From d236f71bd3227a7db9f001a39dc7c2577a6857ae Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sat, 26 Sep 2026 17:12:45 +0200
Subject: [PATCH 1/7] The layout as ruled, and its first stage: /home/toy,
 /config, /state, HOME from init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The owner ruled where everything lives on 2026-09-26, and
issues/filesystem/where-everything-lives.md records it: the tree, the rules
(no dotfiles, English names, a path is one file in every view with /tmp the
one exception, locations through environment variables init sets), and the
stages with their exits. The storage track's `## Paths` and the users track
now point at it instead of carrying their own `.config/<app>` layout.

The first stage, the part that needs no isolation:

- `/config` and `/state` are two more names DATA answers to
  (`ROOT_ENTRIES`, `DATA_PATHS`).
- The kernel makes no home. init makes `/home/toy` and Apps, Desktop,
  Documents, Downloads, Fonts, Music, Pictures and Videos at boot, and a
  service's `/state/<name>` before each start.
- A `system.toml` row says `service = true` for a system service, the
  manifest carries it as a `service` record, and `Program::home` answers
  `/state/<name>` for one and `/home/toy` for every other row. init sets
  `HOME` from it on every start, over whatever a launching caller carried.
- std's `home_dir` answers `$HOME`, or `None` when it is unset or empty. The
  runtime used to overwrite `HOME` with `/home/root` and set `XDG_CONFIG_HOME`
  at every process start, so nothing a parent passed could survive; that
  seeding is gone (fork commits on wt-toyos-layout).
- The keyboard layout is `/config/keyboard-layout`, a machine setting in no
  user's home (`surface::LAYOUT_CONFIG`; toyos 0.14.0 and toyos-window
  0.15.0, every pin and lockfile with them).
- sshd keeps its identity and key list in its own `HOME`, `/state/sshd`.
- The shell keeps its history in `$HOME/Apps/shell/State/history` and
  invents no `HOME`; the files app starts in `home_dir()`.
- JetBrains Mono ships as a TTF in `/system/share/fonts`, where the toolkits
  look, with its OFL text in `/system/share/licenses`; NOTICE says so.
- The 26 SDK doc lines naming `/bin` name `/system/bin`, and the Rights::LOG
  doc gate strips that prefix: the issue that tracked them is closed.

`/log/lease.txt` does not move. It is not netd's lease but the
`--exit-with-lease` bench report the metal loop reads off the stick's FAT log
volume, which cannot read DATA; the track says so.

Found on the way and filed: a directory on DATA is the VFS's in-memory
record, absent from every listing of its parent and from the next boot, and
it is taken with no parent — which is why init makes each level in turn.

`layout_fresh_boot` boots tests/sshdcase on a blank DATA volume and asks a
session program's child where everything is.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014iqcj4jDKpaiDX8B7CMvmK
---
 NOTICE                                        |  10 +-
 console/system.toml                           |   1 +
 diag/system.toml                              |   1 +
 ...-home-no-earlier-boot-of-its-lane-wrote.md |   4 +-
 ...-sdk-doc-lines-name-a-path-that-is-gone.md |  43 --------
 ...-on-data-is-in-no-listing-and-no-reboot.md |  41 +++++++
 .../a-user-is-a-home-tree-and-a-login-row.md  |   8 +-
 ...l-c-discards-the-cwd-its-launch-carried.md |   2 +-
 ...ge-is-layers-and-a-role-is-a-filesystem.md |  32 ++----
 issues/filesystem/where-everything-lives.md   | 100 ++++++++++++++++++
 .../sshd-authorized-keys-unprotected.md       |   4 +-
 kernel/src/main.rs                            |  29 ++---
 kernel/src/vfs.rs                             |   3 +-
 rust                                          |   2 +-
 src/assets.rs                                 |  59 ++++++++++-
 src/build.rs                                  |  11 +-
 system.toml                                   |   9 ++
 tests/common/pkg.rs                           |   2 +-
 tests/common/storage.rs                       |   8 +-
 tests/desktopaudiocase/system.toml            |   3 +
 tests/desktopcase/system.toml                 |   2 +
 tests/doomcase/system.toml                    |   2 +
 tests/doommusiccase/system.toml               |   2 +
 tests/e1000case/system.toml                   |   2 +
 tests/e1000leasecase/system.toml              |   2 +
 tests/e1000talkcase/system.toml               |   3 +
 tests/flrswapcase/system.toml                 |   3 +
 tests/inspectcase/system.toml                 |   4 +
 tests/jobcase/system.toml                     |   1 +
 tests/jobdeadlinecase/system.toml             |   1 +
 tests/lancase/system.toml                     |   2 +
 tests/lanicscase/system.toml                  |   2 +
 tests/lanleasecase/system.toml                |   2 +
 tests/lantalkcase/system.toml                 |   3 +
 tests/latencycase/system.toml                 |   1 +
 tests/logholdcase/system.toml                 |   1 +
 tests/logrotatecase/system.toml               |   5 +
 tests/logstallcase/system.toml                |   2 +
 tests/logstreamcase/system.toml               |   2 +
 tests/logstreame1000case/system.toml          |   2 +
 tests/metalcase/system.toml                   |   5 +
 tests/metaldevicecase/system.toml             |   2 +
 tests/netcase/system.toml                     |   2 +
 tests/partclaimcase/system.toml               |   2 +
 tests/pkgcase/system.toml                     |   3 +
 tests/quiescecase/system.toml                 |   1 +
 tests/quiescelastcase/system.toml             |   1 +
 tests/quiescetwicecase/system.toml            |   1 +
 tests/sshdcase/system.toml                    |   3 +
 tests/swapcase/system.toml                    |   3 +
 tests/testcases/system.toml                   |   2 +
 tests/toyos-rust-tests/Cargo.lock             |   8 +-
 .../src/bin/hierarchy_paths.rs                |   5 +-
 tests/toyos-rust-tests/src/bin/home_absent.rs |  35 +++---
 .../toyos-rust-tests/src/bin/layout_paths.rs  |  86 +++++++++++++++
 .../src/bin/pkg_launch_gbae.rs                |   4 +-
 tests/toyos.rs                                |  54 ++++++++--
 toyos-abi/src/handle.rs                       |   8 +-
 toyos-abi/src/lib.rs                          |   2 +-
 toyos-abi/src/part.rs                         |   2 +-
 toyos-abi/src/syscall.rs                      |  10 +-
 toyos-manifest/src/lib.rs                     |  41 +++++++
 toyos-manifest/src/package.rs                 |  10 +-
 toyos/Cargo.lock                              |   2 +-
 toyos/Cargo.toml                              |   2 +-
 toyos/src/device.rs                           |   2 +-
 toyos/src/launch.rs                           |   8 +-
 toyos/src/lib.rs                              |   2 +-
 toyos/src/log.rs                              |   2 +-
 toyos/src/namespace.rs                        |   2 +-
 toyos/src/net.rs                              |   4 +-
 toyos/src/surface.rs                          |   9 +-
 toyos/src/syscap.rs                           |   6 +-
 userland/Cargo.lock                           |  52 ++++-----
 userland/files/src/main.rs                    |   2 +-
 userland/init/src/main.rs                     |  45 ++++++++
 userland/libc/Cargo.lock                      |   2 +-
 userland/shell/src/main.rs                    |  25 +++--
 userland/sshd/src/main.rs                     |  49 +++++----
 userland/toyos-window/Cargo.toml              |   4 +-
 userland/toyos-window/src/lib.rs              |   2 +-
 81 files changed, 689 insertions(+), 237 deletions(-)
 delete mode 100644 issues/build/twenty-seven-sdk-doc-lines-name-a-path-that-is-gone.md
 create mode 100644 issues/filesystem/a-directory-on-data-is-in-no-listing-and-no-reboot.md
 create mode 100644 issues/filesystem/where-everything-lives.md
 create mode 100644 tests/toyos-rust-tests/src/bin/layout_paths.rs

diff --git a/NOTICE b/NOTICE
index b97394572a8..7619294b8b1 100644
--- a/NOTICE
+++ b/NOTICE
@@ -157,8 +157,14 @@ Two derived artifacts come from it, and whether a 1-bit rasterization is still
 - `share/fonts/JetBrainsMono-Regular-8x16.font` on every ROOT that ships
   `assets/`, rasterized at build time by `src/assets.rs`.
 
-The OFL's reserved-name clause is not engaged: neither artifact is distributed
-as a font under the JetBrains Mono name.
+The OFL's reserved-name clause is not engaged: neither derived artifact is
+distributed as a font under the JetBrains Mono name.
+
+The font itself ships unmodified as `share/fonts/jetbrainsmono-regular.ttf` on
+every ROOT that ships `assets/`, the system's monospace family where fontdb and
+fontique look, with its licence text beside it as
+`share/licenses/OFL-1.1-JetBrainsMono.txt`: the OFL permits bundling and
+redistributing it with any software, provided that text travels with it.
 
 
 assets/icons/*.svg — Phosphor Icons, MIT
diff --git a/console/system.toml b/console/system.toml
index e4a9393a78f..64a7407a57f 100644
--- a/console/system.toml
+++ b/console/system.toml
@@ -27,6 +27,7 @@ start = ["logd", "console"]
 # reads the kernel's records with `logread`, which is `Rights::LOG |
 # Rights::WAIT` on a `SysCap` duplicate, and serves `log` to the console.
 [programs.logd]
+service = true
 syscap = ["logread"]
 serves = ["log"]
 
diff --git a/diag/system.toml b/diag/system.toml
index 47b87060ebe..7892237af94 100644
--- a/diag/system.toml
+++ b/diag/system.toml
@@ -36,6 +36,7 @@ start = ["logd", "toybox"]
 # `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands it every
 # program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.toybox]
diff --git a/issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md b/issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md
index 890e24edf3e..3edec411602 100644
--- a/issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md
+++ b/issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md
@@ -4,10 +4,10 @@ kind: tooling
 opened: 2026-09-24
 ---
 
-# `sshd_fail_closed` assumes a `/home` no earlier boot of its lane wrote
+# `sshd_fail_closed` assumes a `/state/sshd` no earlier boot of its lane wrote
 
 `sshd_fail_closed` owes `sshd: minted a new host identity at
-/home/root/.ssh/host_ed25519`, and boots `tests/sshdcase` on the lane's shared
+/state/sshd/host_ed25519`, and boots `tests/sshdcase` on the lane's shared
 scratch disk (`tests/common/qemu.rs`: "Reused across the boots of one lane").
 Any earlier boot of the same lane whose sshd ran leaves its identity on that
 disk, and this boot then reads it and mints nothing.
diff --git a/issues/build/twenty-seven-sdk-doc-lines-name-a-path-that-is-gone.md b/issues/build/twenty-seven-sdk-doc-lines-name-a-path-that-is-gone.md
deleted file mode 100644
index 0d2df595059..00000000000
--- a/issues/build/twenty-seven-sdk-doc-lines-name-a-path-that-is-gone.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-04
----
-
-# Twenty-seven SDK doc lines name `/bin`, which no longer exists
-
-## Reproduction
-
-```
-rg -n --pcre2 '(?<![A-Za-z0-9_/.])/(bin|lib|share|etc)(/|(?![A-Za-z0-9_/.-]))' \
-   toyos-abi/src toyos/src userland/toyos-window/src
-```
-
-Twenty-seven lines, all doc comments: `/bin/init`, `/bin/logd`, `/bin/toybox`,
-`/bin/ps`, `/bin/shutdown`, `/bin/sshd`, `/bin/terminal`, `/bin/console`,
-`/bin/ls`. ROOT mounts at `/system` since the hierarchy landed, so every one of
-them names a path no image carries.
-
-## Why the branch that moved the rest left them
-
-`src/CLAUDE.md`: a doc-comment change under `toyos-abi/src` costs a sysroot
-claim exactly like a layout change (`SYSROOT_SOURCES` in `src/toolchain.rs` is
-`toyos-abi/src`, `toyos/src`, `userland/libc/src`, and `standing` asks `git
-diff` over them). A claim refuses every other checkout on this host until the
-claimant lands, and it also makes the claiming branch unable to build its own
-base — which is the arm a negative control needs. `userland/toyos-window` is
-one of the five crates the ToyOSOrg forks resolve by version off crates.io, so
-a change there is a published bump plus every dependent's pin
-(`src/sdkversion.rs` refuses the pair).
-
-So the cost of correcting these lines is not the lines: it is a sysroot claim
-and an SDK version bump, and neither is worth spending on prose.
-
-## Exit condition
-
-The next branch that claims the sysroot for its own reason deletes them in the
-same commit — deleted rather than corrected, per the owner's rule on wrong
-prose — and `userland/toyos-window`'s one line goes with the next bump of that
-crate. `LOG_DOC_BIN` in `src/build.rs` is the directory the `Rights::LOG` doc
-gate strips, and it moves in that same commit or the gate stops seeing a doc
-that names the wrong one. This file closes when the `rg` above is empty.
diff --git a/issues/filesystem/a-directory-on-data-is-in-no-listing-and-no-reboot.md b/issues/filesystem/a-directory-on-data-is-in-no-listing-and-no-reboot.md
new file mode 100644
index 00000000000..886fe295595
--- /dev/null
+++ b/issues/filesystem/a-directory-on-data-is-in-no-listing-and-no-reboot.md
@@ -0,0 +1,41 @@
+---
+status: open
+kind: defect
+opened: 2026-09-26
+---
+
+# A directory on DATA is in no listing and survives no reboot
+
+The DATA adapter answers every `create_dir` with `NotSupported`
+(`kernel/src/bcachefs_adapter.rs`), so the VFS keeps the directory itself in
+`created_dirs` (`kernel/src/vfs.rs`). Three things follow:
+
+- **No listing of the parent shows it.** `Vfs::list` builds its answer from
+  the filesystem's files and consults `created_dirs` only to decide whether the
+  listed directory itself exists. After init makes `/home/toy` and its eight
+  folders, `ls /home/toy` prints nothing and `ls /home` does not name `toy`.
+  A directory appears in its parent's listing only once a file is under it.
+- **A child is taken whose parent was never made.** `create_dir("/home/toy/Apps")`
+  succeeds with no `/home/toy`, so `std::fs::create_dir_all` makes the leaf and
+  nothing above it, and `read_dir("/home/toy")` then answers `NotFound`. init
+  makes every level in turn for this reason (`make_dir` in
+  `userland/init/src/main.rs`).
+- **It is memory.** Nothing reaches the volume, so an empty directory is gone
+  at the next boot; init remakes the session home and each service's `/state`
+  every boot.
+
+Seen building `layout_fresh_boot`: `read_dir /home/toy: entity not found` from
+a boot whose init had just made `/home/toy/Apps`, which is why
+`tests/toyos-rust-tests/src/bin/layout_paths.rs` asks for each directory by
+name.
+
+## Owner
+
+The storage track, `issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md`:
+real bcachefs under DATA carries directories.
+
+## What would close it
+
+DATA stores directories, `create_dir` refuses a missing parent, a listing names
+every directory under it, and `created_dirs` is gone or kept only for a mount
+that has no directories and says so.
diff --git a/issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md b/issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md
index 6f91bed1942..ec664e139c6 100644
--- a/issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md
+++ b/issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md
@@ -9,15 +9,15 @@ opened: 2026-09-05
 A stage of `issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md`;
 where a program's own data goes depends on it.
 
-A user is two things: `/home/<user>`, a directory on DATA holding Documents,
-Downloads, `.config/<app>` and `.local/<app>`; and a row in the manifest from
+A user is two things: `/home/<user>`, a directory on DATA laid out as
+`issues/filesystem/where-everything-lives.md` rules; and a row in the manifest from
 which init builds a login session's namespace, the way it builds every system
 program's from `system.toml`. Nothing else names a user: no numeric id the
 kernel checks, no password file, no ambient "current user" a process can ask
 for. A session holds its home tree because init moved that directory's handle
 into it, and a program launched inside the session holds what the session's
-launcher row grants it. Until this lands there is one implicit user and a
-package writes under `/apps/<name>/` only.
+launcher row grants it. Until this lands there is one user, `toy`, whose home
+init makes at boot.
 
 Stage 3 of `issues/isolation/every-program-sees-only-the-files-it-was-given.md`, and blocked on its first two stages: a user is isolated only
 once a session's view is all it can name. The mount protocol and real bcachefs
diff --git a/issues/filesystem/shell-c-discards-the-cwd-its-launch-carried.md b/issues/filesystem/shell-c-discards-the-cwd-its-launch-carried.md
index 2664f9f715b..42ce55239fb 100644
--- a/issues/filesystem/shell-c-discards-the-cwd-its-launch-carried.md
+++ b/issues/filesystem/shell-c-discards-the-cwd-its-launch-carried.md
@@ -24,7 +24,7 @@ down, where `set_current_dir(&home)` is at least a stated policy.
 
 ## Reproduction
 
-Spawn `/system/bin/shell` with `Command::current_dir("/home/root")` and the
+Spawn `/system/bin/shell` with `Command::current_dir("/home/toy")` and the
 arguments `-c`, `pwd`. It answers `/`.
 
 Read from the source rather than measured: `pkg_install_gbae`'s
diff --git a/issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md b/issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md
index d7bbac20df5..073bee18eac 100644
--- a/issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md
+++ b/issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md
@@ -41,7 +41,7 @@ volume, handed to whichever driver recognises its superblock.
 |---|---|---|---|
 | ESP | FAT32, firmware's rule | `/boot` | kernel only |
 | ROOT | bcachefs image the build writes | `/system` | no; versioned per release |
-| DATA | bcachefs, formatted on first boot | `/apps`, `/home` | yes |
+| DATA | bcachefs, formatted on first boot | `/apps`, `/config`, `/home`, `/state` | yes |
 | LOG | FAT32 while a Mac has to read the dev stick | `/log` | yes |
 
 `/tmp` has no backing. The dev loop keeps the ESP and ROOT on the stick and
@@ -66,8 +66,8 @@ kernel's `root=` argument, mounted read-only through `ReadOnlyBcacheFsAdapter`
 **Every other filesystem is a userland server** behind the VFS's existing
 trait (`kernel/src/vfs.rs`, `FileSystem`, one access mode per mount) through
 a mount protocol: init's manifest row moves the DATA members' device handles
-into the storage server, which links the whole crate and mounts `/home` and
-`/apps` read-write. A server that crashes loses its mounts and nothing else,
+into the storage server, which links the whole crate and mounts DATA's four
+names read-write. A server that crashes loses its mounts and nothing else,
 and no foreign parser runs in the kernel on bytes another OS wrote. This is
 `issues/kernel/every-driver-is-still-in-the-kernel.md` applied to storage; FAT32
 moves out first, being a pure crate already whose two volumes are the cheapest
@@ -96,25 +96,13 @@ shape if wanted.
 
 ## Paths
 
-No drive letters, no `/usr`, `/var`, `/opt`, `/dev`, `/proc` or `/sys`:
-devices and processes are capabilities and syscalls here, not files. Each
-process sees the part of this hierarchy its parent gave it
-(`issues/isolation/every-program-sees-only-the-files-it-was-given.md`); today paths are still ambient and `/boot`'s mount guard is the one
-restriction.
-
-- `/boot` — bootloader, kernel, kernel arguments.
-- `/system` — the OS image, read-only, versioned: today's `bin`, `lib`, `share`
-  and the manifest.
-- `/apps/<name>` — each installed program in its own directory with its own
-  binaries, data and manifest row; doom moves here with its WAD.
-- `/home/<user>` — Documents, Downloads, `.config/<app>` for settings,
-  `.local/<app>` for saves and caches.
-- `/log`, `/tmp` — as today.
-- `/media/<label>` — foreign and unassigned volumes; a Windows disk is
-  `/media/windows`. A mount point is exactly one top-level name
-  (`kernel/src/vfs.rs`, `ROOT_ENTRIES` and the array indexed by it), so
-  `/media/<label>` is a nested mount the structure cannot represent: the
-  mount protocol owes that, and `/media` is an empty directory until then.
+The tree, its names and how a program finds them are
+`issues/filesystem/where-everything-lives.md`. What this track owes it is the
+mount structure: a mount point is exactly one top-level name
+(`kernel/src/vfs.rs`, `ROOT_ENTRIES` and the array indexed by it), so
+`/media/<label>` for a foreign volume — a Windows disk is `/media/windows` — is
+a nested mount the structure cannot represent. The mount protocol owes that,
+and `/media` is an empty directory until then.
 
 Users are a track of their own,
 `issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md`: a `/home/<user>`
diff --git a/issues/filesystem/where-everything-lives.md b/issues/filesystem/where-everything-lives.md
new file mode 100644
index 00000000000..36aa6ba32ad
--- /dev/null
+++ b/issues/filesystem/where-everything-lives.md
@@ -0,0 +1,100 @@
+---
+status: open
+kind: track
+opened: 2026-09-26
+---
+
+# Where everything lives, and how a program finds it
+
+The owner ruled this layout on 2026-09-26. This file is where it is recorded:
+`issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md` says what
+backs each name, and
+`issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md` and
+`issues/isolation/every-program-sees-only-the-files-it-was-given.md` say who
+may reach it.
+
+## The tree
+
+```
+/system                read-only, signed: bin, lib, etc, and
+                       share/{fonts, icons, themes, sounds, backgrounds, licenses, doc}
+/config                machine settings the owner changes; a file here overrides /system/etc
+/state/<program>       a system service's private persistent data
+/apps/<name>           installed packages; no layout is required inside one
+/home/<user>           Desktop Documents Downloads Music Pictures Videos Fonts Apps/<name>/
+/boot                  bootloader, kernel, kernel arguments; the updater's alone
+/log  /media           logs; foreign volumes, one /media/<label> each
+/tmp                   private per program
+```
+
+## The rules
+
+- **No drive letters, no `/usr`, `/var`, `/opt`, `/dev`, `/proc` or `/sys`**:
+  devices and processes are capabilities and syscalls here, not files.
+- **No dotfile and no hidden folder anywhere in the layout.** A third-party
+  program that hard-codes `~/.something` may still create one, but only inside
+  its own app folder.
+- **English names, never translated.**
+- **A path means the same file in every view.** `/tmp` is the one exception:
+  it is private per program. A view hides names and never renames one.
+- **A program learns a location from an environment variable init sets**
+  (`HOME` and those like it). A location grants nothing, because the view
+  decides what a program can reach. On ToyOS `std::env::home_dir()` is `$HOME`
+  or `None`, with no fallback, and `temp_dir()` is `/tmp`.
+- **`/home/<user>/Apps/<name>` is one app's private data for that user**, and
+  it is that app's `HOME`. Inside it ToyOS answers config, data, cache and
+  state as the visible `Config`, `Data`, `Cache` and `State`.
+- **Fonts**: the system's are in `/system/share/fonts`, a user's in
+  `/home/<user>/Fonts`. sans-serif and system-ui are Open Sans, monospace is
+  JetBrains Mono, and serif is empty until a licence-clean one is chosen.
+- **The time zone is machine-wide in `/config`.** The keyboard layout and the
+  language are machine defaults in `/config`, and per-user overrides come with
+  the users track.
+- **The dev image's user is `toy`.** There is no `root` user and no
+  `/home/root`.
+- An app finds its own files next to its binary (`current_exe()`).
+
+## Stages
+
+1. **Everything that needs no isolation.** `/config` and `/state` are DATA
+   names; init makes `/home/toy`, its eight folders, and each service's
+   `/state/<name>`, and it sets `HOME` from each row (`service = true` in
+   `system.toml`); the kernel makes no home; the keyboard layout is
+   `/config/keyboard-layout`; sshd keeps its identity and key list in
+   `/state/sshd`; the shell's history is `$HOME/Apps/shell/State/history`;
+   std's `home_dir` reads `$HOME`; JetBrains Mono ships as a TTF with its OFL
+   text. **Exit**: `layout_fresh_boot` is green.
+2. **An app's `HOME` is its folder.** init launches an app from `/apps` (and
+   each desktop app in the image) with `HOME=/home/<user>/Apps/<name>`, makes
+   the folder and its `Config Data Cache State`, and puts nothing else of the
+   home in that app's view. It needs
+   `issues/isolation/every-program-sees-only-the-files-it-was-given.md` stage 2.
+   **Exit**: a launched app's `home_dir()` is its folder, and it cannot name
+   another app's folder.
+3. **Users.** The users track creates `/home/<user>` and its folders from a
+   login row, and `toy` stops being a constant in `toyos-manifest`.
+   **Exit**: init names no user.
+4. **The upstream arms**, none opened until the owner opens it:
+   - fontdb and fontique scan `/system/share/fonts` and `$HOME/Fonts` from the
+     start, and fontique maps the families above. **Exit**: both prepared
+     branches carry both folders and the family table.
+   - dirs-sys answers `home_dir` from std, and the six user folders and the
+     four `Config Data Cache State` directories under `$HOME` by their names
+     here. **Exit**: `dirs` and `directories` build for ToyOS and answer this
+     layout.
+   - home answers from std. **Exit**: `home` builds for ToyOS.
+   - tempfile takes the unix create-then-unlink path once std's
+     `create_new` and unlink-while-open are measured on ToyOS. **Exit**:
+     `tempfile` makes files on ToyOS.
+   - sys-locale reads the language init sets from `/config`. **Exit**:
+     `sys-locale` answers on ToyOS.
+   - rustls-native-certs reads a CA bundle under `/system/etc`, once something
+     needs native roots. **Exit**: the first native-roots consumer runs.
+
+## Not moved
+
+`/log/lease.txt` stays on `/log`. It is not netd's lease: it is the
+`--exit-with-lease` bench report the metal loop reads off the stick's FAT log
+volume, as it reads `/log/metal-*.bin`, and the DATA volume is not readable
+there. It goes with
+`issues/diagnostics/the-lanleasecase-boot-is-a-third-t14-flash-for-one-exit-code.md`.
diff --git a/issues/isolation/sshd-authorized-keys-unprotected.md b/issues/isolation/sshd-authorized-keys-unprotected.md
index 7fc3e6f49be..ac78b264422 100644
--- a/issues/isolation/sshd-authorized-keys-unprotected.md
+++ b/issues/isolation/sshd-authorized-keys-unprotected.md
@@ -6,8 +6,8 @@ opened: 2026-08-06
 
