diff --git a/build.zig b/build.zig
index 026e140..57689b3 100644
--- a/build.zig
+++ b/build.zig
@@ -251,9 +251,6 @@ pub fn build(b: *std.Build) void {
     const abi_module = kernel_library.module("abi");
     const device_abi_module = device_library.module("device-abi");
     const pci_class_module = device_library.module("pci-class");
-    const csv_module = csv_library.module("csv");
-    const device_registry_module = device_library.module("device-registry");
-    const aml_module = device_library.module("aml");
     const usb_abi_module = device_library.module("usb-abi");
     const usb_ids_module = device_library.module("usb-ids");
     const usb_transfer_protocol_module = protocol_library.module("usb-transfer-protocol");
@@ -299,13 +296,12 @@ pub fn build(b: *std.Build) void {
         },
     });
 
-    // The wire protocols, all exported by the protocol package.
-    const vfs_protocol_module = protocol_library.module("vfs-protocol");
+    // The wire protocols some binaries name as per-binary extras, exported by
+    // the protocol package.
     const input_protocol_module = protocol_library.module("input-protocol");
     const device_manager_protocol_module = protocol_library.module("device-manager-protocol");
     const display_protocol_module = protocol_library.module("display-protocol");
     const scanout_protocol_module = protocol_library.module("scanout-protocol");
-    const power_protocol_module = protocol_library.module("power-protocol");
 
     // The driver-side libraries some binaries name as per-binary extras. (The
     // rest of the domain modules reach the root only through build-support's
@@ -370,23 +366,14 @@ pub fn build(b: *std.Build) void {
         .xkeyboard_config = xkeyboard_config_library,
     });
 
-    // Built by the shared user-binary recipe (see addUserBinary): freestanding,
-    // linked into the kernel's user region against the library/kernel modules, and
-    // started in ring 3 by the kernel's user-ELF loader.
-    const init_exe = addUserBinary(b, kernel_target, &default_imports, "init", "system/services/init/init.zig");
-    programModule(init_exe).addImport("power-protocol", power_protocol_module);
-    // init parses its boot service list from /etc/init.csv with the shared csv helpers.
-    programModule(init_exe).addImport("csv", csv_module);
-    // init reads the same `serial` flag the kernel does: its liveness heartbeat is a
-    // serial/test-build diagnostic (the QEMU harness's init tests assert on it, and
-    // -Dserial images emit it), so a flashable image runs a purely event-driven PID 1
-    // that wakes only for real work. The test harness builds with -Dserial=true, so
-    // the heartbeat stays present under test.
-    const init_options = b.addOptions();
-    init_options.addOption(bool, "serial", serial);
-    // Which services init starts is no longer a comptime option: it reads /etc/init.csv,
-    // and -Ddiagnose selects which init.csv is bundled (see the `bundled` list below).
-    programModule(init_exe).addImport("build_options", init_options.createModule());
+    // Binary packages (docs/build-packages-plan.md, phase 2): each binary
+    // builds itself against the domain packages via build-support's shared
+    // recipe, started in ring 3 by the kernel's user-ELF loader like always;
+    // the root build just takes artifacts for the boot image. init receives
+    // the root's -Dserial as a dependency option (its liveness heartbeat is a
+    // serial/test-build diagnostic the QEMU harness asserts on; a flashable
+    // image leaves it out).
+    const init_exe = b.dependency("init", .{ .serial = serial }).artifact("init");
 
     // --- the rest of the boot tree: /system services and drivers, /test fixtures ---
     // Each is built by the same user-binary recipe and laid out at its FHS path on
@@ -424,16 +411,13 @@ pub fn build(b: *std.Build) void {
     const usb_storage_exe = addUserBinary(b, kernel_target, &default_imports, "usb-storage", "system/drivers/usb-storage/usb-storage.zig");
     programModule(usb_storage_exe).addImport("usb", usb_module);
     programModule(usb_storage_exe).addImport("block-protocol", block_protocol_module);
-    // The FAT filesystem server: mounts the block device and serves it into the VFS
-    // at /mnt/usb. Its engine (engine.zig / on-disk.zig) is imported relatively.
-    const fat_exe = addUserBinary(b, kernel_target, &default_imports, "fat", "system/services/fat/fat.zig");
-    programModule(fat_exe).addImport("vfs-protocol", vfs_protocol_module);
-    // Threaded: the display runs a mouse-listener thread alongside its compositor loop
-    // (docs/threading.md, docs/display.md), so it opts into real atomics/TLS.
-    const display_exe = addThreadedUserBinary(b, kernel_target, &default_imports, "display", "system/services/display/display.zig");
-    programModule(display_exe).addImport("display-protocol", display_protocol_module);
-    programModule(display_exe).addImport("scanout-protocol", scanout_protocol_module);
-    const display_demo_exe = addUserBinary(b, kernel_target, &default_imports, "display-demo", "system/services/display-demo/display-demo.zig");
+    // The FAT filesystem server and the display stack, each its own package
+    // (fat's and display's unit tests ride along in their packages).
