impl Vfs {
             }
         }
 
+        // A directory the VFS carries is its parent's entry whether or not a
+        // file is under it yet.
+        let parent = format!("{}/", directory(&mount, &subdir));
+        for dir in self.created_dirs.range(parent.clone()..) {
+            let Some(rest) = dir.strip_prefix(parent.as_str()) else { break };
+            let child = rest.split('/').next().unwrap_or(rest);
+            if !child.is_empty() {
+                let dir_name = format!("{child}/");
+                if seen_dirs.insert(dir_name.clone()) {
+                    if result.len() == MAX_LIST_ENTRIES {
+                        return Err(SyscallError::ResourceExhausted);
+                    }
+                    result.push((dir_name, 0));
+                }
+            }
+        }
+
         // An empty directory's witnesses: its own listing entry on a mount
         // that represents directories, `created_dirs` on one the VFS carries.
         if result.is_empty()
diff --git a/rust b/rust
index f6bf9d220aa..80ea645f83b 160000
--- a/rust
+++ b/rust
@@ -1 +1 @@
-Subproject commit f6bf9d220aa5fb39d8e2e90dfda6c6df66ca3b05
+Subproject commit 80ea645f83bf528b50ccac4f23235dc61dc7ea6b
diff --git a/src/build.rs b/src/build.rs
index 774e62f0f06..9ac252332aa 100644
--- a/src/build.rs
+++ b/src/build.rs
@@ -132,6 +132,9 @@ struct ProgramConfig {
     /// `toyos_manifest::syscap_rights` takes. A handful of rows in the whole
     /// tree declare one.
     syscap: Vec<String>,
+    /// A system service: init starts it with `HOME` at its own `/state/<name>`
+    /// and makes that directory, where every other row gets the session's.
+    service: bool,
 }
 
 impl ProgramConfig {
@@ -680,6 +683,7 @@ fn render_manifest(config: &SystemConfig) -> Vec<u8> {
                     receives: cfg.receives.clone(),
                     devices: cfg.devices.clone(),
                     syscap: cfg.syscap.clone(),
+                    service: cfg.service,
                 }
             })
             .collect(),
@@ -2762,12 +2766,21 @@ mod tests {
         }
     }
 
+    /// Every config renders, so a row the manifest refuses — one that serves a
+    /// port and is not marked `service` — reds here rather than at a build.
+    #[test]
+    fn every_config_renders_its_manifest() {
+        let root = Path::new(env!("CARGO_MANIFEST_DIR"));
+        for config in ALL_CONFIGS {
+            let parsed = parse_config(&root.join(config));
+            let rendered = std::panic::catch_unwind(|| render_manifest(&parsed));
+            assert!(rendered.is_ok(), "{config} does not render; the panic above says why");
+        }
+    }
+
     /// One prefix and no other, so a doc naming `/etc/logd` or `/apps/logd` is a
-    /// token the filter below drops and an assertion that reds. Still `/bin/`
-    /// because `toyos-abi/src` is the tree the sweep did not reach;
-    /// `issues/build/twenty-seven-sdk-doc-lines-name-a-path-that-is-gone.md`
-    /// moves this and those lines together.
-    const LOG_DOC_BIN: &str = "/bin/";
+    /// token the filter below drops and an assertion that reds.
+    const LOG_DOC_BIN: &str = "/system/bin/";
 
     /// `Rights::LOG`'s doc names its holders, which is a claim about these
     /// manifests and rots on its own: `/system/bin/console` stood in it for the whole
@@ -2845,6 +2858,7 @@ mod tests {
         "tests/lanleasecase/system.toml",
         "tests/lantalkcase/system.toml",
         "tests/latencycase/system.toml",
+        "tests/layoutcase/system.toml",
         "tests/logholdcase/system.toml",
         "tests/logrotatecase/system.toml",
         "tests/logstallcase/system.toml",
diff --git a/system.toml b/system.toml
index 2d0b8c856a0..592a145eec5 100644
--- a/system.toml
+++ b/system.toml
@@ -32,6 +32,9 @@ start = ["logd", "compositor", "soundd", "netd", "filepicker"]
 [apps]
 receives = ["compositor", "soundd", "filepicker"]
 
+# `service = true` makes a row a system service: init starts it with `HOME` at
+# its own `/state/<name>` and makes that directory first. Every other row runs
+# with the session user's home.
 [programs]
 input-test = {}
 proctest = {}
@@ -48,6 +51,7 @@ toyos-cc = { path = "toyos-cc" }
 # `every_boot_config_runs_logd` is what refuses one. It claims no device, and
 # `log` is the port it answers `inspect` on.
 [programs.logd]
+service = true
 syscap = ["logread"]
 serves = ["log"]
 # What lets `logd` serve this boot's log on the network, to whoever connects:
@@ -55,11 +59,13 @@ serves = ["log"]
 receives = ["netd"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["soundd", "filepicker", "launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
@@ -69,12 +75,14 @@ syscap = ["rt"]
 # Named by vendor and device rather than by slot, so one row finds the card
 # wherever firmware put it.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
 # `swap` is the authority to replace a running service's binary; the build
 # refuses it to any other program (`src/build.rs`).
 [programs.sshd]
+service = true
 receives = ["netd", "launcher", "swap"]
 
 # A name's addresses, asked of netd's resolver: `netd` is the whole of what it
@@ -90,6 +98,7 @@ receives = ["netd", "soundd", "log", "compositor"]
 syscap = ["inventory"]
 
 [programs.filepicker]
+service = true
 serves = ["filepicker"]
 receives = ["compositor"]
 
diff --git a/tests/common/pkg.rs b/tests/common/pkg.rs
index 090a25d0a02..d737e2863dd 100644
--- a/tests/common/pkg.rs
+++ b/tests/common/pkg.rs
@@ -206,7 +206,7 @@ fn guest_probes(qemu: &mut QemuInstance, log: &mut String) -> Result<(), String>
     // The gate's other half: the shell resolves what its user typed, so a
     // dotted path still runs.
     let ran = passed(qemu, log, "test_rs_pkg_launch_gbae relative-path")?;
-    for said in ["./home/root/reltest/echo ran", "../home/root/reltest/echo ran"] {
+    for said in ["./home/toy/reltest/echo ran", "../home/toy/reltest/echo ran"] {
         if !ran.contains(said) {
             return Err(format!("no {said:?} line:\n{ran}"));
         }
diff --git a/tests/common/ssh.rs b/tests/common/ssh.rs
index 4e42f72d0ac..c500359e4fe 100644
--- a/tests/common/ssh.rs
+++ b/tests/common/ssh.rs
@@ -319,6 +319,12 @@ const GUEST_TEST: &str = "test_rs_empty_dir_stat";
 const MISSING: &str = "/tmp/no_such_file_for_the_stderr_arm";
 
 /// `tests/sshdcase` with a key in its image and a forward into its port 22.
+pub fn boot(rust_bins: &[(String, Vec<u8>)]) -> super::qemu::QemuInstance {
+    boot_case("tests/sshdcase", rust_bins).0
+}
+
+/// `case` with a key in its image and a forward into its port 22, and its
+/// console up to sshd's listening line.
 ///
 /// **The key is staged rather than installed**: `/home` on this machine may be
 /// a tmpfs, so a key that had to be put there after the boot is a key nobody
@@ -328,7 +334,10 @@ const MISSING: &str = "/tmp/no_such_file_for_the_stderr_arm";
 /// profile with no NIC, an argv with no forward, and a daemon that never opened
 /// its port are each a machine the gate cannot run on at all, which is the same
 /// class as a guest that never printed its ready marker.
-pub fn boot(rust_bins: &[(String, Vec<u8>)]) -> super::qemu::QemuInstance {
+pub fn boot_case(
+    case: &str,
+    rust_bins: &[(String, Vec<u8>)],
+) -> (super::qemu::QemuInstance, String) {
     let identity = Identity::mint(KEY).unwrap_or_else(|why| panic!("[sshd] {why}"));
     let options = super::qemu::BootOptions {
         profile: super::qemu::Profile::Headless,
@@ -354,7 +363,7 @@ pub fn boot(rust_bins: &[(String, Vec<u8>)]) -> super::qemu::QemuInstance {
         "[sshd] the argv carries no {forward}, so nothing on this host can reach the guest"
     );
 
-    let config = compile::repo_root().join("tests/sshdcase");
+    let config = compile::repo_root().join(case);
     let mut guest =
         super::qemu::QemuInstance::boot_with_options(&config, &[], rust_bins, options);
     let mut console = guest.boot_log().to_string();
@@ -366,7 +375,7 @@ pub fn boot(rust_bins: &[(String, Vec<u8>)]) -> super::qemu::QemuInstance {
     ) {
         panic!("[sshd] never listened, so no exchange below would mean anything: {why}\n{console}");
     }
-    guest
+    (guest, console)
 }
 
 /// What `exec` is for: run this program, and tell me how it ended.
diff --git a/tests/common/storage.rs b/tests/common/storage.rs
index b171b2d7978..ddd95194979 100644
--- a/tests/common/storage.rs
+++ b/tests/common/storage.rs
@@ -278,7 +278,7 @@ pub fn broken_data_volume_is_absent(
     for said in [
         "storage: the DATA volume does not mount, and nothing says it is another's: \
          ChecksumMismatch",
-        "storage: /apps and /home are absent this boot",
+        "storage: /apps, /config, /home and /state are absent this boot",
         "Boot: complete",
     ] {
         if !log.contains(said) {
@@ -303,8 +303,8 @@ pub fn broken_data_volume_is_absent(
     let result = qemu.run_test("test_rs_home_absent", Duration::from_secs(20));
     if result.exit_code != Some(0) {
         return Err(format!(
-            "home_absent guest failed — /apps, /home or /home/root answered a write, a chdir or \
-             a listing that an absent DATA volume must refuse:\n{}\nkernel log while it ran:\n{}{}",
+            "home_absent guest failed — /apps, /config, /home, /state or /home/toy answered a write, \
+             a chdir or a listing that an absent DATA volume must refuse:\n{}\nkernel log while it ran:\n{}{}",
             result.stdout, result.before, result.serial
         ));
     }
@@ -363,7 +363,7 @@ pub fn data_candidate_with_bad_geometry_is_absent(
             return Err(format!("{bad:?}: a misaligned candidate must not be fatal\n{log}"));
         }
     }
-    for said in ["not whole", "storage: /apps and /home are absent this boot", "Boot: complete"] {
+    for said in ["not whole", "storage: /apps, /config, /home and /state are absent this boot", "Boot: complete"] {
         if !log.contains(said) {
             return Err(format!("the kernel never said {said:?}\n{log}"));
         }
diff --git a/tests/desktopaudiocase/system.toml b/tests/desktopaudiocase/system.toml
index 379677437ae..82d72037c07 100644
--- a/tests/desktopaudiocase/system.toml
+++ b/tests/desktopaudiocase/system.toml
@@ -19,14 +19,17 @@ start = ["logd", "compositor", "soundd", "terminal"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["soundd", "launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/desktopcase/system.toml b/tests/desktopcase/system.toml
index 33b7ae3c41d..07326adc9c2 100644
--- a/tests/desktopcase/system.toml
+++ b/tests/desktopcase/system.toml
@@ -25,9 +25,11 @@ start = ["logd", "compositor", "terminal"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
diff --git a/tests/doomcase/system.toml b/tests/doomcase/system.toml
index 188d183fbb3..f9b7b2411c6 100644
--- a/tests/doomcase/system.toml
+++ b/tests/doomcase/system.toml
@@ -20,9 +20,11 @@ start = ["logd", "soundd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/doommusiccase/system.toml b/tests/doommusiccase/system.toml
index 4a40250884a..251c91f88d5 100644
--- a/tests/doommusiccase/system.toml
+++ b/tests/doommusiccase/system.toml
@@ -21,9 +21,11 @@ start = ["logd", "soundd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/e1000case/system.toml b/tests/e1000case/system.toml
index 4494033d5e9..1742df853ff 100644
--- a/tests/e1000case/system.toml
+++ b/tests/e1000case/system.toml
@@ -12,6 +12,7 @@
 start = ["logd", "netd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 # What lets `logd` serve this boot's log on the network, to whoever connects:
 # without it the log is served on this machine only.
@@ -22,6 +23,7 @@ receives = ["netd"]
 # claim. Named by vendor and device rather than by slot, so one row finds the
 # card wherever firmware put it.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:10d3"]
 
diff --git a/tests/e1000leasecase/system.toml b/tests/e1000leasecase/system.toml
index f994ad58ac2..51f53e79b2c 100644
--- a/tests/e1000leasecase/system.toml
+++ b/tests/e1000leasecase/system.toml
@@ -7,9 +7,11 @@
 start = ["logd", "netd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:10d3"]
 args = ["--exit-with-lease"]
diff --git a/tests/e1000talkcase/system.toml b/tests/e1000talkcase/system.toml
index 52717a39078..1bedfc16982 100644
--- a/tests/e1000talkcase/system.toml
+++ b/tests/e1000talkcase/system.toml
@@ -7,17 +7,20 @@
 start = ["logd", "netd", "sshd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 # What lets `logd` serve this boot's log on the network, to whoever connects:
 # without it the log is served on this machine only.
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:10d3"]
 