 # Sshd's keys are as protected as any other file, which is not at all
 
-`/home/root/.ssh/host_ed25519` is the machine's SSH private key and
-`/home/root/.ssh/authorized_keys` is the list of who may log in. There is no
+`/state/sshd/host_ed25519` is the machine's SSH private key and
+`/state/sshd/authorized_keys` is the list of who may log in. There is no
 user model and no file permissions, so **any process on the machine can read
 the first and rewrite the second** — the second being the one that matters:
 appending a line to it is a remote login, and nothing stops a process doing it.
diff --git a/kernel/src/main.rs b/kernel/src/main.rs
index ae9b72b77d3..22873881bed 100644
--- a/kernel/src/main.rs
+++ b/kernel/src/main.rs
@@ -220,9 +220,9 @@ fn register_gpu(driver: Box<dyn gpu::Gpu>, info: gpu::GpuInfo) {
     gpu::register(driver, info);
 }
 
-/// The two names DATA answers to. One filesystem, so `/apps/x` and `/home/x`
-/// are two directories of it and never two volumes.
-const DATA_PATHS: [&str; 2] = ["apps", "home"];
+/// The names DATA answers to. One filesystem, so `/apps/x` and `/home/x` are
+/// two directories of it and never two volumes.
+const DATA_PATHS: [&str; 4] = ["apps", "config", "home", "state"];
 
 /// The boot from power-on, off the loader's TSC readings and `complete`'s, at
 /// the calibrated rate. The TSC counts from reset, so the first span is
@@ -564,30 +564,30 @@ unsafe fn kernel_main(kernel_args: &KernelArgs) -> ! {
     fat32_adapter::probe_boot_disks();
     rootfs::hold_source();
 
-    // One filesystem, two paths: `/apps` and `/home` are two directories of
-    // DATA, so one sync settles both and neither can outlive the other.
+    // One filesystem, four paths: each of `DATA_PATHS` is a directory of DATA,
+    // so one sync settles them all and none can outlive the others.
     // tmpfs when there is no DATA volume this kernel may write: persistence is
     // the only difference, so the earlier refusal doesn't cascade. Nothing at
     // all when the volume is ours and did not mount.
     #[cfg_attr(not(feature = "boot-actuators"), allow(unused_variables))]
-    let (data_cache, home) = match bcachefs_adapter::open_data() {
+    let data_cache = match bcachefs_adapter::open_data() {
         bcachefs_adapter::Data::Mounted(cache, fs) => {
             let adapter = bcachefs_adapter::BcacheFsAdapter::new(fs, Arc::clone(&cache));
             vfs::lock().mount(&DATA_PATHS, Box::new(adapter), UserAccess::ReadWrite);
-            (Some(cache), true)
+            Some(cache)
         }
         bcachefs_adapter::Data::Volatile => {
-            log!("storage: /apps and /home are a tmpfs — they will not survive a reboot");
+            log!("storage: /apps, /config, /home and /state are a tmpfs — they will not survive a reboot");
             vfs::lock().mount(
                 &DATA_PATHS,
                 Box::new(crate::tmpfs::TmpFs::new()),
                 UserAccess::ReadWrite,
             );
-            (None, true)
+            None
         }
         bcachefs_adapter::Data::Absent => {
-            log!("storage: /apps and /home are absent this boot — the DATA volume is ours and did not mount");
-            (None, false)
+            log!("storage: /apps, /config, /home and /state are absent this boot — the DATA volume is ours and did not mount");
+            None
         }
     };
 
@@ -608,13 +608,6 @@ unsafe fn kernel_main(kernel_args: &KernelArgs) -> ! {
         None => log!("log-volume: not mounted; this boot's kernel log stays in memory"),
     }
 
-    // Fixed kernel strings well under MAX_PATH: a refusal here is a kernel bug, so this fails fast instead of returning an error.
-    // Not on an absent `/home`: the VFS's own directory set would answer for a directory nothing holds.
-    if home {
-        vfs::lock().create_dir("/home/root").expect("boot: /home/root exceeds MAX_PATH");
-        vfs::lock().create_dir("/home/root/.config").expect("boot: /home/root/.config exceeds MAX_PATH");
-    }
-
 
     // After the mounts above: the FAT reopen control drives `/log`.
     #[cfg(feature = "boot-actuators")]
diff --git a/kernel/src/vfs.rs b/kernel/src/vfs.rs
index bb01f2eabcb..55994c1f530 100644
--- a/kernel/src/vfs.rs
+++ b/kernel/src/vfs.rs
@@ -126,7 +126,8 @@ pub enum UserAccess {
 
 /// The entries `/` has, in listing order. `/` is synthesized rather than
 /// mounted: it is no filesystem, and nothing outside this set can be mounted.
-pub const ROOT_ENTRIES: [&str; 7] = ["apps", "boot", "home", "log", "media", "system", "tmp"];
+pub const ROOT_ENTRIES: [&str; 9] =
+    ["apps", "boot", "config", "home", "log", "media", "state", "system", "tmp"];
 
 struct Mount {
     fs: Box<dyn FileSystem>,
diff --git a/rust b/rust
index f6bf9d220aa..e1acded3fb8 160000
--- a/rust
+++ b/rust
@@ -1 +1 @@
-Subproject commit f6bf9d220aa5fb39d8e2e90dfda6c6df66ca3b05
+Subproject commit e1acded3fb88ca1040e2cd1d61c7b84579007696
diff --git a/src/assets.rs b/src/assets.rs
index 5e53ac54681..b01a33e7659 100644
--- a/src/assets.rs
+++ b/src/assets.rs
@@ -270,6 +270,20 @@ fn absentees(dir: &Path, declared: &BTreeSet<PathBuf>) -> Vec<PathBuf> {
 /// `only_doom_opens_doom_s_assets` is what keeps the right-hand column true.
 const OPENED_BY: &[(&str, &str)] = &[("doom1.wad", "doom"), ("soundfont.sf2", "doom")];
 
+/// The licence text under `licenses/` that travels with each font an image
+/// ships as it is: the OFL's second condition.
+const FONT_LICENCES: &[(&str, &str)] = &[("JetBrainsMono-Regular.ttf", "OFL-1.1-JetBrainsMono.txt")];
+
+/// A font with no row in [`FONT_LICENCES`] stops the build rather than ship
+/// without its licence.
+fn font_licence(name: &str) -> &'static str {
+    FONT_LICENCES
+        .iter()
+        .find(|(font, _)| *font == name)
+        .map(|(_, licence)| *licence)
+        .unwrap_or_else(|| panic!("{name} has no licence text in FONT_LICENCES, so it cannot ship"))
+}
+
 /// ROOT's asset files, for an image building exactly `programs`.
 pub fn collect(dirs: &[String], programs: &BTreeSet<&str>) -> Vec<(String, Vec<u8>)> {
     let mut files = vec![];
@@ -305,7 +319,8 @@ pub fn collect(dirs: &[String], programs: &BTreeSet<&str>) -> Vec<(String, Vec<u
             true
         };
 
-        // Pre-rasterize TTF fonts
+        // A top-level TTF ships twice: rasterized for the console, and as it is,
+        // with its licence text, where the toolkits look for system fonts.
         for entry in fs::read_dir(dir).unwrap_or_else(|e| panic!("Failed to read {}: {e}", dir.display())) {
             let path = entry.unwrap().path();
             if path.extension().is_some_and(|e| e == "ttf") && ships(&path) {
@@ -313,6 +328,12 @@ pub fn collect(dirs: &[String], programs: &BTreeSet<&str>) -> Vec<(String, Vec<u
                 let stem = path.file_stem().unwrap().to_str().unwrap();
                 let font_data = rasterize_font(&ttf, 8, 16);
                 files.push((format!("share/fonts/{stem}-8x16.font"), font_data));
+                let name = path.file_name().unwrap().to_str().unwrap();
+                let licence = font_licence(name);
+                let text = fs::read(Path::new(env!("CARGO_MANIFEST_DIR")).join("licenses").join(licence))
+                    .unwrap_or_else(|e| panic!("Failed to read licenses/{licence}: {e}"));
+                files.push((format!("share/fonts/{}", name.to_lowercase()), ttf));
+                files.push((format!("share/licenses/{licence}"), text));
             }
         }
 
@@ -509,6 +530,42 @@ mod tests {
         );
     }
 
+    /// The system monospace font ships byte for byte where fontdb and fontique
+    /// look, its licence text beside it, and its raster for the console.
+    #[test]
+    fn a_top_level_font_ships_as_it_is_with_its_licence_and_as_its_raster() {
+        let root = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+        let dir = std::env::temp_dir().join(format!("toyos-font-{}", std::process::id()));
+        let _ = fs::remove_dir_all(&dir);
+        fs::create_dir_all(&dir).expect("make the asset tree");
+        let ttf = fs::read(root.join("assets/JetBrainsMono-Regular.ttf")).expect("the font");
+        fs::write(dir.join("JetBrainsMono-Regular.ttf"), &ttf).unwrap();
+        let out = Command::new("git").args(["-C", &dir.display().to_string(), "init", "-q"]).output();
+        assert!(out.expect("run git").status.success());
+        let out = Command::new("git")
+            .args(["-C", &dir.display().to_string(), "add", "JetBrainsMono-Regular.ttf"])
+            .output();
+        assert!(out.expect("run git").status.success());
+
+        let shipped: std::collections::BTreeMap<String, Vec<u8>> =
+            collect(&[dir.display().to_string()], &BTreeSet::new()).into_iter().collect();
+        fs::remove_dir_all(&dir).ok();
+
+        assert_eq!(
+            shipped.keys().collect::<Vec<_>>(),
+            [
+                "share/fonts/JetBrainsMono-Regular-8x16.font",
+                "share/fonts/jetbrainsmono-regular.ttf",
+                "share/licenses/OFL-1.1-JetBrainsMono.txt",
+            ],
+        );
+        assert_eq!(shipped["share/fonts/jetbrainsmono-regular.ttf"], ttf, "the font was changed");
+        assert_eq!(
+            shipped["share/licenses/OFL-1.1-JetBrainsMono.txt"],
+            fs::read(root.join("licenses/OFL-1.1-JetBrainsMono.txt")).unwrap(),
+        );
+    }
+
     /// The right-hand column of [`OPENED_BY`] is true of the tree.
     ///
     /// The claim is that one program opens the file, so a second program naming
diff --git a/src/build.rs b/src/build.rs
index 1d3534d3b76..89d14683edf 100644
--- a/src/build.rs
+++ b/src/build.rs
@@ -132,6 +132,9 @@ struct ProgramConfig {
     /// `toyos_manifest::syscap_rights` takes. A handful of rows in the whole
     /// tree declare one.
     syscap: Vec<String>,
+    /// A system service: init starts it with `HOME` at its own `/state/<name>`
+    /// and makes that directory, where every other row gets the session's.
+    service: bool,
 }
 
 impl ProgramConfig {
@@ -680,6 +683,7 @@ fn render_manifest(config: &SystemConfig) -> Vec<u8> {
                     receives: cfg.receives.clone(),
                     devices: cfg.devices.clone(),
                     syscap: cfg.syscap.clone(),
+                    service: cfg.service,
                 }
             })
             .collect(),
@@ -2764,11 +2768,8 @@ mod tests {
     }
 
     /// One prefix and no other, so a doc naming `/etc/logd` or `/apps/logd` is a
-    /// token the filter below drops and an assertion that reds. Still `/bin/`
-    /// because `toyos-abi/src` is the tree the sweep did not reach;
-    /// `issues/build/twenty-seven-sdk-doc-lines-name-a-path-that-is-gone.md`
-    /// moves this and those lines together.
-    const LOG_DOC_BIN: &str = "/bin/";
+    /// token the filter below drops and an assertion that reds.
+    const LOG_DOC_BIN: &str = "/system/bin/";
 
     /// `Rights::LOG`'s doc names its holders, which is a claim about these
     /// manifests and rots on its own: `/system/bin/console` stood in it for the whole
diff --git a/system.toml b/system.toml
index 2d0b8c856a0..592a145eec5 100644
--- a/system.toml
+++ b/system.toml
@@ -32,6 +32,9 @@ start = ["logd", "compositor", "soundd", "netd", "filepicker"]
 [apps]
 receives = ["compositor", "soundd", "filepicker"]
 
+# `service = true` makes a row a system service: init starts it with `HOME` at
+# its own `/state/<name>` and makes that directory first. Every other row runs
+# with the session user's home.
 [programs]
 input-test = {}
 proctest = {}
@@ -48,6 +51,7 @@ toyos-cc = { path = "toyos-cc" }
 # `every_boot_config_runs_logd` is what refuses one. It claims no device, and
 # `log` is the port it answers `inspect` on.
 [programs.logd]
+service = true
 syscap = ["logread"]
 serves = ["log"]
 # What lets `logd` serve this boot's log on the network, to whoever connects:
@@ -55,11 +59,13 @@ serves = ["log"]
 receives = ["netd"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["soundd", "filepicker", "launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
@@ -69,12 +75,14 @@ syscap = ["rt"]
 # Named by vendor and device rather than by slot, so one row finds the card
 # wherever firmware put it.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
 # `swap` is the authority to replace a running service's binary; the build
 # refuses it to any other program (`src/build.rs`).
 [programs.sshd]
+service = true
 receives = ["netd", "launcher", "swap"]
 
 # A name's addresses, asked of netd's resolver: `netd` is the whole of what it
@@ -90,6 +98,7 @@ receives = ["netd", "soundd", "log", "compositor"]
 syscap = ["inventory"]
 
 [programs.filepicker]
+service = true
 serves = ["filepicker"]
 receives = ["compositor"]
 
diff --git a/tests/common/pkg.rs b/tests/common/pkg.rs
index 090a25d0a02..d737e2863dd 100644
--- a/tests/common/pkg.rs
+++ b/tests/common/pkg.rs
@@ -206,7 +206,7 @@ fn guest_probes(qemu: &mut QemuInstance, log: &mut String) -> Result<(), String>
     // The gate's other half: the shell resolves what its user typed, so a
     // dotted path still runs.
     let ran = passed(qemu, log, "test_rs_pkg_launch_gbae relative-path")?;
-    for said in ["./home/root/reltest/echo ran", "../home/root/reltest/echo ran"] {
+    for said in ["./home/toy/reltest/echo ran", "../home/toy/reltest/echo ran"] {
         if !ran.contains(said) {
             return Err(format!("no {said:?} line:\n{ran}"));
         }
diff --git a/tests/common/storage.rs b/tests/common/storage.rs
index b171b2d7978..ddd95194979 100644
--- a/tests/common/storage.rs
+++ b/tests/common/storage.rs
@@ -278,7 +278,7 @@ pub fn broken_data_volume_is_absent(
     for said in [
         "storage: the DATA volume does not mount, and nothing says it is another's: \
          ChecksumMismatch",
-        "storage: /apps and /home are absent this boot",
+        "storage: /apps, /config, /home and /state are absent this boot",
         "Boot: complete",
     ] {
         if !log.contains(said) {
@@ -303,8 +303,8 @@ pub fn broken_data_volume_is_absent(
     let result = qemu.run_test("test_rs_home_absent", Duration::from_secs(20));
     if result.exit_code != Some(0) {
         return Err(format!(
-            "home_absent guest failed — /apps, /home or /home/root answered a write, a chdir or \
-             a listing that an absent DATA volume must refuse:\n{}\nkernel log while it ran:\n{}{}",
+            "home_absent guest failed — /apps, /config, /home, /state or /home/toy answered a write, \
+             a chdir or a listing that an absent DATA volume must refuse:\n{}\nkernel log while it ran:\n{}{}",
             result.stdout, result.before, result.serial
         ));
     }
@@ -363,7 +363,7 @@ pub fn data_candidate_with_bad_geometry_is_absent(
             return Err(format!("{bad:?}: a misaligned candidate must not be fatal\n{log}"));
         }
     }
-    for said in ["not whole", "storage: /apps and /home are absent this boot", "Boot: complete"] {
+    for said in ["not whole", "storage: /apps, /config, /home and /state are absent this boot", "Boot: complete"] {
         if !log.contains(said) {
             return Err(format!("the kernel never said {said:?}\n{log}"));
         }
diff --git a/tests/desktopaudiocase/system.toml b/tests/desktopaudiocase/system.toml
index 379677437ae..82d72037c07 100644
--- a/tests/desktopaudiocase/system.toml
+++ b/tests/desktopaudiocase/system.toml
@@ -19,14 +19,17 @@ start = ["logd", "compositor", "soundd", "terminal"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["soundd", "launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/desktopcase/system.toml b/tests/desktopcase/system.toml
index 33b7ae3c41d..07326adc9c2 100644
--- a/tests/desktopcase/system.toml
+++ b/tests/desktopcase/system.toml
@@ -25,9 +25,11 @@ start = ["logd", "compositor", "terminal"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
diff --git a/tests/doomcase/system.toml b/tests/doomcase/system.toml
index 188d183fbb3..f9b7b2411c6 100644
--- a/tests/doomcase/system.toml
+++ b/tests/doomcase/system.toml
@@ -20,9 +20,11 @@ start = ["logd", "soundd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/doommusiccase/system.toml b/tests/doommusiccase/system.toml
index 4a40250884a..251c91f88d5 100644
--- a/tests/doommusiccase/system.toml
+++ b/tests/doommusiccase/system.toml
@@ -21,9 +21,11 @@ start = ["logd", "soundd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/e1000case/system.toml b/tests/e1000case/system.toml
index 4494033d5e9..1742df853ff 100644
--- a/tests/e1000case/system.toml
+++ b/tests/e1000case/system.toml
@@ -12,6 +12,7 @@
 start = ["logd", "netd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 # What lets `logd` serve this boot's log on the network, to whoever connects:
 # without it the log is served on this machine only.
@@ -22,6 +23,7 @@ receives = ["netd"]
 # claim. Named by vendor and device rather than by slot, so one row finds the
 # card wherever firmware put it.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:10d3"]
 
diff --git a/tests/e1000leasecase/system.toml b/tests/e1000leasecase/system.toml
index f994ad58ac2..51f53e79b2c 100644
--- a/tests/e1000leasecase/system.toml
+++ b/tests/e1000leasecase/system.toml
@@ -7,9 +7,11 @@
 start = ["logd", "netd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:10d3"]
 args = ["--exit-with-lease"]
diff --git a/tests/e1000talkcase/system.toml b/tests/e1000talkcase/system.toml
index 52717a39078..1bedfc16982 100644
--- a/tests/e1000talkcase/system.toml
+++ b/tests/e1000talkcase/system.toml
@@ -7,17 +7,20 @@
 start = ["logd", "netd", "sshd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 # What lets `logd` serve this boot's log on the network, to whoever connects:
 # without it the log is served on this machine only.
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:10d3"]
 
 # `swap` too: the host replaces netd on this boot without rebooting it.
 [programs.sshd]
+service = true
 receives = ["netd", "launcher", "swap"]
 
 [programs.test-runner]
diff --git a/tests/flrswapcase/system.toml b/tests/flrswapcase/system.toml
index 176276a4cbc..f7112fbef3e 100644
--- a/tests/flrswapcase/system.toml
+++ b/tests/flrswapcase/system.toml
@@ -7,16 +7,19 @@
 start = ["logd", "netd", "sshd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 # The record stream's authority: the address on the parameter line is
 # information, and this row is the whole of what can act on it.
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:10d3", "pci:8086:10c9"]
 
 [programs.sshd]
+service = true
 receives = ["netd", "launcher", "swap"]
 
 [programs.test-runner]
diff --git a/tests/inspectcase/system.toml b/tests/inspectcase/system.toml
index 2901ab4a91c..1c12310260d 100644
--- a/tests/inspectcase/system.toml
+++ b/tests/inspectcase/system.toml
@@ -16,19 +16,23 @@ start = ["logd", "compositor", "soundd", "netd", "test-runner"]
 # `every_boot_config_runs_logd` refuses a config without it. `log` is the port
 # it answers `inspect` on.
 [programs.logd]
+service = true
 syscap = ["logread"]
 serves = ["log"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
diff --git a/tests/jobcase/system.toml b/tests/jobcase/system.toml
index c7791551c35..ad42601aefe 100644
--- a/tests/jobcase/system.toml
+++ b/tests/jobcase/system.toml
@@ -5,6 +5,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 # One binary name per job, never a command line: the stdin path's `run <name>`
diff --git a/tests/jobdeadlinecase/system.toml b/tests/jobdeadlinecase/system.toml
index d457d25a593..bcd4a6f6058 100644
--- a/tests/jobdeadlinecase/system.toml
+++ b/tests/jobdeadlinecase/system.toml
@@ -7,6 +7,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.test-runner]
diff --git a/tests/lancase/system.toml b/tests/lancase/system.toml
index 5eaf3999ff0..380c3e31f92 100644
--- a/tests/lancase/system.toml
+++ b/tests/lancase/system.toml
@@ -11,9 +11,11 @@
 start = ["logd", "netd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:15fc"]
 
diff --git a/tests/lanicscase/system.toml b/tests/lanicscase/system.toml
index d4c7d6070f6..90ca68d2e1a 100644
--- a/tests/lanicscase/system.toml
+++ b/tests/lanicscase/system.toml
@@ -12,9 +12,11 @@
 start = ["logd", "netd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:15fc"]
 args = ["--provoke-message"]
diff --git a/tests/lanleasecase/system.toml b/tests/lanleasecase/system.toml
index 0dd2d4827fd..f35c29f5979 100644
--- a/tests/lanleasecase/system.toml
+++ b/tests/lanleasecase/system.toml
@@ -10,9 +10,11 @@
 start = ["logd", "netd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:15fc"]
 args = ["--exit-with-lease"]
diff --git a/tests/lantalkcase/system.toml b/tests/lantalkcase/system.toml
index ffdb50ed1a3..cff48ed353f 100644
--- a/tests/lantalkcase/system.toml
+++ b/tests/lantalkcase/system.toml
@@ -12,17 +12,20 @@
 start = ["logd", "netd", "sshd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 # What lets `logd` serve this boot's log on the network, to whoever connects:
 # without it the log is served on this machine only.
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:15fc"]
 
 # `swap` too: the host replaces netd on this boot without rebooting it.
 [programs.sshd]
+service = true
 receives = ["netd", "launcher", "swap"]
 