+    const fat_package = b.dependency("fat", .{});
+    const fat_exe = fat_package.artifact("fat");
+    const display_package = b.dependency("display", .{});
+    const display_exe = display_package.artifact("display");
+    const display_demo_exe = b.dependency("display-demo", .{}).artifact("display-demo");
     const virtio_gpu_exe = addUserBinary(b, kernel_target, &default_imports, "virtio-gpu", "system/drivers/virtio-gpu/virtio-gpu.zig");
     programModule(virtio_gpu_exe).addImport("pci", pci_module); // library/device/pci — the claimed-function view
     programModule(virtio_gpu_exe).addImport("display-protocol", display_protocol_module);
@@ -466,32 +450,24 @@ pub fn build(b: *std.Build) void {
     // "discovery" so the device manager never learns which firmware it is on.
     // x86 boots describe hardware with ACPI; the Raspberry Pis hand over a
     // flattened device tree — the aarch64 target flips the default when it
-    // lands (docs/arm.md). Both are placeholders until M20.1 (acpi) and the
-    // ARM bring-up (fdt).
+    // lands (docs/arm.md). Each firmware's service is its own package; both
+    // export an artifact named "discovery", and this option picks which one
+    // ships (only the chosen one is compiled).
     const Discovery = enum { acpi, fdt };
     const discovery = b.option(Discovery, "discovery", "Which discovery service fills the ramdisk's 'discovery' slot (default: acpi)") orelse Discovery.acpi;
-    const discovery_source: []const u8 = switch (discovery) {
-        .acpi => "system/services/acpi/acpi.zig",
-        .fdt => "system/services/fdt/fdt.zig",
+    const discovery_exe = switch (discovery) {
+        .acpi => b.dependency("acpi", .{}).artifact("discovery"),
+        .fdt => b.dependency("fdt", .{}).artifact("discovery"),
     };
-    const discovery_exe = addUserBinary(b, kernel_target, &default_imports, "discovery", discovery_source);
-    if (discovery == .acpi) programModule(discovery_exe).addImport("aml", aml_module);
-    if (discovery == .acpi) programModule(discovery_exe).addImport("device-manager-protocol", device_manager_protocol_module);
-    if (discovery == .acpi) programModule(discovery_exe).addImport("power-protocol", power_protocol_module);
-    const device_manager_exe = addUserBinary(b, kernel_target, &default_imports, "device-manager", "system/services/device-manager/device-manager.zig");
-    programModule(device_manager_exe).addImport("device-manager-protocol", device_manager_protocol_module);
-    // Driver matching is data-driven: the manager parses /etc/devices.csv into this
-    // module's rules and binds each reported device by most-specific match.
-    programModule(device_manager_exe).addImport("device-registry", device_registry_module);
+    const device_manager_exe = b.dependency("device-manager", .{}).artifact("device-manager");
     // The input service and its exercisers: the fan-out server, a hardware-free synthetic
     // source, and a subscriber that doubles as the `input` test's oracle. See docs/input.md.
-    const input_exe = addUserBinary(b, kernel_target, &default_imports, "input", "system/services/input/input.zig");
-    programModule(input_exe).addImport("input-protocol", input_protocol_module);
+    const input_exe = b.dependency("input", .{}).artifact("input");
     const input_source_exe = addUserBinary(b, kernel_target, &default_imports, "input-source", "test/system/services/input-source/input-source.zig");
     const input_test_exe = addUserBinary(b, kernel_target, &default_imports, "input-test", "test/system/services/input-test/input-test.zig");
     const args_echo_exe = addUserBinary(b, kernel_target, &default_imports, "args-echo", "test/system/services/args-echo/args-echo.zig");
     const process_test_exe = addUserBinary(b, kernel_target, &default_imports, "process-test", "test/system/services/process-test/process-test.zig");
-    const logger_exe = addUserBinary(b, kernel_target, &default_imports, "logger", "system/services/logger/logger.zig");
+    const logger_exe = b.dependency("logger", .{}).artifact("logger");
     // The first multi-threaded binary: exercises runtime.Thread over the thread ABI
     // (docs/threading.md). Built threaded so its shared-memory poll is real.
     const thread_test_exe = addThreadedUserBinary(b, kernel_target, &default_imports, "thread-test", "test/system/services/thread-test/thread-test.zig");
@@ -852,9 +828,6 @@ pub fn build(b: *std.Build) void {
         "system/drivers/usb-hid/hid-report.zig", // HID boot-report keyboard/mouse decode
         "system/drivers/usb-storage/bulk-only-transport.zig", // CBW/CSW wrapper sizes
         "system/drivers/usb-storage/scsi.zig", // SCSI CDB encodings (big-endian)
-        "system/services/fat/on-disk.zig", // FAT on-disk struct sizes + type detection
-        "system/services/fat/engine.zig", // FAT read/write over a RAM-backed image
-        "system/services/display/compositor.zig", // Rect math + fill/composite/blit-tile
         "system/drivers/virtio-gpu/virtio-gpu-protocol.zig", // virtio-gpu command struct sizes
         "system/drivers/virtio-gpu/virtio-pci.zig", // virtio 1.0 PCI transport struct sizes
     }) |root| {
@@ -868,11 +841,12 @@ pub fn build(b: *std.Build) void {
         test_step.dependOn(&b.addRunArtifact(mod_tests).step);
     }
 
-    // The library domains own their unit tests (each package's standalone
-    // `zig build test` step); the root aggregate delegates to those steps so
-    // one command still runs everything and a test added inside a domain
-    // package can never be silently skipped here. Domain tests are host-only,
-    // so root's -Dtarget/-Doptimize deliberately do not reach them.