 # `swap` too: the host replaces netd on this boot without rebooting it.
 [programs.sshd]
+service = true
 receives = ["netd", "launcher", "swap"]
 
 [programs.test-runner]
diff --git a/tests/flrswapcase/system.toml b/tests/flrswapcase/system.toml
index 176276a4cbc..f7112fbef3e 100644
--- a/tests/flrswapcase/system.toml
+++ b/tests/flrswapcase/system.toml
@@ -7,16 +7,19 @@
 start = ["logd", "netd", "sshd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 # The record stream's authority: the address on the parameter line is
 # information, and this row is the whole of what can act on it.
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:10d3", "pci:8086:10c9"]
 
 [programs.sshd]
+service = true
 receives = ["netd", "launcher", "swap"]
 
 [programs.test-runner]
diff --git a/tests/inspectcase/system.toml b/tests/inspectcase/system.toml
index 2901ab4a91c..1c12310260d 100644
--- a/tests/inspectcase/system.toml
+++ b/tests/inspectcase/system.toml
@@ -16,19 +16,23 @@ start = ["logd", "compositor", "soundd", "netd", "test-runner"]
 # `every_boot_config_runs_logd` refuses a config without it. `log` is the port
 # it answers `inspect` on.
 [programs.logd]
+service = true
 syscap = ["logread"]
 serves = ["log"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
diff --git a/tests/jobcase/system.toml b/tests/jobcase/system.toml
index c7791551c35..ad42601aefe 100644
--- a/tests/jobcase/system.toml
+++ b/tests/jobcase/system.toml
@@ -5,6 +5,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 # One binary name per job, never a command line: the stdin path's `run <name>`
diff --git a/tests/jobdeadlinecase/system.toml b/tests/jobdeadlinecase/system.toml
index d457d25a593..bcd4a6f6058 100644
--- a/tests/jobdeadlinecase/system.toml
+++ b/tests/jobdeadlinecase/system.toml
@@ -7,6 +7,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.test-runner]
diff --git a/tests/lancase/system.toml b/tests/lancase/system.toml
index 5eaf3999ff0..380c3e31f92 100644
--- a/tests/lancase/system.toml
+++ b/tests/lancase/system.toml
@@ -11,9 +11,11 @@
 start = ["logd", "netd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:15fc"]
 
diff --git a/tests/lanicscase/system.toml b/tests/lanicscase/system.toml
index d4c7d6070f6..90ca68d2e1a 100644
--- a/tests/lanicscase/system.toml
+++ b/tests/lanicscase/system.toml
@@ -12,9 +12,11 @@
 start = ["logd", "netd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:15fc"]
 args = ["--provoke-message"]
diff --git a/tests/lanleasecase/system.toml b/tests/lanleasecase/system.toml
index 0dd2d4827fd..f35c29f5979 100644
--- a/tests/lanleasecase/system.toml
+++ b/tests/lanleasecase/system.toml
@@ -10,9 +10,11 @@
 start = ["logd", "netd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:15fc"]
 args = ["--exit-with-lease"]
diff --git a/tests/lantalkcase/system.toml b/tests/lantalkcase/system.toml
index ffdb50ed1a3..cff48ed353f 100644
--- a/tests/lantalkcase/system.toml
+++ b/tests/lantalkcase/system.toml
@@ -12,17 +12,20 @@
 start = ["logd", "netd", "sshd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 # What lets `logd` serve this boot's log on the network, to whoever connects:
 # without it the log is served on this machine only.
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:15fc"]
 
 # `swap` too: the host replaces netd on this boot without rebooting it.
 [programs.sshd]
+service = true
 receives = ["netd", "launcher", "swap"]
 
 [programs.test-runner]
diff --git a/tests/latencycase/system.toml b/tests/latencycase/system.toml
index 415b382f871..976e7f7b30b 100644
--- a/tests/latencycase/system.toml
+++ b/tests/latencycase/system.toml
@@ -14,6 +14,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.test-runner]
diff --git a/tests/layoutcase/system.toml b/tests/layoutcase/system.toml
new file mode 100644
index 00000000000..01dcc9f045b
--- /dev/null
+++ b/tests/layoutcase/system.toml
@@ -0,0 +1,38 @@
+# Where a fresh boot puts things, asked over the cable: `layout_fresh_boot`.
+#
+# `tests/sshdcase` plus a declared shell and the `locale` applet. The shell is
+# declared so that its `HOME` is init's row answer on the launcher path; the
+# judge (`test_rs_layout_paths`) is declared nowhere, so its `HOME` is init's
+# answer on the direct path, spawned by a service whose own `HOME` is
+# `/state/sshd`.
+
+[boot]
+start = ["logd", "netd", "sshd", "test-runner"]
+
+[programs.logd]
+service = true
+syscap = ["logread"]
+
+[programs.netd]
+service = true
+serves = ["netd"]
+devices = ["pci:1af4:1041"]
+
+[programs.sshd]
+service = true
+receives = ["netd", "launcher"]
+
+[programs.test-runner]
+receives = ["netd"]
+syscap = ["logread"]
+
+# A session program with no authority: what is asked of it is where its
+# `HOME` is and where it keeps its history.
+[programs.shell]
+
+# `echo` for the shell's `-c`, `locale` for the machine's keyboard layout.
+[programs.toybox]
+
+[symlinks]
+"bin/echo" = "/system/bin/toybox"
+"bin/locale" = "/system/bin/toybox"
diff --git a/tests/logholdcase/system.toml b/tests/logholdcase/system.toml
index 5700947552a..7e75716c095 100644
--- a/tests/logholdcase/system.toml
+++ b/tests/logholdcase/system.toml
@@ -8,6 +8,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 args = ["--hold-ring-until=log hold: said after 192 records"]
 syscap = ["logread"]
 
diff --git a/tests/logrotatecase/system.toml b/tests/logrotatecase/system.toml
index 89c794f0d2d..684e0958a7c 100644
--- a/tests/logrotatecase/system.toml
+++ b/tests/logrotatecase/system.toml
@@ -33,15 +33,18 @@ start = ["logd", "compositor", "soundd", "netd", "sshd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 args = ["--rotate-fast"]
 syscap = ["logread"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["soundd", "launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
@@ -49,10 +52,12 @@ syscap = ["rt"]
 # netd holds the NIC's PCI function and drives it: the virtqueues, the register
 # window and the interrupt are its own, and the kernel keeps only the claim.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
 [programs.sshd]
+service = true
 receives = ["netd", "launcher"]
 
 # The union its guest binaries need on this machine shape.
diff --git a/tests/logstallcase/system.toml b/tests/logstallcase/system.toml
index a136c69e72e..7e48fa2a101 100644
--- a/tests/logstallcase/system.toml
+++ b/tests/logstallcase/system.toml
@@ -8,6 +8,7 @@
 start = ["logd", "soundd", "test-runner"]
 
 [programs.logd]
+service = true
 args = [
     "--stall=soundd",
     "--stall-until=soundd_log_stall: the tone has played, and logd may read soundd again",
@@ -15,6 +16,7 @@ args = [
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/logstreamcase/system.toml b/tests/logstreamcase/system.toml
index 0b82d2525d5..e79fa339727 100644
--- a/tests/logstreamcase/system.toml
+++ b/tests/logstreamcase/system.toml
@@ -9,10 +9,12 @@ start = ["logd", "netd", "test-runner"]
 # `receives = ["netd"]` is what lets `logd` serve this boot's log on the
 # network.
 [programs.logd]
+service = true
 syscap = ["logread"]
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
diff --git a/tests/logstreame1000case/system.toml b/tests/logstreame1000case/system.toml
index 0b8cd5682c6..ac190b0b7a2 100644
--- a/tests/logstreame1000case/system.toml
+++ b/tests/logstreame1000case/system.toml
@@ -9,10 +9,12 @@ start = ["logd", "netd", "test-runner"]
 # `receives = ["netd"]` is what lets `logd` serve this boot's log on the
 # network.
 [programs.logd]
+service = true
 syscap = ["logread"]
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:10d3"]
 
diff --git a/tests/metalcase/system.toml b/tests/metalcase/system.toml
index 80371614005..eeca4fe25ed 100644
--- a/tests/metalcase/system.toml
+++ b/tests/metalcase/system.toml
@@ -27,14 +27,17 @@ start = ["logd", "compositor", "soundd", "netd", "sshd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["soundd", "launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
@@ -42,10 +45,12 @@ syscap = ["rt"]
 # netd holds the NIC's PCI function and drives it: the virtqueues, the register
 # window and the interrupt are its own, and the kernel keeps only the claim.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
 [programs.sshd]
+service = true
 receives = ["netd", "launcher"]
 