 [programs.test-runner]
diff --git a/tests/latencycase/system.toml b/tests/latencycase/system.toml
index 415b382f871..976e7f7b30b 100644
--- a/tests/latencycase/system.toml
+++ b/tests/latencycase/system.toml
@@ -14,6 +14,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.test-runner]
diff --git a/tests/logholdcase/system.toml b/tests/logholdcase/system.toml
index 5700947552a..7e75716c095 100644
--- a/tests/logholdcase/system.toml
+++ b/tests/logholdcase/system.toml
@@ -8,6 +8,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 args = ["--hold-ring-until=log hold: said after 192 records"]
 syscap = ["logread"]
 
diff --git a/tests/logrotatecase/system.toml b/tests/logrotatecase/system.toml
index 89c794f0d2d..684e0958a7c 100644
--- a/tests/logrotatecase/system.toml
+++ b/tests/logrotatecase/system.toml
@@ -33,15 +33,18 @@ start = ["logd", "compositor", "soundd", "netd", "sshd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 args = ["--rotate-fast"]
 syscap = ["logread"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["soundd", "launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
@@ -49,10 +52,12 @@ syscap = ["rt"]
 # netd holds the NIC's PCI function and drives it: the virtqueues, the register
 # window and the interrupt are its own, and the kernel keeps only the claim.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
 [programs.sshd]
+service = true
 receives = ["netd", "launcher"]
 
 # The union its guest binaries need on this machine shape.
diff --git a/tests/logstallcase/system.toml b/tests/logstallcase/system.toml
index a136c69e72e..7e48fa2a101 100644
--- a/tests/logstallcase/system.toml
+++ b/tests/logstallcase/system.toml
@@ -8,6 +8,7 @@
 start = ["logd", "soundd", "test-runner"]
 
 [programs.logd]
+service = true
 args = [
     "--stall=soundd",
     "--stall-until=soundd_log_stall: the tone has played, and logd may read soundd again",
@@ -15,6 +16,7 @@ args = [
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/logstreamcase/system.toml b/tests/logstreamcase/system.toml
index 0b82d2525d5..e79fa339727 100644
--- a/tests/logstreamcase/system.toml
+++ b/tests/logstreamcase/system.toml
@@ -9,10 +9,12 @@ start = ["logd", "netd", "test-runner"]
 # `receives = ["netd"]` is what lets `logd` serve this boot's log on the
 # network.
 [programs.logd]
+service = true
 syscap = ["logread"]
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
diff --git a/tests/logstreame1000case/system.toml b/tests/logstreame1000case/system.toml
index 0b8cd5682c6..ac190b0b7a2 100644
--- a/tests/logstreame1000case/system.toml
+++ b/tests/logstreame1000case/system.toml
@@ -9,10 +9,12 @@ start = ["logd", "netd", "test-runner"]
 # `receives = ["netd"]` is what lets `logd` serve this boot's log on the
 # network.
 [programs.logd]
+service = true
 syscap = ["logread"]
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:8086:10d3"]
 
diff --git a/tests/metalcase/system.toml b/tests/metalcase/system.toml
index 80371614005..eeca4fe25ed 100644
--- a/tests/metalcase/system.toml
+++ b/tests/metalcase/system.toml
@@ -27,14 +27,17 @@ start = ["logd", "compositor", "soundd", "netd", "sshd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["soundd", "launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
@@ -42,10 +45,12 @@ syscap = ["rt"]
 # netd holds the NIC's PCI function and drives it: the virtqueues, the register
 # window and the interrupt are its own, and the kernel keeps only the claim.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
 [programs.sshd]
+service = true
 receives = ["netd", "launcher"]
 
 # The union its guest binaries need on this machine shape.
diff --git a/tests/metaldevicecase/system.toml b/tests/metaldevicecase/system.toml
index 4240e42dc1f..0f7989fd49d 100644
--- a/tests/metaldevicecase/system.toml
+++ b/tests/metaldevicecase/system.toml
@@ -15,9 +15,11 @@
 start = ["logd", "soundd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio"]
 syscap = ["rt"]
diff --git a/tests/netcase/system.toml b/tests/netcase/system.toml
index e4ec788892a..1ae7dc9ddde 100644
--- a/tests/netcase/system.toml
+++ b/tests/netcase/system.toml
@@ -14,6 +14,7 @@ start = ["logd", "netd", "test-runner"]
 # kernel keeps the record ring and writes no file, so such a boot's `/log` is
 # empty. It claims no device and serves no port.
 [programs.logd]
+service = true
 syscap = ["logread"]
 # What lets `logd` serve this boot's log on the network, to whoever connects:
 # without it the log is served on this machine only.
@@ -24,6 +25,7 @@ receives = ["netd"]
 # Named by vendor and device rather than by slot, so one row finds the card
 # wherever firmware put it.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
diff --git a/tests/partclaimcase/system.toml b/tests/partclaimcase/system.toml
index e7d575d8e10..91e410712aa 100644
--- a/tests/partclaimcase/system.toml
+++ b/tests/partclaimcase/system.toml
@@ -16,9 +16,11 @@ start = ["logd", "soundd", "test-runner"]
 # It claims no device and serves no port: its whole authority
 # is `logread`, which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/pkgcase/system.toml b/tests/pkgcase/system.toml
index 26b620e0c46..e4e992dba9d 100644
--- a/tests/pkgcase/system.toml
+++ b/tests/pkgcase/system.toml
@@ -22,14 +22,17 @@ receives = ["compositor", "soundd"]
 # boot config without `logd` is a boot whose `/log` is empty —
 # `every_boot_config_runs_logd` is what refuses one.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.compositor]
+service = true
 serves = ["compositor"]
 receives = ["soundd", "launcher"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/quiescecase/system.toml b/tests/quiescecase/system.toml
index 29362fd0b4e..24fe5602bd0 100644
--- a/tests/quiescecase/system.toml
+++ b/tests/quiescecase/system.toml
@@ -5,6 +5,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 # `power` because the job ends the machine, `dup` because the runner passes a
diff --git a/tests/quiescelastcase/system.toml b/tests/quiescelastcase/system.toml
index dcbc59becd3..e0a4c72aca9 100644
--- a/tests/quiescelastcase/system.toml
+++ b/tests/quiescelastcase/system.toml
@@ -4,6 +4,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 # `power` because the job ends the machine, `dup` because the runner passes a
diff --git a/tests/quiescetwicecase/system.toml b/tests/quiescetwicecase/system.toml
index 170437972a4..3bed5458de3 100644
--- a/tests/quiescetwicecase/system.toml
+++ b/tests/quiescetwicecase/system.toml
@@ -3,6 +3,7 @@
 start = ["logd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 # `power` because the job ends the machine, `logread` because the second
diff --git a/tests/sshdcase/system.toml b/tests/sshdcase/system.toml
index 97c3990fc3f..09320cddb9b 100644
--- a/tests/sshdcase/system.toml
+++ b/tests/sshdcase/system.toml
@@ -21,15 +21,18 @@ start = ["logd", "netd", "sshd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 # netd holds the NIC's PCI function and drives it: the virtqueues, the register
 # window and the interrupt are its own, and the kernel keeps only the claim.
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
 [programs.sshd]
+service = true
 receives = ["netd", "launcher"]
 
 # `logread` is the log gate's own: a spawned test binary does not inherit a
diff --git a/tests/swapcase/system.toml b/tests/swapcase/system.toml
index b85f06be8c9..1c85d1576c5 100644
--- a/tests/swapcase/system.toml
+++ b/tests/swapcase/system.toml
@@ -11,18 +11,21 @@
 start = ["logd", "netd", "sshd", "test-runner"]
 
 [programs.logd]
+service = true
 syscap = ["logread"]
 # The record stream's authority: the address on the parameter line is
 # information, and this row is the whole of what can act on it.
 receives = ["netd"]
 
 [programs.netd]
+service = true
 serves = ["netd"]
 devices = ["pci:1af4:1041"]
 
 # `swap` is the authority to replace a service's binary, and no other program
 # may hold it.
 [programs.sshd]
+service = true
 receives = ["netd", "launcher", "swap"]
 
 [programs.test-runner]
diff --git a/tests/testcases/system.toml b/tests/testcases/system.toml
index fd171f668fc..f06fcd532a9 100644
--- a/tests/testcases/system.toml
+++ b/tests/testcases/system.toml
@@ -10,9 +10,11 @@ start = ["logd", "soundd", "test-runner"]
 # which is `Rights::LOG | Rights::WAIT` on a `SysCap` duplicate, and init hands
 # it every program's output beside that.
 [programs.logd]
+service = true
 syscap = ["logread"]
 
 [programs.soundd]
+service = true
 serves = ["soundd"]
 devices = ["hda-audio", "virtio-sound"]
 syscap = ["rt"]
diff --git a/tests/toyos-rust-tests/Cargo.lock b/tests/toyos-rust-tests/Cargo.lock
index b2c7cafc020..581878cb7cd 100644
--- a/tests/toyos-rust-tests/Cargo.lock
+++ b/tests/toyos-rust-tests/Cargo.lock
@@ -1442,7 +1442,7 @@ dependencies = [
 
 [[package]]
 name = "toyos"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "toyos-abi 0.12.0",
 ]
@@ -1500,7 +1500,7 @@ dependencies = [
  "rustls-pki-types",
  "rustls-rustcrypto",
  "sha2",
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-dns",
  "toyos-i219",
@@ -1518,9 +1518,9 @@ version = "0.1.0"
 
 [[package]]
 name = "toyos-window"
-version = "0.14.0"
+version = "0.15.0"
 dependencies = [
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-font",
  "toyos-keymap",
diff --git a/tests/toyos-rust-tests/src/bin/hierarchy_paths.rs b/tests/toyos-rust-tests/src/bin/hierarchy_paths.rs
index d76341bad35..b3446ceade3 100644
--- a/tests/toyos-rust-tests/src/bin/hierarchy_paths.rs
+++ b/tests/toyos-rust-tests/src/bin/hierarchy_paths.rs
@@ -15,8 +15,9 @@ use std::io::Write;
 use toyos_abi::syscall::{self, OpenFlags, SyscallError};
 
 /// `vfs::ROOT_ENTRIES`: the kernel's set and this one are two spellings of the
-/// hierarchy, so a boot that grew an eighth entry reds here.
-const ROOT_ENTRIES: [&str; 7] = ["apps", "boot", "home", "log", "media", "system", "tmp"];
+/// hierarchy, so a boot that grew another entry reds here.
+const ROOT_ENTRIES: [&str; 9] =
+    ["apps", "boot", "config", "home", "log", "media", "state", "system", "tmp"];
 
 /// Mirrored in `tests/common/storage.rs`, whose reader sees them without the
 /// mount point, inside the one volume.
diff --git a/tests/toyos-rust-tests/src/bin/home_absent.rs b/tests/toyos-rust-tests/src/bin/home_absent.rs
index 2ca4a7aac72..3d3071f4e71 100644
--- a/tests/toyos-rust-tests/src/bin/home_absent.rs
+++ b/tests/toyos-rust-tests/src/bin/home_absent.rs
@@ -1,28 +1,26 @@
-//! On a boot where the DATA volume is ours and did not mount, `/apps` and
-//! `/home` must never come back as a place to write: the kernel's own log
-//! line and the byte-identical image (asserted on the host, in
-//! `tests/common/storage.rs`) do not observe that from inside the guest — this
-//! does. Driven by `broken_data_volume_is_absent` and
+//! On a boot where the DATA volume is ours and did not mount, `/apps`,
+//! `/config`, `/home` and `/state` must never come back as a place to write:
+//! the kernel's own log line and the byte-identical image (asserted on the
+//! host, in `tests/common/storage.rs`) do not observe that from inside the
+//! guest — this does. Driven by `broken_data_volume_is_absent` and
 //! `data_candidate_with_bad_geometry_is_absent` alone: every other boot mounts
-//! `/apps` and `/home`, on the DATA volume or on a tmpfs, and every check
-//! below would fail on it.
+//! the four, on the DATA volume or on a tmpfs, and every check below would
+//! fail on it.
 
 use std::io::ErrorKind;
 
 fn main() {
     let mut wrong = Vec::new();
 
-    match std::fs::write("/home/x", b"should never land") {
-        Err(e) if e.kind() == ErrorKind::PermissionDenied => {}
-        other => wrong.push(format!("writing /home/x: {other:?}, want PermissionDenied")),
-    }
-    match std::fs::write("/apps/x", b"should never land") {
-        Err(e) if e.kind() == ErrorKind::PermissionDenied => {}
-        other => wrong.push(format!("writing /apps/x: {other:?}, want PermissionDenied")),
+    for dir in ["/apps", "/config", "/home", "/state"] {
+        match std::fs::write(format!("{dir}/x"), b"should never land") {
+            Err(e) if e.kind() == ErrorKind::PermissionDenied => {}
+            other => wrong.push(format!("writing {dir}/x: {other:?}, want PermissionDenied")),
+        }
     }
-    match std::env::set_current_dir("/home/root") {
+    match std::env::set_current_dir("/home/toy") {
         Err(e) if e.kind() == ErrorKind::NotFound => {}
-        other => wrong.push(format!("chdir /home/root: {other:?}, want NotFound")),
+        other => wrong.push(format!("chdir /home/toy: {other:?}, want NotFound")),
     }
     match std::fs::read_dir("/home") {
         Ok(entries) => {
@@ -35,5 +33,8 @@ fn main() {
     }
 
     assert!(wrong.is_empty(), "an absent DATA volume was not absent:\n{}", wrong.join("\n"));
-    println!("home-absent: /home and /apps refused every write, and /home/root every chdir and listing");
+    println!(
+        "home-absent: /apps, /config, /home and /state refused every write, and /home/toy every \
+         chdir and listing"
+    );
 }
diff --git a/tests/toyos-rust-tests/src/bin/layout_paths.rs b/tests/toyos-rust-tests/src/bin/layout_paths.rs
new file mode 100644
index 00000000000..5701ffc7040
--- /dev/null
+++ b/tests/toyos-rust-tests/src/bin/layout_paths.rs
@@ -0,0 +1,86 @@
+//! Where a fresh boot puts things: the session user's home, each service's own
+//! `/state`, and no dotfile anywhere ToyOS's own programs write.
+//!
+//! Driven by `layout_fresh_boot` alone, on `tests/sshdcase` once sshd has
+//! minted its identity: that boot runs three services and a session program
+//! (`test-runner`, whose `HOME` this binary inherits). The dotfile walk sees
+//! every file, and a directory only once it holds one.
+
+use std::fs;
+use std::io::ErrorKind;
+use std::path::Path;
+
+/// init's `HOME_FOLDERS`, spelled again: the two are two spellings of the
+/// session home, so a folder added to one reds here.
+const HOME_FOLDERS: [&str; 8] =
+    ["Apps", "Desktop", "Documents", "Downloads", "Fonts", "Music", "Pictures", "Videos"];
+
+/// The services `tests/sshdcase` runs, each of which init gave a `/state` of
+/// its own.
+const SERVICES: [&str; 3] = ["logd", "netd", "sshd"];
+
+/// Every volume a ToyOS program writes to.
+const WRITTEN: [&str; 6] = ["/apps", "/config", "/home", "/log", "/state", "/tmp"];
+
+fn main() {
+    let mut wrong = Vec::new();
+
+    let home = std::env::var("HOME");
+    if home.as_deref() != Ok("/home/toy") {
+        wrong.push(format!("HOME is {home:?}, want /home/toy"));
+    }
+    let std_home = std::env::home_dir();
+    if std_home.as_deref() != Some(Path::new("/home/toy")) {
+        wrong.push(format!("std::env::home_dir() is {std_home:?}, want /home/toy"));
+    }
+
+    match fs::metadata("/home/root") {
+        Err(e) if e.kind() == ErrorKind::NotFound => {}
+        other => wrong.push(format!("/home/root: {other:?}, want NotFound")),
+    }
+    // Asked by name and not listed: a directory on DATA is the VFS's own
+    // record, and no listing of its parent shows it
+    // (`issues/filesystem/a-directory-on-data-is-in-no-listing-and-no-reboot.md`).
+    let dirs = ["/home/toy".to_string()]
+        .into_iter()
+        .chain(HOME_FOLDERS.iter().map(|f| format!("/home/toy/{f}")))
+        .chain(SERVICES.iter().map(|s| format!("/state/{s}")));
+    for dir in dirs {
+        match fs::metadata(&dir) {
+            Ok(meta) if meta.is_dir() => {}
+            other => wrong.push(format!("{dir}: {other:?}, want a directory")),
+        }
+    }
+    match fs::metadata("/state/sshd/host_ed25519") {
+        Ok(meta) if meta.is_file() && meta.len() > 0 => {}
+        other => wrong.push(format!("/state/sshd/host_ed25519: {other:?}, want a file")),
+    }
+
+    let mut dotted = Vec::new();
+    let mut walked = 0usize;
+    let mut pending: Vec<String> = WRITTEN.iter().map(|d| d.to_string()).collect();
+    while let Some(dir) = pending.pop() {
+        for entry in fs::read_dir(&dir).unwrap_or_else(|e| panic!("read_dir {dir}: {e}")) {
+            let entry = entry.expect("dir entry");
+            let name = entry.file_name().to_string_lossy().into_owned();
+            let path = format!("{dir}/{name}");
+            walked += 1;
+            if name.starts_with('.') {
+                dotted.push(path.clone());
+            }
+            if entry.file_type().expect("file type").is_dir() {
+                pending.push(path);
+            }
+        }
+    }
+    if !dotted.is_empty() {
+        wrong.push(format!("a dotfile on a fresh boot: {dotted:?}"));
+    }
+
+    assert!(wrong.is_empty(), "the layout is not as ruled:\n{}", wrong.join("\n"));
+    println!(
+        "layout: HOME=/home/toy, {} home folders, /state holds {SERVICES:?} with sshd's key, \
+         and none of {walked} entries under {WRITTEN:?} is a dotfile",
+        HOME_FOLDERS.len()
+    );
+}
diff --git a/tests/toyos-rust-tests/src/bin/pkg_launch_gbae.rs b/tests/toyos-rust-tests/src/bin/pkg_launch_gbae.rs
index f1ee8aebfc2..4e447f2820c 100644
--- a/tests/toyos-rust-tests/src/bin/pkg_launch_gbae.rs
+++ b/tests/toyos-rust-tests/src/bin/pkg_launch_gbae.rs
@@ -85,7 +85,7 @@ fn symlink_row() -> std::process::ExitCode {
 /// The real shell binary through `shell -c`, rather than a second copy of what
 /// it does. `-c` roots the cwd at `/`, so the dotted forms are rooted there.
 fn relative_path() -> std::process::ExitCode {
-    const DIR: &str = "/home/root/reltest";
+    const DIR: &str = "/home/toy/reltest";
     const NONCE: &str = "relpath-ran-9c41";
     std::fs::create_dir_all(DIR).expect("/home is writable");
     let link = format!("{DIR}/echo");
@@ -94,7 +94,7 @@ fn relative_path() -> std::process::ExitCode {
         .expect("a symlink under /home is allowed");
 
     let mut ran = 0;
-    for typed in ["./home/root/reltest/echo", "../home/root/reltest/echo"] {
+    for typed in ["./home/toy/reltest/echo", "../home/toy/reltest/echo"] {
         let out = Command::new("/system/bin/shell")
             .arg("-c")
             .arg(format!("{typed} {NONCE}"))
diff --git a/tests/toyos.rs b/tests/toyos.rs
index 298e12bdbac..da25ae9af91 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -480,6 +480,9 @@ const RUST_SKIP: &[&str] = &[
     "ftruncate_flush_race",
     // Needs the `smp-skip-ap` boot; `smp_failed_ap_leaves_no_hole` runs it there.
     "smp_hole_shootdown",
+    // Its listings are exact against `tests/sshdcase`'s services, and every
+    // boot but that one runs others. `layout_fresh_boot` runs it.
+    "layout_paths",
     // Needs a package installed under `/apps` and a config whose `[apps]` row
     // is what a launch out of it holds; `pkg_install_gbae` gives both, and on
     // any other boot this exits on a launch nothing could satisfy.
@@ -598,13 +601,13 @@ const SCREEN_TESTS: &[(&str, Sched, Tier)] = &[
 /// The command's *output* differs from the command, which is the whole point:
 /// the shell echoes what is typed, so an assertion satisfiable by the echo says
 /// only that the console drew a key, not that anything ran. This is asserted as
-/// a whole trimmed row, so the echoed `/home/root> echo zqjxk` cannot satisfy
+/// a whole trimmed row, so the echoed `/home/toy> echo zqjxk` cannot satisfy
 /// it either.
 const CONSOLE_NONCE: &str = "zqjxk";
 /// `/system/bin/shell` cds to `$HOME` before its first prompt, and prints
 /// `"{cwd}> "` — without the trailing space, which the decoder trims off the
 /// end of every row.
-const CONSOLE_PROMPT: &str = "/home/root>";
+const CONSOLE_PROMPT: &str = "/home/toy>";
 /// The seed's witness on the panel.
 ///
 /// `/system/bin/console` draws the boot so far, as `logd` serves it, above its
@@ -904,6 +907,9 @@ const MACHINE_TESTS: &[(&str, Sched, Tier)] = &[
     // Its own boot with a NIC under it, because sshd leaves at the bind on
     // every other config. Every verdict is a line of text; no clock in any.
     ("sshd_fail_closed", Sched::Parallel, Tier::Fast),
+    // The same boot with a blank DATA volume, read for where everything it
+    // wrote went. Every verdict is a listing; no clock in any.
+    ("layout_fresh_boot", Sched::Parallel, Tier::Fast),
     // One `SSHD_LOGIN` boot for the three, driven by `tests/ssh-client-host`.
     // Adjacent because `group_of` makes adjacency load-bearing, and one tier
     // because one boot cannot be in two. Every verdict is bytes or an exit
@@ -1629,6 +1635,7 @@ const CARRIES: &[(&str, &[&str])] = &[
     ("https_tls13_e1000e", &["test_rs_https_fetch"]),
     ("pkg_install_gbae", &["test_rs_pkg_launch_gbae"]),
     ("apps_and_home_are_one_filesystem", &["test_rs_hierarchy_paths"]),
+    ("layout_fresh_boot", &["test_rs_layout_paths"]),
     ("broken_data_volume_is_absent", &["test_rs_home_absent"]),
     ("data_candidate_with_bad_geometry_is_absent", &["test_rs_home_absent"]),
     ("home_budget_refusal_retried", &["test_rs_home_fsync_budget"]),
@@ -5166,7 +5173,7 @@ fn run_screen_test(
             let after = dump.console_text(&font);
             print_screen(name, &after);
             // A whole trimmed row, because the shell echoes what is typed:
-            // `contains` would be satisfied by `/home/root> echo zqjxk`, which
+            // `contains` would be satisfied by `/home/toy> echo zqjxk`, which
             // says the console drew a keystroke and nothing about anything
             // having run.
             if !dump.console_rows(&font).iter().any(|r| r.trim() == CONSOLE_NONCE) {
@@ -14679,7 +14686,7 @@ fn run_machine_test(
         "sshd_fail_closed" => {
             // sshd with a network under it — the only boot that gets past its
             // bind. What that reaches for the first time is the daemon's own
-            // state on disk: the identity it mints under `/home`, and the file
+            // state on disk: the identity it mints under `/state/sshd`, and the file
             // it authenticates against.
             //
             // The verdict is that it authenticates nobody and says which file
@@ -14698,17 +14705,17 @@ fn run_machine_test(
             let mut qemu = QemuInstance::boot_with_options(&config, &[], &[], options);
             let mut console = qemu.boot_log().to_string();
 