+    // The library domains and the binary packages own their unit tests (each
+    // package's standalone `zig build test` step); the root aggregate
+    // delegates to those steps so one command still runs everything and a
+    // test added inside a package can never be silently skipped here. Package
+    // tests are host-only, so root's -Dtarget/-Doptimize deliberately do not
+    // reach them.
     for ([_]*std.Build.Dependency{
         kernel_library,
         device_library,
@@ -880,8 +854,10 @@ pub fn build(b: *std.Build) void {
         protocol_library,
         csv_library,
         xkeyboard_config_library,
-    }) |library| {
-        test_step.dependOn(&library.builder.top_level_steps.get("test").?.step);
+        fat_package,
+        display_package,
+    }) |package| {
+        test_step.dependOn(&package.builder.top_level_steps.get("test").?.step);
     }
 
     // The tagged kernel log ring: append/wrap/reclaim/sequence-gap behavior over
diff --git a/build.zig.zon b/build.zig.zon
index b80f6ad..2c3c86e 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -44,6 +44,15 @@
         .@"xkeyboard-config" = .{ .path = "library/xkeyboard-config" },
         // Binary packages (phase 2), consumed as artifacts for the boot image.
         .@"pci-bus" = .{ .path = "system/drivers/pci-bus" },
+        .init = .{ .path = "system/services/init" },
+        .fat = .{ .path = "system/services/fat" },
+        .display = .{ .path = "system/services/display" },
+        .@"display-demo" = .{ .path = "system/services/display-demo" },
+        .@"device-manager" = .{ .path = "system/services/device-manager" },
+        .input = .{ .path = "system/services/input" },
+        .logger = .{ .path = "system/services/logger" },
+        .acpi = .{ .path = "system/services/acpi" },
+        .fdt = .{ .path = "system/services/fdt" },
         // See `zig fetch --save <url>` for a command-line interface for adding dependencies.
         //.example = .{
         //    // When updating this field to a new URL, be sure to delete the corresponding
diff --git a/system/drivers/ps2-bus/build.zig b/system/drivers/ps2-bus/build.zig
new file mode 100644
index 0000000..ff6587a
--- /dev/null
+++ b/system/drivers/ps2-bus/build.zig
@@ -0,0 +1,49 @@
+//! The ps2-bus driver as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+
+    const ps2_bus_exe = build_support.userBinary(b, .{
+        .name = "ps2-bus",
+        .root_source_file = b.path("ps2-bus.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(ps2_bus_exe);
+
+    const ps2_keyboard_exe = build_support.userBinary(b, .{
+        .name = "ps2-keyboard",
+        .root_source_file = b.path("keyboard.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(ps2_keyboard_exe).addImport("input-protocol", protocol.module("input-protocol"));
+    b.installArtifact(ps2_keyboard_exe);
+
+    const ps2_mouse_exe = build_support.userBinary(b, .{
+        .name = "ps2-mouse",
+        .root_source_file = b.path("mouse.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(ps2_mouse_exe).addImport("input-protocol", protocol.module("input-protocol"));
+    b.installArtifact(ps2_mouse_exe);
+
+    // Standalone `zig build test`; the root aggregate depends on this step.
+    const test_step = b.step("test", "Run the ps2-bus unit tests");
+    for ([_][]const u8{
+        "scancode.zig", // set-2 decode + keyboard state machine
+        "mouse-packet.zig", // 3-byte mouse packet assembly
+    }) |test_root| {
+        const unit_tests = b.addTest(.{
+            .root_module = b.createModule(.{
+                .root_source_file = b.path(test_root),
+                .target = b.resolveTargetQuery(.{}),
+            }),
+        });
+        test_step.dependOn(&b.addRunArtifact(unit_tests).step);
+    }
+}
diff --git a/system/drivers/ps2-bus/build.zig.zon b/system/drivers/ps2-bus/build.zig.zon
new file mode 100644
index 0000000..79aaf45
--- /dev/null
+++ b/system/drivers/ps2-bus/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .ps2_bus,
+    .version = "0.0.0",
+    .fingerprint = 0x642a365353bf7de9, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/system/drivers/usb-hid/build.zig b/system/drivers/usb-hid/build.zig
new file mode 100644
index 0000000..5c2ca26
--- /dev/null
+++ b/system/drivers/usb-hid/build.zig
@@ -0,0 +1,46 @@
+//! The usb-hid driver as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+    const device = b.dependency("device", .{});
+
+    const usb_hid_keyboard_exe = build_support.userBinary(b, .{
+        .name = "usb-hid-keyboard",
+        .root_source_file = b.path("keyboard.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(usb_hid_keyboard_exe).addImport("usb", device.module("usb"));
+    build_support.programModule(usb_hid_keyboard_exe).addImport("usb-abi", device.module("usb-abi"));
+    build_support.programModule(usb_hid_keyboard_exe).addImport("input-protocol", protocol.module("input-protocol"));
+    b.installArtifact(usb_hid_keyboard_exe);
+
+    const usb_hid_mouse_exe = build_support.userBinary(b, .{
+        .name = "usb-hid-mouse",
+        .root_source_file = b.path("mouse.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(usb_hid_mouse_exe).addImport("usb", device.module("usb"));
+    build_support.programModule(usb_hid_mouse_exe).addImport("usb-abi", device.module("usb-abi"));
+    build_support.programModule(usb_hid_mouse_exe).addImport("input-protocol", protocol.module("input-protocol"));
+    b.installArtifact(usb_hid_mouse_exe);
+
+    // Standalone `zig build test`; the root aggregate depends on this step.