 # The union its guest binaries need on this machine shape.
diff --git a/tests/metaldevicecase/system.toml b/tests/metaldevicecase/system.toml
index 4240e42dc1f..0f7989fd49d 100644
--- a/tests/metaldevicecase/system.toml
+++ b/tests/metaldevicecase/system.toml
@@ -15,9 +15,11 @@
 start = ["logd", "soundd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio"]
 syscap = ["rt"]
diff --git a/tests/netcase/system.toml b/tests/netcase/system.toml
index e4ec788892a..1ae7dc9ddde 100644
--- a/tests/netcase/system.toml
+++ b/tests/netcase/system.toml
@@ -14,6 +14,7 @@ start = ["logd", "netd", "test-runner"]
 # kernel keeps the record ring and writes no file, so such a boot's `/log` is
 # empty. It claims no device and serves no port.
 [programs.logd]
+service = true
 syscap = ["logread"]
 # What lets `logd` serve this boot's log on the network, to whoever connects:
 # without it the log is served on this machine only.
@@ -24,6 +25,7 @@ receives = ["netd"]
 # Named by vendor and device rather than by slot, so one row finds the card
 # wherever firmware put it.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
diff --git a/tests/partclaimcase/system.toml b/tests/partclaimcase/system.toml
index e7d575d8e10..91e410712aa 100644
--- a/tests/partclaimcase/system.toml
+++ b/tests/partclaimcase/system.toml
@@ -16,9 +16,11 @@ start = ["logd", "soundd", "test-runner"]
 # It claims no device and serves no port: its whole authority
 # is `logread`, which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/pkgcase/system.toml b/tests/pkgcase/system.toml
index 26b620e0c46..e4e992dba9d 100644
--- a/tests/pkgcase/system.toml
+++ b/tests/pkgcase/system.toml
@@ -22,14 +22,17 @@ receives = ["compositor", "soundd"]
 # boot config without `logd` is a boot whose `/log` is empty —
 # `every_boot_config_runs_logd` is what refuses one.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["soundd", "launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/quiescecase/system.toml b/tests/quiescecase/system.toml
index 29362fd0b4e..24fe5602bd0 100644
--- a/tests/quiescecase/system.toml
+++ b/tests/quiescecase/system.toml
@@ -5,6 +5,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 # `power` because the job ends the machine, `dup` because the runner passes a
diff --git a/tests/quiescelastcase/system.toml b/tests/quiescelastcase/system.toml
index dcbc59becd3..e0a4c72aca9 100644
--- a/tests/quiescelastcase/system.toml
+++ b/tests/quiescelastcase/system.toml
@@ -4,6 +4,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 # `power` because the job ends the machine, `dup` because the runner passes a
diff --git a/tests/quiescetwicecase/system.toml b/tests/quiescetwicecase/system.toml
index 170437972a4..3bed5458de3 100644
--- a/tests/quiescetwicecase/system.toml
+++ b/tests/quiescetwicecase/system.toml
@@ -3,6 +3,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 # `power` because the job ends the machine, `logread` because the second
diff --git a/tests/ssh-client-host/Cargo.lock b/tests/ssh-client-host/Cargo.lock
index 77f19e1f490..a93acc436ec 100644
--- a/tests/ssh-client-host/Cargo.lock
+++ b/tests/ssh-client-host/Cargo.lock
@@ -1848,7 +1848,7 @@ dependencies = [
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-manifest"
diff --git a/tests/sshdcase/system.toml b/tests/sshdcase/system.toml
index 97c3990fc3f..09320cddb9b 100644
--- a/tests/sshdcase/system.toml
+++ b/tests/sshdcase/system.toml
@@ -21,15 +21,18 @@ start = ["logd", "netd", "sshd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 # netd holds the NIC's PCI function and drives it: the virtqueues, the register
 # window and the interrupt are its own, and the kernel keeps only the claim.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
 [programs.sshd]
+service = true
 receives = ["netd", "launcher"]
 
 # `logread` is the log gate's own: a spawned test binary does not inherit a
diff --git a/tests/swapcase/system.toml b/tests/swapcase/system.toml
index b85f06be8c9..1c85d1576c5 100644
--- a/tests/swapcase/system.toml
+++ b/tests/swapcase/system.toml
@@ -11,18 +11,21 @@
 start = ["logd", "netd", "sshd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 # The record stream's authority: the address on the parameter line is
 # information, and this row is the whole of what can act on it.
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
 # `swap` is the authority to replace a service's binary, and no other program
 # may hold it.
 [programs.sshd]
+service = true
 receives = ["netd", "launcher", "swap"]
 
 [programs.test-runner]
diff --git a/tests/testcases/system.toml b/tests/testcases/system.toml
index fd171f668fc..f06fcd532a9 100644
--- a/tests/testcases/system.toml
+++ b/tests/testcases/system.toml
@@ -10,9 +10,11 @@ start = ["logd", "soundd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/toyos-rust-tests/Cargo.lock b/tests/toyos-rust-tests/Cargo.lock
index dccd3bdb299..4ffdabb3e82 100644
--- a/tests/toyos-rust-tests/Cargo.lock
+++ b/tests/toyos-rust-tests/Cargo.lock
@@ -111,8 +111,8 @@ dependencies = [
 name = "blockd"
 version = "0.0.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-blockhold",
  "toyos-blockring",
  "toyos-gpt",
@@ -1453,9 +1453,9 @@ dependencies = [
 
 [[package]]
 name = "toyos"
-version = "0.14.0"
+version = "0.15.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -1472,7 +1472,7 @@ checksum = "ec119a115b619cec7ca5e56858e98db6558658d6cc9b400906187e62f2877f48"
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-blockhold"
@@ -1512,7 +1512,7 @@ version = "0.1.0"
 name = "toyos-inspect"
 version = "0.1.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -1534,8 +1534,8 @@ dependencies = [
  "rustls-pki-types",
  "rustls-rustcrypto",
  "sha2",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-blockring",
  "toyos-dns",
  "toyos-fat32",
@@ -1558,10 +1558,10 @@ version = "0.1.0"
 
 [[package]]
 name = "toyos-window"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-font",
  "toyos-keymap",
 ]
diff --git a/tests/toyos-rust-tests/src/bin/hierarchy_paths.rs b/tests/toyos-rust-tests/src/bin/hierarchy_paths.rs
index d76341bad35..b3446ceade3 100644
--- a/tests/toyos-rust-tests/src/bin/hierarchy_paths.rs
+++ b/tests/toyos-rust-tests/src/bin/hierarchy_paths.rs
@@ -15,8 +15,9 @@ use std::io::Write;
 use toyos_abi::syscall::{self, OpenFlags, SyscallError};
 
 /// `vfs::ROOT_ENTRIES`: the kernel's set and this one are two spellings of the
-/// hierarchy, so a boot that grew an eighth entry reds here.
-const ROOT_ENTRIES: [&str; 7] = ["apps", "boot", "home", "log", "media", "system", "tmp"];
+/// hierarchy, so a boot that grew another entry reds here.
+const ROOT_ENTRIES: [&str; 9] =
+    ["apps", "boot", "config", "home", "log", "media", "state", "system", "tmp"];
 
 /// Mirrored in `tests/common/storage.rs`, whose reader sees them without the
 /// mount point, inside the one volume.
diff --git a/tests/toyos-rust-tests/src/bin/home_absent.rs b/tests/toyos-rust-tests/src/bin/home_absent.rs
index 2ca4a7aac72..3d3071f4e71 100644
--- a/tests/toyos-rust-tests/src/bin/home_absent.rs
+++ b/tests/toyos-rust-tests/src/bin/home_absent.rs
@@ -1,28 +1,26 @@
-//! On a boot where the DATA volume is ours and did not mount, `/apps` and
-//! `/home` must never come back as a place to write: the kernel's own log
-//! line and the byte-identical image (asserted on the host, in
-//! `tests/common/storage.rs`) do not observe that from inside the guest — this
-//! does. Driven by `broken_data_volume_is_absent` and
+//! On a boot where the DATA volume is ours and did not mount, `/apps`,
+//! `/config`, `/home` and `/state` must never come back as a place to write:
+//! the kernel's own log line and the byte-identical image (asserted on the
+//! host, in `tests/common/storage.rs`) do not observe that from inside the
+//! guest — this does. Driven by `broken_data_volume_is_absent` and
 //! `data_candidate_with_bad_geometry_is_absent` alone: every other boot mounts
-//! `/apps` and `/home`, on the DATA volume or on a tmpfs, and every check
-//! below would fail on it.
+//! the four, on the DATA volume or on a tmpfs, and every check below would
+//! fail on it.
 
 use std::io::ErrorKind;
 
 fn main() {
     let mut wrong = Vec::new();
 
-    match std::fs::write("/home/x", b"should never land") {
-        Err(e) if e.kind() == ErrorKind::PermissionDenied => {}
-        other => wrong.push(format!("writing /home/x: {other:?}, want PermissionDenied")),
-    }
-    match std::fs::write("/apps/x", b"should never land") {
-        Err(e) if e.kind() == ErrorKind::PermissionDenied => {}
-        other => wrong.push(format!("writing /apps/x: {other:?}, want PermissionDenied")),
+    for dir in ["/apps", "/config", "/home", "/state"] {
+        match std::fs::write(format!("{dir}/x"), b"should never land") {
+            Err(e) if e.kind() == ErrorKind::PermissionDenied => {}
+            other => wrong.push(format!("writing {dir}/x: {other:?}, want PermissionDenied")),
+        }
     }
-    match std::env::set_current_dir("/home/root") {
+    match std::env::set_current_dir("/home/toy") {
         Err(e) if e.kind() == ErrorKind::NotFound => {}
-        other => wrong.push(format!("chdir /home/root: {other:?}, want NotFound")),
+        other => wrong.push(format!("chdir /home/toy: {other:?}, want NotFound")),
     }
     match std::fs::read_dir("/home") {
         Ok(entries) => {
@@ -35,5 +33,8 @@ fn main() {
     }
 