-            // Minting proves `/home/root/.ssh` is creatable and writable from
-            // userland; the fingerprint proves the key it wrote reads back.
+            // Minting proves init made `/state/sshd` and set it as the daemon's
+            // `HOME`; the fingerprint proves the key it wrote reads back.
             //
             // **Both files are named, because either one alone authorizes.**
             // This boot stages neither, so the daemon has to report both as
             // unreadable — a check on only the writable one would pass a
             // machine whose image file was silently never consulted.
             const WANT: [&str; 5] = [
-                "sshd: minted a new host identity at /home/root/.ssh/host_ed25519",
+                "sshd: minted a new host identity at /state/sshd/host_ed25519",
                 "sshd: host identity SHA256:",
-                "sshd: cannot read /home/root/.ssh/authorized_keys",
+                "sshd: cannot read /state/sshd/authorized_keys",
                 "sshd: cannot read /system/etc/ssh_authorized_keys",
                 "sshd: no file names a usable key",
             ];
@@ -14731,11 +14738,40 @@ fn run_machine_test(
                 ));
             }
             eprintln!(
-                "  [sshd] host identity minted under /home, and neither authorized_keys file \
+                "  [sshd] host identity minted under /state/sshd, and neither authorized_keys file \
                  left it refusing to listen at all"
             );
             Ok(())
         }
+        "layout_fresh_boot" => {
+            // The layout as ruled, on a boot of its own with a blank DATA
+            // volume: three services, each given a `/state` of its own, and a
+            // session program whose child is the judge. sshd's identity is the
+            // one file a service writes on every such boot, and sshd's last line
+            // on a boot that stages no key follows it, so the listing waits for
+            // that line rather than for a clock.
+            let config = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/sshdcase");
+            let options = BootOptions { profile: qemu::Profile::Headless, ..Default::default() };
+            let mut qemu = QemuInstance::boot_with_options(&config, &[], rust_bins, options);
+            let mut console = qemu.boot_log().to_string();
+            const MINTED: &str = "sshd: minted a new host identity at /state/sshd/host_ed25519";
+            await_guest(&mut qemu, &mut console, "sshd's last line", |c| {
+                c.contains("sshd: no file names a usable key")
+            })
+            .map_err(|why| format!("{why}\n{console}"))?;
+            if !console.contains(MINTED) {
+                return Err(format!("{MINTED:?} never reached the console:\n{console}"));
+            }
+            let result = qemu.run_test("test_rs_layout_paths", Duration::from_secs(60));
+            if result.exit_code != Some(0) {
+                return Err(format!(
+                    "layout_paths guest failed:\n{}\nkernel log while it ran:\n{}{}",
+                    result.stdout, result.before, result.serial
+                ));
+            }
+            eprintln!("  [layout] {}", result.stdout.trim());
+            Ok(())
+        }
         "lan_dhcp_lease" => lan::lan_dhcp_lease(test_config, c_bins, rust_bins),
         "lan_lease_report" => lan::lan_lease_report(test_config, c_bins, rust_bins),
         "lan_talk" => lan::lan_talk(test_config, c_bins, rust_bins),
diff --git a/toyos-abi/src/handle.rs b/toyos-abi/src/handle.rs
index 8ff79e6bcaa..59a00d75a86 100644
--- a/toyos-abi/src/handle.rs
+++ b/toyos-abi/src/handle.rs
@@ -88,7 +88,7 @@ impl Rights {
     /// On a `SysCap`: read the whole machine's kernel log.
     ///
     /// [`SYS_LOG_READ`] answers every record every CPU wrote, which is every
-    /// process's business and no process's right by default. `/bin/logd` holds
+    /// process's business and no process's right by default. `/system/bin/logd` holds
     /// it because writing `/log` is its job and `test-runner` because a gate
     /// reads what the kernel said; no other program in any boot config does.
     ///
@@ -101,10 +101,10 @@ impl Rights {
     /// carries — one bit for both, because a machine taken away from its
     /// processes is the same authority whichever state it is left in. It rides a bit for
     /// the same reason minting a device claim and entering the real-time band
-    /// do: what can cut the power is exactly what `/bin/init` endowed, and
+    /// do: what can cut the power is exactly what `/system/bin/init` endowed, and
     /// there is nothing a program can name to reach it otherwise.
     ///
-    /// The kernel mints one carrying it, at boot, for `/bin/init`
+    /// The kernel mints one carrying it, at boot, for `/system/bin/init`
     /// (`kernel::loader::spawn_init`); every other holder is a narrowed
     /// duplicate init endowed from a `system.toml` row that named `power`.
     ///
@@ -120,7 +120,7 @@ impl Rights {
     /// ambient; the entries are a census of what the machine is running, and a
     /// process that was endowed one connector has no business reading it.
     ///
-    /// `/bin/toybox` holds it because `/bin/ps` is that binary under another
+    /// `/system/bin/toybox` holds it because `/system/bin/ps` is that binary under another
     /// name, and `test-runner` because several guest binaries read their own
     /// threads back out of the roster.
     ///
diff --git a/toyos-abi/src/lib.rs b/toyos-abi/src/lib.rs
index 4633f35d479..99516647976 100644
--- a/toyos-abi/src/lib.rs
+++ b/toyos-abi/src/lib.rs
@@ -79,7 +79,7 @@ impl core::ops::Add for Tid {
 /// **The three handles are installed by the read that answers this.** A
 /// description is a set of buffers, and the process being told about them is
 /// the one that must be able to map them — which is never the process that
-/// minted the claim, because `/bin/init` mints every claim and holds none.
+/// minted the claim, because `/system/bin/init` mints every claim and holds none.
 #[repr(C)]
 #[derive(Clone, Copy)]
 pub struct FramebufferInfo {
diff --git a/toyos-abi/src/part.rs b/toyos-abi/src/part.rs
index 31e09c699f6..058dd2d96f5 100644
--- a/toyos-abi/src/part.rs
+++ b/toyos-abi/src/part.rs
@@ -1,6 +1,6 @@
 //! What a claim on one GPT partition names and hands its holder.
 //!
-//! A partition is claimed the way a PCI function is: `/bin/init` mints it from a
+//! A partition is claimed the way a PCI function is: `/system/bin/init` mints it from a
 //! `system.toml` `devices` entry and endows it, and the holder reads and writes
 //! the partition's blocks through [`syscall::partition_read`] and
 //! [`syscall::partition_write`], durable at [`syscall::fsync`] on the claim.
diff --git a/toyos-abi/src/syscall.rs b/toyos-abi/src/syscall.rs
index aa1356c1d84..c5e7af510f2 100644
--- a/toyos-abi/src/syscall.rs
+++ b/toyos-abi/src/syscall.rs
@@ -265,7 +265,7 @@ pub const SYS_PROCESS_KILL: u64 = 109;
 /// A `Process` handle for a pid, gated by [`Rights::MANAGE`] on a `SysCap`.
 /// See [`process_open`].
 ///
-/// The one place a pid becomes authority, and only `/bin/init` holds a cap that
+/// The one place a pid becomes authority, and only `/system/bin/init` holds a cap that
 /// carries the right — so the set of processes that can reach a process they
 /// did not start is exactly what init endowed.
 ///
@@ -273,7 +273,7 @@ pub const SYS_PROCESS_KILL: u64 = 109;
 pub const SYS_PROCESS_OPEN: u64 = 110;
 
 /// Mint a device claim for a class, gated by [`Rights::DEVICE`] on a `SysCap`.
-/// Only `/bin/init` holds such a cap, so the set of processes that can ever
+/// Only `/system/bin/init` holds such a cap, so the set of processes that can ever
 /// claim a device is exactly what init endowed. See [`device_claim`].
 ///
 /// [`Rights::DEVICE`]: crate::handle::Rights::DEVICE
@@ -301,7 +301,7 @@ pub const SYS_RT_ENTER: u64 = 112;
 /// [`crate::log`].
 ///
 /// **The kernel keeps no per-reader state**, so a second reader costs nothing
-/// and the stream is not consumed: `/bin/logd` and a `log-follow` tool coexist
+/// and the stream is not consumed: `/system/bin/logd` and a `log-follow` tool coexist
 /// with no coordination. Reading the whole machine's log is authority, which is
 /// why it rides a right rather than being ambient.
 ///
@@ -402,7 +402,7 @@ pub struct EndowEntry {
 
 const _: () = assert!(core::mem::size_of::<EndowEntry>() == 16);
 
-/// The label the kernel puts on `/bin/init`'s system capability, and the one
+/// The label the kernel puts on `/system/bin/init`'s system capability, and the one
 /// init puts on the `RT`-only dup it endows a `realtime` program.
 ///
 /// Here rather than in the SDK because the kernel writes it and userland reads
@@ -1186,7 +1186,7 @@ pub fn reboot(syscap: RawHandle) -> SyscallError {
 /// `devices` entry and a `dev:` endowment label spell each one with.
 ///
 /// **One row per class, so the four cannot disagree.** The build system checks
-/// a config against this table, `/bin/init` mints from it, and a claimant finds
+/// a config against this table, `/system/bin/init` mints from it, and a claimant finds
 /// its own claim by it; a second spelling anywhere is a class a config can name
 /// and no program can find. The wire number is here too, because a class whose
 /// number and name came from different lists is the same defect one level down.
diff --git a/toyos-manifest/src/lib.rs b/toyos-manifest/src/lib.rs
index c0330bb428c..f3244339a41 100644
--- a/toyos-manifest/src/lib.rs
+++ b/toyos-manifest/src/lib.rs
@@ -20,6 +20,7 @@
 //! receive <name>            a connector in this program's namespace
 //! device <class>            a claim init mints and endows
 //! syscap <right>            a right on the SysCap dup init endows
+//! service                   a system service: its `HOME` is `/state/<name>`, not the session's
 //! init-serve <name>         a name init serves itself
 //! start <name>              init starts this program at boot
 //! app-receive <name>        a connector every program launched from /apps holds
@@ -42,6 +43,13 @@ pub const GUEST_PATH: &str = "/system/etc/system.manifest";
 /// truncated into some other program's.
 pub const MAX_PROGRAM_NAME: usize = 32;
 
+/// The dev image's one user, until the users track gives init a login row.
+pub const USER: &str = "toy";
+
+/// Where each system service keeps its own persistent data, one directory per
+/// program key.
+pub const STATE: &str = "/state";
+
 pub use toyos_abi::handle::Rights;
 pub use toyos_abi::syscall::{DeviceRequest, DeviceType};
 
@@ -121,6 +129,21 @@ pub struct Program {
     /// the system may enter the RT band, mint a device claim, read the machine
     /// log, list every process in the machine, or power the machine off.
     pub syscap: Vec<String>,
+    /// A system service: its `HOME` is its own [`STATE`] directory rather
+    /// than the session user's home, so what it keeps is machine state and no
+    /// user's.
+    pub service: bool,
+}
+
+impl Program {
+    /// The `HOME` init starts this row with. A location grants nothing: what
+    /// the program can reach is its view's business, never this string's.
+    pub fn home(&self) -> String {
+        match self.service {
+            true => format!("{STATE}/{}", self.name),
+            false => format!("/home/{USER}"),
+        }
+    }
 }
 
 #[derive(Default, Debug, PartialEq, Eq)]
@@ -219,6 +242,9 @@ pub fn render(manifest: &Manifest) -> Result<Vec<u8>, RenderError> {
                 out.push_str(&format!("{word} {value}\n"));
             }
         }
+        if program.service {
+            out.push_str("service\n");
+        }
     }
     for name in &manifest.init_serves {
         check("init", "init_serves", name)?;
@@ -301,6 +327,7 @@ pub fn parse(text: &str) -> Manifest {
                     "receive" => program.receives.push(rest.to_string()),
                     "device" => program.devices.push(rest.to_string()),
                     "syscap" => program.syscap.push(rest.to_string()),
+                    "service" => program.service = true,
                     other => panic!("manifest: unknown record `{other}`"),
                 }
             }
@@ -330,6 +357,7 @@ mod tests {
                     serves: vec!["soundd".into()],
                     devices: vec!["hda-audio".into(), "virtio-sound".into()],
                     syscap: vec!["rt".into()],
+                    service: true,
                     ..Program::default()
                 },
                 Program {
@@ -368,6 +396,19 @@ mod tests {
         assert_eq!(parse(std::str::from_utf8(&rendered).unwrap()), manifest);
     }
 
+    /// A service keeps machine state under its own name, everything else is
+    /// the session's; and a package's synthesized row is never a service.
+    #[test]
+    fn a_service_s_home_is_its_state_and_every_other_row_s_the_session_s() {
+        let m = sample();
+        assert_eq!(m.program("soundd").unwrap().home(), "/state/soundd");
+        assert_eq!(m.program("terminal").unwrap().home(), "/home/toy");
+        assert_eq!(m.app_row("gbae", "/apps/gbae/gbae").home(), "/home/toy");
+        let m = parse("program sshd /system/bin/sshd\nservice\nprogram shell /system/bin/shell\n");
+        assert!(m.program("sshd").unwrap().service);
+        assert!(!m.program("shell").unwrap().service);
+    }
+
     #[test]
     fn the_same_manifest_renders_to_the_same_bytes() {
         assert_eq!(render(&sample()), render(&sample()));
diff --git a/toyos-manifest/src/package.rs b/toyos-manifest/src/package.rs
index fee8bb51e99..0b22d326d77 100644
--- a/toyos-manifest/src/package.rs
+++ b/toyos-manifest/src/package.rs
@@ -278,12 +278,12 @@ mod tests {
     /// Checked against the gate itself, not a shape written down twice.
     #[test]
     fn what_a_shell_resolves_is_what_the_launcher_accepts() {
-        let cwd = "/home/root/reltest";
+        let cwd = "/home/toy/reltest";
         for (typed, want) in [
-            ("./foo", "/home/root/reltest/foo"),
-            ("../bin/foo", "/home/root/bin/foo"),
-            ("./a/./b/../c", "/home/root/reltest/a/c"),
-            ("sub/foo", "/home/root/reltest/sub/foo"),
+            ("./foo", "/home/toy/reltest/foo"),
+            ("../bin/foo", "/home/toy/bin/foo"),
+            ("./a/./b/../c", "/home/toy/reltest/a/c"),
+            ("sub/foo", "/home/toy/reltest/sub/foo"),
             ("/system/bin/toybox", "/system/bin/toybox"),
             ("/system//bin/./toybox", "/system/bin/toybox"),
             ("/../system/bin/toybox", "/system/bin/toybox"),
diff --git a/toyos/Cargo.lock b/toyos/Cargo.lock
index b6f1c992a35..edfb915dfbc 100644
--- a/toyos/Cargo.lock
+++ b/toyos/Cargo.lock
@@ -10,7 +10,7 @@ checksum = "aa9c45b374136f52f2d6311062c7146bff20fec063c3f5d46a410bd937746955"
 
 [[package]]
 name = "toyos"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "rustc-std-workspace-core",
  "toyos-abi",
diff --git a/toyos/Cargo.toml b/toyos/Cargo.toml
index c83cc07068c..c01a7d3e463 100644
--- a/toyos/Cargo.toml
+++ b/toyos/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "toyos"
-version = "0.13.0"
+version = "0.14.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 description = "The ToyOS userland SDK: typed handles, IPC, ports, namespaces, surfaces and net."
diff --git a/toyos/src/device.rs b/toyos/src/device.rs
index e10864041de..4780403beff 100644
--- a/toyos/src/device.rs
+++ b/toyos/src/device.rs
@@ -1,7 +1,7 @@
 //! Hardware device access.
 //!
 //! Typed device wrappers, one per class. **None of them opens anything**: a
-//! claim is minted by `/bin/init` alone and arrives in this process's endowment
+//! claim is minted by `/system/bin/init` alone and arrives in this process's endowment
 //! table under `dev:<class>`, so [`crate::endow::device`] is the only way to
 //! get one and a program the manifest gives no device cannot express reaching
 //! hardware.
diff --git a/toyos/src/launch.rs b/toyos/src/launch.rs
index fa5e63b6eaa..2b2efc20a7d 100644
--- a/toyos/src/launch.rs
+++ b/toyos/src/launch.rs
@@ -1,4 +1,4 @@
-//! Asking `/bin/init` to start a declared program.
+//! Asking `/system/bin/init` to start a declared program.
 //!
 //! **`SYS_SPAWN` can only give a child what the caller holds, and that is not
 //! enough.** doom is started from a shell and doom is to hold sound; the shell
@@ -14,7 +14,7 @@
 //! its own manifest row rather than a narrowing of its parent's.
 //!
 //! The wire is a single frame plus one handle batch, and this module is both
-//! halves of it — std's `Command` encodes and `/bin/init` decodes.
+//! halves of it — std's `Command` encodes and `/system/bin/init` decodes.
 
 use crate::ipc::{Connection, IpcError};
 use crate::RawHandle;
@@ -55,8 +55,8 @@ const HEADER: usize = 32;
 pub struct Launch<'a> {
     /// The program's path, exactly as the caller resolved it.
     ///
-    /// **Not a `[programs]` key**, because `/bin/ls` is a symlink to
-    /// `/bin/toybox` and the row that says what an applet may hold is
+    /// **Not a `[programs]` key**, because `/system/bin/ls` is a symlink to
+    /// `/system/bin/toybox` and the row that says what an applet may hold is
     /// `toybox`'s. init resolves the path to a key; the caller does not parse
     /// the manifest and there is deliberately no second reader of it.
     pub program: &'a str,
diff --git a/toyos/src/lib.rs b/toyos/src/lib.rs
index 02b47116354..e3bccec483d 100644
--- a/toyos/src/lib.rs
+++ b/toyos/src/lib.rs
@@ -104,7 +104,7 @@ impl Drop for OwnedHandle {
 
 /// A claimed hardware device, out of this process's endowment table.
 ///
-/// There is no `open`: `/bin/init` mints every claim from the machine's one
+/// There is no `open`: `/system/bin/init` mints every claim from the machine's one
 /// system capability and endows it, so which process drives a device is a fact
 /// the image was built with. See [`endow::device`].
 pub struct Device(pub(crate) OwnedHandle);
diff --git a/toyos/src/log.rs b/toyos/src/log.rs
index 59300e81c11..55bc6248fdf 100644
--- a/toyos/src/log.rs
+++ b/toyos/src/log.rs
@@ -21,7 +21,7 @@ use crate::AsHandle;
 ///
 /// A fresh tail starts at the oldest record every shard still holds, which is
 /// the whole boot on a machine that has not logged 512 records on any CPU yet —
-/// so `/bin/logd` starting late still writes this boot's log from its first
+/// so `/system/bin/logd` starting late still writes this boot's log from its first
 /// line.
 pub struct LogTail {
     cursor: LogCursor,
diff --git a/toyos/src/namespace.rs b/toyos/src/namespace.rs
index 6f2acc14ba9..5aa6ba69b74 100644
--- a/toyos/src/namespace.rs
+++ b/toyos/src/namespace.rs
@@ -60,7 +60,7 @@ pub struct Builder<'a> {
 }
 
 /// A fixed-capacity name blob and vector, so building a namespace needs no
-/// allocator — `/bin/init` builds one per program before anything else runs.
+/// allocator — `/system/bin/init` builds one per program before anything else runs.
 mod heapless_names {
     use toyos_abi::syscall::{MAX_NAMESPACE_ENTRIES, MAX_SERVICE_NAME};
 
diff --git a/toyos/src/net.rs b/toyos/src/net.rs
index d16deaf8b7f..fb43de4a558 100644
--- a/toyos/src/net.rs
+++ b/toyos/src/net.rs
@@ -328,7 +328,7 @@ impl NetdConn {
 /// already exited *succeeds* — the connection queues on a port nobody will
 /// ever accept from — and the hang-up arrives at the first send or the first
 /// read instead. Reporting that as [`NetError::Io`] left every caller unable
-/// to tell "this machine has no network" from "netd failed", and `/bin/sshd`
+/// to tell "this machine has no network" from "netd failed", and `/system/bin/sshd`
 /// panicked across the boot of every NIC-less machine that lost the race
 /// rather than exiting with the line it has for exactly this.
 ///
@@ -603,7 +603,7 @@ mod tests {
 
     /// Everything that is *not* a peer that has gone. Each of these on a
     /// machine with a live netd is a real failure and must reach the caller as
-    /// one — `/bin/sshd` panics on `NetError::Io` by design.
+    /// one — `/system/bin/sshd` panics on `NetError::Io` by design.
     #[test]
     fn nothing_else_becomes_a_missing_netd() {
         for e in [
diff --git a/toyos/src/surface.rs b/toyos/src/surface.rs
index 59703927e66..fc33ed3ae9b 100644
--- a/toyos/src/surface.rs
+++ b/toyos/src/surface.rs
@@ -1,7 +1,7 @@
 //! Key events down the surface tree.
 //!
 //! A **surface** is something with a screen and a keyboard: the compositor's
-//! windows, `/bin/terminal`, `/bin/console`. Its owner reads key transitions
+//! windows, `/system/bin/terminal`, `/system/bin/console`. Its owner reads key transitions
 //! from whatever is above it and decides what they mean — which for a terminal
 //! is bytes on its child's stdin, through a [`toyos_keymap::Translator`] it
 //! owns alone.
@@ -47,10 +47,9 @@ pub const SERVICE: &str = "surface";
 
 /// The file that says which keyboard layout this machine uses.
 ///
-/// One path, read by every translator and written by `locale` alone. It is on
-/// tmpfs until a writable store lands, so it survives a login and not a
-/// reboot.
-pub const LAYOUT_CONFIG: &str = "/home/root/.config/keyboard_layout";
+/// One path, read by every translator and written by `locale` alone. A machine
+/// setting, so it is in `/config` and in no user's home.
+pub const LAYOUT_CONFIG: &str = "/config/keyboard-layout";
 
 /// SAFETY: `RawKeyEvent` is `#[repr(C)]` and two `u8`s, so it has no padding
 /// and no pointers, and every bit pattern of both fields is a valid value —
diff --git a/toyos/src/syscap.rs b/toyos/src/syscap.rs
index 5318fbd979f..90b12ae0be6 100644
--- a/toyos/src/syscap.rs
+++ b/toyos/src/syscap.rs
@@ -4,7 +4,7 @@
 //! the real-time band, turning a pid into a process handle, listing every
 //! process in the machine, reading what the machine is made of, and taking its
 //! power away, off or back to firmware — and each is one bit on a handle to
-//! this. The kernel makes exactly one at boot, for `/bin/init`, so the set of
+//! this. The kernel makes exactly one at boot, for `/system/bin/init`, so the set of
 //! processes that can ever do any of them is exactly what init endowed.
 
 use toyos_abi::handle::Rights;
@@ -95,7 +95,7 @@ impl SysCap {
     ///
     /// Needs [`Rights::ROSTER`], which is what makes the entries — a pid, a
     /// size, a CPU time and a **name** for every process in the machine — the
-    /// business of `/bin/ps` and not of every program that can make a syscall.
+    /// business of `/system/bin/ps` and not of every program that can make a syscall.
     /// [`crate::system::sysinfo`] is the header on its own and needs nothing.
     ///
     /// A `buf` too small for an entry asks for the header, which this
@@ -131,7 +131,7 @@ impl SysCap {
     ///
     /// The one place a pid becomes authority over anything, and only a cap
     /// carrying [`Rights::MANAGE`] reaches it — which in the whole system is
-    /// `/bin/init`'s.
+    /// `/system/bin/init`'s.
     pub fn open_process(&self, pid: toyos_abi::Pid) -> Result<crate::process::Process, SyscallError> {
         let raw = syscall::process_open(self.0.raw(), pid)?;
         // SAFETY: the kernel installed this handle in this process's table for
diff --git a/userland/Cargo.lock b/userland/Cargo.lock
index 6c4c38cc7b0..c1c55c6d3e0 100644
--- a/userland/Cargo.lock
+++ b/userland/Cargo.lock
@@ -477,13 +477,13 @@ name = "compositor"
 version = "0.1.0"
 dependencies = [
  "sprite",
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-desktop",
  "toyos-font 0.2.0",
  "toyos-inspect",
  "toyos-manifest",
- "toyos-window 0.14.0",
+ "toyos-window 0.15.0",
 ]
 
 [[package]]
@@ -500,11 +500,11 @@ name = "console"
 version = "0.1.0"
 dependencies = [
  "terminal",
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-font 0.2.0",
  "toyos-logstream",
- "toyos-window 0.14.0",
+ "toyos-window 0.15.0",
 ]
 
 [[package]]
@@ -989,7 +989,7 @@ version = "0.1.0"
 dependencies = [
  "filepicker-api",
  "toyos-font 0.2.0",
- "toyos-window 0.14.0",
+ "toyos-window 0.15.0",
 ]
 
 [[package]]
@@ -1109,16 +1109,16 @@ name = "filepicker"
 version = "0.1.0"
 dependencies = [
  "filepicker-api",
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-font 0.2.0",
- "toyos-window 0.14.0",
+ "toyos-window 0.15.0",
 ]
 
 [[package]]
 name = "filepicker-api"
 version = "0.1.0"
 dependencies = [
- "toyos 0.13.0",
+ "toyos 0.14.0",
 ]
 
 [[package]]
@@ -1127,7 +1127,7 @@ version = "0.1.0"
 dependencies = [
  "sprite",
  "toyos-font 0.2.0",
- "toyos-window 0.14.0",
+ "toyos-window 0.15.0",
 ]
 
 [[package]]
@@ -1532,7 +1532,7 @@ dependencies = [
 name = "init"
 version = "0.1.0"
 dependencies = [
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-logstream",
  "toyos-manifest",
@@ -1567,7 +1567,7 @@ version = "0.1.0"
 name = "inspect"
 version = "0.1.0"
 dependencies = [
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-inspect",
 ]
@@ -1816,7 +1816,7 @@ checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 name = "logd"
 version = "0.1.0"
 dependencies = [
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-inspect",
  "toyos-logstream",
@@ -1852,7 +1852,7 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 name = "metalprobe"
 version = "0.1.0"
 dependencies = [
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-tco",
 ]
@@ -1938,7 +1938,7 @@ name = "netd"
 version = "0.0.0"
 dependencies = [
  "smoltcp",
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-dns",
  "toyos-i219",
@@ -2321,7 +2321,7 @@ version = "0.1.0"
 dependencies = [
  "filepicker-api",
  "toyos-font 0.2.0",
- "toyos-window 0.14.0",
+ "toyos-window 0.15.0",
 ]
 
 [[package]]
@@ -3287,7 +3287,7 @@ dependencies = [
 name = "shell"
 version = "0.1.0"
 dependencies = [
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-manifest",
 ]
 
@@ -3439,7 +3439,7 @@ name = "soundd"
 version = "0.0.0"
 dependencies = [
  "rubato",
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-hda",
  "toyos-inspect",
@@ -3515,7 +3515,7 @@ dependencies = [
  "rand 0.10.0",
  "russh",
  "tokio",
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-swap",
 ]
 
@@ -3582,16 +3582,16 @@ dependencies = [
 name = "terminal"
 version = "0.1.0"
 dependencies = [
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-font 0.2.0",
- "toyos-window 0.14.0",
+ "toyos-window 0.15.0",
 ]
 
 [[package]]
 name = "test-runner"
 version = "0.1.0"
 dependencies = [
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-tco",
 ]
@@ -3722,10 +3722,10 @@ name = "toybox"
 version = "0.1.0"
 dependencies = [
  "cpal",
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-keymap 0.1.0",
- "toyos-window 0.14.0",
+ "toyos-window 0.15.0",
 ]
 
 [[package]]
@@ -3748,7 +3748,7 @@ dependencies = [
 
 [[package]]
 name = "toyos"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "toyos-abi 0.12.0",
 ]
@@ -3867,9 +3867,9 @@ dependencies = [
 
 [[package]]
 name = "toyos-window"
-version = "0.14.0"
+version = "0.15.0"
 dependencies = [
- "toyos 0.13.0",
+ "toyos 0.14.0",
  "toyos-abi 0.12.0",
  "toyos-font 0.2.0",
  "toyos-keymap 0.1.0",
diff --git a/userland/files/src/main.rs b/userland/files/src/main.rs
index ca3c130ac37..27c7a6e1eae 100644
--- a/userland/files/src/main.rs
+++ b/userland/files/src/main.rs
@@ -65,7 +65,7 @@ impl FileBrowser {
         let folder_icon = Sprite::from_svg_colored(&folder_svg, ICON_SIZE as u32, [0xf0, 0xc8, 0x50]);
         let file_icon = Sprite::from_svg_colored(&file_svg, ICON_SIZE as u32, [0xd0, 0xd0, 0xd8]);
 
-        let current_dir = PathBuf::from("/home/root");
+        let current_dir = std::env::home_dir().expect("files: init starts every program with HOME");
 
         let mut browser = Self {
             window,
diff --git a/userland/init/src/main.rs b/userland/init/src/main.rs
index 7279603861a..6f4425e3db1 100644
--- a/userland/init/src/main.rs
+++ b/userland/init/src/main.rs
@@ -26,6 +26,10 @@
 //! once, so a client's next connect is `ServerGone` exactly as it is for a
 //! server nothing keeps. A program started through `launcher` still gets its
 //! acceptor by move and is started once per boot.
+//!
+//! **Every program it starts gets `HOME` from its row** (`Program::home`), over
+//! anything a launching caller carried: a service its own `/state/<name>`, made
+//! before it runs, and everything else the session user's home, made at boot.
 