+    const test_step = b.step("test", "Run the usb-hid unit tests");
+    for ([_][]const u8{
+        "hid-report.zig", // HID boot-report keyboard/mouse decode
+    }) |test_root| {
+        const unit_tests = b.addTest(.{
+            .root_module = b.createModule(.{
+                .root_source_file = b.path(test_root),
+                .target = b.resolveTargetQuery(.{}),
+            }),
+        });
+        test_step.dependOn(&b.addRunArtifact(unit_tests).step);
+    }
+}
diff --git a/system/drivers/usb-hid/build.zig.zon b/system/drivers/usb-hid/build.zig.zon
new file mode 100644
index 0000000..91c7b5d
--- /dev/null
+++ b/system/drivers/usb-hid/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .usb_hid,
+    .version = "0.0.0",
+    .fingerprint = 0x66328b738fffff01, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/system/drivers/usb-storage/build.zig b/system/drivers/usb-storage/build.zig
new file mode 100644
index 0000000..d21086f
--- /dev/null
+++ b/system/drivers/usb-storage/build.zig
@@ -0,0 +1,36 @@
+//! The usb-storage driver as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+    const device = b.dependency("device", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "usb-storage",
+        .root_source_file = b.path("usb-storage.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(exe).addImport("usb", device.module("usb"));
+    build_support.programModule(exe).addImport("block-protocol", protocol.module("block-protocol"));
+    b.installArtifact(exe);
+
+    // Standalone `zig build test`; the root aggregate depends on this step.
+    const test_step = b.step("test", "Run the usb-storage unit tests");
+    for ([_][]const u8{
+        "bulk-only-transport.zig", // CBW/CSW wrapper sizes
+        "scsi.zig", // SCSI CDB encodings (big-endian)
+    }) |test_root| {
+        const unit_tests = b.addTest(.{
+            .root_module = b.createModule(.{
+                .root_source_file = b.path(test_root),
+                .target = b.resolveTargetQuery(.{}),
+            }),
+        });
+        test_step.dependOn(&b.addRunArtifact(unit_tests).step);
+    }
+}
diff --git a/system/drivers/usb-storage/build.zig.zon b/system/drivers/usb-storage/build.zig.zon
new file mode 100644
index 0000000..7685ba1
--- /dev/null
+++ b/system/drivers/usb-storage/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .usb_storage,
+    .version = "0.0.0",
+    .fingerprint = 0xce09fdc4c50bb4fe, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/system/drivers/usb-xhci-bus/build.zig b/system/drivers/usb-xhci-bus/build.zig
new file mode 100644
index 0000000..5332929
--- /dev/null
+++ b/system/drivers/usb-xhci-bus/build.zig
@@ -0,0 +1,24 @@
+//! The usb-xhci-bus driver as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+    const device = b.dependency("device", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "usb-xhci-bus",
+        .root_source_file = b.path("usb-xhci-bus.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(exe).addImport("device-manager-protocol", protocol.module("device-manager-protocol"));
+    build_support.programModule(exe).addImport("pci", device.module("pci"));
+    build_support.programModule(exe).addImport("usb-abi", device.module("usb-abi"));
+    build_support.programModule(exe).addImport("usb-ids", device.module("usb-ids"));
+    build_support.programModule(exe).addImport("usb-transfer-protocol", protocol.module("usb-transfer-protocol"));
+    b.installArtifact(exe);
+}
diff --git a/system/drivers/usb-xhci-bus/build.zig.zon b/system/drivers/usb-xhci-bus/build.zig.zon
new file mode 100644
index 0000000..2373020
--- /dev/null
+++ b/system/drivers/usb-xhci-bus/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .usb_xhci_bus,
+    .version = "0.0.0",
+    .fingerprint = 0x46d21373f05f6b20, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/system/drivers/virtio-gpu/build.zig b/system/drivers/virtio-gpu/build.zig
new file mode 100644
index 0000000..285a8f2
--- /dev/null
+++ b/system/drivers/virtio-gpu/build.zig
@@ -0,0 +1,37 @@
+//! The virtio-gpu driver as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+    const device = b.dependency("device", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "virtio-gpu",
+        .root_source_file = b.path("virtio-gpu.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(exe).addImport("pci", device.module("pci"));
+    build_support.programModule(exe).addImport("display-protocol", protocol.module("display-protocol"));
+    build_support.programModule(exe).addImport("scanout-protocol", protocol.module("scanout-protocol"));
+    b.installArtifact(exe);
+
+    // Standalone `zig build test`; the root aggregate depends on this step.