     assert!(wrong.is_empty(), "an absent DATA volume was not absent:\n{}", wrong.join("\n"));
-    println!("home-absent: /home and /apps refused every write, and /home/root every chdir and listing");
+    println!(
+        "home-absent: /apps, /config, /home and /state refused every write, and /home/toy every \
+         chdir and listing"
+    );
 }
diff --git a/tests/toyos-rust-tests/src/bin/launcher_refusals.rs b/tests/toyos-rust-tests/src/bin/launcher_refusals.rs
index ba11086c7fd..ee7ccb2c392 100644
--- a/tests/toyos-rust-tests/src/bin/launcher_refusals.rs
+++ b/tests/toyos-rust-tests/src/bin/launcher_refusals.rs
@@ -111,7 +111,7 @@ fn launcher() -> Connection {
 /// back from.
 fn answer_within(conn: &Connection, budget: Duration) -> Result<u32, &'static str> {
     let deadline = Instant::now() + budget;
-    // The replies are bare headers, so nothing of a payload has to be kept.
+    // Only the reply's type is judged here, so nothing of a payload is kept.
     let mut rx = FrameRx::<0>::new();
     loop {
         match rx.pump(conn) {
diff --git a/tests/toyos-rust-tests/src/bin/layout_paths.rs b/tests/toyos-rust-tests/src/bin/layout_paths.rs
new file mode 100644
index 00000000000..7c6779976b0
--- /dev/null
+++ b/tests/toyos-rust-tests/src/bin/layout_paths.rs
@@ -0,0 +1,107 @@
+//! Where a fresh boot puts things: the session user's home, each service's own
+//! `/state`, the machine's keyboard layout in `/config`, the shell's history in
+//! its own folder, and no dotfile anywhere ToyOS's own programs write.
+//!
+//! Driven by `layout_fresh_boot` alone, over ssh on `tests/layoutcase`, after
+//! `locale <argv[1]>` and an interactive shell that ran `<argv[2]>`. No row
+//! declares this binary, so sshd, a service whose own `HOME` is `/state/sshd`,
+//! spawns it directly, and the `HOME` it reads is the one init answered for it.
+
+use std::fs;
+use std::io::ErrorKind;
+use std::path::Path;
+
+/// init's `HOME_FOLDERS`: the session home's listing, exactly.
+const HOME_FOLDERS: [&str; 8] =
+    ["Apps", "Desktop", "Documents", "Downloads", "Fonts", "Music", "Pictures", "Videos"];
+
+/// The services `tests/layoutcase` runs: `/state`'s listing, exactly.
+const SERVICES: [&str; 3] = ["logd", "netd", "sshd"];
+
+/// Every volume a ToyOS program writes to.
+const WRITTEN: [&str; 6] = ["/apps", "/config", "/home", "/log", "/state", "/tmp"];
+
+/// Asked by literal path, so a constant that moved is a red here.
+const LAYOUT_FILE: &str = "/config/keyboard-layout";
+const HISTORY_FILE: &str = "/home/toy/Apps/shell/State/history";
+
+/// The directory names `dir` lists, sorted.
+fn listed_dirs(dir: &str) -> Result<Vec<String>, String> {
+    let mut names = Vec::new();
+    for entry in fs::read_dir(dir).map_err(|e| format!("read_dir {dir}: {e}"))? {
+        let entry = entry.map_err(|e| format!("an entry of {dir}: {e}"))?;
+        if entry.file_type().map_err(|e| format!("{dir}: {e}"))?.is_dir() {
+            names.push(entry.file_name().to_string_lossy().into_owned());
+        }
+    }
+    names.sort();
+    Ok(names)
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    let [_, layout, typed] = args.as_slice() else {
+        panic!("usage: layout_paths <layout locale set> <line the shell ran>, got {args:?}");
+    };
+    let mut wrong = Vec::new();
+
+    let home = std::env::var("HOME");
+    if home.as_deref() != Ok("/home/toy") {
+        wrong.push(format!("HOME is {home:?}, want /home/toy"));
+    }
+    let std_home = std::env::home_dir();
+    if std_home.as_deref() != Some(Path::new("/home/toy")) {
+        wrong.push(format!("std::env::home_dir() is {std_home:?}, want /home/toy"));
+    }
+
+    match fs::metadata("/home/root") {
+        Err(e) if e.kind() == ErrorKind::NotFound => {}
+        other => wrong.push(format!("/home/root: {other:?}, want NotFound")),
+    }
+    for (dir, want) in [("/home/toy", &HOME_FOLDERS[..]), ("/state", &SERVICES[..])] {
+        match listed_dirs(dir) {
+            Ok(names) if names == want => {}
+            other => wrong.push(format!("{dir} lists {other:?}, want exactly {want:?}")),
+        }
+    }
+    match fs::metadata("/state/sshd/host_ed25519") {
+        Ok(meta) if meta.is_file() && meta.len() > 0 => {}
+        other => wrong.push(format!("/state/sshd/host_ed25519: {other:?}, want a file")),
+    }
+    match fs::read_to_string(LAYOUT_FILE) {
+        Ok(text) if text.trim() == layout => {}
+        other => wrong.push(format!("{LAYOUT_FILE}: {other:?}, want {layout:?}")),
+    }
+    match fs::read_to_string(HISTORY_FILE) {
+        Ok(text) if text.lines().any(|line| line == typed) => {}
+        other => wrong.push(format!("{HISTORY_FILE}: {other:?}, want a line {typed:?}")),
+    }
+
+    let mut dotted = Vec::new();
+    let mut walked = 0usize;
+    let mut pending: Vec<String> = WRITTEN.iter().map(|d| d.to_string()).collect();
+    while let Some(dir) = pending.pop() {
+        for entry in fs::read_dir(&dir).unwrap_or_else(|e| panic!("read_dir {dir}: {e}")) {
+            let entry = entry.expect("dir entry");
+            let name = entry.file_name().to_string_lossy().into_owned();
+            let path = format!("{dir}/{name}");
+            walked += 1;
+            if name.starts_with('.') {
+                dotted.push(path.clone());
+            }
+            if entry.file_type().expect("file type").is_dir() {
+                pending.push(path);
+            }
+        }
+    }
+    if !dotted.is_empty() {
+        wrong.push(format!("a dotfile on a fresh boot: {dotted:?}"));
+    }
+
+    assert!(wrong.is_empty(), "the layout is not as ruled:\n{}", wrong.join("\n"));
+    println!(
+        "layout: HOME=/home/toy, /home/toy lists {HOME_FOLDERS:?}, /state lists {SERVICES:?} \
+         with sshd's key, {LAYOUT_FILE} and {HISTORY_FILE} as written, and none of {walked} \
+         entries under {WRITTEN:?} is a dotfile"
+    );
+}
diff --git a/tests/toyos-rust-tests/src/bin/pkg_launch_gbae.rs b/tests/toyos-rust-tests/src/bin/pkg_launch_gbae.rs
index f1ee8aebfc2..4e447f2820c 100644
--- a/tests/toyos-rust-tests/src/bin/pkg_launch_gbae.rs
+++ b/tests/toyos-rust-tests/src/bin/pkg_launch_gbae.rs
@@ -85,7 +85,7 @@ fn symlink_row() -> std::process::ExitCode {
 /// The real shell binary through `shell -c`, rather than a second copy of what
 /// it does. `-c` roots the cwd at `/`, so the dotted forms are rooted there.
 fn relative_path() -> std::process::ExitCode {
-    const DIR: &str = "/home/root/reltest";
+    const DIR: &str = "/home/toy/reltest";
     const NONCE: &str = "relpath-ran-9c41";
     std::fs::create_dir_all(DIR).expect("/home is writable");
     let link = format!("{DIR}/echo");
@@ -94,7 +94,7 @@ fn relative_path() -> std::process::ExitCode {
         .expect("a symlink under /home is allowed");
 
     let mut ran = 0;
-    for typed in ["./home/root/reltest/echo", "../home/root/reltest/echo"] {
+    for typed in ["./home/toy/reltest/echo", "../home/toy/reltest/echo"] {
         let out = Command::new("/system/bin/shell")
             .arg("-c")
             .arg(format!("{typed} {NONCE}"))
diff --git a/tests/toyos.rs b/tests/toyos.rs
index b79eae489f5..4a5d7898081 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -485,6 +485,9 @@ const RUST_SKIP: &[&str] = &[
     "ftruncate_flush_race",
     // Needs the `smp-skip-ap` boot; `smp_failed_ap_leaves_no_hole` runs it there.
     "smp_hole_shootdown",
+    // Its listings are exact against `tests/layoutcase`, and it takes what that
+    // boot wrote as its argv. `layout_fresh_boot` runs it over ssh.
+    "layout_paths",
     // Needs a package installed under `/apps` and a config whose `[apps]` row
     // is what a launch out of it holds; `pkg_install_gbae` gives both, and on
     // any other boot this exits on a launch nothing could satisfy.
@@ -603,13 +606,13 @@ const SCREEN_TESTS: &[(&str, Sched, Tier)] = &[
 /// The command's *output* differs from the command, which is the whole point:
 /// the shell echoes what is typed, so an assertion satisfiable by the echo says
 /// only that the console drew a key, not that anything ran. This is asserted as
-/// a whole trimmed row, so the echoed `/home/root> echo zqjxk` cannot satisfy
+/// a whole trimmed row, so the echoed `/home/toy> echo zqjxk` cannot satisfy
 /// it either.
 const CONSOLE_NONCE: &str = "zqjxk";
 /// `/system/bin/shell` cds to `$HOME` before its first prompt, and prints
 /// `"{cwd}> "` — without the trailing space, which the decoder trims off the
 /// end of every row.
-const CONSOLE_PROMPT: &str = "/home/root>";
+const CONSOLE_PROMPT: &str = "/home/toy>";
 /// The seed's witness on the panel.
 ///
 /// `/system/bin/console` draws the boot so far, as `logd` serves it, above its
@@ -909,6 +912,9 @@ const MACHINE_TESTS: &[(&str, Sched, Tier)] = &[
     // Its own boot with a NIC under it, because sshd leaves at the bind on
     // every other config. Every verdict is a line of text; no clock in any.
     ("sshd_fail_closed", Sched::Parallel, Tier::Fast),
+    // Its own boot with a blank DATA volume, asked over ssh where everything
+    // it wrote went. Every verdict is a listing or a line; no clock in any.
+    ("layout_fresh_boot", Sched::Parallel, Tier::Fast),
     // One `SSHD_LOGIN` boot for the three, driven by `tests/ssh-client-host`.
     // Adjacent because `group_of` makes adjacency load-bearing, and one tier
     // because one boot cannot be in two. Every verdict is bytes or an exit
@@ -1653,6 +1659,7 @@ const CARRIES: &[(&str, &[&str])] = &[
     ("https_tls13_e1000e", &["test_rs_https_fetch"]),
     ("pkg_install_gbae", &["test_rs_pkg_launch_gbae"]),
     ("apps_and_home_are_one_filesystem", &["test_rs_hierarchy_paths"]),
+    ("layout_fresh_boot", &["test_rs_layout_paths"]),
     ("broken_data_volume_is_absent", &["test_rs_home_absent"]),
     ("data_candidate_with_bad_geometry_is_absent", &["test_rs_home_absent"]),
     ("home_budget_refusal_retried", &["test_rs_home_fsync_budget"]),
@@ -5196,7 +5203,7 @@ fn run_screen_test(
             let after = dump.console_text(&font);
             print_screen(name, &after);
             // A whole trimmed row, because the shell echoes what is typed:
-            // `contains` would be satisfied by `/home/root> echo zqjxk`, which
+            // `contains` would be satisfied by `/home/toy> echo zqjxk`, which
             // says the console drew a keystroke and nothing about anything
             // having run.
             if !dump.console_rows(&font).iter().any(|r| r.trim() == CONSOLE_NONCE) {
@@ -14722,7 +14729,7 @@ fn run_machine_test(
         "sshd_fail_closed" => {
             // sshd with a network under it — the only boot that gets past its
             // bind. What that reaches for the first time is the daemon's own
-            // state on disk: the identity it mints under `/home`, and the file
+            // state on disk: the identity it mints under `/state/sshd`, and the file
             // it authenticates against.
             //
             // The verdict is that it authenticates nobody and says which file
@@ -14741,17 +14748,17 @@ fn run_machine_test(
             let mut qemu = QemuInstance::boot_with_options(&config, &[], &[], options);
             let mut console = qemu.boot_log().to_string();
 