 /// One line, one `write`, into init's own pipe to `logd` ([`Log`]): a line of
 /// init's is a line in the log under init's name, whether or not `logd` has run
@@ -66,6 +70,11 @@ use toyos_abi::syscall::{
 /// manifest carries it as an `init-serve` record.
 const LAUNCHER: &str = "launcher";
 
+/// What init makes in the session user's home before anything runs. English on
+/// disk in every locale: a translation is a label, never a rename.
+const HOME_FOLDERS: [&str; 8] =
+    ["Apps", "Desktop", "Documents", "Downloads", "Fonts", "Music", "Pictures", "Videos"];
+
 /// Connections accepted and not yet carrying a whole launch.
 ///
 /// **The bound is init's handle table, not memory.** A connection nobody has
@@ -177,6 +186,30 @@ impl Log {
     }
 }
 
+/// The session user's home and [`HOME_FOLDERS`]. A boot whose DATA volume did
+/// not mount has no `/home`, which the kernel has already said; this says what
+/// it cost and starts the machine without it.
+fn make_session_home() {
+    let home = format!("/home/{}", toyos_manifest::USER);
+    let folders = HOME_FOLDERS.iter().map(|folder| format!("{home}/{folder}"));
+    for path in std::iter::once(home.clone()).chain(folders) {
+        if let Err(e) = make_dir(&path) {
+            say!("init: {path} could not be made, so this boot has no session home: {e}");
+            return;
+        }
+    }
+}
+
+/// One directory, whose parent is there already. Not `create_dir_all`: DATA
+/// keeps no directories, and the VFS's own record of one takes a child whose
+/// parent it never made, so every level is made in turn.
+fn make_dir(path: &str) -> std::io::Result<()> {
+    match std::fs::create_dir(path) {
+        Err(e) if e.kind() != std::io::ErrorKind::AlreadyExists => Err(e),
+        _ => Ok(()),
+    }
+}
+
 fn main() {
     // Before anything is started, so every program's first line has a pipe to
     // go into, and before init says anything.
@@ -186,6 +219,8 @@ fn main() {
         .take(SYSCAP_LABEL)
         .expect("init: the kernel spawns this program holding the system capability");
 
+    make_session_home();
+
     let text = std::fs::read_to_string(toyos_manifest::GUEST_PATH)
         .unwrap_or_else(|e| panic!("init: cannot read {}: {e}", toyos_manifest::GUEST_PATH));
     let system = toyos_manifest::parse(&text);
@@ -1132,6 +1167,16 @@ fn start<'a>(
     command.args(&program.args);
     let booting = log.is_some();
 
+    // **Set here, over whatever a launching caller carried**: the row decides
+    // where a program's home is, and a service's is made before it first runs.
+    let home = program.home();
+    if program.service {
+        if let Err(e) = make_dir(&home) {
+            say!("init: {}: {home} could not be made: {e}", program.name);
+        }
+    }
+    command.env("HOME", &home);
+
     // **Everything endowed stays owned until the spawn that moves it
     // succeeds.** `endow` records a number; a refused spawn moves nothing
     // (`build_child_handles` is all-or-nothing), so a handle whose owner had
diff --git a/userland/libc/Cargo.lock b/userland/libc/Cargo.lock
index 0af49dca0ca..a13ddee4b71 100644
--- a/userland/libc/Cargo.lock
+++ b/userland/libc/Cargo.lock
@@ -27,7 +27,7 @@ checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
 [[package]]
 name = "toyos"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "toyos-abi",
 ]
diff --git a/userland/shell/src/main.rs b/userland/shell/src/main.rs
index 2d99cf5258d..9ceff9d375f 100644
--- a/userland/shell/src/main.rs
+++ b/userland/shell/src/main.rs
@@ -8,7 +8,9 @@ use std::sync::OnceLock;
 
 use toyos::port::Connector;
 
-const HISTORY_PATH: &str = "/home/root/.config/shell_history";
+/// Where the history lives under `$HOME`: this program's own `State` in the
+/// session's `Apps`, never a dotfile in the user's home.
+const HISTORY: &str = "Apps/shell/State/history";
 const HISTORY_MAX: usize = 200;
 
 static mut LAST_STATUS: i32 = 0;
@@ -17,9 +19,6 @@ fn main() {
     if env::var_os("PATH").is_none() {
         env::set_var("PATH", "/system/bin");
     }
-    if env::var_os("HOME").is_none() {
-        env::set_var("HOME", "/home/root");
-    }
 
     let args: Vec<String> = env::args().collect();
     if args.len() >= 3 && args[1] == "-c" {
@@ -28,8 +27,9 @@ fn main() {
         std::process::exit(unsafe { LAST_STATUS });
     }
 
-    let home = env::var("HOME").unwrap_or_else(|_| "/".into());
-    let _ = env::set_current_dir(&home);
+    if let Some(home) = env::var_os("HOME") {
+        let _ = env::set_current_dir(home);
+    }
     let mut history = load_history();
     std::os::toyos::io::set_stdin_raw(true);
 
@@ -795,15 +795,24 @@ fn print_help() {
 
 // --- History ---
 
+fn history_path() -> Option<std::path::PathBuf> {
+    env::var_os("HOME").map(|home| Path::new(&home).join(HISTORY))
+}
+
 fn load_history() -> Vec<String> {
-    fs::read_to_string(HISTORY_PATH)
+    let Some(path) = history_path() else { return Vec::new() };
+    fs::read_to_string(path)
         .map(|s| s.lines().map(String::from).collect())
         .unwrap_or_default()
 }
 
 fn save_history(history: &[String]) {
+    let Some(path) = history_path() else { return };
     let content = history.join("\n");
-    let _ = fs::write(HISTORY_PATH, &content);
+    if let Some(dir) = path.parent() {
+        let _ = fs::create_dir_all(dir);
+    }
+    let _ = fs::write(path, &content);
 }
 
 // --- Readline helpers ---
diff --git a/userland/sshd/src/main.rs b/userland/sshd/src/main.rs
index a49954d42a6..8a2482e5216 100644
--- a/userland/sshd/src/main.rs
+++ b/userland/sshd/src/main.rs
@@ -25,23 +25,30 @@ use russh::server::{Auth, Msg, Server, Session};
 use russh::{Channel, ChannelId, MethodKind, MethodSet};
 use tokio::sync::{mpsc, watch};
 
-/// Where this machine keeps its SSH identity and the keys it trusts. `/home`
-/// is the only mount that is both persistent and writable by userland; where
-/// it is a tmpfs the identity lasts one boot, which the fingerprint printed at
-/// every start is what makes visible.
-const SSH_DIR: &str = "/home/root/.ssh";
-const HOST_KEY: &str = "/home/root/.ssh/host_ed25519";
+/// Where this machine keeps its SSH identity and the keys it trusts: this
+/// daemon's own `HOME`, which init makes `/state/sshd`. Machine state, so it is
+/// in no user's home; where DATA is a tmpfs the identity lasts one boot, which
+/// the fingerprint printed at every start is what makes visible.
+fn state() -> String {
+    let home = std::env::home_dir().expect("sshd: init starts every service with HOME");
+    home.to_str().expect("sshd: HOME is not UTF-8").to_string()
+}
+
+fn host_key_path() -> String {
+    format!("{}/host_ed25519", state())
+}
 
 /// The two files that name who may log in; a key in either authorizes.
 ///
 /// **The second is why a freshly flashed machine can be reached at all.** A
-/// bench boot mints an identity into a `/home` that may be a tmpfs and starts
+/// bench boot mints an identity into a `/state` that may be a tmpfs and starts
 /// with nothing in it, so a key that has to be *installed* before the first
 /// login is a key nobody can install. Neither file is protected from anything
 /// else on the machine — see
 /// `issues/isolation/sshd-authorized-keys-unprotected.md`.
-const AUTHORIZED_KEYS: [&str; 2] =
-    ["/home/root/.ssh/authorized_keys", "/system/etc/ssh_authorized_keys"];
+fn authorized_keys() -> [String; 2] {
+    [format!("{}/authorized_keys", state()), "/system/etc/ssh_authorized_keys".to_string()]
+}
 
 /// How long a program may take none of the input a client is sending before
 /// this daemon stops offering it and the program runs on with a closed stdin.
@@ -69,27 +76,27 @@ const EXTENDED_STDERR: u32 = 1;
 /// over it would change the identity every client has pinned without anyone
 /// asking, which is the one event a host key exists to make noisy.
 fn host_key() -> Result<PrivateKey, String> {
-    match fs::read(HOST_KEY) {
+    let path = host_key_path();
+    match fs::read(&path) {
         Ok(pem) => PrivateKey::from_openssh(&pem).map_err(|e| {
             format!(
-                "{HOST_KEY} is not an OpenSSH private key ({e}); refusing to \
+                "{path} is not an OpenSSH private key ({e}); refusing to \
                  replace it — move it aside to mint a new identity"
             )
         }),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => mint_host_key(),
-        Err(e) => Err(format!("cannot read {HOST_KEY}: {e}")),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => mint_host_key(&path),
+        Err(e) => Err(format!("cannot read {path}: {e}")),
     }
 }
 
-fn mint_host_key() -> Result<PrivateKey, String> {
+fn mint_host_key(path: &str) -> Result<PrivateKey, String> {
     let key = PrivateKey::random(&mut rand::rng(), Algorithm::Ed25519)
         .map_err(|e| format!("cannot generate a host key: {e}"))?;
     let pem = key
         .to_openssh(LineEnding::LF)
         .map_err(|e| format!("cannot encode the host key: {e}"))?;
-    fs::create_dir_all(SSH_DIR).map_err(|e| format!("cannot create {SSH_DIR}: {e}"))?;
-    fs::write(HOST_KEY, pem.as_bytes()).map_err(|e| format!("cannot write {HOST_KEY}: {e}"))?;
-    println!("sshd: minted a new host identity at {HOST_KEY}");
+    fs::write(path, pem.as_bytes()).map_err(|e| format!("cannot write {path}: {e}"))?;
+    println!("sshd: minted a new host identity at {path}");
     Ok(key)
 }
 
@@ -114,7 +121,7 @@ fn authorizes(text: &str, offered: &PublicKey) -> bool {
 /// restart — there is nothing here to send a reload signal to. An unreadable
 /// file names nobody, so every failure answers "not authorized".
 fn is_authorized(key: &PublicKey) -> bool {
-    AUTHORIZED_KEYS
+    authorized_keys()
         .iter()
         .any(|path| fs::read_to_string(path).is_ok_and(|text| authorizes(&text, key)))
 }
@@ -123,8 +130,8 @@ fn is_authorized(key: &PublicKey) -> bool {
 /// visible before somebody tries it. `Err` means nobody can authenticate.
 fn authorized_key_count() -> Result<usize, String> {
     let mut total = 0;
-    for path in AUTHORIZED_KEYS {
-        let text = match fs::read_to_string(path) {
+    for path in authorized_keys() {
+        let text = match fs::read_to_string(&path) {
             Ok(text) => text,
             Err(e) => {
                 println!("sshd: cannot read {path} ({e})");
@@ -154,7 +161,7 @@ fn authorized_key_count() -> Result<usize, String> {
     if total == 0 {
         return Err(format!(
             "no file names a usable key ({}); put a public key in one of them and start again",
-            AUTHORIZED_KEYS.join(" or ")
+            authorized_keys().join(" or ")
         ));
     }
     Ok(total)
diff --git a/userland/toyos-window/Cargo.toml b/userland/toyos-window/Cargo.toml
index 0b9802d9a03..eaf58aa83fb 100644
--- a/userland/toyos-window/Cargo.toml
+++ b/userland/toyos-window/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "toyos-window"
-version = "0.14.0"
+version = "0.15.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 description = "Client library for ToyOS windows: create one, draw into it, read its events."
@@ -10,7 +10,7 @@ repository = "https://github.com/ToyOSOrg/ToyOS"
 toyos-font = { path = "../toyos-font", version = "0.2.0" }
 toyos-abi = { path = "../../toyos-abi", version = "0.12.0" }
 toyos-keymap = { path = "../../toyos-keymap", version = "0.1.0" }
-toyos = { path = "../../toyos", version = "0.13.0" }
+toyos = { path = "../../toyos", version = "0.14.0" }
 
 # `window` is taken on crates.io, so the package is `toyos-window`; the lib
 # target keeps the name every caller spells, `toyos/src`'s citations included.
diff --git a/userland/toyos-window/src/lib.rs b/userland/toyos-window/src/lib.rs
index 98c1707d94e..af586459f93 100644
--- a/userland/toyos-window/src/lib.rs
+++ b/userland/toyos-window/src/lib.rs
@@ -10,7 +10,7 @@ use toyos::surface;
 use toyos::Connection;
 use toyos::shm::SharedMemory;
 /// Re-exported because [`KeyPress`] is made of them and a client that holds
-/// its own translator — `/bin/console`, a test that stands in for a surface —
+/// its own translator — `/system/bin/console`, a test that stands in for a surface —
 /// should not have to name a second crate to do what this one does.
 pub use toyos_keymap::{Emit, Mods, Translator};
 

From 3ab6d0e8650d89db9629b09c5e4133a065127e4c Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sat, 26 Sep 2026 17:53:48 +0200
Subject: [PATCH 2/7] layout_fresh_boot waits for sshd's end, not for its last
 line

A std whose `home_dir` answers `None` makes sshd refuse before it says
anything, and waiting on a line it never prints turned that red into a
300 s STALL the harness reads as saying nothing about the tree. The
kernel's `exit: sshd` record comes however sshd fares, so the wait ends on
the event and the mint line is then asserted by name.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014iqcj4jDKpaiDX8B7CMvmK
---
 tests/toyos.rs | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/toyos.rs b/tests/toyos.rs
index da25ae9af91..e0f46ed679d 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -14747,16 +14747,16 @@ fn run_machine_test(
             // The layout as ruled, on a boot of its own with a blank DATA
             // volume: three services, each given a `/state` of its own, and a
             // session program whose child is the judge. sshd's identity is the
-            // one file a service writes on every such boot, and sshd's last line
-            // on a boot that stages no key follows it, so the listing waits for
-            // that line rather than for a clock.
+            // one file a service writes on every such boot, and on a boot that
+            // stages no key sshd then ends, however it fares; so the listing
+            // waits for the kernel's record of that end rather than for a clock.
             let config = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/sshdcase");
             let options = BootOptions { profile: qemu::Profile::Headless, ..Default::default() };
             let mut qemu = QemuInstance::boot_with_options(&config, &[], rust_bins, options);
             let mut console = qemu.boot_log().to_string();
             const MINTED: &str = "sshd: minted a new host identity at /state/sshd/host_ed25519";
-            await_guest(&mut qemu, &mut console, "sshd's last line", |c| {
-                c.contains("sshd: no file names a usable key")
+            await_guest(&mut qemu, &mut console, "sshd's end", |c| {
+                c.contains("exit: sshd pid=")
             })
             .map_err(|why| format!("{why}\n{console}"))?;
             if !console.contains(MINTED) {

From 1b8d4599aa6e8d1b78e26dcdbbd3092b7887995e Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sat, 26 Sep 2026 18:04:40 +0200
Subject: [PATCH 3/7] issues: a lane's tap socket path is past SUN_LEN on the
 dev host

The fast tier on this branch, after merging origin/main at e48604c0, reds
lan_mdns_answer wide and alone on a 104-byte socket path under the new
toyos-tmpdir scratch root. Nothing on this branch touches the lane or the
tap; filed for its owner.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014iqcj4jDKpaiDX8B7CMvmK
---
 ...et-path-is-past-sun-len-on-the-dev-host.md | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 issues/build/a-lane-s-tap-socket-path-is-past-sun-len-on-the-dev-host.md

diff --git a/issues/build/a-lane-s-tap-socket-path-is-past-sun-len-on-the-dev-host.md b/issues/build/a-lane-s-tap-socket-path-is-past-sun-len-on-the-dev-host.md
new file mode 100644
index 00000000000..a055bb032a6
--- /dev/null
+++ b/issues/build/a-lane-s-tap-socket-path-is-past-sun-len-on-the-dev-host.md
@@ -0,0 +1,27 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-26
+---
+
+# A lane's tap socket path is past `SUN_LEN` on the dev host
+
+`lan_mdns_answer` reds on the macOS dev host, wide and alone:
+
+```
+connect to QEMU's /private/var/folders/gr/mr4_fg4n34jb417sx1g5cgxc0000gp/T/toyos-tmp-89085-0/tests-0/lane-3/tap-out-0.sock: path must be shorter than SUN_LEN
+```
+
+That path is 104 bytes, and macOS's `sun_path` holds 104 including the NUL.
+`tests/common/segment.rs`'s `Tap::in_lane` puts both sockets in
+`lane::dir()`, which since `toyos-tmpdir` is
+`$TMPDIR/toyos-tmp-<pid>-<n>/tests-<n>/lane-<i>/`, and the dev host's
+`$TMPDIR` resolves to 57 bytes (`/private/var/folders/…/T/`) before any of
+that. A five-digit pid is enough to cross the limit. Seen on
+`wt/toyos-layout` after it merged `origin/main` at `e48604c0`; nothing on that
+branch touches the lane or the tap.
+
+## Exit condition
+
+A tap socket's path fits `sun_path` on every host the suite runs on, and
+`lan_mdns_answer` is green on the dev host.

From 75942e245e5d17a9ea5c0a0071c997e1c9822d9b Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sat, 26 Sep 2026 18:43:35 +0200
Subject: [PATCH 4/7] Answer the review: HOME is init's on every spawn path,
 and the layout is asked over ssh

The review of 1b8d4599 found four blockers and a fast-tier question.

HOME on the direct path. std's direct spawn handed a child the parent's
whole environment, so an ssh exec of an undeclared binary ran with
HOME=/state/sshd. init now answers a launch of an undeclared program with
the session's HOME (MSG_NOT_DECLARED carries it; toyos::launch's
Outcome::NotDeclared has it), and std's direct spawn carries only a HOME
its caller named or init answered, never its own (fork commit 957f1426,
merged with toyos-inbox at 7a809b75, #520's pin, in 80ea645f).

The layout, asked over the cable. layout_fresh_boot boots
tests/layoutcase (sshdcase plus a declared shell and the locale applet)
with a staged key, then over ssh: `shell -c 'echo $HOME'` must print
/home/toy (a launched row's HOME is init's, over sshd's); `locale de` and
an interactive shell write /config/keyboard-layout and the shell's
history; and test_rs_layout_paths, declared nowhere so sshd spawns it
directly, asserts its HOME, both files by literal path, and the exact
listings of /home/toy and /state.

An empty directory is listed. Vfs::list names the directories the VFS
carries in created_dirs, so an empty dot-folder is in its parent's
listing and the dotfile walk sees it. The filed DATA-directory issue
loses that bullet and its slug says what is left.

Also: a manifest row that serves a port and is not marked a service is
refused at render, and every config is rendered by a host test; init's
folder failure no longer says the whole session home is missing; the
shell's history finds its own folder whether HOME is the session's or,
at stage 2, the folder itself; the track records the owner's rulings,
gains a time-zone, a language and a fonts stage, and no longer ships
JetBrains Mono here, which leaves src/assets.rs and NOTICE to #528;
the sshd fail-closed issue is closed, its exit met by the blank DATA
volume every image-less boot gets.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014iqcj4jDKpaiDX8B7CMvmK
---
 NOTICE                                        | 10 +--
 ...-home-no-earlier-boot-of-its-lane-wrote.md | 24 ------
 ...-on-data-is-in-no-listing-and-no-reboot.md | 41 ----------
 .../a-directory-on-data-survives-no-reboot.md | 33 ++++++++
 issues/filesystem/where-everything-lives.md   | 44 ++++++++---
 kernel/src/vfs.rs                             | 14 ++++
 rust                                          |  2 +-
 src/assets.rs                                 | 59 +-------------
 src/build.rs                                  | 13 ++++
 tests/common/ssh.rs                           | 15 +++-
 tests/layoutcase/system.toml                  | 38 +++++++++
 .../src/bin/launcher_refusals.rs              |  2 +-
 .../toyos-rust-tests/src/bin/layout_paths.rs  | 67 ++++++++++------
 tests/toyos.rs                                | 78 +++++++++++++------
 toyos-manifest/src/lib.rs                     | 28 ++++++-
 toyos/src/launch.rs                           | 30 +++++--
 userland/init/src/main.rs                     | 27 ++++---
 userland/shell/src/main.rs                    | 12 ++-
 18 files changed, 322 insertions(+), 215 deletions(-)
 delete mode 100644 issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md
 delete mode 100644 issues/filesystem/a-directory-on-data-is-in-no-listing-and-no-reboot.md
 create mode 100644 issues/filesystem/a-directory-on-data-survives-no-reboot.md
 create mode 100644 tests/layoutcase/system.toml

diff --git a/NOTICE b/NOTICE
index 7619294b8b1..b97394572a8 100644
--- a/NOTICE
+++ b/NOTICE
@@ -157,14 +157,8 @@ Two derived artifacts come from it, and whether a 1-bit rasterization is still
 - `share/fonts/JetBrainsMono-Regular-8x16.font` on every ROOT that ships
   `assets/`, rasterized at build time by `src/assets.rs`.
 