+    const test_step = b.step("test", "Run the virtio-gpu unit tests");
+    for ([_][]const u8{
+        "virtio-gpu-protocol.zig", // virtio-gpu command struct sizes
+        "virtio-pci.zig", // virtio 1.0 PCI transport struct sizes
+    }) |test_root| {
+        const unit_tests = b.addTest(.{
+            .root_module = b.createModule(.{
+                .root_source_file = b.path(test_root),
+                .target = b.resolveTargetQuery(.{}),
+            }),
+        });
+        test_step.dependOn(&b.addRunArtifact(unit_tests).step);
+    }
+}
diff --git a/system/drivers/virtio-gpu/build.zig.zon b/system/drivers/virtio-gpu/build.zig.zon
new file mode 100644
index 0000000..5098bf8
--- /dev/null
+++ b/system/drivers/virtio-gpu/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .virtio_gpu,
+    .version = "0.0.0",
+    .fingerprint = 0xfb704899c18b9a23, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/system/services/acpi/build.zig b/system/services/acpi/build.zig
new file mode 100644
index 0000000..04ab2f7
--- /dev/null
+++ b/system/services/acpi/build.zig
@@ -0,0 +1,24 @@
+//! The acpi discovery service as a binary package (docs/build-packages-plan.md,
+//! phase 2). The artifact is named "discovery": one swappable process per
+//! firmware fills the ramdisk's neutral `discovery` slot (docs/discovery.md),
+//! so the device manager never learns which firmware it is on. The root
+//! build's -Ddiscovery picks this package or `fdt`.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "discovery",
+        .root_source_file = b.path("acpi.zig"),
+        .domains = build_support.domains(b),
+    });
+    const protocol = b.dependency("protocol", .{});
+    // The shared AML interpreter (the same parser the kernel runs), the
+    // device-manager report channel, and the power protocol (the SCI/power
+    // button path, docs/power.md).
+    build_support.programModule(exe).addImport("aml", b.dependency("device", .{}).module("aml"));
+    build_support.programModule(exe).addImport("device-manager-protocol", protocol.module("device-manager-protocol"));
+    build_support.programModule(exe).addImport("power-protocol", protocol.module("power-protocol"));
+    b.installArtifact(exe);
+}
diff --git a/system/services/acpi/build.zig.zon b/system/services/acpi/build.zig.zon
new file mode 100644
index 0000000..d6eb819
--- /dev/null
+++ b/system/services/acpi/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .acpi,
+    .version = "0.0.0",
+    .fingerprint = 0xf31e9a0903256b64, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/system/services/device-manager/build.zig b/system/services/device-manager/build.zig
new file mode 100644
index 0000000..97ad471
--- /dev/null
+++ b/system/services/device-manager/build.zig
@@ -0,0 +1,21 @@
+//! The device-manager service as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+    const device = b.dependency("device", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "device-manager",
+        .root_source_file = b.path("device-manager.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(exe).addImport("device-manager-protocol", protocol.module("device-manager-protocol"));
+    build_support.programModule(exe).addImport("device-registry", device.module("device-registry"));
+    b.installArtifact(exe);
+}
diff --git a/system/services/device-manager/build.zig.zon b/system/services/device-manager/build.zig.zon
new file mode 100644
index 0000000..626e6d9
--- /dev/null
+++ b/system/services/device-manager/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .device_manager,
+    .version = "0.0.0",
+    .fingerprint = 0x7092fc24905cd147, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/system/services/display-demo/build.zig b/system/services/display-demo/build.zig
new file mode 100644
index 0000000..8639b7d
--- /dev/null
+++ b/system/services/display-demo/build.zig
@@ -0,0 +1,16 @@
+//! The display-demo service as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "display-demo",
+        .root_source_file = b.path("display-demo.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/system/services/display-demo/build.zig.zon b/system/services/display-demo/build.zig.zon
new file mode 100644
index 0000000..7221935
--- /dev/null
+++ b/system/services/display-demo/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .display_demo,
+    .version = "0.0.0",
+    .fingerprint = 0x5d2832e1e2880143, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/system/services/display/build.zig b/system/services/display/build.zig
new file mode 100644
index 0000000..54e0d18
--- /dev/null
+++ b/system/services/display/build.zig
@@ -0,0 +1,35 @@
+//! The display service as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "display",
+        .root_source_file = b.path("display.zig"),
+        .domains = build_support.domains(b),
+        .threaded = true, // real atomics/TLS (docs/threading.md)
+    });
+    build_support.programModule(exe).addImport("display-protocol", protocol.module("display-protocol"));
+    build_support.programModule(exe).addImport("scanout-protocol", protocol.module("scanout-protocol"));
+    b.installArtifact(exe);
+
+    // Standalone `zig build test`; the root aggregate depends on this step.
+    const test_step = b.step("test", "Run the display unit tests");
+    for ([_][]const u8{
+        "compositor.zig", // Rect math + fill/composite/blit-tile
+    }) |test_root| {
+        const unit_tests = b.addTest(.{
+            .root_module = b.createModule(.{
+                .root_source_file = b.path(test_root),
+                .target = b.resolveTargetQuery(.{}),
+            }),
+        });
+        test_step.dependOn(&b.addRunArtifact(unit_tests).step);
+    }
+}
diff --git a/system/services/display/build.zig.zon b/system/services/display/build.zig.zon
new file mode 100644
index 0000000..165dd06
--- /dev/null
+++ b/system/services/display/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .display,
+    .version = "0.0.0",
+    .fingerprint = 0xcd172a34b127a19, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/system/services/fat/build.zig b/system/services/fat/build.zig
new file mode 100644
index 0000000..ca78739
--- /dev/null
+++ b/system/services/fat/build.zig
@@ -0,0 +1,34 @@
+//! The fat service as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "fat",
+        .root_source_file = b.path("fat.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(exe).addImport("vfs-protocol", protocol.module("vfs-protocol"));
+    b.installArtifact(exe);
+
+    // Standalone `zig build test`; the root aggregate depends on this step.