-            // Minting proves `/home/root/.ssh` is creatable and writable from
-            // userland; the fingerprint proves the key it wrote reads back.
+            // Minting proves init made `/state/sshd` and set it as the daemon's
+            // `HOME`; the fingerprint proves the key it wrote reads back.
             //
             // **Both files are named, because either one alone authorizes.**
             // This boot stages neither, so the daemon has to report both as
             // unreadable — a check on only the writable one would pass a
             // machine whose image file was silently never consulted.
             const WANT: [&str; 5] = [
-                "sshd: minted a new host identity at /home/root/.ssh/host_ed25519",
+                "sshd: minted a new host identity at /state/sshd/host_ed25519",
                 "sshd: host identity SHA256:",
-                "sshd: cannot read /home/root/.ssh/authorized_keys",
+                "sshd: cannot read /state/sshd/authorized_keys",
                 "sshd: cannot read /system/etc/ssh_authorized_keys",
                 "sshd: no file names a usable key",
             ];
@@ -14774,11 +14781,74 @@ fn run_machine_test(
                 ));
             }
             eprintln!(
-                "  [sshd] host identity minted under /home, and neither authorized_keys file \
+                "  [sshd] host identity minted under /state/sshd, and neither authorized_keys file \
                  left it refusing to listen at all"
             );
             Ok(())
         }
+        "layout_fresh_boot" => {
+            // The layout as ruled, on a boot of its own with a blank DATA
+            // volume, asked over the cable because sshd is the service that
+            // starts programs: a declared shell's `HOME` is init's row answer,
+            // and the judge, declared nowhere, is spawned by sshd directly with
+            // the `HOME` init answered for it. Before the judge, `locale` and
+            // an interactive shell write the two files a session writes.
+            use common::ssh::{self, HOST};
+            const MINTED: &str = "sshd: minted a new host identity at /state/sshd/host_ed25519";
+            const LAYOUT: &str = "de";
+            const TYPED: &str = "echo layout history";
+            let (guest, console) = ssh::boot_case("tests/layoutcase", rust_bins);
+            if !console.contains(MINTED) {
+                return Err(format!("{MINTED:?} never reached the console:\n{console}"));
+            }
+            let identity = ssh::Identity::mint(ssh::KEY)?;
+            let port = guest.ssh_port();
+
+            let home = ssh::ssh_exec(HOST, port, &identity, "shell -c 'echo $HOME'")?;
+            if home.stdout != b"/home/toy\n" || home.status != Some(0) {
+                return Err(format!(
+                    "a launched shell's HOME is {:?} (ended {:?}, stderr {:?}), not /home/toy",
+                    home.stdout_text(),
+                    home.status,
+                    home.stderr_text()
+                ));
+            }
+            let set = ssh::ssh_exec(HOST, port, &identity, &format!("locale {LAYOUT}"))?;
+            if set.status != Some(0) || !set.stdout_text().contains("Keyboard layout set to") {
+                return Err(format!(
+                    "`locale {LAYOUT}` ended {:?} saying {:?} {:?}",
+                    set.status,
+                    set.stdout_text(),
+                    set.stderr_text()
+                ));
+            }
+            let (typed, _) =
+                ssh::ssh_feed(HOST, port, &identity, "shell", format!("{TYPED}\r").as_bytes())?;
+            if typed.status != Some(0) || !typed.stdout_text().contains("layout history") {
+                return Err(format!(
+                    "the interactive shell ended {:?} saying {:?} {:?}",
+                    typed.status,
+                    typed.stdout_text(),
+                    typed.stderr_text()
+                ));
+            }
+            let judge = ssh::ssh_exec(
+                HOST,
+                port,
+                &identity,
+                &format!("test_rs_layout_paths {LAYOUT} '{TYPED}'"),
+            )?;
+            if judge.status != Some(0) {
+                return Err(format!(
+                    "layout_paths ended {:?} over ssh:\n{}\n{}",
+                    judge.status,
+                    judge.stdout_text(),
+                    judge.stderr_text()
+                ));
+            }
+            eprintln!("  [layout] a launched shell's HOME is /home/toy; {}", judge.stdout_text().trim());
+            Ok(())
+        }
         "lan_dhcp_lease" => lan::lan_dhcp_lease(test_config, c_bins, rust_bins),
         "lan_lease_report" => lan::lan_lease_report(test_config, c_bins, rust_bins),
         "lan_talk" => lan::lan_talk(test_config, c_bins, rust_bins),
diff --git a/toyos-abi/Cargo.toml b/toyos-abi/Cargo.toml
index c893e683ad4..724ce7f88c7 100644
--- a/toyos-abi/Cargo.toml
+++ b/toyos-abi/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 description = "The ToyOS kernel ABI: syscall numbers, struct layouts and typed syscall wrappers."
diff --git a/toyos-abi/src/handle.rs b/toyos-abi/src/handle.rs
index 8ff79e6bcaa..a0e1a324cc0 100644
--- a/toyos-abi/src/handle.rs
+++ b/toyos-abi/src/handle.rs
@@ -88,7 +88,7 @@ impl Rights {
     /// On a `SysCap`: read the whole machine's kernel log.
     ///
     /// [`SYS_LOG_READ`] answers every record every CPU wrote, which is every
-    /// process's business and no process's right by default. `/bin/logd` holds
+    /// process's business and no process's right by default. `logd` holds
     /// it because writing `/log` is its job and `test-runner` because a gate
     /// reads what the kernel said; no other program in any boot config does.
     ///
@@ -101,10 +101,10 @@ impl Rights {
     /// carries — one bit for both, because a machine taken away from its
     /// processes is the same authority whichever state it is left in. It rides a bit for
     /// the same reason minting a device claim and entering the real-time band
-    /// do: what can cut the power is exactly what `/bin/init` endowed, and
+    /// do: what can cut the power is exactly what `init` endowed, and
     /// there is nothing a program can name to reach it otherwise.
     ///
-    /// The kernel mints one carrying it, at boot, for `/bin/init`
+    /// The kernel mints one carrying it, at boot, for `init`
     /// (`kernel::loader::spawn_init`); every other holder is a narrowed
     /// duplicate init endowed from a `system.toml` row that named `power`.
     ///
@@ -120,7 +120,7 @@ impl Rights {
     /// ambient; the entries are a census of what the machine is running, and a
     /// process that was endowed one connector has no business reading it.
     ///
-    /// `/bin/toybox` holds it because `/bin/ps` is that binary under another
+    /// `toybox` holds it because `ps` is that binary under another
     /// name, and `test-runner` because several guest binaries read their own
     /// threads back out of the roster.
     ///
diff --git a/toyos-abi/src/lib.rs b/toyos-abi/src/lib.rs
index 4633f35d479..27fa4b03553 100644
--- a/toyos-abi/src/lib.rs
+++ b/toyos-abi/src/lib.rs
@@ -79,7 +79,7 @@ impl core::ops::Add for Tid {
 /// **The three handles are installed by the read that answers this.** A
 /// description is a set of buffers, and the process being told about them is
 /// the one that must be able to map them — which is never the process that
-/// minted the claim, because `/bin/init` mints every claim and holds none.
+/// minted the claim, because `init` mints every claim and holds none.
 #[repr(C)]
 #[derive(Clone, Copy)]
 pub struct FramebufferInfo {
diff --git a/toyos-abi/src/part.rs b/toyos-abi/src/part.rs
index 31e09c699f6..76e383dd766 100644
--- a/toyos-abi/src/part.rs
+++ b/toyos-abi/src/part.rs
@@ -1,6 +1,6 @@
 //! What a claim on one GPT partition names and hands its holder.
 //!
-//! A partition is claimed the way a PCI function is: `/bin/init` mints it from a
+//! A partition is claimed the way a PCI function is: `init` mints it from a
 //! `system.toml` `devices` entry and endows it, and the holder reads and writes
 //! the partition's blocks through [`syscall::partition_read`] and
 //! [`syscall::partition_write`], durable at [`syscall::fsync`] on the claim.
diff --git a/toyos-abi/src/syscall.rs b/toyos-abi/src/syscall.rs
index f7000524559..dcb1cd8abc0 100644
--- a/toyos-abi/src/syscall.rs
+++ b/toyos-abi/src/syscall.rs
@@ -265,7 +265,7 @@ pub const SYS_PROCESS_KILL: u64 = 109;
 /// A `Process` handle for a pid, gated by [`Rights::MANAGE`] on a `SysCap`.
 /// See [`process_open`].
 ///
-/// The one place a pid becomes authority, and only `/bin/init` holds a cap that
+/// The one place a pid becomes authority, and only `init` holds a cap that
 /// carries the right — so the set of processes that can reach a process they
 /// did not start is exactly what init endowed.
 ///
@@ -273,7 +273,7 @@ pub const SYS_PROCESS_KILL: u64 = 109;
 pub const SYS_PROCESS_OPEN: u64 = 110;
 
 /// Mint a device claim for a class, gated by [`Rights::DEVICE`] on a `SysCap`.
-/// Only `/bin/init` holds such a cap, so the set of processes that can ever
+/// Only `init` holds such a cap, so the set of processes that can ever
 /// claim a device is exactly what init endowed. See [`device_claim`].
 ///
 /// [`Rights::DEVICE`]: crate::handle::Rights::DEVICE
@@ -301,7 +301,7 @@ pub const SYS_RT_ENTER: u64 = 112;
 /// [`crate::log`].
 ///
 /// **The kernel keeps no per-reader state**, so a second reader costs nothing
-/// and the stream is not consumed: `/bin/logd` and a `log-follow` tool coexist
+/// and the stream is not consumed: `logd` and a `log-follow` tool coexist
 /// with no coordination. Reading the whole machine's log is authority, which is
 /// why it rides a right rather than being ambient.
 ///
@@ -411,7 +411,7 @@ pub struct EndowEntry {
 
 const _: () = assert!(core::mem::size_of::<EndowEntry>() == 16);
 
-/// The label the kernel puts on `/bin/init`'s system capability, and the one
+/// The label the kernel puts on `init`'s system capability, and the one
 /// init puts on the `RT`-only dup it endows a `realtime` program.
 ///
 /// Here rather than in the SDK because the kernel writes it and userland reads
@@ -1195,7 +1195,7 @@ pub fn reboot(syscap: RawHandle) -> SyscallError {
 /// `devices` entry and a `dev:` endowment label spell each one with.
 ///
 /// **One row per class, so the four cannot disagree.** The build system checks
-/// a config against this table, `/bin/init` mints from it, and a claimant finds
+/// a config against this table, `init` mints from it, and a claimant finds
 /// its own claim by it; a second spelling anywhere is a class a config can name
 /// and no program can find. The wire number is here too, because a class whose
 /// number and name came from different lists is the same defect one level down.
diff --git a/toyos-manifest/src/lib.rs b/toyos-manifest/src/lib.rs
index c0330bb428c..b65a479f850 100644
--- a/toyos-manifest/src/lib.rs
+++ b/toyos-manifest/src/lib.rs
@@ -20,6 +20,7 @@
 //! receive <name>            a connector in this program's namespace
 //! device <class>            a claim init mints and endows
 //! syscap <right>            a right on the SysCap dup init endows
+//! service                   a system service: its `HOME` is `/state/<name>`, not the session's
 //! init-serve <name>         a name init serves itself
 //! start <name>              init starts this program at boot
 //! app-receive <name>        a connector every program launched from /apps holds
@@ -42,6 +43,19 @@ pub const GUEST_PATH: &str = "/system/etc/system.manifest";
 /// truncated into some other program's.
 pub const MAX_PROGRAM_NAME: usize = 32;
 
+/// The dev image's one user, until the users track gives init a login row.
+pub const USER: &str = "toy";
+
+/// The session user's home: every program's `HOME` that no service row claims,
+/// a program no row names included.
+pub fn session_home() -> String {
+    format!("/home/{USER}")
+}
+
+/// Where each system service keeps its own persistent data, one directory per
+/// program key.
+pub const STATE: &str = "/state";
+
 pub use toyos_abi::handle::Rights;
 pub use toyos_abi::syscall::{DeviceRequest, DeviceType};
 
@@ -121,6 +135,21 @@ pub struct Program {
     /// the system may enter the RT band, mint a device claim, read the machine
     /// log, list every process in the machine, or power the machine off.
     pub syscap: Vec<String>,
+    /// A system service: its `HOME` is its own [`STATE`] directory rather
+    /// than the session user's home, so what it keeps is machine state and no
+    /// user's.
+    pub service: bool,
+}
+
+impl Program {
+    /// The `HOME` init starts this row with. A location grants nothing: what
+    /// the program can reach is its view's business, never this string's.
+    pub fn home(&self) -> String {
+        match self.service {
+            true => format!("{STATE}/{}", self.name),
+            false => session_home(),
+        }
+    }
 }
 
 #[derive(Default, Debug, PartialEq, Eq)]
@@ -185,6 +214,10 @@ pub enum RenderError {
     NameTooLong(String),
     /// A field whose bytes would not survive the round trip.
     Unrepresentable { program: String, field: &'static str, value: String },
+    /// A row that serves a machine-wide port and is not marked a service, so
+    /// init would start it in the session user's home. A service that serves
+    /// nothing (`sshd`) cannot be told from its row, and is marked by hand.
+    ServesWithoutService(String),
 }
 
 pub fn render(manifest: &Manifest) -> Result<Vec<u8>, RenderError> {
@@ -195,6 +228,9 @@ pub fn render(manifest: &Manifest) -> Result<Vec<u8>, RenderError> {
         }
         check(&program.name, "name", &program.name)?;
         check(&program.name, "path", &program.path)?;
+        if !program.serves.is_empty() && !program.service {
+            return Err(RenderError::ServesWithoutService(program.name.clone()));
+        }
         out.push_str(&format!("program {} {}\n", program.name, program.path));
         for arg in &program.args {
             reject_newline(&program.name, "args", arg)?;
@@ -219,6 +255,9 @@ pub fn render(manifest: &Manifest) -> Result<Vec<u8>, RenderError> {
                 out.push_str(&format!("{word} {value}\n"));
             }
         }
+        if program.service {
+            out.push_str("service\n");
+        }
     }
     for name in &manifest.init_serves {
         check("init", "init_serves", name)?;
@@ -301,6 +340,7 @@ pub fn parse(text: &str) -> Manifest {
                     "receive" => program.receives.push(rest.to_string()),
                     "device" => program.devices.push(rest.to_string()),
                     "syscap" => program.syscap.push(rest.to_string()),
+                    "service" => program.service = true,
                     other => panic!("manifest: unknown record `{other}`"),
                 }
             }
@@ -322,6 +362,7 @@ mod tests {
                     serves: vec!["compositor".into()],
                     receives: vec!["soundd".into(), "launcher".into()],
                     devices: vec!["framebuffer".into(), "keyboard".into()],
+                    service: true,
                     ..Program::default()
                 },
                 Program {
@@ -330,6 +371,7 @@ mod tests {
                     serves: vec!["soundd".into()],
                     devices: vec!["hda-audio".into(), "virtio-sound".into()],
                     syscap: vec!["rt".into()],
+                    service: true,
                     ..Program::default()
                 },
                 Program {
@@ -368,6 +410,31 @@ mod tests {
         assert_eq!(parse(std::str::from_utf8(&rendered).unwrap()), manifest);
     }
 