-The OFL's reserved-name clause is not engaged: neither derived artifact is
-distributed as a font under the JetBrains Mono name.
-
-The font itself ships unmodified as `share/fonts/jetbrainsmono-regular.ttf` on
-every ROOT that ships `assets/`, the system's monospace family where fontdb and
-fontique look, with its licence text beside it as
-`share/licenses/OFL-1.1-JetBrainsMono.txt`: the OFL permits bundling and
-redistributing it with any software, provided that text travels with it.
+The OFL's reserved-name clause is not engaged: neither artifact is distributed
+as a font under the JetBrains Mono name.
 
 
 assets/icons/*.svg — Phosphor Icons, MIT
diff --git a/issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md b/issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md
deleted file mode 100644
index 3edec411602..00000000000
--- a/issues/build/sshd-fail-closed-assumes-a-home-no-earlier-boot-of-its-lane-wrote.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-status: open
-kind: tooling
-opened: 2026-09-24
----
-
-# `sshd_fail_closed` assumes a `/state/sshd` no earlier boot of its lane wrote
-
-`sshd_fail_closed` owes `sshd: minted a new host identity at
-/state/sshd/host_ed25519`, and boots `tests/sshdcase` on the lane's shared
-scratch disk (`tests/common/qemu.rs`: "Reused across the boots of one lane").
-Any earlier boot of the same lane whose sshd ran leaves its identity on that
-disk, and this boot then reads it and mints nothing.
-
-Seen on CI (run 35984557404, shard 5): `lan_talk` ran first in the lane and its
-sshd minted a key; `sshd_fail_closed` then said `host identity SHA256:yYw2…`
-with the same fingerprint on both of its runs and no `minted` line, red twice.
-On main the two had not shared a shard. `lan_talk` now boots a disk of its own,
-which removes this one neighbour and not the premise.
-
-## Exit condition
-
-`sshd_fail_closed` boots a disk of its own, as `tests/common/pkg.rs` does, so
-its verdict does not depend on which tests the shard split put before it.
diff --git a/issues/filesystem/a-directory-on-data-is-in-no-listing-and-no-reboot.md b/issues/filesystem/a-directory-on-data-is-in-no-listing-and-no-reboot.md
deleted file mode 100644
index 886fe295595..00000000000
--- a/issues/filesystem/a-directory-on-data-is-in-no-listing-and-no-reboot.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-status: open
-kind: defect
-opened: 2026-09-26
----
-
-# A directory on DATA is in no listing and survives no reboot
-
-The DATA adapter answers every `create_dir` with `NotSupported`
-(`kernel/src/bcachefs_adapter.rs`), so the VFS keeps the directory itself in
-`created_dirs` (`kernel/src/vfs.rs`). Three things follow:
-
-- **No listing of the parent shows it.** `Vfs::list` builds its answer from
-  the filesystem's files and consults `created_dirs` only to decide whether the
-  listed directory itself exists. After init makes `/home/toy` and its eight
-  folders, `ls /home/toy` prints nothing and `ls /home` does not name `toy`.
-  A directory appears in its parent's listing only once a file is under it.
-- **A child is taken whose parent was never made.** `create_dir("/home/toy/Apps")`
-  succeeds with no `/home/toy`, so `std::fs::create_dir_all` makes the leaf and
-  nothing above it, and `read_dir("/home/toy")` then answers `NotFound`. init
-  makes every level in turn for this reason (`make_dir` in
-  `userland/init/src/main.rs`).
-- **It is memory.** Nothing reaches the volume, so an empty directory is gone
-  at the next boot; init remakes the session home and each service's `/state`
-  every boot.
-
-Seen building `layout_fresh_boot`: `read_dir /home/toy: entity not found` from
-a boot whose init had just made `/home/toy/Apps`, which is why
-`tests/toyos-rust-tests/src/bin/layout_paths.rs` asks for each directory by
-name.
-
-## Owner
-
-The storage track, `issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md`:
-real bcachefs under DATA carries directories.
-
-## What would close it
-
-DATA stores directories, `create_dir` refuses a missing parent, a listing names
-every directory under it, and `created_dirs` is gone or kept only for a mount
-that has no directories and says so.
diff --git a/issues/filesystem/a-directory-on-data-survives-no-reboot.md b/issues/filesystem/a-directory-on-data-survives-no-reboot.md
new file mode 100644
index 00000000000..4fa2928e343
--- /dev/null
+++ b/issues/filesystem/a-directory-on-data-survives-no-reboot.md
@@ -0,0 +1,33 @@
+---
+status: open
+kind: defect
+opened: 2026-09-26
+---
+
+# A directory on DATA survives no reboot, and takes a child whose parent was never made
+
+The DATA adapter answers every `create_dir` with `NotSupported`
+(`kernel/src/bcachefs_adapter.rs`), so the VFS keeps the directory itself in
+`created_dirs` (`kernel/src/vfs.rs`). Two things follow:
+
+- **A child is taken whose parent was never made.** `create_dir("/home/toy/Apps")`
+  succeeds with no `/home/toy`, so `std::fs::create_dir_all` makes the leaf and
+  nothing above it. init makes every level in turn for this reason (`make_dir`
+  in `userland/init/src/main.rs`).
+- **It is memory.** Nothing reaches the volume, so an empty directory is gone
+  at the next boot; init remakes the session home and each service's `/state`
+  every boot.
+
+Seen building `layout_fresh_boot`: `read_dir /home/toy: entity not found` from
+a boot whose init had just made `/home/toy/Apps`.
+
+## Owner
+
+The storage track, `issues/filesystem/storage-is-layers-and-a-role-is-a-filesystem.md`:
+real bcachefs under DATA carries directories.
+
+## What would close it
+
+DATA stores directories, `create_dir` refuses a missing parent, and
+`created_dirs` is gone or kept only for a mount that has no directories and
+says so.
diff --git a/issues/filesystem/where-everything-lives.md b/issues/filesystem/where-everything-lives.md
index 36aa6ba32ad..8ec1c6c1988 100644
--- a/issues/filesystem/where-everything-lives.md
+++ b/issues/filesystem/where-everything-lives.md
@@ -11,7 +11,7 @@ The owner ruled this layout on 2026-09-26. This file is where it is recorded:
 backs each name, and
 `issues/filesystem/a-user-is-a-home-tree-and-a-login-row.md` and
 `issues/isolation/every-program-sees-only-the-files-it-was-given.md` say who
-may reach it.
+may reach it. Every line below is the owner's ruling.
 