+    const test_step = b.step("test", "Run the fat unit tests");
+    for ([_][]const u8{
+        "on-disk.zig", // FAT on-disk struct sizes + type detection
+        "engine.zig", // FAT read/write over a RAM-backed image
+    }) |test_root| {
+        const unit_tests = b.addTest(.{
+            .root_module = b.createModule(.{
+                .root_source_file = b.path(test_root),
+                .target = b.resolveTargetQuery(.{}),
+            }),
+        });
+        test_step.dependOn(&b.addRunArtifact(unit_tests).step);
+    }
+}
diff --git a/system/services/fat/build.zig.zon b/system/services/fat/build.zig.zon
new file mode 100644
index 0000000..43109c4
--- /dev/null
+++ b/system/services/fat/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .fat,
+    .version = "0.0.0",
+    .fingerprint = 0x98958143ecfe1636, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/system/services/fdt/build.zig b/system/services/fdt/build.zig
new file mode 100644
index 0000000..2487a76
--- /dev/null
+++ b/system/services/fdt/build.zig
@@ -0,0 +1,17 @@
+//! The fdt discovery service as a binary package (docs/build-packages-plan.md,
+//! phase 2). The artifact is named "discovery" like acpi's: the Raspberry Pis
+//! hand over a flattened device tree instead of ACPI, and the aarch64 target
+//! flips the root build's -Ddiscovery default when it lands (docs/arm.md).
+//! A placeholder until the ARM bring-up.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "discovery",
+        .root_source_file = b.path("fdt.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/system/services/fdt/build.zig.zon b/system/services/fdt/build.zig.zon
new file mode 100644
index 0000000..e1f58c4
--- /dev/null
+++ b/system/services/fdt/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .fdt,
+    .version = "0.0.0",
+    .fingerprint = 0xe5e27506c7fc2eea, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/system/services/init/build.zig b/system/services/init/build.zig
new file mode 100644
index 0000000..3903da8
--- /dev/null
+++ b/system/services/init/build.zig
@@ -0,0 +1,31 @@
+//! init (PID 1) as a binary package (docs/build-packages-plan.md, phase 2):
+//! this file names only what is specific to init — the shared recipe and the
+//! default-import wiring live in build-support. The root build consumes the
+//! artifact for the boot image and forwards its -Dserial here.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "init",
+        .root_source_file = b.path("init.zig"),
+        .domains = build_support.domains(b),
+    });
+    // init speaks the power protocol (orderly shutdown, docs/power.md) and
+    // parses its boot service list from /etc/init.csv with the shared csv
+    // helpers. Which services it starts is data, not a compile-time option:
+    // the root build selects which init.csv variant is bundled (-Ddiagnose).
+    build_support.programModule(exe).addImport("power-protocol", b.dependency("protocol", .{}).module("power-protocol"));
+    build_support.programModule(exe).addImport("csv", b.dependency("csv", .{}).module("csv"));
+    // init reads the same `serial` flag the kernel does: its liveness heartbeat
+    // is a serial/test-build diagnostic (the QEMU harness's init tests assert
+    // on it, and -Dserial images emit it), so a flashable image runs a purely
+    // event-driven PID 1 that wakes only for real work. The root build forwards
+    // its top-level -Dserial as this dependency option.
+    const serial = b.option(bool, "serial", "Compile the serial liveness heartbeat in (forwarded from the root -Dserial)") orelse false;
+    const init_options = b.addOptions();
+    init_options.addOption(bool, "serial", serial);
+    build_support.programModule(exe).addImport("build_options", init_options.createModule());
+    b.installArtifact(exe);
+}
diff --git a/system/services/init/build.zig.zon b/system/services/init/build.zig.zon
new file mode 100644
index 0000000..a6c55a5
--- /dev/null
+++ b/system/services/init/build.zig.zon
@@ -0,0 +1,16 @@
+.{
+    .name = .init,
+    .version = "0.0.0",
+    .fingerprint = 0xc674e474eeeced43, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+        .csv = .{ .path = "../../../library/csv" },
+    },
+    .paths = .{""},
+}
diff --git a/system/services/input/build.zig b/system/services/input/build.zig
new file mode 100644
index 0000000..836dec6
--- /dev/null
+++ b/system/services/input/build.zig
@@ -0,0 +1,19 @@
+//! The input service as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "input",
+        .root_source_file = b.path("input.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(exe).addImport("input-protocol", protocol.module("input-protocol"));
+    b.installArtifact(exe);
+}
diff --git a/system/services/input/build.zig.zon b/system/services/input/build.zig.zon
new file mode 100644
index 0000000..591b663
--- /dev/null
+++ b/system/services/input/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .input,
+    .version = "0.0.0",
+    .fingerprint = 0xd82832d7113ed94e, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/system/services/logger/build.zig b/system/services/logger/build.zig
new file mode 100644
index 0000000..5763494
--- /dev/null
+++ b/system/services/logger/build.zig
@@ -0,0 +1,16 @@
+//! The logger service as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "logger",
+        .root_source_file = b.path("logger.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/system/services/logger/build.zig.zon b/system/services/logger/build.zig.zon
new file mode 100644
index 0000000..36da39f
--- /dev/null
+++ b/system/services/logger/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .logger,
+    .version = "0.0.0",
+    .fingerprint = 0x987e13f37b0eaea2, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../build-support" },
+        .kernel = .{ .path = "../../../library/kernel" },
+        .device = .{ .path = "../../../library/device" },