+    /// A row that serves a machine-wide port is a service, and one not marked
+    /// so is refused rather than started in the session user's home.
+    #[test]
+    fn a_row_that_serves_a_port_and_is_no_service_is_refused() {
+        let mut manifest = sample();
+        manifest.programs[0].service = false;
+        assert_eq!(
+            render(&manifest),
+            Err(RenderError::ServesWithoutService("compositor".into()))
+        );
+    }
+
+    /// A service keeps machine state under its own name, everything else is
+    /// the session's; and a package's synthesized row is never a service.
+    #[test]
+    fn a_service_s_home_is_its_state_and_every_other_row_s_the_session_s() {
+        let m = sample();
+        assert_eq!(m.program("soundd").unwrap().home(), "/state/soundd");
+        assert_eq!(m.program("terminal").unwrap().home(), "/home/toy");
+        assert_eq!(m.app_row("gbae", "/apps/gbae/gbae").home(), "/home/toy");
+        let m = parse("program sshd /system/bin/sshd\nservice\nprogram shell /system/bin/shell\n");
+        assert!(m.program("sshd").unwrap().service);
+        assert!(!m.program("shell").unwrap().service);
+    }
+
     #[test]
     fn the_same_manifest_renders_to_the_same_bytes() {
         assert_eq!(render(&sample()), render(&sample()));
diff --git a/toyos-manifest/src/package.rs b/toyos-manifest/src/package.rs
index fee8bb51e99..0b22d326d77 100644
--- a/toyos-manifest/src/package.rs
+++ b/toyos-manifest/src/package.rs
@@ -278,12 +278,12 @@ mod tests {
     /// Checked against the gate itself, not a shape written down twice.
     #[test]
     fn what_a_shell_resolves_is_what_the_launcher_accepts() {
-        let cwd = "/home/root/reltest";
+        let cwd = "/home/toy/reltest";
         for (typed, want) in [
-            ("./foo", "/home/root/reltest/foo"),
-            ("../bin/foo", "/home/root/bin/foo"),
-            ("./a/./b/../c", "/home/root/reltest/a/c"),
-            ("sub/foo", "/home/root/reltest/sub/foo"),
+            ("./foo", "/home/toy/reltest/foo"),
+            ("../bin/foo", "/home/toy/bin/foo"),
+            ("./a/./b/../c", "/home/toy/reltest/a/c"),
+            ("sub/foo", "/home/toy/reltest/sub/foo"),
             ("/system/bin/toybox", "/system/bin/toybox"),
             ("/system//bin/./toybox", "/system/bin/toybox"),
             ("/../system/bin/toybox", "/system/bin/toybox"),
diff --git a/toyos/Cargo.lock b/toyos/Cargo.lock
index cc2b0631982..ca59fff5fa1 100644
--- a/toyos/Cargo.lock
+++ b/toyos/Cargo.lock
@@ -10,7 +10,7 @@ checksum = "aa9c45b374136f52f2d6311062c7146bff20fec063c3f5d46a410bd937746955"
 
 [[package]]
 name = "toyos"
-version = "0.14.0"
+version = "0.15.0"
 dependencies = [
  "rustc-std-workspace-core",
  "toyos-abi",
@@ -18,7 +18,7 @@ dependencies = [
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "rustc-std-workspace-core",
 ]
diff --git a/toyos/Cargo.toml b/toyos/Cargo.toml
index 721664c8d04..1336eba01eb 100644
--- a/toyos/Cargo.toml
+++ b/toyos/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "toyos"
-version = "0.14.0"
+version = "0.15.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 description = "The ToyOS userland SDK: typed handles, IPC, ports, namespaces, surfaces and net."
@@ -11,4 +11,4 @@ rustc-dep-of-std = ["core", "toyos-abi/rustc-dep-of-std"]
 
 [dependencies]
 core = { version = "1.0.0", optional = true, package = "rustc-std-workspace-core" }
-toyos-abi = { path = "../toyos-abi", version = "0.13.0", default-features = false }
+toyos-abi = { path = "../toyos-abi", version = "0.14.0", default-features = false }
diff --git a/toyos/src/device.rs b/toyos/src/device.rs
index 7a33978c72a..7e7c8e05ddc 100644
--- a/toyos/src/device.rs
+++ b/toyos/src/device.rs
@@ -1,7 +1,7 @@
 //! Hardware device access.
 //!
 //! Typed device wrappers, one per class. **None of them opens anything**: a
-//! claim is minted by `/bin/init` alone and arrives in this process's endowment
+//! claim is minted by `init` alone and arrives in this process's endowment
 //! table under `dev:<class>`, so [`crate::endow::device`] is the only way to
 //! get one and a program the manifest gives no device cannot express reaching
 //! hardware.
diff --git a/toyos/src/launch.rs b/toyos/src/launch.rs
index fa5e63b6eaa..bbc4a7b06e9 100644
--- a/toyos/src/launch.rs
+++ b/toyos/src/launch.rs
@@ -1,4 +1,4 @@
-//! Asking `/bin/init` to start a declared program.
+//! Asking `init` to start a declared program.
 //!
 //! **`SYS_SPAWN` can only give a child what the caller holds, and that is not
 //! enough.** doom is started from a shell and doom is to hold sound; the shell
@@ -14,7 +14,7 @@
 //! its own manifest row rather than a narrowing of its parent's.
 //!
 //! The wire is a single frame plus one handle batch, and this module is both
-//! halves of it — std's `Command` encodes and `/bin/init` decodes.
+//! halves of it — std's `Command` encodes and `init` decodes.
 
 use crate::ipc::{Connection, IpcError};
 use crate::RawHandle;
@@ -27,6 +27,8 @@ pub const MSG_LAUNCHED: u32 = 2;
 /// No `[programs]` row names that program, so init has nothing to build its
 /// authority from. The caller spawns it directly instead, which gets
 /// inheritance — the right answer for a binary the image did not declare.
+/// The payload is the `HOME` init decides for it, which that spawn carries in
+/// place of the caller's own: a location is init's to hand out, not a parent's.
 pub const MSG_NOT_DECLARED: u32 = 3;
 /// It is declared and did not start: no such file, a full table, a refused
 /// endowment. The reason is in init's log, not in this frame — a caller can do
@@ -55,8 +57,8 @@ const HEADER: usize = 32;
 pub struct Launch<'a> {
     /// The program's path, exactly as the caller resolved it.
     ///
-    /// **Not a `[programs]` key**, because `/bin/ls` is a symlink to
-    /// `/bin/toybox` and the row that says what an applet may hold is
+    /// **Not a `[programs]` key**, because `ls` is a symlink to
+    /// `toybox` and the row that says what an applet may hold is
     /// `toybox`'s. init resolves the path to a key; the caller does not parse
     /// the manifest and there is deliberately no second reader of it.
     pub program: &'a str,
@@ -249,21 +251,27 @@ pub enum LaunchError {
 }
 
 /// What a launch answered.
-pub enum Outcome {
+pub enum Outcome<'a> {
     /// The handle the caller now holds for the child.
     Started(RawHandle),
-    /// Not a `[programs]` key. The caller spawns it directly.
-    NotDeclared,
+    /// Not a `[programs]` key. The caller spawns it directly, with `home` as
+    /// its `HOME`.
+    NotDeclared { home: &'a str },
     /// Declared, and it did not start.
     Refused,
 }
 
-/// Send one launch and read its answer.
+/// Send one launch and read its answer, a `HOME` in `answer`.
 ///
 /// The handles go before the frame that announces them, which is
 /// [`Connection::send_with_handles`]'s whole rule — and the `Process` handle
-/// comes back the same way.
-pub fn launch(conn: &Connection, request: &Launch<'_>) -> Result<Outcome, LaunchError> {
+/// comes back the same way. A `HOME` longer than `answer` or not UTF-8 is a
+/// malformed answer, never a shortened one.
+pub fn launch<'a>(
+    conn: &Connection,
+    request: &Launch<'_>,
+    answer: &'a mut [u8],
+) -> Result<Outcome<'a>, LaunchError> {
     let mut buf = [0u8; crate::ipc::MAX_FRAME_LEN as usize];
     let len = request
         .encode(&mut buf)
@@ -277,7 +285,15 @@ pub fn launch(conn: &Connection, request: &Launch<'_>) -> Result<Outcome, Launch
             Some([process]) => Ok(Outcome::Started(process)),
             None => Err(LaunchError::Sent(IpcError::Malformed)),
         },
-        MSG_NOT_DECLARED => Ok(Outcome::NotDeclared),
+        MSG_NOT_DECLARED => {
+            if header.len() as usize > answer.len() {
+                return Err(LaunchError::Sent(IpcError::Malformed));
+            }
+            let len = conn.recv_bytes(&header, answer).map_err(LaunchError::Sent)?;
+            let home = core::str::from_utf8(&answer[..len])
+                .map_err(|_| LaunchError::Sent(IpcError::Malformed))?;
+            Ok(Outcome::NotDeclared { home })
+        }
         MSG_REFUSED => Ok(Outcome::Refused),
         _ => Err(LaunchError::Sent(IpcError::Malformed)),
     }
diff --git a/toyos/src/lib.rs b/toyos/src/lib.rs
index 468c5a5757e..1ef64f67bae 100644
--- a/toyos/src/lib.rs
+++ b/toyos/src/lib.rs
@@ -105,7 +105,7 @@ impl Drop for OwnedHandle {
 
 /// A claimed hardware device, out of this process's endowment table.
 ///
-/// There is no `open`: `/bin/init` mints every claim from the machine's one
+/// There is no `open`: `init` mints every claim from the machine's one
 /// system capability and endows it, so which process drives a device is a fact
 /// the image was built with. See [`endow::device`].
 pub struct Device(pub(crate) OwnedHandle);
diff --git a/toyos/src/log.rs b/toyos/src/log.rs
index 59300e81c11..d82df68fb4c 100644
--- a/toyos/src/log.rs
+++ b/toyos/src/log.rs
@@ -21,7 +21,7 @@ use crate::AsHandle;
 ///
 /// A fresh tail starts at the oldest record every shard still holds, which is
 /// the whole boot on a machine that has not logged 512 records on any CPU yet —
-/// so `/bin/logd` starting late still writes this boot's log from its first
+/// so `logd` starting late still writes this boot's log from its first
 /// line.
 pub struct LogTail {
     cursor: LogCursor,
diff --git a/toyos/src/namespace.rs b/toyos/src/namespace.rs
index 6f2acc14ba9..f3608c4ffbc 100644
--- a/toyos/src/namespace.rs
+++ b/toyos/src/namespace.rs
@@ -60,7 +60,7 @@ pub struct Builder<'a> {
 }
 
 /// A fixed-capacity name blob and vector, so building a namespace needs no
-/// allocator — `/bin/init` builds one per program before anything else runs.
+/// allocator — `init` builds one per program before anything else runs.
 mod heapless_names {
     use toyos_abi::syscall::{MAX_NAMESPACE_ENTRIES, MAX_SERVICE_NAME};
 
diff --git a/toyos/src/net.rs b/toyos/src/net.rs
index d16deaf8b7f..88ff96e3047 100644
--- a/toyos/src/net.rs
+++ b/toyos/src/net.rs
@@ -328,7 +328,7 @@ impl NetdConn {
 /// already exited *succeeds* — the connection queues on a port nobody will
 /// ever accept from — and the hang-up arrives at the first send or the first
 /// read instead. Reporting that as [`NetError::Io`] left every caller unable
-/// to tell "this machine has no network" from "netd failed", and `/bin/sshd`
+/// to tell "this machine has no network" from "netd failed", and `sshd`
 /// panicked across the boot of every NIC-less machine that lost the race
 /// rather than exiting with the line it has for exactly this.
 ///
@@ -603,7 +603,7 @@ mod tests {
 