 ## The tree
 
@@ -27,20 +27,26 @@ may reach it.
 /tmp                   private per program
 ```
 
+`/system` is signed because the image is:
+`issues/boot-media/the-machine-updates-itself-without-ubuntu.md` signs it, and
+until that lands nothing verifies it.
+
 ## The rules
 
 - **No drive letters, no `/usr`, `/var`, `/opt`, `/dev`, `/proc` or `/sys`**:
   devices and processes are capabilities and syscalls here, not files.
 - **No dotfile and no hidden folder anywhere in the layout.** A third-party
   program that hard-codes `~/.something` may still create one, but only inside
-  its own app folder.
+  its own app folder: the owner accepted that as the honest limit.
 - **English names, never translated.**
 - **A path means the same file in every view.** `/tmp` is the one exception:
   it is private per program. A view hides names and never renames one.
 - **A program learns a location from an environment variable init sets**
   (`HOME` and those like it). A location grants nothing, because the view
   decides what a program can reach. On ToyOS `std::env::home_dir()` is `$HOME`
-  or `None`, with no fallback, and `temp_dir()` is `/tmp`.
+  or `None`, with no fallback, and `temp_dir()` is `/tmp`. A program init did
+  not start carries the `HOME` its caller named or init answered for it, never
+  its parent's own.
 - **`/home/<user>/Apps/<name>` is one app's private data for that user**, and
   it is that app's `HOME`. Inside it ToyOS answers config, data, cache and
   state as the visible `Config`, `Data`, `Cache` and `State`.
@@ -59,22 +65,38 @@ may reach it.
 1. **Everything that needs no isolation.** `/config` and `/state` are DATA
    names; init makes `/home/toy`, its eight folders, and each service's
    `/state/<name>`, and it sets `HOME` from each row (`service = true` in
-   `system.toml`); the kernel makes no home; the keyboard layout is
-   `/config/keyboard-layout`; sshd keeps its identity and key list in
-   `/state/sshd`; the shell's history is `$HOME/Apps/shell/State/history`;
-   std's `home_dir` reads `$HOME`; JetBrains Mono ships as a TTF with its OFL
-   text. **Exit**: `layout_fresh_boot` is green.
+   `system.toml`, which a row that serves a port must say); a program no row
+   names carries the `HOME` init answers for it, never its spawner's own;
+   the kernel makes no home, and lists a directory it carries; the keyboard
+   layout is `/config/keyboard-layout`; sshd keeps its identity and key list
+   in `/state/sshd`; the shell's history is in `Apps/shell/State`; std's
+   `home_dir` reads `$HOME`. **Exit**: `layout_fresh_boot` is green.
 2. **An app's `HOME` is its folder.** init launches an app from `/apps` (and
    each desktop app in the image) with `HOME=/home/<user>/Apps/<name>`, makes
    the folder and its `Config Data Cache State`, and puts nothing else of the
    home in that app's view. It needs
    `issues/isolation/every-program-sees-only-the-files-it-was-given.md` stage 2.
-   **Exit**: a launched app's `home_dir()` is its folder, and it cannot name
-   another app's folder.
+   **Exit**: a launched app's `home_dir()` is its folder, it cannot name
+   another app's folder, and the shell's history is still
+   `/home/<user>/Apps/shell/State/history` (`OWN_FOLDER` in `userland/shell`).
 3. **Users.** The users track creates `/home/<user>` and its folders from a
    login row, and `toy` stops being a constant in `toyos-manifest`.
    **Exit**: init names no user.
-4. **The upstream arms**, none opened until the owner opens it:
+4. **The time zone.** One file in `/config` names the machine's zone, one
+   program writes it, and local time is read through it rather than recovered
+   by subtracting `SYS_CLOCK_REALTIME` from `SYS_CLOCK_EPOCH`. **Exit**: a
+   guest test sets the zone and reads its local time back, and nothing
+   recovers the zone by subtraction.
+5. **The language.** One file in `/config` names the machine's default
+   language, one program writes it, and init sets it on every program it
+   starts. **Exit**: a guest test sets the language and a program init starts
+   reads it back.
+6. **Fonts ship as files.** JetBrains Mono and Open Sans ship as TTFs under
+   `/system/share/fonts` from `assets/fonts/`, the console's raster stays its
+   own asset, and each OFL text ships once, under `/system/share/licenses`.
+   **Exit**: an image carries both families there and their licence texts
+   under `/system/share/licenses`, and none under `/system/share/fonts`.
+7. **The upstream arms**, none opened until the owner opens it:
    - fontdb and fontique scan `/system/share/fonts` and `$HOME/Fonts` from the
      start, and fontique maps the families above. **Exit**: both prepared
      branches carry both folders and the family table.
diff --git a/kernel/src/vfs.rs b/kernel/src/vfs.rs
index 55994c1f530..58a29ee0bcf 100644
--- a/kernel/src/vfs.rs
+++ b/kernel/src/vfs.rs
@@ -385,6 +385,20 @@ impl Vfs {
             }
         }
 
+        // A directory the VFS carries is its parent's entry whether or not a
+        // file is under it yet.
+        let parent = format!("{}/", directory(&mount, &subdir));
+        for dir in self.created_dirs.range(parent.clone()..) {
+            let Some(rest) = dir.strip_prefix(parent.as_str()) else { break };
+            let child = rest.split('/').next().unwrap_or(rest);
+            if !child.is_empty() {
+                let dir_name = format!("{child}/");
+                if seen_dirs.insert(dir_name.clone()) {
+                    result.push((dir_name, 0));
+                }
+            }
+        }
+
         // An empty directory's witnesses: its own listing entry on a mount
         // that represents directories, `created_dirs` on one the VFS carries.
         if result.is_empty()
diff --git a/rust b/rust
index e1acded3fb8..80ea645f83b 160000
--- a/rust
+++ b/rust
@@ -1 +1 @@
-Subproject commit e1acded3fb88ca1040e2cd1d61c7b84579007696
+Subproject commit 80ea645f83bf528b50ccac4f23235dc61dc7ea6b
diff --git a/src/assets.rs b/src/assets.rs
index 0f118a489fe..795ce35fc5d 100644
--- a/src/assets.rs
+++ b/src/assets.rs
@@ -270,20 +270,6 @@ fn absentees(dir: &Path, declared: &BTreeSet<PathBuf>) -> Vec<PathBuf> {
 /// `only_doom_opens_doom_s_assets` is what keeps the right-hand column true.
 const OPENED_BY: &[(&str, &str)] = &[("doom1.wad", "doom"), ("soundfont.sf2", "doom")];
 
-/// The licence text under `licenses/` that travels with each font an image
-/// ships as it is: the OFL's second condition.
-const FONT_LICENCES: &[(&str, &str)] = &[("JetBrainsMono-Regular.ttf", "OFL-1.1-JetBrainsMono.txt")];
-
-/// A font with no row in [`FONT_LICENCES`] stops the build rather than ship
-/// without its licence.
-fn font_licence(name: &str) -> &'static str {
-    FONT_LICENCES
-        .iter()
-        .find(|(font, _)| *font == name)
-        .map(|(_, licence)| *licence)
-        .unwrap_or_else(|| panic!("{name} has no licence text in FONT_LICENCES, so it cannot ship"))
-}
-
 /// ROOT's asset files, for an image building exactly `programs`.
 pub fn collect(dirs: &[String], programs: &BTreeSet<&str>) -> Vec<(String, Vec<u8>)> {
     let mut files = vec![];
@@ -319,8 +305,7 @@ pub fn collect(dirs: &[String], programs: &BTreeSet<&str>) -> Vec<(String, Vec<u
             true
         };
 
-        // A top-level TTF ships twice: rasterized for the console, and as it is,
-        // with its licence text, where the toolkits look for system fonts.
+        // Pre-rasterize TTF fonts
         for entry in fs::read_dir(dir).unwrap_or_else(|e| panic!("Failed to read {}: {e}", dir.display())) {
             let path = entry.unwrap().path();
             if path.extension().is_some_and(|e| e == "ttf") && ships(&path) {
@@ -328,12 +313,6 @@ pub fn collect(dirs: &[String], programs: &BTreeSet<&str>) -> Vec<(String, Vec<u
                 let stem = path.file_stem().unwrap().to_str().unwrap();
                 let font_data = rasterize_font(&ttf, 8, 16);
                 files.push((format!("share/fonts/{stem}-8x16.font"), font_data));
-                let name = path.file_name().unwrap().to_str().unwrap();
-                let licence = font_licence(name);
-                let text = fs::read(Path::new(env!("CARGO_MANIFEST_DIR")).join("licenses").join(licence))
-                    .unwrap_or_else(|e| panic!("Failed to read licenses/{licence}: {e}"));
-                files.push((format!("share/fonts/{}", name.to_lowercase()), ttf));
-                files.push((format!("share/licenses/{licence}"), text));
             }
         }
 
@@ -525,42 +504,6 @@ mod tests {
         );
     }
 
-    /// The system monospace font ships byte for byte where fontdb and fontique
-    /// look, its licence text beside it, and its raster for the console.
-    #[test]
-    fn a_top_level_font_ships_as_it_is_with_its_licence_and_as_its_raster() {
-        let root = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
-        let dir = std::env::temp_dir().join(format!("toyos-font-{}", std::process::id()));
-        let _ = fs::remove_dir_all(&dir);
-        fs::create_dir_all(&dir).expect("make the asset tree");
-        let ttf = fs::read(root.join("assets/JetBrainsMono-Regular.ttf")).expect("the font");
-        fs::write(dir.join("JetBrainsMono-Regular.ttf"), &ttf).unwrap();
-        let out = Command::new("git").args(["-C", &dir.display().to_string(), "init", "-q"]).output();
-        assert!(out.expect("run git").status.success());
-        let out = Command::new("git")
-            .args(["-C", &dir.display().to_string(), "add", "JetBrainsMono-Regular.ttf"])
-            .output();
-        assert!(out.expect("run git").status.success());
-
-        let shipped: std::collections::BTreeMap<String, Vec<u8>> =
-            collect(&[dir.display().to_string()], &BTreeSet::new()).into_iter().collect();
-        fs::remove_dir_all(&dir).ok();
-
-        assert_eq!(
-            shipped.keys().collect::<Vec<_>>(),
-            [
-                "share/fonts/JetBrainsMono-Regular-8x16.font",
-                "share/fonts/jetbrainsmono-regular.ttf",
-                "share/licenses/OFL-1.1-JetBrainsMono.txt",
-            ],
-        );
-        assert_eq!(shipped["share/fonts/jetbrainsmono-regular.ttf"], ttf, "the font was changed");
-        assert_eq!(
-            shipped["share/licenses/OFL-1.1-JetBrainsMono.txt"],
-            fs::read(root.join("licenses/OFL-1.1-JetBrainsMono.txt")).unwrap(),
-        );
-    }
-
     /// The right-hand column of [`OPENED_BY`] is true of the tree.
     ///
     /// The claim is that one program opens the file, so a second program naming
diff --git a/src/build.rs b/src/build.rs
index 31488e76339..6d7abbc2039 100644
--- a/src/build.rs
+++ b/src/build.rs
@@ -2765,6 +2765,18 @@ mod tests {
         }
     }
 
+    /// Every config renders, so a row the manifest refuses — one that serves a
+    /// port and is not marked `service` — reds here rather than at a build.
+    #[test]
+    fn every_config_renders_its_manifest() {
+        let root = Path::new(env!("CARGO_MANIFEST_DIR"));
+        for config in ALL_CONFIGS {
+            let parsed = parse_config(&root.join(config));
+            let rendered = std::panic::catch_unwind(|| render_manifest(&parsed));
+            assert!(rendered.is_ok(), "{config} does not render; the panic above says why");
+        }
+    }
+
     /// One prefix and no other, so a doc naming `/etc/logd` or `/apps/logd` is a
     /// token the filter below drops and an assertion that reds.
     const LOG_DOC_BIN: &str = "/system/bin/";
@@ -2844,6 +2856,7 @@ mod tests {
         "tests/lanleasecase/system.toml",
         "tests/lantalkcase/system.toml",
         "tests/latencycase/system.toml",
+        "tests/layoutcase/system.toml",
         "tests/logholdcase/system.toml",
         "tests/logrotatecase/system.toml",
         "tests/logstallcase/system.toml",
diff --git a/tests/common/ssh.rs b/tests/common/ssh.rs
index 4e42f72d0ac..c500359e4fe 100644
--- a/tests/common/ssh.rs
+++ b/tests/common/ssh.rs
@@ -319,6 +319,12 @@ const GUEST_TEST: &str = "test_rs_empty_dir_stat";
 const MISSING: &str = "/tmp/no_such_file_for_the_stderr_arm";
 
 /// `tests/sshdcase` with a key in its image and a forward into its port 22.
+pub fn boot(rust_bins: &[(String, Vec<u8>)]) -> super::qemu::QemuInstance {
+    boot_case("tests/sshdcase", rust_bins).0
+}
+
+/// `case` with a key in its image and a forward into its port 22, and its
+/// console up to sshd's listening line.
 ///
 /// **The key is staged rather than installed**: `/home` on this machine may be
 /// a tmpfs, so a key that had to be put there after the boot is a key nobody
@@ -328,7 +334,10 @@ const MISSING: &str = "/tmp/no_such_file_for_the_stderr_arm";
 /// profile with no NIC, an argv with no forward, and a daemon that never opened
 /// its port are each a machine the gate cannot run on at all, which is the same
 /// class as a guest that never printed its ready marker.
-pub fn boot(rust_bins: &[(String, Vec<u8>)]) -> super::qemu::QemuInstance {
+pub fn boot_case(
+    case: &str,
+    rust_bins: &[(String, Vec<u8>)],
+) -> (super::qemu::QemuInstance, String) {
     let identity = Identity::mint(KEY).unwrap_or_else(|why| panic!("[sshd] {why}"));
     let options = super::qemu::BootOptions {
         profile: super::qemu::Profile::Headless,
@@ -354,7 +363,7 @@ pub fn boot(rust_bins: &[(String, Vec<u8>)]) -> super::qemu::QemuInstance {
         "[sshd] the argv carries no {forward}, so nothing on this host can reach the guest"
     );
 
-    let config = compile::repo_root().join("tests/sshdcase");
+    let config = compile::repo_root().join(case);
     let mut guest =
         super::qemu::QemuInstance::boot_with_options(&config, &[], rust_bins, options);
     let mut console = guest.boot_log().to_string();
@@ -366,7 +375,7 @@ pub fn boot(rust_bins: &[(String, Vec<u8>)]) -> super::qemu::QemuInstance {
     ) {
         panic!("[sshd] never listened, so no exchange below would mean anything: {why}\n{console}");
     }
-    guest
+    (guest, console)
 }
 
 /// What `exec` is for: run this program, and tell me how it ended.
diff --git a/tests/layoutcase/system.toml b/tests/layoutcase/system.toml
new file mode 100644
index 00000000000..01dcc9f045b
--- /dev/null
+++ b/tests/layoutcase/system.toml
@@ -0,0 +1,38 @@
+# Where a fresh boot puts things, asked over the cable: `layout_fresh_boot`.
+#
+# `tests/sshdcase` plus a declared shell and the `locale` applet. The shell is
+# declared so that its `HOME` is init's row answer on the launcher path; the
+# judge (`test_rs_layout_paths`) is declared nowhere, so its `HOME` is init's
+# answer on the direct path, spawned by a service whose own `HOME` is
+# `/state/sshd`.
+
+[boot]
+start = ["logd", "netd", "sshd", "test-runner"]
+
+[programs.logd]
+service = true
+syscap = ["logread"]
+
+[programs.netd]
+service = true
+serves = ["netd"]
+devices = ["pci:1af4:1041"]
+
+[programs.sshd]
+service = true
+receives = ["netd", "launcher"]
+
+[programs.test-runner]
+receives = ["netd"]
+syscap = ["logread"]
+
+# A session program with no authority: what is asked of it is where its
+# `HOME` is and where it keeps its history.
+[programs.shell]
+
+# `echo` for the shell's `-c`, `locale` for the machine's keyboard layout.
+[programs.toybox]
+
+[symlinks]
+"bin/echo" = "/system/bin/toybox"
+"bin/locale" = "/system/bin/toybox"
diff --git a/tests/toyos-rust-tests/src/bin/launcher_refusals.rs b/tests/toyos-rust-tests/src/bin/launcher_refusals.rs
index ba11086c7fd..ee7ccb2c392 100644
--- a/tests/toyos-rust-tests/src/bin/launcher_refusals.rs
+++ b/tests/toyos-rust-tests/src/bin/launcher_refusals.rs
@@ -111,7 +111,7 @@ fn launcher() -> Connection {
 /// back from.
 fn answer_within(conn: &Connection, budget: Duration) -> Result<u32, &'static str> {
     let deadline = Instant::now() + budget;
-    // The replies are bare headers, so nothing of a payload has to be kept.
+    // Only the reply's type is judged here, so nothing of a payload is kept.
     let mut rx = FrameRx::<0>::new();
     loop {
         match rx.pump(conn) {
diff --git a/tests/toyos-rust-tests/src/bin/layout_paths.rs b/tests/toyos-rust-tests/src/bin/layout_paths.rs
index 5701ffc7040..7c6779976b0 100644
--- a/tests/toyos-rust-tests/src/bin/layout_paths.rs
+++ b/tests/toyos-rust-tests/src/bin/layout_paths.rs
@@ -1,28 +1,48 @@
 //! Where a fresh boot puts things: the session user's home, each service's own
-//! `/state`, and no dotfile anywhere ToyOS's own programs write.
+//! `/state`, the machine's keyboard layout in `/config`, the shell's history in
+//! its own folder, and no dotfile anywhere ToyOS's own programs write.
 //!
-//! Driven by `layout_fresh_boot` alone, on `tests/sshdcase` once sshd has
-//! minted its identity: that boot runs three services and a session program
-//! (`test-runner`, whose `HOME` this binary inherits). The dotfile walk sees
-//! every file, and a directory only once it holds one.
+//! Driven by `layout_fresh_boot` alone, over ssh on `tests/layoutcase`, after
+//! `locale <argv[1]>` and an interactive shell that ran `<argv[2]>`. No row
+//! declares this binary, so sshd, a service whose own `HOME` is `/state/sshd`,
+//! spawns it directly, and the `HOME` it reads is the one init answered for it.
 
 use std::fs;
 use std::io::ErrorKind;
 use std::path::Path;
 
-/// init's `HOME_FOLDERS`, spelled again: the two are two spellings of the
-/// session home, so a folder added to one reds here.
+/// init's `HOME_FOLDERS`: the session home's listing, exactly.
 const HOME_FOLDERS: [&str; 8] =
     ["Apps", "Desktop", "Documents", "Downloads", "Fonts", "Music", "Pictures", "Videos"];
 
-/// The services `tests/sshdcase` runs, each of which init gave a `/state` of
-/// its own.
+/// The services `tests/layoutcase` runs: `/state`'s listing, exactly.
 const SERVICES: [&str; 3] = ["logd", "netd", "sshd"];
 
 /// Every volume a ToyOS program writes to.
 const WRITTEN: [&str; 6] = ["/apps", "/config", "/home", "/log", "/state", "/tmp"];
 
+/// Asked by literal path, so a constant that moved is a red here.
+const LAYOUT_FILE: &str = "/config/keyboard-layout";
+const HISTORY_FILE: &str = "/home/toy/Apps/shell/State/history";
+
+/// The directory names `dir` lists, sorted.
+fn listed_dirs(dir: &str) -> Result<Vec<String>, String> {
+    let mut names = Vec::new();
+    for entry in fs::read_dir(dir).map_err(|e| format!("read_dir {dir}: {e}"))? {
+        let entry = entry.map_err(|e| format!("an entry of {dir}: {e}"))?;
+        if entry.file_type().map_err(|e| format!("{dir}: {e}"))?.is_dir() {
+            names.push(entry.file_name().to_string_lossy().into_owned());
+        }
+    }
+    names.sort();
+    Ok(names)
+}
+
 fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    let [_, layout, typed] = args.as_slice() else {
+        panic!("usage: layout_paths <layout locale set> <line the shell ran>, got {args:?}");
+    };
     let mut wrong = Vec::new();
 
     let home = std::env::var("HOME");
@@ -38,23 +58,24 @@ fn main() {
         Err(e) if e.kind() == ErrorKind::NotFound => {}
         other => wrong.push(format!("/home/root: {other:?}, want NotFound")),
     }
-    // Asked by name and not listed: a directory on DATA is the VFS's own
-    // record, and no listing of its parent shows it
-    // (`issues/filesystem/a-directory-on-data-is-in-no-listing-and-no-reboot.md`).
-    let dirs = ["/home/toy".to_string()]
-        .into_iter()
-        .chain(HOME_FOLDERS.iter().map(|f| format!("/home/toy/{f}")))
-        .chain(SERVICES.iter().map(|s| format!("/state/{s}")));
-    for dir in dirs {
-        match fs::metadata(&dir) {
-            Ok(meta) if meta.is_dir() => {}
-            other => wrong.push(format!("{dir}: {other:?}, want a directory")),
+    for (dir, want) in [("/home/toy", &HOME_FOLDERS[..]), ("/state", &SERVICES[..])] {
+        match listed_dirs(dir) {
+            Ok(names) if names == want => {}
+            other => wrong.push(format!("{dir} lists {other:?}, want exactly {want:?}")),
         }
     }
     match fs::metadata("/state/sshd/host_ed25519") {
         Ok(meta) if meta.is_file() && meta.len() > 0 => {}
         other => wrong.push(format!("/state/sshd/host_ed25519: {other:?}, want a file")),
     }
+    match fs::read_to_string(LAYOUT_FILE) {
+        Ok(text) if text.trim() == layout => {}
+        other => wrong.push(format!("{LAYOUT_FILE}: {other:?}, want {layout:?}")),
+    }
+    match fs::read_to_string(HISTORY_FILE) {
+        Ok(text) if text.lines().any(|line| line == typed) => {}
+        other => wrong.push(format!("{HISTORY_FILE}: {other:?}, want a line {typed:?}")),
+    }
 
     let mut dotted = Vec::new();
     let mut walked = 0usize;
@@ -79,8 +100,8 @@ fn main() {
 
     assert!(wrong.is_empty(), "the layout is not as ruled:\n{}", wrong.join("\n"));
     println!(
-        "layout: HOME=/home/toy, {} home folders, /state holds {SERVICES:?} with sshd's key, \
-         and none of {walked} entries under {WRITTEN:?} is a dotfile",
-        HOME_FOLDERS.len()
+        "layout: HOME=/home/toy, /home/toy lists {HOME_FOLDERS:?}, /state lists {SERVICES:?} \
+         with sshd's key, {LAYOUT_FILE} and {HISTORY_FILE} as written, and none of {walked} \
+         entries under {WRITTEN:?} is a dotfile"
     );
 }
diff --git a/tests/toyos.rs b/tests/toyos.rs
index 66cd6b69cc2..529fd15bd98 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -480,8 +480,8 @@ const RUST_SKIP: &[&str] = &[
     "ftruncate_flush_race",
     // Needs the `smp-skip-ap` boot; `smp_failed_ap_leaves_no_hole` runs it there.
     "smp_hole_shootdown",
-    // Its listings are exact against `tests/sshdcase`'s services, and every
-    // boot but that one runs others. `layout_fresh_boot` runs it.
+    // Its listings are exact against `tests/layoutcase`, and it takes what that
+    // boot wrote as its argv. `layout_fresh_boot` runs it over ssh.
     "layout_paths",
     // Needs a package installed under `/apps` and a config whose `[apps]` row
     // is what a launch out of it holds; `pkg_install_gbae` gives both, and on
@@ -907,8 +907,8 @@ const MACHINE_TESTS: &[(&str, Sched, Tier)] = &[
     // Its own boot with a NIC under it, because sshd leaves at the bind on
     // every other config. Every verdict is a line of text; no clock in any.
     ("sshd_fail_closed", Sched::Parallel, Tier::Fast),
-    // The same boot with a blank DATA volume, read for where everything it
-    // wrote went. Every verdict is a listing; no clock in any.
+    // Its own boot with a blank DATA volume, asked over ssh where everything
+    // it wrote went. Every verdict is a listing or a line; no clock in any.
     ("layout_fresh_boot", Sched::Parallel, Tier::Fast),
     // One `SSHD_LOGIN` boot for the three, driven by `tests/ssh-client-host`.
     // Adjacent because `group_of` makes adjacency load-bearing, and one tier
@@ -14751,31 +14751,65 @@ fn run_machine_test(
         }
         "layout_fresh_boot" => {
             // The layout as ruled, on a boot of its own with a blank DATA
-            // volume: three services, each given a `/state` of its own, and a
-            // session program whose child is the judge. sshd's identity is the
-            // one file a service writes on every such boot, and on a boot that
-            // stages no key sshd then ends, however it fares; so the listing
-            // waits for the kernel's record of that end rather than for a clock.
-            let config = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/sshdcase");
-            let options = BootOptions { profile: qemu::Profile::Headless, ..Default::default() };
-            let mut qemu = QemuInstance::boot_with_options(&config, &[], rust_bins, options);
-            let mut console = qemu.boot_log().to_string();
+            // volume, asked over the cable because sshd is the service that
+            // starts programs: a declared shell's `HOME` is init's row answer,
+            // and the judge, declared nowhere, is spawned by sshd directly with
+            // the `HOME` init answered for it. Before the judge, `locale` and
+            // an interactive shell write the two files a session writes.
+            use common::ssh::{self, HOST};
             const MINTED: &str = "sshd: minted a new host identity at /state/sshd/host_ed25519";
-            await_guest(&mut qemu, &mut console, "sshd's end", |c| {
-                c.contains("exit: sshd pid=")
-            })
-            .map_err(|why| format!("{why}\n{console}"))?;
+            const LAYOUT: &str = "de";
+            const TYPED: &str = "echo layout history";
+            let (guest, console) = ssh::boot_case("tests/layoutcase", rust_bins);
             if !console.contains(MINTED) {
                 return Err(format!("{MINTED:?} never reached the console:\n{console}"));
             }
-            let result = qemu.run_test("test_rs_layout_paths", Duration::from_secs(60));
-            if result.exit_code != Some(0) {
+            let identity = ssh::Identity::mint(ssh::KEY)?;
+            let port = guest.ssh_port();
+
+            let home = ssh::ssh_exec(HOST, port, &identity, "shell -c 'echo $HOME'")?;
+            if home.stdout != b"/home/toy\n" || home.status != Some(0) {
                 return Err(format!(
-                    "layout_paths guest failed:\n{}\nkernel log while it ran:\n{}{}",
-                    result.stdout, result.before, result.serial
+                    "a launched shell's HOME is {:?} (ended {:?}, stderr {:?}), not /home/toy",
+                    home.stdout_text(),
+                    home.status,
+                    home.stderr_text()
+                ));
+            }
+            let set = ssh::ssh_exec(HOST, port, &identity, &format!("locale {LAYOUT}"))?;
+            if set.status != Some(0) || !set.stdout_text().contains("Keyboard layout set to") {
+                return Err(format!(
+                    "`locale {LAYOUT}` ended {:?} saying {:?} {:?}",
+                    set.status,
+                    set.stdout_text(),
+                    set.stderr_text()
+                ));
+            }
+            let (typed, _) =
+                ssh::ssh_feed(HOST, port, &identity, "shell", format!("{TYPED}\r").as_bytes())?;
+            if typed.status != Some(0) || !typed.stdout_text().contains("layout history") {
+                return Err(format!(
+                    "the interactive shell ended {:?} saying {:?} {:?}",
+                    typed.status,
+                    typed.stdout_text(),
+                    typed.stderr_text()
+                ));
+            }
+            let judge = ssh::ssh_exec(
+                HOST,
+                port,
+                &identity,
+                &format!("test_rs_layout_paths {LAYOUT} '{TYPED}'"),
+            )?;
+            if judge.status != Some(0) {
+                return Err(format!(
+                    "layout_paths ended {:?} over ssh:\n{}\n{}",
+                    judge.status,
+                    judge.stdout_text(),
+                    judge.stderr_text()
                 ));
             }
-            eprintln!("  [layout] {}", result.stdout.trim());
+            eprintln!("  [layout] a launched shell's HOME is /home/toy; {}", judge.stdout_text().trim());
             Ok(())
         }
         "lan_dhcp_lease" => lan::lan_dhcp_lease(test_config, c_bins, rust_bins),
diff --git a/toyos-manifest/src/lib.rs b/toyos-manifest/src/lib.rs
index f3244339a41..b65a479f850 100644
--- a/toyos-manifest/src/lib.rs
+++ b/toyos-manifest/src/lib.rs
@@ -46,6 +46,12 @@ pub const MAX_PROGRAM_NAME: usize = 32;
 /// The dev image's one user, until the users track gives init a login row.
 pub const USER: &str = "toy";
 
+/// The session user's home: every program's `HOME` that no service row claims,
+/// a program no row names included.
+pub fn session_home() -> String {
+    format!("/home/{USER}")
+}
+
 /// Where each system service keeps its own persistent data, one directory per
 /// program key.
 pub const STATE: &str = "/state";
@@ -141,7 +147,7 @@ impl Program {
     pub fn home(&self) -> String {
         match self.service {
             true => format!("{STATE}/{}", self.name),
-            false => format!("/home/{USER}"),
+            false => session_home(),
         }
     }
 }
@@ -208,6 +214,10 @@ pub enum RenderError {
     NameTooLong(String),
     /// A field whose bytes would not survive the round trip.
     Unrepresentable { program: String, field: &'static str, value: String },
+    /// A row that serves a machine-wide port and is not marked a service, so
+    /// init would start it in the session user's home. A service that serves
+    /// nothing (`sshd`) cannot be told from its row, and is marked by hand.
+    ServesWithoutService(String),
 }
 
 pub fn render(manifest: &Manifest) -> Result<Vec<u8>, RenderError> {
@@ -218,6 +228,9 @@ pub fn render(manifest: &Manifest) -> Result<Vec<u8>, RenderError> {
         }
         check(&program.name, "name", &program.name)?;
         check(&program.name, "path", &program.path)?;
+        if !program.serves.is_empty() && !program.service {
+            return Err(RenderError::ServesWithoutService(program.name.clone()));
+        }
         out.push_str(&format!("program {} {}\n", program.name, program.path));
         for arg in &program.args {
             reject_newline(&program.name, "args", arg)?;
@@ -349,6 +362,7 @@ mod tests {
                     serves: vec!["compositor".into()],
                     receives: vec!["soundd".into(), "launcher".into()],
                     devices: vec!["framebuffer".into(), "keyboard".into()],
+                    service: true,
                     ..Program::default()
                 },
                 Program {
@@ -396,6 +410,18 @@ mod tests {
         assert_eq!(parse(std::str::from_utf8(&rendered).unwrap()), manifest);
     }
 
+    /// A row that serves a machine-wide port is a service, and one not marked
+    /// so is refused rather than started in the session user's home.
+    #[test]
+    fn a_row_that_serves_a_port_and_is_no_service_is_refused() {
+        let mut manifest = sample();
+        manifest.programs[0].service = false;
+        assert_eq!(
+            render(&manifest),
+            Err(RenderError::ServesWithoutService("compositor".into()))
+        );
+    }
+
     /// A service keeps machine state under its own name, everything else is
     /// the session's; and a package's synthesized row is never a service.
     #[test]
diff --git a/toyos/src/launch.rs b/toyos/src/launch.rs
index 2b2efc20a7d..4eda500c440 100644
--- a/toyos/src/launch.rs
+++ b/toyos/src/launch.rs
@@ -27,6 +27,8 @@ pub const MSG_LAUNCHED: u32 = 2;
 /// No `[programs]` row names that program, so init has nothing to build its
 /// authority from. The caller spawns it directly instead, which gets
 /// inheritance — the right answer for a binary the image did not declare.
+/// The payload is the `HOME` init decides for it, which that spawn carries in
+/// place of the caller's own: a location is init's to hand out, not a parent's.
 pub const MSG_NOT_DECLARED: u32 = 3;
 /// It is declared and did not start: no such file, a full table, a refused
 /// endowment. The reason is in init's log, not in this frame — a caller can do
@@ -249,21 +251,27 @@ pub enum LaunchError {
 }
 
 /// What a launch answered.
-pub enum Outcome {
+pub enum Outcome<'a> {
     /// The handle the caller now holds for the child.
     Started(RawHandle),
-    /// Not a `[programs]` key. The caller spawns it directly.
-    NotDeclared,
+    /// Not a `[programs]` key. The caller spawns it directly, with `home` as
+    /// its `HOME`.
+    NotDeclared { home: &'a str },
     /// Declared, and it did not start.
     Refused,
 }
 
-/// Send one launch and read its answer.
+/// Send one launch and read its answer, a `HOME` in `answer`.
 ///
 /// The handles go before the frame that announces them, which is
 /// [`Connection::send_with_handles`]'s whole rule — and the `Process` handle
-/// comes back the same way.
-pub fn launch(conn: &Connection, request: &Launch<'_>) -> Result<Outcome, LaunchError> {
+/// comes back the same way. A `HOME` longer than `answer` or not UTF-8 is a