+        .client = .{ .path = "../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/args-echo/build.zig b/test/system/services/args-echo/build.zig
new file mode 100644
index 0000000..ec0bf4c
--- /dev/null
+++ b/test/system/services/args-echo/build.zig
@@ -0,0 +1,16 @@
+//! The args-echo test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "args-echo",
+        .root_source_file = b.path("args-echo.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/args-echo/build.zig.zon b/test/system/services/args-echo/build.zig.zon
new file mode 100644
index 0000000..64b5416
--- /dev/null
+++ b/test/system/services/args-echo/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .args_echo,
+    .version = "0.0.0",
+    .fingerprint = 0xcc0ad94cf777eeb, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/crash-test/build.zig b/test/system/services/crash-test/build.zig
new file mode 100644
index 0000000..f68e1fb
--- /dev/null
+++ b/test/system/services/crash-test/build.zig
@@ -0,0 +1,19 @@
+//! The crash-test test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "crash-test",
+        .root_source_file = b.path("crash-test.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(exe).addImport("device-manager-protocol", protocol.module("device-manager-protocol"));
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/crash-test/build.zig.zon b/test/system/services/crash-test/build.zig.zon
new file mode 100644
index 0000000..03b5db8
--- /dev/null
+++ b/test/system/services/crash-test/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .crash_test,
+    .version = "0.0.0",
+    .fingerprint = 0x611122f815277984, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/device-list/build.zig b/test/system/services/device-list/build.zig
new file mode 100644
index 0000000..d09c572
--- /dev/null
+++ b/test/system/services/device-list/build.zig
@@ -0,0 +1,19 @@
+//! The device-list test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const protocol = b.dependency("protocol", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "device-list",
+        .root_source_file = b.path("device-list.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(exe).addImport("device-manager-protocol", protocol.module("device-manager-protocol"));
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/device-list/build.zig.zon b/test/system/services/device-list/build.zig.zon
new file mode 100644
index 0000000..cab7256
--- /dev/null
+++ b/test/system/services/device-list/build.zig.zon
@@ -0,0 +1,15 @@
+.{
+    .name = .device_list,
+    .version = "0.0.0",
+    .fingerprint = 0xcdf12d2276a06cb1, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+        .protocol = .{ .path = "../../../../library/protocol" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/fat-test/build.zig b/test/system/services/fat-test/build.zig
new file mode 100644
index 0000000..01759b2
--- /dev/null
+++ b/test/system/services/fat-test/build.zig
@@ -0,0 +1,16 @@
+//! The fat-test test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "fat-test",
+        .root_source_file = b.path("fat-test.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/fat-test/build.zig.zon b/test/system/services/fat-test/build.zig.zon
new file mode 100644
index 0000000..f9108d8
--- /dev/null
+++ b/test/system/services/fat-test/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .fat_test,
+    .version = "0.0.0",
+    .fingerprint = 0x8dac87d9dc3aabca, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/input-source/build.zig b/test/system/services/input-source/build.zig
new file mode 100644
index 0000000..ea29e4b
--- /dev/null
+++ b/test/system/services/input-source/build.zig
@@ -0,0 +1,16 @@
+//! The input-source test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "input-source",
+        .root_source_file = b.path("input-source.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/input-source/build.zig.zon b/test/system/services/input-source/build.zig.zon
new file mode 100644
index 0000000..627cb7c
--- /dev/null
+++ b/test/system/services/input-source/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .input_source,
+    .version = "0.0.0",
+    .fingerprint = 0x933ef62ed7d33db7, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/input-test/build.zig b/test/system/services/input-test/build.zig
new file mode 100644
index 0000000..32998d3
--- /dev/null
+++ b/test/system/services/input-test/build.zig
@@ -0,0 +1,16 @@
+//! The input-test test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "input-test",
+        .root_source_file = b.path("input-test.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/input-test/build.zig.zon b/test/system/services/input-test/build.zig.zon
new file mode 100644
index 0000000..703dec3
--- /dev/null
+++ b/test/system/services/input-test/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .input_test,
+    .version = "0.0.0",
+    .fingerprint = 0x9b12c53bde4d070e, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/iommu-fault-test/build.zig b/test/system/services/iommu-fault-test/build.zig
new file mode 100644
index 0000000..59ca82e
--- /dev/null
+++ b/test/system/services/iommu-fault-test/build.zig
@@ -0,0 +1,20 @@
+//! The iommu-fault-test test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const device = b.dependency("device", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "iommu-fault-test",
+        .root_source_file = b.path("iommu-fault-test.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(exe).addImport("pci", device.module("pci"));
+    build_support.programModule(exe).addImport("pci-class", device.module("pci-class"));
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/iommu-fault-test/build.zig.zon b/test/system/services/iommu-fault-test/build.zig.zon
new file mode 100644
index 0000000..99d3565
--- /dev/null
+++ b/test/system/services/iommu-fault-test/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .iommu_fault_test,