     /// Everything that is *not* a peer that has gone. Each of these on a
     /// machine with a live netd is a real failure and must reach the caller as
-    /// one — `/bin/sshd` panics on `NetError::Io` by design.
+    /// one — `sshd` panics on `NetError::Io` by design.
     #[test]
     fn nothing_else_becomes_a_missing_netd() {
         for e in [
diff --git a/toyos/src/surface.rs b/toyos/src/surface.rs
index 59703927e66..758730ab7a4 100644
--- a/toyos/src/surface.rs
+++ b/toyos/src/surface.rs
@@ -1,7 +1,7 @@
 //! Key events down the surface tree.
 //!
 //! A **surface** is something with a screen and a keyboard: the compositor's
-//! windows, `/bin/terminal`, `/bin/console`. Its owner reads key transitions
+//! windows, `terminal`, `console`. Its owner reads key transitions
 //! from whatever is above it and decides what they mean — which for a terminal
 //! is bytes on its child's stdin, through a [`toyos_keymap::Translator`] it
 //! owns alone.
@@ -47,10 +47,9 @@ pub const SERVICE: &str = "surface";
 
 /// The file that says which keyboard layout this machine uses.
 ///
-/// One path, read by every translator and written by `locale` alone. It is on
-/// tmpfs until a writable store lands, so it survives a login and not a
-/// reboot.
-pub const LAYOUT_CONFIG: &str = "/home/root/.config/keyboard_layout";
+/// One path, read by every translator and written by `locale` alone. A machine
+/// setting, so it is in `/config` and in no user's home.
+pub const LAYOUT_CONFIG: &str = "/config/keyboard-layout";
 
 /// SAFETY: `RawKeyEvent` is `#[repr(C)]` and two `u8`s, so it has no padding
 /// and no pointers, and every bit pattern of both fields is a valid value —
diff --git a/toyos/src/syscap.rs b/toyos/src/syscap.rs
index 5318fbd979f..2bc9aec4b45 100644
--- a/toyos/src/syscap.rs
+++ b/toyos/src/syscap.rs
@@ -4,7 +4,7 @@
 //! the real-time band, turning a pid into a process handle, listing every
 //! process in the machine, reading what the machine is made of, and taking its
 //! power away, off or back to firmware — and each is one bit on a handle to
-//! this. The kernel makes exactly one at boot, for `/bin/init`, so the set of
+//! this. The kernel makes exactly one at boot, for `init`, so the set of
 //! processes that can ever do any of them is exactly what init endowed.
 
 use toyos_abi::handle::Rights;
@@ -95,7 +95,7 @@ impl SysCap {
     ///
     /// Needs [`Rights::ROSTER`], which is what makes the entries — a pid, a
     /// size, a CPU time and a **name** for every process in the machine — the
-    /// business of `/bin/ps` and not of every program that can make a syscall.
+    /// business of `ps` and not of every program that can make a syscall.
     /// [`crate::system::sysinfo`] is the header on its own and needs nothing.
     ///
     /// A `buf` too small for an entry asks for the header, which this
@@ -131,7 +131,7 @@ impl SysCap {
     ///
     /// The one place a pid becomes authority over anything, and only a cap
     /// carrying [`Rights::MANAGE`] reaches it — which in the whole system is
-    /// `/bin/init`'s.
+    /// `init`'s.
     pub fn open_process(&self, pid: toyos_abi::Pid) -> Result<crate::process::Process, SyscallError> {
         let raw = syscall::process_open(self.0.raw(), pid)?;
         // SAFETY: the kernel installed this handle in this process's table for
diff --git a/userland/Cargo.lock b/userland/Cargo.lock
index 73e16ec672d..f8b20ade8ae 100644
--- a/userland/Cargo.lock
+++ b/userland/Cargo.lock
@@ -289,8 +289,8 @@ dependencies = [
 name = "blockd"
 version = "0.0.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-blockhold",
  "toyos-blockring",
  "toyos-gpt",
@@ -488,13 +488,13 @@ name = "compositor"
 version = "0.1.0"
 dependencies = [
  "sprite",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-desktop",
  "toyos-font 0.2.0",
  "toyos-inspect",
  "toyos-manifest",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -511,11 +511,11 @@ name = "console"
 version = "0.1.0"
 dependencies = [
  "terminal",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-font 0.2.0",
  "toyos-logstream",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -1000,7 +1000,7 @@ version = "0.1.0"
 dependencies = [
  "filepicker-api",
  "toyos-font 0.2.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -1120,16 +1120,16 @@ name = "filepicker"
 version = "0.1.0"
 dependencies = [
  "filepicker-api",
- "toyos 0.14.0",
+ "toyos 0.15.0",
  "toyos-font 0.2.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
 name = "filepicker-api"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
+ "toyos 0.15.0",
 ]
 
 [[package]]
@@ -1138,7 +1138,7 @@ version = "0.1.0"
 dependencies = [
  "sprite",
  "toyos-font 0.2.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -1543,8 +1543,8 @@ dependencies = [
 name = "init"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-logstream",
  "toyos-manifest",
  "toyos-swap",
@@ -1578,8 +1578,8 @@ version = "0.1.0"
 name = "inspect"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-inspect",
 ]
 
@@ -1827,8 +1827,8 @@ checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 name = "logd"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-inspect",
  "toyos-logstream",
  "toyos-swap",
@@ -1863,8 +1863,8 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 name = "metalprobe"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-tco",
 ]
 
@@ -1949,8 +1949,8 @@ name = "netd"
 version = "0.0.0"
 dependencies = [
  "smoltcp",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-dns",
  "toyos-i219",
  "toyos-inspect",
@@ -2332,7 +2332,7 @@ version = "0.1.0"
 dependencies = [
  "filepicker-api",
  "toyos-font 0.2.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -3299,7 +3299,7 @@ dependencies = [
 name = "shell"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
+ "toyos 0.15.0",
  "toyos-manifest",
 ]
 
@@ -3451,8 +3451,8 @@ name = "soundd"
 version = "0.0.0"
 dependencies = [
  "rubato",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-hda",
  "toyos-inspect",
  "toyos-mixer",
@@ -3527,7 +3527,7 @@ dependencies = [
  "rand 0.10.0",
  "russh",
  "tokio",
- "toyos 0.14.0",
+ "toyos 0.15.0",
  "toyos-swap",
  "toyos-tmpdir",
 ]
@@ -3595,17 +3595,17 @@ dependencies = [
 name = "terminal"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
+ "toyos 0.15.0",
  "toyos-font 0.2.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
 name = "test-runner"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-tco",
 ]
 
@@ -3735,10 +3735,10 @@ name = "toybox"
 version = "0.1.0"
 dependencies = [
  "cpal",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-keymap 0.1.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -3761,9 +3761,9 @@ dependencies = [
 
 [[package]]
 name = "toyos"
-version = "0.14.0"
+version = "0.15.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -3780,7 +3780,7 @@ checksum = "ec119a115b619cec7ca5e56858e98db6558658d6cc9b400906187e62f2877f48"
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-blockhold"
@@ -3797,7 +3797,7 @@ dependencies = [
 name = "toyos-desktop"
 version = "0.1.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -3830,7 +3830,7 @@ version = "0.1.0"
 name = "toyos-inspect"
 version = "0.1.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -3851,7 +3851,7 @@ version = "0.1.0"
 name = "toyos-manifest"
 version = "0.1.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -3899,10 +3899,10 @@ dependencies = [
 
 [[package]]
 name = "toyos-window"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-font 0.2.0",
  "toyos-keymap 0.1.0",
 ]
diff --git a/userland/files/src/main.rs b/userland/files/src/main.rs
index ca3c130ac37..27c7a6e1eae 100644
--- a/userland/files/src/main.rs
+++ b/userland/files/src/main.rs
@@ -65,7 +65,7 @@ impl FileBrowser {
         let folder_icon = Sprite::from_svg_colored(&folder_svg, ICON_SIZE as u32, [0xf0, 0xc8, 0x50]);
         let file_icon = Sprite::from_svg_colored(&file_svg, ICON_SIZE as u32, [0xd0, 0xd0, 0xd8]);
 
-        let current_dir = PathBuf::from("/home/root");
+        let current_dir = std::env::home_dir().expect("files: init starts every program with HOME");
 
         let mut browser = Self {
             window,
diff --git a/userland/init/src/main.rs b/userland/init/src/main.rs
index 7279603861a..5bd9ffa1250 100644
--- a/userland/init/src/main.rs
+++ b/userland/init/src/main.rs
@@ -26,6 +26,12 @@
 //! once, so a client's next connect is `ServerGone` exactly as it is for a
 //! server nothing keeps. A program started through `launcher` still gets its
 //! acceptor by move and is started once per boot.
+//!
+//! **Every program it starts gets `HOME` from its row** (`Program::home`), over
+//! anything a launching caller carried: a service its own `/state/<name>`, made
+//! before it runs, and everything else the session user's home, made at boot.
+//! A launch of a program no row names is answered with the session's, which
+//! the caller's direct spawn carries in place of its own.
 
 /// One line, one `write`, into init's own pipe to `logd` ([`Log`]): a line of
 /// init's is a line in the log under init's name, whether or not `logd` has run
@@ -66,6 +72,11 @@ use toyos_abi::syscall::{
 /// manifest carries it as an `init-serve` record.
 const LAUNCHER: &str = "launcher";
 
+/// What init makes in the session user's home before anything runs. English on
+/// disk in every locale: a translation is a label, never a rename.
+const HOME_FOLDERS: [&str; 8] =
+    ["Apps", "Desktop", "Documents", "Downloads", "Fonts", "Music", "Pictures", "Videos"];
+
 /// Connections accepted and not yet carrying a whole launch.
 ///
 /// **The bound is init's handle table, not memory.** A connection nobody has
@@ -177,6 +188,32 @@ impl Log {
     }
 }
 
+/// The session user's home and [`HOME_FOLDERS`]. A boot whose DATA volume did
+/// not mount has no `/home`, which the kernel has already said; this says what
+/// it cost and starts the machine without it.
+fn make_session_home() {
+    let home = toyos_manifest::session_home();
+    if let Err(e) = make_dir(&home) {
+        say!("init: {home} could not be made, so this boot has no session home: {e}");
+        return;
+    }
+    for folder in HOME_FOLDERS {
+        if let Err(e) = make_dir(&format!("{home}/{folder}")) {
+            say!("init: {home}/{folder} could not be made, so the session home has no {folder}: {e}");
+        }
+    }
+}
+
+/// One directory, whose parent is there already. Not `create_dir_all`: DATA
+/// keeps no directories, and the VFS's own record of one takes a child whose
+/// parent it never made, so every level is made in turn.
+fn make_dir(path: &str) -> std::io::Result<()> {
+    match std::fs::create_dir(path) {
+        Err(e) if e.kind() != std::io::ErrorKind::AlreadyExists => Err(e),
+        _ => Ok(()),
+    }
+}
+
 fn main() {
     // Before anything is started, so every program's first line has a pipe to
     // go into, and before init says anything.
@@ -186,6 +223,8 @@ fn main() {
         .take(SYSCAP_LABEL)
         .expect("init: the kernel spawns this program holding the system capability");
 