+/// malformed answer, never a shortened one.
+pub fn launch<'a>(
+    conn: &Connection,
+    request: &Launch<'_>,
+    answer: &'a mut [u8],
+) -> Result<Outcome<'a>, LaunchError> {
     let mut buf = [0u8; crate::ipc::MAX_FRAME_LEN as usize];
     let len = request
         .encode(&mut buf)
@@ -277,7 +285,15 @@ pub fn launch(conn: &Connection, request: &Launch<'_>) -> Result<Outcome, Launch
             Some([process]) => Ok(Outcome::Started(process)),
             None => Err(LaunchError::Sent(IpcError::Malformed)),
         },
-        MSG_NOT_DECLARED => Ok(Outcome::NotDeclared),
+        MSG_NOT_DECLARED => {
+            if header.len() as usize > answer.len() {
+                return Err(LaunchError::Sent(IpcError::Malformed));
+            }
+            let len = conn.recv_bytes(&header, answer).map_err(LaunchError::Sent)?;
+            let home = core::str::from_utf8(&answer[..len])
+                .map_err(|_| LaunchError::Sent(IpcError::Malformed))?;
+            Ok(Outcome::NotDeclared { home })
+        }
         MSG_REFUSED => Ok(Outcome::Refused),
         _ => Err(LaunchError::Sent(IpcError::Malformed)),
     }
diff --git a/userland/init/src/main.rs b/userland/init/src/main.rs
index 6f4425e3db1..5bd9ffa1250 100644
--- a/userland/init/src/main.rs
+++ b/userland/init/src/main.rs
@@ -30,6 +30,8 @@
 //! **Every program it starts gets `HOME` from its row** (`Program::home`), over
 //! anything a launching caller carried: a service its own `/state/<name>`, made
 //! before it runs, and everything else the session user's home, made at boot.
+//! A launch of a program no row names is answered with the session's, which
+//! the caller's direct spawn carries in place of its own.
 
 /// One line, one `write`, into init's own pipe to `logd` ([`Log`]): a line of
 /// init's is a line in the log under init's name, whether or not `logd` has run
@@ -190,12 +192,14 @@ impl Log {
 /// not mount has no `/home`, which the kernel has already said; this says what
 /// it cost and starts the machine without it.
 fn make_session_home() {
-    let home = format!("/home/{}", toyos_manifest::USER);
-    let folders = HOME_FOLDERS.iter().map(|folder| format!("{home}/{folder}"));
-    for path in std::iter::once(home.clone()).chain(folders) {
-        if let Err(e) = make_dir(&path) {
-            say!("init: {path} could not be made, so this boot has no session home: {e}");
-            return;
+    let home = toyos_manifest::session_home();
+    if let Err(e) = make_dir(&home) {
+        say!("init: {home} could not be made, so this boot has no session home: {e}");
+        return;
+    }
+    for folder in HOME_FOLDERS {
+        if let Err(e) = make_dir(&format!("{home}/{folder}")) {
+            say!("init: {home}/{folder} could not be made, so the session home has no {folder}: {e}");
         }
     }
 }
@@ -919,11 +923,12 @@ fn serve_launch<'a>(
             &installed
         }
         Resolved::NotDeclared => {
-            // **`try_signal` and not `send`.** A bare header is what every
-            // answer here is, and a blocking write is the other half of the
-            // rule that made the read side an event loop: a client that never
-            // drains its end decides when init runs again.
-            let _ = conn.try_signal(launch::MSG_NOT_DECLARED);
+            // **`try_send_bytes` and not `send`.** A blocking write is the
+            // other half of the rule that made the read side an event loop: a
+            // client that never drains its end decides when init runs again.
+            // The `HOME` is the session's: a program no row names is no service.
+            let home = toyos_manifest::session_home();
+            let _ = conn.try_send_bytes(launch::MSG_NOT_DECLARED, home.as_bytes());
             return;
         }
         Resolved::Refused(why) => {
diff --git a/userland/shell/src/main.rs b/userland/shell/src/main.rs
index 9ceff9d375f..4e88747e6dd 100644
--- a/userland/shell/src/main.rs
+++ b/userland/shell/src/main.rs
@@ -8,9 +8,10 @@ use std::sync::OnceLock;
 
 use toyos::port::Connector;
 
-/// Where the history lives under `$HOME`: this program's own `State` in the
-/// session's `Apps`, never a dotfile in the user's home.
-const HISTORY: &str = "Apps/shell/State/history";
+/// This program's own folder, whose `State` keeps the history: `$HOME` itself
+/// once init makes that folder the shell's `HOME`, and `$HOME/Apps/shell`
+/// while `HOME` is the session's. Never a dotfile in the user's home.
+const OWN_FOLDER: [&str; 2] = ["Apps", "shell"];
 const HISTORY_MAX: usize = 200;
 
 static mut LAST_STATUS: i32 = 0;
@@ -796,7 +797,10 @@ fn print_help() {
 // --- History ---
 
 fn history_path() -> Option<std::path::PathBuf> {
-    env::var_os("HOME").map(|home| Path::new(&home).join(HISTORY))
+    let home = std::path::PathBuf::from(env::var_os("HOME")?);
+    let own: std::path::PathBuf = OWN_FOLDER.iter().collect();
+    let folder = if home.ends_with(&own) { home } else { home.join(own) };
+    Some(folder.join("State").join("history"))
 }
 
 fn load_history() -> Vec<String> {

From 542f00ed64d5bc3f701e4f6a9ab3acf295e6ac4c Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sat, 26 Sep 2026 19:02:21 +0200
Subject: [PATCH 5/7] A listing that names the VFS's directories still refuses
 past its bound

Vfs::list now adds the directories created_dirs carries, which could take
a listing past MAX_LIST_ENTRIES, the bound the files it lists already
respect. It refuses there as every FileSystem::list does, rather than
growing the answer past what the bound was derived for.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014iqcj4jDKpaiDX8B7CMvmK
---
 kernel/src/vfs.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/src/vfs.rs b/kernel/src/vfs.rs
index 58a29ee0bcf..e4b2a3811fb 100644
--- a/kernel/src/vfs.rs
+++ b/kernel/src/vfs.rs
@@ -394,6 +394,9 @@ impl Vfs {
             if !child.is_empty() {
                 let dir_name = format!("{child}/");
                 if seen_dirs.insert(dir_name.clone()) {
+                    if result.len() == MAX_LIST_ENTRIES {
+                        return Err(SyscallError::ResourceExhausted);
+                    }
                     result.push((dir_name, 0));
                 }
             }

From 9c0c4b25709afe57d19ab33e76a3d7b3bb290865 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sat, 26 Sep 2026 19:27:45 +0200
Subject: [PATCH 6/7] sdk: bump toyos-abi, toyos and toyos-window past main's
 landed versions

PR #525 landed on main at the same 0.13.0/0.14.0/0.15.0 this branch's
toyos-abi, toyos and toyos-window sources had already moved past, so the
abi-split gate now judges this branch's changes against those taken
versions rather than the old base. Bump each to the next free minor
(0.14.0/0.15.0/0.16.0), move every in-tree pin, and re-lock every tracked
lockfile in its own workspace with `cargo update -w`.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014iqcj4jDKpaiDX8B7CMvmK
---
 Cargo.lock                        |  2 +-
 bootloader/Cargo.lock             |  2 +-
 kernel/Cargo.lock                 |  2 +-
 tests/ssh-client-host/Cargo.lock  |  2 +-
 tests/toyos-rust-tests/Cargo.lock | 22 ++++----
 toyos-abi/Cargo.toml              |  2 +-
 toyos/Cargo.lock                  |  4 +-
 toyos/Cargo.toml                  |  4 +-
 userland/Cargo.lock               | 88 +++++++++++++++----------------
 userland/libc/Cargo.lock          |  4 +-
 userland/toyos-window/Cargo.toml  |  6 +--
 11 files changed, 69 insertions(+), 69 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 13c286c2b33..e07e5c65ebe 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1090,7 +1090,7 @@ checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "rustc-std-workspace-core",
 ]
diff --git a/bootloader/Cargo.lock b/bootloader/Cargo.lock
index 35ed32ef024..928fd536ebf 100644
--- a/bootloader/Cargo.lock
+++ b/bootloader/Cargo.lock
@@ -110,7 +110,7 @@ dependencies = [
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-acpi"
diff --git a/kernel/Cargo.lock b/kernel/Cargo.lock
index 9b18c6188e2..27590e95506 100644
--- a/kernel/Cargo.lock
+++ b/kernel/Cargo.lock
@@ -75,7 +75,7 @@ checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-acpi"
diff --git a/tests/ssh-client-host/Cargo.lock b/tests/ssh-client-host/Cargo.lock
index 77f19e1f490..a93acc436ec 100644
--- a/tests/ssh-client-host/Cargo.lock
+++ b/tests/ssh-client-host/Cargo.lock
@@ -1848,7 +1848,7 @@ dependencies = [
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-manifest"
diff --git a/tests/toyos-rust-tests/Cargo.lock b/tests/toyos-rust-tests/Cargo.lock
index dccd3bdb299..4ffdabb3e82 100644
--- a/tests/toyos-rust-tests/Cargo.lock
+++ b/tests/toyos-rust-tests/Cargo.lock
@@ -111,8 +111,8 @@ dependencies = [
 name = "blockd"
 version = "0.0.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-blockhold",
  "toyos-blockring",
  "toyos-gpt",
@@ -1453,9 +1453,9 @@ dependencies = [
 
 [[package]]
 name = "toyos"
-version = "0.14.0"
+version = "0.15.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -1472,7 +1472,7 @@ checksum = "ec119a115b619cec7ca5e56858e98db6558658d6cc9b400906187e62f2877f48"
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-blockhold"
@@ -1512,7 +1512,7 @@ version = "0.1.0"
 name = "toyos-inspect"
 version = "0.1.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -1534,8 +1534,8 @@ dependencies = [
  "rustls-pki-types",
  "rustls-rustcrypto",
  "sha2",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-blockring",
  "toyos-dns",
  "toyos-fat32",
@@ -1558,10 +1558,10 @@ version = "0.1.0"
 
 [[package]]
 name = "toyos-window"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-font",
  "toyos-keymap",
 ]
diff --git a/toyos-abi/Cargo.toml b/toyos-abi/Cargo.toml
index c893e683ad4..724ce7f88c7 100644
--- a/toyos-abi/Cargo.toml
+++ b/toyos-abi/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 description = "The ToyOS kernel ABI: syscall numbers, struct layouts and typed syscall wrappers."
diff --git a/toyos/Cargo.lock b/toyos/Cargo.lock
index cc2b0631982..ca59fff5fa1 100644
--- a/toyos/Cargo.lock
+++ b/toyos/Cargo.lock
@@ -10,7 +10,7 @@ checksum = "aa9c45b374136f52f2d6311062c7146bff20fec063c3f5d46a410bd937746955"
 
 [[package]]
 name = "toyos"
-version = "0.14.0"
+version = "0.15.0"
 dependencies = [
  "rustc-std-workspace-core",
  "toyos-abi",
@@ -18,7 +18,7 @@ dependencies = [
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "rustc-std-workspace-core",
 ]
diff --git a/toyos/Cargo.toml b/toyos/Cargo.toml
index 721664c8d04..1336eba01eb 100644
--- a/toyos/Cargo.toml
+++ b/toyos/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "toyos"
-version = "0.14.0"
+version = "0.15.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 description = "The ToyOS userland SDK: typed handles, IPC, ports, namespaces, surfaces and net."
@@ -11,4 +11,4 @@ rustc-dep-of-std = ["core", "toyos-abi/rustc-dep-of-std"]
 
 [dependencies]
 core = { version = "1.0.0", optional = true, package = "rustc-std-workspace-core" }
-toyos-abi = { path = "../toyos-abi", version = "0.13.0", default-features = false }
+toyos-abi = { path = "../toyos-abi", version = "0.14.0", default-features = false }
diff --git a/userland/Cargo.lock b/userland/Cargo.lock
index 73e16ec672d..f8b20ade8ae 100644
--- a/userland/Cargo.lock
+++ b/userland/Cargo.lock
@@ -289,8 +289,8 @@ dependencies = [
 name = "blockd"
 version = "0.0.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-blockhold",
  "toyos-blockring",
  "toyos-gpt",
@@ -488,13 +488,13 @@ name = "compositor"
 version = "0.1.0"
 dependencies = [
  "sprite",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-desktop",
  "toyos-font 0.2.0",
  "toyos-inspect",
  "toyos-manifest",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -511,11 +511,11 @@ name = "console"
 version = "0.1.0"
 dependencies = [
  "terminal",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-font 0.2.0",
  "toyos-logstream",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -1000,7 +1000,7 @@ version = "0.1.0"
 dependencies = [
  "filepicker-api",
  "toyos-font 0.2.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -1120,16 +1120,16 @@ name = "filepicker"
 version = "0.1.0"
 dependencies = [
  "filepicker-api",
- "toyos 0.14.0",
+ "toyos 0.15.0",
  "toyos-font 0.2.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
 name = "filepicker-api"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
+ "toyos 0.15.0",
 ]
 
 [[package]]
@@ -1138,7 +1138,7 @@ version = "0.1.0"
 dependencies = [
  "sprite",
  "toyos-font 0.2.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -1543,8 +1543,8 @@ dependencies = [
 name = "init"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-logstream",
  "toyos-manifest",
  "toyos-swap",
@@ -1578,8 +1578,8 @@ version = "0.1.0"
 name = "inspect"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-inspect",
 ]
 
@@ -1827,8 +1827,8 @@ checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 name = "logd"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-inspect",
  "toyos-logstream",
  "toyos-swap",
@@ -1863,8 +1863,8 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 name = "metalprobe"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-tco",
 ]
 
@@ -1949,8 +1949,8 @@ name = "netd"
 version = "0.0.0"
 dependencies = [
  "smoltcp",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-dns",
  "toyos-i219",
  "toyos-inspect",
@@ -2332,7 +2332,7 @@ version = "0.1.0"
 dependencies = [
  "filepicker-api",
  "toyos-font 0.2.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -3299,7 +3299,7 @@ dependencies = [
 name = "shell"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
+ "toyos 0.15.0",
  "toyos-manifest",
 ]
 
@@ -3451,8 +3451,8 @@ name = "soundd"
 version = "0.0.0"
 dependencies = [
  "rubato",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-hda",
  "toyos-inspect",
  "toyos-mixer",
@@ -3527,7 +3527,7 @@ dependencies = [
  "rand 0.10.0",
  "russh",
  "tokio",
- "toyos 0.14.0",
+ "toyos 0.15.0",
  "toyos-swap",
  "toyos-tmpdir",
 ]
@@ -3595,17 +3595,17 @@ dependencies = [
 name = "terminal"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
+ "toyos 0.15.0",
  "toyos-font 0.2.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
 name = "test-runner"
 version = "0.1.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-tco",
 ]
 
@@ -3735,10 +3735,10 @@ name = "toybox"
 version = "0.1.0"
 dependencies = [
  "cpal",
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-keymap 0.1.0",
- "toyos-window 0.15.0",
+ "toyos-window 0.16.0",
 ]
 
 [[package]]
@@ -3761,9 +3761,9 @@ dependencies = [
 
 [[package]]
 name = "toyos"
-version = "0.14.0"
+version = "0.15.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -3780,7 +3780,7 @@ checksum = "ec119a115b619cec7ca5e56858e98db6558658d6cc9b400906187e62f2877f48"
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-blockhold"
@@ -3797,7 +3797,7 @@ dependencies = [
 name = "toyos-desktop"
 version = "0.1.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -3830,7 +3830,7 @@ version = "0.1.0"
 name = "toyos-inspect"
 version = "0.1.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -3851,7 +3851,7 @@ version = "0.1.0"
 name = "toyos-manifest"
 version = "0.1.0"
 dependencies = [
- "toyos-abi 0.13.0",
+ "toyos-abi 0.14.0",
 ]
 
 [[package]]
@@ -3899,10 +3899,10 @@ dependencies = [
 
 [[package]]
 name = "toyos-window"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
- "toyos 0.14.0",
- "toyos-abi 0.13.0",
+ "toyos 0.15.0",
+ "toyos-abi 0.14.0",
  "toyos-font 0.2.0",
  "toyos-keymap 0.1.0",
 ]
diff --git a/userland/libc/Cargo.lock b/userland/libc/Cargo.lock
index e64d16be489..504e96fbadd 100644
--- a/userland/libc/Cargo.lock
+++ b/userland/libc/Cargo.lock
@@ -27,14 +27,14 @@ checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
 [[package]]
 name = "toyos"
-version = "0.14.0"
+version = "0.15.0"
 dependencies = [
  "toyos-abi",
 ]
 
 [[package]]
 name = "toyos-abi"
-version = "0.13.0"
+version = "0.14.0"
 
 [[package]]
 name = "toyos-libc"
diff --git a/userland/toyos-window/Cargo.toml b/userland/toyos-window/Cargo.toml
index 29bafcdffd0..ec9d3753e31 100644
--- a/userland/toyos-window/Cargo.toml
+++ b/userland/toyos-window/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "toyos-window"
-version = "0.15.0"
+version = "0.16.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 description = "Client library for ToyOS windows: create one, draw into it, read its events."
@@ -8,9 +8,9 @@ repository = "https://github.com/ToyOSOrg/ToyOS"
 
 [dependencies]
 toyos-font = { path = "../toyos-font", version = "0.2.0" }
-toyos-abi = { path = "../../toyos-abi", version = "0.13.0" }
+toyos-abi = { path = "../../toyos-abi", version = "0.14.0" }
 toyos-keymap = { path = "../../toyos-keymap", version = "0.1.0" }
-toyos = { path = "../../toyos", version = "0.14.0" }
+toyos = { path = "../../toyos", version = "0.15.0" }
 
 # `window` is taken on crates.io, so the package is `toyos-window`; the lib
 # target keeps the name every caller spells, `toyos/src`'s citations included.

From fd454902f69eb722469ef84de05e5da5e557b4c8 Mon Sep 17 00:00:00 2001
From: japabu <japa.busse@gmail.com>
Date: Sat, 26 Sep 2026 19:50:52 +0200
Subject: [PATCH 7/7] sdk docs: delete the 26 corrected /bin paths instead of
 carrying them
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The owner's rule on wrong prose is delete, not correct — the exit
condition of the deleted issues/build/twenty-seven-sdk-doc-lines-name-a-path-that-is-gone.md
said so. Correcting each `/bin/x` to `/system/bin/x` would only make the
same 26 lines wrong again at the next layout change; a bare-lined comment
line owed the same rewrite, so the path itself goes, leaving the program
name each sentence actually needed. `cargo doc --no-deps` still builds
clean on toyos-abi, toyos and toyos-window.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014iqcj4jDKpaiDX8B7CMvmK
---
 toyos-abi/src/handle.rs          |  8 ++++----
 toyos-abi/src/lib.rs             |  2 +-
 toyos-abi/src/part.rs            |  2 +-
 toyos-abi/src/syscall.rs         | 10 +++++-----
 toyos/src/device.rs              |  2 +-
 toyos/src/launch.rs              |  8 ++++----
 toyos/src/lib.rs                 |  2 +-
 toyos/src/log.rs                 |  2 +-
 toyos/src/namespace.rs           |  2 +-
 toyos/src/net.rs                 |  4 ++--
 toyos/src/surface.rs             |  2 +-
 toyos/src/syscap.rs              |  6 +++---
 userland/toyos-window/src/lib.rs |  2 +-
 13 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/toyos-abi/src/handle.rs b/toyos-abi/src/handle.rs
index 59a00d75a86..a0e1a324cc0 100644
--- a/toyos-abi/src/handle.rs
+++ b/toyos-abi/src/handle.rs
@@ -88,7 +88,7 @@ impl Rights {
     /// On a `SysCap`: read the whole machine's kernel log.
     ///
     /// [`SYS_LOG_READ`] answers every record every CPU wrote, which is every
-    /// process's business and no process's right by default. `/system/bin/logd` holds
+    /// process's business and no process's right by default. `logd` holds
     /// it because writing `/log` is its job and `test-runner` because a gate
     /// reads what the kernel said; no other program in any boot config does.
     ///
@@ -101,10 +101,10 @@ impl Rights {
     /// carries — one bit for both, because a machine taken away from its
     /// processes is the same authority whichever state it is left in. It rides a bit for
     /// the same reason minting a device claim and entering the real-time band
-    /// do: what can cut the power is exactly what `/system/bin/init` endowed, and
+    /// do: what can cut the power is exactly what `init` endowed, and
     /// there is nothing a program can name to reach it otherwise.
     ///
-    /// The kernel mints one carrying it, at boot, for `/system/bin/init`
+    /// The kernel mints one carrying it, at boot, for `init`
     /// (`kernel::loader::spawn_init`); every other holder is a narrowed
     /// duplicate init endowed from a `system.toml` row that named `power`.
     ///
@@ -120,7 +120,7 @@ impl Rights {
     /// ambient; the entries are a census of what the machine is running, and a
     /// process that was endowed one connector has no business reading it.
     ///
-    /// `/system/bin/toybox` holds it because `/system/bin/ps` is that binary under another
+    /// `toybox` holds it because `ps` is that binary under another
     /// name, and `test-runner` because several guest binaries read their own
     /// threads back out of the roster.
     ///
diff --git a/toyos-abi/src/lib.rs b/toyos-abi/src/lib.rs
index 99516647976..27fa4b03553 100644
--- a/toyos-abi/src/lib.rs
+++ b/toyos-abi/src/lib.rs
@@ -79,7 +79,7 @@ impl core::ops::Add for Tid {
 /// **The three handles are installed by the read that answers this.** A
 /// description is a set of buffers, and the process being told about them is
 /// the one that must be able to map them — which is never the process that
-/// minted the claim, because `/system/bin/init` mints every claim and holds none.
+/// minted the claim, because `init` mints every claim and holds none.
 #[repr(C)]
 #[derive(Clone, Copy)]
 pub struct FramebufferInfo {
diff --git a/toyos-abi/src/part.rs b/toyos-abi/src/part.rs
index 058dd2d96f5..76e383dd766 100644
--- a/toyos-abi/src/part.rs
+++ b/toyos-abi/src/part.rs
@@ -1,6 +1,6 @@
 //! What a claim on one GPT partition names and hands its holder.
 //!
-//! A partition is claimed the way a PCI function is: `/system/bin/init` mints it from a
+//! A partition is claimed the way a PCI function is: `init` mints it from a
 //! `system.toml` `devices` entry and endows it, and the holder reads and writes
 //! the partition's blocks through [`syscall::partition_read`] and
 //! [`syscall::partition_write`], durable at [`syscall::fsync`] on the claim.
diff --git a/toyos-abi/src/syscall.rs b/toyos-abi/src/syscall.rs
index d888b38fb89..dcb1cd8abc0 100644
--- a/toyos-abi/src/syscall.rs
+++ b/toyos-abi/src/syscall.rs
@@ -265,7 +265,7 @@ pub const SYS_PROCESS_KILL: u64 = 109;
 /// A `Process` handle for a pid, gated by [`Rights::MANAGE`] on a `SysCap`.
 /// See [`process_open`].
 ///
-/// The one place a pid becomes authority, and only `/system/bin/init` holds a cap that
+/// The one place a pid becomes authority, and only `init` holds a cap that
 /// carries the right — so the set of processes that can reach a process they
 /// did not start is exactly what init endowed.
 ///
@@ -273,7 +273,7 @@ pub const SYS_PROCESS_KILL: u64 = 109;
 pub const SYS_PROCESS_OPEN: u64 = 110;
 
 /// Mint a device claim for a class, gated by [`Rights::DEVICE`] on a `SysCap`.
-/// Only `/system/bin/init` holds such a cap, so the set of processes that can ever
+/// Only `init` holds such a cap, so the set of processes that can ever
 /// claim a device is exactly what init endowed. See [`device_claim`].
 ///
 /// [`Rights::DEVICE`]: crate::handle::Rights::DEVICE
@@ -301,7 +301,7 @@ pub const SYS_RT_ENTER: u64 = 112;
 /// [`crate::log`].
 ///
 /// **The kernel keeps no per-reader state**, so a second reader costs nothing
-/// and the stream is not consumed: `/system/bin/logd` and a `log-follow` tool coexist
+/// and the stream is not consumed: `logd` and a `log-follow` tool coexist
 /// with no coordination. Reading the whole machine's log is authority, which is
 /// why it rides a right rather than being ambient.
 ///
@@ -411,7 +411,7 @@ pub struct EndowEntry {
 
 const _: () = assert!(core::mem::size_of::<EndowEntry>() == 16);
 
-/// The label the kernel puts on `/system/bin/init`'s system capability, and the one
+/// The label the kernel puts on `init`'s system capability, and the one
 /// init puts on the `RT`-only dup it endows a `realtime` program.
 ///
 /// Here rather than in the SDK because the kernel writes it and userland reads
@@ -1195,7 +1195,7 @@ pub fn reboot(syscap: RawHandle) -> SyscallError {
 /// `devices` entry and a `dev:` endowment label spell each one with.
 ///
 /// **One row per class, so the four cannot disagree.** The build system checks
-/// a config against this table, `/system/bin/init` mints from it, and a claimant finds
+/// a config against this table, `init` mints from it, and a claimant finds
 /// its own claim by it; a second spelling anywhere is a class a config can name
 /// and no program can find. The wire number is here too, because a class whose
 /// number and name came from different lists is the same defect one level down.
diff --git a/toyos/src/device.rs b/toyos/src/device.rs
index cda2e0977b2..7e7c8e05ddc 100644
--- a/toyos/src/device.rs
+++ b/toyos/src/device.rs
@@ -1,7 +1,7 @@
 //! Hardware device access.
 //!
 //! Typed device wrappers, one per class. **None of them opens anything**: a
-//! claim is minted by `/system/bin/init` alone and arrives in this process's endowment
+//! claim is minted by `init` alone and arrives in this process's endowment
 //! table under `dev:<class>`, so [`crate::endow::device`] is the only way to
 //! get one and a program the manifest gives no device cannot express reaching
 //! hardware.
diff --git a/toyos/src/launch.rs b/toyos/src/launch.rs
index 4eda500c440..bbc4a7b06e9 100644
--- a/toyos/src/launch.rs
+++ b/toyos/src/launch.rs
@@ -1,4 +1,4 @@
-//! Asking `/system/bin/init` to start a declared program.
+//! Asking `init` to start a declared program.
 //!
 //! **`SYS_SPAWN` can only give a child what the caller holds, and that is not
 //! enough.** doom is started from a shell and doom is to hold sound; the shell
@@ -14,7 +14,7 @@
 //! its own manifest row rather than a narrowing of its parent's.
 //!
 //! The wire is a single frame plus one handle batch, and this module is both
-//! halves of it — std's `Command` encodes and `/system/bin/init` decodes.
+//! halves of it — std's `Command` encodes and `init` decodes.
 
 use crate::ipc::{Connection, IpcError};
 use crate::RawHandle;
@@ -57,8 +57,8 @@ const HEADER: usize = 32;
 pub struct Launch<'a> {
     /// The program's path, exactly as the caller resolved it.
     ///
-    /// **Not a `[programs]` key**, because `/system/bin/ls` is a symlink to
-    /// `/system/bin/toybox` and the row that says what an applet may hold is
+    /// **Not a `[programs]` key**, because `ls` is a symlink to
+    /// `toybox` and the row that says what an applet may hold is
     /// `toybox`'s. init resolves the path to a key; the caller does not parse
     /// the manifest and there is deliberately no second reader of it.
     pub program: &'a str,
diff --git a/toyos/src/lib.rs b/toyos/src/lib.rs
index bf6d485e617..1ef64f67bae 100644
--- a/toyos/src/lib.rs
+++ b/toyos/src/lib.rs
@@ -105,7 +105,7 @@ impl Drop for OwnedHandle {
 
 /// A claimed hardware device, out of this process's endowment table.
 ///
-/// There is no `open`: `/system/bin/init` mints every claim from the machine's one
+/// There is no `open`: `init` mints every claim from the machine's one
 /// system capability and endows it, so which process drives a device is a fact
 /// the image was built with. See [`endow::device`].
 pub struct Device(pub(crate) OwnedHandle);
diff --git a/toyos/src/log.rs b/toyos/src/log.rs
index 55bc6248fdf..d82df68fb4c 100644
--- a/toyos/src/log.rs
+++ b/toyos/src/log.rs
@@ -21,7 +21,7 @@ use crate::AsHandle;
 ///
 /// A fresh tail starts at the oldest record every shard still holds, which is
 /// the whole boot on a machine that has not logged 512 records on any CPU yet —
-/// so `/system/bin/logd` starting late still writes this boot's log from its first
+/// so `logd` starting late still writes this boot's log from its first
 /// line.
 pub struct LogTail {
     cursor: LogCursor,
diff --git a/toyos/src/namespace.rs b/toyos/src/namespace.rs
index 5aa6ba69b74..f3608c4ffbc 100644
--- a/toyos/src/namespace.rs
+++ b/toyos/src/namespace.rs
@@ -60,7 +60,7 @@ pub struct Builder<'a> {
 }
 
 /// A fixed-capacity name blob and vector, so building a namespace needs no
-/// allocator — `/system/bin/init` builds one per program before anything else runs.
+/// allocator — `init` builds one per program before anything else runs.
 mod heapless_names {
     use toyos_abi::syscall::{MAX_NAMESPACE_ENTRIES, MAX_SERVICE_NAME};
 
diff --git a/toyos/src/net.rs b/toyos/src/net.rs
index fb43de4a558..88ff96e3047 100644
--- a/toyos/src/net.rs
+++ b/toyos/src/net.rs
@@ -328,7 +328,7 @@ impl NetdConn {
 /// already exited *succeeds* — the connection queues on a port nobody will
 /// ever accept from — and the hang-up arrives at the first send or the first
 /// read instead. Reporting that as [`NetError::Io`] left every caller unable
-/// to tell "this machine has no network" from "netd failed", and `/system/bin/sshd`
+/// to tell "this machine has no network" from "netd failed", and `sshd`
 /// panicked across the boot of every NIC-less machine that lost the race
 /// rather than exiting with the line it has for exactly this.
 ///
@@ -603,7 +603,7 @@ mod tests {
 
     /// Everything that is *not* a peer that has gone. Each of these on a
     /// machine with a live netd is a real failure and must reach the caller as
-    /// one — `/system/bin/sshd` panics on `NetError::Io` by design.
+    /// one — `sshd` panics on `NetError::Io` by design.
     #[test]
     fn nothing_else_becomes_a_missing_netd() {
         for e in [
diff --git a/toyos/src/surface.rs b/toyos/src/surface.rs
index fc33ed3ae9b..758730ab7a4 100644
--- a/toyos/src/surface.rs
+++ b/toyos/src/surface.rs
@@ -1,7 +1,7 @@
 //! Key events down the surface tree.
 //!
 //! A **surface** is something with a screen and a keyboard: the compositor's
-//! windows, `/system/bin/terminal`, `/system/bin/console`. Its owner reads key transitions
+//! windows, `terminal`, `console`. Its owner reads key transitions
 //! from whatever is above it and decides what they mean — which for a terminal
 //! is bytes on its child's stdin, through a [`toyos_keymap::Translator`] it
 //! owns alone.
diff --git a/toyos/src/syscap.rs b/toyos/src/syscap.rs
index 90b12ae0be6..2bc9aec4b45 100644
--- a/toyos/src/syscap.rs
+++ b/toyos/src/syscap.rs
@@ -4,7 +4,7 @@
 //! the real-time band, turning a pid into a process handle, listing every
 //! process in the machine, reading what the machine is made of, and taking its
 //! power away, off or back to firmware — and each is one bit on a handle to
-//! this. The kernel makes exactly one at boot, for `/system/bin/init`, so the set of
+//! this. The kernel makes exactly one at boot, for `init`, so the set of
 //! processes that can ever do any of them is exactly what init endowed.
 
 use toyos_abi::handle::Rights;
@@ -95,7 +95,7 @@ impl SysCap {
     ///
     /// Needs [`Rights::ROSTER`], which is what makes the entries — a pid, a
     /// size, a CPU time and a **name** for every process in the machine — the
-    /// business of `/system/bin/ps` and not of every program that can make a syscall.
+    /// business of `ps` and not of every program that can make a syscall.
     /// [`crate::system::sysinfo`] is the header on its own and needs nothing.
     ///
     /// A `buf` too small for an entry asks for the header, which this
@@ -131,7 +131,7 @@ impl SysCap {
     ///
     /// The one place a pid becomes authority over anything, and only a cap
     /// carrying [`Rights::MANAGE`] reaches it — which in the whole system is
-    /// `/system/bin/init`'s.
+    /// `init`'s.
     pub fn open_process(&self, pid: toyos_abi::Pid) -> Result<crate::process::Process, SyscallError> {
         let raw = syscall::process_open(self.0.raw(), pid)?;
         // SAFETY: the kernel installed this handle in this process's table for
diff --git a/userland/toyos-window/src/lib.rs b/userland/toyos-window/src/lib.rs
index af586459f93..4ceb528dff6 100644
--- a/userland/toyos-window/src/lib.rs
+++ b/userland/toyos-window/src/lib.rs
@@ -10,7 +10,7 @@ use toyos::surface;
 use toyos::Connection;
 use toyos::shm::SharedMemory;
 /// Re-exported because [`KeyPress`] is made of them and a client that holds
-/// its own translator — `/system/bin/console`, a test that stands in for a surface —
+/// its own translator — `console`, a test that stands in for a surface —
 /// should not have to name a second crate to do what this one does.
 pub use toyos_keymap::{Emit, Mods, Translator};