+    .version = "0.0.0",
+    .fingerprint = 0xd7ec3a4e1a61696c, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/pci-cap-test/build.zig b/test/system/services/pci-cap-test/build.zig
new file mode 100644
index 0000000..c147523
--- /dev/null
+++ b/test/system/services/pci-cap-test/build.zig
@@ -0,0 +1,20 @@
+//! The pci-cap-test test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const device = b.dependency("device", .{});
+
+    const exe = build_support.userBinary(b, .{
+        .name = "pci-cap-test",
+        .root_source_file = b.path("pci-cap-test.zig"),
+        .domains = build_support.domains(b),
+    });
+    build_support.programModule(exe).addImport("pci", device.module("pci"));
+    build_support.programModule(exe).addImport("pci-class", device.module("pci-class"));
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/pci-cap-test/build.zig.zon b/test/system/services/pci-cap-test/build.zig.zon
new file mode 100644
index 0000000..ee9f489
--- /dev/null
+++ b/test/system/services/pci-cap-test/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .pci_cap_test,
+    .version = "0.0.0",
+    .fingerprint = 0x2d4f027d811c3953, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/process-test/build.zig b/test/system/services/process-test/build.zig
new file mode 100644
index 0000000..0c6fcc0
--- /dev/null
+++ b/test/system/services/process-test/build.zig
@@ -0,0 +1,16 @@
+//! The process-test test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "process-test",
+        .root_source_file = b.path("process-test.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/process-test/build.zig.zon b/test/system/services/process-test/build.zig.zon
new file mode 100644
index 0000000..a0f0b3a
--- /dev/null
+++ b/test/system/services/process-test/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .process_test,
+    .version = "0.0.0",
+    .fingerprint = 0x3796ac392c89622b, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/shared-memory-client/build.zig b/test/system/services/shared-memory-client/build.zig
new file mode 100644
index 0000000..11c8d0e
--- /dev/null
+++ b/test/system/services/shared-memory-client/build.zig
@@ -0,0 +1,16 @@
+//! The shared-memory-client test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "shared-memory-client",
+        .root_source_file = b.path("shared-memory-client.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/shared-memory-client/build.zig.zon b/test/system/services/shared-memory-client/build.zig.zon
new file mode 100644
index 0000000..1947d3e
--- /dev/null
+++ b/test/system/services/shared-memory-client/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .shared_memory_client,
+    .version = "0.0.0",
+    .fingerprint = 0xc3945d0308ff5720, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/shared-memory-server/build.zig b/test/system/services/shared-memory-server/build.zig
new file mode 100644
index 0000000..09431ed
--- /dev/null
+++ b/test/system/services/shared-memory-server/build.zig
@@ -0,0 +1,16 @@
+//! The shared-memory-server test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "shared-memory-server",
+        .root_source_file = b.path("shared-memory-server.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/shared-memory-server/build.zig.zon b/test/system/services/shared-memory-server/build.zig.zon
new file mode 100644
index 0000000..17c0c2e
--- /dev/null
+++ b/test/system/services/shared-memory-server/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .shared_memory_server,
+    .version = "0.0.0",
+    .fingerprint = 0x5ebd8ca0f8a1675b, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/thread-test/build.zig b/test/system/services/thread-test/build.zig
new file mode 100644
index 0000000..ba0ffe1
--- /dev/null
+++ b/test/system/services/thread-test/build.zig
@@ -0,0 +1,16 @@
+//! The thread-test test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "thread-test",
+        .root_source_file = b.path("thread-test.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/thread-test/build.zig.zon b/test/system/services/thread-test/build.zig.zon
new file mode 100644
index 0000000..35bd5d6
--- /dev/null
+++ b/test/system/services/thread-test/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .thread_test,
+    .version = "0.0.0",
+    .fingerprint = 0x5cce628236ddbf19, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}
diff --git a/test/system/services/vfs-test/build.zig b/test/system/services/vfs-test/build.zig
new file mode 100644
index 0000000..b7c7301
--- /dev/null
+++ b/test/system/services/vfs-test/build.zig
@@ -0,0 +1,16 @@
+//! The vfs-test test fixture as a binary package (docs/build-packages-plan.md,
+//! phase 2): this file names only what is specific to this binary — the shared
+//! recipe and the default-import wiring live in build-support. The root build
+//! consumes the artifact(s) for the boot image.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "vfs-test",
+        .root_source_file = b.path("vfs-test.zig"),
+        .domains = build_support.domains(b),
+    });
+    b.installArtifact(exe);
+}
diff --git a/test/system/services/vfs-test/build.zig.zon b/test/system/services/vfs-test/build.zig.zon
new file mode 100644
index 0000000..f19266a
--- /dev/null
+++ b/test/system/services/vfs-test/build.zig.zon
@@ -0,0 +1,14 @@
+.{
+    .name = .vfs_test,
+    .version = "0.0.0",
+    .fingerprint = 0x29b5b8c468cdfe6e, // Changing this has security and trust implications.
+    .minimum_zig_version = "0.16.0",
+    .dependencies = .{
+        .@"build-support" = .{ .path = "../../../../build-support" },
+        .kernel = .{ .path = "../../../../library/kernel" },
+        .device = .{ .path = "../../../../library/device" },
+        .client = .{ .path = "../../../../library/client" },
+        .@"xkeyboard-config" = .{ .path = "../../../../library/xkeyboard-config" },
+    },
+    .paths = .{""},
+}