+    make_session_home();
+
     let text = std::fs::read_to_string(toyos_manifest::GUEST_PATH)
         .unwrap_or_else(|e| panic!("init: cannot read {}: {e}", toyos_manifest::GUEST_PATH));
     let system = toyos_manifest::parse(&text);
@@ -884,11 +923,12 @@ fn serve_launch<'a>(
             &installed
         }
         Resolved::NotDeclared => {
-            // **`try_signal` and not `send`.** A bare header is what every
-            // answer here is, and a blocking write is the other half of the
-            // rule that made the read side an event loop: a client that never
-            // drains its end decides when init runs again.
-            let _ = conn.try_signal(launch::MSG_NOT_DECLARED);
+            // **`try_send_bytes` and not `send`.** A blocking write is the
+            // other half of the rule that made the read side an event loop: a
+            // client that never drains its end decides when init runs again.
+            // The `HOME` is the session's: a program no row names is no service.
+            let home = toyos_manifest::session_home();
+            let _ = conn.try_send_bytes(launch::MSG_NOT_DECLARED, home.as_bytes());
             return;
         }
         Resolved::Refused(why) => {
@@ -1132,6 +1172,16 @@ fn start<'a>(
     command.args(&program.args);
     let booting = log.is_some();
 
+    // **Set here, over whatever a launching caller carried**: the row decides
+    // where a program's home is, and a service's is made before it first runs.
+    let home = program.home();
+    if program.service {
+        if let Err(e) = make_dir(&home) {
+            say!("init: {}: {home} could not be made: {e}", program.name);
+        }
+    }
+    command.env("HOME", &home);
+
     // **Everything endowed stays owned until the spawn that moves it
     // succeeds.** `endow` records a number; a refused spawn moves nothing
     // (`build_child_handles` is all-or-nothing), so a handle whose owner had
diff --git a/userland/libc/Cargo.lock b/userland/libc/Cargo.lock
index e64d16be489..504e96fbadd 100644
--- a/userland/libc/Cargo.lock
+++ b/userland/libc/Cargo.lock
@@ -27,14 +27,14 @@ checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
 [[package]]
 name = "toyos"
-version = "0.14.0"
+version = "0.15.0"
 dependencies = [
  "toyos-abi",
 ]
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-libc"
diff --git a/userland/shell/src/main.rs b/userland/shell/src/main.rs
index 2d99cf5258d..4e88747e6dd 100644
--- a/userland/shell/src/main.rs
+++ b/userland/shell/src/main.rs
@@ -8,7 +8,10 @@ use std::sync::OnceLock;
 
 use toyos::port::Connector;
 
-const HISTORY_PATH: &str = "/home/root/.config/shell_history";
+/// This program's own folder, whose `State` keeps the history: `$HOME` itself
+/// once init makes that folder the shell's `HOME`, and `$HOME/Apps/shell`
+/// while `HOME` is the session's. Never a dotfile in the user's home.
+const OWN_FOLDER: [&str; 2] = ["Apps", "shell"];
 const HISTORY_MAX: usize = 200;
 
 static mut LAST_STATUS: i32 = 0;
@@ -17,9 +20,6 @@ fn main() {
     if env::var_os("PATH").is_none() {
         env::set_var("PATH", "/system/bin");
     }
-    if env::var_os("HOME").is_none() {
-        env::set_var("HOME", "/home/root");
-    }
 
     let args: Vec<String> = env::args().collect();
     if args.len() >= 3 && args[1] == "-c" {
@@ -28,8 +28,9 @@ fn main() {
         std::process::exit(unsafe { LAST_STATUS });
     }
 
-    let home = env::var("HOME").unwrap_or_else(|_| "/".into());
-    let _ = env::set_current_dir(&home);
+    if let Some(home) = env::var_os("HOME") {
+        let _ = env::set_current_dir(home);
+    }
     let mut history = load_history();
     std::os::toyos::io::set_stdin_raw(true);
 
@@ -795,15 +796,27 @@ fn print_help() {
 
 // --- History ---
 
+fn history_path() -> Option<std::path::PathBuf> {
+    let home = std::path::PathBuf::from(env::var_os("HOME")?);
+    let own: std::path::PathBuf = OWN_FOLDER.iter().collect();
+    let folder = if home.ends_with(&own) { home } else { home.join(own) };
+    Some(folder.join("State").join("history"))
+}
+
 fn load_history() -> Vec<String> {
-    fs::read_to_string(HISTORY_PATH)
+    let Some(path) = history_path() else { return Vec::new() };
+    fs::read_to_string(path)
         .map(|s| s.lines().map(String::from).collect())
         .unwrap_or_default()
 }
 
 fn save_history(history: &[String]) {
+    let Some(path) = history_path() else { return };
     let content = history.join("\n");
-    let _ = fs::write(HISTORY_PATH, &content);
+    if let Some(dir) = path.parent() {
+        let _ = fs::create_dir_all(dir);
+    }
+    let _ = fs::write(path, &content);
 }
 
 // --- Readline helpers ---
diff --git a/userland/sshd/src/main.rs b/userland/sshd/src/main.rs
index a49954d42a6..8a2482e5216 100644
--- a/userland/sshd/src/main.rs
+++ b/userland/sshd/src/main.rs
@@ -25,23 +25,30 @@ use russh::server::{Auth, Msg, Server, Session};
 use russh::{Channel, ChannelId, MethodKind, MethodSet};
 use tokio::sync::{mpsc, watch};
 
-/// Where this machine keeps its SSH identity and the keys it trusts. `/home`
-/// is the only mount that is both persistent and writable by userland; where
-/// it is a tmpfs the identity lasts one boot, which the fingerprint printed at
-/// every start is what makes visible.
-const SSH_DIR: &str = "/home/root/.ssh";
-const HOST_KEY: &str = "/home/root/.ssh/host_ed25519";
+/// Where this machine keeps its SSH identity and the keys it trusts: this
+/// daemon's own `HOME`, which init makes `/state/sshd`. Machine state, so it is
+/// in no user's home; where DATA is a tmpfs the identity lasts one boot, which
+/// the fingerprint printed at every start is what makes visible.
+fn state() -> String {
+    let home = std::env::home_dir().expect("sshd: init starts every service with HOME");
+    home.to_str().expect("sshd: HOME is not UTF-8").to_string()
+}
+
+fn host_key_path() -> String {
+    format!("{}/host_ed25519", state())
+}
 
 /// The two files that name who may log in; a key in either authorizes.
 ///
 /// **The second is why a freshly flashed machine can be reached at all.** A
-/// bench boot mints an identity into a `/home` that may be a tmpfs and starts
+/// bench boot mints an identity into a `/state` that may be a tmpfs and starts
 /// with nothing in it, so a key that has to be *installed* before the first
 /// login is a key nobody can install. Neither file is protected from anything
 /// else on the machine — see
 /// `issues/isolation/sshd-authorized-keys-unprotected.md`.
-const AUTHORIZED_KEYS: [&str; 2] =
-    ["/home/root/.ssh/authorized_keys", "/system/etc/ssh_authorized_keys"];
+fn authorized_keys() -> [String; 2] {
+    [format!("{}/authorized_keys", state()), "/system/etc/ssh_authorized_keys".to_string()]
+}
 
 /// How long a program may take none of the input a client is sending before
 /// this daemon stops offering it and the program runs on with a closed stdin.
@@ -69,27 +76,27 @@ const EXTENDED_STDERR: u32 = 1;
 /// over it would change the identity every client has pinned without anyone
 /// asking, which is the one event a host key exists to make noisy.
 fn host_key() -> Result<PrivateKey, String> {
-    match fs::read(HOST_KEY) {
+    let path = host_key_path();
+    match fs::read(&path) {
         Ok(pem) => PrivateKey::from_openssh(&pem).map_err(|e| {
             format!(
-                "{HOST_KEY} is not an OpenSSH private key ({e}); refusing to \
+                "{path} is not an OpenSSH private key ({e}); refusing to \
                  replace it — move it aside to mint a new identity"
             )
         }),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => mint_host_key(),
-        Err(e) => Err(format!("cannot read {HOST_KEY}: {e}")),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => mint_host_key(&path),
+        Err(e) => Err(format!("cannot read {path}: {e}")),
     }
 }
 
-fn mint_host_key() -> Result<PrivateKey, String> {
+fn mint_host_key(path: &str) -> Result<PrivateKey, String> {
     let key = PrivateKey::random(&mut rand::rng(), Algorithm::Ed25519)
         .map_err(|e| format!("cannot generate a host key: {e}"))?;
     let pem = key
         .to_openssh(LineEnding::LF)
         .map_err(|e| format!("cannot encode the host key: {e}"))?;
-    fs::create_dir_all(SSH_DIR).map_err(|e| format!("cannot create {SSH_DIR}: {e}"))?;
-    fs::write(HOST_KEY, pem.as_bytes()).map_err(|e| format!("cannot write {HOST_KEY}: {e}"))?;
-    println!("sshd: minted a new host identity at {HOST_KEY}");
+    fs::write(path, pem.as_bytes()).map_err(|e| format!("cannot write {path}: {e}"))?;
+    println!("sshd: minted a new host identity at {path}");
     Ok(key)
 }
 
@@ -114,7 +121,7 @@ fn authorizes(text: &str, offered: &PublicKey) -> bool {
 /// restart — there is nothing here to send a reload signal to. An unreadable
 /// file names nobody, so every failure answers "not authorized".
 fn is_authorized(key: &PublicKey) -> bool {
-    AUTHORIZED_KEYS
+    authorized_keys()
         .iter()
         .any(|path| fs::read_to_string(path).is_ok_and(|text| authorizes(&text, key)))
 }
@@ -123,8 +130,8 @@ fn is_authorized(key: &PublicKey) -> bool {
 /// visible before somebody tries it. `Err` means nobody can authenticate.
 fn authorized_key_count() -> Result<usize, String> {
     let mut total = 0;
-    for path in AUTHORIZED_KEYS {
-        let text = match fs::read_to_string(path) {
+    for path in authorized_keys() {
+        let text = match fs::read_to_string(&path) {
             Ok(text) => text,
             Err(e) => {
                 println!("sshd: cannot read {path} ({e})");
@@ -154,7 +161,7 @@ fn authorized_key_count() -> Result<usize, String> {
     if total == 0 {
         return Err(format!(
             "no file names a usable key ({}); put a public key in one of them and start again",
-            AUTHORIZED_KEYS.join(" or ")
+            authorized_keys().join(" or ")
         ));
     }
     Ok(total)
diff --git a/userland/toyos-window/Cargo.toml b/userland/toyos-window/Cargo.toml
index 29bafcdffd0..ec9d3753e31 100644
--- a/userland/toyos-window/Cargo.toml
+++ b/userland/toyos-window/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "toyos-window"
-version = "0.15.0"
+version = "0.16.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 description = "Client library for ToyOS windows: create one, draw into it, read its events."
@@ -8,9 +8,9 @@ repository = "https://github.com/ToyOSOrg/ToyOS"
 
 [dependencies]
 toyos-font = { path = "../toyos-font", version = "0.2.0" }
-toyos-abi = { path = "../../toyos-abi", version = "0.13.0" }
+toyos-abi = { path = "../../toyos-abi", version = "0.14.0" }
 toyos-keymap = { path = "../../toyos-keymap", version = "0.1.0" }
-toyos = { path = "../../toyos", version = "0.14.0" }
+toyos = { path = "../../toyos", version = "0.15.0" }
 
 # `window` is taken on crates.io, so the package is `toyos-window`; the lib
 # target keeps the name every caller spells, `toyos/src`'s citations included.
diff --git a/userland/toyos-window/src/lib.rs b/userland/toyos-window/src/lib.rs
index 98c1707d94e..4ceb528dff6 100644
--- a/userland/toyos-window/src/lib.rs
+++ b/userland/toyos-window/src/lib.rs
@@ -10,7 +10,7 @@ use toyos::surface;
 use toyos::Connection;
 use toyos::shm::SharedMemory;
 /// Re-exported because [`KeyPress`] is made of them and a client that holds
-/// its own translator — `/bin/console`, a test that stands in for a surface —
+/// its own translator — `console`, a test that stands in for a surface —
 /// should not have to name a second crate to do what this one does.
 pub use toyos_keymap::{Emit, Mods, Translator};